@mutmutco/cli 4.5.123 → 4.5.125

package/dist/main.cjs

@@ -76,19 +76,19 @@ function hardExit(code) {
   process.exit(code);
 }
 function flushStream(stream) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     try {
-      stream.write("", () => resolve7());
+      stream.write("", () => resolve8());
     } catch {
-      resolve7();
+      resolve8();
     }
   });
 }
 async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
   await Promise.race([
     Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
-    new Promise((resolve7) => {
-      setTimeout(resolve7, timeoutMs).unref?.();
+    new Promise((resolve8) => {
+      setTimeout(resolve8, timeoutMs).unref?.();
     })
   ]);
 }
@@ -96,7 +96,7 @@ async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
   await flushStdio();
-  await new Promise((resolve7) => setImmediate(resolve7));
+  await new Promise((resolve8) => setImmediate(resolve8));
   return void 0;
 }
 async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
@@ -644,7 +644,7 @@ function rateLimitedReceipt(opts) {
   };
 }
 async function runWithRateLimitBackoff(operation, opts) {
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = opts.now ?? Date.now;
   const log = opts.log ?? ((message2) => console.warn(message2));
   const capMs = opts.capMs ?? RATE_LIMIT_WAIT_CAP_MS;
@@ -734,7 +734,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -1057,8 +1057,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve7) => {
-    timer = setTimeout(resolve7, timeoutMs);
+  const timeout = new Promise((resolve8) => {
+    timer = setTimeout(resolve8, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -1125,12 +1125,12 @@ function killProcessTree(pid) {
 function execFileHard(file, args, options) {
   const { timeout, step, ...rest } = options;
   const started = Date.now();
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const child2 = (0, import_node_child_process2.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
       clearTimeout(timer);
       if (expired) return;
       if (error) reject(error);
-      else resolve7({ stdout: String(stdout), stderr: String(stderr) });
+      else resolve8({ stdout: String(stdout), stderr: String(stderr) });
     });
     let expired = false;
     const timer = setTimeout(() => {
@@ -5119,8 +5119,8 @@ function survivingFlagArgs(argv, rejectedFlag, ownFlags) {
   return out;
 }
 function formatPositionalTarget(commandPath3, argName, opts = {}) {
-  const concrete = opts.flag && opts.argv ? targetFlagValueFromArgv(opts.flag, opts.argv) : void 0;
-  const target = concrete ?? `<${argName}>`;
+  const concrete2 = opts.flag && opts.argv ? targetFlagValueFromArgv(opts.flag, opts.argv) : void 0;
+  const target = concrete2 ?? `<${argName}>`;
   const kept = opts.flag && opts.argv && opts.ownFlags ? survivingFlagArgs(opts.argv, opts.flag, opts.ownFlags) : [];
   return [`mmi-cli ${commandPath3}`, target, ...kept].join(" ");
 }
@@ -5656,7 +5656,7 @@ function resolveVerbAliasShim(argv) {
 
 // src/command-composition.ts
 var import_node_os25 = require("node:os");
-var import_node_path54 = require("node:path");
+var import_node_path56 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs14 = require("node:fs");
@@ -5789,6 +5789,8 @@ var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
   "read run view",
   "read run list",
   "read run watch",
+  "read run log",
+  // #8136: bounded jobs/logs REST read, same polling credential.
   "read pr view",
   "read pr checks",
   "read issue view",
@@ -6733,7 +6735,7 @@ async function readRestPrSnapshotWithRetry(prNumber, repo, gh2 = defaultGhApi, o
   const retries = options?.retries ?? PR_SNAPSHOT_READ_RETRIES;
   const untilMs = options?.retryTransientUntilMs;
   const delayMs = options?.delayMs ?? (untilMs !== void 0 ? PR_CHECKS_POLL_MS : PR_SNAPSHOT_READ_DELAY_MS);
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = options?.now ?? (() => Date.now());
   let lastError = "no attempt completed";
   let attempt = 0;
@@ -10108,18 +10110,18 @@ function isGhHttpNotFound(err) {
 function isForkStyleHead(head) {
   return head.includes(":");
 }
-async function defaultReadRemoteHead(exec2, repo, head) {
+async function defaultReadRemoteHead(exec3, repo, head) {
   try {
-    await exec2("gh", ["api", `repos/${repo}/git/ref/heads/${encodeURIComponent(head)}`], { timeout: 15e3 });
+    await exec3("gh", ["api", `repos/${repo}/git/ref/heads/${encodeURIComponent(head)}`], { timeout: 15e3 });
     return "present";
   } catch (e) {
     if (isGhHttpNotFound(e)) return "absent";
     return "unknown";
   }
 }
-async function defaultCompareRefs(exec2, repo, base, head) {
+async function defaultCompareRefs(exec3, repo, base, head) {
   try {
-    const { stdout } = await exec2(
+    const { stdout } = await exec3(
       "gh",
       ["api", `repos/${repo}/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}`],
       { timeout: 15e3 }
@@ -10130,11 +10132,11 @@ async function defaultCompareRefs(exec2, repo, base, head) {
     return "unknown";
   }
 }
-async function publishAbsentPrHeadIfOwned(repo, head, exec2) {
+async function publishAbsentPrHeadIfOwned(repo, head, exec3) {
   if (isForkStyleHead(head)) return false;
   let originRepo;
   try {
-    const { stdout } = await exec2("git", ["remote", "get-url", "--push", "origin"], { timeout: GIT_TIMEOUT_MS });
+    const { stdout } = await exec3("git", ["remote", "get-url", "--push", "origin"], { timeout: GIT_TIMEOUT_MS });
     originRepo = repoFromRemoteUrl(stdout.trim());
   } catch {
     return false;
@@ -10142,20 +10144,20 @@ async function publishAbsentPrHeadIfOwned(repo, head, exec2) {
   if (!originRepo || originRepo.toLowerCase() !== repo.toLowerCase()) return false;
   let currentBranch2;
   try {
-    currentBranch2 = (await exec2("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
+    currentBranch2 = (await exec3("git", ["symbolic-ref", "--quiet", "--short", "HEAD"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
   } catch {
     return false;
   }
   if (!currentBranch2 || currentBranch2 !== head) return false;
   let commit;
   try {
-    commit = (await exec2("git", ["rev-parse", "--verify", "HEAD^{commit}"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
+    commit = (await exec3("git", ["rev-parse", "--verify", "HEAD^{commit}"], { timeout: GIT_TIMEOUT_MS })).stdout.trim();
   } catch {
     return false;
   }
   if (!commit) return false;
   try {
-    await exec2("git", ["push", "origin", `${commit}:refs/heads/${head}`], { timeout: GH_MUTATION_TIMEOUT_MS });
+    await exec3("git", ["push", "origin", `${commit}:refs/heads/${head}`], { timeout: GH_MUTATION_TIMEOUT_MS });
     return true;
   } catch {
     return false;
@@ -10285,22 +10287,22 @@ function upstreamFaultMessage(verb, stderr) {
   const advice = mayRetryCreate(verb) ? "Retrying is the right action" : "The write may have completed server-side before the error \u2014 VERIFY before retrying, or a retry will duplicate it";
   return `gh ${verb} create failed: GitHub's API is failing (server-side 5xx) \u2014 this is NOT a problem with your diff or arguments. GitHub request ID: ${requestId ?? "unavailable"}. ${advice}; note githubstatus.com may still read green while this is happening.`;
 }
-async function resolveRepoForCreate(args, exec2) {
+async function resolveRepoForCreate(args, exec3) {
   const fromFlag = flagValue(args, "--repo");
   if (fromFlag) return fromFlag;
   try {
-    const { stdout } = await exec2("git", ["remote", "get-url", "origin"], { timeout: 1e4 });
+    const { stdout } = await exec3("git", ["remote", "get-url", "origin"], { timeout: 1e4 });
     const fromOrigin = repoFromRemoteUrl(stdout.trim());
     if (fromOrigin) return fromOrigin;
   } catch {
   }
   return repoFromRemoteUrl(originUrlFromGitConfig() ?? "") || void 0;
 }
-async function resolveHeadForCreate(args, exec2) {
+async function resolveHeadForCreate(args, exec3) {
   const fromFlag = flagValue(args, "--head");
   if (fromFlag) return fromFlag;
   try {
-    const { stdout } = await exec2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { timeout: 1e4 });
+    const { stdout } = await exec3("git", ["rev-parse", "--abbrev-ref", "HEAD"], { timeout: 1e4 });
     const head = stdout.trim();
     return head && head !== "HEAD" ? head : void 0;
   } catch {
@@ -10312,13 +10314,13 @@ async function resolveBodyForCreate(args, read) {
   if (bodyFile !== void 0) return read(bodyFile, "utf8");
   return flagValue(args, "--body") ?? "";
 }
-async function defaultFindOpenPr(exec2, input) {
+async function defaultFindOpenPr(exec3, input) {
   const owner = input.repo.split("/")[0];
   if (!owner) return void 0;
   const qs = new URLSearchParams({ state: "open", head: `${owner}:${input.head}` });
   if (input.base) qs.set("base", input.base);
   try {
-    const { stdout } = await exec2("gh", ["api", `repos/${input.repo}/pulls?${qs.toString()}`], { timeout: GH_MUTATION_TIMEOUT_MS });
+    const { stdout } = await exec3("gh", ["api", `repos/${input.repo}/pulls?${qs.toString()}`], { timeout: GH_MUTATION_TIMEOUT_MS });
     const rows = JSON.parse(stdout);
     const first = Array.isArray(rows) ? rows[0] : void 0;
     if (typeof first?.number === "number" && typeof first.html_url === "string") {
@@ -10328,7 +10330,7 @@ async function defaultFindOpenPr(exec2, input) {
   }
   return void 0;
 }
-async function defaultRestCreatePr(exec2, input, deps = {}) {
+async function defaultRestCreatePr(exec3, input, deps = {}) {
   const write = deps.write ?? import_promises.writeFile;
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
@@ -10353,7 +10355,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
     file
   ];
   try {
-    const { stdout } = await exec2("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
+    const { stdout } = await exec3("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
     const parsed = JSON.parse(stdout);
     if (typeof parsed.number === "number" && typeof parsed.html_url === "string") {
       return { number: parsed.number, url: parsed.html_url };
@@ -10365,7 +10367,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
     const fromText = parseExistingPr(text);
     if (fromText) return { ...fromText, existing: true };
     if (/already exists/i.test(text)) {
-      const found = await defaultFindOpenPr(exec2, { repo: input.repo, head: input.head, base: input.base });
+      const found = await defaultFindOpenPr(exec3, { repo: input.repo, head: input.head, base: input.base });
       if (found) return found;
     }
     throw e;
@@ -10376,7 +10378,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
     }
   }
 }
-async function defaultRestCreateIssue(exec2, input) {
+async function defaultRestCreateIssue(exec3, input) {
   const args = [
     "api",
     "--method",
@@ -10391,7 +10393,7 @@ async function defaultRestCreateIssue(exec2, input) {
     args.push("-f", `labels[]=${label}`);
   }
   try {
-    const { stdout } = await exec2("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
+    const { stdout } = await exec3("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS });
     const parsed = JSON.parse(stdout);
     if (typeof parsed.number === "number" && typeof parsed.html_url === "string") {
       return { number: parsed.number, url: parsed.html_url };
@@ -10410,9 +10412,9 @@ ${err.stdout ?? ""}`;
     throw e;
   }
 }
-async function defaultReadRateLimit(exec2) {
+async function defaultReadRateLimit(exec3) {
   try {
-    const { stdout } = await exec2("gh", ["api", "rate_limit"], { timeout: 15e3 });
+    const { stdout } = await exec3("gh", ["api", "rate_limit"], { timeout: 15e3 });
     return parseRateLimitPools(stdout);
   } catch {
     return {};
@@ -10585,17 +10587,17 @@ async function createPrViaRestFallback(args, swappedArgs, deps, knownPools) {
   }
 }
 async function ghCreate(args, deps = {}) {
-  const exec2 = deps.exec ?? execFileP;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const exec3 = deps.exec ?? execFileP;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = deps.now ?? Date.now;
   const read = deps.readFile ?? import_promises.readFile;
-  const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec2, input));
-  const restCreateIssue = deps.restCreateIssue ?? ((input) => defaultRestCreateIssue(exec2, input));
-  const findOpenPr = deps.findOpenPr ?? ((input) => defaultFindOpenPr(exec2, input));
-  const readRateLimit = deps.readRateLimit ?? (() => defaultReadRateLimit(exec2));
+  const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec3, input));
+  const restCreateIssue = deps.restCreateIssue ?? ((input) => defaultRestCreateIssue(exec3, input));
+  const findOpenPr = deps.findOpenPr ?? ((input) => defaultFindOpenPr(exec3, input));
+  const readRateLimit = deps.readRateLimit ?? (() => defaultReadRateLimit(exec3));
   if (args[0] === "pr") {
     const refusal = await preflightPrCreateRemoteHead(args, {
-      exec: exec2,
+      exec: exec3,
       readRemoteHead: deps.readRemoteHead,
       compareRefs: deps.compareRefs
     });
@@ -10603,7 +10605,7 @@ async function ghCreate(args, deps = {}) {
   }
   const swapped = await bodyArgsViaFile(args);
   const restDeps = {
-    exec: exec2,
+    exec: exec3,
     sleep: sleep2,
     now,
     readFile: read,
@@ -10646,7 +10648,7 @@ async function ghCreate(args, deps = {}) {
     }
     for (let attempt = 1; attempt <= GH_CREATE_UPSTREAM_RETRIES; attempt++) {
       try {
-        const { stdout } = await exec2("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
+        const { stdout } = await exec3("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
         return parseCreatedUrl(stdout);
       } catch (e) {
         const err = e;
@@ -10664,7 +10666,7 @@ async function ghCreate(args, deps = {}) {
         if (args[0] === "issue" && isGhRateLimitError(errText)) {
           try {
             const result = await createIssueViaRestFallback(args, swapped.args, {
-              exec: exec2,
+              exec: exec3,
               sleep: sleep2,
               now,
               readFile: read,
@@ -11414,8 +11416,8 @@ var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
     closeHttpPool().then(() => true),
-    new Promise((resolve7) => {
-      setTimeout(() => resolve7(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
+    new Promise((resolve8) => {
+      setTimeout(() => resolve8(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
     })
   ]);
   if (!drained) destroyHttpPool();
@@ -15002,7 +15004,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -15785,6 +15787,135 @@ function checkCommands(docs, commandPaths) {
   }
   return { ok: findings.length === 0, findings, warnings: [] };
 }
+function isRunbook(doc, body) {
+  return doc === "docs/Guides/operator.md" || body.split(/\r?\n/).slice(0, 20).some((line) => line.includes("<!-- runbook -->"));
+}
+function shellClaims(body) {
+  const claims = [];
+  let fence = "";
+  let enabled = false;
+  body.split(/\r?\n/).forEach((text, index) => {
+    const marker = /^\s*(`{3,}|~{3,})(.*)$/.exec(text);
+    if (marker) {
+      if (!fence) {
+        fence = marker[1];
+        enabled = /^(bash|sh|shell|console)?$/.test(marker[2].trim().toLowerCase());
+      } else if (marker[1][0] === fence[0] && marker[1].length >= fence.length && !marker[2].trim()) {
+        fence = "";
+        enabled = false;
+      }
+      return;
+    }
+    if (!enabled || /^\s*#/.test(text)) return;
+    const parts = text.replace(/^\s*\$ /, "").match(/(?:"[^"\n]*"|'[^'\n]*'|<[^>\n]*>|[^\s;&|])+|&&|\|\||[;|]/g) ?? [];
+    let tokens2 = [];
+    const emit = () => {
+      while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens2[0] ?? "")) tokens2.shift();
+      if (tokens2.length) claims.push({ tokens: tokens2, line: index + 1 });
+      tokens2 = [];
+    };
+    for (const part of parts) {
+      if (part.startsWith("#")) break;
+      if (["&&", "||", ";", "|"].includes(part)) emit();
+      else tokens2.push(part.replace(/^(["'])(.*)\1$/, "$2"));
+    }
+    emit();
+  });
+  return claims;
+}
+function checkRunbookClaims(root, docs, deps) {
+  const findings = [];
+  const placeholder = (token) => token.includes("<");
+  const paths = deps.commandPaths ?? /* @__PURE__ */ new Set();
+  for (const [doc, body] of Object.entries(docs)) {
+    for (const { tokens: tokens2, line } of shellClaims(body)) {
+      const [cmd, ...args] = tokens2;
+      const report = (kind, detail) => {
+        findings.push({ kind, doc, line, detail });
+      };
+      if (cmd === "mmi-cli" && deps.commandPaths) {
+        let resolved = "";
+        let unknown = false;
+        for (const token of args) {
+          if (token.startsWith("-") || placeholder(token)) break;
+          const next = resolved ? `${resolved} ${token}` : token;
+          if ([...paths].some((path2) => path2 === next || path2.startsWith(`${next} `))) resolved = next;
+          else if (paths.has(resolved)) break;
+          else {
+            report("unknown-command", `mmi-cli ${next}`);
+            unknown = true;
+            break;
+          }
+        }
+        for (const token of unknown ? [] : args) {
+          if (token === "--") break;
+          const flag = token.split("=")[0];
+          if (/^--[\w-]+$/.test(flag) && flag !== "--help" && !placeholder(flag) && !deps.commandOptions?.get(resolved)?.has(flag)) {
+            report("unknown-flag", `mmi-cli ${resolved}: ${flag}`);
+          }
+        }
+      } else if (cmd === "npm") {
+        const run = args.indexOf("run");
+        if (run < 0) continue;
+        const prefix = args.indexOf("--prefix");
+        const dir = prefix >= 0 ? args[prefix + 1] : ".";
+        const script = args.slice(run + 1).find((token, i, tail) => !token.startsWith("-") && tail[i - 1] !== "--prefix");
+        if (!dir || !script || placeholder(dir) || placeholder(script)) continue;
+        const manifest = deps.readFile((0, import_node_path13.join)(root, dir, "package.json"));
+        const scripts = manifest ? JSON.parse(manifest).scripts : void 0;
+        if (!scripts || !Object.hasOwn(scripts, script)) report("missing-script", `npm run ${script} (${dir}/package.json)`);
+      } else if ((cmd === "python" || cmd === "python3") && args[0] === "-m") {
+        const module2 = args[1];
+        if (!module2 || placeholder(module2)) continue;
+        const rel = module2.replaceAll(".", "/");
+        const first = rel.split("/")[0];
+        const tracked = deps.trackedFirstSegments([first, `${first}.py`, `src/${first}`, `src/${first}.py`]);
+        const roots = ["", "src/"].filter((prefix) => {
+          if (!prefix) return tracked ? tracked.has(first) || tracked.has(`${first}.py`) : deps.exists((0, import_node_path13.join)(root, first)) || deps.exists((0, import_node_path13.join)(root, `${first}.py`));
+          return tracked ? tracked.has(`src/${first}`) || tracked.has(`src/${first}.py`) : deps.exists((0, import_node_path13.join)(root, "src", first)) || deps.exists((0, import_node_path13.join)(root, "src", `${first}.py`));
+        });
+        if (roots.length && !roots.some((prefix) => [".py", "/__init__.py", "/__main__.py"].some((suffix) => deps.exists((0, import_node_path13.join)(root, `${prefix}${rel}${suffix}`))))) {
+          report("missing-module", module2);
+        }
+      } else if (["node", "bash", "sh"].includes(cmd)) {
+        const rel = args[0];
+        if (!rel || rel.startsWith("-") || placeholder(rel) || /^(\/|[A-Za-z]:|\.\.\/)/.test(rel)) continue;
+        const first = refFirstSegment(rel);
+        const tracked = deps.trackedFirstSegments([first]);
+        if ((tracked ? tracked.has(first) : deps.exists((0, import_node_path13.join)(root, first))) && !deps.exists((0, import_node_path13.join)(root, rel)) && !deps.isIgnored([rel]).has(rel)) report("missing-path", rel);
+      }
+    }
+  }
+  return findings;
+}
+function checkRunbookCoverage(docs, base, git3) {
+  const changed = git3(["diff", "--name-only", `${base}...HEAD`]).split(/\r?\n/).filter(Boolean);
+  const findings = [];
+  const matches = (glob, path2) => {
+    const pattern = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*\*/g, "
").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replaceAll("\0", "(?:.*/)?").replaceAll("
", ".*");
+    return new RegExp(`^${pattern}$`).test(path2);
+  };
+  for (const [doc, body] of Object.entries(docs)) {
+    const lines2 = stripFences(body);
+    const headings = lines2.flatMap((text, i) => {
+      const match = /^(#{1,6})\s+(.+)$/.exec(text);
+      return match ? [{ level: match[1].length, title: match[2], start: i + 1 }] : [];
+    });
+    const diff = git3(["diff", "-U0", `${base}...HEAD`, "--", doc]);
+    const ranges = [...diff.matchAll(/^@@ .*?\+(\d+)(?:,(\d+))? @@/gm)].map((m) => ({ start: Number(m[1]), count: m[2] === void 0 ? 1 : Number(m[2]) }));
+    for (let i = 0; i < headings.length; i++) {
+      const heading = headings[i];
+      const end = headings.slice(i + 1).find((h) => h.level <= heading.level)?.start ?? lines2.length + 1;
+      const markerEnd = headings[i + 1]?.start ?? end;
+      const globs = lines2.slice(heading.start, markerEnd - 1).flatMap((text) => /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim()) ?? []);
+      const affected = changed.filter((path2) => globs.some((glob) => matches(glob, path2)));
+      if (affected.length && !ranges.some((r) => r.count > 0 && r.start < end && r.start + r.count > heading.start)) {
+        findings.push({ kind: "runbook-section-stale", doc, line: heading.start, detail: `${heading.title}: changed ${affected.join(", ")}; update this section or declare Runbook-Unaffected: <reason>` });
+      }
+    }
+  }
+  return findings;
+}
 function readFileOrNull(path2) {
   return (0, import_node_fs15.existsSync)(path2) ? (0, import_node_fs15.readFileSync)(path2, "utf8") : null;
 }
@@ -15806,11 +15937,11 @@ function defaultListDocs(root) {
   return [...ROOT_DOCS.filter((rel) => (0, import_node_fs15.existsSync)((0, import_node_path13.join)(root, rel))), ...docs];
 }
 var CHECK_IGNORE_MAX_BUFFER = 32 * 1024 * 1024;
-function defaultIsIgnored(root, relPaths, exec2 = import_node_child_process6.execFileSync) {
+function defaultIsIgnored(root, relPaths, exec3 = import_node_child_process6.execFileSync) {
   const inRepo = relPaths.filter((p) => !p.startsWith(".."));
   if (inRepo.length === 0) return /* @__PURE__ */ new Set();
   try {
-    const out = exec2("git", ["check-ignore", "--stdin"], {
+    const out = exec3("git", ["check-ignore", "--stdin"], {
       cwd: root,
       input: inRepo.join("\n"),
       encoding: "utf8",
@@ -15829,17 +15960,19 @@ function defaultIsIgnored(root, relPaths, exec2 = import_node_child_process6.exe
     throw error;
   }
 }
-function defaultTrackedFirstSegments(root, firstSegments, exec2 = import_node_child_process6.execFileSync) {
+function defaultTrackedFirstSegments(root, firstSegments, exec3 = import_node_child_process6.execFileSync) {
   if (firstSegments.length === 0) return /* @__PURE__ */ new Set();
   try {
-    const out = exec2("git", ["ls-files", "-z", "--", ...firstSegments.map((s) => `:(literal)${s}`)], {
+    const out = exec3("git", ["ls-files", "-z", "--", ...firstSegments.map((s) => `:(literal)${s}`)], {
       cwd: root,
       encoding: "utf8",
       maxBuffer: CHECK_IGNORE_MAX_BUFFER
     });
     const tracked = /* @__PURE__ */ new Set();
     for (const path2 of out.split("\0")) {
-      if (path2) tracked.add(path2.split("/")[0]);
+      if (path2) for (const segment of firstSegments) {
+        if (path2 === segment || path2.startsWith(`${segment}/`)) tracked.add(segment);
+      }
     }
     return tracked;
   } catch (error) {
@@ -15863,7 +15996,7 @@ function runDocRefs(root, deps = {}) {
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs = Object.fromEntries(
-    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path13.join)(root, rel))]).filter(([, body]) => body != null)
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path13.join)(root, rel))]).filter(([rel, body]) => body != null && (!deps.runbooksOnly || isRunbook(rel, body)))
   );
   const refResult = checkRefs(root, { exists, isIgnored, trackedFirstSegments }, docs);
   const findings = [
@@ -15880,10 +16013,22 @@ function runDocRefs(root, deps = {}) {
   } else {
     findings.push(...checkCommands(docs, commandPaths).findings);
   }
+  const runbooks = Object.fromEntries(Object.entries(docs).filter(([doc, body]) => isRunbook(doc, body)));
+  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile10, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions }));
+  const warnings = [...refResult.warnings];
+  if (deps.runbooksOnly && !Object.keys(runbooks).length) {
+    warnings.push({ kind: "runbook-missing", doc: "docs/Guides/operator.md", line: 0, detail: "no operator runbook or <!-- runbook --> document exists" });
+  }
+  if (deps.base) {
+    const git3 = deps.git ?? ((args) => (0, import_node_child_process6.execFileSync)("git", args, { cwd: root, encoding: "utf8", maxBuffer: CHECK_IGNORE_MAX_BUFFER, windowsHide: true }));
+    const stale = checkRunbookCoverage(runbooks, deps.base, git3);
+    const override = /^Runbook-Unaffected:[ \t]*\S.*$/m.test(git3(["log", "--format=%B", `${deps.base}..HEAD`]));
+    (override ? warnings : findings).push(...stale);
+  }
   return {
     ok: findings.length === 0,
     findings,
-    warnings: refResult.warnings,
+    warnings,
     docCount: Object.keys(docs).length
   };
 }
@@ -16001,6 +16146,7 @@ function createDocsIndexDeps(repoRoot2) {
 // src/gate-budget.ts
 var BLESSED_RUN_WITH_BUDGET_SHA = "5ce541add569e54e7ca96de67a768577d3d604e4";
 var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
+var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
 var FULL_SHA = /^[0-9a-f]{40}$/;
@@ -16375,6 +16521,8 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     // The pin is the CLI's blessed SHA, not an operator knob — one central place to bump (#3178).
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA,
     GATE_RUNNER_SHA: BLESSED_RUNNER_GATE_SHA,
+    // #8129: the guard and its bundled CLI must come from the same immutable Hub revision.
+    GATE_RUNBOOK_SHA: BLESSED_RUNBOOK_GUARD_SHA,
     // #7407: repo-declared service containers and extra check steps; empty renders today's gate byte-for-byte.
     GATE_SERVICES_YAML: "",
     GATE_EXTRA_STEPS_YAML: ""
@@ -16412,6 +16560,8 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
 }
 function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranches, requiredChecks) {
   const out = { ...vars };
+  out.OWNER ??= parsed.owner;
+  out.REPO ??= parsed.name;
   out.REPO_NAME ??= parsed.name;
   out.REPO_SLUG ??= parsed.slug;
   out.CLASS ??= cls;
@@ -18093,10 +18243,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.123",
-    tag: "v4.5.123",
-    commit: "056fe18dfd23",
-    npm: "@mutmutco/cli@4.5.123"
+    version: "4.5.125",
+    tag: "v4.5.125",
+    commit: "00accba6d8e0",
+    npm: "@mutmutco/cli@4.5.125"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18113,14 +18263,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.123"
+          v3Target: "v4.5.125"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.123 and redeploy the Hub Lambda from tag v4.5.123 (056fe18dfd23); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.123 (@mutmutco/cli@4.5.123, tag commit 056fe18dfd23 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.125 and redeploy the Hub Lambda from tag v4.5.125 (00accba6d8e0); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.125 (@mutmutco/cli@4.5.125, tag commit 00accba6d8e0 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20203,7 +20353,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve7, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve8, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -20217,7 +20367,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve7, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve7}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve8}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -20397,7 +20547,7 @@ var CORRELATE_SKEW_SLACK_MS = 1e4;
 var CORRELATE_PAGE_LIMIT = 50;
 var RUN_CONFIRM_ATTEMPTS = 3;
 var RUN_CONFIRM_DELAY_MS = 1e3;
-var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var defaultSleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep;
 }
@@ -20977,6 +21127,14 @@ async function isStrayUnreleasedTag(deps, tag, remoteSha, repo) {
   }
   return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
 }
+async function isPromotedUnreleasedTag(deps, tag, remoteSha, repo) {
+  try {
+    await deps.run("git", ["merge-base", "--is-ancestor", remoteSha, "origin/main"]);
+  } catch {
+    return false;
+  }
+  return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
+}
 function cmpReleaseTag(a, b) {
   const parse2 = (t) => {
     const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(t.trim());
@@ -23568,7 +23726,7 @@ function lockTokenPid(token) {
   const m = /^(\d+)-/.exec(token);
   return m ? Number(m[1]) : void 0;
 }
-var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
   lockPath;
@@ -24444,7 +24602,7 @@ async function defaultWatchRun(deps, runId, repo) {
   }
   let confirmError;
   for (let attempt = 0; attempt < RUN_CONFIRM_ATTEMPTS2; attempt++) {
-    if (attempt > 0) await new Promise((resolve7) => setTimeout(resolve7, RUN_CONFIRM_DELAY_MS2));
+    if (attempt > 0) await new Promise((resolve8) => setTimeout(resolve8, RUN_CONFIRM_DELAY_MS2));
     try {
       const parsed = JSON.parse(await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--json", "status,conclusion"]));
       if (parsed.status === "completed") return parsed.conclusion === "success" ? "success" : "failure";
@@ -25486,11 +25644,11 @@ var defaultDeps = {
   // #5813: the caller supplies that command line. `process.argv` is NOT it — the house shim splices
   // the house root out in place, so re-reading it here re-ran the removed flat alias (`release …`
   // instead of `devops release …`) and the converged child refused with exit 2.
-  reexec: (argv) => new Promise((resolve7) => {
+  reexec: (argv) => new Promise((resolve8) => {
     const args = [...argv];
     const child2 = isWin2 ? (0, import_node_child_process8.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", windowsHide: true }) : (0, import_node_child_process8.spawn)("mmi-cli", args, { stdio: "inherit", windowsHide: true });
-    child2.on("exit", (code) => resolve7(code ?? 1));
-    child2.on("error", () => resolve7(1));
+    child2.on("exit", (code) => resolve8(code ?? 1));
+    child2.on("error", () => resolve8(1));
   }),
   // stderr only — stdout may be carrying --json output.
   warn: (line) => console.error(line)
@@ -25596,7 +25754,7 @@ var defaultDeps2 = {
     }
   },
   registryWhoami: probeRegistryWhoami,
-  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+  sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
   env: process.env
 };
 function message(e) {
@@ -27609,7 +27767,9 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
     for (const note of reverifyNotes) deps.warn?.(`release ledger: ${note}`);
   }
   const ledgerMode = persisted ? "strict" : "migration";
-  const partialRelease = await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo);
+  const preMainPartial = await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo);
+  const promotedPartial = !preMainPartial && await isPromotedUnreleasedTag(deps, tag, tagSha, ctx.repo);
+  const partialRelease = preMainPartial || promotedPartial;
   if (partialRelease && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
   if (!partialRelease) {
     try {
@@ -27726,7 +27886,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       note: state2 === "failed" ? `release ${tag} was already published, but its deploy/publish on the release SHA FAILED \u2014 re-run the failed job (do NOT re-tag); the protected alignment PRs were reused` : state2 === "pending" ? `release ${tag} was already published; reused its protected alignment PRs, but a deploy/publish or alignment follow-up is unresolved \u2014 watch it to completion` : `release ${tag} was already published; alignment is complete and the deploy on the release SHA is proven green`
     };
   }
-  if (!await probeAncestor(deps, "origin/main", tagSha, "release --resume: origin/main fast-forward ancestry")) {
+  if (!promotedPartial && !await probeAncestor(deps, "origin/main", tagSha, "release --resume: origin/main fast-forward ancestry")) {
     throw new Error(
       `release --resume: origin/main is not an ancestor of ${tag} (${tagSha.slice(0, 12)}) \u2014 main has moved on since the partial release, so finishing it here would not be a fast-forward. Resolve by hand; nothing was written.`
     );
@@ -27772,9 +27932,9 @@ ${recovery.note}`), recoveryInput);
   }
   await recordPhase(ledger, deps, anchors, "ordinaryCi", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified the required-check wall live on this resume" }), { strict: ledgerMode === "strict", landed: "the immutable tag on origin at the resumed SHA" });
   deps.warn?.("Release: Promoting the verified release");
-  const versionEnv = await pushAfterVercelVersionEnv(deps, meta, "main", tag, ["push", "origin", `${tagSha}:refs/heads/main`]);
-  steps.push(`pushed ${tagSha.slice(0, 12)} to origin/main`);
-  await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
+  const versionEnv = promotedPartial ? { status: "skipped", note: "" } : await pushAfterVercelVersionEnv(deps, meta, "main", tag, ["push", "origin", `${tagSha}:refs/heads/main`]);
+  steps.push(promotedPartial ? `origin/main already contains ${tagSha.slice(0, 12)} (the main push had landed): not pushed again` : `pushed ${tagSha.slice(0, 12)} to origin/main`);
+  await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: promotedPartial ? "re-verified live: origin/main contains the immutable tag SHA (#8128)" : `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
   deps.warn?.("Release: Creating the GitHub Release");
   const autoRunSince = (deps.now ?? Date.now)();
   const cutBy = (await ledger.load(anchors))?.cutBy ?? describeSessionIdentity();
@@ -37002,7 +37162,7 @@ function readSuiteCut(path2) {
   } catch {
     throw new Error(`suite cut record unreadable at ${path2}; repair it, never recut`);
   }
-  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinsUnchanged !== void 0 && (record.pinsUnchanged !== true || record.pinPr !== void 0) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr && !record.pinsUnchanged) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0) || m.ruleset !== void 0 && (!["rc", "main"].includes(m.ruleset.after) || typeof m.ruleset.ok !== "boolean" || !Array.isArray(m.ruleset.lines))))
+  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinsUnchanged !== void 0 && (record.pinsUnchanged !== true || record.pinPr !== void 0) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr && !record.pinsUnchanged) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.carriedPublished !== void 0 && (m.carriedPublished !== true || !m.carried) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0) || m.ruleset !== void 0 && (!["rc", "main"].includes(m.ruleset.after) || typeof m.ruleset.ok !== "boolean" || !Array.isArray(m.ruleset.lines))))
     throw new Error(`suite cut record has unknown or invalid state at ${path2}; repair it, never recut`);
   return record;
 }
@@ -37114,7 +37274,22 @@ async function pendingBackend(deps, m, dev) {
   const files = (await deps.changedPaths(m.repo, live, dev)).filter((f) => !NOT_BACKEND.test(f));
   return files.length ? `${files.length} backend file(s) changed since live ${version}, e.g. ${files[0]}` : "";
 }
+function existingCutDescription(record) {
+  const tags = [...record.members.flatMap((m) => m.tag ? [m.tag] : []), ...record.leadRcTag ? [record.leadRcTag] : []];
+  return `from ${record.leadDevelopment.slice(0, 12)}; tags: ${tags.join(", ") || "none"}; pin PR: ${record.pinPr ?? "none"}`;
+}
 async function suiteRcand(deps, opts) {
+  const existing = readSuiteCut(deps.recordPath);
+  try {
+    return await suiteRcandRun(deps, opts);
+  } catch (e) {
+    if (existing && !opts.dryRun && opts.ownerGo && readSuiteCut(deps.recordPath))
+      throw new Error(`${e.message}
+An existing cut record ${existingCutDescription(existing)} was resumed. mmi-cli devops suite abandon --owner-go retires it (subject to abandon safety checks).`);
+    throw e;
+  }
+}
+async function suiteRcandRun(deps, opts) {
   if (!opts.ownerGo && !opts.dryRun) throw new Error("suite rcand requires --owner-go (rc uses live data); nothing was written");
   const members = suiteMembers(await deps.registry());
   const modules = trainModules(members);
@@ -37128,6 +37303,8 @@ async function suiteRcand(deps, opts) {
   const lead = await deps.head(SUITE_REPO, "development");
   plan.push(await kitCheck(deps, lead, active.map((m) => ({ id: m.id, url: m.bundles.dev })), "dev bundles"));
   if (opts.dryRun) {
+    const existing = readSuiteCut(deps.recordPath);
+    if (existing) plan.push(`existing cut record: ${deps.recordPath} (${existingCutDescription(existing)})`);
     plan.push(...await Promise.all(modules.map(async (m) => `${m.repo}: ${heldById.has(m.id) ? "HELD" : await dryRunStatus(deps, m)}`)));
     return { plan };
   }
@@ -37212,7 +37389,7 @@ async function suiteRcand(deps, opts) {
   }
   const refusals = [];
   for (const member of record.members) {
-    if (member.published) continue;
+    if (member.published || member.carriedPublished) continue;
     try {
       await deps.preflight(member.repo);
     } catch (e) {
@@ -37226,28 +37403,60 @@ async function suiteRcand(deps, opts) {
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
   }
-  for (const member of record.members) {
-    if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
-      throw new Error(`${member.repo}: development moved after the cut snapshot; refuse to add untested code`);
-    if (member.carried) {
-      await deps.publish(member.repo, pinVersion(member.rcPin));
-      continue;
-    }
-    if (!member.tag) {
-      const cut = await deps.rcand(member.repo, member.previousRc, member.rcWasAbsent);
-      if (!RC_TAG.test(cut.tag) || !SHA2.test(cut.sha) || cut.sha.toLowerCase() === member.previousRc.toLowerCase()) throw new Error(`${member.repo}: rcand did not return a new immutable rc tag/SHA`);
-      if (!await deps.contains(member.repo, member.development, cut.sha)) throw new Error(`${member.repo}: rc tag does not carry the snapshotted development SHA; refuse`);
-      member.tag = cut.tag;
-      member.sha = cut.sha;
-      writeSuiteCut(deps.recordPath, record);
-    }
-    if ((await deps.tagSha(member.repo, member.tag))?.toLowerCase() !== member.sha.toLowerCase()) throw new Error(`${member.repo}: rc tag ${member.tag} moved or is unreadable; stop`);
-    if (!member.published) {
-      await deps.publish(member.repo, member.tag);
-      member.published = true;
-      writeSuiteCut(deps.recordPath, record);
+  const cutRecord = record;
+  let writes = Promise.resolve();
+  const persist = (mutate) => {
+    const next = writes.then(() => {
+      mutate();
+      writeSuiteCut(deps.recordPath, cutRecord);
+    });
+    writes = next.catch(() => {
+    });
+    return next;
+  };
+  let running = 0;
+  const waiting = [];
+  const results = await Promise.allSettled(record.members.map(async (member) => {
+    if (running >= 4) await new Promise((resolve8) => waiting.push(resolve8));
+    else running++;
+    try {
+      if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
+        throw new Error(`${member.repo}: development moved after the cut snapshot; refuse to add untested code`);
+      if (member.carried) {
+        if (!member.carriedPublished) {
+          await deps.publish(member.repo, pinVersion(member.rcPin));
+          await persist(() => {
+            member.carriedPublished = true;
+          });
+        }
+        return;
+      }
+      if (!member.tag) {
+        const cut = await deps.rcand(member.repo, member.previousRc, member.rcWasAbsent);
+        if (!RC_TAG.test(cut.tag) || !SHA2.test(cut.sha) || cut.sha.toLowerCase() === member.previousRc.toLowerCase()) throw new Error(`${member.repo}: rcand did not return a new immutable rc tag/SHA`);
+        if (!await deps.contains(member.repo, member.development, cut.sha)) throw new Error(`${member.repo}: rc tag does not carry the snapshotted development SHA; refuse`);
+        await persist(() => {
+          member.tag = cut.tag;
+          member.sha = cut.sha;
+        });
+      }
+      const tag = member.tag;
+      if ((await deps.tagSha(member.repo, tag))?.toLowerCase() !== member.sha.toLowerCase()) throw new Error(`${member.repo}: rc tag ${member.tag} moved or is unreadable; stop`);
+      if (!member.published) {
+        await deps.publish(member.repo, tag);
+        await persist(() => {
+          member.published = true;
+        });
+      }
+    } finally {
+      const next = waiting.shift();
+      if (next) next();
+      else running--;
     }
-  }
+  }));
+  const failures = results.flatMap((result, i) => result.status === "rejected" ? [`${record.members[i].repo}: ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`] : []);
+  if (failures.length) throw new Error(`suite member cuts failed:
+${failures.join("\n")}`);
   for (const member of record.members) {
     const [live, devHead] = await Promise.all([
       deps.backend({ repo: member.repo, id: member.id, bundles: {} }),
@@ -37692,8 +37901,10 @@ async function runRcDataSwitch(deps, opts) {
 }
 
 // src/suite-train-io.ts
-var import_node_fs45 = require("node:fs");
+var import_node_child_process18 = require("node:child_process");
 var import_node_path44 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path45 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
@@ -37875,7 +38086,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -38048,8 +38259,8 @@ async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return { failures: [], skipped: [] };
   const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
   const { tmpdir: tmpdir12 } = await import("node:os");
-  const { join: join48 } = await import("node:path");
-  const dir = await mkdtemp2(join48(tmpdir12(), "mmi-hotfix-preflight-"));
+  const { join: join49 } = await import("node:path");
+  const dir = await mkdtemp2(join49(tmpdir12(), "mmi-hotfix-preflight-"));
   const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
   const skipped = [];
@@ -39547,7 +39758,7 @@ async function updatePrHeadFromBase(input) {
   } catch (e) {
     throw new Error(`GitHub could not update ${input.head} from ${input.base} (${e.message.trim()}) \u2014 ${remedy}`);
   }
-  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   for (let attempt = 0; attempt < PR_HEAD_UPDATE_API_READ_RETRIES; attempt++) {
     const to = await readHead2();
     if (to && to !== from) return { from, to, base: input.base, via: "update-branch-api" };
@@ -39565,7 +39776,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   await sleep2(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
@@ -39576,7 +39787,7 @@ var AUTO_MERGE_CONFIRM_DELAY_MS = 15e3;
 async function confirmAutoMergeEnqueued(deps, options) {
   const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
   const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   for (let attempt = 0; attempt < retries; attempt++) {
     if (await deps.readMerged().catch(() => false)) return "merged";
     const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
@@ -39593,7 +39804,7 @@ async function confirmAutoMergeEnqueued(deps, options) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -43221,7 +43432,7 @@ async function checkPrReview(number, repo, head, deps = {
   }
 }
 function computePrPatchId(number, repo) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const gh2 = (0, import_node_child_process14.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     const git3 = (0, import_node_child_process14.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
     let out = "";
@@ -43259,7 +43470,7 @@ function computePrPatchId(number, repo) {
       if (gitCode !== 0) return reject(new Error(`git patch-id --stable exited ${gitCode}: ${gitErr.trim()}`));
       const id = out.trim().split(/\s+/)[0];
       if (!/^[0-9a-f]{40}$/.test(id ?? "")) return reject(new Error(`patch-id: PR #${number} diff is empty or unreadable (gh: ${ghErr.trim() || "no stderr"})`));
-      resolve7(id);
+      resolve8(id);
     };
     gh2.on("close", (code) => {
       ghCode = code;
@@ -43310,7 +43521,7 @@ init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
   if (paths.length === 0) return Promise.resolve([]);
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const chunks = [];
     let settled = false;
     const child2 = (0, import_node_child_process15.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
@@ -43318,7 +43529,7 @@ function catFileBatch(root, ref, paths) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve7(parseCatFileBatch(Buffer.concat(chunks), paths.length));
+      resolve8(parseCatFileBatch(Buffer.concat(chunks), paths.length));
     };
     const timer = setTimeout(() => {
       child2.kill("SIGKILL");
@@ -43743,7 +43954,7 @@ function healthPollIntervalMs() {
   return HEALTH_POLL_INTERVAL_MS;
 }
 function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -43753,7 +43964,7 @@ function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
       child2.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve7), graceMs);
+    const timer = setTimeout(() => finish(resolve8), graceMs);
     child2.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -43946,10 +44157,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve7(false));
-    srv.once("listening", () => srv.close(() => resolve7(true)));
+    srv.once("error", () => resolve8(false));
+    srv.once("listening", () => srv.close(() => resolve8(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -44227,7 +44438,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve7) => setTimeout(resolve7, 500));
+  await new Promise((resolve8) => setTimeout(resolve8, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -44300,7 +44511,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve7) => setTimeout(resolve7, healthPollIntervalMs()));
+    await new Promise((resolve8) => setTimeout(resolve8, healthPollIntervalMs()));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -44660,7 +44871,7 @@ function unlinkNodeModulesJunction(wtPath) {
   }
 }
 function defaultSleep2(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
   const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs42.rmdirSync, exists = import_node_fs42.existsSync } = options;
@@ -46410,7 +46621,7 @@ ${list}`);
       // #5400: after grace, name "GitHub delivered zero runs" instead of burning the full budget as pending.
       pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr checks-wait", number, repo),
       baseBranch,
-      sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+      sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
       log: (message2) => console.warn(message2),
       timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
       // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
@@ -46565,7 +46776,7 @@ ${list}`);
           // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
           pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
           baseBranch: "development",
-          sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+          sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
           log: (message2) => console.warn(message2),
           // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
           // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
@@ -46616,7 +46827,7 @@ ${list}`);
           } else {
             lastFailure = void 0;
           }
-          await new Promise((resolve7) => setTimeout(resolve7, PR_LAND_POLL_MS));
+          await new Promise((resolve8) => setTimeout(resolve8, PR_LAND_POLL_MS));
         }
         if (lastFailure) {
           throw new Error(
@@ -46774,7 +46985,7 @@ ${list}`);
         checksDiagnosticCommand: `gh pr checks ${number} --repo ${repo}`,
         pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr merge --wait", number, repo),
         baseBranch,
-        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+        sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
         progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -46843,7 +47054,7 @@ ${list}`);
       }
       if (!o.auto && mergeRejectedBaseBranchModified(message2)) {
         console.warn(`pr merge: the base branch was modified by a concurrent merge \u2014 waiting ${PR_MERGE_BASE_RACE_RETRY_DELAY_MS / 1e3}s and retrying PR #${number}'s merge once (#6052).`);
-        await new Promise((resolve7) => setTimeout(resolve7, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
+        await new Promise((resolve8) => setTimeout(resolve8, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
         await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
           const m2 = String(e2.message || "");
           if (/already been merged/i.test(m2)) {
@@ -47104,7 +47315,7 @@ ${list}`);
           console.warn(`ci checks-wait: zero-runs probe FAILED (${read.error}) \u2014 not treating as delivery failure this cycle`);
           return null;
         },
-        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+        sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: timeoutMs ?? PR_CHECKS_TIMEOUT_MS,
         progress: ({ state, elapsedMs, remainingMs }) => console.warn(`ci checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -47469,7 +47680,7 @@ function hotfixFollowUpLegs(runs, foldPort, alignment, foldNote, deployNote) {
   }
   return legs;
 }
-async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))) {
+async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))) {
   for (let attempt = 0; ; attempt++) {
     try {
       return await cb(repo, true);
@@ -48198,18 +48409,63 @@ function rcRunCauseFromLog(log) {
 function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
-var suiteStateDir = (root) => (0, import_node_path44.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+var suiteStateDir = (root) => (0, import_node_path45.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+async function runSuiteMemberRcand(repo, previousRc, rcWasAbsent) {
+  const deps = trainApplyDeps();
+  deps.suiteCut = suiteCutContext(repo, SUITE_REPO);
+  deps.announce = async () => ({ status: "skipped", note: "suite announcement belongs to MM-Work" });
+  return rcandInCheckout(repo, deps, previousRc, rcWasAbsent);
+}
+async function rcandInCheckout(repo, deps, previousRc, rcWasAbsent) {
+  if (repo !== SUITE_REPO) await prepareDevelopmentCheckout((args) => deps.run("git", args), repo);
+  await deps.run("git", ["fetch", "origin", "--tags"]);
+  let rcNow;
+  try {
+    rcNow = (await deps.run("git", ["rev-parse", "--verify", "origin/rc"])).trim();
+  } catch (e) {
+    if (!rcWasAbsent || !previousRc || repo === SUITE_REPO) throw e;
+    const slug = repo.split("/")[1].toLowerCase();
+    const meta = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
+    if (!meta.ok || meta.project?.releaseTrack !== "full" || meta.project.suite !== "mm-work")
+      throw new Error(`${repo}: first rc branch requires releaseTrack full and suite=mm-work in META; no branch created`);
+    const main = (await deps.run("git", ["rev-parse", "origin/main"])).trim();
+    if (main.toLowerCase() !== previousRc.toLowerCase()) throw new Error(`${repo}: main moved since the cut snapshot; no rc branch created`);
+    await deps.run("git", ["push", "origin", `${previousRc}:refs/heads/rc`]);
+    await deps.run("git", ["fetch", "origin", "rc"]);
+    rcNow = (await deps.run("git", ["rev-parse", "origin/rc"])).trim();
+  }
+  if (!(await deps.run("git", ["branch", "--list", "rc"])).trim()) {
+    await deps.run("git", ["switch", "-c", "rc", "--track", "origin/rc"]);
+    await deps.run("git", ["switch", "development"]);
+  }
+  if (previousRc && rcNow.toLowerCase() !== previousRc.toLowerCase()) {
+    const tags = (await deps.run("git", ["tag", "--points-at", rcNow, "--list", "v*-rc.*"])).trim().split("\n").filter(Boolean);
+    if (tags.length !== 1) throw new Error(`${repo}: rc moved since cut start without exactly one candidate tag; stop`);
+    return { tag: tags[0], sha: rcNow };
+  }
+  try {
+    const result = await runTrainApply("rcand", deps, { watch: true });
+    if (result.deployStatus !== "success") throw new Error(`${repo}: rcand deploy not green (${result.deployStatus})`);
+    return { tag: result.tag, sha: (await deps.run("git", ["rev-parse", result.tag])).trim() };
+  } catch (e) {
+    const existing = (await deps.run("git", ["tag", "--list", "v*-rc.*"])).trim();
+    if (!existing || !/resume|partial|ledger|tag.*pushed/i.test(e.message)) throw e;
+    const result = await runRcandResume(deps, { watch: true });
+    if (result.deployStatus !== "success") throw new Error(`${repo}: resumed rcand deploy not green (${result.deployStatus})`);
+    return { tag: result.tag, sha: result.tagSha };
+  }
+}
 function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
-  const recordPath = (0, import_node_path44.join)(suiteStateDir(root), "cut.json");
-  const base = (0, import_node_path44.join)(suiteStateDir(root), "checkouts");
+  const recordPath = (0, import_node_path45.join)(suiteStateDir(root), "cut.json");
+  const base = (0, import_node_path45.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path44.join)(base, repo.split("/")[1]);
+    const target = (0, import_node_path45.join)(base, repo.split("/")[1]);
     if (!(0, import_node_fs45.existsSync)(target)) {
       (0, import_node_fs45.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs45.existsSync)((0, import_node_path44.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs45.existsSync)((0, import_node_path45.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -48269,45 +48525,28 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       throw e;
     }
   };
-  const runRcand = async (repo, previousRc, rcWasAbsent) => inTrain(repo, async (deps) => {
-    if (repo !== SUITE_REPO) await prepareDevelopmentCheckout((args) => deps.run("git", args), repo);
-    await deps.run("git", ["fetch", "origin", "--tags"]);
-    let rcNow;
-    try {
-      rcNow = (await deps.run("git", ["rev-parse", "--verify", "origin/rc"])).trim();
-    } catch (e) {
-      if (!rcWasAbsent || !previousRc || repo === SUITE_REPO) throw e;
-      const slug = repo.split("/")[1].toLowerCase();
-      const meta = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
-      if (!meta.ok || meta.project?.releaseTrack !== "full" || meta.project.suite !== "mm-work")
-        throw new Error(`${repo}: first rc branch requires releaseTrack full and suite=mm-work in META; no branch created`);
-      const main = (await deps.run("git", ["rev-parse", "origin/main"])).trim();
-      if (main.toLowerCase() !== previousRc.toLowerCase()) throw new Error(`${repo}: main moved since the cut snapshot; no rc branch created`);
-      await deps.run("git", ["push", "origin", `${previousRc}:refs/heads/rc`]);
-      await deps.run("git", ["fetch", "origin", "rc"]);
-      rcNow = (await deps.run("git", ["rev-parse", "origin/rc"])).trim();
-    }
-    if (!(await deps.run("git", ["branch", "--list", "rc"])).trim()) {
-      await deps.run("git", ["switch", "-c", "rc", "--track", "origin/rc"]);
-      await deps.run("git", ["switch", "development"]);
-    }
-    if (previousRc && rcNow.toLowerCase() !== previousRc.toLowerCase()) {
-      const tags = (await deps.run("git", ["tag", "--points-at", rcNow, "--list", "v*-rc.*"])).trim().split("\n").filter(Boolean);
-      if (tags.length !== 1) throw new Error(`${repo}: rc moved since cut start without exactly one candidate tag; stop`);
-      return { tag: tags[0], sha: rcNow };
-    }
-    try {
-      const result = await runTrainApply("rcand", deps, { watch: true });
-      if (result.deployStatus !== "success") throw new Error(`${repo}: rcand deploy not green (${result.deployStatus})`);
-      return { tag: result.tag, sha: (await deps.run("git", ["rev-parse", result.tag])).trim() };
-    } catch (e) {
-      const existing = (await deps.run("git", ["tag", "--list", "v*-rc.*"])).trim();
-      if (!existing || !/resume|partial|ledger|tag.*pushed/i.test(e.message)) throw e;
-      const result = await runRcandResume(deps, { watch: true });
-      if (result.deployStatus !== "success") throw new Error(`${repo}: resumed rcand deploy not green (${result.deployStatus})`);
-      return { tag: result.tag, sha: result.tagSha };
-    }
-  });
+  const runRcand = async (repo, previousRc, rcWasAbsent) => {
+    if (repo === SUITE_REPO) return inTrain(repo, (deps) => rcandInCheckout(repo, deps, previousRc, rcWasAbsent));
+    const target = await checkout(repo);
+    return new Promise((resolveResult, reject) => {
+      const child2 = (0, import_node_child_process18.fork)((0, import_node_path44.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
+        cwd: target,
+        stdio: ["ignore", "inherit", "inherit", "ipc"],
+        execArgv: []
+      });
+      let result;
+      let failure;
+      child2.on("message", (message2) => {
+        result = message2.result;
+        failure = message2.error;
+      });
+      child2.on("error", reject);
+      child2.on("exit", (code) => {
+        if (code === 0 && result) resolveResult(result);
+        else reject(new Error(failure ?? `${repo}: member rcand process exited ${code} without a result`));
+      });
+    });
+  };
   const release = async (repo, expected, rcSha, opts) => inTrain(repo, async (deps) => {
     await prepareRcCheckout((args) => deps.run("git", args), repo);
     const plainWords = {
@@ -48362,7 +48601,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (!reuse) await gh(["workflow", "run", "module-rc-publish.yml", "--repo", "mutmutco/MMI-Hub", ...fields.flatMap((f) => ["--field", f])]);
     let candidate = reuse;
     for (let i = 0; !candidate && i < 25; i++) {
-      await new Promise((resolve7) => setTimeout(resolve7, 1e3));
+      await new Promise((resolve8) => setTimeout(resolve8, 1e3));
       candidate = (await rcRuns()).find((r) => r.displayTitle === title && Date.parse(r.createdAt) >= since);
     }
     if (!candidate) throw new Error(`workflow dispatch outcome ambiguous for "${title}"; inspect Actions before retrying`);
@@ -48517,7 +48756,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       for (let i = 0; ; i++) {
         const pin = await openSuitePinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, { repo, tag, stage: "main" });
         if (pin.status !== "pending" || i >= 40) return pin;
-        await new Promise((resolve7) => setTimeout(resolve7, 3e4));
+        await new Promise((resolve8) => setTimeout(resolve8, 3e4));
       }
     },
     suiteMapping: async (leadTag) => {
@@ -48533,7 +48772,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
       (0, import_node_fs45.mkdirSync)(dir, { recursive: true });
-      const file = (0, import_node_path44.join)(dir, `notes-${leadTag}.md`);
+      const file = (0, import_node_path45.join)(dir, `notes-${leadTag}.md`);
       (0, import_node_fs45.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
@@ -48599,11 +48838,23 @@ function suiteRcDataProdDeps() {
       const rc = facts.stages.rc;
       return rc?.present ? rc.substrate ?? "an unnamed substrate" : null;
     },
-    sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
+    sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))
   };
 }
 function registerSuiteCommands(program3) {
   const suite = program3.command("suite").description("MM-Work suite status, candidate cut and release (#7262/#7263)");
+  suite.command("member-rcand-internal", { hidden: true }).argument("<repo>").argument("<previous-rc>").option("--rc-was-absent").action(async (repo, previousRc, o) => {
+    if (!process.send) return fail("member rcand is an internal suite child operation");
+    try {
+      if (repo === SUITE_REPO || (await resolveRepo())?.toLowerCase() !== repo.toLowerCase())
+        throw new Error(`${repo}: member rcand checkout mismatch; stop`);
+      const result = await runSuiteMemberRcand(repo, previousRc || void 0, o.rcWasAbsent);
+      process.send({ result }, () => process.disconnect());
+    } catch (e) {
+      process.exitCode = 1;
+      process.send({ error: e.message }, () => process.disconnect());
+    }
+  });
   const leadRoot = async () => {
     const repo = await resolveRepo();
     if (repo?.toLowerCase() !== SUITE_REPO.toLowerCase()) throw new Error(`suite commands run only from ${SUITE_REPO} (got ${repo ?? "unknown"})`);
@@ -48845,10 +49096,10 @@ function suiteStatusDeps(github, registry2) {
 }
 
 // src/packages-adopt-export.ts
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_fs47 = require("node:fs");
 var import_node_os22 = require("node:os");
-var import_node_path45 = require("node:path");
+var import_node_path46 = require("node:path");
 var import_node_util6 = require("node:util");
 init_cli_shared();
 
@@ -49468,25 +49719,25 @@ function expectedFromRun(run, opts) {
 }
 async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
-  const packagePath = (0, import_node_path45.join)(opts.dir, "package.json");
-  const lockPath = (0, import_node_path45.join)(opts.dir, "package-lock.json");
+  const packagePath = (0, import_node_path46.join)(opts.dir, "package.json");
+  const lockPath = (0, import_node_path46.join)(opts.dir, "package-lock.json");
   const packageText = (0, import_node_fs47.readFileSync)(packagePath, "utf8");
   const lockText = (0, import_node_fs47.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs47.mkdtempSync)((0, import_node_path45.join)((0, import_node_os22.tmpdir)(), "mmi-adopt-export-"));
+  const work = (0, import_node_fs47.mkdtempSync)((0, import_node_path46.join)((0, import_node_os22.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
-    const script = (0, import_node_path45.join)(work, "package_export.py");
+    (0, import_node_fs47.writeFileSync)((0, import_node_path46.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs47.writeFileSync)((0, import_node_path46.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs47.writeFileSync)((0, import_node_path46.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    const script = (0, import_node_path46.join)(work, "package_export.py");
     (0, import_node_fs47.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
-    const verified = (0, import_node_path45.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs47.readFileSync)((0, import_node_path45.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const verified = (0, import_node_path46.join)(work, "verified");
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs47.readFileSync)((0, import_node_path46.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
-      await deps.npm(["cache", "add", (0, import_node_path45.join)(verified, `${short3}.tgz`)], opts.dir);
+      await deps.npm(["cache", "add", (0, import_node_path46.join)(verified, `${short3}.tgz`)], opts.dir);
     }
     (0, import_node_fs47.writeFileSync)(packagePath, plan.packageText);
     (0, import_node_fs47.writeFileSync)(lockPath, plan.lockText);
@@ -49502,7 +49753,7 @@ async function adoptExport(opts, deps) {
     (0, import_node_fs47.rmSync)(work, { recursive: true, force: true });
   }
 }
-var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process18.execFile);
+var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process19.execFile);
 var MAX_OUTPUT = 200 * 1024 * 1024;
 async function findPython() {
   for (const bin of ["python3", "python"]) {
@@ -49628,7 +49879,7 @@ init_github_client();
 init_cli_shared();
 var import_node_fs49 = require("node:fs");
 var import_node_os23 = require("node:os");
-var import_node_path46 = require("node:path");
+var import_node_path47 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -49819,8 +50070,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os23.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path46.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs49.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path46.join)(home, ".claude", "settings.json"), import_node_fs49.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path47.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs49.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path47.join)(home, ".claude", "settings.json"), import_node_fs49.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -52015,6 +52266,65 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
 // src/api-read.ts
 var import_node_fs50 = require("node:fs");
 
+// src/run-log-read.ts
+init_cli_shared();
+var FAILED2 = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out"]);
+function logRepo(raw) {
+  const repo = parseBrokerRepo(raw, "--repo");
+  if (repo.split("/").some((s) => s === "." || s === "..")) throw new Error("read run log: --repo refuses dot segments");
+  return repo;
+}
+function logJob(raw) {
+  if (!raw.trim() || /[\r\n\0]/.test(raw)) throw new Error("read run log: --job must be a non-empty job name");
+  return raw;
+}
+function sliceRunLog(text, tail) {
+  const lines2 = text.replace(/\r\n/g, "\n").split("\n");
+  if (lines2.at(-1) === "") lines2.pop();
+  const context = /* @__PURE__ */ new Set();
+  lines2.forEach((line, i) => {
+    if (line.includes("##[error]")) for (let j = Math.max(0, i - 3); j <= Math.min(lines2.length - 1, i + 3); j++) context.add(j);
+  });
+  return { errorLines: lines2.filter((_, i) => context.has(i)), tail: lines2.slice(-tail) };
+}
+async function readRunLog(id, o, runner) {
+  const runId = parseBrokerId(id, "run id");
+  const repo = logRepo(o.repo);
+  const tail = parseBrokerInt(o.tail ?? "200", "--tail", 1, 2e3);
+  const attempt = o.attempt === void 0 ? void 0 : parseBrokerInt(o.attempt, "--attempt", 1, 1e3);
+  const jobName = o.job === void 0 ? void 0 : logJob(o.job);
+  if (o.failed && jobName !== void 0) throw new Error("read run log: --failed and --job are mutually exclusive");
+  const base = `repos/${repo}/actions/runs/${runId}`;
+  const pages = JSON.parse(await readAppApi(`${base}${attempt === void 0 ? "" : `/attempts/${attempt}`}/jobs`, runner));
+  const jobs = pages.flatMap((page) => page.jobs);
+  const selected = jobs.filter((job) => jobName === void 0 ? FAILED2.has(job.conclusion ?? "") : job.name === jobName);
+  const result = { runId, repo, jobs: [] };
+  if (!selected.length) return { result, exitCode: 1, message: `read run log: no matching job for run ${runId} in ${repo}; conclusions seen: ${[...new Set(jobs.map((j) => j.conclusion ?? "pending"))].join(", ") || "none"}` };
+  for (const job of selected) {
+    const text = await readAppApi(`repos/${repo}/actions/jobs/${parseBrokerId(String(job.id), "job id")}/logs`, runner);
+    result.jobs.push({ id: job.id, name: job.name, conclusion: job.conclusion, failedStep: job.steps?.find((s) => s.conclusion === "failure")?.name ?? null, ...sliceRunLog(text, tail) });
+  }
+  return { result, exitCode: 0 };
+}
+function registerRunLogRead(run, runner) {
+  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3)), "200").option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).option("--json", "emit runId, repo and jobs with failedStep/errorLines/tail").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
+    requireBrokerApp("read run log");
+    const env = brokerChildEnv();
+    try {
+      const { result, message: message2, exitCode } = await readRunLog(id, o, runner);
+      if (message2) printLine(message2);
+      else if (o.json) printLine(redactPrivateCredential(JSON.stringify(result), env));
+      else for (const job of result.jobs) {
+        printLine(redactPrivateCredential(`== ${job.name} (${job.id}) ${job.conclusion}: failing step "${job.failedStep ?? "none"}"`, env));
+        for (const line of [...job.errorLines, ...job.tail]) printLine(redactPrivateCredential(line, env));
+      }
+      process.exitCode = exitCode;
+    } catch (e) {
+      return fail(redactPrivateCredential(`read run log: App-pool read failed (${e.message}) \u2014 re-run the same command; never falls back to personal`, env));
+    }
+  });
+}
+
 // src/app-read-broker.ts
 init_cli_shared();
 var OWNER_REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -52301,7 +52611,8 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
   const runStatusOpt = (v) => parseBrokerRunStatus(v);
   const assigneeOpt = (v) => parseBrokerAssignee(v);
   const read = program3.command("read").description(`closed typed GitHub reads on the App pool (${BROKER_JSON_FLAGS_NOTE})`);
-  const run = read.command("run").description("workflow-run reads (view/list/watch) \u2014 stdout and exit codes pass gh through verbatim");
+  const run = read.command("run").description("workflow-run reads (view/list/watch pass gh through; log is a bounded App REST read)");
+  registerRunLogRead(run, overrides?.apiRunner);
   run.command("view").description("read a workflow run (attempt/exit-status/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--exit-status", "exit non-zero when the run failed").option("--attempt <n>", "the attempt number of the run (1-1000)", intOpt("--attempt", 1, 1e3)).argument("<id>", "workflow run number", idOpt("run id")).action(async (id, o) => {
     let spec;
     try {
@@ -52391,11 +52702,11 @@ var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
 var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
 var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
-var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/jobs$`);
+var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+(?:/attempts/\\d+)?/jobs$`);
 var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
 var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
 var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
@@ -52429,8 +52740,16 @@ function buildApiGetArgs(path2, accept) {
 async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
+var apiReadRunner = async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout;
+async function readAppApi(path2, runner = apiReadRunner) {
+  const req = parseApiGetPath(path2);
+  requireBrokerApp("read run log");
+  const log = req.kind === "actions-job-logs";
+  const body = await runApiGet((args, timeout) => runner(req.kind === "actions-jobs" ? [...args, "--slurp"] : args, log ? ZIP_TIMEOUT_MS : timeout, brokerChildEnv(), log || void 0), path2);
+  return log ? Buffer.from(body, "latin1").toString("utf8") : body;
+}
 function registerApiReadCommands(program3, overrides) {
-  const spawn6 = overrides?.runner ?? (async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout);
+  const spawn6 = overrides?.runner ?? apiReadRunner;
   const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts)");
   api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
     acceptHeaderFor(v);
@@ -53309,7 +53628,7 @@ function registerSessionReport(program3) {
 
 // src/stage-commands.ts
 var import_node_fs51 = require("node:fs");
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -53557,8 +53876,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs51.existsSync)((0, import_node_path47.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs51.existsSync)((0, import_node_path47.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs51.existsSync)((0, import_node_path48.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs51.existsSync)((0, import_node_path48.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -53853,7 +54172,7 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 var import_node_crypto17 = require("node:crypto");
 var import_node_fs52 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
-var import_node_path48 = require("node:path");
+var import_node_path49 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
@@ -53863,7 +54182,7 @@ async function sha256File(path2) {
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path48.resolve)(inputPath);
+  const path2 = (0, import_node_path49.resolve)(inputPath);
   const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES2) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES2} bytes`);
@@ -54053,7 +54372,7 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path53 = require("node:path");
+var import_node_path55 = require("node:path");
 init_house_map();
 init_hub_url();
 
@@ -54086,21 +54405,21 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/dist-drift.ts
-var import_node_child_process19 = require("node:child_process");
+var import_node_child_process20 = require("node:child_process");
 var import_node_crypto19 = require("node:crypto");
 var import_node_fs54 = require("node:fs");
 var import_node_os24 = require("node:os");
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
 var import_node_crypto18 = require("node:crypto");
 var import_node_fs53 = require("node:fs");
-var import_node_path49 = require("node:path");
+var import_node_path50 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path49.resolve)(root);
-  const target = (0, import_node_path49.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path49.sep}`)) {
+  const absoluteRoot = (0, import_node_path50.resolve)(root);
+  const target = (0, import_node_path50.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path50.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
@@ -54132,6 +54451,7 @@ function digestPackedFiles(packageRoot, packedFiles) {
 var DIST_ARTIFACTS = [
   { path: "cli/dist/index.cjs", packageDir: "cli", output: "index.cjs" },
   { path: "cli/dist/main.cjs", packageDir: "cli", output: "main.cjs" },
+  { path: "cli/dist/runbook-sweep.cjs", packageDir: "cli", output: "runbook-sweep.cjs" },
   { path: "updater/dist/index.cjs", packageDir: "updater", output: "index.cjs" }
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
@@ -54214,7 +54534,7 @@ function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
     for (const entry of (0, import_node_fs54.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path50.join)(directory, entry.name);
+      const child2 = (0, import_node_path51.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -54224,14 +54544,14 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs54.readFileSync)((0, import_node_path50.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path50.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs54.readFileSync)((0, import_node_path51.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path51.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path50.join)(root, "distribution-bom.json");
+    return (0, import_node_path51.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process19.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process20.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -54240,28 +54560,28 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs54.mkdtempSync)((0, import_node_path50.join)((0, import_node_os24.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs54.mkdtempSync)((0, import_node_path51.join)((0, import_node_os24.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path50.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path50.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path50.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path50.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path51.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path51.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path51.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path51.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path50.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path51.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path50.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path50.join)(root, path2));
-    const distRoot = (0, import_node_path50.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path50.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const committed = (path2) => readOrNull((0, import_node_path51.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path51.join)(root, path2));
+    const distRoot = (0, import_node_path51.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path51.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
     const bom = JSON.parse((0, import_node_fs54.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path50.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path51.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path50.join)(overlay, entry.path);
-        (0, import_node_fs54.mkdirSync)((0, import_node_path50.dirname)(target), { recursive: true });
+        const target = (0, import_node_path51.join)(overlay, entry.path);
+        (0, import_node_fs54.mkdirSync)((0, import_node_path51.dirname)(target), { recursive: true });
         (0, import_node_fs54.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
@@ -54272,6 +54592,123 @@ function runDistStatus(root) {
   }
 }
 
+// src/doc-refs-live.ts
+var import_node_path52 = require("node:path");
+var concrete = (value) => !!value && !/[<>{}$]/.test(value);
+var liveOption = (tokens2, flag) => {
+  const index = tokens2.indexOf(flag);
+  return index >= 0 ? tokens2[index + 1] : tokens2.find((token) => token.startsWith(`${flag}=`))?.slice(flag.length + 1);
+};
+async function checkRunbookLive(docs, deps) {
+  const findings = [];
+  const warnings = [];
+  const cache = /* @__PURE__ */ new Map();
+  const names = (type, scope) => {
+    const key = `${type}:${scope}`;
+    if (!cache.has(key)) cache.set(key, Promise.resolve().then(() => deps[type](scope)));
+    return cache.get(key);
+  };
+  for (const [doc, body] of Object.entries(docs)) {
+    if (!isRunbook(doc, body)) continue;
+    for (const { tokens: raw, line } of shellClaims(body)) {
+      if (raw[0] !== "mmi-cli") continue;
+      const end = raw.indexOf("--");
+      const tokens2 = end < 0 ? raw : raw.slice(0, end);
+      const task = liveOption(tokens2, "--task");
+      const repo = liveOption(tokens2, "--repo") ?? tokens2.find((token) => /^[\w.-]+\/[\w.-]+$/.test(token));
+      const key = liveOption(tokens2, "--key");
+      const scope = liveOption(tokens2, "--repo") ?? (liveOption(tokens2, "--slug") === "_org" ? "_org" : void 0);
+      const checks = [];
+      if (tokens2.includes("run-task") && concrete(repo) && concrete(task)) checks.push({ type: "tasks", scope: repo, name: task, kind: "unknown-task" });
+      if (tokens2[1] === "vault" && tokens2[2] === "secrets" && ["use", "set", "rm"].includes(tokens2[3]) && concrete(scope) && concrete(key)) checks.push({ type: "vaultKeys", scope, name: key, kind: "unknown-vault-key" });
+      for (const check of checks) {
+        const detail = `${check.scope}: ${check.name}`;
+        try {
+          if (!(await names(check.type, check.scope)).has(check.name)) findings.push({ kind: check.kind, doc, line, detail });
+        } catch {
+          warnings.push({ kind: "live-unverified", doc, line, detail: `${check.type} ${check.scope}: remote names unreadable (auth/transport or unsupported scope)` });
+        }
+      }
+    }
+    let fence = "";
+    const seen = /* @__PURE__ */ new Set();
+    for (const [index, text] of body.split(/\r?\n/).entries()) {
+      const marker = /^\s*(`{3,}|~{3,})(.*)$/.exec(text);
+      if (marker) {
+        if (!fence) fence = marker[1];
+        else if (marker[1][0] === fence[0] && marker[1].length >= fence.length && !marker[2].trim()) fence = "";
+        continue;
+      }
+      const spans = fence ? [text] : [...text.matchAll(/`([^`]+)`/g)].map((match) => match[1]);
+      for (const span of spans) for (const match of span.matchAll(/https:\/\/[^\s`"']+/g)) {
+        const url = match[0].replace(/[),.;]+$/, "");
+        if (!concrete(url) || seen.has(url)) continue;
+        let host;
+        try {
+          host = new URL(url).hostname;
+        } catch {
+          continue;
+        }
+        if (/(^|\.)example\./i.test(host)) continue;
+        seen.add(url);
+        try {
+          const status = await deps.endpoint(url);
+          if (status >= 500) findings.push({ kind: "endpoint-down", doc, line: index + 1, detail: `${url}: HTTP ${status}` });
+        } catch {
+          findings.push({ kind: "endpoint-down", doc, line: index + 1, detail: `${url}: network error or 10s timeout` });
+        }
+      }
+    }
+  }
+  return { findings, warnings };
+}
+async function runLiveDocRefs(root, deps, live) {
+  const offline = runDocRefs(root, { ...deps, runbooksOnly: true });
+  const read = deps.readFile ?? readFileOrNull;
+  const docs = Object.fromEntries((deps.listDocs ?? defaultListDocs)(root).flatMap((doc) => {
+    const body = read((0, import_node_path52.join)(root, doc));
+    return body !== null && isRunbook(doc, body) && !deps.isIgnored?.([doc]).has(doc) ? [[doc, body]] : [];
+  }));
+  const remote = await checkRunbookLive(docs, live);
+  const findings = [...offline.findings, ...remote.findings];
+  return { ...offline, findings, warnings: [...offline.warnings, ...remote.warnings], ok: findings.length === 0 };
+}
+
+// src/doc-refs-live-io.ts
+var import_node_child_process21 = require("node:child_process");
+var import_node_util7 = require("node:util");
+var exec2 = (0, import_node_util7.promisify)(import_node_child_process21.execFile);
+function createRunbookLiveDeps(cliBin) {
+  const json = async (args) => {
+    const { stdout } = await exec2(process.execPath, [cliBin, ...args, "--json"], { windowsHide: true, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 });
+    return JSON.parse(stdout);
+  };
+  return {
+    tasks: async (repo) => {
+      const project2 = await json(["oracle", "org", "project", "get", repo]);
+      if (!project2 || typeof project2 !== "object" || Array.isArray(project2)) throw new Error("unreadable META");
+      return new Set(Object.keys(project2.tenantTasks ?? {}));
+    },
+    vaultKeys: async (scope) => {
+      if (scope === "_org") throw new Error("org names listing unsupported");
+      const result = await json(["vault", "secrets", "list", "--repo", scope]);
+      if (!Array.isArray(result?.secrets) || result.secrets.some((item) => typeof item.key !== "string")) throw new Error("unreadable names");
+      return new Set(result.secrets.map((item) => item.key));
+    },
+    endpoint: async (url) => {
+      const probe = async () => {
+        const response = await fetch(url, { method: "GET", signal: AbortSignal.timeout(1e4) });
+        await response.body?.cancel();
+        return response.status;
+      };
+      const first = await probe().catch(() => 599);
+      if (first < 500) return first;
+      await new Promise((resolve8) => setTimeout(resolve8, 2e4));
+      return probe();
+    }
+  };
+}
+
 // src/edge-commands.ts
 init_cli_shared();
 
@@ -54369,7 +54806,7 @@ init_hub_auth();
 
 // src/schedules-lift-command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path51 = require("node:path");
+var import_node_path53 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -54398,7 +54835,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path51.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path53.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -54480,9 +54917,9 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process20 = require("node:child_process");
+var import_node_child_process22 = require("node:child_process");
 var import_node_fs55 = require("node:fs");
-var import_node_path52 = require("node:path");
+var import_node_path54 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -54551,7 +54988,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process20.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process22.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,
@@ -54568,7 +55005,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs55.readFileSync)((0, import_node_path52.join)(root, file), "utf8");
+      raw = (0, import_node_fs55.readFileSync)((0, import_node_path54.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -54588,7 +55025,7 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path53.join)(process.cwd(), ".gitignore");
+    const path2 = (0, import_node_path55.join)(process.cwd(), ".gitignore");
     const current = (0, import_node_fs56.existsSync)(path2) ? (0, import_node_fs56.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
@@ -54734,17 +55171,23 @@ function registerDeveloperCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  docs.command("refs").description("deterministic doc reference gate: repo paths, markdown links, mmi-cli command refs, and pins across docs, org-guide, mmi-help, README and architecture must resolve, or exit 1").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs refs reads the current checkout").hideHelp()).action(async (o) => {
+  docs.command("refs").description("deterministic doc reference gate: repo paths, markdown links, mmi-cli command refs, and pins across docs, org-guide, mmi-help, README and architecture must resolve, or exit 1").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs refs reads the current checkout").hideHelp()).option("--base <ref>", "require covered runbook sections to be touched against this merge base (#8126)").option("--runbooks-only", "check only operator runbooks (#8126)").option("--live", "check operator runbooks against registry tasks, vault names and HTTPS endpoints (implies --runbooks-only)").action(async (o) => {
     try {
       if (o.repo) {
         const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli oracle docs refs${o.json ? " --json" : ""}`, "docs refs");
         if (!guard.ok) return failGraceful(guard.message);
       }
       const root = await repoRoot();
-      const commandPaths = new Set(
-        buildCommandManifest(program3).index.map((entry) => entry.path)
-      );
-      const result = runDocRefs(root, { commandPaths });
+      const manifest = buildCommandManifest(program3);
+      const commandPaths = new Set(manifest.index.map((entry) => entry.path));
+      const commandOptions = /* @__PURE__ */ new Map();
+      const collect = (entry) => {
+        commandOptions.set(entry.path, new Set(entry.options.flatMap((option) => option.flags.match(/--[\w-]+/g) ?? [])));
+        entry.subcommands.forEach(collect);
+      };
+      collect(manifest.tree);
+      const deps = { commandPaths, commandOptions, base: o.base, runbooksOnly: o.runbooksOnly };
+      const result = o.live ? await runLiveDocRefs(root, deps, createRunbookLiveDeps(process.argv[1])) : runDocRefs(root, deps);
       if (o.json) {
         consoleIo.log(JSON.stringify({ ok: result.ok, docCount: result.docCount, findings: result.findings, warnings: result.warnings }, null, 2));
         if (!result.ok) process.exitCode = 1;
@@ -54863,7 +55306,7 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path54.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path56.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -55035,7 +55478,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs57.existsSync)((0, import_node_path54.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path56.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -55044,7 +55487,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs57.existsSync)((0, import_node_path54.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path56.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -55065,8 +55508,8 @@ function mmiDoctorDeps(opts = {}) {
         });
         const raced = await Promise.race([
           work.then((r) => ({ ...r, timedOut: false })),
-          new Promise((resolve7) => {
-            ceiling = setTimeout(() => resolve7({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
+          new Promise((resolve8) => {
+            ceiling = setTimeout(() => resolve8({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
           })
         ]);
         if (raced.timedOut) return { scanned: 0, findings: 0, fixed: 0, failed: 0, timedOut: true };
@@ -55099,8 +55542,8 @@ function mmiDoctorDeps(opts = {}) {
             incomplete: nb.incomplete,
             timedOut: false
           })),
-          new Promise((resolve7) => {
-            ceiling = setTimeout(() => resolve7({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
+          new Promise((resolve8) => {
+            ceiling = setTimeout(() => resolve8({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
           })
         ]);
         if (!raced.timedOut && raced.incomplete.length === 0) writeSchedulesDriftCache(cachePath, raced.driftLines);
@@ -56152,16 +56595,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path54.join)(root, path2);
+      const fullPath = (0, import_node_path56.join)(root, path2);
       return (0, import_node_fs57.existsSync)(fullPath) ? (0, import_node_fs57.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path54.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path56.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs57.existsSync)((0, import_node_path54.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs57.existsSync)((0, import_node_path54.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs57.existsSync)((0, import_node_path56.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs57.existsSync)((0, import_node_path56.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -56330,7 +56773,7 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path54.join)(path2, entry.name);
+    const child2 = (0, import_node_path56.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
@@ -56360,7 +56803,7 @@ function pluginCacheFsDeps(configRoot, dirBytes) {
     dirBytes,
     listStagingDirs: (root) => (0, import_node_fs57.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path54.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs57.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path56.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs57.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -56374,7 +56817,7 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path54.join)(stagingRoot, name);
+      const p = (0, import_node_path56.join)(stagingRoot, name);
       if (!(0, import_node_fs57.existsSync)(p)) return null;
       try {
         return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs57.statSync)(q).mtimeMs);