@mutmutco/cli 4.5.42 → 4.5.44

package/dist/main.cjs

@@ -5496,8 +5496,8 @@ function resolveVerbAliasShim(argv) {
 }
 
 // src/command-composition.ts
-var import_node_os22 = require("node:os");
-var import_node_path51 = require("node:path");
+var import_node_os23 = require("node:os");
+var import_node_path52 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs13 = require("node:fs");
@@ -7620,6 +7620,33 @@ function cadenceContainsCron(cadence, cron) {
   if (!cronTokens.length || cronTokens.length > cadenceTokens.length) return false;
   return cadenceTokens.some((_, i) => i + cronTokens.length <= cadenceTokens.length && cronTokens.every((t, j) => cadenceTokens[i + j] === t));
 }
+var DECLARED_UNSCHEDULED = /* @__PURE__ */ new Set(["on demand", "on-demand", "manual", "manual only", "event-driven"]);
+var CRON_FIELD2 = /^[0-9A-Za-z*,/\-]+$/;
+var DOW_NAMES = /* @__PURE__ */ new Set(["SUN", "MON", "TUE", "WED", "THU", "FRI", "SAT"]);
+function dowOk(dow) {
+  return dow.split(",").every((part) => {
+    const slash2 = part.indexOf("/");
+    const step = slash2 === -1 ? "" : part.slice(slash2);
+    if (step !== "" && !/^\/[1-9]\d*$/.test(step)) return false;
+    const tokens2 = (slash2 === -1 ? part : part.slice(0, slash2)).split("-");
+    if (tokens2.length > 2 || tokens2.some((t) => t === "")) return false;
+    return tokens2.every((t) => t === "*" || (/^\d+$/.test(t) ? Number(t) <= 7 : DOW_NAMES.has(t.toUpperCase())));
+  });
+}
+function cadenceProblem(cadence) {
+  const c = cadence.trim();
+  const cut = c.search(/[(+]/);
+  const lead = (cut === -1 ? c : c.slice(0, cut)).trim();
+  if (DECLARED_UNSCHEDULED.has(lead.toLowerCase())) return null;
+  if (/^((?:rate|cron)\([^()]+\))(?:\s*[(+].*)?$/is.test(c)) return null;
+  const f = lead.split(/\s+/);
+  if (f.length !== 5) return `cadence not mappable to a Scheduler expression: ${JSON.stringify(cadence)}`;
+  const [minute, hour, dom, month, dow] = f;
+  if (![minute, hour, dom, month].every((x) => CRON_FIELD2.test(x)) || dom !== "*" && dow !== "*" || !dowOk(dow)) {
+    return `cadence not mappable to a Scheduler expression: ${JSON.stringify(cadence)}`;
+  }
+  return null;
+}
 function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   const header = parseScheduleHeader(yamlText);
@@ -7638,6 +7665,10 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   if (!SCHEDULE_EXECUTORS.has(h.executor)) {
     throw new Error(`schedules register: ${expectedId} header \`executor: ${h.executor}\` is not a member of the closed executor taxonomy (${[...SCHEDULE_EXECUTORS].join(", ")}) \u2014 an unknown executor would register a row the harbour can never dispatch (docs/schedules.md "The entry template", H2 #4429).`);
   }
+  const problem = cadenceProblem(h.cadence);
+  if (problem) {
+    throw new Error(`schedules register: ${expectedId} ${problem} \u2014 lead with a 5-field cron, rate(...) or cron(...), then any note in (...) or after +; or declare one of: ${[...DECLARED_UNSCHEDULED].join(", ")} (docs/schedules.md "The entry template", #7415).`);
+  }
   for (const cron of crons) {
     if (!cadenceContainsCron(h.cadence, cron)) {
       throw new Error(`schedules register: ${expectedId} cadence \`${h.cadence}\` does not contain the workflow cron \`${cron}\` (whole-token comparison) \u2014 the declared cadence disagrees with the actual schedule.`);
@@ -14366,7 +14397,7 @@ function loadBootstrapSeeds(manifestJson) {
   };
 }
 function renderSeed(template, vars) {
-  return template.replace(PLACEHOLDER_RE, (match, key) => key in vars ? vars[key] : match);
+  return template.replace(PLACEHOLDER_RE, (match, key) => key in vars ? vars[key].replace(PLACEHOLDER_RE, (inner, innerKey) => innerKey !== key && innerKey in vars ? vars[innerKey] : inner) : match);
 }
 function missingPlaceholders(rendered) {
   const out = /* @__PURE__ */ new Set();
@@ -15370,7 +15401,10 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     GATE_MAX_SECONDS: DEFAULT_GATE_MAX_SECONDS,
     // The pin is the CLI's blessed SHA, not an operator knob — one central place to bump (#3178).
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA,
-    GATE_RUNNER_SHA: BLESSED_RUNNER_GATE_SHA
+    GATE_RUNNER_SHA: BLESSED_RUNNER_GATE_SHA,
+    // #7407: repo-declared service containers and extra check steps; empty renders today's gate byte-for-byte.
+    GATE_SERVICES_YAML: "",
+    GATE_EXTRA_STEPS_YAML: ""
   };
   const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
   const trackBranches = track === "trunk" ? ["main"] : track === "direct" ? ["development", "main"] : ["development", "rc", "main"];
@@ -15417,6 +15451,112 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranc
   if (!out.GATE_AFFECTED_CMD.trim()) out.GATE_AFFECTED_CMD = out.GATE_CMD;
   return out;
 }
+var GATE_SERVICE_KEYS = /* @__PURE__ */ new Set(["image", "env", "ports", "options", "tmpfs"]);
+var GATE_STEP_KEYS = /* @__PURE__ */ new Set(["name", "command", "env", "maxSeconds"]);
+function gateLine(value, field) {
+  if (typeof value !== "string" || !value.trim() || /[\r\n]/.test(value)) throw new Error(`${field} must be a non-empty single-line string`);
+  return value.trim();
+}
+function gateEnv(value, field) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${field} must be an object of NAME: "value" strings`);
+  const out = {};
+  for (const [name, entry] of Object.entries(value)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error(`${field}.${name} is not a valid environment variable name`);
+    if (typeof entry !== "string" || /[\r\n]/.test(entry)) throw new Error(`${field}.${name} must be a single-line string`);
+    out[name] = entry;
+  }
+  return out;
+}
+function gateSeconds(value, field) {
+  const text = typeof value === "number" ? String(value) : value;
+  if (typeof text !== "string" || !/^\d+$/.test(text.trim()) || Number(text) <= 0) throw new Error(`${field} must be a positive whole number of seconds`);
+  return text.trim();
+}
+function validateGateExtras(gate) {
+  const out = {};
+  if (gate.services !== void 0) {
+    if (!gate.services || typeof gate.services !== "object" || Array.isArray(gate.services)) throw new Error("gate.services must be an object keyed by service name");
+    out.services = {};
+    for (const [name, raw] of Object.entries(gate.services)) {
+      const field = `gate.services.${name}`;
+      if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`${field}: service name must be lowercase letters, digits, - or _`);
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${field} must be an object with an image`);
+      const service = raw;
+      for (const key of Object.keys(service)) if (!GATE_SERVICE_KEYS.has(key)) throw new Error(`${field}.${key} is not a service field (expected image/env/ports/options/tmpfs)`);
+      const parsed = { image: gateLine(service.image, `${field}.image`) };
+      if (service.env !== void 0) parsed.env = gateEnv(service.env, `${field}.env`);
+      if (service.ports !== void 0) {
+        if (!Array.isArray(service.ports) || service.ports.length === 0) throw new Error(`${field}.ports must be a non-empty array`);
+        parsed.ports = service.ports.map((port, index) => {
+          const ok = typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536 || typeof port === "string" && /^\d{1,5}(:\d{1,5})?$/.test(port);
+          if (!ok) throw new Error(`${field}.ports[${index}] must be a port number or "host:container"`);
+          return port;
+        });
+      }
+      if (service.options !== void 0) parsed.options = gateLine(service.options, `${field}.options`);
+      if (service.tmpfs !== void 0) {
+        if (!Array.isArray(service.tmpfs) || service.tmpfs.length === 0) throw new Error(`${field}.tmpfs must be a non-empty array of paths`);
+        parsed.tmpfs = service.tmpfs.map((path2, index) => gateLine(path2, `${field}.tmpfs[${index}]`));
+      }
+      out.services[name] = parsed;
+    }
+  }
+  if (gate.steps !== void 0) {
+    if (!Array.isArray(gate.steps)) throw new Error("gate.steps must be an array");
+    out.steps = gate.steps.map((raw, index) => {
+      const field = `gate.steps[${index}]`;
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${field} must be an object with name and command`);
+      const step = raw;
+      for (const key of Object.keys(step)) if (!GATE_STEP_KEYS.has(key)) throw new Error(`${field}.${key} is not a step field (expected name/command/env/maxSeconds)`);
+      const parsed = { name: gateLine(step.name, `${field}.name`), command: gateLine(step.command, `${field}.command`) };
+      if (step.env !== void 0) parsed.env = gateEnv(step.env, `${field}.env`);
+      if (step.maxSeconds !== void 0) parsed.maxSeconds = gateSeconds(step.maxSeconds, `${field}.maxSeconds`);
+      return parsed;
+    });
+  }
+  return out;
+}
+function yamlScalar(value) {
+  const plainSafe = /^[A-Za-z0-9_./$(][^\r\n]*$/.test(value) && !/: |\s#|[\s:]$/.test(value) && !/^(?:true|false|yes|no|on|off|null|~|[-+]?[\d.][\d_.eE+-]*)$/i.test(value);
+  return plainSafe ? value : JSON.stringify(value);
+}
+function envYaml(env, indent) {
+  return Object.entries(env).map(([name, value]) => `
+${indent}${name}: ${yamlScalar(value)}`).join("");
+}
+function gateServicesYaml(services) {
+  let out = "\n    services:";
+  for (const [name, service] of Object.entries(services)) {
+    out += `
+      ${name}:
+        image: ${yamlScalar(service.image)}`;
+    if (service.env && Object.keys(service.env).length) out += `
+        env:${envYaml(service.env, "          ")}`;
+    if (service.ports) out += `
+        ports:${service.ports.map((port) => `
+          - ${typeof port === "number" ? port : yamlScalar(port)}`).join("")}`;
+    const options = [...service.options ? [service.options] : [], ...(service.tmpfs ?? []).map((path2) => `--tmpfs ${path2}`)];
+    if (options.length) out += `
+        options: >-${options.map((line) => `
+          ${line}`).join("")}`;
+  }
+  return out;
+}
+function gateExtraStepsYaml(steps) {
+  return steps.map((step) => [
+    `
+      - name: ${yamlScalar(step.name)}`,
+    step.env && Object.keys(step.env).length ? `
+        env:${envYaml(step.env, "          ")}` : "",
+    "\n        uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}",
+    "\n        with:",
+    `
+          command: ${yamlScalar(step.command)}`,
+    `
+          max-seconds: ${step.maxSeconds ?? "{{GATE_MAX_SECONDS}}"}`,
+    "\n          working-directory: {{GATE_WORKDIR}}"
+  ].join("")).join("");
+}
 function gateConfigToVars(gate) {
   const out = {};
   if (!gate || typeof gate !== "object") return out;
@@ -15428,6 +15568,9 @@ function gateConfigToVars(gate) {
   if (typeof gate.pyVersion === "string" && gate.pyVersion.trim()) out.GATE_PY_VERSION = gate.pyVersion;
   const seconds = typeof gate.maxSeconds === "number" ? String(gate.maxSeconds) : gate.maxSeconds;
   if (typeof seconds === "string" && /^\d+$/.test(seconds.trim()) && Number(seconds) > 0) out.GATE_MAX_SECONDS = seconds.trim();
+  const extras = validateGateExtras(gate);
+  if (extras.services && Object.keys(extras.services).length) out.GATE_SERVICES_YAML = gateServicesYaml(extras.services);
+  if (extras.steps?.length) out.GATE_EXTRA_STEPS_YAML = gateExtraStepsYaml(extras.steps);
   return out;
 }
 function seedMatchesDeployModel(seed, deployModel) {
@@ -16871,10 +17014,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.42",
-    tag: "v4.5.42",
-    commit: "448720f2bc43",
-    npm: "@mutmutco/cli@4.5.42"
+    version: "4.5.44",
+    tag: "v4.5.44",
+    commit: "dda7c3cc34f2",
+    npm: "@mutmutco/cli@4.5.44"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -16891,14 +17034,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.42"
+          v3Target: "v4.5.44"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.42 and redeploy the Hub Lambda from tag v4.5.42 (448720f2bc43); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.42 (@mutmutco/cli@4.5.42, tag commit 448720f2bc43 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.44 and redeploy the Hub Lambda from tag v4.5.44 (dda7c3cc34f2); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.44 (@mutmutco/cli@4.5.44, tag commit dda7c3cc34f2 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -27801,8 +27944,15 @@ async function seedGateYml(repo, deps, meta, result) {
     result.skipped.push(`gate.yml missing \u2014 no registry gate config; set \`mmi-cli oracle org project set ${repo} --var gate={...}\` first, then re-run reconcile`);
     return "none";
   }
+  let gateVars;
+  try {
+    gateVars = gateConfigToVars(gate);
+  } catch (e) {
+    result.errors.push(`gate.yml re-seed: registry gate config is invalid \u2014 ${e.message}`);
+    return "none";
+  }
   const derivedVars = withDerivedRepoVars(
-    { ...gateConfigToVars(gate), REPO_SLUG: parsed.slug },
+    { ...gateVars, REPO_SLUG: parsed.slug },
     parsed,
     "deployable",
     releaseTrack,
@@ -29577,8 +29727,8 @@ function registerBoardCommands(program3) {
 
 // src/bootstrap-commands.ts
 var import_node_fs28 = require("node:fs");
-var import_node_os16 = require("node:os");
-var import_node_path27 = require("node:path");
+var import_node_os17 = require("node:os");
+var import_node_path28 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -29890,6 +30040,134 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 
 // src/box-commands.ts
 var import_node_fs27 = require("node:fs");
+var import_node_child_process10 = require("node:child_process");
+var import_node_os16 = require("node:os");
+var import_node_path27 = require("node:path");
+
+// src/box-control.ts
+var import_node_crypto8 = require("node:crypto");
+var MANIFEST_PATH = "infra/box-control/manifest.json";
+var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
+function parseManifest(text) {
+  const raw = JSON.parse(text);
+  if (!Array.isArray(raw.files)) throw new Error('box control manifest: "files" must be an array');
+  const seen = /* @__PURE__ */ new Set();
+  return raw.files.map((f, i) => {
+    const where = `box control manifest: files[${i}]`;
+    if (typeof f.src !== "string" || !f.src || f.src.startsWith("/") || f.src.includes("..")) throw new Error(`${where}: src must be a repo-relative path`);
+    if (f.mode !== "0644" && f.mode !== "0755") throw new Error(`${where} (${f.src}): mode must be "0644" or "0755"`);
+    const targets = [];
+    if (Array.isArray(f.targets)) targets.push(...f.targets);
+    if (f.lanes !== void 0) targets.push(...expandLanes(f.lanes, where));
+    if (!targets.length) throw new Error(`${where} (${f.src}): needs targets or lanes`);
+    const ownSysctl = typeof f.post === "string" && /^sysctl -p (\/etc\/sysctl\.d\/[A-Za-z0-9._-]+\.conf)$/.exec(f.post);
+    const postOk = f.post === void 0 || typeof f.post === "string" && ALLOWED_POST.has(f.post) || !!ownSysctl && targets.every((t) => t.dest === ownSysctl[1]);
+    if (!postOk) {
+      throw new Error(`${where} (${f.src}): post must be one of ${[...ALLOWED_POST].join(", ")}, or \`sysctl -p <its own /etc/sysctl.d dest>\``);
+    }
+    for (const t of targets) {
+      if (typeof t.box !== "string" || !/^[a-z0-9-]+$/.test(t.box)) throw new Error(`${where} (${f.src}): bad box name`);
+      if (typeof t.dest !== "string" || !/^\/[A-Za-z0-9._\/-]+$/.test(t.dest) || t.dest.includes("..")) {
+        throw new Error(`${where} (${f.src}): dest must be an absolute path of plain characters`);
+      }
+      if (t.dest.startsWith("/opt/mmi-control/secrets") || t.dest.endsWith(".env")) {
+        throw new Error(`${where} (${f.src}): ${t.dest} is vault-owned and cannot be a manifest destination`);
+      }
+      const key = `${t.box}:${t.dest}`;
+      if (seen.has(key)) throw new Error(`${where} (${f.src}): duplicate destination ${key}`);
+      seen.add(key);
+    }
+    return { src: f.src, mode: f.mode, ...f.post ? { post: f.post } : {}, targets };
+  });
+}
+function expandLanes(l, where) {
+  if (!l || typeof l.box !== "string" || !Number.isInteger(l.from) || !Number.isInteger(l.to) || l.from < 1 || l.to < l.from || typeof l.dest !== "string" || !l.dest.includes("{N}")) {
+    throw new Error(`${where}: lanes needs box, integer from <= to, and a dest containing {N}`);
+  }
+  const out = [];
+  for (let n = l.from; n <= l.to; n += 1) out.push({ box: l.box, dest: l.dest.replace("{N}", String(n)) });
+  return out;
+}
+function filesForBox(files, box) {
+  return files.flatMap((file) => file.targets.filter((t) => t.box === box).map((t) => ({ file, dest: t.dest })));
+}
+function md5(content) {
+  return (0, import_node_crypto8.createHash)("md5").update(content).digest("hex");
+}
+function planRemoteScript(dests) {
+  const lines2 = ["set -u"];
+  for (const d of dests) {
+    lines2.push(`if [ -f '${d}' ]; then printf '%s %s %s\\n' "$(md5sum < '${d}' | cut -d' ' -f1)" "$(stat -c %a '${d}')" '${d}'; else printf 'MISSING - %s\\n' '${d}'; fi`);
+  }
+  lines2.push(`for f in ${ALERT_DIR}/*; do [ -f "$f" ] && printf 'ALERT %s %s\\n' "$(basename "$f")" "$(head -c 300 "$f" | tr '\\n' ' ')"; done; true`);
+  return `${lines2.join("\n")}
+`;
+}
+var ALERT_DIR = "/var/lib/mmi-control/alerts";
+function parseAlerts(output) {
+  const out = [];
+  for (const line of output.split("\n")) {
+    const m = /^ALERT ([A-Za-z0-9._-]+) ?(.*)$/.exec(line.trim());
+    if (m) out.push({ name: m[1], message: m[2].trim() });
+  }
+  return out;
+}
+function parsePlanOutput(output, rows) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const line of output.split("\n")) {
+    const m = /^([0-9a-f]{32}|MISSING) (\d{3,4}|-) (\/\S+)$/.exec(line.trim());
+    if (m) seen.set(m[3], { md5: m[1], mode: m[2] });
+  }
+  return rows.map(({ file, dest, expectedMd5 }) => {
+    const expectedMode = file.mode.replace(/^0/, "");
+    const got = seen.get(dest);
+    const base = { src: file.src, dest, expectedMd5, expectedMode: file.mode };
+    if (!got) return { ...base, status: "unread", installedMd5: null, installedMode: null };
+    if (got.md5 === "MISSING") return { ...base, status: "missing", installedMd5: null, installedMode: null };
+    const status = got.md5 !== expectedMd5 ? "drift" : got.mode !== expectedMode ? "mode-drift" : "in-sync";
+    return { ...base, status, installedMd5: got.md5, installedMode: `0${got.mode}` };
+  });
+}
+function selectApplyRows(rows, sel) {
+  const unknown = sel.only.filter((s) => !rows.some((r) => r.file.src === s));
+  if (unknown.length) return `not a manifest src for this box: ${unknown.join(", ")}`;
+  const chosen = rows.filter((r) => sel.only.includes(r.file.src));
+  const strayDest = sel.dest.filter((d) => !chosen.some((r) => r.dest === d));
+  if (strayDest.length) return `--dest is not a destination of the chosen --only source(s): ${strayDest.join(", ")}`;
+  const out = [];
+  for (const src of sel.only) {
+    const targets = chosen.filter((r) => r.file.src === src);
+    if (targets.length === 1 || sel.allTargets) {
+      out.push(...targets);
+      continue;
+    }
+    const named = targets.filter((r) => sel.dest.includes(r.dest));
+    if (!named.length) {
+      return `${src} has ${targets.length} destinations on this box; name each with --dest <path>, or pass --all-targets`;
+    }
+    out.push(...named);
+  }
+  return out;
+}
+function backupPath(dest, date) {
+  if (dest.startsWith("/etc/cron.d/")) return `/root/${dest.slice("/etc/cron.d/".length)}.cron.bak-${date}`;
+  return `${dest}.bak-${date}`;
+}
+function applyRemoteScript(items, date) {
+  const lines2 = ["set -eu", "tmp=$(mktemp)", `trap 'rm -f "$tmp"' EXIT`];
+  for (const it of items) {
+    const b64 = Buffer.from(it.content).toString("base64");
+    lines2.push(`if [ -f '${it.dest}' ]; then cp -p '${it.dest}' '${backupPath(it.dest, date)}'; fi`);
+    lines2.push(`printf '%s' '${b64}' | base64 -d > "$tmp"`);
+    lines2.push(`install -D -m ${it.mode} "$tmp" '${it.dest}'`);
+  }
+  for (const post of [...new Set(items.map((i) => i.post).filter((p) => !!p))]) lines2.push(post);
+  lines2.push(planRemoteScript(items.map((i) => i.dest)).replace(/^set -u\n/, ""));
+  return `${lines2.join("\n")}
+`;
+}
+
+// src/box-commands.ts
 init_clean_exit();
 
 // src/secrets-commands.ts
@@ -30299,14 +30577,20 @@ function parseGateVar(raw) {
   const map = parsed;
   const out = {};
   for (const [key, value] of Object.entries(map)) {
-    if (key === "runtime") {
+    if (key === "services" || key === "steps") {
+      try {
+        Object.assign(out, validateGateExtras({ [key]: value }));
+      } catch (error) {
+        throw new Error(`org project set: ${error.message}`);
+      }
+    } else if (key === "runtime") {
       if (value !== "node" && value !== "python") throw new Error('org project set: gate.runtime must be "node" or "python"');
       out.runtime = value;
     } else if (key === "cmd" || key === "affectedCmd" || key === "workdir" || key === "cacheDepPath" || key === "pyVersion") {
       if (typeof value !== "string" || !value.trim()) throw new Error(`org project set: gate.${key} must be a non-empty string`);
       out[key] = value.trim();
     } else {
-      throw new Error(`org project set: gate key "${key}" \u2014 expected only runtime/cmd/affectedCmd/workdir/cacheDepPath/pyVersion`);
+      throw new Error(`org project set: gate key "${key}" \u2014 expected only runtime/cmd/affectedCmd/workdir/cacheDepPath/pyVersion/services/steps`);
     }
   }
   return out;
@@ -31479,6 +31763,81 @@ ${SSH_RECIPE_AGENT_NOTE}`);
       await failGraceful(e.message);
     }
   });
+  box.command("control <name>").description("box-side control files (#7402): --plan (default, read-only) reports drift from the repo; --apply --only <src> installs with backups").option("--plan", "read-only drift report (the default)").option("--apply", "install the files named by --only on this box, backing up each previous copy").option("--only <src>", "with --apply: a manifest src to install (repeatable; approval is file by file)", (v, acc) => [...acc, v], []).option("--dest <path>", "with --apply: a destination of a multi-target --only source to install (repeatable, #7409)", (v, acc) => [...acc, v], []).option("--all-targets", "with --apply: install a multi-target --only source to every one of its destinations on this box").option("--ref <ref>", "git ref the repo content is read from", "origin/development").option("--json", "machine-readable output").action(async (name, o) => {
+    try {
+      if (o.apply && o.plan) throw new UsageError("box control: --plan and --apply are exclusive");
+      if (o.apply && !o.only.length) throw new UsageError("box control: --apply needs --only <src> for each file to install; approval is file by file");
+      if (!o.apply && (o.only.length || o.dest.length || o.allTargets)) throw new UsageError("box control: --only, --dest and --all-targets apply to --apply");
+      const show = hubGitShow(o.ref);
+      const files = parseManifest(show(MANIFEST_PATH).toString("utf8"));
+      const { boxes, incomplete } = await fetchInventory();
+      const found = lookupBox(name, boxes, incomplete);
+      if (found.kind !== "found") {
+        const why = found.kind === "unknown" ? `the inventory is incomplete (${found.reasons.join("; ")})` : `no box named '${name}'`;
+        throw new UnreadableError(`box control: ${why}`);
+      }
+      const rows = filesForBox(files, found.box.name).map(({ file, dest }) => {
+        const content = show(file.src);
+        return { file, dest, content, expectedMd5: md5(content) };
+      });
+      if (!rows.length) throw new UsageError(`box control: ${MANIFEST_PATH} lists no files for ${found.box.name}`);
+      let probeRows = rows;
+      if (o.apply) {
+        const picked = selectApplyRows(rows, { only: o.only, dest: o.dest, allTargets: !!o.allTargets });
+        if (typeof picked === "string") throw new UsageError(`box control: ${picked}`);
+        probeRows = picked;
+      }
+      const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10).replace(/-/g, "");
+      const script = o.apply ? applyRemoteScript(probeRows.map((r) => ({ dest: r.dest, mode: r.file.mode, content: r.content, post: r.file.post })), date) : planRemoteScript(probeRows.map((r) => r.dest));
+      const output = runOnBox(found.box, script);
+      const results = parsePlanOutput(output, probeRows);
+      const drift = results.filter((r) => r.status !== "in-sync").length;
+      const unread = results.some((r) => r.status === "unread");
+      const alerts = parseAlerts(output);
+      const payload = { box: found.box.name, ref: o.ref, mode: o.apply ? "apply" : "plan", files: results, drift, alerts, ok: drift === 0 && alerts.length === 0 };
+      if (o.json) console.log(JSON.stringify(payload, null, 2));
+      else console.log([formatControl(payload.mode, found.box.name, results), ...alerts.map((a) => `ALERT ${a.name}: ${a.message}`)].join("\n"));
+      process.exitCode = unread ? 2 : drift || alerts.length ? 1 : 0;
+    } catch (e) {
+      if (o.json) console.log(JSON.stringify({ box: name, ref: o.ref, ok: false, error: e.message }, null, 2));
+      else console.error(e.message);
+      process.exitCode = 2;
+    }
+  });
+}
+var UsageError = class extends Error {
+};
+var UnreadableError = class extends Error {
+};
+function hubGitShow(ref) {
+  const git3 = (args) => (0, import_node_child_process10.execFileSync)("git", args, { maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+  try {
+    git3(["cat-file", "-e", `HEAD:${MANIFEST_PATH}`]);
+  } catch {
+    throw new UsageError(`box control: run this from an MMI-Hub checkout (no ${MANIFEST_PATH} here)`);
+  }
+  if (ref.startsWith("origin/")) git3(["fetch", "--quiet", "origin"]);
+  return (path2) => git3(["show", `${ref}:${path2}`]);
+}
+function runOnBox(found, script) {
+  const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-box-control-"));
+  try {
+    const recipe = (0, import_node_path27.join)(dir, "recipe.sh");
+    (0, import_node_fs27.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    const r = (0, import_node_child_process10.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
+    if (r.status !== 0) {
+      throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
+    }
+    return r.stdout;
+  } finally {
+    (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
+  }
+}
+function formatControl(mode, box, rows) {
+  const lines2 = rows.map((r) => `${r.status.padEnd(10)} ${r.dest}  <- ${r.src}`);
+  const bad = rows.filter((r) => r.status !== "in-sync").length;
+  lines2.push(`${box}: ${mode} \u2014 ${rows.length} file(s), ${bad} not in sync`);
+  return lines2.join("\n");
 }
 
 // src/bootstrap-box-ports.ts
@@ -31599,7 +31958,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -31619,7 +31978,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto8.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto9.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -31781,7 +32140,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -31794,7 +32153,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto9.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto10.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -32950,7 +33309,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -32983,7 +33342,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto10.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   return { ...planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`), baseSha, baseBranch };
 }
 async function verifyTargetedSeedBranch(repo, plan, target, client, allowMissing = false) {
@@ -33378,7 +33737,7 @@ function registerBootstrapCommands(program3) {
     const readFile9 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path27.join)((0, import_node_os16.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
       (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
@@ -34125,7 +34484,7 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path27.join)((0, import_node_os16.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
         (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
@@ -34300,7 +34659,7 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path27.join)((0, import_node_os16.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
       (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
@@ -34586,8 +34945,8 @@ function formatSuiteStatus(report) {
 
 // src/suite-train.ts
 var import_node_fs29 = require("node:fs");
-var import_node_path28 = require("node:path");
-var import_node_crypto11 = require("node:crypto");
+var import_node_path29 = require("node:path");
+var import_node_crypto12 = require("node:crypto");
 var SCHEMA = "mmi-suite-cut/v1";
 var SHA2 = /^[a-f0-9]{40}$/i;
 var RC_TAG = /^v\d+\.\d+\.\d+-rc\.\d+$/;
@@ -34622,8 +34981,8 @@ function readSuiteCut(path2) {
   return record;
 }
 function writeSuiteCut(path2, record) {
-  (0, import_node_fs29.mkdirSync)((0, import_node_path28.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto11.randomBytes)(8).toString("hex")}.tmp`;
+  (0, import_node_fs29.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
+  const temp = `${path2}.${(0, import_node_crypto12.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs29.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
     (0, import_node_fs29.renameSync)(temp, path2);
@@ -34828,7 +35187,7 @@ async function suiteRelease(deps, ownerGo) {
 
 // src/suite-train-io.ts
 var import_node_fs43 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
@@ -35108,9 +35467,9 @@ A hotfix branch is cut from origin/main and carries ONLY the fixes --from names,
 async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return { failures: [], skipped: [] };
   const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
-  const { tmpdir: tmpdir10 } = await import("node:os");
-  const { join: join44 } = await import("node:path");
-  const dir = await mkdtemp2(join44(tmpdir10(), "mmi-hotfix-preflight-"));
+  const { tmpdir: tmpdir11 } = await import("node:os");
+  const { join: join45 } = await import("node:path");
+  const dir = await mkdtemp2(join45(tmpdir11(), "mmi-hotfix-preflight-"));
   const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
   const skipped = [];
@@ -36309,13 +36668,13 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag, workflows = H
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 var GIT_MAX_BUFFER = 512 * 1024 * 1024;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process10.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
   const revList = (range) => {
     const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -36383,7 +36742,7 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process10.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process11.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"], maxBuffer: GIT_MAX_BUFFER }));
   const isAncestor = (sha, ref) => {
     try {
       git3(["merge-base", "--is-ancestor", sha, ref]);
@@ -36416,8 +36775,8 @@ function checkHotfixCarries(options) {
 
 // src/merge-cleanup.ts
 var import_node_fs31 = require("node:fs");
-var import_node_path30 = require("node:path");
-var import_node_os17 = require("node:os");
+var import_node_path31 = require("node:path");
+var import_node_os18 = require("node:os");
 init_cli_shared();
 init_github_client();
 
@@ -36706,12 +37065,12 @@ async function runPrLand(prNumber, options, deps) {
 }
 
 // src/test-policy-core.ts
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_node_fs30 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_path30 = require("node:path");
 
 // src/test-command-policy-shared.mjs
-var import_node_child_process11 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 var TEST_COMMAND_CLASS = "test";
 var TRAILER_KEY = "Test-Policy-Override";
 var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
@@ -36828,7 +37187,7 @@ function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, overrid
   };
 }
 function git(args, cwd) {
-  return (0, import_node_child_process11.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return (0, import_node_child_process12.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 function parseScope(value) {
   const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
@@ -37184,7 +37543,7 @@ function isMeaningfulRow(file) {
   return file.meaningful !== false;
 }
 function loadPolicy(root, readFile9 = readFileOrNull2) {
-  const raw = readFile9((0, import_node_path29.join)(root, POLICY_FILE));
+  const raw = readFile9((0, import_node_path30.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   return parsePolicy(raw, POLICY_FILE);
 }
@@ -37290,11 +37649,11 @@ function classify(changed, policy, present = () => false) {
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
 function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs30.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path29.join)(root, p)));
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
 function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs30.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path29.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, meaningfulTestChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -37327,14 +37686,14 @@ function evaluate(changed, policy, present = () => false) {
   return findings;
 }
 function git2(args, cwd) {
-  return (0, import_node_child_process12.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return (0, import_node_child_process13.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 var COAUTHOR_KEY = "Co-authored-by";
 var GH_MESSAGE_SEPARATOR = /^-{5,}$/;
 var LIFTED_KEYS = new RegExp(`^(?:${TRAILER_KEY}|${COAUTHOR_KEY}):`, "i");
 function parseTrailers(message2, cwd) {
   try {
-    return (0, import_node_child_process12.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    return (0, import_node_child_process13.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
       windowsHide: true,
       cwd,
       input: message2,
@@ -37440,7 +37799,7 @@ function runTestPolicy(root, deps = {}) {
   const raw = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const changed = deps.changed ? raw : annotateChangeMeaning(raw, policy, (path2) => ({
     before: blobAt(base, path2, root),
-    after: readFileOrNull2((0, import_node_path29.join)(root, path2))
+    after: readFileOrNull2((0, import_node_path30.join)(root, path2))
   }));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride2(base, root) : { override: null, refusals: [] };
   const policyRefusals = policy.declared === false ? [{
@@ -37450,8 +37809,8 @@ function runTestPolicy(root, deps = {}) {
   A gate with no policy cannot decide which test commands are required or permitted.
 ` + (deps.base === HOTFIX_DIFF_BASE ? `  Hotfix lane (--base ${HOTFIX_DIFF_BASE}): pass --policy-ref <exact-${HOTFIX_POLICY_REF}-commit> so the current policy is read from ${HOTFIX_POLICY_REF}.` : `  Restore ${POLICY_FILE} on this branch; the policy file belongs on every non-hotfix lane.`)
   }] : [];
-  const present = (path2) => exists((0, import_node_path29.join)(root, path2));
-  const policyTree = policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path29.join)(root, p))) : null;
+  const present = (path2) => exists((0, import_node_path30.join)(root, path2));
+  const policyTree = policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path30.join)(root, p))) : null;
   const policyTreeExists = policyTree ? (abs) => policyTree.has(abs) : exists;
   const where = policySource.sha ? `${policySource.ref}@${policySource.sha}` : "this worktree";
   const removedByThisDiff = removedPaths(changed);
@@ -37696,8 +38055,8 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs31.mkdtempSync)((0, import_node_path30.join)((0, import_node_os17.tmpdir)(), "mmi-squash-body-"));
-  const path2 = (0, import_node_path30.join)(dir, "body.txt");
+  const dir = (0, import_node_fs31.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path31.join)(dir, "body.txt");
   (0, import_node_fs31.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
@@ -37910,7 +38269,7 @@ async function deleteMergedRemoteBranch(options) {
 
 // src/project-info-sync.ts
 var import_node_fs32 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_path32 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -37957,7 +38316,7 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path31.join)(repoRoot2, "README.md");
+  const readmePath = (0, import_node_path32.join)(repoRoot2, "README.md");
   if (!(0, import_node_fs32.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
@@ -37983,8 +38342,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs32.existsSync)((0, import_node_path31.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs32.existsSync)((0, import_node_path31.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs32.existsSync)((0, import_node_path32.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs32.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -38007,7 +38366,7 @@ async function syncProjectInfo(plan, client, apply) {
 
 // src/train-commands.ts
 var import_node_fs33 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_path33 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -38022,7 +38381,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs33.readFileSync)((0, import_node_path32.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs33.readFileSync)((0, import_node_path33.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -38133,7 +38492,7 @@ function releaseProgressVerdict(status, subject = "Release") {
 
 // src/suite-pin.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path33 = require("node:path");
+var import_node_path34 = require("node:path");
 async function openSuiteCutPinPr(deps, input) {
   if (!/^[a-f0-9]{40}$/.test(input.cut) || !input.pins.length) throw new Error("suite pin PR needs an anchored cut and at least one module");
   const ids = input.pins.map((p) => p.module);
@@ -38169,15 +38528,15 @@ async function openSuiteCutPinPr(deps, input) {
       const row = rows.find((r) => r.id === p.module);
       return row?.bundles.rc === p.rc && row?.bundles.main === p.main;
     })) throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
-    await (0, import_promises5.mkdir)((0, import_node_path33.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises5.mkdtemp)((0, import_node_path33.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises5.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises5.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     if ((await run("git", ["rev-parse", "HEAD"])).trim().toLowerCase() !== input.cut.toLowerCase())
       throw new Error("MM-Work development moved after the suite snapshot; no pin PR opened");
     await run("git", ["switch", "-c", branch]);
     for (const stage of ["rc", "main"]) {
-      const path2 = (0, import_node_path33.join)(scratch, `${stage}-pins.json`);
+      const path2 = (0, import_node_path34.join)(scratch, `${stage}-pins.json`);
       await (0, import_promises5.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
@@ -38223,8 +38582,8 @@ async function openSuitePinPr(deps, input) {
     url.searchParams.set("v", tag);
     const pin = url.toString();
     const branch = `suite-pin/${stage}-${member.id}-${tag}`;
-    await (0, import_promises5.mkdir)((0, import_node_path33.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises5.mkdtemp)((0, import_node_path33.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises5.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises5.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     const existing = JSON.parse(await run("gh", ["pr", "list", "--repo", SUITE_REPO, "--head", branch, "--state", "all", "--json", "url,state"]));
@@ -38267,7 +38626,7 @@ async function openSuitePinPr(deps, input) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_child_process16 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 var import_node_fs42 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
 init_clean_exit();
@@ -38292,11 +38651,11 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path41 = require("node:path");
+var import_node_path42 = require("node:path");
 init_house_map();
 
 // src/issue-body.ts
-var import_node_os18 = require("node:os");
+var import_node_os19 = require("node:os");
 init_error_codes();
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
@@ -38309,7 +38668,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os18.platform)() === "win32") {
+  if ((0, import_node_os19.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -38402,7 +38761,7 @@ init_github_client();
 
 // src/issue-commands.ts
 var import_node_fs34 = require("node:fs");
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -38875,7 +39234,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto12.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto13.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -39335,7 +39694,7 @@ ${lines2}`, {
 
 // src/post-merge-recon.ts
 var import_node_fs35 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_path35 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 init_github_client();
@@ -39502,7 +39861,7 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs35.mkdirSync)((0, import_node_path34.dirname)(path2), { recursive: true });
+  (0, import_node_fs35.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
   (0, import_node_fs35.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
@@ -39937,10 +40296,10 @@ function registerPrLifecycleCommands(program3) {
 }
 
 // src/review-verdict.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 var import_node_fs36 = require("node:fs");
-var import_node_os19 = require("node:os");
-var import_node_path35 = require("node:path");
+var import_node_os20 = require("node:os");
+var import_node_path36 = require("node:path");
 init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
 var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
@@ -40037,8 +40396,8 @@ async function checkPrReview(number, repo, head, deps = {
 }
 function computePrPatchId(number, repo) {
   return new Promise((resolve7, reject) => {
-    const gh2 = (0, import_node_child_process13.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
-    const git3 = (0, import_node_child_process13.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    const gh2 = (0, import_node_child_process14.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const git3 = (0, import_node_child_process14.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
     let out = "";
     let ghErr = "";
     let gitErr = "";
@@ -40105,8 +40464,8 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs36.mkdtempSync)((0, import_node_path35.join)((0, import_node_os19.tmpdir)(), "mmi-review-verdict-"));
-  const path2 = (0, import_node_path35.join)(dir, "body.md");
+  const dir = (0, import_node_fs36.mkdtempSync)((0, import_node_path36.join)((0, import_node_os20.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path36.join)(dir, "body.md");
   try {
     (0, import_node_fs36.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
@@ -40120,7 +40479,7 @@ async function postPrCommentFromFile(number, repo, body) {
 }
 
 // src/pr-create-docs-check.ts
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
@@ -40128,7 +40487,7 @@ function catFileBatch(root, ref, paths) {
   return new Promise((resolve7) => {
     const chunks = [];
     let settled = false;
-    const child2 = (0, import_node_child_process14.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
+    const child2 = (0, import_node_child_process15.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
     const finish = () => {
       if (settled) return;
       settled = true;
@@ -40340,17 +40699,17 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
 
 // src/worktree-residue-sweep.ts
 var import_node_fs41 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_path41 = require("node:path");
 
 // src/worktree-merge-cleanup.ts
 var import_node_fs40 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_path40 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process16 = require("node:child_process");
 var import_node_fs38 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_path38 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
@@ -40361,7 +40720,7 @@ function normalizeEol2(s) {
 
 // src/env-detection.ts
 var import_node_fs37 = require("node:fs");
-var import_node_path36 = require("node:path");
+var import_node_path37 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
   return name.toLowerCase() === ".env";
@@ -40379,13 +40738,13 @@ function findEnvFiles(root) {
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
-        walk2((0, import_node_path36.join)(dir, entry.name), relPath);
+        walk2((0, import_node_path37.join)(dir, entry.name), relPath);
         continue;
       }
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs37.lstatSync)((0, import_node_path36.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs37.lstatSync)((0, import_node_path37.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -40442,15 +40801,15 @@ function stageComposeFileEnv(files) {
 }
 
 // src/stage-runner.ts
-var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process15.execFile);
+var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process16.execFile);
 var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path37.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs38.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path38.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs38.existsSync)(configured)) return configured;
   const candidates = [
-    (0, import_node_path37.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
-    ...process.env.LOCALAPPDATA ? [(0, import_node_path37.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
+    (0, import_node_path38.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
+    ...process.env.LOCALAPPDATA ? [(0, import_node_path38.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
   const bash = candidates.find((path2) => (0, import_node_fs38.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
@@ -40583,7 +40942,7 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path37.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path38.join)(cwd, "tmp", "stage", "state.json");
 }
 function normPath(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -40800,7 +41159,7 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
-  const envFile = (0, import_node_path37.join)(cwd, ".env");
+  const envFile = (0, import_node_path38.join)(cwd, ".env");
   return (0, import_node_fs38.existsSync)(envFile) && envFileKeys((0, import_node_fs38.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
@@ -40814,13 +41173,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs38.existsSync)((0, import_node_path37.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs38.existsSync)((0, import_node_path38.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs38.existsSync)((0, import_node_path37.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs38.existsSync)((0, import_node_path38.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -40836,15 +41195,15 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   }
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys);
   if (!body) return {};
-  const overridePath = (0, import_node_path37.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs38.mkdirSync)((0, import_node_path37.join)(cwd, "tmp", "stage"), { recursive: true });
+  const overridePath = (0, import_node_path38.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
+  (0, import_node_fs38.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
   (0, import_node_fs38.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path37.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path37.join)(cwd, config.ensureEnv.example);
+  const target = (0, import_node_path38.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path38.join)(cwd, config.ensureEnv.example);
   if (!(0, import_node_fs38.existsSync)(target) && (0, import_node_fs38.existsSync)(example)) {
     (0, import_node_fs38.copyFileSync)(example, target);
   } else if ((0, import_node_fs38.existsSync)(target) && (0, import_node_fs38.existsSync)(example)) {
@@ -41025,7 +41384,7 @@ async function startStage(config = {}, opts = {}) {
   let up = sub(config.up.trim());
   if (opts.forceRecreate) up = appendForceRecreate(up);
   const identity = await resolveStageIdentity(cwd);
-  const child2 = (0, import_node_child_process15.spawn)(bash, ["-c", up], {
+  const child2 = (0, import_node_child_process16.spawn)(bash, ["-c", up], {
     cwd,
     // POSIX-only: the process group exists for the group-kill in stopStage. On win32 teardown is
     // `taskkill /T /F` (no group needed), and detached+shell defeats windowsHide — every spawn would
@@ -41135,7 +41494,7 @@ async function runStage(config = {}, opts = {}) {
 
 // src/worktree-evidence-archive.ts
 var import_node_fs39 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_path39 = require("node:path");
 var JERV_ARTIFACT_RUN_SCOPE_ENV_VARS = ["JERV_RUN_ID", ...SESSION_ID_ENV_VARS];
 function sanitizeArchiveSegment(value, max = 80) {
   const scrubbed = value.replace(/[^A-Za-z0-9._@+-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -41167,7 +41526,7 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   const resolveRoot = deps.resolveArchiveRoot ?? repoRuntimeStatePath;
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
-  const source = (0, import_node_path38.join)(args.worktreePath, ".jerv");
+  const source = (0, import_node_path39.join)(args.worktreePath, ".jerv");
   if (!exists(source)) return { status: "absent" };
   if (!isDirectory(source)) return { status: "skipped", reason: "jerv-not-a-directory" };
   const runScope = resolveArtifactRunScope(env);
@@ -41175,7 +41534,7 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "jerv-artifacts", runScope, branchSlug, stamp, ".jerv");
   try {
-    mkdirp((0, import_node_path38.dirname)(dest));
+    mkdirp((0, import_node_path39.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     return { status: "archived", path: dest, runScope };
@@ -41191,7 +41550,7 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
   const exists = deps.exists ?? import_node_fs39.existsSync;
   const stat4 = deps.stat ?? defaultStat;
   const readdir2 = deps.readdir ?? import_node_fs39.readdirSync;
-  const tmpRoot = (0, import_node_path38.join)(worktreePath, "tmp");
+  const tmpRoot = (0, import_node_path39.join)(worktreePath, "tmp");
   if (!exists(tmpRoot)) return [];
   const entries = [];
   const walk2 = (dir) => {
@@ -41202,14 +41561,14 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
       return;
     }
     for (const name of names) {
-      const full = (0, import_node_path38.join)(dir, name);
+      const full = (0, import_node_path39.join)(dir, name);
       let st;
       try {
         st = stat4(full);
       } catch {
         continue;
       }
-      const relPath = (0, import_node_path38.relative)(worktreePath, full).replace(/\\/g, "/");
+      const relPath = (0, import_node_path39.relative)(worktreePath, full).replace(/\\/g, "/");
       if (st.isDirectory()) {
         if (st.mtimeMs > newerThanMs) entries.push({ relPath, bytes: 0, mtimeMs: st.mtimeMs });
         walk2(full);
@@ -41234,7 +41593,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
   const scanned = scanWorktreeTmpEvidence(args.worktreePath, args.newerThanMs, deps);
-  const source = (0, import_node_path38.join)(args.worktreePath, "tmp");
+  const source = (0, import_node_path39.join)(args.worktreePath, "tmp");
   if (!scanned.length) return { status: "absent" };
   if (!exists(source)) return { status: "absent" };
   const runScope = resolveArtifactRunScope(env);
@@ -41242,7 +41601,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "worktree-artifacts", runScope, branchSlug, stamp, "tmp");
   try {
-    mkdirp((0, import_node_path38.dirname)(dest));
+    mkdirp((0, import_node_path39.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     const bytes = scanned.reduce((sum, e) => sum + e.bytes, 0);
@@ -41311,7 +41670,7 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path39.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path40.join)(wtPath, "node_modules");
   try {
     if ((0, import_node_fs40.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs40.rmdirSync)(nm);
     return { ok: true };
@@ -41448,7 +41807,7 @@ async function preCleanWorktreeForRemoval(wtPath, execGit) {
 }
 async function listNestedIgnoredNodeModules(wtPath, execGit) {
   const out = await execGit(["-C", wtPath, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory"]).catch(() => "");
-  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path39.join)(wtPath, line.slice(0, -1)));
+  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path40.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
   const stat4 = (0, import_node_fs40.lstatSync)(path2);
@@ -41461,7 +41820,7 @@ function safeRemoveTree(path2) {
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs40.readdirSync)(path2)) safeRemoveTree((0, import_node_path39.join)(path2, entry));
+    for (const entry of (0, import_node_fs40.readdirSync)(path2)) safeRemoveTree((0, import_node_path40.join)(path2, entry));
     (0, import_node_fs40.rmdirSync)(path2);
     return;
   }
@@ -41469,7 +41828,7 @@ function safeRemoveTree(path2) {
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
-    safeRemoveTree((0, import_node_path39.join)(wtPath, "node_modules"));
+    safeRemoveTree((0, import_node_path40.join)(wtPath, "node_modules"));
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -41513,7 +41872,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
-      const child2 = (0, import_node_path39.join)(dir, entry.name);
+      const child2 = (0, import_node_path40.join)(dir, entry.name);
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
@@ -41840,7 +42199,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
   if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
   unlinkedReparsePoints.push(...preHelperGuard.unlinked);
-  if (pathExists((0, import_node_path39.join)(wtPath, "node_modules"))) {
+  if (pathExists((0, import_node_path40.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? removeWorktreeNodeModules)(wtPath);
     if (!nmRemoved.ok) {
       report.worktree = {
@@ -41980,7 +42339,7 @@ function norm(p) {
   return process.platform === "win32" ? s.toLowerCase() : s;
 }
 function residueLedgerPath(gitCommonDir) {
-  return (0, import_node_path40.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
+  return (0, import_node_path41.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
 }
 function readPaths(file, deps) {
   try {
@@ -41993,7 +42352,7 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs41.mkdirSync)((0, import_node_path40.dirname)(f), { recursive: true });
+      (0, import_node_fs41.mkdirSync)((0, import_node_path41.dirname)(f), { recursive: true });
       (0, import_node_fs41.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
@@ -42044,7 +42403,7 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
   }
   if (recorded.length) writePaths(file, remaining, deps);
   const roots = /* @__PURE__ */ new Set();
-  for (const p of [...registered.slice(1), ...recorded]) roots.add((0, import_node_path40.dirname)(p));
+  for (const p of [...registered.slice(1), ...recorded]) roots.add((0, import_node_path41.dirname)(p));
   const keptKeys = new Set(remaining.map(norm));
   for (const root of roots) {
     if (!isDir(root) || live.has(norm(root)) || norm(root) === primary) continue;
@@ -42055,7 +42414,7 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
       continue;
     }
     for (const name of children) {
-      const child2 = (0, import_node_path40.join)(root, name);
+      const child2 = (0, import_node_path41.join)(root, name);
       const key = norm(child2);
       if (live.has(key) || key === primary || keptKeys.has(key) || !isDir(child2)) continue;
       let entries;
@@ -42123,10 +42482,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path41.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path42.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs42.existsSync)((0, import_node_path41.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs42.existsSync)((0, import_node_path41.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs42.existsSync)((0, import_node_path42.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs42.existsSync)((0, import_node_path42.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -42138,7 +42497,7 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path41.join)(root, path2);
+      const fullPath = (0, import_node_path42.join)(root, path2);
       return (0, import_node_fs42.existsSync)(fullPath) ? (0, import_node_fs42.readFileSync)(fullPath, "utf8") : null;
     }
   };
@@ -42246,7 +42605,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process16.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process17.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -42897,11 +43256,11 @@ ${list}`);
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path41.join)(cwd, ".github", "workflows");
+    const wfDir = (0, import_node_path42.join)(cwd, ".github", "workflows");
     if (!(0, import_node_fs42.existsSync)(wfDir)) return [];
     return (0, import_node_fs42.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs42.readFileSync)((0, import_node_path41.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs42.readFileSync)((0, import_node_path42.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -43406,7 +43765,7 @@ ${list}`);
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path41.join)((0, import_node_path41.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path42.join)((0, import_node_path42.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -43615,7 +43974,7 @@ ${list}`);
     let residueSweep;
     if (!(foreignCwd && !foreignCheckout)) {
       try {
-        gitCommonDir = (0, import_node_path41.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
+        gitCommonDir = (0, import_node_path42.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
         residueSweep = await sweepWorktreeResidue(gitCommonDir, beforeWorktrees.map((w) => w.path));
       } catch {
       }
@@ -44709,15 +45068,15 @@ function rcRunCauseFromLog(log) {
 }
 function suiteTrainIo(root, summaryFile) {
   const recordPath = repoRuntimeStatePath(root, "suite", "cut.json");
-  const base = (0, import_node_path42.join)(repoRuntimeStatePath(root, "suite"), "checkouts");
+  const base = (0, import_node_path43.join)(repoRuntimeStatePath(root, "suite"), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path42.join)(base, repo.split("/")[1]);
+    const target = (0, import_node_path43.join)(base, repo.split("/")[1]);
     if (!(0, import_node_fs43.existsSync)(target)) {
       (0, import_node_fs43.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs43.existsSync)((0, import_node_path42.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs43.existsSync)((0, import_node_path43.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -45106,8 +45465,8 @@ async function collectWaveStatus(deps) {
 init_github_client();
 init_cli_shared();
 var import_node_fs46 = require("node:fs");
-var import_node_os20 = require("node:os");
-var import_node_path43 = require("node:path");
+var import_node_os21 = require("node:os");
+var import_node_path44 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -45296,10 +45655,10 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os20.homedir)();
+  const home = (0, import_node_os21.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path43.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs46.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path43.join)(home, ".claude", "settings.json"), import_node_fs46.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path44.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs46.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path44.join)(home, ".claude", "settings.json"), import_node_fs46.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -48413,7 +48772,7 @@ function registerSessionReport(program3) {
 
 // src/stage-commands.ts
 var import_node_fs47 = require("node:fs");
-var import_node_path44 = require("node:path");
+var import_node_path45 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -48659,8 +49018,8 @@ function registerStageCommands(program3) {
     return {
       resolution: decideStage({
         registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-        hasCompose: (0, import_node_fs47.existsSync)((0, import_node_path44.join)(process.cwd(), "docker-compose.yml")),
-        hasEnvExample: (0, import_node_fs47.existsSync)((0, import_node_path44.join)(process.cwd(), ".env.example")),
+        hasCompose: (0, import_node_fs47.existsSync)((0, import_node_path45.join)(process.cwd(), "docker-compose.yml")),
+        hasEnvExample: (0, import_node_fs47.existsSync)((0, import_node_path45.join)(process.cwd(), ".env.example")),
         repo
       }),
       project: project2,
@@ -48944,20 +49303,20 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 var import_node_fs48 = require("node:fs");
 var import_promises10 = require("node:fs/promises");
-var import_node_path45 = require("node:path");
+var import_node_path46 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto13.createHash)("sha256");
+  const hash = (0, import_node_crypto14.createHash)("sha256");
   for await (const chunk of (0, import_node_fs48.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path45.resolve)(inputPath);
+  const path2 = (0, import_node_path46.resolve)(inputPath);
   const info = await (0, import_promises10.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
@@ -49147,7 +49506,7 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 init_house_map();
 init_hub_url();
 
@@ -49180,27 +49539,27 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/dist-drift.ts
-var import_node_child_process17 = require("node:child_process");
-var import_node_crypto15 = require("node:crypto");
+var import_node_child_process18 = require("node:child_process");
+var import_node_crypto16 = require("node:crypto");
 var import_node_fs50 = require("node:fs");
-var import_node_os21 = require("node:os");
-var import_node_path47 = require("node:path");
+var import_node_os22 = require("node:os");
+var import_node_path48 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var import_node_fs49 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_path47 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path46.resolve)(root);
-  const target = (0, import_node_path46.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path46.sep}`)) {
+  const absoluteRoot = (0, import_node_path47.resolve)(root);
+  const target = (0, import_node_path47.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path47.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto14.createHash)("sha256");
+  const hash = (0, import_node_crypto15.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs49.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs49.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -49230,7 +49589,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha256 = (bytes) => `sha256:${(0, import_node_crypto15.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha256 = (bytes) => `sha256:${(0, import_node_crypto16.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha256(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha256(rebuiltBytes) : ABSENT;
@@ -49308,7 +49667,7 @@ function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
     for (const entry of (0, import_node_fs50.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path47.join)(directory, entry.name);
+      const child2 = (0, import_node_path48.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -49318,14 +49677,14 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs50.readFileSync)((0, import_node_path47.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path47.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs50.readFileSync)((0, import_node_path48.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path48.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path47.join)(root, "distribution-bom.json");
+    return (0, import_node_path48.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process17.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process18.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -49334,28 +49693,28 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs50.mkdtempSync)((0, import_node_path47.join)((0, import_node_os21.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs50.mkdtempSync)((0, import_node_path48.join)((0, import_node_os22.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path47.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path47.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path47.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path47.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path48.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path48.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path48.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path48.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path47.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path48.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path47.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path47.join)(root, path2));
-    const distRoot = (0, import_node_path47.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path47.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const committed = (path2) => readOrNull((0, import_node_path48.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path48.join)(root, path2));
+    const distRoot = (0, import_node_path48.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path48.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
     const bom = JSON.parse((0, import_node_fs50.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path47.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path48.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path47.join)(overlay, entry.path);
-        (0, import_node_fs50.mkdirSync)((0, import_node_path47.dirname)(target), { recursive: true });
+        const target = (0, import_node_path48.join)(overlay, entry.path);
+        (0, import_node_fs50.mkdirSync)((0, import_node_path48.dirname)(target), { recursive: true });
         (0, import_node_fs50.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
@@ -49441,7 +49800,7 @@ init_hub_auth();
 
 // src/schedules-lift-command.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_path48 = require("node:path");
+var import_node_path49 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -49470,7 +49829,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises11.readFile)((0, import_node_path48.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises11.readFile)((0, import_node_path49.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -49552,9 +49911,9 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_fs51 = require("node:fs");
-var import_node_path49 = require("node:path");
+var import_node_path50 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -49623,7 +49982,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process18.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process19.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,
@@ -49640,7 +49999,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs51.readFileSync)((0, import_node_path49.join)(root, file), "utf8");
+      raw = (0, import_node_fs51.readFileSync)((0, import_node_path50.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -49660,7 +50019,7 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path50.join)(process.cwd(), ".gitignore");
+    const path2 = (0, import_node_path51.join)(process.cwd(), ".gitignore");
     const current = (0, import_node_fs52.existsSync)(path2) ? (0, import_node_fs52.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
@@ -49935,12 +50294,12 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path51.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path52.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os22.homedir)()),
+      envHealLockPath((0, import_node_os23.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -50037,7 +50396,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os22.homedir)(),
+        (0, import_node_os23.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -50065,7 +50424,7 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os22.homedir)(),
+        (0, import_node_os23.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
@@ -50107,7 +50466,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs53.existsSync)((0, import_node_path51.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs53.existsSync)((0, import_node_path52.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -50116,7 +50475,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs53.existsSync)((0, import_node_path51.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs53.existsSync)((0, import_node_path52.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -51203,16 +51562,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path51.join)(root, path2);
+      const fullPath = (0, import_node_path52.join)(root, path2);
       return (0, import_node_fs53.existsSync)(fullPath) ? (0, import_node_fs53.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path51.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path52.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs53.existsSync)((0, import_node_path51.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs53.existsSync)((0, import_node_path51.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs53.existsSync)((0, import_node_path52.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs53.existsSync)((0, import_node_path52.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -51353,7 +51712,7 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path51.join)(path2, entry.name);
+    const child2 = (0, import_node_path52.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
@@ -51383,7 +51742,7 @@ function pluginCacheFsDeps(configRoot, dirBytes) {
     dirBytes,
     listStagingDirs: (root) => (0, import_node_fs53.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path51.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs53.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path52.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs53.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -51397,7 +51756,7 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path51.join)(stagingRoot, name);
+      const p = (0, import_node_path52.join)(stagingRoot, name);
       if (!(0, import_node_fs53.existsSync)(p)) return null;
       try {
         return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs53.statSync)(q).mtimeMs);
@@ -51420,7 +51779,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os22.homedir)(),
+    (0, import_node_os23.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }