@mutmutco/codex-plugin 4.5.103 → 4.5.105

package/cli/dist/main.cjs

@@ -4747,7 +4747,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs54 = require("node:fs");
+var import_node_fs55 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 
@@ -14908,7 +14908,7 @@ async function readDefaultBranchGate(repo, client, baseBranch, now = Date.now(),
 async function gateIsProvenGreen(repo, client, baseBranch, gateFiles = DEFAULT_GATE_FILES) {
   return (await readDefaultBranchGate(repo, client, baseBranch, Date.now(), gateFiles)).state === "green";
 }
-async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active") {
+async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active", dryRun = false) {
   const want = new Set(rulesetRequiredContexts({ rules: rulesetBody.rules }));
   const wantStrict = rulesetStrictPolicy({ rules: rulesetBody.rules });
   const wantBranches = rulesetBranchIncludes(rulesetBody);
@@ -14927,10 +14927,10 @@ async function activateProductRuleset(repo, rulesetBody, client, enforcement = "
     if (detail.enforcement === effective && branchesMatch && strictMatch && have.size === want.size && [...want].every((c) => have.has(c))) {
       return { action: "skipped", enforcement: effective, detail: `${effective} ruleset already matches required contexts, branches and up-to-date policy${kept}` };
     }
-    await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body: { ...rulesetBody, enforcement: effective }, timeoutMs: 2e4 });
+    if (!dryRun) await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body: { ...rulesetBody, enforcement: effective }, timeoutMs: 2e4 });
     return { action: "updated", enforcement: effective, detail: `ruleset ${existing.id}${kept}` };
   }
-  await client.rest("POST", `repos/${repo}/rulesets`, { body: { ...rulesetBody, enforcement }, timeoutMs: 2e4 });
+  if (!dryRun) await client.rest("POST", `repos/${repo}/rulesets`, { body: { ...rulesetBody, enforcement }, timeoutMs: 2e4 });
   return { action: "created", enforcement };
 }
 async function gateContextEnforced(repo, rest) {
@@ -16383,7 +16383,7 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     suite,
     ...suite === "mm-work" && deployModel === "tenant-container" ? {
       requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"],
-      requiredChecks: ["gate", "screens / screens"]
+      requiredChecks: options.existing?.requiredChecks ?? ["gate"]
     } : {},
     repos: [`${parsedRepo.owner}/${slug}`],
     branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
@@ -17699,10 +17699,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.103",
-    tag: "v4.5.103",
-    commit: "c2dd99cf0d72",
-    npm: "@mutmutco/cli@4.5.103"
+    version: "4.5.105",
+    tag: "v4.5.105",
+    commit: "2edfdb644608",
+    npm: "@mutmutco/cli@4.5.105"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17719,14 +17719,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.103"
+          v3Target: "v4.5.105"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.103 and redeploy the Hub Lambda from tag v4.5.103 (c2dd99cf0d72); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.103 (@mutmutco/cli@4.5.103, tag commit c2dd99cf0d72 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.105 and redeploy the Hub Lambda from tag v4.5.105 (2edfdb644608); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.105 (@mutmutco/cli@4.5.105, tag commit 2edfdb644608 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21992,7 +21992,7 @@ function renderTenantControl(r) {
 }
 
 // src/train-apply-phases.ts
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
 var import_node_path24 = require("node:path");
 
@@ -25765,6 +25765,7 @@ function formatTrainDoctor(v) {
 
 // src/release-plain-words.ts
 var import_promises3 = require("node:fs/promises");
+var import_node_fs24 = require("node:fs");
 function releaseCutByNotes(cutBy) {
   return `## Internal
 Cut by ${formatSessionIdentity(cutBy)}
@@ -25779,8 +25780,44 @@ function buildPlainWordsSection(lines2, big, heading = PLAIN_WORDS_HEADING) {
   if (big) body.push(PLAIN_WORDS_MARKER);
   return body.join("\n");
 }
-function noChangePlainWordsLine(suiteTag) {
-  return suiteTag ? `No changes to this module in this release; ships with the MM-Work suite ${suiteTag}.` : "No changes to this module in this release.";
+var SUMMARY_GUIDE = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing";
+function validatePlainWordsSummary(content) {
+  const lines2 = content.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+  if (lines2[0]?.startsWith("No changes to this module")) throw new Error(`requires a real MM-Work title, not the no-change placeholder \u2014 see ${SUMMARY_GUIDE}`);
+  if (lines2.length < 3 || lines2.length > 6) throw new Error(`requires 3\u20136 curated non-empty lines (title + 2\u20135 notes; found ${lines2.length}) \u2014 see ${SUMMARY_GUIDE}`);
+}
+function validateSuiteReleaseSummary(path2) {
+  if (!path2) throw new Error(`requires --announce-summary-file <path> before promoting any member \u2014 see ${SUMMARY_GUIDE}`);
+  let content;
+  try {
+    content = (0, import_node_fs24.readFileSync)(path2, "utf8");
+  } catch (e) {
+    throw new Error(`could not read summary file ${path2}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
+  }
+  validatePlainWordsSummary(content);
+}
+async function validateReleaseSummaries(releases, files, releaseExists) {
+  const refusals = [];
+  for (const { repo, tag } of releases) {
+    if (await releaseExists(repo, tag)) continue;
+    try {
+      validateSuiteReleaseSummary(files[repo]);
+    } catch (e) {
+      refusals.push(`${repo}: ${e.message}`);
+    }
+  }
+  if (refusals.length) throw new Error(`suite release summaries refused; no member was released:
+${refusals.join("\n")}`);
+}
+async function requireSuiteReleaseSummary(deps, path2) {
+  if (!path2) throw new Error(`a new mm-work suite Release requires --announce-summary-file <path> with a title + 2\u20135 notes \u2014 see ${SUMMARY_GUIDE}`);
+  let content;
+  try {
+    content = await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(path2);
+  } catch (e) {
+    throw new Error(`could not read --announce-summary-file ${path2}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
+  }
+  validatePlainWordsSummary(content);
 }
 function upsertPlainWordsSection(body, section) {
   let rest = body;
@@ -25810,7 +25847,8 @@ function plainWordsSummaryLines(content) {
 async function writePlainWordsIfSuiteMember(deps, args) {
   if (args.meta?.suite !== "mm-work") return;
   try {
-    const lines2 = args.summaryLines && args.summaryLines.length > 0 ? args.summaryLines : [noChangePlainWordsLine(args.suiteTag)];
+    if (!args.summaryLines?.length) return;
+    const lines2 = args.summaryLines;
     const section = [
       buildPlainWordsSection(lines2, args.big === true),
       ...args.summaryLinesTr?.length ? [buildPlainWordsSection(args.summaryLinesTr, false, PLAIN_WORDS_HEADING_TR)] : []
@@ -25962,14 +26000,14 @@ function readLocalGateWorkflows() {
   const dir = (0, import_node_path24.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs24.readdirSync)(dir);
+    names = (0, import_node_fs25.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs24.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -25979,14 +26017,14 @@ function readLocalWorkflows() {
   const dir = (0, import_node_path24.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs24.readdirSync)(dir);
+    names = (0, import_node_fs25.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter((n) => /\.ya?ml$/i.test(n))) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs24.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -26868,7 +26906,7 @@ async function activeRcandLedgerCandidate(deps, cwd) {
   }
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs24.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -27157,6 +27195,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
   }
   const ledgerMode = persisted ? "strict" : "migration";
   const partialRelease = await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo);
+  if (partialRelease && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
   if (!partialRelease) {
     try {
       await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
@@ -28031,6 +28070,7 @@ async function runTrainApplyLocked(command, deps, options = {}) {
   const bumpIntent = await resolveTrainBumpIntent(deps, process.env, void 0, preOneZeroInForce(meta));
   const branchHints = await loadReleaseTrackBranchHints(deps);
   const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
+  if (command === "release" && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
   const pipelineInput = { deps, ctx, command, meta, branchHints, watch, options, bumpIntent };
   if (command === "rcand") {
     if (directTrack) {
@@ -28344,7 +28384,7 @@ function planBranchRequiredContexts(input) {
   })).filter((entry) => entry.contexts.length > 0);
   return { common, pending, waiting };
 }
-async function branchContextPlan(deps, repo, authority, meta) {
+async function branchContextPlan(deps, repo, authority, meta, emittedBranchesOnly = false) {
   const branches = resolveRequiredCheckBranches(meta, repo);
   const emittedByBranch = {};
   const unreadable = [];
@@ -28354,7 +28394,10 @@ async function branchContextPlan(deps, repo, authority, meta) {
     emittedByBranch[branch] = await resolveEmittedPrContexts(deps, repo, branch);
     if (presence === void 0 || emittedByBranch[branch] === void 0) unreadable.push(branch);
   }
-  return { ...planBranchRequiredContexts({ contexts: authority.contexts, branches, emittedByBranch }), unreadable };
+  const bindingBranches = emittedBranchesOnly ? branches.filter((branch) => authority.contexts.some((context) => emittedByBranch[branch]?.includes(context))) : branches;
+  const plan = planBranchRequiredContexts({ contexts: authority.contexts, branches: bindingBranches, emittedByBranch });
+  const waiting = planBranchRequiredContexts({ contexts: authority.contexts, branches, emittedByBranch }).waiting;
+  return { ...plan, waiting, unreadable, bindingBranches };
 }
 function projectCommonAuthority(authority, common) {
   const apiPayload = patchRulesetRequiredContexts(authority.apiPayload, common);
@@ -28608,8 +28651,8 @@ async function auditRepoCi(repo, callerDeps) {
         checks.push({
           ok: pendingAligned,
           label: "branch-specific required checks match workflow emitters",
-          detail: pendingAligned ? void 0 : "pending ruleset contexts or branch conditions have not converged to the emitted registry requirements",
-          remediation: pendingAligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
+          detail: pendingAligned ? void 0 : `pending ruleset contexts or branch conditions have not converged to the emitted registry requirements \u2014 run mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`,
+          remediation: pendingAligned ? void 0 : `mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`
         });
       }
     }
@@ -28641,7 +28684,7 @@ async function auditRepoCi(repo, callerDeps) {
         checks.push({
           ok: aligned,
           label: RULESET_REFERENCE_MATCH_LABEL,
-          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy differs from committed policy \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`),
+          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy differs from committed policy \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`) + ` \u2014 live repair: mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`,
           remediation: aligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
         });
       }
@@ -29184,9 +29227,14 @@ async function authoritativeSafetyHold(authority, deps, repo, baseBranch, meta)
   }
   return null;
 }
-async function applyCiReconcileRepo(repo, deps) {
+async function applyCiReconcileRepo(repo, deps, options = {}) {
+  if (options.dryRun && !options.productRulesetOnly) throw new Error("dry-run requires productRulesetOnly");
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
+  if (options.productRulesetOnly && !meta?.requiredChecks?.length) {
+    return { repo, applied: [], skipped: [], errors: ["product-ruleset requires registry META requiredChecks"] };
+  }
   const report = await auditRepoCi(repo, deps);
+  const finish = (result2, pendingReason) => options.productRulesetOnly ? Promise.resolve(result2) : finalizeCiReconcile(repo, deps, result2, report, pendingReason);
   const baseBranch = "development";
   let raw = report.class === "deployable" && !report.explicitNoCi ? await fetchRulesetSeedBody(deps, repo) : null;
   let authority = null;
@@ -29196,12 +29244,12 @@ async function applyCiReconcileRepo(repo, deps) {
       authority = parseAuthoritativeRuleset(raw, meta, repo);
     } catch (e) {
       empty.errors.push(`${PRODUCT_RULESET_REF} is not parseable: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, empty, report);
+      return finish(empty);
     }
     const hold = await authoritativeSafetyHold(authority, deps, repo, baseBranch, meta);
     if (hold) {
       empty.skipped.push(hold);
-      return finalizeCiReconcile(repo, deps, empty, report, hold);
+      return finish(empty, hold);
     }
   } else if (report.class === "deployable" && !report.explicitNoCi) {
     const registryAuthority = registryAuthorityWithoutReference(meta, repo);
@@ -29209,59 +29257,64 @@ async function applyCiReconcileRepo(repo, deps) {
       const hold = await authoritativeSafetyHold(registryAuthority, deps, repo, baseBranch, meta);
       if (hold) {
         empty.skipped.push(hold);
-        return finalizeCiReconcile(repo, deps, empty, report, hold);
+        return finish(empty, hold);
       }
     }
   }
-  const result = await applyCiReconcileMergeSettingsFromReport(repo, deps, report);
+  const result = options.productRulesetOnly ? empty : await applyCiReconcileMergeSettingsFromReport(repo, deps, report);
   if (report.class !== "deployable" || report.explicitNoCi) {
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
-  const refDelivery = await seedGateYml(repo, deps, meta, result);
+  const refDelivery = options.productRulesetOnly ? void 0 : await seedGateYml(repo, deps, meta, result);
   if (refDelivery === "pending") {
     const reason = `${PRODUCT_RULESET_REF} is pending on its protected-base source PR; live ruleset convergence waits for that source to merge`;
     result.skipped.push(reason);
-    return finalizeCiReconcile(repo, deps, result, report, reason);
+    return finish(result, reason);
   }
   raw ??= await fetchRulesetSeedBody(deps, repo);
   if (!raw) {
     result.errors.push(`missing ${PRODUCT_RULESET_REF} on development \u2014 run bootstrap apply first`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   if (authority == null) {
     try {
       authority = parseAuthoritativeRuleset(raw, meta, repo);
     } catch (e) {
       result.errors.push(`${PRODUCT_RULESET_REF} is not parseable: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
     const hold = await authoritativeSafetyHold(authority, deps, repo, baseBranch, meta);
     if (hold) {
       result.skipped.push(hold);
-      return finalizeCiReconcile(repo, deps, result, report, hold);
+      return finish(result, hold);
     }
   }
   if (authority.contexts.length === 0) {
     result.errors.push(`${authority.source} declares no required contexts`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   let pendingPlan = null;
   const declaredContexts = authority.contexts;
   if (authority.source === "registry META requiredChecks") {
-    pendingPlan = await branchContextPlan(deps, repo, authority, meta);
+    pendingPlan = await branchContextPlan(deps, repo, authority, meta, options.productRulesetOnly);
     if (pendingPlan.unreadable.length) {
       const reason = `required branch workflow emitters unreadable on [${pendingPlan.unreadable.join(", ")}] \u2014 ruleset convergence deferred`;
       result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
+      return finish(result, reason);
     }
     if (pendingPlan.common.length === 0) {
       result.errors.push("no common required context is emitted by every required branch \u2014 ruleset convergence deferred");
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
     authority = projectCommonAuthority(authority, pendingPlan.common);
+    if (options.productRulesetOnly) {
+      const apiPayload = patchRulesetBranchIncludes(authority.apiPayload, pendingPlan.bindingBranches);
+      authority = { ...authority, apiPayload, branchIncludes: rulesetBranchIncludes(apiPayload) };
+      for (const entry of pendingPlan.waiting) result.skipped.push(`${entry.branch} waits for workflow emitter(s) [${entry.contexts.join(", ")}]`);
+    }
   }
   const sourceNeedsConvergence = !sameContexts(authority.committedContexts, authority.contexts) || !sameContexts(authority.committedBranchIncludes, authority.branchIncludes) || !authority.committedStrict;
-  if (sourceNeedsConvergence) {
+  if (sourceNeedsConvergence && !options.productRulesetOnly) {
     try {
       const delivery = await deliverSeedFile(
         deps,
@@ -29278,15 +29331,15 @@ async function applyCiReconcileRepo(repo, deps) {
           `${PRODUCT_RULESET_REF} authority \u2192 contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}] delivered on ${delivery.plan.branch} (${delivery.plan.reason})${delivery.prUrl ? `: ${delivery.prUrl}` : ""}`
         );
         const reason = `${PRODUCT_RULESET_REF} authority is pending on its protected-base source PR; live ruleset convergence waits for that source to merge`;
-        return finalizeCiReconcile(repo, deps, result, report, reason);
+        return finish(result, reason);
       } else {
         result.applied.push(`reconciled ${PRODUCT_RULESET_REF} authority \u2192 contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}]`);
       }
     } catch (e) {
       result.errors.push(`ruleset reference delivery failed: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
-  } else {
+  } else if (!options.productRulesetOnly) {
     result.skipped.push(`${PRODUCT_RULESET_REF} already matches declared context and branch authority`);
   }
   let live;
@@ -29294,7 +29347,7 @@ async function applyCiReconcileRepo(repo, deps) {
     live = await readLiveProductRuleset(deps, repo);
   } catch (e) {
     result.errors.push(`cannot read the live ${PRODUCT_RULESET_NAME} ruleset: ${e.message}`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   const liveContexts = live == null ? [] : sortedUnique(rulesetRequiredContexts(live));
   const liveBranchIncludes = live == null ? [] : rulesetBranchIncludes(live);
@@ -29312,7 +29365,7 @@ async function applyCiReconcileRepo(repo, deps) {
   if (pendingPlan?.pending.some((entry) => entry.contexts.some((context) => unsafe.includes(context)))) {
     const reason = `pending required-check rulesets left non-enforcing \u2014 [${unsafe.join(", ")}] emitted only by path-filtered workflows`;
     result.skipped.push(reason);
-    return finalizeCiReconcile(repo, deps, result, report, reason);
+    return finish(result, reason);
   }
   const gateProvenGreen = await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles);
   const plan = resolveProductRulesetReconcilePlan({
@@ -29329,25 +29382,25 @@ async function applyCiReconcileRepo(repo, deps) {
   if (!plan.shouldActivate) {
     if (plan.holdReason) {
       result.skipped.push(plan.holdReason);
-      return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
+      return finish(result, plan.holdReason);
     }
     result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts, branches and up-to-date policy already match declared authority`);
   }
   if (plan.shouldActivate) {
     try {
-      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
+      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement, options.dryRun);
       if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
-      else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+      else result.applied.push(`product ruleset ${activation.action} (${activation.enforcement}; contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}])${activation.detail ? `: ${activation.detail}` : ""}`);
     } catch (e) {
       result.errors.push(e.message);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
   }
   if (pendingPlan) {
     if (pendingPlan.pending.length > 0 && !gateProvenGreen) {
       const reason = "pending required-check rulesets left non-enforcing \u2014 the gate is not green on development";
       result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
+      return finish(result, reason);
     }
     try {
       const desired = /* @__PURE__ */ new Set();
@@ -29363,20 +29416,20 @@ async function applyCiReconcileRepo(repo, deps) {
           patchRulesetRequiredContexts(statusOnly, entry.contexts),
           [entry.branch]
         );
-        const activation = await activateProductRuleset(repo, payload, deps.client);
-        (activation.action === "skipped" ? result.skipped : result.applied).push(`${name}: ${activation.action}`);
+        const activation = await activateProductRuleset(repo, payload, deps.client, "active", options.dryRun);
+        (activation.action === "skipped" ? result.skipped : result.applied).push(`${name}: ${activation.action} \u2014 contexts [${entry.contexts.join(", ")}]`);
       }
       const list = await deps.client.rest("GET", `repos/${repo}/rulesets`);
       for (const stale of list ?? []) {
         if (!stale.name?.startsWith(PRODUCT_PENDING_RULESET_PREFIX) || desired.has(stale.name) || stale.id == null) continue;
-        await deps.client.rest("DELETE", `repos/${repo}/rulesets/${stale.id}`);
+        if (!options.dryRun) await deps.client.rest("DELETE", `repos/${repo}/rulesets/${stale.id}`);
         result.applied.push(`deleted converged ${stale.name}`);
       }
     } catch (e) {
       result.errors.push(`pending ruleset convergence failed: ${e.message}`);
     }
   }
-  return finalizeCiReconcile(repo, deps, result, report);
+  return finish(result);
 }
 
 // src/command-composition.ts
@@ -30728,7 +30781,7 @@ function registerBoardCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_os17 = require("node:os");
 var import_node_path28 = require("node:path");
 init_cli_shared();
@@ -30914,7 +30967,7 @@ init_github_client();
 init_cli_shared();
 
 // src/port-registry.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_node_path25 = require("node:path");
 
 // ../infra/port-geometry.mjs
@@ -30929,8 +30982,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs25.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs25.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs26.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -30960,7 +31013,7 @@ function existingPortRange(repo, registry2) {
 function portRangeInfraAt(root, source) {
   const registryPath = (0, import_node_path25.join)(root, "infra", "port-ranges.json");
   const ddbScriptPath = (0, import_node_path25.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs25.existsSync)(registryPath) || !(0, import_node_fs25.existsSync)(ddbScriptPath)) return null;
+  if (!(0, import_node_fs26.existsSync)(registryPath) || !(0, import_node_fs26.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
@@ -31042,7 +31095,7 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 
 // src/box-commands.ts
-var import_node_fs27 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 var import_node_child_process10 = require("node:child_process");
 var import_node_os16 = require("node:os");
 var import_node_path27 = require("node:path");
@@ -31174,7 +31227,7 @@ function applyRemoteScript(items, date) {
 init_clean_exit();
 
 // src/secrets-commands.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_path26 = require("node:path");
 var import_node_os15 = require("node:os");
 init_cli_shared();
@@ -32336,8 +32389,8 @@ async function decryptRailsCredentials(input) {
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs26.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs26.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs27.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs27.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -32347,9 +32400,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs26.mkdtempSync)((0, import_node_path26.join)((0, import_node_os15.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptDir = (0, import_node_fs27.mkdtempSync)((0, import_node_path26.join)((0, import_node_os15.tmpdir)(), "mmi-rails-decrypt-"));
   const scriptPath = (0, import_node_path26.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs26.writeFileSync)(scriptPath, script, "utf8");
+  (0, import_node_fs27.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -32361,7 +32414,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs26.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs27.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -32451,7 +32504,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs26.readFileSync)((0, import_node_path26.resolve)(o.file), "utf8");
+        body = (0, import_node_fs27.readFileSync)((0, import_node_path26.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -32587,7 +32640,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs26.unlinkSync)((0, import_node_path26.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs27.unlinkSync)((0, import_node_path26.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -32635,8 +32688,6 @@ function registerSecretsCommands(program3) {
 var BOX_KEYS = {
   /** Opens every MM box INCLUDING the CI runner (`mmi-runner`). The general-purpose MM key. */
   mmMaster: "HETZNER_MASTER_SSH_PRIVATE_KEY",
-  /** Opens the OGUZ project's boxes. */
-  oguzMaster: "HETZNER_OGUZ_MASTER_SSH_PRIVATE_KEY",
   /** The deploy key. Opens MM prod/tenant boxes but NOT `mmi-runner` — a real trap: reaching for this key
    *  to get into the CI runner fails, and the failure reads like a broken box rather than a wrong key. */
   mmDeploy: "HETZNER_SSH_PRIVATE_KEY"
@@ -32645,11 +32696,10 @@ var HETZNER_VAULT_SLUG = "_org";
 var HETZNER_NS = "hetzner";
 var nsKey = (key) => `${HETZNER_NS}/${key}`;
 var PROJECT_API_TOKEN = {
-  MM: nsKey("HETZNER_MM_API_TOKEN"),
-  OGUZ: nsKey("HETZNER_OGUZ_API_TOKEN")
+  MM: nsKey("HETZNER_MM_API_TOKEN")
 };
-function sshKeyForProject(project2) {
-  return project2 === "OGUZ" ? BOX_KEYS.oguzMaster : BOX_KEYS.mmMaster;
+function sshKeyForProject(_project) {
+  return BOX_KEYS.mmMaster;
 }
 function vaultPath(key) {
   return `/mmi-future/${HETZNER_VAULT_SLUG}/${HETZNER_NS}/${key}`;
@@ -32752,7 +32802,7 @@ var HETZNER_API = "https://api.hetzner.cloud/v1/servers";
 var HETZNER_TIMEOUT_MS = 15e3;
 var PER_PAGE = 50;
 var MAX_PAGES = 20;
-var PROJECTS = ["MM", "OGUZ"];
+var PROJECTS = ["MM"];
 async function fetchProjectBoxes(project2, token) {
   const boxes = [];
   let page = 1;
@@ -32846,7 +32896,7 @@ function registerBoxCommands(program3) {
       }
       const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs27.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs28.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -32920,17 +32970,17 @@ function hubGitShow(ref) {
   return (path2) => git3(["show", `${ref}:${path2}`]);
 }
 function runOnBox(found, script) {
-  const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-box-control-"));
+  const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-box-control-"));
   try {
     const recipe = (0, import_node_path27.join)(dir, "recipe.sh");
-    (0, import_node_fs27.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    (0, import_node_fs28.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
     const r = (0, import_node_child_process10.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
     return r.stdout;
   } finally {
-    (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function formatControl(mode, box, rows) {
@@ -34433,8 +34483,8 @@ function suiteModulePackageAccessCheck(suite, deployModel) {
   if (suite !== "mm-work" || deployModel !== "tenant-container") return void 0;
   return {
     ok: true,
-    label: "mmwork-ds package access (manual org-admin step; unverified)",
-    detail: "An org admin must add this repository with Read under @mutmutco/mmwork-ds \u2192 Package settings \u2192 Manage Actions access. No GitHub REST API can verify or grant this; without it CI fails with 403 read_package."
+    label: "mmwork-ds + mmwork-screens package access (manual org-admin step; unverified)",
+    detail: `An org admin must add this repository with Read under BOTH @mutmutco/mmwork-ds and @mutmutco/mmwork-screens \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build or the screens job fails with 403 read_package. Once screens is green, require it: mmi-cli oracle org project set <owner/repo> --var 'requiredChecks=["gate","screens / screens"]'.`
   };
 }
 function attachTrainDoctorVerdicts(report, trainDoctors) {
@@ -34565,12 +34615,12 @@ async function verifyTargetedSeedPr(repo, number, plan, target, expected, client
 // src/bootstrap-commands.ts
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 async function gateRenderDiff(current, rendered) {
-  const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-gate-diff-"));
+  const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-gate-diff-"));
   const before = (0, import_node_path28.join)(dir, "committed-gate.yml");
   const after = (0, import_node_path28.join)(dir, "registry-render.yml");
   try {
-    (0, import_node_fs28.writeFileSync)(before, current);
-    (0, import_node_fs28.writeFileSync)(after, rendered);
+    (0, import_node_fs29.writeFileSync)(before, current);
+    (0, import_node_fs29.writeFileSync)(after, rendered);
     try {
       return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
     } catch (e) {
@@ -34579,7 +34629,7 @@ async function gateRenderDiff(current, rendered) {
       throw e;
     }
   } finally {
-    (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function bootstrapTrainDoctorDeps() {
@@ -34639,13 +34689,13 @@ function registerBootstrapCommands(program3) {
       })),
       pushAllowlistOwners: verifyOwners,
       pushAllowlistOwnersRead: verifyOwnersRead,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs28.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs28.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs29.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs29.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -34723,14 +34773,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs28.existsSync)(s.target) ? (0, import_node_fs28.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs29.existsSync)(s.target) ? (0, import_node_fs29.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -34830,7 +34880,7 @@ function registerBootstrapCommands(program3) {
     }
     if (findings.some((f) => f.state !== "waived")) process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--from-config", "with --only gate.yml: adopt an equal legacy gate with a render stamp, then update from registry config via review PR; refuse hand edits").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special targets environments (#5035) / product-ruleset (#7986) to reconcile only that live surface (dry-run classifies, --execute writes)").option("--from-config", "with --only gate.yml: adopt an equal legacy gate with a render stamp, then update from registry config via review PR; refuse hand edits").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
@@ -34917,25 +34967,45 @@ function registerBootstrapCommands(program3) {
       }
       return;
     }
+    if (o.only.trim() === "product-ruleset") {
+      if (cmdOpts.var?.length) return fail("bootstrap apply: --only product-ruleset accepts no --var overrides; set registry META instead");
+      const read = await fetchProjectBySlugChecked(parsedRepo.slug, registryClientDeps(await loadConfig()));
+      if (!read.ok) return failGraceful(`bootstrap apply: registry META unreadable (${read.error}); refusing product ruleset reconciliation`);
+      if (!read.project?.requiredChecks?.length) return failGraceful("bootstrap apply: --only product-ruleset requires registry META requiredChecks");
+      const result = await applyCiReconcileRepo(repo, {
+        client: defaultGitHubClient(),
+        listProjects: async () => [],
+        getProjectMeta: async () => read.project
+      }, { productRulesetOnly: true, dryRun: !o.execute });
+      if (o.json) console.log(JSON.stringify(result, null, 2));
+      else {
+        console.log(`bootstrap apply --only product-ruleset \u2014 ${o.execute ? "LIVE" : "dry-run; no writes"} (${repo}):`);
+        result.applied.forEach((line) => console.log(`  ${o.execute ? "APPLY" : "PLAN"} ${line}`));
+        result.skipped.forEach((line) => console.log(`  SKIP ${line}`));
+        result.errors.forEach((line) => console.error(`  REFUSED ${line}`));
+      }
+      if (result.errors.length) return failGraceful("bootstrap apply: product ruleset reconciliation failed");
+      return;
+    }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs29.existsSync)(p) ? (0, import_node_fs29.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
       const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs28.unlinkSync)(tmp);
+          (0, import_node_fs29.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -35003,9 +35073,10 @@ function registerBootstrapCommands(program3) {
     const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     if (vars.SUITE === "mm-work" || registryMeta?.suite === "mm-work") {
       if (applyDeployModel === "tenant-container") {
-        const moduleGate = withDerivedRepoVars({}, parsedRepo, o.class, effectiveTrack, registryRequiredCheckBranches, ["gate", "screens / screens"]);
+        const requiredChecks = registryMeta?.requiredChecks ?? ["gate"];
+        const moduleGate = withDerivedRepoVars({}, parsedRepo, o.class, effectiveTrack, registryRequiredCheckBranches, requiredChecks);
         vars.GATE_RULESET_CONTEXTS_JSON = moduleGate.GATE_RULESET_CONTEXTS_JSON;
-        if (registryMeta) registryMeta = { ...registryMeta, requiredChecks: ["gate", "screens / screens"] };
+        if (registryMeta) registryMeta = { ...registryMeta, requiredChecks };
       }
     }
     const controlClient = defaultGitHubClient();
@@ -35570,10 +35641,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -35582,9 +35653,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs28.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs28.readFileSync)(seed.target, "utf8");
-    const readSeedFile2 = (path2) => (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs29.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs29.readFileSync)(seed.target, "utf8");
+    const readSeedFile2 = (path2) => (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -35593,9 +35664,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos.length;
-    if ((0, import_node_fs28.existsSync)("projects.json")) {
+    if ((0, import_node_fs29.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs28.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs29.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -35768,12 +35839,12 @@ LIVE apply to ${repo}:
         const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
+        (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
         try {
           await gh2(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs28.unlinkSync)(tmp);
+            (0, import_node_fs29.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -35842,10 +35913,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -35862,10 +35933,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs28.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs29.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs28.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs29.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -35943,12 +36014,12 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
         existingSha = void 0;
       }
       const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs28.unlinkSync)(tmp);
+          (0, import_node_fs29.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -36404,7 +36475,7 @@ async function waitSuiteDev(deps, opts) {
 }
 
 // src/suite-train.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var import_node_path29 = require("node:path");
 var import_node_crypto14 = require("node:crypto");
 
@@ -36434,6 +36505,17 @@ var SCHEMA = "mmi-suite-cut/v1";
 var SHA2 = /^[a-f0-9]{40}$/i;
 var RC_TAG = /^v\d+\.\d+\.\d+-rc\.\d+$/;
 var RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
+async function reapplyRulesets(deps, record, after) {
+  for (const member of record.members) {
+    try {
+      member.ruleset = { after, ok: true, lines: await deps.productRuleset(member.repo) };
+    } catch (e) {
+      member.ruleset = { after, ok: false, lines: [e.message] };
+      console.warn(`${member.repo}: product ruleset not re-applied (${e.message}); run mmi-cli devops bootstrap apply ${member.repo} --only product-ruleset --execute from the MMI-Hub checkout`);
+    }
+    writeSuiteCut(deps.recordPath, record);
+  }
+}
 async function kitCheck(deps, shellSha, bundles, where) {
   const shell2 = shellSha ? await deps.shellKit(shellSha) : void 0;
   const kits = await Promise.all(bundles.map(async (b) => ({ id: b.id, kit: b.url ? await deps.bundleKit(b.url) : void 0 })));
@@ -36480,7 +36562,7 @@ function suiteReleaseTag(rc) {
 function readSuiteCut(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs29.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs30.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -36491,16 +36573,16 @@ function readSuiteCut(path2) {
   } catch {
     throw new Error(`suite cut record unreadable at ${path2}; repair it, never recut`);
   }
-  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinsUnchanged !== void 0 && (record.pinsUnchanged !== true || record.pinPr !== void 0) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr && !record.pinsUnchanged) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
+  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinsUnchanged !== void 0 && (record.pinsUnchanged !== true || record.pinPr !== void 0) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr && !record.pinsUnchanged) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0) || m.ruleset !== void 0 && (!["rc", "main"].includes(m.ruleset.after) || typeof m.ruleset.ok !== "boolean" || !Array.isArray(m.ruleset.lines))))
     throw new Error(`suite cut record has unknown or invalid state at ${path2}; repair it, never recut`);
   return record;
 }
 function writeSuiteCut(path2, record) {
-  (0, import_node_fs29.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
+  (0, import_node_fs30.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
   const temp = `${path2}.${(0, import_node_crypto14.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    (0, import_node_fs29.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
-    (0, import_node_fs29.renameSync)(temp, path2);
+    (0, import_node_fs30.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
+    (0, import_node_fs30.renameSync)(temp, path2);
   } catch (e) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
@@ -36549,25 +36631,25 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
 async function retireFailedLeadRcLedger(deps, ownerGo) {
-  if (!(0, import_node_fs29.existsSync)(deps.ledgerPath)) return void 0;
+  if (!(0, import_node_fs30.existsSync)(deps.ledgerPath)) return void 0;
   return withLedgerLock(deps.ledgerPath, async (fence) => {
-    const ledger = parseReleaseLedger((0, import_node_fs29.readFileSync)(deps.ledgerPath, "utf8"));
+    const ledger = parseReleaseLedger((0, import_node_fs30.readFileSync)(deps.ledgerPath, "utf8"));
     const states = Object.values(ledger.phases).map((p) => p.state);
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
     const archive = (0, import_node_path29.join)((0, import_node_path29.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
-    if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
-    await fence(() => (0, import_node_fs29.renameSync)(deps.ledgerPath, archive));
+    await fence(() => (0, import_node_fs30.renameSync)(deps.ledgerPath, archive));
     return `${ledger.tag} (ledger archived to ${archive})`;
   });
 }
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
-  if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
-  (0, import_node_fs29.renameSync)(recordPath, archive);
+  if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
+  (0, import_node_fs30.renameSync)(recordPath, archive);
   return { archive, orphanTags: record.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
 async function suiteRestoreMainPins(deps) {
@@ -36633,12 +36715,12 @@ async function suiteRcand(deps, opts) {
   }
   if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
-    if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
-    (0, import_node_fs29.renameSync)(deps.recordPath, archive);
+    if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
+    (0, import_node_fs30.renameSync)(deps.recordPath, archive);
     record = void 0;
   }
   if (record && !record.pinPr && !record.leadRcTag && record.members.every((m) => !m.tag)) {
-    (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
     record = void 0;
   }
   if (!record) {
@@ -36692,7 +36774,7 @@ async function suiteRcand(deps, opts) {
     quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m)) && await deps.contains(SUITE_REPO, record.leadDevelopment, record.leadPreviousRc)) {
-    (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
     throw new Error("nothing to promote: neither MM-Work nor any module has new development commits since its rc; no suite cut started");
   }
   for (const member of quiet) {
@@ -36710,7 +36792,7 @@ async function suiteRcand(deps, opts) {
   }
   if (refusals.length) {
     const untouched = record.members.every((m) => !m.tag) && !record.pinPr;
-    if (untouched) (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
+    if (untouched) (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
     throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
@@ -36773,6 +36855,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
     record.leadRcSha = leadCut.sha;
     writeSuiteCut(deps.recordPath, record);
   }
+  await reapplyRulesets(deps, record, "rc");
   return { plan, record };
 }
 async function suiteRelease(deps, ownerGo, big = false) {
@@ -36808,6 +36891,10 @@ async function suiteRelease(deps, ownerGo, big = false) {
       throw new Error(`${member.repo}: live backend changed after the cut (${member.backend} \u2192 ${live.version}); release refused`);
   }
   if ((await deps.tagSha(SUITE_REPO, record.leadRcTag))?.toLowerCase() !== record.leadRcSha?.toLowerCase()) throw new Error("MM-Work rc tag changed after the cut; release refused");
+  await deps.validateReleaseSummaries([
+    ...record.members.filter((m) => !m.carried && !m.released && !m.hotfixedTo).map((m) => ({ repo: m.repo, tag: m.releasedAs ?? suiteReleaseTag(m.tag) })),
+    ...!record.leadReleased ? [{ repo: SUITE_REPO, tag: suiteReleaseTag(record.leadRcTag) }] : []
+  ]);
   const publishesMain = !record.leadReleased;
   const refusals = [];
   for (const member of record.members) {
@@ -36839,6 +36926,7 @@ Each member's live release must serve <data>/main/module.js at its main pin path
       writeSuiteCut(deps.recordPath, record);
     }
   }
+  await reapplyRulesets(deps, record, "main");
   if (!record.leadReleased) {
     await deps.release(SUITE_REPO, suiteReleaseTag(record.leadRcTag), record.leadRcSha, { big });
     record.leadReleased = true;
@@ -36865,7 +36953,7 @@ var hotfixRecordPath = (deps) => (0, import_node_path29.join)((0, import_node_pa
 function readSuiteHotfix(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs29.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs30.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -36904,11 +36992,11 @@ async function suiteHotfix(deps, opts) {
   if (cut && !cut.leadReleased) throw new Error(`an unfinished suite cut (${cut.leadRcTag ?? "no lead tag"}) is in flight; finish it with suite release or retire it with suite abandon first`);
   const path2 = hotfixRecordPath(deps);
   let record = readSuiteHotfix(path2);
-  if (record?.mapped) {
-    (0, import_node_fs29.renameSync)(path2, `${path2}.${record.leadTag}.json`);
-    record = void 0;
-  }
+  const completed = record?.mapped ? record : void 0;
+  if (completed) record = void 0;
   if (record && record.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record.repo} is recorded; finish it (rerun with that member) first`);
+  if (!record?.tag) await deps.validateHotfixSummary();
+  if (completed) (0, import_node_fs30.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
   const rec = record ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
   const save = () => writeSuiteHotfix(path2, rec);
   save();
@@ -37175,7 +37263,7 @@ async function runRcDataSwitch(deps, opts) {
 }
 
 // src/suite-train-io.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var import_node_path43 = require("node:path");
 init_cli_shared();
 
@@ -38237,6 +38325,7 @@ async function runHotfixReleaseLocked(deps, versionInput, options, doctor) {
     await assertConsumerBomLineage(deps, mergedSha, tag);
   }
   const releaseExists = await hotfixReleaseExists(deps, ctx, tag);
+  if (!releaseExists && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
   if (!releaseExists && isHubControlRepo(ctx.repo)) {
     if (!options.announceSummaryFile) {
       throw new Error("a new MMI-Hub hotfix Release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same hotfix release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing");
@@ -38852,7 +38941,7 @@ function checkHotfixCarries(options) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var import_node_path31 = require("node:path");
 var import_node_os18 = require("node:os");
 init_cli_shared();
@@ -39168,7 +39257,7 @@ async function runPrLand(prNumber, options, deps) {
 
 // src/test-policy-core.ts
 var import_node_child_process13 = require("node:child_process");
-var import_node_fs30 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_node_path30 = require("node:path");
 
 // src/test-command-policy-shared.mjs
@@ -39722,7 +39811,7 @@ function loadPolicySource(root, explicitRef, diffBase) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs30.readFileSync)(path2, "utf8");
+    return (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -39750,10 +39839,10 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs30.existsSync)(path2)) {
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
   return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs30.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
   return [...new Set(declared)].filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
@@ -39894,7 +39983,7 @@ function runTestPolicy(root, deps = {}) {
   }
   const loaded = deps.policy ? { policy: deps.policy, source: { ref: null, sha: null, path: POLICY_FILE } } : loadPolicySource(root, deps.policyRef, deps.base);
   const { policy, source: policySource } = loaded;
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs30.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs31.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : deps.policyRef ? resolveHotfixBase(root) : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
@@ -40192,13 +40281,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs31.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
+  const dir = (0, import_node_fs32.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
   const path2 = (0, import_node_path31.join)(dir, "body.txt");
-  (0, import_node_fs31.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  (0, import_node_fs32.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs31.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs32.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -40405,7 +40494,7 @@ async function deleteMergedRemoteBranch(options) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var import_node_path32 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
@@ -40454,13 +40543,13 @@ function sharedName(entries, fallback) {
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
   const readmePath = (0, import_node_path32.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs32.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  if (!(0, import_node_fs33.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs32.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs33.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines2 = [
     `# ${projectName}`,
     "",
@@ -40479,8 +40568,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs32.existsSync)((0, import_node_path32.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs32.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs33.existsSync)((0, import_node_path32.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs33.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -40502,7 +40591,7 @@ async function syncProjectInfo(plan, client, apply) {
 }
 
 // src/train-commands.ts
-var import_node_fs33 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_node_path33 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -40518,7 +40607,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs33.readFileSync)((0, import_node_path33.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs34.readFileSync)((0, import_node_path33.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -40883,7 +40972,7 @@ async function openSuitePinPr(deps, input) {
 
 // src/command-register-collaboration.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs42 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -41017,7 +41106,7 @@ init_github_client();
 init_github_quota();
 
 // src/issue-commands.ts
-var import_node_fs34 = require("node:fs");
+var import_node_fs35 = require("node:fs");
 var import_node_crypto15 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
@@ -41210,7 +41299,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs34.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs35.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -41873,7 +41962,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs34.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs35.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) {
           const top = specs === null ? "null" : typeof specs === "object" ? `an object with keys: ${Object.keys(specs).join(", ") || "(none)"}` : `a ${typeof specs}`;
@@ -41950,7 +42039,7 @@ ${lines2}`, {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 var import_node_path35 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
@@ -42120,16 +42209,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs35.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
-  (0, import_node_fs35.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs36.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
+  (0, import_node_fs36.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs35.existsSync)(path2)) return;
+  if (!(0, import_node_fs36.existsSync)(path2)) return;
   try {
-    (0, import_node_fs35.unlinkSync)(path2);
+    (0, import_node_fs36.unlinkSync)(path2);
   } catch {
   }
 }
@@ -42605,7 +42694,7 @@ function registerPrLifecycleCommands(program3) {
 
 // src/review-verdict.ts
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs36 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 var import_node_os20 = require("node:os");
 var import_node_path36 = require("node:path");
 init_cli_shared();
@@ -42772,15 +42861,15 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs36.mkdtempSync)((0, import_node_path36.join)((0, import_node_os20.tmpdir)(), "mmi-review-verdict-"));
+  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path36.join)((0, import_node_os20.tmpdir)(), "mmi-review-verdict-"));
   const path2 = (0, import_node_path36.join)(dir, "body.md");
   try {
-    (0, import_node_fs36.writeFileSync)(path2, body, "utf8");
+    (0, import_node_fs37.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
     return stdout.trim();
   } finally {
     try {
-      (0, import_node_fs36.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -43014,17 +43103,17 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
 }
 
 // src/worktree-residue-sweep.ts
-var import_node_fs41 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 var import_node_path41 = require("node:path");
 
 // src/worktree-merge-cleanup.ts
-var import_node_fs40 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_node_path40 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs38 = require("node:fs");
+var import_node_fs39 = require("node:fs");
 var import_node_path38 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
@@ -43035,7 +43124,7 @@ function normalizeEol2(s) {
 }
 
 // src/env-detection.ts
-var import_node_fs37 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var import_node_path37 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
@@ -43046,7 +43135,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs37.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs38.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -43060,7 +43149,7 @@ function findEnvFiles(root) {
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs37.lstatSync)((0, import_node_path37.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs38.lstatSync)((0, import_node_path37.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -43173,12 +43262,12 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path38.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs38.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path38.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs39.existsSync)(configured)) return configured;
   const candidates = [
     (0, import_node_path38.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
     ...process.env.LOCALAPPDATA ? [(0, import_node_path38.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
-  const bash = candidates.find((path2) => (0, import_node_fs38.existsSync)(path2));
+  const bash = candidates.find((path2) => (0, import_node_fs39.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
   return bash;
 }
@@ -43534,7 +43623,7 @@ function stageProcessEnv(stagePort, extraEnv) {
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
   const envFile = (0, import_node_path38.join)(cwd, ".env");
-  return (0, import_node_fs38.existsSync)(envFile) && envFileKeys((0, import_node_fs38.readFileSync)(envFile, "utf8")).has("PORT");
+  return (0, import_node_fs39.existsSync)(envFile) && envFileKeys((0, import_node_fs39.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
   const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
@@ -43549,13 +43638,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs38.existsSync)((0, import_node_path38.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs39.existsSync)((0, import_node_path38.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs38.existsSync)((0, import_node_path38.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs39.existsSync)((0, import_node_path38.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -43572,20 +43661,20 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson));
   if (!body) return {};
   const overridePath = (0, import_node_path38.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs38.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
-  (0, import_node_fs38.writeFileSync)(overridePath, body, "utf8");
+  (0, import_node_fs39.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
+  (0, import_node_fs39.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
   const target = (0, import_node_path38.join)(cwd, config.ensureEnv.target);
   const example = (0, import_node_path38.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs38.existsSync)(target) && (0, import_node_fs38.existsSync)(example)) {
-    (0, import_node_fs38.copyFileSync)(example, target);
-  } else if ((0, import_node_fs38.existsSync)(target) && (0, import_node_fs38.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs38.readFileSync)(example, "utf8"), (0, import_node_fs38.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs38.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs38.statSync)(target).mtimeMs
+  if (!(0, import_node_fs39.existsSync)(target) && (0, import_node_fs39.existsSync)(example)) {
+    (0, import_node_fs39.copyFileSync)(example, target);
+  } else if ((0, import_node_fs39.existsSync)(target) && (0, import_node_fs39.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs39.readFileSync)(example, "utf8"), (0, import_node_fs39.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs39.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs39.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -43593,8 +43682,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs38.existsSync)(target)) {
-    (0, import_node_fs38.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs38.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs39.existsSync)(target)) {
+    (0, import_node_fs39.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs39.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -43624,20 +43713,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs38.existsSync)(path2)) return null;
+  if (!(0, import_node_fs39.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs39.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs38.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs39.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs38.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs39.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -43666,7 +43755,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
     );
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs38.rmSync)(path2, { force: true });
+    (0, import_node_fs39.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -43913,8 +44002,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs38.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs38.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs39.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs39.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -43929,7 +44018,7 @@ async function runStage(config = {}, opts = {}) {
 }
 
 // src/worktree-evidence-archive.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_path39 = require("node:path");
 var JERV_ARTIFACT_RUN_SCOPE_ENV_VARS = ["JERV_RUN_ID", ...SESSION_ID_ENV_VARS];
 function sanitizeArchiveSegment(value, max = 80) {
@@ -43945,17 +44034,17 @@ function resolveArtifactRunScope(env = process.env) {
 }
 function defaultIsDirectory(path2) {
   try {
-    return (0, import_node_fs39.lstatSync)(path2).isDirectory();
+    return (0, import_node_fs40.lstatSync)(path2).isDirectory();
   } catch {
     return false;
   }
 }
 function archiveWorktreeJervArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs39.existsSync;
+  const exists = deps.exists ?? import_node_fs40.existsSync;
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs39.cpSync)(from, to, { recursive: true, force: true }));
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs39.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -43979,13 +44068,13 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   }
 }
 function defaultStat(path2) {
-  const st = (0, import_node_fs39.statSync)(path2);
+  const st = (0, import_node_fs40.statSync)(path2);
   return { mtimeMs: st.mtimeMs, size: st.size, isDirectory: () => st.isDirectory() };
 }
 function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
-  const exists = deps.exists ?? import_node_fs39.existsSync;
+  const exists = deps.exists ?? import_node_fs40.existsSync;
   const stat4 = deps.stat ?? defaultStat;
-  const readdir2 = deps.readdir ?? import_node_fs39.readdirSync;
+  const readdir2 = deps.readdir ?? import_node_fs40.readdirSync;
   const tmpRoot = (0, import_node_path39.join)(worktreePath, "tmp");
   if (!exists(tmpRoot)) return [];
   const entries = [];
@@ -44018,10 +44107,10 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
   return entries;
 }
 function archiveWorktreeTmpArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs39.existsSync;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs39.cpSync)(from, to, { recursive: true, force: true }));
+  const exists = deps.exists ?? import_node_fs40.existsSync;
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs39.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -44108,7 +44197,7 @@ function normPath2(p) {
 function unlinkNodeModulesJunction(wtPath) {
   const nm = (0, import_node_path40.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs40.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs40.rmdirSync)(nm);
+    if ((0, import_node_fs41.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs41.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -44119,8 +44208,8 @@ function defaultSleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs40.rmdirSync, exists = import_node_fs40.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs40.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs41.rmdirSync, exists = import_node_fs41.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs41.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -44246,21 +44335,21 @@ async function listNestedIgnoredNodeModules(wtPath, execGit) {
   return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path40.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs40.lstatSync)(path2);
+  const stat4 = (0, import_node_fs41.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs40.rmdirSync)(path2);
+      (0, import_node_fs41.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs40.unlinkSync)(path2);
+      (0, import_node_fs41.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs40.readdirSync)(path2)) safeRemoveTree((0, import_node_path40.join)(path2, entry));
-    (0, import_node_fs40.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs41.readdirSync)(path2)) safeRemoveTree((0, import_node_path40.join)(path2, entry));
+    (0, import_node_fs41.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs40.unlinkSync)(path2);
+  (0, import_node_fs41.unlinkSync)(path2);
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
@@ -44276,7 +44365,7 @@ function errorMessage(e) {
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs40.realpathSync)(path2));
+    return normPath2((0, import_node_fs41.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -44284,10 +44373,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs40.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs41.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs40.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs41.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -44303,7 +44392,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
@@ -44313,7 +44402,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs40.realpathSync)(child2));
+          target = normPath2((0, import_node_fs41.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -44496,7 +44585,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs40.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs41.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -44783,7 +44872,7 @@ function residueLedgerPath(gitCommonDir) {
 }
 function readPaths(file, deps) {
   try {
-    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs41.readFileSync)(f, "utf8")))(file));
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs42.readFileSync)(f, "utf8")))(file));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -44792,8 +44881,8 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs41.mkdirSync)((0, import_node_path41.dirname)(f), { recursive: true });
-      (0, import_node_fs41.writeFileSync)(f, t, "utf8");
+      (0, import_node_fs42.mkdirSync)((0, import_node_path41.dirname)(f), { recursive: true });
+      (0, import_node_fs42.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
 `);
@@ -44807,17 +44896,17 @@ function recordResidue(gitCommonDir, path2, deps = {}) {
   writePaths(file, paths, deps);
 }
 async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
-  const exists = deps.exists ?? import_node_fs41.existsSync;
-  const readDir = deps.readDir ?? ((p) => (0, import_node_fs41.readdirSync)(p));
+  const exists = deps.exists ?? import_node_fs42.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs42.readdirSync)(p));
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return (0, import_node_fs41.statSync)(p).isDirectory();
+      return (0, import_node_fs42.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   });
   const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
-  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs41.rmdirSync)(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs42.rmdirSync)(p));
   const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
   const live = new Set(registered.map(norm));
   const primary = registered[0] ? norm(registered[0]) : void 0;
@@ -44897,8 +44986,8 @@ function argvWantsJson2() {
 function hubRoot() {
   const fromPkg = (0, import_node_path42.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs42.existsSync)((0, import_node_path42.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs42.existsSync)((0, import_node_path42.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -44911,7 +45000,7 @@ function ciAuditDeps() {
     readSeedFile: (path2) => {
       if (!root) return null;
       const fullPath = (0, import_node_path42.join)(root, path2);
-      return (0, import_node_fs42.existsSync)(fullPath) ? (0, import_node_fs42.readFileSync)(fullPath, "utf8") : null;
+      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -45675,10 +45764,10 @@ ${list}`);
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
     const wfDir = (0, import_node_path42.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs42.existsSync)(wfDir)) return [];
-    return (0, import_node_fs42.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
+    return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs42.readFileSync)((0, import_node_path42.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path42.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -45883,7 +45972,7 @@ ${list}`);
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs42.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs43.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -46158,7 +46247,7 @@ ${list}`);
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs42.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -46288,7 +46377,7 @@ ${list}`);
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs42.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -46420,7 +46509,7 @@ ${list}`);
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs42.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs43.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -47329,6 +47418,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         const slug = applyingRepo ? slugOf(applyingRepo) : "";
         const isHub = applyingRepo?.toLowerCase() === ANNOUNCE_REPO.toLowerCase();
         let announcesToChannel = isHub;
+        let isWorkSuite = false;
         let releaseLanguage2 = "en";
         if (!isHub && slug) {
           let read;
@@ -47342,9 +47432,17 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
               `release: Hub registry read failed for ${slug} (${read.error}) \u2014 whether ${slug} announces to a project release channel is UNREAD, so the --announce-summary-file requirement is unproven. Likely transient (cold start, network, or auth blip); retry shortly.`
             );
           }
+          isWorkSuite = read.project?.suite === "mm-work";
           announcesToChannel = Boolean(read.project?.releaseChannel?.trim());
           releaseLanguage2 = read.project?.releaseLanguage?.trim() || "en";
         }
+        if (isWorkSuite) {
+          try {
+            await requireSuiteReleaseSummary({}, o.announceSummaryFile);
+          } catch (e) {
+            return fail(`release: ${e.message}`);
+          }
+        }
         if (announcesToChannel) {
           if (!o.announceSummaryFile) {
             return fail(
@@ -47648,11 +47746,11 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
     const target = (0, import_node_path43.join)(base, repo.split("/")[1]);
-    if (!(0, import_node_fs43.existsSync)(target)) {
-      (0, import_node_fs43.mkdirSync)(base, { recursive: true });
+    if (!(0, import_node_fs44.existsSync)(target)) {
+      (0, import_node_fs44.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs43.existsSync)((0, import_node_path43.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs44.existsSync)((0, import_node_path43.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -47856,6 +47954,20 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
   };
   return {
     recordPath,
+    validateHotfixSummary: () => requireSuiteReleaseSummary({}, summaryFile),
+    validateReleaseSummaries: (releases) => validateReleaseSummaries(
+      releases,
+      { ...memberSummaryFiles, [SUITE_REPO]: summaryFile },
+      async (repo, tag) => {
+        try {
+          await gh(["release", "view", tag, "--repo", repo, "--json", "tagName"]);
+          return true;
+        } catch (e) {
+          if (/release not found|HTTP 404|Not Found|\(404\)/i.test(e.message)) return false;
+          throw e;
+        }
+      }
+    ),
     registry: registry2,
     backend,
     hold,
@@ -47936,10 +48048,11 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     },
     // #7738: a member hotfixes as suite-solo; the lead hotfixes under its suite-lead capability (inTrain sets it).
     hotfixStart: (repo, o) => inTrain(repo, async (deps) => {
+      await requireSuiteReleaseSummary(deps, summaryFile);
       const r = await runHotfixStart(deps, { from: o.from, ack: o.ack, suiteSolo: repo !== SUITE_REPO });
       return { tag: r.tag };
     }, repo !== SUITE_REPO),
-    hotfixRelease: (repo, tag) => inTrain(repo, async (deps) => ({ tag: (await runHotfixRelease(deps, tag, { suiteSolo: repo !== SUITE_REPO })).tag }), repo !== SUITE_REPO),
+    hotfixRelease: (repo, tag) => inTrain(repo, async (deps) => ({ tag: (await runHotfixRelease(deps, tag, { suiteSolo: repo !== SUITE_REPO, announceSummaryFile: summaryFile, announceSummaryFileTr: summaryFileTr })).tag }), repo !== SUITE_REPO),
     // #7738: the #7714 solo pin leg, polled until the auto-merge lands (30 s x 40 = 20 min), then the caller decides.
     soloPin: async (repo, tag) => {
       for (let i = 0; ; i++) {
@@ -47960,13 +48073,27 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
-      (0, import_node_fs43.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs44.mkdirSync)(dir, { recursive: true });
       const file = (0, import_node_path43.join)(dir, `notes-${leadTag}.md`);
-      (0, import_node_fs43.writeFileSync)(file, `${body}
+      (0, import_node_fs44.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
       await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
     },
+    productRuleset: async (repo) => {
+      const read = await fetchProjectBySlugChecked(slugOf(repo), registryClientDeps(await loadConfig()));
+      if (!read.ok) throw new Error(`registry META unreadable (${read.error})`);
+      if (!read.project?.requiredChecks?.length) return ["skip: no registry META requiredChecks; the seeded ruleset stays as it is"];
+      const result = await applyCiReconcileRepo(repo, {
+        client: defaultGitHubClient(),
+        listProjects: async () => [],
+        getProjectMeta: async () => read.project
+      }, { productRulesetOnly: true });
+      const lines2 = [...result.applied, ...result.skipped.map((s) => `skip: ${s}`)];
+      lines2.forEach((line) => console.log(`${repo}: product ruleset ${line}`));
+      if (result.errors.length) throw new Error(result.errors.join("; "));
+      return lines2;
+    },
     release,
     shippedTag,
     sameContent: sameContent2,
@@ -47989,7 +48116,7 @@ ${suiteMappingBlock(leadTag, mapping)}`);
 
 // src/suite-commands.ts
 init_cli_shared();
-var import_node_fs44 = require("node:fs");
+var import_node_fs45 = require("node:fs");
 function parseMemberSummaryFiles(entries) {
   const memberSummaryFiles = {};
   for (const entry of entries) {
@@ -47999,12 +48126,6 @@ function parseMemberSummaryFiles(entries) {
   }
   return memberSummaryFiles;
 }
-function validateSuiteReleaseSummary(path2) {
-  if (!path2) throw new Error("suite release requires --announce-summary-file before promoting any member");
-  const lines2 = (0, import_node_fs44.readFileSync)(path2, "utf8").split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-  if (lines2[0]?.startsWith("No changes to this module")) throw new Error("suite release requires a real MM-Work title, not the no-change placeholder");
-  if (lines2.length < 3 || lines2.length > 6) throw new Error("suite release announcement needs 3\u20136 curated lines before promoting any member");
-}
 function suiteRcDataProdDeps() {
   return {
     fetch: async (url, init) => {
@@ -48077,7 +48198,7 @@ function registerSuiteCommands(program3) {
       try {
         const io = suiteTrainIo(root);
         retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
-        if (retired && !(0, import_node_fs44.existsSync)(io.recordPath)) {
+        if (retired && !(0, import_node_fs45.existsSync)(io.recordPath)) {
           console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
           return;
         }
@@ -48099,10 +48220,9 @@ function registerSuiteCommands(program3) {
       return fail(`suite abandon: ${e.message}`);
     }
   });
-  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: a member's OWN plain-words summary (#7510) \u2014 never the suite lead's summary reused; a member with no entry still ships, with the coordinator-ruled no-change line", (val, prev = []) => [...prev, val], []).option("--announce-summary-file-tr <path>", "Turkish plain-words summary for MM-Work itself").option("--member-summary-file-tr <owner/repo=path>", "repeatable: a member's own Turkish plain-words summary", (val, prev = []) => [...prev, val], []).option("--big", "marks MM-Work's own release big for the plain-words section (#7510); a member is never marked big through this flag \u2014 it is big only via the read route's automatic minor/major detection").option("--json", "structured receipt").action(async (o) => {
+  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: required title + 2\u20135 notes for each member being released; carried members need none", (val, prev = []) => [...prev, val], []).option("--announce-summary-file-tr <path>", "Turkish plain-words summary for MM-Work itself").option("--member-summary-file-tr <owner/repo=path>", "repeatable: a member's own Turkish plain-words summary", (val, prev = []) => [...prev, val], []).option("--big", "marks MM-Work's own release big for the plain-words section (#7510); a member is never marked big through this flag \u2014 it is big only via the read route's automatic minor/major detection").option("--json", "structured receipt").action(async (o) => {
     try {
       if (!o.ownerGo) throw new Error("suite release requires --owner-go; nothing was written");
-      validateSuiteReleaseSummary(o.announceSummaryFile);
       const memberSummaryFiles = parseMemberSummaryFiles(o.memberSummaryFile ?? []);
       const memberSummaryFilesTr = parseMemberSummaryFiles(o.memberSummaryFileTr ?? []);
       const root = await leadRoot();
@@ -48123,14 +48243,14 @@ function registerSuiteCommands(program3) {
       return fail(`suite release: ${e.message}`);
     }
   });
-  suite.command("hotfix <member>").description("member hotfix, main pin PR, MM-Work patch release, and the recorded suite version -> member versions mapping (#7738)").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR(s) or SHA(s) the member hotfix carries").option("--ack <shas>", "dev shas verified as not needed on main (see hotfix start --ack)").option("--owner-go", "explicit owner approval: ships the member and MM-Work to production (not needed for --dry-run)").option("--dry-run", "read-only: print the ordered plan; writes nothing").option("--json", "structured receipt").action(async (member, o) => {
+  suite.command("hotfix <member>").description("member hotfix, main pin PR, MM-Work patch release, and the recorded suite version -> member versions mapping (#7738)").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR(s) or SHA(s) the member hotfix carries").option("--ack <shas>", "dev shas verified as not needed on main (see hotfix start --ack)").option("--announce-summary-file <path>", "required title + 2\u20135 notes for the member and lead hotfix Releases").option("--announce-summary-file-tr <path>", "optional Turkish plain-words notes").option("--owner-go", "explicit owner approval: ships the member and MM-Work to production (not needed for --dry-run)").option("--dry-run", "read-only: print the ordered plan; writes nothing").option("--json", "structured receipt").action(async (member, o) => {
     try {
       if (!o.ownerGo && !o.dryRun) throw new Error("suite hotfix requires --owner-go (it ships to production); nothing was written. --dry-run prints the plan");
       const root = await leadRoot();
       const unlock = o.dryRun ? async () => void 0 : await acquireTrainWriterLock(root, "suite hotfix");
       let result;
       try {
-        result = await suiteHotfix(suiteTrainIo(root), { member, from: o.from, ack: o.ack?.split(",").map((s) => s.trim()).filter(Boolean), ownerGo: o.ownerGo, dryRun: o.dryRun });
+        result = await suiteHotfix(suiteTrainIo(root, o.announceSummaryFile, {}, o.announceSummaryFileTr), { member, from: o.from, ack: o.ack?.split(",").map((s) => s.trim()).filter(Boolean), ownerGo: o.ownerGo, dryRun: o.dryRun });
       } finally {
         await unlock();
       }
@@ -48267,7 +48387,7 @@ function suiteStatusDeps(github, registry2) {
 
 // src/packages-adopt-export.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 var import_node_os21 = require("node:os");
 var import_node_path44 = require("node:path");
 var import_node_util6 = require("node:util");
@@ -48891,36 +49011,36 @@ async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
   const packagePath = (0, import_node_path44.join)(opts.dir, "package.json");
   const lockPath = (0, import_node_path44.join)(opts.dir, "package-lock.json");
-  const packageText = (0, import_node_fs45.readFileSync)(packagePath, "utf8");
-  const lockText = (0, import_node_fs45.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs45.mkdtempSync)((0, import_node_path44.join)((0, import_node_os21.tmpdir)(), "mmi-adopt-export-"));
+  const packageText = (0, import_node_fs46.readFileSync)(packagePath, "utf8");
+  const lockText = (0, import_node_fs46.readFileSync)(lockPath, "utf8");
+  const work = (0, import_node_fs46.mkdtempSync)((0, import_node_path44.join)((0, import_node_os21.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs45.writeFileSync)((0, import_node_path44.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs45.writeFileSync)((0, import_node_path44.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs45.writeFileSync)((0, import_node_path44.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
     const script = (0, import_node_path44.join)(work, "package_export.py");
-    (0, import_node_fs45.writeFileSync)(script, package_export_default);
+    (0, import_node_fs46.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
     const verified = (0, import_node_path44.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path44.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path44.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
       await deps.npm(["cache", "add", (0, import_node_path44.join)(verified, `${short3}.tgz`)], opts.dir);
     }
-    (0, import_node_fs45.writeFileSync)(packagePath, plan.packageText);
-    (0, import_node_fs45.writeFileSync)(lockPath, plan.lockText);
+    (0, import_node_fs46.writeFileSync)(packagePath, plan.packageText);
+    (0, import_node_fs46.writeFileSync)(lockPath, plan.lockText);
     try {
       await deps.npm(["ci", "--offline", "--ignore-scripts", "--no-audit", "--no-fund"], opts.dir);
     } catch (error) {
-      (0, import_node_fs45.writeFileSync)(packagePath, packageText);
-      (0, import_node_fs45.writeFileSync)(lockPath, lockText);
+      (0, import_node_fs46.writeFileSync)(packagePath, packageText);
+      (0, import_node_fs46.writeFileSync)(lockPath, lockText);
       throw new Error(`npm ci --offline failed, package.json and package-lock.json restored: ${error.message}`);
     }
     return plan.result;
   } finally {
-    (0, import_node_fs45.rmSync)(work, { recursive: true, force: true });
+    (0, import_node_fs46.rmSync)(work, { recursive: true, force: true });
   }
 }
 var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process18.execFile);
@@ -48985,12 +49105,12 @@ function registerPackagesCommands(program3) {
 init_cli_shared();
 
 // src/wave-status.ts
-var import_node_fs46 = require("node:fs");
+var import_node_fs47 = require("node:fs");
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs46.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs47.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs46.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs47.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -49047,7 +49167,7 @@ async function collectWaveStatus(deps) {
 // src/discovery-commands.ts
 init_github_client();
 init_cli_shared();
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 var import_node_os22 = require("node:os");
 var import_node_path45 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
@@ -49240,8 +49360,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os22.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path45.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs47.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path45.join)(home, ".claude", "settings.json"), import_node_fs47.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path45.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs48.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path45.join)(home, ".claude", "settings.json"), import_node_fs48.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -52345,7 +52465,7 @@ function registerSessionReport(program3) {
 }
 
 // src/stage-commands.ts
-var import_node_fs48 = require("node:fs");
+var import_node_fs49 = require("node:fs");
 var import_node_path46 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -52594,8 +52714,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -52888,14 +53008,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 
 // src/tenant-artifact.ts
 var import_node_crypto16 = require("node:crypto");
-var import_node_fs49 = require("node:fs");
+var import_node_fs50 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
 var import_node_path47 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
   const hash = (0, import_node_crypto16.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs49.createReadStream)(path2)) hash.update(chunk);
+  for await (const chunk of (0, import_node_fs50.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
@@ -52918,7 +53038,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs49.createReadStream)(path2);
+  const stream = (0, import_node_fs50.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -53057,7 +53177,7 @@ function renderVerifySecrets(body) {
 }
 
 // src/command-register-developer.ts
-var import_node_fs53 = require("node:fs");
+var import_node_fs54 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -53125,13 +53245,13 @@ async function executeWaveLand(plan, deps) {
 // src/dist-drift.ts
 var import_node_child_process19 = require("node:child_process");
 var import_node_crypto18 = require("node:crypto");
-var import_node_fs51 = require("node:fs");
+var import_node_fs52 = require("node:fs");
 var import_node_os23 = require("node:os");
 var import_node_path49 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
 var import_node_crypto17 = require("node:crypto");
-var import_node_fs50 = require("node:fs");
+var import_node_fs51 = require("node:fs");
 var import_node_path48 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
@@ -53145,7 +53265,7 @@ function repoPath(root, declaredPath, label) {
 function digestFiles(files) {
   const hash = (0, import_node_crypto17.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs50.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs50.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs51.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs51.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -53160,8 +53280,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs50.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs50.lstatSync)(absolute) };
+    if (!(0, import_node_fs51.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs51.lstatSync)(absolute) };
   }));
 }
 
@@ -53245,12 +53365,12 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs51.existsSync)(path2) ? (0, import_node_fs51.readFileSync)(path2) : null;
+  return (0, import_node_fs52.existsSync)(path2) ? (0, import_node_fs52.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs51.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    for (const entry of (0, import_node_fs52.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       const child2 = (0, import_node_path49.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
@@ -53261,7 +53381,7 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs51.readFileSync)((0, import_node_path49.join)(root, "surfaces.json"), "utf8"));
+    const registry2 = JSON.parse((0, import_node_fs52.readFileSync)((0, import_node_path49.join)(root, "surfaces.json"), "utf8"));
     return (0, import_node_path49.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
     return (0, import_node_path49.join)(root, "distribution-bom.json");
@@ -53277,7 +53397,7 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs51.mkdtempSync)((0, import_node_path49.join)((0, import_node_os23.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs52.mkdtempSync)((0, import_node_path49.join)((0, import_node_os23.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
     const cliOut = (0, import_node_path49.join)(stage, "cli-dist");
@@ -53293,19 +53413,19 @@ function runDistStatus(root) {
     const tree = (path2) => readOrNull((0, import_node_path49.join)(root, path2));
     const distRoot = (0, import_node_path49.join)(root, "cli", "dist");
     const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path49.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs51.readFileSync)(bomPathFor(root), "utf8"));
+    const bom = JSON.parse((0, import_node_fs52.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
       const overlay = (0, import_node_path49.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
         const target = (0, import_node_path49.join)(overlay, entry.path);
-        (0, import_node_fs51.mkdirSync)((0, import_node_path49.dirname)(target), { recursive: true });
-        (0, import_node_fs51.writeFileSync)(target, entry.bytes);
+        (0, import_node_fs52.mkdirSync)((0, import_node_path49.dirname)(target), { recursive: true });
+        (0, import_node_fs52.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs51.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs52.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
@@ -53518,7 +53638,7 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process20 = require("node:child_process");
-var import_node_fs52 = require("node:fs");
+var import_node_fs53 = require("node:fs");
 var import_node_path51 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
@@ -53605,7 +53725,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs52.readFileSync)((0, import_node_path51.join)(root, file), "utf8");
+      raw = (0, import_node_fs53.readFileSync)((0, import_node_path51.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -53626,18 +53746,18 @@ function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
     const path2 = (0, import_node_path52.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs53.existsSync)(path2) ? (0, import_node_fs53.readFileSync)(path2, "utf8") : null;
+    const current = (0, import_node_fs54.existsSync)(path2) ? (0, import_node_fs54.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs53.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs54.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs53.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs54.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -54037,7 +54157,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs54.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs55.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -54072,7 +54192,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs54.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -54081,7 +54201,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs54.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -54795,7 +54915,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs54.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs55.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -55184,15 +55304,15 @@ function ciAuditDeps2() {
     readSeedFile: (path2) => {
       if (!root) return null;
       const fullPath = (0, import_node_path53.join)(root, path2);
-      return (0, import_node_fs54.existsSync)(fullPath) ? (0, import_node_fs54.readFileSync)(fullPath, "utf8") : null;
+      return (0, import_node_fs55.existsSync)(fullPath) ? (0, import_node_fs55.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
   const fromPkg = (0, import_node_path53.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs54.existsSync)((0, import_node_path53.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs54.existsSync)((0, import_node_path53.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs55.existsSync)((0, import_node_path53.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs55.existsSync)((0, import_node_path53.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -55318,10 +55438,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs54.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs54.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs55.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs55.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs54.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs54.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs55.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs55.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -55352,7 +55472,7 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs54.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs55.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -55361,7 +55481,7 @@ function directoryBytes(path2) {
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs54.statSync)(child2).size;
+        total += (0, import_node_fs55.statSync)(child2).size;
       } catch {
       }
     }
@@ -55369,25 +55489,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs54.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs55.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs54.existsSync)(p)) return [];
+  if (!(0, import_node_fs55.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs54.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs55.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs54.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs54.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs55.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs55.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs54.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs55.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path53.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs54.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path53.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs55.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -55402,9 +55522,9 @@ function stagingApplyFsGuard(configRoot) {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
       const p = (0, import_node_path53.join)(stagingRoot, name);
-      if (!(0, import_node_fs54.existsSync)(p)) return null;
+      if (!(0, import_node_fs55.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs54.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs55.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -55430,7 +55550,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs54.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs55.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));