npm - @mutmutco/codex-plugin - Versions diffs - 4.5.104 → 4.5.105 - Mend

@mutmutco/codex-plugin 4.5.104 → 4.5.105

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/.codex-plugin/plugin.json +1 -1
package/cli/dist/main.cjs +364 -278
package/cli/package.json +1 -1
package/package.json +1 -1
package/skills/org-guide/references/work-and-releases.md +1 -1
package/skills/release/SKILL.md +3 -3

package/cli/dist/main.cjs CHANGED Viewed

@@ -4747,7 +4747,7 @@ function useColor() {
 var program = new Command();
 // src/command-composition.ts
-var import_node_fs54 = require("node:fs");
+var import_node_fs55 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
@@ -17699,10 +17699,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.104",
-    tag: "v4.5.104",
-    commit: "6bf765dc986c",
-    npm: "@mutmutco/cli@4.5.104"
+    version: "4.5.105",
+    tag: "v4.5.105",
+    commit: "2edfdb644608",
+    npm: "@mutmutco/cli@4.5.105"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17719,14 +17719,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.104"
+          v3Target: "v4.5.105"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.104 and redeploy the Hub Lambda from tag v4.5.104 (6bf765dc986c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.104 (@mutmutco/cli@4.5.104, tag commit 6bf765dc986c \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.105 and redeploy the Hub Lambda from tag v4.5.105 (2edfdb644608); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.105 (@mutmutco/cli@4.5.105, tag commit 2edfdb644608 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21992,7 +21992,7 @@ function renderTenantControl(r) {
 }
 // src/train-apply-phases.ts
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
 var import_node_path24 = require("node:path");
@@ -25765,6 +25765,7 @@ function formatTrainDoctor(v) {
 // src/release-plain-words.ts
 var import_promises3 = require("node:fs/promises");
+var import_node_fs24 = require("node:fs");
 function releaseCutByNotes(cutBy) {
   return `## Internal
 Cut by ${formatSessionIdentity(cutBy)}
@@ -25779,8 +25780,44 @@ function buildPlainWordsSection(lines2, big, heading = PLAIN_WORDS_HEADING) {
   if (big) body.push(PLAIN_WORDS_MARKER);
   return body.join("\n");
 }
-function noChangePlainWordsLine(suiteTag) {
-  return suiteTag ? `No changes to this module in this release; ships with the MM-Work suite ${suiteTag}.` : "No changes to this module in this release.";
+var SUMMARY_GUIDE = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing";
+function validatePlainWordsSummary(content) {
+  const lines2 = content.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+  if (lines2[0]?.startsWith("No changes to this module")) throw new Error(`requires a real MM-Work title, not the no-change placeholder \u2014 see ${SUMMARY_GUIDE}`);
+  if (lines2.length < 3 || lines2.length > 6) throw new Error(`requires 3\u20136 curated non-empty lines (title + 2\u20135 notes; found ${lines2.length}) \u2014 see ${SUMMARY_GUIDE}`);
+}
+function validateSuiteReleaseSummary(path2) {
+  if (!path2) throw new Error(`requires --announce-summary-file <path> before promoting any member \u2014 see ${SUMMARY_GUIDE}`);
+  let content;
+  try {
+    content = (0, import_node_fs24.readFileSync)(path2, "utf8");
+  } catch (e) {
+    throw new Error(`could not read summary file ${path2}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
+  }
+  validatePlainWordsSummary(content);
+}
+async function validateReleaseSummaries(releases, files, releaseExists) {
+  const refusals = [];
+  for (const { repo, tag } of releases) {
+    if (await releaseExists(repo, tag)) continue;
+    try {
+      validateSuiteReleaseSummary(files[repo]);
+    } catch (e) {
+      refusals.push(`${repo}: ${e.message}`);
+    }
+  }
+  if (refusals.length) throw new Error(`suite release summaries refused; no member was released:
+${refusals.join("\n")}`);
+}
+async function requireSuiteReleaseSummary(deps, path2) {
+  if (!path2) throw new Error(`a new mm-work suite Release requires --announce-summary-file <path> with a title + 2\u20135 notes \u2014 see ${SUMMARY_GUIDE}`);
+  let content;
+  try {
+    content = await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(path2);
+  } catch (e) {
+    throw new Error(`could not read --announce-summary-file ${path2}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
+  }
+  validatePlainWordsSummary(content);
 }
 function upsertPlainWordsSection(body, section) {
   let rest = body;
@@ -25810,7 +25847,8 @@ function plainWordsSummaryLines(content) {
 async function writePlainWordsIfSuiteMember(deps, args) {
   if (args.meta?.suite !== "mm-work") return;
   try {
-    const lines2 = args.summaryLines && args.summaryLines.length > 0 ? args.summaryLines : [noChangePlainWordsLine(args.suiteTag)];
+    if (!args.summaryLines?.length) return;
+    const lines2 = args.summaryLines;
     const section = [
       buildPlainWordsSection(lines2, args.big === true),
       ...args.summaryLinesTr?.length ? [buildPlainWordsSection(args.summaryLinesTr, false, PLAIN_WORDS_HEADING_TR)] : []
@@ -25962,14 +26000,14 @@ function readLocalGateWorkflows() {
   const dir = (0, import_node_path24.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs24.readdirSync)(dir);
+    names = (0, import_node_fs25.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs24.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -25979,14 +26017,14 @@ function readLocalWorkflows() {
   const dir = (0, import_node_path24.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs24.readdirSync)(dir);
+    names = (0, import_node_fs25.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter((n) => /\.ya?ml$/i.test(n))) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs24.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -26868,7 +26906,7 @@ async function activeRcandLedgerCandidate(deps, cwd) {
   }
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs24.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -27157,6 +27195,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
   }
   const ledgerMode = persisted ? "strict" : "migration";
   const partialRelease = await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo);
+  if (partialRelease && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
   if (!partialRelease) {
     try {
       await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
@@ -28031,6 +28070,7 @@ async function runTrainApplyLocked(command, deps, options = {}) {
   const bumpIntent = await resolveTrainBumpIntent(deps, process.env, void 0, preOneZeroInForce(meta));
   const branchHints = await loadReleaseTrackBranchHints(deps);
   const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
+  if (command === "release" && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
   const pipelineInput = { deps, ctx, command, meta, branchHints, watch, options, bumpIntent };
   if (command === "rcand") {
     if (directTrack) {
@@ -30741,7 +30781,7 @@ function registerBoardCommands(program3) {
 }
 // src/bootstrap-commands.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_os17 = require("node:os");
 var import_node_path28 = require("node:path");
 init_cli_shared();
@@ -30927,7 +30967,7 @@ init_github_client();
 init_cli_shared();
 // src/port-registry.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_node_path25 = require("node:path");
 // ../infra/port-geometry.mjs
@@ -30942,8 +30982,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs25.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs25.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs26.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -30973,7 +31013,7 @@ function existingPortRange(repo, registry2) {
 function portRangeInfraAt(root, source) {
   const registryPath = (0, import_node_path25.join)(root, "infra", "port-ranges.json");
   const ddbScriptPath = (0, import_node_path25.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs25.existsSync)(registryPath) || !(0, import_node_fs25.existsSync)(ddbScriptPath)) return null;
+  if (!(0, import_node_fs26.existsSync)(registryPath) || !(0, import_node_fs26.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
@@ -31055,7 +31095,7 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 // src/box-commands.ts
-var import_node_fs27 = require("node:fs");
+var import_node_fs28 = require("node:fs");
 var import_node_child_process10 = require("node:child_process");
 var import_node_os16 = require("node:os");
 var import_node_path27 = require("node:path");
@@ -31187,7 +31227,7 @@ function applyRemoteScript(items, date) {
 init_clean_exit();
 // src/secrets-commands.ts
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_path26 = require("node:path");
 var import_node_os15 = require("node:os");
 init_cli_shared();
@@ -32349,8 +32389,8 @@ async function decryptRailsCredentials(input) {
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs26.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs26.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs27.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs27.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -32360,9 +32400,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs26.mkdtempSync)((0, import_node_path26.join)((0, import_node_os15.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptDir = (0, import_node_fs27.mkdtempSync)((0, import_node_path26.join)((0, import_node_os15.tmpdir)(), "mmi-rails-decrypt-"));
   const scriptPath = (0, import_node_path26.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs26.writeFileSync)(scriptPath, script, "utf8");
+  (0, import_node_fs27.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -32374,7 +32414,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs26.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs27.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -32464,7 +32504,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs26.readFileSync)((0, import_node_path26.resolve)(o.file), "utf8");
+        body = (0, import_node_fs27.readFileSync)((0, import_node_path26.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -32600,7 +32640,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs26.unlinkSync)((0, import_node_path26.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs27.unlinkSync)((0, import_node_path26.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -32648,8 +32688,6 @@ function registerSecretsCommands(program3) {
 var BOX_KEYS = {
   /** Opens every MM box INCLUDING the CI runner (`mmi-runner`). The general-purpose MM key. */
   mmMaster: "HETZNER_MASTER_SSH_PRIVATE_KEY",
-  /** Opens the OGUZ project's boxes. */
-  oguzMaster: "HETZNER_OGUZ_MASTER_SSH_PRIVATE_KEY",
   /** The deploy key. Opens MM prod/tenant boxes but NOT `mmi-runner` — a real trap: reaching for this key
    *  to get into the CI runner fails, and the failure reads like a broken box rather than a wrong key. */
   mmDeploy: "HETZNER_SSH_PRIVATE_KEY"
@@ -32658,11 +32696,10 @@ var HETZNER_VAULT_SLUG = "_org";
 var HETZNER_NS = "hetzner";
 var nsKey = (key) => `${HETZNER_NS}/${key}`;
 var PROJECT_API_TOKEN = {
-  MM: nsKey("HETZNER_MM_API_TOKEN"),
-  OGUZ: nsKey("HETZNER_OGUZ_API_TOKEN")
+  MM: nsKey("HETZNER_MM_API_TOKEN")
 };
-function sshKeyForProject(project2) {
-  return project2 === "OGUZ" ? BOX_KEYS.oguzMaster : BOX_KEYS.mmMaster;
+function sshKeyForProject(_project) {
+  return BOX_KEYS.mmMaster;
 }
 function vaultPath(key) {
   return `/mmi-future/${HETZNER_VAULT_SLUG}/${HETZNER_NS}/${key}`;
@@ -32765,7 +32802,7 @@ var HETZNER_API = "https://api.hetzner.cloud/v1/servers";
 var HETZNER_TIMEOUT_MS = 15e3;
 var PER_PAGE = 50;
 var MAX_PAGES = 20;
-var PROJECTS = ["MM", "OGUZ"];
+var PROJECTS = ["MM"];
 async function fetchProjectBoxes(project2, token) {
   const boxes = [];
   let page = 1;
@@ -32859,7 +32896,7 @@ function registerBoxCommands(program3) {
       }
       const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs27.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs28.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -32933,17 +32970,17 @@ function hubGitShow(ref) {
   return (path2) => git3(["show", `${ref}:${path2}`]);
 }
 function runOnBox(found, script) {
-  const dir = (0, import_node_fs27.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-box-control-"));
+  const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-box-control-"));
   try {
     const recipe = (0, import_node_path27.join)(dir, "recipe.sh");
-    (0, import_node_fs27.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    (0, import_node_fs28.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
     const r = (0, import_node_child_process10.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
     return r.stdout;
   } finally {
-    (0, import_node_fs27.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function formatControl(mode, box, rows) {
@@ -34578,12 +34615,12 @@ async function verifyTargetedSeedPr(repo, number, plan, target, expected, client
 // src/bootstrap-commands.ts
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 async function gateRenderDiff(current, rendered) {
-  const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-gate-diff-"));
+  const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-gate-diff-"));
   const before = (0, import_node_path28.join)(dir, "committed-gate.yml");
   const after = (0, import_node_path28.join)(dir, "registry-render.yml");
   try {
-    (0, import_node_fs28.writeFileSync)(before, current);
-    (0, import_node_fs28.writeFileSync)(after, rendered);
+    (0, import_node_fs29.writeFileSync)(before, current);
+    (0, import_node_fs29.writeFileSync)(after, rendered);
     try {
       return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
     } catch (e) {
@@ -34592,7 +34629,7 @@ async function gateRenderDiff(current, rendered) {
       throw e;
     }
   } finally {
-    (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function bootstrapTrainDoctorDeps() {
@@ -34652,13 +34689,13 @@ function registerBootstrapCommands(program3) {
       })),
       pushAllowlistOwners: verifyOwners,
       pushAllowlistOwnersRead: verifyOwnersRead,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs28.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs28.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs29.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs29.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -34736,14 +34773,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs28.existsSync)(s.target) ? (0, import_node_fs28.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs29.existsSync)(s.target) ? (0, import_node_fs29.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -34951,24 +34988,24 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs29.existsSync)(p) ? (0, import_node_fs29.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
       const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs28.unlinkSync)(tmp);
+          (0, import_node_fs29.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -35604,10 +35641,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -35616,9 +35653,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs28.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs28.readFileSync)(seed.target, "utf8");
-    const readSeedFile2 = (path2) => (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs29.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs29.readFileSync)(seed.target, "utf8");
+    const readSeedFile2 = (path2) => (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -35627,9 +35664,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos.length;
-    if ((0, import_node_fs28.existsSync)("projects.json")) {
+    if ((0, import_node_fs29.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs28.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs29.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -35802,12 +35839,12 @@ LIVE apply to ${repo}:
         const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
+        (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
         try {
           await gh2(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs28.unlinkSync)(tmp);
+            (0, import_node_fs29.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -35876,10 +35913,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -35896,10 +35933,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs28.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs29.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs28.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs29.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -35977,12 +36014,12 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
         existingSha = void 0;
       }
       const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs28.unlinkSync)(tmp);
+          (0, import_node_fs29.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -36438,7 +36475,7 @@ async function waitSuiteDev(deps, opts) {
 }
 // src/suite-train.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var import_node_path29 = require("node:path");
 var import_node_crypto14 = require("node:crypto");
@@ -36468,6 +36505,17 @@ var SCHEMA = "mmi-suite-cut/v1";
 var SHA2 = /^[a-f0-9]{40}$/i;
 var RC_TAG = /^v\d+\.\d+\.\d+-rc\.\d+$/;
 var RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
+async function reapplyRulesets(deps, record, after) {
+  for (const member of record.members) {
+    try {
+      member.ruleset = { after, ok: true, lines: await deps.productRuleset(member.repo) };
+    } catch (e) {
+      member.ruleset = { after, ok: false, lines: [e.message] };
+      console.warn(`${member.repo}: product ruleset not re-applied (${e.message}); run mmi-cli devops bootstrap apply ${member.repo} --only product-ruleset --execute from the MMI-Hub checkout`);
+    }
+    writeSuiteCut(deps.recordPath, record);
+  }
+}
 async function kitCheck(deps, shellSha, bundles, where) {
   const shell2 = shellSha ? await deps.shellKit(shellSha) : void 0;
   const kits = await Promise.all(bundles.map(async (b) => ({ id: b.id, kit: b.url ? await deps.bundleKit(b.url) : void 0 })));
@@ -36514,7 +36562,7 @@ function suiteReleaseTag(rc) {
 function readSuiteCut(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs29.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs30.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -36525,16 +36573,16 @@ function readSuiteCut(path2) {
   } catch {
     throw new Error(`suite cut record unreadable at ${path2}; repair it, never recut`);
   }
-  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinsUnchanged !== void 0 && (record.pinsUnchanged !== true || record.pinPr !== void 0) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr && !record.pinsUnchanged) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
+  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinsUnchanged !== void 0 && (record.pinsUnchanged !== true || record.pinPr !== void 0) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr && !record.pinsUnchanged) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0) || m.ruleset !== void 0 && (!["rc", "main"].includes(m.ruleset.after) || typeof m.ruleset.ok !== "boolean" || !Array.isArray(m.ruleset.lines))))
     throw new Error(`suite cut record has unknown or invalid state at ${path2}; repair it, never recut`);
   return record;
 }
 function writeSuiteCut(path2, record) {
-  (0, import_node_fs29.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
+  (0, import_node_fs30.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
   const temp = `${path2}.${(0, import_node_crypto14.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    (0, import_node_fs29.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
-    (0, import_node_fs29.renameSync)(temp, path2);
+    (0, import_node_fs30.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
+    (0, import_node_fs30.renameSync)(temp, path2);
   } catch (e) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
@@ -36583,25 +36631,25 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
 async function retireFailedLeadRcLedger(deps, ownerGo) {
-  if (!(0, import_node_fs29.existsSync)(deps.ledgerPath)) return void 0;
+  if (!(0, import_node_fs30.existsSync)(deps.ledgerPath)) return void 0;
   return withLedgerLock(deps.ledgerPath, async (fence) => {
-    const ledger = parseReleaseLedger((0, import_node_fs29.readFileSync)(deps.ledgerPath, "utf8"));
+    const ledger = parseReleaseLedger((0, import_node_fs30.readFileSync)(deps.ledgerPath, "utf8"));
     const states = Object.values(ledger.phases).map((p) => p.state);
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
     const archive = (0, import_node_path29.join)((0, import_node_path29.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
-    if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
-    await fence(() => (0, import_node_fs29.renameSync)(deps.ledgerPath, archive));
+    await fence(() => (0, import_node_fs30.renameSync)(deps.ledgerPath, archive));
     return `${ledger.tag} (ledger archived to ${archive})`;
   });
 }
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
-  if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
-  (0, import_node_fs29.renameSync)(recordPath, archive);
+  if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
+  (0, import_node_fs30.renameSync)(recordPath, archive);
   return { archive, orphanTags: record.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
 async function suiteRestoreMainPins(deps) {
@@ -36667,12 +36715,12 @@ async function suiteRcand(deps, opts) {
   }
   if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
-    if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
-    (0, import_node_fs29.renameSync)(deps.recordPath, archive);
+    if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
+    (0, import_node_fs30.renameSync)(deps.recordPath, archive);
     record = void 0;
   }
   if (record && !record.pinPr && !record.leadRcTag && record.members.every((m) => !m.tag)) {
-    (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
     record = void 0;
   }
   if (!record) {
@@ -36726,7 +36774,7 @@ async function suiteRcand(deps, opts) {
     quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m)) && await deps.contains(SUITE_REPO, record.leadDevelopment, record.leadPreviousRc)) {
-    (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
     throw new Error("nothing to promote: neither MM-Work nor any module has new development commits since its rc; no suite cut started");
   }
   for (const member of quiet) {
@@ -36744,7 +36792,7 @@ async function suiteRcand(deps, opts) {
   }
   if (refusals.length) {
     const untouched = record.members.every((m) => !m.tag) && !record.pinPr;
-    if (untouched) (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
+    if (untouched) (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
     throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
@@ -36807,6 +36855,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
     record.leadRcSha = leadCut.sha;
     writeSuiteCut(deps.recordPath, record);
   }
+  await reapplyRulesets(deps, record, "rc");
   return { plan, record };
 }
 async function suiteRelease(deps, ownerGo, big = false) {
@@ -36842,6 +36891,10 @@ async function suiteRelease(deps, ownerGo, big = false) {
       throw new Error(`${member.repo}: live backend changed after the cut (${member.backend} \u2192 ${live.version}); release refused`);
   }
   if ((await deps.tagSha(SUITE_REPO, record.leadRcTag))?.toLowerCase() !== record.leadRcSha?.toLowerCase()) throw new Error("MM-Work rc tag changed after the cut; release refused");
+  await deps.validateReleaseSummaries([
+    ...record.members.filter((m) => !m.carried && !m.released && !m.hotfixedTo).map((m) => ({ repo: m.repo, tag: m.releasedAs ?? suiteReleaseTag(m.tag) })),
+    ...!record.leadReleased ? [{ repo: SUITE_REPO, tag: suiteReleaseTag(record.leadRcTag) }] : []
+  ]);
   const publishesMain = !record.leadReleased;
   const refusals = [];
   for (const member of record.members) {
@@ -36873,6 +36926,7 @@ Each member's live release must serve <data>/main/module.js at its main pin path
       writeSuiteCut(deps.recordPath, record);
     }
   }
+  await reapplyRulesets(deps, record, "main");
   if (!record.leadReleased) {
     await deps.release(SUITE_REPO, suiteReleaseTag(record.leadRcTag), record.leadRcSha, { big });
     record.leadReleased = true;
@@ -36899,7 +36953,7 @@ var hotfixRecordPath = (deps) => (0, import_node_path29.join)((0, import_node_pa
 function readSuiteHotfix(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs29.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs30.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -36938,11 +36992,11 @@ async function suiteHotfix(deps, opts) {
   if (cut && !cut.leadReleased) throw new Error(`an unfinished suite cut (${cut.leadRcTag ?? "no lead tag"}) is in flight; finish it with suite release or retire it with suite abandon first`);
   const path2 = hotfixRecordPath(deps);
   let record = readSuiteHotfix(path2);
-  if (record?.mapped) {
-    (0, import_node_fs29.renameSync)(path2, `${path2}.${record.leadTag}.json`);
-    record = void 0;
-  }
+  const completed = record?.mapped ? record : void 0;
+  if (completed) record = void 0;
   if (record && record.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record.repo} is recorded; finish it (rerun with that member) first`);
+  if (!record?.tag) await deps.validateHotfixSummary();
+  if (completed) (0, import_node_fs30.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
   const rec = record ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
   const save = () => writeSuiteHotfix(path2, rec);
   save();
@@ -37209,7 +37263,7 @@ async function runRcDataSwitch(deps, opts) {
 }
 // src/suite-train-io.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var import_node_path43 = require("node:path");
 init_cli_shared();
@@ -38271,6 +38325,7 @@ async function runHotfixReleaseLocked(deps, versionInput, options, doctor) {
     await assertConsumerBomLineage(deps, mergedSha, tag);
   }
   const releaseExists = await hotfixReleaseExists(deps, ctx, tag);
+  if (!releaseExists && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
   if (!releaseExists && isHubControlRepo(ctx.repo)) {
     if (!options.announceSummaryFile) {
       throw new Error("a new MMI-Hub hotfix Release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same hotfix release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing");
@@ -38886,7 +38941,7 @@ function checkHotfixCarries(options) {
 }
 // src/merge-cleanup.ts
-var import_node_fs31 = require("node:fs");
+var import_node_fs32 = require("node:fs");
 var import_node_path31 = require("node:path");
 var import_node_os18 = require("node:os");
 init_cli_shared();
@@ -39202,7 +39257,7 @@ async function runPrLand(prNumber, options, deps) {
 // src/test-policy-core.ts
 var import_node_child_process13 = require("node:child_process");
-var import_node_fs30 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 var import_node_path30 = require("node:path");
 // src/test-command-policy-shared.mjs
@@ -39756,7 +39811,7 @@ function loadPolicySource(root, explicitRef, diffBase) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs30.readFileSync)(path2, "utf8");
+    return (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -39784,10 +39839,10 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs30.existsSync)(path2)) {
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
   return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs30.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
   return [...new Set(declared)].filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
@@ -39928,7 +39983,7 @@ function runTestPolicy(root, deps = {}) {
   }
   const loaded = deps.policy ? { policy: deps.policy, source: { ref: null, sha: null, path: POLICY_FILE } } : loadPolicySource(root, deps.policyRef, deps.base);
   const { policy, source: policySource } = loaded;
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs30.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs31.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : deps.policyRef ? resolveHotfixBase(root) : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
@@ -40226,13 +40281,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs31.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
+  const dir = (0, import_node_fs32.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
   const path2 = (0, import_node_path31.join)(dir, "body.txt");
-  (0, import_node_fs31.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  (0, import_node_fs32.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs31.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs32.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -40439,7 +40494,7 @@ async function deleteMergedRemoteBranch(options) {
 }
 // src/project-info-sync.ts
-var import_node_fs32 = require("node:fs");
+var import_node_fs33 = require("node:fs");
 var import_node_path32 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
@@ -40488,13 +40543,13 @@ function sharedName(entries, fallback) {
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
   const readmePath = (0, import_node_path32.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs32.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  if (!(0, import_node_fs33.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs32.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs33.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines2 = [
     `# ${projectName}`,
     "",
@@ -40513,8 +40568,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs32.existsSync)((0, import_node_path32.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs32.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs33.existsSync)((0, import_node_path32.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs33.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -40536,7 +40591,7 @@ async function syncProjectInfo(plan, client, apply) {
 }
 // src/train-commands.ts
-var import_node_fs33 = require("node:fs");
+var import_node_fs34 = require("node:fs");
 var import_node_path33 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -40552,7 +40607,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs33.readFileSync)((0, import_node_path33.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs34.readFileSync)((0, import_node_path33.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -40917,7 +40972,7 @@ async function openSuitePinPr(deps, input) {
 // src/command-register-collaboration.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs42 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -41051,7 +41106,7 @@ init_github_client();
 init_github_quota();
 // src/issue-commands.ts
-var import_node_fs34 = require("node:fs");
+var import_node_fs35 = require("node:fs");
 var import_node_crypto15 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
@@ -41244,7 +41299,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs34.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs35.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -41907,7 +41962,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs34.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs35.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) {
           const top = specs === null ? "null" : typeof specs === "object" ? `an object with keys: ${Object.keys(specs).join(", ") || "(none)"}` : `a ${typeof specs}`;
@@ -41984,7 +42039,7 @@ ${lines2}`, {
 }
 // src/post-merge-recon.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 var import_node_path35 = require("node:path");
 // src/cross-repo-filing-issue.ts
@@ -42154,16 +42209,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs35.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
-  (0, import_node_fs35.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs36.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
+  (0, import_node_fs36.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs35.existsSync)(path2)) return;
+  if (!(0, import_node_fs36.existsSync)(path2)) return;
   try {
-    (0, import_node_fs35.unlinkSync)(path2);
+    (0, import_node_fs36.unlinkSync)(path2);
   } catch {
   }
 }
@@ -42639,7 +42694,7 @@ function registerPrLifecycleCommands(program3) {
 // src/review-verdict.ts
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs36 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 var import_node_os20 = require("node:os");
 var import_node_path36 = require("node:path");
 init_cli_shared();
@@ -42806,15 +42861,15 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs36.mkdtempSync)((0, import_node_path36.join)((0, import_node_os20.tmpdir)(), "mmi-review-verdict-"));
+  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path36.join)((0, import_node_os20.tmpdir)(), "mmi-review-verdict-"));
   const path2 = (0, import_node_path36.join)(dir, "body.md");
   try {
-    (0, import_node_fs36.writeFileSync)(path2, body, "utf8");
+    (0, import_node_fs37.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
     return stdout.trim();
   } finally {
     try {
-      (0, import_node_fs36.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -43048,17 +43103,17 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
 }
 // src/worktree-residue-sweep.ts
-var import_node_fs41 = require("node:fs");
+var import_node_fs42 = require("node:fs");
 var import_node_path41 = require("node:path");
 // src/worktree-merge-cleanup.ts
-var import_node_fs40 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var import_node_path40 = require("node:path");
 init_cli_shared();
 // src/stage-runner.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs38 = require("node:fs");
+var import_node_fs39 = require("node:fs");
 var import_node_path38 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
@@ -43069,7 +43124,7 @@ function normalizeEol2(s) {
 }
 // src/env-detection.ts
-var import_node_fs37 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var import_node_path37 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
@@ -43080,7 +43135,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs37.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs38.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -43094,7 +43149,7 @@ function findEnvFiles(root) {
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs37.lstatSync)((0, import_node_path37.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs38.lstatSync)((0, import_node_path37.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -43207,12 +43262,12 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path38.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs38.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path38.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs39.existsSync)(configured)) return configured;
   const candidates = [
     (0, import_node_path38.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
     ...process.env.LOCALAPPDATA ? [(0, import_node_path38.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
-  const bash = candidates.find((path2) => (0, import_node_fs38.existsSync)(path2));
+  const bash = candidates.find((path2) => (0, import_node_fs39.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
   return bash;
 }
@@ -43568,7 +43623,7 @@ function stageProcessEnv(stagePort, extraEnv) {
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
   const envFile = (0, import_node_path38.join)(cwd, ".env");
-  return (0, import_node_fs38.existsSync)(envFile) && envFileKeys((0, import_node_fs38.readFileSync)(envFile, "utf8")).has("PORT");
+  return (0, import_node_fs39.existsSync)(envFile) && envFileKeys((0, import_node_fs39.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
   const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
@@ -43583,13 +43638,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs38.existsSync)((0, import_node_path38.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs39.existsSync)((0, import_node_path38.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs38.existsSync)((0, import_node_path38.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs39.existsSync)((0, import_node_path38.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -43606,20 +43661,20 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson));
   if (!body) return {};
   const overridePath = (0, import_node_path38.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs38.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
-  (0, import_node_fs38.writeFileSync)(overridePath, body, "utf8");
+  (0, import_node_fs39.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
+  (0, import_node_fs39.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
   const target = (0, import_node_path38.join)(cwd, config.ensureEnv.target);
   const example = (0, import_node_path38.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs38.existsSync)(target) && (0, import_node_fs38.existsSync)(example)) {
-    (0, import_node_fs38.copyFileSync)(example, target);
-  } else if ((0, import_node_fs38.existsSync)(target) && (0, import_node_fs38.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs38.readFileSync)(example, "utf8"), (0, import_node_fs38.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs38.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs38.statSync)(target).mtimeMs
+  if (!(0, import_node_fs39.existsSync)(target) && (0, import_node_fs39.existsSync)(example)) {
+    (0, import_node_fs39.copyFileSync)(example, target);
+  } else if ((0, import_node_fs39.existsSync)(target) && (0, import_node_fs39.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs39.readFileSync)(example, "utf8"), (0, import_node_fs39.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs39.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs39.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -43627,8 +43682,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs38.existsSync)(target)) {
-    (0, import_node_fs38.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs38.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs39.existsSync)(target)) {
+    (0, import_node_fs39.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs39.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -43658,20 +43713,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs38.existsSync)(path2)) return null;
+  if (!(0, import_node_fs39.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs39.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs38.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs39.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs38.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs39.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -43700,7 +43755,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
     );
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs38.rmSync)(path2, { force: true });
+    (0, import_node_fs39.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -43947,8 +44002,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs38.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs38.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs39.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs39.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -43963,7 +44018,7 @@ async function runStage(config = {}, opts = {}) {
 }
 // src/worktree-evidence-archive.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_path39 = require("node:path");
 var JERV_ARTIFACT_RUN_SCOPE_ENV_VARS = ["JERV_RUN_ID", ...SESSION_ID_ENV_VARS];
 function sanitizeArchiveSegment(value, max = 80) {
@@ -43979,17 +44034,17 @@ function resolveArtifactRunScope(env = process.env) {
 }
 function defaultIsDirectory(path2) {
   try {
-    return (0, import_node_fs39.lstatSync)(path2).isDirectory();
+    return (0, import_node_fs40.lstatSync)(path2).isDirectory();
   } catch {
     return false;
   }
 }
 function archiveWorktreeJervArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs39.existsSync;
+  const exists = deps.exists ?? import_node_fs40.existsSync;
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs39.cpSync)(from, to, { recursive: true, force: true }));
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs39.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -44013,13 +44068,13 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   }
 }
 function defaultStat(path2) {
-  const st = (0, import_node_fs39.statSync)(path2);
+  const st = (0, import_node_fs40.statSync)(path2);
   return { mtimeMs: st.mtimeMs, size: st.size, isDirectory: () => st.isDirectory() };
 }
 function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
-  const exists = deps.exists ?? import_node_fs39.existsSync;
+  const exists = deps.exists ?? import_node_fs40.existsSync;
   const stat4 = deps.stat ?? defaultStat;
-  const readdir2 = deps.readdir ?? import_node_fs39.readdirSync;
+  const readdir2 = deps.readdir ?? import_node_fs40.readdirSync;
   const tmpRoot = (0, import_node_path39.join)(worktreePath, "tmp");
   if (!exists(tmpRoot)) return [];
   const entries = [];
@@ -44052,10 +44107,10 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
   return entries;
 }
 function archiveWorktreeTmpArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs39.existsSync;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs39.cpSync)(from, to, { recursive: true, force: true }));
+  const exists = deps.exists ?? import_node_fs40.existsSync;
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs39.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -44142,7 +44197,7 @@ function normPath2(p) {
 function unlinkNodeModulesJunction(wtPath) {
   const nm = (0, import_node_path40.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs40.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs40.rmdirSync)(nm);
+    if ((0, import_node_fs41.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs41.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -44153,8 +44208,8 @@ function defaultSleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs40.rmdirSync, exists = import_node_fs40.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs40.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs41.rmdirSync, exists = import_node_fs41.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs41.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -44280,21 +44335,21 @@ async function listNestedIgnoredNodeModules(wtPath, execGit) {
   return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path40.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs40.lstatSync)(path2);
+  const stat4 = (0, import_node_fs41.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs40.rmdirSync)(path2);
+      (0, import_node_fs41.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs40.unlinkSync)(path2);
+      (0, import_node_fs41.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs40.readdirSync)(path2)) safeRemoveTree((0, import_node_path40.join)(path2, entry));
-    (0, import_node_fs40.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs41.readdirSync)(path2)) safeRemoveTree((0, import_node_path40.join)(path2, entry));
+    (0, import_node_fs41.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs40.unlinkSync)(path2);
+  (0, import_node_fs41.unlinkSync)(path2);
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
@@ -44310,7 +44365,7 @@ function errorMessage(e) {
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs40.realpathSync)(path2));
+    return normPath2((0, import_node_fs41.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -44318,10 +44373,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs40.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs41.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs40.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs41.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -44337,7 +44392,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
@@ -44347,7 +44402,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs40.realpathSync)(child2));
+          target = normPath2((0, import_node_fs41.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -44530,7 +44585,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs40.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs41.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -44817,7 +44872,7 @@ function residueLedgerPath(gitCommonDir) {
 }
 function readPaths(file, deps) {
   try {
-    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs41.readFileSync)(f, "utf8")))(file));
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs42.readFileSync)(f, "utf8")))(file));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -44826,8 +44881,8 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs41.mkdirSync)((0, import_node_path41.dirname)(f), { recursive: true });
-      (0, import_node_fs41.writeFileSync)(f, t, "utf8");
+      (0, import_node_fs42.mkdirSync)((0, import_node_path41.dirname)(f), { recursive: true });
+      (0, import_node_fs42.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
 `);
@@ -44841,17 +44896,17 @@ function recordResidue(gitCommonDir, path2, deps = {}) {
   writePaths(file, paths, deps);
 }
 async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
-  const exists = deps.exists ?? import_node_fs41.existsSync;
-  const readDir = deps.readDir ?? ((p) => (0, import_node_fs41.readdirSync)(p));
+  const exists = deps.exists ?? import_node_fs42.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs42.readdirSync)(p));
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return (0, import_node_fs41.statSync)(p).isDirectory();
+      return (0, import_node_fs42.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   });
   const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
-  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs41.rmdirSync)(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs42.rmdirSync)(p));
   const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
   const live = new Set(registered.map(norm));
   const primary = registered[0] ? norm(registered[0]) : void 0;
@@ -44931,8 +44986,8 @@ function argvWantsJson2() {
 function hubRoot() {
   const fromPkg = (0, import_node_path42.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs42.existsSync)((0, import_node_path42.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs42.existsSync)((0, import_node_path42.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -44945,7 +45000,7 @@ function ciAuditDeps() {
     readSeedFile: (path2) => {
       if (!root) return null;
       const fullPath = (0, import_node_path42.join)(root, path2);
-      return (0, import_node_fs42.existsSync)(fullPath) ? (0, import_node_fs42.readFileSync)(fullPath, "utf8") : null;
+      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -45709,10 +45764,10 @@ ${list}`);
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
     const wfDir = (0, import_node_path42.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs42.existsSync)(wfDir)) return [];
-    return (0, import_node_fs42.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
+    return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs42.readFileSync)((0, import_node_path42.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path42.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -45917,7 +45972,7 @@ ${list}`);
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs42.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs43.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -46192,7 +46247,7 @@ ${list}`);
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs42.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -46322,7 +46377,7 @@ ${list}`);
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs42.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -46454,7 +46509,7 @@ ${list}`);
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs42.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs43.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -47363,6 +47418,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         const slug = applyingRepo ? slugOf(applyingRepo) : "";
         const isHub = applyingRepo?.toLowerCase() === ANNOUNCE_REPO.toLowerCase();
         let announcesToChannel = isHub;
+        let isWorkSuite = false;
         let releaseLanguage2 = "en";
         if (!isHub && slug) {
           let read;
@@ -47376,9 +47432,17 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
               `release: Hub registry read failed for ${slug} (${read.error}) \u2014 whether ${slug} announces to a project release channel is UNREAD, so the --announce-summary-file requirement is unproven. Likely transient (cold start, network, or auth blip); retry shortly.`
             );
           }
+          isWorkSuite = read.project?.suite === "mm-work";
           announcesToChannel = Boolean(read.project?.releaseChannel?.trim());
           releaseLanguage2 = read.project?.releaseLanguage?.trim() || "en";
         }
+        if (isWorkSuite) {
+          try {
+            await requireSuiteReleaseSummary({}, o.announceSummaryFile);
+          } catch (e) {
+            return fail(`release: ${e.message}`);
+          }
+        }
         if (announcesToChannel) {
           if (!o.announceSummaryFile) {
             return fail(
@@ -47682,11 +47746,11 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
     const target = (0, import_node_path43.join)(base, repo.split("/")[1]);
-    if (!(0, import_node_fs43.existsSync)(target)) {
-      (0, import_node_fs43.mkdirSync)(base, { recursive: true });
+    if (!(0, import_node_fs44.existsSync)(target)) {
+      (0, import_node_fs44.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs43.existsSync)((0, import_node_path43.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs44.existsSync)((0, import_node_path43.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -47890,6 +47954,20 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
   };
   return {
     recordPath,
+    validateHotfixSummary: () => requireSuiteReleaseSummary({}, summaryFile),
+    validateReleaseSummaries: (releases) => validateReleaseSummaries(
+      releases,
+      { ...memberSummaryFiles, [SUITE_REPO]: summaryFile },
+      async (repo, tag) => {
+        try {
+          await gh(["release", "view", tag, "--repo", repo, "--json", "tagName"]);
+          return true;
+        } catch (e) {
+          if (/release not found|HTTP 404|Not Found|\(404\)/i.test(e.message)) return false;
+          throw e;
+        }
+      }
+    ),
     registry: registry2,
     backend,
     hold,
@@ -47970,10 +48048,11 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     },
     // #7738: a member hotfixes as suite-solo; the lead hotfixes under its suite-lead capability (inTrain sets it).
     hotfixStart: (repo, o) => inTrain(repo, async (deps) => {
+      await requireSuiteReleaseSummary(deps, summaryFile);
       const r = await runHotfixStart(deps, { from: o.from, ack: o.ack, suiteSolo: repo !== SUITE_REPO });
       return { tag: r.tag };
     }, repo !== SUITE_REPO),
-    hotfixRelease: (repo, tag) => inTrain(repo, async (deps) => ({ tag: (await runHotfixRelease(deps, tag, { suiteSolo: repo !== SUITE_REPO })).tag }), repo !== SUITE_REPO),
+    hotfixRelease: (repo, tag) => inTrain(repo, async (deps) => ({ tag: (await runHotfixRelease(deps, tag, { suiteSolo: repo !== SUITE_REPO, announceSummaryFile: summaryFile, announceSummaryFileTr: summaryFileTr })).tag }), repo !== SUITE_REPO),
     // #7738: the #7714 solo pin leg, polled until the auto-merge lands (30 s x 40 = 20 min), then the caller decides.
     soloPin: async (repo, tag) => {
       for (let i = 0; ; i++) {
@@ -47994,13 +48073,27 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
-      (0, import_node_fs43.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs44.mkdirSync)(dir, { recursive: true });
       const file = (0, import_node_path43.join)(dir, `notes-${leadTag}.md`);
-      (0, import_node_fs43.writeFileSync)(file, `${body}
+      (0, import_node_fs44.writeFileSync)(file, `${body}
 ${suiteMappingBlock(leadTag, mapping)}`);
       await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
     },
+    productRuleset: async (repo) => {
+      const read = await fetchProjectBySlugChecked(slugOf(repo), registryClientDeps(await loadConfig()));
+      if (!read.ok) throw new Error(`registry META unreadable (${read.error})`);
+      if (!read.project?.requiredChecks?.length) return ["skip: no registry META requiredChecks; the seeded ruleset stays as it is"];
+      const result = await applyCiReconcileRepo(repo, {
+        client: defaultGitHubClient(),
+        listProjects: async () => [],
+        getProjectMeta: async () => read.project
+      }, { productRulesetOnly: true });
+      const lines2 = [...result.applied, ...result.skipped.map((s) => `skip: ${s}`)];
+      lines2.forEach((line) => console.log(`${repo}: product ruleset ${line}`));
+      if (result.errors.length) throw new Error(result.errors.join("; "));
+      return lines2;
+    },
     release,
     shippedTag,
     sameContent: sameContent2,
@@ -48023,7 +48116,7 @@ ${suiteMappingBlock(leadTag, mapping)}`);
 // src/suite-commands.ts
 init_cli_shared();
-var import_node_fs44 = require("node:fs");
+var import_node_fs45 = require("node:fs");
 function parseMemberSummaryFiles(entries) {
   const memberSummaryFiles = {};
   for (const entry of entries) {
@@ -48033,12 +48126,6 @@ function parseMemberSummaryFiles(entries) {
   }
   return memberSummaryFiles;
 }
-function validateSuiteReleaseSummary(path2) {
-  if (!path2) throw new Error("suite release requires --announce-summary-file before promoting any member");
-  const lines2 = (0, import_node_fs44.readFileSync)(path2, "utf8").split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-  if (lines2[0]?.startsWith("No changes to this module")) throw new Error("suite release requires a real MM-Work title, not the no-change placeholder");
-  if (lines2.length < 3 || lines2.length > 6) throw new Error("suite release announcement needs 3\u20136 curated lines before promoting any member");
-}
 function suiteRcDataProdDeps() {
   return {
     fetch: async (url, init) => {
@@ -48111,7 +48198,7 @@ function registerSuiteCommands(program3) {
       try {
         const io = suiteTrainIo(root);
         retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
-        if (retired && !(0, import_node_fs44.existsSync)(io.recordPath)) {
+        if (retired && !(0, import_node_fs45.existsSync)(io.recordPath)) {
           console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
           return;
         }
@@ -48133,10 +48220,9 @@ function registerSuiteCommands(program3) {
       return fail(`suite abandon: ${e.message}`);
     }
   });
-  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: a member's OWN plain-words summary (#7510) \u2014 never the suite lead's summary reused; a member with no entry still ships, with the coordinator-ruled no-change line", (val, prev = []) => [...prev, val], []).option("--announce-summary-file-tr <path>", "Turkish plain-words summary for MM-Work itself").option("--member-summary-file-tr <owner/repo=path>", "repeatable: a member's own Turkish plain-words summary", (val, prev = []) => [...prev, val], []).option("--big", "marks MM-Work's own release big for the plain-words section (#7510); a member is never marked big through this flag \u2014 it is big only via the read route's automatic minor/major detection").option("--json", "structured receipt").action(async (o) => {
+  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: required title + 2\u20135 notes for each member being released; carried members need none", (val, prev = []) => [...prev, val], []).option("--announce-summary-file-tr <path>", "Turkish plain-words summary for MM-Work itself").option("--member-summary-file-tr <owner/repo=path>", "repeatable: a member's own Turkish plain-words summary", (val, prev = []) => [...prev, val], []).option("--big", "marks MM-Work's own release big for the plain-words section (#7510); a member is never marked big through this flag \u2014 it is big only via the read route's automatic minor/major detection").option("--json", "structured receipt").action(async (o) => {
     try {
       if (!o.ownerGo) throw new Error("suite release requires --owner-go; nothing was written");
-      validateSuiteReleaseSummary(o.announceSummaryFile);
       const memberSummaryFiles = parseMemberSummaryFiles(o.memberSummaryFile ?? []);
       const memberSummaryFilesTr = parseMemberSummaryFiles(o.memberSummaryFileTr ?? []);
       const root = await leadRoot();
@@ -48157,14 +48243,14 @@ function registerSuiteCommands(program3) {
       return fail(`suite release: ${e.message}`);
     }
   });
-  suite.command("hotfix <member>").description("member hotfix, main pin PR, MM-Work patch release, and the recorded suite version -> member versions mapping (#7738)").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR(s) or SHA(s) the member hotfix carries").option("--ack <shas>", "dev shas verified as not needed on main (see hotfix start --ack)").option("--owner-go", "explicit owner approval: ships the member and MM-Work to production (not needed for --dry-run)").option("--dry-run", "read-only: print the ordered plan; writes nothing").option("--json", "structured receipt").action(async (member, o) => {
+  suite.command("hotfix <member>").description("member hotfix, main pin PR, MM-Work patch release, and the recorded suite version -> member versions mapping (#7738)").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR(s) or SHA(s) the member hotfix carries").option("--ack <shas>", "dev shas verified as not needed on main (see hotfix start --ack)").option("--announce-summary-file <path>", "required title + 2\u20135 notes for the member and lead hotfix Releases").option("--announce-summary-file-tr <path>", "optional Turkish plain-words notes").option("--owner-go", "explicit owner approval: ships the member and MM-Work to production (not needed for --dry-run)").option("--dry-run", "read-only: print the ordered plan; writes nothing").option("--json", "structured receipt").action(async (member, o) => {
     try {
       if (!o.ownerGo && !o.dryRun) throw new Error("suite hotfix requires --owner-go (it ships to production); nothing was written. --dry-run prints the plan");
       const root = await leadRoot();
       const unlock = o.dryRun ? async () => void 0 : await acquireTrainWriterLock(root, "suite hotfix");
       let result;
       try {
-        result = await suiteHotfix(suiteTrainIo(root), { member, from: o.from, ack: o.ack?.split(",").map((s) => s.trim()).filter(Boolean), ownerGo: o.ownerGo, dryRun: o.dryRun });
+        result = await suiteHotfix(suiteTrainIo(root, o.announceSummaryFile, {}, o.announceSummaryFileTr), { member, from: o.from, ack: o.ack?.split(",").map((s) => s.trim()).filter(Boolean), ownerGo: o.ownerGo, dryRun: o.dryRun });
       } finally {
         await unlock();
       }
@@ -48301,7 +48387,7 @@ function suiteStatusDeps(github, registry2) {
 // src/packages-adopt-export.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 var import_node_os21 = require("node:os");
 var import_node_path44 = require("node:path");
 var import_node_util6 = require("node:util");
@@ -48925,36 +49011,36 @@ async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
   const packagePath = (0, import_node_path44.join)(opts.dir, "package.json");
   const lockPath = (0, import_node_path44.join)(opts.dir, "package-lock.json");
-  const packageText = (0, import_node_fs45.readFileSync)(packagePath, "utf8");
-  const lockText = (0, import_node_fs45.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs45.mkdtempSync)((0, import_node_path44.join)((0, import_node_os21.tmpdir)(), "mmi-adopt-export-"));
+  const packageText = (0, import_node_fs46.readFileSync)(packagePath, "utf8");
+  const lockText = (0, import_node_fs46.readFileSync)(lockPath, "utf8");
+  const work = (0, import_node_fs46.mkdtempSync)((0, import_node_path44.join)((0, import_node_os21.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs45.writeFileSync)((0, import_node_path44.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs45.writeFileSync)((0, import_node_path44.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs45.writeFileSync)((0, import_node_path44.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
     const script = (0, import_node_path44.join)(work, "package_export.py");
-    (0, import_node_fs45.writeFileSync)(script, package_export_default);
+    (0, import_node_fs46.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
     const verified = (0, import_node_path44.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path44.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path44.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
       await deps.npm(["cache", "add", (0, import_node_path44.join)(verified, `${short3}.tgz`)], opts.dir);
     }
-    (0, import_node_fs45.writeFileSync)(packagePath, plan.packageText);
-    (0, import_node_fs45.writeFileSync)(lockPath, plan.lockText);
+    (0, import_node_fs46.writeFileSync)(packagePath, plan.packageText);
+    (0, import_node_fs46.writeFileSync)(lockPath, plan.lockText);
     try {
       await deps.npm(["ci", "--offline", "--ignore-scripts", "--no-audit", "--no-fund"], opts.dir);
     } catch (error) {
-      (0, import_node_fs45.writeFileSync)(packagePath, packageText);
-      (0, import_node_fs45.writeFileSync)(lockPath, lockText);
+      (0, import_node_fs46.writeFileSync)(packagePath, packageText);
+      (0, import_node_fs46.writeFileSync)(lockPath, lockText);
       throw new Error(`npm ci --offline failed, package.json and package-lock.json restored: ${error.message}`);
     }
     return plan.result;
   } finally {
-    (0, import_node_fs45.rmSync)(work, { recursive: true, force: true });
+    (0, import_node_fs46.rmSync)(work, { recursive: true, force: true });
   }
 }
 var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process18.execFile);
@@ -49019,12 +49105,12 @@ function registerPackagesCommands(program3) {
 init_cli_shared();
 // src/wave-status.ts
-var import_node_fs46 = require("node:fs");
+var import_node_fs47 = require("node:fs");
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs46.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs47.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs46.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs47.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -49081,7 +49167,7 @@ async function collectWaveStatus(deps) {
 // src/discovery-commands.ts
 init_github_client();
 init_cli_shared();
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 var import_node_os22 = require("node:os");
 var import_node_path45 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
@@ -49274,8 +49360,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os22.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path45.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs47.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path45.join)(home, ".claude", "settings.json"), import_node_fs47.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path45.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs48.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path45.join)(home, ".claude", "settings.json"), import_node_fs48.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -52379,7 +52465,7 @@ function registerSessionReport(program3) {
 }
 // src/stage-commands.ts
-var import_node_fs48 = require("node:fs");
+var import_node_fs49 = require("node:fs");
 var import_node_path46 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -52628,8 +52714,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -52922,14 +53008,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 // src/tenant-artifact.ts
 var import_node_crypto16 = require("node:crypto");
-var import_node_fs49 = require("node:fs");
+var import_node_fs50 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
 var import_node_path47 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
   const hash = (0, import_node_crypto16.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs49.createReadStream)(path2)) hash.update(chunk);
+  for await (const chunk of (0, import_node_fs50.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
@@ -52952,7 +53038,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs49.createReadStream)(path2);
+  const stream = (0, import_node_fs50.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -53091,7 +53177,7 @@ function renderVerifySecrets(body) {
 }
 // src/command-register-developer.ts
-var import_node_fs53 = require("node:fs");
+var import_node_fs54 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -53159,13 +53245,13 @@ async function executeWaveLand(plan, deps) {
 // src/dist-drift.ts
 var import_node_child_process19 = require("node:child_process");
 var import_node_crypto18 = require("node:crypto");
-var import_node_fs51 = require("node:fs");
+var import_node_fs52 = require("node:fs");
 var import_node_os23 = require("node:os");
 var import_node_path49 = require("node:path");
 // ../scripts/distribution-digest.mjs
 var import_node_crypto17 = require("node:crypto");
-var import_node_fs50 = require("node:fs");
+var import_node_fs51 = require("node:fs");
 var import_node_path48 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
@@ -53179,7 +53265,7 @@ function repoPath(root, declaredPath, label) {
 function digestFiles(files) {
   const hash = (0, import_node_crypto17.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs50.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs50.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs51.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs51.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -53194,8 +53280,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs50.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs50.lstatSync)(absolute) };
+    if (!(0, import_node_fs51.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs51.lstatSync)(absolute) };
   }));
 }
@@ -53279,12 +53365,12 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs51.existsSync)(path2) ? (0, import_node_fs51.readFileSync)(path2) : null;
+  return (0, import_node_fs52.existsSync)(path2) ? (0, import_node_fs52.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs51.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    for (const entry of (0, import_node_fs52.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
       const child2 = (0, import_node_path49.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
@@ -53295,7 +53381,7 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs51.readFileSync)((0, import_node_path49.join)(root, "surfaces.json"), "utf8"));
+    const registry2 = JSON.parse((0, import_node_fs52.readFileSync)((0, import_node_path49.join)(root, "surfaces.json"), "utf8"));
     return (0, import_node_path49.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
     return (0, import_node_path49.join)(root, "distribution-bom.json");
@@ -53311,7 +53397,7 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs51.mkdtempSync)((0, import_node_path49.join)((0, import_node_os23.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs52.mkdtempSync)((0, import_node_path49.join)((0, import_node_os23.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
     const cliOut = (0, import_node_path49.join)(stage, "cli-dist");
@@ -53327,19 +53413,19 @@ function runDistStatus(root) {
     const tree = (path2) => readOrNull((0, import_node_path49.join)(root, path2));
     const distRoot = (0, import_node_path49.join)(root, "cli", "dist");
     const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path49.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs51.readFileSync)(bomPathFor(root), "utf8"));
+    const bom = JSON.parse((0, import_node_fs52.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
       const overlay = (0, import_node_path49.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
         const target = (0, import_node_path49.join)(overlay, entry.path);
-        (0, import_node_fs51.mkdirSync)((0, import_node_path49.dirname)(target), { recursive: true });
-        (0, import_node_fs51.writeFileSync)(target, entry.bytes);
+        (0, import_node_fs52.mkdirSync)((0, import_node_path49.dirname)(target), { recursive: true });
+        (0, import_node_fs52.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs51.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs52.rmSync)(stage, { recursive: true, force: true });
   }
 }
@@ -53552,7 +53638,7 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 // src/spawn-policy-core.ts
 var import_node_child_process20 = require("node:child_process");
-var import_node_fs52 = require("node:fs");
+var import_node_fs53 = require("node:fs");
 var import_node_path51 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
@@ -53639,7 +53725,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs52.readFileSync)((0, import_node_path51.join)(root, file), "utf8");
+      raw = (0, import_node_fs53.readFileSync)((0, import_node_path51.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -53660,18 +53746,18 @@ function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
     const path2 = (0, import_node_path52.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs53.existsSync)(path2) ? (0, import_node_fs53.readFileSync)(path2, "utf8") : null;
+    const current = (0, import_node_fs54.existsSync)(path2) ? (0, import_node_fs54.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs53.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs54.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs53.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs54.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -54071,7 +54157,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs54.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs55.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -54106,7 +54192,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs54.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -54115,7 +54201,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs54.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -54829,7 +54915,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs54.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs55.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -55218,15 +55304,15 @@ function ciAuditDeps2() {
     readSeedFile: (path2) => {
       if (!root) return null;
       const fullPath = (0, import_node_path53.join)(root, path2);
-      return (0, import_node_fs54.existsSync)(fullPath) ? (0, import_node_fs54.readFileSync)(fullPath, "utf8") : null;
+      return (0, import_node_fs55.existsSync)(fullPath) ? (0, import_node_fs55.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
   const fromPkg = (0, import_node_path53.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs54.existsSync)((0, import_node_path53.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs54.existsSync)((0, import_node_path53.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs55.existsSync)((0, import_node_path53.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs55.existsSync)((0, import_node_path53.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -55352,10 +55438,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs54.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs54.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs55.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs55.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs54.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs54.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs55.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs55.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -55386,7 +55472,7 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs54.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs55.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -55395,7 +55481,7 @@ function directoryBytes(path2) {
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs54.statSync)(child2).size;
+        total += (0, import_node_fs55.statSync)(child2).size;
       } catch {
       }
     }
@@ -55403,25 +55489,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs54.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs55.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs54.existsSync)(p)) return [];
+  if (!(0, import_node_fs55.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs54.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs55.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs54.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs54.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs55.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs55.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs54.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs55.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path53.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs54.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path53.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs55.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -55436,9 +55522,9 @@ function stagingApplyFsGuard(configRoot) {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
       const p = (0, import_node_path53.join)(stagingRoot, name);
-      if (!(0, import_node_fs54.existsSync)(p)) return null;
+      if (!(0, import_node_fs55.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs54.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs55.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -55464,7 +55550,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs54.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs55.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));