npm - @mutmutco/codex-plugin - Versions diffs - 4.5.117 → 4.5.118 - Mend

@mutmutco/codex-plugin 4.5.117 → 4.5.118

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/cli/dist/main.cjs CHANGED Viewed

@@ -4751,7 +4751,7 @@ function useColor() {
 var program = new Command();
 // src/command-composition.ts
-var import_node_fs55 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
@@ -5653,13 +5653,13 @@ function resolveVerbAliasShim(argv) {
 }
 // src/command-composition.ts
-var import_node_os24 = require("node:os");
-var import_node_path53 = require("node:path");
+var import_node_os25 = require("node:os");
+var import_node_path54 = require("node:path");
 // src/board-read.ts
-var import_node_fs13 = require("node:fs");
-var import_node_os9 = require("node:os");
-var import_node_path11 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_os10 = require("node:os");
+var import_node_path12 = require("node:path");
 init_cli_shared();
 init_github_client();
@@ -5667,21 +5667,35 @@ init_github_client();
 init_fetch_retry();
 init_client_version();
 var BOARD_SNAPSHOT_TIMEOUT_MS = 25e3;
+var BOARD_SNAPSHOT_EXIT_CODES = {
+  "hub-unreachable": 20,
+  "app-quota-exhausted": 21,
+  refused: 22
+};
+var BoardSnapshotFailure = class extends Error {
+  constructor(receipt) {
+    super(receipt.reason);
+    this.receipt = receipt;
+    this.exitCode = BOARD_SNAPSHOT_EXIT_CODES[receipt.outcome];
+  }
+  receipt;
+  exitCode;
+};
 function isSnapshotShape(body) {
   const b = body;
   const rate = b?.github?.rateLimit;
   const staleValid = b?.stale === void 0 || typeof b.stale === "object" && b.stale !== null && Number.isFinite(b.stale.ageMs) && b.stale.ageMs >= 0;
-  const githubValid = b?.github === void 0 || b.github.credential === "app_installation" && (rate === void 0 || Number.isFinite(rate?.limit) && Number.isFinite(rate?.remaining) && Number.isFinite(rate?.cost) && typeof rate?.resetAt === "string");
+  const githubValid = b?.github === void 0 || b.github !== null && typeof b.github === "object" && b.github.credential === "app_installation" && (rate === void 0 || Number.isFinite(rate?.limit) && Number.isFinite(rate?.remaining) && Number.isFinite(rate?.cost) && typeof rate?.resetAt === "string");
   return Boolean(
     b && typeof b === "object" && typeof b.project?.id === "string" && typeof b.project?.title === "string" && typeof b.viewer === "string" && b.viewer.length > 0 && Array.isArray(b.nodes) && Array.isArray(b.writableRepos) && Array.isArray(b.unreadableRepos) && Array.isArray(b.pullRequests) && Array.isArray(b.warnings) && typeof b.partial === "boolean" && (b.source === void 0 || b.source === "live" || b.source === "cache") && (b.builtAt === void 0 || typeof b.builtAt === "string" && Number.isFinite(Date.parse(b.builtAt))) && (b.eventCursor === void 0 || Number.isInteger(b.eventCursor) && b.eventCursor >= 0) && githubValid && staleValid
   );
 }
 async function fetchHubBoardSnapshot(request, deps) {
   if (!deps.baseUrl) return { state: "unavailable", reason: "no Hub API URL (set MMI_HUB_URL or use a current MMI CLI/plugin build)" };
-  const token = await deps.token();
-  if (!token) return { state: "unavailable", reason: "no Hub session token (run `gh auth login`)" };
   let res;
   try {
+    const token = await deps.token();
+    if (!token) return { state: "unavailable", reason: "no Hub session token (run `gh auth login`)" };
     res = await fetchWithRetry(
       deps.fetch ?? fetch,
       `${deps.baseUrl.replace(/\/$/, "")}/board/snapshot`,
@@ -5715,10 +5729,26 @@ async function fetchHubBoardSnapshot(request, deps) {
       return {
         state: "unavailable",
         reason: `GitHub App quota exhausted${reset}`,
+        appQuotaExhausted: true,
+        pool: "graphql",
+        ...typeof body2.resetAt === "string" ? { resetAt: body2.resetAt } : {},
         ...body2.github?.credential === "app_installation" && body2.github.resource === "graphql" && /^github-app-v1:[a-f0-9]{64}$/.test(body2.github.quotaScope ?? "") ? { quota: { status: "rate_limited", ...typeof body2.resetAt === "string" ? { resetAt: body2.resetAt } : {}, github: { credential: "app_installation", resource: "graphql", quotaScope: body2.github.quotaScope } } } : {}
       };
     }
   }
+  if (res.status === 503) {
+    const body2 = await res.json().catch(() => null);
+    if (body2?.code === "github-rate-limited") {
+      const reset = typeof body2.resetAt === "string" ? `; resets ${body2.resetAt}` : "; reset time unavailable";
+      return {
+        state: "unavailable",
+        reason: `GitHub App allowance exhausted${reset}`,
+        appQuotaExhausted: true,
+        pool: "rest",
+        ...typeof body2.resetAt === "string" ? { resetAt: body2.resetAt } : {}
+      };
+    }
+  }
   if (!res.ok) return { state: "unavailable", reason: `board snapshot HTTP ${res.status}` };
   const body = await res.json().catch(() => null);
   if (!isSnapshotShape(body)) return { state: "unavailable", reason: "malformed board snapshot response" };
@@ -5816,6 +5846,18 @@ var activeQuotaScope;
 function activeAppQuotaScope() {
   return activeQuotaScope;
 }
+async function readAppVaultSecret(read) {
+  try {
+    return await read();
+  } catch (e) {
+    const reason = e.message;
+    if (/^(Hub GitHub App allowance used up|rate limited)/.test(reason)) {
+      throw new AppActorError(`app actor: the vault could not read the App credentials because GitHub is rate-limited, not a denial: ${reason}`, "mint-failed");
+    }
+    if (/^authority refused|\(HTTP 404\b/.test(reason)) return null;
+    throw new AppActorError(`app actor: the vault read of the App credentials failed, not a denial: ${reason}`, "mint-failed");
+  }
+}
 async function mintInstallationToken(deps) {
   const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
   if (!appId || !installationId || !privateKey) {
@@ -6298,6 +6340,93 @@ function isReleaseShaDeployEnumerationCandidate(row, nonDeployEvents) {
 // src/pr-checks-rest.ts
 init_github_quota();
+// src/rest-etag-cache.ts
+var import_node_crypto5 = require("node:crypto");
+var import_node_fs11 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path9 = require("node:path");
+var MAX_AGE_MS = 24 * 60 * 6e4;
+var MAX_ENTRIES = 256;
+var MAX_BYTES = 16 * 1024 * 1024;
+var MAX_ENTRY_BYTES = 1024 * 1024;
+function restEtagCacheDir() {
+  if (process.env.MMI_REST_ETAG_CACHE_DIR) return process.env.MMI_REST_ETAG_CACHE_DIR;
+  return process.platform === "win32" ? (0, import_node_path9.join)(process.env.LOCALAPPDATA || (0, import_node_path9.join)((0, import_node_os4.homedir)(), "AppData", "Local"), "MMI Future", "mmi-cli", "rest-etags") : (0, import_node_path9.join)(process.env.XDG_CACHE_HOME || (0, import_node_path9.join)((0, import_node_os4.homedir)(), ".cache"), "mmi-cli", "rest-etags");
+}
+function entryPath(dir, key) {
+  return (0, import_node_path9.join)(dir, `${(0, import_node_crypto5.createHash)("sha256").update(key).digest("hex")}.json`);
+}
+function readRestEtag(key, dir = restEtagCacheDir()) {
+  if (dir === "off") return void 0;
+  try {
+    const path2 = entryPath(dir, key);
+    if ((0, import_node_fs11.statSync)(path2).size > MAX_ENTRY_BYTES) return void 0;
+    const entry = JSON.parse((0, import_node_fs11.readFileSync)(path2, "utf8"));
+    const age = Date.now() - entry.storedAt;
+    if (typeof entry.etag === "string" && entry.etag && !/[\r\n]/.test(entry.etag) && typeof entry.body === "string" && Number.isFinite(entry.storedAt) && age >= 0 && age <= MAX_AGE_MS) return entry;
+  } catch {
+  }
+  return void 0;
+}
+function deleteRestEtag(key, dir = restEtagCacheDir()) {
+  if (dir === "off") return;
+  try {
+    (0, import_node_fs11.rmSync)(entryPath(dir, key), { force: true });
+  } catch {
+  }
+}
+function prune(dir) {
+  const now = Date.now();
+  const files = (0, import_node_fs11.readdirSync)(dir).filter((name) => /^[a-f0-9]{64}\.json(?:\.tmp-.+)?$/.test(name)).flatMap((name) => {
+    try {
+      const path2 = (0, import_node_path9.join)(dir, name);
+      const stat4 = (0, import_node_fs11.statSync)(path2);
+      if (now - stat4.mtimeMs > MAX_AGE_MS) {
+        (0, import_node_fs11.rmSync)(path2, { force: true });
+        return [];
+      }
+      return name.endsWith(".json") ? [{ path: path2, size: stat4.size, at: stat4.mtimeMs }] : [];
+    } catch {
+      return [];
+    }
+  }).sort((a, b) => a.at - b.at);
+  let bytes = files.reduce((sum, f) => sum + f.size, 0);
+  let count = files.length;
+  for (const file of files) {
+    if (count <= MAX_ENTRIES && bytes <= MAX_BYTES) break;
+    try {
+      (0, import_node_fs11.rmSync)(file.path, { force: true });
+      bytes -= file.size;
+      count--;
+    } catch {
+    }
+  }
+}
+function writeRestEtag(key, entry, dir = restEtagCacheDir()) {
+  if (dir === "off") return;
+  const path2 = entryPath(dir, key);
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto5.randomUUID)()}`;
+  try {
+    const data = JSON.stringify({ etag: entry.etag, body: entry.body, storedAt: Date.now() });
+    if (Buffer.byteLength(data) > MAX_ENTRY_BYTES) {
+      deleteRestEtag(key, dir);
+      return;
+    }
+    (0, import_node_fs11.mkdirSync)(dir, { recursive: true, mode: 448 });
+    (0, import_node_fs11.writeFileSync)(tmp, data, { mode: 384, flag: "wx" });
+    (0, import_node_fs11.renameSync)(tmp, path2);
+    prune(dir);
+  } catch {
+  } finally {
+    try {
+      (0, import_node_fs11.rmSync)(tmp, { force: true });
+    } catch {
+    }
+  }
+}
+// src/pr-checks-rest.ts
 var REST_GH_TIMEOUT_MS = 2e4;
 var pollTokenProvider;
 var pollTokenOnce;
@@ -6382,8 +6511,9 @@ function observedCorePool(source, nowMs) {
 async function defaultGhApi(args, env = process.env) {
   const appToken = await pollToken();
   const source = appToken ? "app" : "user";
-  const key = `${source}\0${args.join("\0")}`;
-  const cached = etagCache.get(key);
+  const key = `${source}\0${env.GH_HOST || "github.com"}\0${args.join("\0")}`;
+  const cached = etagCache.get(key) ?? readRestEtag(key);
+  if (cached) etagCache.set(key, cached);
   let stdout;
   try {
     ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
@@ -6397,31 +6527,37 @@ async function defaultGhApi(args, env = process.env) {
   } catch (e) {
     const out = e.stdout;
     const errOut = typeof out === "string" ? out : void 0;
-    const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
+    const status2 = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
     if (errOut !== void 0) notePoolHeaders(source, errOut, Date.now());
-    if (cached && status === 304) {
+    if (cached && status2 === 304) {
       lastPollSource = source;
       return cached.body;
     }
-    if (status === 403 || status === 429) {
+    if (status2 === 403 || status2 === 429) {
       const path2 = args.filter((a) => !a.startsWith("-")).join(" ") || args.join(" ");
       const refusal = errOut !== void 0 ? describeRefusal(errOut) : "no rate-limit headers or message";
-      if (status === 403 && /Resource not accessible by integration/i.test(refusal)) {
+      if (status2 === 403 && /Resource not accessible by integration/i.test(refusal)) {
         throw new Error(
           `poll read refused: App token lacks permission for ${path2} (HTTP 403, response: ${refusal}) \u2014 reads never fall back to the owner's token (#8030); add the permission to APP_POLL_PERMISSIONS / the App installation`
         );
       }
       throw Object.assign(new Error(
-        `poll read refused on the ${source} pool (HTTP ${status}, response: ${refusal}) \u2014 reads stay on the ${source === "app" ? "App" : "ambient identity"} (#8030); the wait re-arms after reset`
-      ), { status, stdout: errOut, stderr: e.stderr });
+        `poll read refused on the ${source} pool (HTTP ${status2}, response: ${refusal}) \u2014 reads stay on the ${source === "app" ? "App" : "ambient identity"} (#8030); the wait re-arms after reset`
+      ), { status: status2, stdout: errOut, stderr: e.stderr });
     }
     throw e;
   }
-  const { body, etag, pages } = parseIncludedOutput(stdout);
+  const { body, status, etag, pages } = parseIncludedOutput(stdout);
   notePoolHeaders(source, stdout, Date.now());
   lastPollSource = source;
-  if (etag && pages === 1) etagCache.set(key, { etag, body });
-  else etagCache.delete(key);
+  if (cached && status === 304) return cached.body;
+  if (status === 200 && etag && pages === 1) {
+    etagCache.set(key, { etag, body });
+    writeRestEtag(key, { etag, body });
+  } else {
+    etagCache.delete(key);
+    deleteRestEtag(key);
+  }
   return body;
 }
 function classifyCheckRun(run) {
@@ -8526,12 +8662,12 @@ async function fetchSchedulesList(deps) {
     return null;
   }
 }
-async function fetchOrgConfig(deps) {
+async function fetchOrgConfig(deps, spendMinutes) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
   if (!token) return null;
   try {
-    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}${ORG_CONFIG_PATH}`, {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}${ORG_CONFIG_PATH}${spendMinutes === void 0 ? "" : `?github-spend-minutes=${spendMinutes}`}`, {
       method: "GET",
       headers: { Authorization: `Bearer ${token}` }
     });
@@ -9765,14 +9901,14 @@ async function secretsPreflight(deps, opts) {
 // src/secrets-execution.ts
 var import_node_child_process4 = require("node:child_process");
-var import_node_os5 = require("node:os");
+var import_node_os6 = require("node:os");
 init_clean_exit();
 // src/gh-create.ts
 var import_promises = require("node:fs/promises");
-var import_node_os4 = require("node:os");
-var import_node_path9 = require("node:path");
-var import_node_crypto5 = require("node:crypto");
+var import_node_os5 = require("node:os");
+var import_node_path10 = require("node:path");
+var import_node_crypto6 = require("node:crypto");
 // src/board-priority.ts
 var BOARD_PRIORITY_NAMES = ["Urgent", "High", "Medium", "Low"];
@@ -9858,9 +9994,9 @@ async function bodyArgsViaFile(args, deps = {}) {
   const write = deps.write ?? import_promises.writeFile;
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
-  const dir = deps.dir ?? (0, import_node_os4.tmpdir)();
-  const file = (0, import_node_path9.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.md`);
-  await ensureDir((0, import_node_path9.dirname)(file), { recursive: true }).catch(() => {
+  const dir = deps.dir ?? (0, import_node_os5.tmpdir)();
+  const file = (0, import_node_path10.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}.md`);
+  await ensureDir((0, import_node_path10.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, args[i + 1], "utf8");
   return {
@@ -10188,8 +10324,8 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
   const write = deps.write ?? import_promises.writeFile;
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
-  const dir = deps.dir ?? (0, import_node_os4.tmpdir)();
-  const file = (0, import_node_path9.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.json`);
+  const dir = deps.dir ?? (0, import_node_os5.tmpdir)();
+  const file = (0, import_node_path10.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}.json`);
   const payload = {
     title: input.title,
     head: input.head,
@@ -10197,7 +10333,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
   };
   if (input.base) payload.base = input.base;
   if (input.draft) payload.draft = true;
-  await ensureDir((0, import_node_path9.dirname)(file), { recursive: true }).catch(() => {
+  await ensureDir((0, import_node_path10.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, JSON.stringify(payload), "utf8");
   const args = [
@@ -11133,7 +11269,7 @@ function resolveSpawnTarget(command, args, platform2 = process.platform) {
 }
 function spawnExitCode(status, signal) {
   if (status != null) return status;
-  const signo = signal ? import_node_os5.constants.signals[signal] : void 0;
+  const signo = signal ? import_node_os6.constants.signals[signal] : void 0;
   return signo ? 128 + signo : 1;
 }
 function defaultSpawn(command, args, env) {
@@ -11589,14 +11725,14 @@ function findDuplicateLesson(source, openLessons) {
 }
 // src/session-identity.ts
-var import_node_crypto6 = require("node:crypto");
-var import_node_os8 = require("node:os");
+var import_node_crypto7 = require("node:crypto");
+var import_node_os9 = require("node:os");
 // src/plugin-guard-io.ts
-var import_node_fs12 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var import_node_child_process5 = require("node:child_process");
-var import_node_path10 = require("node:path");
-var import_node_os7 = require("node:os");
+var import_node_path11 = require("node:path");
+var import_node_os8 = require("node:os");
 // src/marketplace-autoupdate.ts
 var KNOWN_MARKETPLACES_RELATIVE = [".claude", "plugins", "known_marketplaces.json"];
@@ -11740,8 +11876,8 @@ function buildPluginGuardLine(state, opts = {}) {
 }
 // src/host-doc-lock.ts
-var import_node_fs11 = require("node:fs");
-var import_node_os6 = require("node:os");
+var import_node_fs12 = require("node:fs");
+var import_node_os7 = require("node:os");
 var SHARED_DOC_LOCK_STALE_MS = 3e4;
 var SHARED_DOC_LOCK_ATTEMPTS = 50;
 var SHARED_DOC_LOCK_INTERVAL_MS = 100;
@@ -11754,7 +11890,7 @@ function lockContent(options) {
 }
 function readHolder(lockPath) {
   try {
-    const parsed = JSON.parse((0, import_node_fs11.readFileSync)(lockPath, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs12.readFileSync)(lockPath, "utf8"));
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
@@ -11766,7 +11902,7 @@ function lockAgeMs(lockPath, now) {
   const declared = typeof holder?.acquiredAt === "string" ? Date.parse(holder.acquiredAt) : Number.NaN;
   if (!Number.isNaN(declared)) return Math.max(0, now - declared);
   try {
-    return Math.max(0, now - (0, import_node_fs11.statSync)(lockPath).mtimeMs);
+    return Math.max(0, now - (0, import_node_fs12.statSync)(lockPath).mtimeMs);
   } catch {
     return 0;
   }
@@ -11781,7 +11917,7 @@ function acquireSharedDocLock(documentPath, options) {
   const staleAfterMs = options.staleAfterMs ?? SHARED_DOC_LOCK_STALE_MS;
   const attempts = options.attempts ?? SHARED_DOC_LOCK_ATTEMPTS;
   const intervalMs = options.intervalMs ?? SHARED_DOC_LOCK_INTERVAL_MS;
-  const identity = { owner: options.owner, pid: process.pid, host: options.host ?? (0, import_node_os6.hostname)(), acquiredAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const identity = { owner: options.owner, pid: process.pid, host: options.host ?? (0, import_node_os7.hostname)(), acquiredAt: (/* @__PURE__ */ new Date()).toISOString() };
   const content = lockContent(identity);
   const sleep2 = (ms) => {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -11789,9 +11925,9 @@ function acquireSharedDocLock(documentPath, options) {
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     let fd;
     try {
-      fd = (0, import_node_fs11.openSync)(lockPath, "wx");
-      (0, import_node_fs11.writeSync)(fd, content);
-      (0, import_node_fs11.closeSync)(fd);
+      fd = (0, import_node_fs12.openSync)(lockPath, "wx");
+      (0, import_node_fs12.writeSync)(fd, content);
+      (0, import_node_fs12.closeSync)(fd);
       return {
         documentPath,
         lockPath,
@@ -11804,11 +11940,11 @@ function acquireSharedDocLock(documentPath, options) {
     } catch (error) {
       if (fd !== void 0) {
         try {
-          (0, import_node_fs11.closeSync)(fd);
+          (0, import_node_fs12.closeSync)(fd);
         } catch {
         }
         try {
-          (0, import_node_fs11.unlinkSync)(lockPath);
+          (0, import_node_fs12.unlinkSync)(lockPath);
         } catch {
         }
       }
@@ -11817,12 +11953,12 @@ function acquireSharedDocLock(documentPath, options) {
     if (lockAgeMs(lockPath, Date.now()) >= staleAfterMs) {
       const aside = `${lockPath}.stale-${Date.now()}`;
       try {
-        (0, import_node_fs11.renameSync)(lockPath, aside);
+        (0, import_node_fs12.renameSync)(lockPath, aside);
       } catch {
         continue;
       }
       try {
-        (0, import_node_fs11.rmSync)(aside, { force: true });
+        (0, import_node_fs12.rmSync)(aside, { force: true });
       } catch {
       }
       continue;
@@ -11835,7 +11971,7 @@ function releaseSharedDocLock(handle) {
   try {
     const holder = readHolder(handle.lockPath);
     if (holder && holder.owner === handle.owner && Number(holder.pid) === handle.pid) {
-      (0, import_node_fs11.unlinkSync)(handle.lockPath);
+      (0, import_node_fs12.unlinkSync)(handle.lockPath);
     }
   } catch {
   }
@@ -11982,25 +12118,25 @@ function runHostBin(bin, args, opts) {
   const argv = isWin ? ["/c", bin, ...args] : args;
   return step ? execFileHard(file, argv, { ...shared, step }) : execFileP(file, argv, shared);
 }
-function hermesConfigRoot(env = process.env, home = (0, import_node_os7.homedir)(), platform2 = process.platform) {
+function hermesConfigRoot(env = process.env, home = (0, import_node_os8.homedir)(), platform2 = process.platform) {
   if (env.HERMES_HOME?.trim()) return env.HERMES_HOME.trim();
-  if (platform2 === "win32") return (0, import_node_path10.join)(env.LOCALAPPDATA?.trim() || (0, import_node_path10.join)(home, "AppData", "Local"), "hermes");
-  return (0, import_node_path10.join)(home, ".hermes");
+  if (platform2 === "win32") return (0, import_node_path11.join)(env.LOCALAPPDATA?.trim() || (0, import_node_path11.join)(home, "AppData", "Local"), "hermes");
+  return (0, import_node_path11.join)(home, ".hermes");
 }
-function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os7.homedir)()) {
-  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path10.join)(home, ".codex");
+function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os8.homedir)()) {
+  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path11.join)(home, ".codex");
   if (surface === "hermes") return hermesConfigRoot(env, home);
   if (surface === "jervcode") {
-    return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path10.join)(home, ".jerv", "agent");
+    return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path11.join)(home, ".jerv", "agent");
   }
-  return (0, import_node_path10.join)(home, ".claude");
+  return (0, import_node_path11.join)(home, ".claude");
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
-  return (0, import_node_path10.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
+  return (0, import_node_path11.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs12.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs13.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -12009,15 +12145,15 @@ function marketplaceCloneCandidates(surface, home, env = process.env) {
   if (surface === "codex") {
     const root = surfaceConfigRoot(surface, env, home);
     return [
-      (0, import_node_path10.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
-      (0, import_node_path10.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
+      (0, import_node_path11.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
+      (0, import_node_path11.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
     ];
   }
   if (surface === "hermes") return [];
   if (surface === "jervcode") return [];
-  return [(0, import_node_path10.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path11.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs12.existsSync, env = process.env) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs13.existsSync, env = process.env) {
   return marketplaceCloneCandidates(surface, home, env).some(exists);
 }
 function runHostBinSync(bin, args) {
@@ -12059,26 +12195,26 @@ async function fetchNpmReleasedVersion() {
   }
 }
 var JERVCODE_NPM_PACKAGE = "@mutmutco/pi-plugin";
-function jervcodeAgentDirs(env = process.env, home = (0, import_node_os7.homedir)()) {
+function jervcodeAgentDirs(env = process.env, home = (0, import_node_os8.homedir)()) {
   const primary = surfaceConfigRoot("jervcode", env, home);
-  const legacy = (0, import_node_path10.join)(home, ".pi", "agent");
+  const legacy = (0, import_node_path11.join)(home, ".pi", "agent");
   const dirs = [primary];
   if (legacy !== primary) dirs.push(legacy);
-  return dirs.filter((dir) => (0, import_node_fs12.existsSync)(dir));
+  return dirs.filter((dir) => (0, import_node_fs13.existsSync)(dir));
 }
 function readPiSettings(path2) {
-  if (!(0, import_node_fs12.existsSync)(path2)) return void 0;
+  if (!(0, import_node_fs13.existsSync)(path2)) return void 0;
   try {
-    const parsed = JSON.parse((0, import_node_fs12.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(path2, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
     return null;
   }
 }
-function mmiPiPackageEntry(env = process.env, home = (0, import_node_os7.homedir)()) {
+function mmiPiPackageEntry(env = process.env, home = (0, import_node_os8.homedir)()) {
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const settings = readPiSettings((0, import_node_path10.join)(dir, "settings.json"));
+    const settings = readPiSettings((0, import_node_path11.join)(dir, "settings.json"));
     const entries = Array.isArray(settings?.packages) ? settings.packages : [];
     for (const entry of entries) {
       if (typeof entry !== "string") continue;
@@ -12088,10 +12224,10 @@ function mmiPiPackageEntry(env = process.env, home = (0, import_node_os7.homedir
   return null;
 }
 var LEGACY_MMI_PI_PATH = /[/\\]mutmutco[/\\]mmi[/\\]\d+\.\d+\.\d+[/\\]\.pi-plugin[/\\]?$/i;
-function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os7.homedir)()) {
+function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os8.homedir)()) {
   const found = [];
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const settings = readPiSettings((0, import_node_path10.join)(dir, "settings.json"));
+    const settings = readPiSettings((0, import_node_path11.join)(dir, "settings.json"));
     const entries = Array.isArray(settings?.packages) ? settings.packages : [];
     for (const entry of entries) {
       if (typeof entry === "string" && LEGACY_MMI_PI_PATH.test(entry) && !found.includes(entry)) found.push(entry);
@@ -12099,37 +12235,37 @@ function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os7.ho
   }
   return found;
 }
-function mmiPiPackageRoot(env = process.env, home = (0, import_node_os7.homedir)()) {
+function mmiPiPackageRoot(env = process.env, home = (0, import_node_os8.homedir)()) {
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const root = (0, import_node_path10.join)(dir, "npm", "node_modules", ...JERVCODE_NPM_PACKAGE.split("/"));
-    if ((0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "package.json"))) return root;
+    const root = (0, import_node_path11.join)(dir, "npm", "node_modules", ...JERVCODE_NPM_PACKAGE.split("/"));
+    if ((0, import_node_fs13.existsSync)((0, import_node_path11.join)(root, "package.json"))) return root;
   }
   return null;
 }
-function installedJervCodePackageVersion(env = process.env, home = (0, import_node_os7.homedir)()) {
+function installedJervCodePackageVersion(env = process.env, home = (0, import_node_os8.homedir)()) {
   const root = mmiPiPackageRoot(env, home);
   if (!root) return void 0;
   try {
-    const manifest = JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path10.join)(root, "package.json"), "utf8"));
+    const manifest = JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path11.join)(root, "package.json"), "utf8"));
     return typeof manifest.version === "string" ? manifest.version : void 0;
   } catch {
     return void 0;
   }
 }
-function mmiPiPackageHealthy(env = process.env, home = (0, import_node_os7.homedir)()) {
+function mmiPiPackageHealthy(env = process.env, home = (0, import_node_os8.homedir)()) {
   const root = mmiPiPackageRoot(env, home);
-  return Boolean(root && (0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "skills", "bootstrap", "SKILL.md")));
+  return Boolean(root && (0, import_node_fs13.existsSync)((0, import_node_path11.join)(root, "skills", "bootstrap", "SKILL.md")));
 }
 function piDoctorEnv(agentDir) {
   return { ...process.env, PI_CODING_AGENT_DIR: agentDir };
 }
-function hermesPluginRoot(env = process.env, home = (0, import_node_os7.homedir)()) {
-  return (0, import_node_path10.join)(hermesConfigRoot(env, home), "plugins", "mmi");
+function hermesPluginRoot(env = process.env, home = (0, import_node_os8.homedir)()) {
+  return (0, import_node_path11.join)(hermesConfigRoot(env, home), "plugins", "mmi");
 }
-function hermesPluginTreeHealthy(root, exists = import_node_fs12.existsSync) {
-  if (!["plugin.yaml", "__init__.py"].every((file) => exists((0, import_node_path10.join)(root, file)))) return false;
+function hermesPluginTreeHealthy(root, exists = import_node_fs13.existsSync) {
+  if (!["plugin.yaml", "__init__.py"].every((file) => exists((0, import_node_path11.join)(root, file)))) return false;
   try {
-    return (0, import_node_fs12.statSync)((0, import_node_path10.join)(root, "skills")).isDirectory();
+    return (0, import_node_fs13.statSync)((0, import_node_path11.join)(root, "skills")).isDirectory();
   } catch {
     return false;
   }
@@ -12144,12 +12280,12 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     // Codex's native projection is authoritative; its legacy installed_plugins.json may be empty
     // while `plugin list --json` proves the managed plugin installed (#6111).
     installRecordPresent: surface === "codex" ? codexStatus?.installed === true : hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()) || // #4188: jervcode's install record is the settings-file packages[] entry itself.
-    surface === "jervcode" && piEntry !== null || surface === "hermes" && (0, import_node_fs12.existsSync)(hermesPluginRoot()),
+    surface === "jervcode" && piEntry !== null || surface === "hermes" && (0, import_node_fs13.existsSync)(hermesPluginRoot()),
     // JervCode's settings entry and native local surfaces have no marketplace clone.
-    marketplaceClonePresent: surface === "jervcode" || surface === "hermes" ? true : marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
+    marketplaceClonePresent: surface === "jervcode" || surface === "hermes" ? true : marketplaceClonePresent(surface, (0, import_node_os8.homedir)()),
     pluginCachePresent: surface === "jervcode" ? mmiPiPackageHealthy() : surface === "hermes" ? hermesPluginTreeHealthy(hermesPluginRoot()) : surface === "codex" ? Boolean(
-      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
-    ) : (0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "plugins", "cache", "mutmutco", "mmi"))
+      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs13.existsSync)((0, import_node_path11.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
+    ) : (0, import_node_fs13.existsSync)((0, import_node_path11.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 async function runPluginCli(bin, args, log) {
@@ -12196,7 +12332,7 @@ async function runHealSteps(host, tableSteps, deps) {
   const refSupported = needsRefProbe ? await marketplaceAddRefSupported(host) : true;
   const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
   if (deps.banner) log(deps.banner(refSupported));
-  const pinsPath = (0, import_node_path10.join)((0, import_node_os7.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
+  const pinsPath = (0, import_node_path11.join)((0, import_node_os8.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
   const pins = host === "claude" ? captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]) : /* @__PURE__ */ new Map();
   let failure;
   try {
@@ -12307,7 +12443,7 @@ async function healActivePluginForDoctor(surface = detectSurface(process.env), o
 }
 function readKnownMarketplacesFile(path2) {
   try {
-    return (0, import_node_fs12.existsSync)(path2) ? (0, import_node_fs12.readFileSync)(path2, "utf8") : void 0;
+    return (0, import_node_fs13.existsSync)(path2) ? (0, import_node_fs13.readFileSync)(path2, "utf8") : void 0;
   } catch {
     return void 0;
   }
@@ -12341,11 +12477,11 @@ function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb, declineW
       if (declined) return declined;
       const tmp = `${path2}.tmp-${process.pid}`;
       try {
-        (0, import_node_fs12.writeFileSync)(tmp, next, "utf8");
-        (0, import_node_fs12.renameSync)(tmp, path2);
+        (0, import_node_fs13.writeFileSync)(tmp, next, "utf8");
+        (0, import_node_fs13.renameSync)(tmp, path2);
       } catch {
         try {
-          (0, import_node_fs12.rmSync)(tmp, { force: true });
+          (0, import_node_fs13.rmSync)(tmp, { force: true });
         } catch {
         }
         return `could NOT ${failedVerb} ${[...pins.keys()].join(", ")} \u2014 set it by hand`;
@@ -12473,7 +12609,7 @@ function readSessionIdSource(env) {
 var synthesizedSessionId;
 function fallbackSessionId(surface) {
   if (!synthesizedSessionId) {
-    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto6.randomBytes)(3).toString("hex")}`;
+    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto7.randomBytes)(3).toString("hex")}`;
   }
   return synthesizedSessionId;
 }
@@ -12482,7 +12618,7 @@ function describeSessionIdentity(env = process.env) {
   return {
     session: readSessionId(env) ?? fallbackSessionId(surface),
     surface,
-    host: (0, import_node_os8.hostname)()
+    host: (0, import_node_os9.hostname)()
   };
 }
 function formatSessionIdentity(identity) {
@@ -13182,7 +13318,7 @@ function renderBoardSource() {
   return "source: live";
 }
 async function collectBoardPreferringSnapshot(cfg, options, deps) {
-  if (options.snapshotOnly && !deps.snapshot) throw new Error("--snapshot-only needs the Hub snapshot transport (not with --direct)");
+  if (options.snapshotOnly && !deps.snapshot) throw new BoardSnapshotFailure({ ok: false, outcome: "hub-unreachable", reason: "--snapshot-only needs the Hub snapshot transport (not with --direct)" });
   const attempt = deps.snapshot ? await fetchHubBoardSnapshot(
     {
       owner: cfg.projectOwner,
@@ -13195,6 +13331,7 @@ async function collectBoardPreferringSnapshot(cfg, options, deps) {
     deps.snapshot
   ) : void 0;
   if (attempt?.state === "refused") {
+    if (options.snapshotOnly) throw new BoardSnapshotFailure({ ok: false, outcome: "refused", reason: attempt.reason });
     throw new Error(attempt.reason);
   }
   if (attempt?.state === "ok") {
@@ -13224,7 +13361,16 @@ async function collectBoardPreferringSnapshot(cfg, options, deps) {
     };
   }
   if (options.snapshotOnly && attempt?.state === "unavailable") {
-    throw Object.assign(new Error(`Hub board snapshot unavailable (${attempt.reason}) \u2014 --snapshot-only refuses the direct user-auth fallback`), { quota: attempt.quota });
+    throw Object.assign(new BoardSnapshotFailure({
+      ok: false,
+      outcome: attempt.appQuotaExhausted ? "app-quota-exhausted" : "hub-unreachable",
+      reason: `Hub board snapshot unavailable (${attempt.reason}) \u2014 --snapshot-only refuses the direct user-auth fallback`,
+      ...attempt.resetAt ? { resetAt: attempt.resetAt } : {},
+      ...attempt.pool ? { pool: attempt.pool } : {}
+    }), { quota: attempt.quota });
+  }
+  if (attempt?.state === "unavailable" && attempt.appQuotaExhausted) {
+    throw Object.assign(new Error(`Hub board snapshot unavailable (${attempt.reason}) \u2014 the personal-token fallback is refused while the org App allowance is exhausted; retry after the reset`), { quota: attempt.quota });
   }
   const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial, activeOnly: true }, deps);
   if (attempt?.state === "unavailable") {
@@ -13907,7 +14053,7 @@ var CLAIM_SESSION_ACTIVITY_MS = 30 * 6e4;
 var CLAIM_SESSION_PROBE_CACHE_MS = 6e4;
 var claimSessionProbeCache = /* @__PURE__ */ new Map();
 function probeLocalClaimSession(marker, now = Date.now()) {
-  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os9.hostname)().toLowerCase()) return void 0;
+  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os10.hostname)().toLowerCase()) return void 0;
   if (!marker.surface?.toLowerCase().startsWith("claude")) return void 0;
   const cacheKey = `${marker.host.toLowerCase()}/${marker.session}`;
   const cached = claimSessionProbeCache.get(cacheKey);
@@ -13916,17 +14062,17 @@ function probeLocalClaimSession(marker, now = Date.now()) {
     claimSessionProbeCache.set(cacheKey, { checkedAt: now, state });
     return state;
   };
-  const root = (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".claude", "projects");
+  const root = (0, import_node_path12.join)((0, import_node_os10.homedir)(), ".claude", "projects");
   try {
     const wanted = `${marker.session}.jsonl`.toLowerCase();
     const pending = [root];
     while (pending.length) {
       const dir = pending.pop();
-      for (const entry of (0, import_node_fs13.readdirSync)(dir, { withFileTypes: true })) {
-        const path2 = (0, import_node_path11.join)(dir, entry.name);
+      for (const entry of (0, import_node_fs14.readdirSync)(dir, { withFileTypes: true })) {
+        const path2 = (0, import_node_path12.join)(dir, entry.name);
         if (entry.isDirectory()) pending.push(path2);
         else if (entry.isFile() && entry.name.toLowerCase() === wanted) {
-          return remember(now - (0, import_node_fs13.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
+          return remember(now - (0, import_node_fs14.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead");
         }
       }
     }
@@ -15179,7 +15325,7 @@ async function propagateMayAutoMerge(repo, repoClass, rest) {
 }
 // src/bootstrap-apply.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 // src/bootstrap-seeds.ts
 var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
@@ -15418,13 +15564,13 @@ function planManagedGitignore(current) {
 }
 // src/docs-index-command.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path14 = require("node:path");
 // src/doc-refs-core.ts
 var import_node_child_process6 = require("node:child_process");
-var import_node_fs14 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path13 = require("node:path");
 var PIN_RE = /<!--\s*pinned by\s+([^:]+?)\s*:\s*"([^"]+)"[^"]*-->/;
 var PIN_MENTION_RE = /<!--\s*pinned by\b/;
 var FWD_RE = /<!--\s*forward-ref:\s*(\S+?)\s*-->/;
@@ -15483,7 +15629,7 @@ function checkPins(root, readFile10, docs) {
         findings.push({ kind: "malformed-pin", doc, line: pin.line, detail: pin.text });
         continue;
       }
-      const source = readFile10((0, import_node_path12.join)(root, pin.file));
+      const source = readFile10((0, import_node_path13.join)(root, pin.file));
       if (source == null) {
         findings.push({ kind: "missing-test", doc, line: pin.line, detail: pin.file });
         continue;
@@ -15546,11 +15692,11 @@ function checkRefs(root, deps, docs) {
     for (const { ref } of extractRefs(markdown)) allFirstSegments.add(refFirstSegment(ref));
   }
   const tracked = allFirstSegments.size ? deps.trackedFirstSegments?.([...allFirstSegments]) ?? null : null;
-  const firstVerifiable = (first) => tracked ? tracked.has(first) : exists((0, import_node_path12.join)(root, first));
+  const firstVerifiable = (first) => tracked ? tracked.has(first) : exists((0, import_node_path13.join)(root, first));
   const candidates = [];
   const direct = [];
   for (const [doc, markdown] of Object.entries(docs)) {
-    const docDir = import_node_path12.posix.dirname(doc);
+    const docDir = import_node_path13.posix.dirname(doc);
     const base = docDir === "." ? "" : docDir;
     const covered = /* @__PURE__ */ new Set();
     const markers = [];
@@ -15559,21 +15705,21 @@ function checkRefs(root, deps, docs) {
         direct.push({ kind: "malformed-forward-ref", doc, line: fwd.line, detail: fwd.text });
         continue;
       }
-      const docRel = import_node_path12.posix.normalize(import_node_path12.posix.join(base, fwd.target));
-      const rootRel = import_node_path12.posix.normalize(fwd.target.replace(/^\/+/, ""));
+      const docRel = import_node_path13.posix.normalize(import_node_path13.posix.join(base, fwd.target));
+      const rootRel = import_node_path13.posix.normalize(fwd.target.replace(/^\/+/, ""));
       markers.push({ target: fwd.target, line: fwd.line, docRel, rootRel });
       covered.add(docRel);
       covered.add(rootRel);
     }
     const links = extractLinks(markdown).map(({ target, line }) => {
-      const resolved = import_node_path12.posix.normalize(import_node_path12.posix.join(base, target));
-      return { target, line, resolved, missing: !exists((0, import_node_path12.join)(root, resolved)) };
+      const resolved = import_node_path13.posix.normalize(import_node_path13.posix.join(base, target));
+      return { target, line, resolved, missing: !exists((0, import_node_path13.join)(root, resolved)) };
     });
     for (const marker of markers) {
       const coversMissing = links.some(
         (l) => l.missing && (l.resolved === marker.docRel || l.resolved === marker.rootRel)
       );
-      if (!coversMissing && (exists((0, import_node_path12.join)(root, marker.docRel)) || exists((0, import_node_path12.join)(root, marker.rootRel)))) {
+      if (!coversMissing && (exists((0, import_node_path13.join)(root, marker.docRel)) || exists((0, import_node_path13.join)(root, marker.rootRel)))) {
         direct.push({
           kind: "stale-forward-ref",
           doc,
@@ -15584,7 +15730,7 @@ function checkRefs(root, deps, docs) {
     }
     for (const { ref, line } of extractRefs(markdown)) {
       if (!firstVerifiable(refFirstSegment(ref))) continue;
-      if (!exists((0, import_node_path12.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
+      if (!exists((0, import_node_path13.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
     }
     for (const { target, line, resolved, missing } of links) {
       if (resolved.startsWith("..")) {
@@ -15632,24 +15778,24 @@ function checkCommands(docs, commandPaths) {
   return { ok: findings.length === 0, findings, warnings: [] };
 }
 function readFileOrNull(path2) {
-  return (0, import_node_fs14.existsSync)(path2) ? (0, import_node_fs14.readFileSync)(path2, "utf8") : null;
+  return (0, import_node_fs15.existsSync)(path2) ? (0, import_node_fs15.readFileSync)(path2, "utf8") : null;
 }
 function walk(dir, root, out) {
-  for (const entry of (0, import_node_fs14.readdirSync)(dir)) {
-    const full = (0, import_node_path12.join)(dir, entry);
-    if ((0, import_node_fs14.statSync)(full).isDirectory()) walk(full, root, out);
+  for (const entry of (0, import_node_fs15.readdirSync)(dir)) {
+    const full = (0, import_node_path13.join)(dir, entry);
+    if ((0, import_node_fs15.statSync)(full).isDirectory()) walk(full, root, out);
     else if (entry.endsWith(".md")) out.push(full.slice(root.length + 1).replaceAll("\\", "/"));
   }
   return out;
 }
 function defaultListDocs(root) {
   const docs = ["docs", "skills/org-guide", "skills/mmi-help"].flatMap((path2) => {
-    const directory = (0, import_node_path12.join)(root, path2);
-    return (0, import_node_fs14.existsSync)(directory) ? walk(directory, root, []) : [];
+    const directory = (0, import_node_path13.join)(root, path2);
+    return (0, import_node_fs15.existsSync)(directory) ? walk(directory, root, []) : [];
   }).filter(
     (rel) => !SKIP_WALK.some((skip) => rel.startsWith(skip))
   );
-  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs14.existsSync)((0, import_node_path12.join)(root, rel))), ...docs];
+  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs15.existsSync)((0, import_node_path13.join)(root, rel))), ...docs];
 }
 var CHECK_IGNORE_MAX_BUFFER = 32 * 1024 * 1024;
 function defaultIsIgnored(root, relPaths, exec2 = import_node_child_process6.execFileSync) {
@@ -15701,7 +15847,7 @@ function defaultTrackedFirstSegments(root, firstSegments, exec2 = import_node_ch
 }
 function runDocRefs(root, deps = {}) {
   const readFile10 = deps.readFile ?? readFileOrNull;
-  const exists = deps.exists ?? import_node_fs14.existsSync;
+  const exists = deps.exists ?? import_node_fs15.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
   const trackedFirstSegments = deps.trackedFirstSegments ?? ((segs) => defaultTrackedFirstSegments(root, segs));
@@ -15709,7 +15855,7 @@ function runDocRefs(root, deps = {}) {
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs = Object.fromEntries(
-    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path12.join)(root, rel))]).filter(([, body]) => body != null)
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path13.join)(root, rel))]).filter(([, body]) => body != null)
   );
   const refResult = checkRefs(root, { exists, isIgnored, trackedFirstSegments }, docs);
   const findings = [
@@ -15816,31 +15962,31 @@ function walkMarkdown(dir) {
   const stack = [dir];
   while (stack.length) {
     const current = stack.pop();
-    for (const entry of (0, import_node_fs15.readdirSync)(current, { withFileTypes: true })) {
-      const full = (0, import_node_path13.join)(current, entry.name);
+    for (const entry of (0, import_node_fs16.readdirSync)(current, { withFileTypes: true })) {
+      const full = (0, import_node_path14.join)(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        out.push((0, import_node_path13.relative)(dir, full).split(import_node_path13.sep).join("/"));
+        out.push((0, import_node_path14.relative)(dir, full).split(import_node_path14.sep).join("/"));
       }
     }
   }
   return out;
 }
 function createDocsIndexDeps(repoRoot2) {
-  const docsDir = (0, import_node_path13.join)(repoRoot2, "docs");
-  const indexPath = (0, import_node_path13.join)(repoRoot2, DOCS_INDEX_PATH);
+  const docsDir = (0, import_node_path14.join)(repoRoot2, "docs");
+  const indexPath = (0, import_node_path14.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
     listDocs: () => {
-      if (!(0, import_node_fs15.existsSync)(docsDir)) return [];
+      if (!(0, import_node_fs16.existsSync)(docsDir)) return [];
       const walked = walkMarkdown(docsDir).filter(isRoutableDocsPath);
       if (!walked.length) return [];
       const ignored = defaultIsIgnored(repoRoot2, walked.map((rel) => `docs/${rel}`));
       return walked.filter((rel) => !ignored.has(`docs/${rel}`)).sort();
     },
-    readDoc: (relPath) => (0, import_node_fs15.readFileSync)((0, import_node_path13.join)(docsDir, relPath), "utf8"),
-    readIndex: () => (0, import_node_fs15.existsSync)(indexPath) ? (0, import_node_fs15.readFileSync)(indexPath, "utf8") : null,
-    writeIndex: (content) => (0, import_node_fs15.writeFileSync)(indexPath, content, "utf8")
+    readDoc: (relPath) => (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(docsDir, relPath), "utf8"),
+    readIndex: () => (0, import_node_fs16.existsSync)(indexPath) ? (0, import_node_fs16.readFileSync)(indexPath, "utf8") : null,
+    writeIndex: (content) => (0, import_node_fs16.writeFileSync)(indexPath, content, "utf8")
   };
 }
@@ -16446,7 +16592,7 @@ function planSeedAction(seed, exists) {
   return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
 }
 var GATE_RENDER_NOTE = "# Rendered from the registry gate config by mmi-cli devops bootstrap apply <repo> --only gate.yml --from-config; edit the config, not this file.\n";
-var gateHash = (body) => (0, import_node_crypto7.createHash)("sha256").update(body, "utf8").digest("hex");
+var gateHash = (body) => (0, import_node_crypto8.createHash)("sha256").update(body, "utf8").digest("hex");
 function parseGateRenderStamp(content) {
   const match = /^# mmi-gate-render: sha256=([a-f0-9]{64})\n/.exec(content);
   return match ? { hash: match[1], body: content.slice(match[0].length) } : null;
@@ -16753,8 +16899,8 @@ function contentPutInputArgs(repo, path2, inputFile) {
 }
 // src/train-apply-contracts.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path15 = require("node:path");
 function reduceFollowUpOutcomes(outcomes) {
   if (outcomes.includes("failure")) return "failure";
   if (outcomes.includes("unresolved")) return "unresolved";
@@ -16834,7 +16980,7 @@ async function resolveFoldPaths(deps, model) {
   if (model === "vercel") return [];
   const helper = "scripts/release-distribution.mjs";
   if (model === "hub-serverless" || model === "registry-publish") {
-    if ((0, import_node_fs16.existsSync)(helper)) {
+    if ((0, import_node_fs17.existsSync)(helper)) {
       let out;
       try {
         out = await deps.run("node", [helper, "changed-files"]);
@@ -16973,7 +17119,7 @@ async function restoreMainNpmPackIdentities(deps, version) {
   if (mainBom.version !== version) return void 0;
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs16.readFileSync)(bomPath, "utf8"));
+    localBom = JSON.parse((0, import_node_fs17.readFileSync)(bomPath, "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: ${bomPath} written by this fold's prepare is unreadable (${describeReadError(e)}) \u2014 cannot restore the published ${version} npm-pack identities from origin/main (#4503/#4713).`
@@ -16991,14 +17137,14 @@ async function restoreMainNpmPackIdentities(deps, version) {
     restored += 1;
   }
   if (restored === 0) return void 0;
-  (0, import_node_fs16.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
+  (0, import_node_fs17.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
 `);
   return `restored ${restored} npm-pack BOM identit${restored === 1 ? "y" : "ies"} from origin/main (#4503)`;
 }
 function publishVisibilityFor(surfaceId) {
   let raw;
   try {
-    raw = (0, import_node_fs16.readFileSync)("surfaces.json", "utf8");
+    raw = (0, import_node_fs17.readFileSync)("surfaces.json", "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return "unknown";
     throw trainReadFailure(
@@ -17019,7 +17165,7 @@ function publishVisibilityFor(surfaceId) {
 }
 function npmPackArtifactName(packagePath) {
   try {
-    const pkg = JSON.parse((0, import_node_fs16.readFileSync)((0, import_node_path14.join)(packagePath, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs17.readFileSync)((0, import_node_path15.join)(packagePath, "package.json"), "utf8"));
     return pkg.name || void 0;
   } catch {
     return void 0;
@@ -17028,7 +17174,7 @@ function npmPackArtifactName(packagePath) {
 async function refuseDivergentPublishedNpmPack(deps, version) {
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs16.readFileSync)("distribution-bom.json", "utf8"));
+    localBom = JSON.parse((0, import_node_fs17.readFileSync)("distribution-bom.json", "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: distribution-bom.json written by this fold's prepare is unreadable (${e instanceof Error ? e.message.split("\n")[0] : String(e)}) \u2014 cannot compare the same-PATCH ${version} npm-pack identities against published npm (#4503/#4662).`
@@ -17173,8 +17319,8 @@ function assertGitBashOnWindowsForJervHubRelease(repo, platform2 = process.platf
 }
 // src/train-apply-correlation.ts
-var import_node_fs18 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs19 = require("node:fs");
+var import_node_path17 = require("node:path");
 // src/fleet-lockstep-enforce.ts
 init_github_client();
@@ -17939,10 +18085,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.117",
-    tag: "v4.5.117",
-    commit: "8ec1a0aa6b67",
-    npm: "@mutmutco/cli@4.5.117"
+    version: "4.5.118",
+    tag: "v4.5.118",
+    commit: "4dc2fb2beb2b",
+    npm: "@mutmutco/cli@4.5.118"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17959,14 +18105,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.117"
+          v3Target: "v4.5.118"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.117 and redeploy the Hub Lambda from tag v4.5.117 (8ec1a0aa6b67); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.117 (@mutmutco/cli@4.5.117, tag commit 8ec1a0aa6b67 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.118 and redeploy the Hub Lambda from tag v4.5.118 (4dc2fb2beb2b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.118 (@mutmutco/cli@4.5.118, tag commit 4dc2fb2beb2b \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18300,13 +18446,13 @@ function resolveIssueViewGhFields(normalized) {
 }
 // src/utf8-receipt.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path16 = require("node:path");
 function writeUtf8Receipt(path2, text) {
-  (0, import_node_fs17.mkdirSync)((0, import_node_path15.dirname)(path2), { recursive: true });
+  (0, import_node_fs18.mkdirSync)((0, import_node_path16.dirname)(path2), { recursive: true });
   const body = text.endsWith("\n") ? text : `${text}
 `;
-  (0, import_node_fs17.writeFileSync)(path2, body, "utf8");
+  (0, import_node_fs18.writeFileSync)(path2, body, "utf8");
   return Buffer.byteLength(body, "utf8");
 }
@@ -20174,7 +20320,7 @@ function resolveReleaseAbortNpmPackage(meta, repo) {
   if (isHubControlRepo(repo)) return "@mutmutco/cli";
   const publishDir = typeof meta.publishDir === "string" && meta.publishDir.trim() ? meta.publishDir.trim() : ".";
   try {
-    const pkg = JSON.parse((0, import_node_fs18.readFileSync)((0, import_node_path16.join)(publishDir, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs19.readFileSync)((0, import_node_path17.join)(publishDir, "package.json"), "utf8"));
     const name = pkg.name?.trim();
     if (!name) throw new Error("missing name field");
     return name;
@@ -21102,9 +21248,9 @@ function parseVerifyBroker(stdout) {
 }
 // src/train-apply-deploy.ts
-var import_node_fs19 = require("node:fs");
-var import_node_os10 = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_os11 = require("node:os");
+var import_node_path18 = require("node:path");
 // src/vercel-deployments.ts
 var TERMINAL = /* @__PURE__ */ new Set(["success", "failure", "error", "inactive"]);
@@ -21243,7 +21389,7 @@ function mmiGetRedeployCommand(repo) {
 }
 function readLocalLauncherVersion(root = process.cwd()) {
   try {
-    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "cli", "package.json"), "utf8");
+    const raw = (0, import_node_fs20.readFileSync)((0, import_node_path18.join)(root, "cli", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
@@ -21252,7 +21398,7 @@ function readLocalLauncherVersion(root = process.cwd()) {
 }
 function readServedChannelUrl(product = HUB_SERVED_PRODUCT, root = process.cwd()) {
   try {
-    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "config", `product.${product}.json`), "utf8");
+    const raw = (0, import_node_fs20.readFileSync)((0, import_node_path18.join)(root, "config", `product.${product}.json`), "utf8");
     const host = JSON.parse(raw).host;
     if (typeof host !== "string" || !host.trim()) return null;
     return `${host.trim().replace(/\/+$/, "")}/release/version`;
@@ -21686,13 +21832,13 @@ async function runTaggedJervGatewayLocalWrapper(deps, tag, tagSha) {
     const reason = error instanceof Error ? error.message : String(error);
     throw new Error(`could not extract ${JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT} from tagged commit ${tagSha.slice(0, 12)}: ${reason}`);
   }
-  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path17.join)((0, import_node_os10.tmpdir)(), "jerv-gateway-release-deploy-"));
-  const extracted = (0, import_node_path17.join)(dir, "jerv-gateway-release-deploy.sh");
+  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os11.tmpdir)(), "jerv-gateway-release-deploy-"));
+  const extracted = (0, import_node_path18.join)(dir, "jerv-gateway-release-deploy.sh");
   try {
-    (0, import_node_fs19.writeFileSync)(extracted, script, "utf8");
+    (0, import_node_fs20.writeFileSync)(extracted, script, "utf8");
     return await deps.run("bash", [extracted, "--tag", tag]);
   } finally {
-    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs20.rmSync)(dir, { recursive: true, force: true });
   }
 }
 async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch) {
@@ -22158,28 +22304,46 @@ async function runTenantControl(deps, options) {
   const watch = options.watch ?? tenantControlWatches(action);
   const base = { command: "tenant-control", repo, stage, action };
   const since = (deps.now ?? Date.now)();
-  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, edge: options.edge, since: options.logSince, until: options.logUntil, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
-  if (!d.ok) {
-    const transport = d.category === "transport-failed";
-    return {
-      ...base,
-      dispatched: false,
-      conclusion: "failure",
-      category: action === "retire" ? transport ? "transport-failed" : "dispatch-rejected" : void 0,
-      note: transport ? `runtime tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `runtime tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
-    };
-  }
-  const correlated = await correlateControlRun(deps, since, [stage, action, ...action === "run-task" && options.task ? [options.task] : []]);
-  if (correlated.read === "failed") {
-    return {
-      ...base,
-      dispatched: true,
-      conclusion: "failure",
-      category: action === "retire" ? "wait-timeout" : void 0,
-      note: `runtime tenant control ${action} dispatched, but its run could not be READ: ${correlated.error} \u2014 the run's outcome is unverified, not absent; check the Actions tab or retry once the read succeeds (#4713)`
-    };
+  let runId;
+  let runUrl;
+  if (options.resume != null) {
+    if (action !== "run-task") throw new Error("runtime tenant control: --resume is valid only for run-task");
+    let view;
+    try {
+      view = JSON.parse(await deps.run("gh", ["run", "view", String(options.resume), "--repo", HUB_REPO2, "--json", "workflowName,displayTitle,url"]));
+    } catch (e) {
+      throw new Error(`runtime tenant control: run ${options.resume} could not be READ: ${e.message}`);
+    }
+    const f = (view.displayTitle ?? "").split(" ");
+    if (view.workflowName !== "tenant-control" || f[0] !== "tenant-control" || f[1] !== (repo.split("/")[1] ?? "").toLowerCase() || f[2] !== stage || f[3] !== "run-task") {
+      throw new Error(`runtime tenant control: run ${options.resume} is not a tenant-control run-task run for ${repo} ${stage} (title: ${view.displayTitle ?? "unreadable"}) \u2014 refusing to resume it`);
+    }
+    runId = options.resume;
+    runUrl = view.url;
+  } else {
+    const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, edge: options.edge, since: options.logSince, until: options.logUntil, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
+    if (!d.ok) {
+      const transport = d.category === "transport-failed";
+      return {
+        ...base,
+        dispatched: false,
+        conclusion: "failure",
+        category: action === "retire" ? transport ? "transport-failed" : "dispatch-rejected" : void 0,
+        note: transport ? `runtime tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `runtime tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
+      };
+    }
+    const correlated = await correlateControlRun(deps, since, [stage, action, ...action === "run-task" && options.task ? [options.task] : []]);
+    if (correlated.read === "failed") {
+      return {
+        ...base,
+        dispatched: true,
+        conclusion: "failure",
+        category: action === "retire" ? "wait-timeout" : void 0,
+        note: `runtime tenant control ${action} dispatched, but its run could not be READ: ${correlated.error} \u2014 the run's outcome is unverified, not absent; check the Actions tab or retry once the read succeeds (#4713)`
+      };
+    }
+    ({ runId, runUrl } = correlated);
   }
-  const { runId, runUrl } = correlated;
   const conclusion = watch ? await watchTenantRun(deps, runId) : "pending";
   const result = { ...base, dispatched: true, runId, runUrl, conclusion, note: "" };
   if (action === "retire") {
@@ -22213,6 +22377,9 @@ async function runTenantControl(deps, options) {
     }
   }
   result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
+  if (conclusion === "pending" && runId != null && action === "run-task") {
+    result.note += `; run ${runId} \u2014 resume without re-dispatching: mmi-cli devops runtime tenant control ${repo} ${stage} run-task --resume ${runId} --watch`;
+  }
   return result;
 }
 function renderTenantControl(r) {
@@ -22232,9 +22399,9 @@ function renderTenantControl(r) {
 }
 // src/train-apply-phases.ts
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
-var import_node_path24 = require("node:path");
+var import_node_path25 = require("node:path");
 // src/actions-billing-preflight.ts
 var CANARY_WORKFLOW = "actions-job-start-canary.yml";
@@ -22542,14 +22709,14 @@ function assertPreOneZero(repo, meta, tag) {
 // src/train-doctor.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
-var import_node_os14 = require("node:os");
-var import_node_path23 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_os15 = require("node:os");
+var import_node_path24 = require("node:path");
 // src/doctor-io.ts
-var import_node_fs20 = require("node:fs");
-var import_node_os11 = require("node:os");
-var import_node_path18 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_os12 = require("node:os");
+var import_node_path19 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
 var import_node_util4 = require("node:util");
@@ -22562,8 +22729,8 @@ function nodeDiscardSinkPath(platform2 = process.platform) {
 var execFileP2 = (0, import_node_util4.promisify)(import_node_child_process7.execFile);
 function execFileCapture(file, args, opts = {}) {
   const sink = nodeDiscardSinkPath();
-  const inFd = (0, import_node_fs20.openSync)(sink, "r");
-  const errFd = (0, import_node_fs20.openSync)(sink, "w");
+  const inFd = (0, import_node_fs21.openSync)(sink, "r");
+  const errFd = (0, import_node_fs21.openSync)(sink, "w");
   try {
     return (0, import_node_child_process7.execFileSync)(file, args, {
       ...opts,
@@ -22571,17 +22738,17 @@ function execFileCapture(file, args, opts = {}) {
       stdio: [inFd, "pipe", errFd]
     });
   } finally {
-    (0, import_node_fs20.closeSync)(inFd);
-    (0, import_node_fs20.closeSync)(errFd);
+    (0, import_node_fs21.closeSync)(inFd);
+    (0, import_node_fs21.closeSync)(errFd);
   }
 }
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function stagedClaudePluginVersion() {
   try {
-    const stagingRoot = (0, import_node_path18.join)((0, import_node_os11.homedir)(), ".claude", "plugins", "staging");
-    const record = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path18.join)(stagingRoot, "launch-target.json"), "utf8"));
+    const stagingRoot = (0, import_node_path19.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "staging");
+    const record = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(stagingRoot, "launch-target.json"), "utf8"));
     if (typeof record.target !== "string" || typeof record.incoming !== "string") return void 0;
-    const manifest = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path18.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
+    const manifest = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path19.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
     if (typeof manifest.version !== "string") return void 0;
     return manifest.version === record.target ? record.target : void 0;
   } catch {
@@ -22591,7 +22758,7 @@ function stagedClaudePluginVersion() {
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs20.readFileSync)((0, import_node_path18.join)((0, import_node_os11.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs21.readFileSync)((0, import_node_path19.join)((0, import_node_os12.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -22603,12 +22770,12 @@ function installedClaudePluginVersion() {
 function readHermesPluginEvidence(env = process.env) {
   const host = hermesConfigRoot(env);
   const root = hermesPluginRoot(env);
-  const installRecordPresent = (0, import_node_fs20.existsSync)(root);
-  const manifestPath = (0, import_node_path18.join)(root, "plugin.yaml");
+  const installRecordPresent = (0, import_node_fs21.existsSync)(root);
+  const manifestPath = (0, import_node_path19.join)(root, "plugin.yaml");
   let installedVersion;
   let manifest = "missing";
   try {
-    const text = (0, import_node_fs20.readFileSync)(manifestPath, "utf8");
+    const text = (0, import_node_fs21.readFileSync)(manifestPath, "utf8");
     let version;
     try {
       const parsed = JSON.parse(text).version;
@@ -22622,25 +22789,25 @@ function readHermesPluginEvidence(env = process.env) {
     if (version) {
       installedVersion = version;
       manifest = "valid";
-    } else if ((0, import_node_fs20.existsSync)(manifestPath)) manifest = "invalid";
+    } else if ((0, import_node_fs21.existsSync)(manifestPath)) manifest = "invalid";
   } catch {
-    if ((0, import_node_fs20.existsSync)(manifestPath)) manifest = "invalid";
+    if ((0, import_node_fs21.existsSync)(manifestPath)) manifest = "invalid";
   }
   let skills = false;
   try {
-    skills = (0, import_node_fs20.existsSync)((0, import_node_path18.join)(root, "skills")) && (0, import_node_fs20.statSync)((0, import_node_path18.join)(root, "skills")).isDirectory();
+    skills = (0, import_node_fs21.existsSync)((0, import_node_path19.join)(root, "skills")) && (0, import_node_fs21.statSync)((0, import_node_path19.join)(root, "skills")).isDirectory();
   } catch {
   }
   let provisioned = false;
-  const provisionedRoot = (0, import_node_path18.join)(host, "skills", "mmi");
+  const provisionedRoot = (0, import_node_path19.join)(host, "skills", "mmi");
   try {
-    provisioned = (0, import_node_fs20.existsSync)(provisionedRoot) && (0, import_node_fs20.statSync)(provisionedRoot).isDirectory();
+    provisioned = (0, import_node_fs21.existsSync)(provisionedRoot) && (0, import_node_fs21.statSync)(provisionedRoot).isDirectory();
   } catch {
   }
-  const treeOk = (0, import_node_fs20.existsSync)((0, import_node_path18.join)(root, "__init__.py")) && skills && manifest === "valid";
+  const treeOk = (0, import_node_fs21.existsSync)((0, import_node_path19.join)(root, "__init__.py")) && skills && manifest === "valid";
   const receipt = treeOk && !provisioned ? `hermes-skills-unprovisioned:${provisionedRoot}` : void 0;
   return {
-    hostPresent: (0, import_node_fs20.existsSync)(host),
+    hostPresent: (0, import_node_fs21.existsSync)(host),
     installRecordPresent,
     manifest,
     payloadPresent: treeOk && provisioned,
@@ -22686,13 +22853,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path18.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path19.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs20.readFileSync)(path2, "utf8");
+    return (0, import_node_fs21.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -22701,14 +22868,14 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs20.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs21.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
   }
 }
 function lineEndingState(root) {
-  const attributesPresent = (0, import_node_fs20.existsSync)((0, import_node_path18.join)(root, ".gitattributes"));
+  const attributesPresent = (0, import_node_fs21.existsSync)((0, import_node_path19.join)(root, ".gitattributes"));
   try {
     const output = execFileCapture("git", ["-C", root, "ls-files", "--eol", "--", ":(glob)**/*.sh"], {
       windowsHide: true
@@ -22751,18 +22918,18 @@ function compatHolds(range, version) {
 }
 // src/claude-binary-doctor.ts
-var import_node_fs21 = require("node:fs");
-var import_node_os13 = require("node:os");
-var import_node_path20 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_os14 = require("node:os");
+var import_node_path21 = require("node:path");
 // src/jerv-cli-spawn.ts
-var import_node_os12 = require("node:os");
-var import_node_path19 = require("node:path");
+var import_node_os13 = require("node:os");
+var import_node_path20 = require("node:path");
 init_cli_shared();
-var JERV_CLI_ENTRY = (0, import_node_path19.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
+var JERV_CLI_ENTRY = (0, import_node_path20.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
 function pathEnvEntries(pathEnv, platform2 = process.platform) {
   if (platform2 !== "win32") {
-    return pathEnv.split(import_node_path19.delimiter).map((e) => e.trim()).filter(Boolean);
+    return pathEnv.split(import_node_path20.delimiter).map((e) => e.trim()).filter(Boolean);
   }
   if (pathEnv.includes(";")) {
     return pathEnv.split(";").map((e) => e.trim()).filter(Boolean);
@@ -22781,7 +22948,7 @@ function normalizeSpawnPathEntry(entry, platform2 = process.platform) {
   if (msys) return `${msys[1].toUpperCase()}:\\${msys[2].replace(/\//g, "\\")}`;
   return trimmed;
 }
-function jervCliCandidateDirs(env = process.env, home = (0, import_node_os12.homedir)(), platform2 = process.platform) {
+function jervCliCandidateDirs(env = process.env, home = (0, import_node_os13.homedir)(), platform2 = process.platform) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   const push = (dir) => {
@@ -22795,10 +22962,10 @@ function jervCliCandidateDirs(env = process.env, home = (0, import_node_os12.hom
     push(normalizeSpawnPathEntry(entry, platform2));
   }
   if (platform2 === "win32") {
-    if (env.APPDATA) push((0, import_node_path19.join)(env.APPDATA, "npm"));
-    if (env.LOCALAPPDATA) push((0, import_node_path19.join)(env.LOCALAPPDATA, "npm"));
+    if (env.APPDATA) push((0, import_node_path20.join)(env.APPDATA, "npm"));
+    if (env.LOCALAPPDATA) push((0, import_node_path20.join)(env.LOCALAPPDATA, "npm"));
   } else {
-    push((0, import_node_path19.join)(home, ".local", "bin"));
+    push((0, import_node_path20.join)(home, ".local", "bin"));
   }
   return out;
 }
@@ -22851,26 +23018,26 @@ function globalNodeModulesRoots(host) {
     out.push(dir);
   };
   const prefix = env.npm_config_prefix?.trim();
-  if (prefix) push(platform2 === "win32" ? (0, import_node_path20.join)(prefix, "node_modules") : (0, import_node_path20.join)(prefix, "lib", "node_modules"));
-  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os13.homedir)(), platform2)) {
-    push((0, import_node_path20.join)(dir, "node_modules"));
-    push((0, import_node_path20.join)((0, import_node_path20.dirname)(dir), "lib", "node_modules"));
+  if (prefix) push(platform2 === "win32" ? (0, import_node_path21.join)(prefix, "node_modules") : (0, import_node_path21.join)(prefix, "lib", "node_modules"));
+  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os14.homedir)(), platform2)) {
+    push((0, import_node_path21.join)(dir, "node_modules"));
+    push((0, import_node_path21.join)((0, import_node_path21.dirname)(dir), "lib", "node_modules"));
   }
   return out;
 }
 function readHead(path2) {
   let fd;
   try {
-    fd = (0, import_node_fs21.openSync)(path2, "r");
+    fd = (0, import_node_fs22.openSync)(path2, "r");
     const buffer = new Uint8Array(MAGIC_HEAD_BYTES);
-    const read = (0, import_node_fs21.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
+    const read = (0, import_node_fs22.readSync)(fd, buffer, 0, MAGIC_HEAD_BYTES, 0);
     return buffer.subarray(0, read);
   } catch {
     return void 0;
   } finally {
     if (fd !== void 0) {
       try {
-        (0, import_node_fs21.closeSync)(fd);
+        (0, import_node_fs22.closeSync)(fd);
       } catch {
       }
     }
@@ -22878,7 +23045,7 @@ function readHead(path2) {
 }
 function fileBytes(path2) {
   try {
-    return (0, import_node_fs21.statSync)(path2).size;
+    return (0, import_node_fs22.statSync)(path2).size;
   } catch {
     return void 0;
   }
@@ -22892,17 +23059,17 @@ function readClaudeBinaryState(host = {}) {
   const arch = host.arch ?? process.arch;
   const magic = EXECUTABLE_MAGIC[platform2];
   if (!magic) return void 0;
-  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path20.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs21.existsSync)((0, import_node_path20.join)(dir, "package.json")));
+  const packageRoot = globalNodeModulesRoots(host).map((root) => (0, import_node_path21.join)(root, ...PACKAGE.split("/"))).find((dir) => (0, import_node_fs22.existsSync)((0, import_node_path21.join)(dir, "package.json")));
   if (!packageRoot) return void 0;
   const keys = platformPackageKeys(platform2, arch);
   const fallbackPackage = `${PACKAGE}-${keys[0]}`;
   let manifest;
   try {
-    manifest = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path20.join)(packageRoot, "package.json"), "utf8"));
+    manifest = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path21.join)(packageRoot, "package.json"), "utf8"));
   } catch (e) {
     return {
       state: "unreadable",
-      binPath: (0, import_node_path20.join)(packageRoot, "package.json"),
+      binPath: (0, import_node_path21.join)(packageRoot, "package.json"),
       expectedMagic: magic.name,
       platformPackage: fallbackPackage,
       error: `package.json could not be read \u2014 ${e.message}`
@@ -22919,17 +23086,17 @@ function readClaudeBinaryState(host = {}) {
       error: "package.json declares no `bin` entry \u2014 the executed file cannot be resolved"
     };
   }
-  const binPath = (0, import_node_path20.join)(packageRoot, binRelative);
-  const binName = (0, import_node_path20.basename)(binRelative);
+  const binPath = (0, import_node_path21.join)(packageRoot, binRelative);
+  const binName = (0, import_node_path21.basename)(binRelative);
   const optional = manifest.optionalDependencies;
   const publishes = (name) => typeof optional === "object" && optional !== null && Object.prototype.hasOwnProperty.call(optional, name);
   const published = keys.map((key) => `${PACKAGE}-${key}`).filter(publishes);
   if (published.length === 0) return void 0;
   const binIn = (name) => [
-    (0, import_node_path20.join)(packageRoot, "node_modules", ...name.split("/"), binName),
-    (0, import_node_path20.join)((0, import_node_path20.dirname)((0, import_node_path20.dirname)(packageRoot)), ...name.split("/"), binName)
+    (0, import_node_path21.join)(packageRoot, "node_modules", ...name.split("/"), binName),
+    (0, import_node_path21.join)((0, import_node_path21.dirname)((0, import_node_path21.dirname)(packageRoot)), ...name.split("/"), binName)
   ];
-  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs21.existsSync)(file)) })).find((c) => c.path);
+  const found = published.map((name) => ({ name, path: binIn(name).find((file) => (0, import_node_fs22.existsSync)(file)) })).find((c) => c.path);
   const platformPackage = found?.name ?? published[0];
   let source;
   let sourceProblem;
@@ -22940,7 +23107,7 @@ function readClaudeBinaryState(host = {}) {
   } else {
     source = { path: found.path, bytes: fileBytes(found.path) ?? 0 };
   }
-  if (!(0, import_node_fs21.existsSync)(binPath)) {
+  if (!(0, import_node_fs22.existsSync)(binPath)) {
     return { state: "missing", binPath, expectedMagic: magic.name, platformPackage, ...source ? { source } : {}, ...sourceProblem ? { sourceProblem } : {} };
   }
   const head = readHead(binPath);
@@ -22983,9 +23150,9 @@ function healClaudeBinary(host = {}, onStep) {
   const platform2 = host.platform ?? process.platform;
   const aside = `${probe.binPath}.stub-${Date.now()}`;
   let renamed = false;
-  if ((0, import_node_fs21.existsSync)(probe.binPath)) {
+  if ((0, import_node_fs22.existsSync)(probe.binPath)) {
     try {
-      (0, import_node_fs21.renameSync)(probe.binPath, aside);
+      (0, import_node_fs22.renameSync)(probe.binPath, aside);
       renamed = true;
       onStep?.(`renamed the stub aside: ${aside}`);
     } catch (e) {
@@ -22994,12 +23161,12 @@ function healClaudeBinary(host = {}, onStep) {
   }
   try {
     onStep?.(`copying ${probe.source.path} \u2192 ${probe.binPath} (${(probe.source.bytes / 1e6).toFixed(0)} MB)`);
-    (0, import_node_fs21.copyFileSync)(probe.source.path, probe.binPath);
-    if (platform2 !== "win32") (0, import_node_fs21.chmodSync)(probe.binPath, 493);
+    (0, import_node_fs22.copyFileSync)(probe.source.path, probe.binPath);
+    if (platform2 !== "win32") (0, import_node_fs22.chmodSync)(probe.binPath, 493);
   } catch (e) {
     if (renamed) {
       try {
-        (0, import_node_fs21.renameSync)(aside, probe.binPath);
+        (0, import_node_fs22.renameSync)(aside, probe.binPath);
       } catch {
         return { ok: false, detail: `copy failed (${e.message}) and the stub could not be restored \u2014 the original is at ${aside}` };
       }
@@ -23013,7 +23180,7 @@ function healClaudeBinary(host = {}, onStep) {
   let kept = false;
   if (renamed) {
     try {
-      (0, import_node_fs21.rmSync)(aside);
+      (0, import_node_fs22.rmSync)(aside);
     } catch {
       kept = true;
     }
@@ -23372,13 +23539,13 @@ function checkLineEndings(probe) {
 }
 // src/release-ledger.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path22 = require("node:path");
-var import_node_crypto8 = require("node:crypto");
+var import_node_fs23 = require("node:fs");
+var import_node_path23 = require("node:path");
+var import_node_crypto9 = require("node:crypto");
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
-var import_node_path21 = require("node:path");
+var import_node_path22 = require("node:path");
 function pidIsDead(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   if (pid === process.pid) return false;
@@ -23496,7 +23663,7 @@ async function withFileLock(lockPath, opts, fn) {
 }
 async function withFencedFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
-  await (0, import_promises2.mkdir)((0, import_node_path21.dirname)(lockPath), { recursive: true }).catch(() => void 0);
+  await (0, import_promises2.mkdir)((0, import_node_path22.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
     return await fn(() => fileLockHeldBy(lockPath, guard.token));
@@ -23547,8 +23714,8 @@ function attachOutputNote(note, suffix) {
 }
 function writeFailingLegOutput(artifactPath, output) {
   const fileLines = lastNonEmptyLines(output, LEDGER_OUTPUT_FILE_LINES);
-  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(artifactPath), { recursive: true });
-  (0, import_node_fs22.writeFileSync)(artifactPath, `${fileLines.join("\n")}
+  (0, import_node_fs23.mkdirSync)((0, import_node_path23.dirname)(artifactPath), { recursive: true });
+  (0, import_node_fs23.writeFileSync)(artifactPath, `${fileLines.join("\n")}
 `, "utf8");
   const tail = fileLines.slice(-LEDGER_OUTPUT_NOTE_LINES).join("\n");
   const noteSuffix = truncate(`failing-leg output: ${artifactPath}
@@ -23563,7 +23730,7 @@ function stampPhaseRecord(ledgerPath, tag, phase, entry, previousRetries, now) {
     if (raw) {
       try {
         const persisted = writeFailingLegOutput(
-          (0, import_node_path22.join)((0, import_node_path22.dirname)((0, import_node_path22.dirname)(ledgerPath)), "ledger-output", `${tag}-${phase}.txt`),
+          (0, import_node_path23.join)((0, import_node_path23.dirname)((0, import_node_path23.dirname)(ledgerPath)), "ledger-output", `${tag}-${phase}.txt`),
           raw
         );
         note = attachOutputNote(note, persisted.noteSuffix);
@@ -23716,30 +23883,30 @@ function resolvePrimaryGitDir(cwd) {
   }
   let common;
   try {
-    common = (0, import_node_fs22.readFileSync)((0, import_node_path22.join)(gitDir, "commondir"), "utf8").trim();
+    common = (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(gitDir, "commondir"), "utf8").trim();
   } catch (e) {
     if (e.code !== "ENOENT") {
       throw new ReleaseLedgerError("unreadable", `release ledger: the worktree gitdir's commondir pointer could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not primary (#5987/#4713)`);
     }
   }
   if (!common) return gitDir;
-  const commonDir = (0, import_node_path22.isAbsolute)(common) ? common : (0, import_node_path22.resolve)(gitDir, common);
+  const commonDir = (0, import_node_path23.isAbsolute)(common) ? common : (0, import_node_path23.resolve)(gitDir, common);
   try {
-    (0, import_node_fs22.readFileSync)((0, import_node_path22.join)(commonDir, "HEAD"), "utf8");
+    (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(commonDir, "HEAD"), "utf8");
   } catch (e) {
     throw new ReleaseLedgerError("no-checkout", `release ledger: the worktree's commondir pointer names ${commonDir}, which has no readable HEAD (${e instanceof Error ? e.message : String(e)}) \u2014 the primary checkout may have been removed; refusing to write the ledger into a doomed location`);
   }
   return commonDir;
 }
 function releaseLedgerPath(cwd) {
-  return (0, import_node_path22.join)(resolvePrimaryGitDir(cwd), "mmi-runtime", "release", "phases.json");
+  return (0, import_node_path23.join)(resolvePrimaryGitDir(cwd), "mmi-runtime", "release", "phases.json");
 }
 function atomicWriteJson(path2, ledger) {
-  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(path2), { recursive: true });
-  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto8.randomBytes)(4).toString("hex")}`;
-  (0, import_node_fs22.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
+  (0, import_node_fs23.mkdirSync)((0, import_node_path23.dirname)(path2), { recursive: true });
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto9.randomBytes)(4).toString("hex")}`;
+  (0, import_node_fs23.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
-  (0, import_node_fs22.renameSync)(tmp, path2);
+  (0, import_node_fs23.renameSync)(tmp, path2);
 }
 var LEDGER_LOCK_OPTS = { label: "release ledger", staleMs: 18e4, deadHolderSteal: true };
 async function withLedgerLock(path2, fn, opts = {}) {
@@ -23751,16 +23918,16 @@ async function withLedgerLock(path2, fn, opts = {}) {
   }));
 }
 function checkoutRootFrom(cwd) {
-  let dir = (0, import_node_path22.resolve)(cwd);
+  let dir = (0, import_node_path23.resolve)(cwd);
   for (; ; ) {
     if (resolveGitDir(dir)) return dir;
-    const parent = (0, import_node_path22.dirname)(dir);
+    const parent = (0, import_node_path23.dirname)(dir);
     if (parent === dir) throw new ReleaseLedgerError("no-checkout", `train writer lock: no git checkout found above ${cwd}`);
     dir = parent;
   }
 }
 function trainWriterLockPath(cwd) {
-  return (0, import_node_path22.join)((0, import_node_path22.dirname)(releaseLedgerPath(checkoutRootFrom(cwd))), "train.lock");
+  return (0, import_node_path23.join)((0, import_node_path23.dirname)(releaseLedgerPath(checkoutRootFrom(cwd))), "train.lock");
 }
 var TrainWriterBusyError = class extends Error {
   lockPath;
@@ -23786,7 +23953,7 @@ function describeTrainWriterToken(token) {
 function liveTrainWriterHolder(cwd) {
   let token;
   try {
-    token = (0, import_node_fs22.readFileSync)(trainWriterLockPath(cwd), "utf8");
+    token = (0, import_node_fs23.readFileSync)(trainWriterLockPath(cwd), "utf8");
   } catch {
     return void 0;
   }
@@ -23808,7 +23975,7 @@ async function acquireTrainWriterLock(cwd, verb) {
       if (heldTrainWriter) heldTrainWriter.depth -= 1;
     };
   }
-  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(lockPath), { recursive: true });
+  (0, import_node_fs23.mkdirSync)((0, import_node_path23.dirname)(lockPath), { recursive: true });
   const opts = resolveFileLockOpts({ label: "train writer", staleMs: TRAIN_WRITER_STALE_MS, deadHolderSteal: true, maxWaitMs: 0, holder: verb });
   let guard;
   try {
@@ -23817,7 +23984,7 @@ async function acquireTrainWriterLock(cwd, verb) {
     if (!(e instanceof FileLockBusyError)) throw e;
     let token = "";
     try {
-      token = (0, import_node_fs22.readFileSync)(lockPath, "utf8");
+      token = (0, import_node_fs23.readFileSync)(lockPath, "utf8");
     } catch {
       token = "";
     }
@@ -23852,7 +24019,7 @@ async function withReleaseLedger(path2, expected, fn, opts = {}) {
     let current;
     let raw;
     try {
-      raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs23.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code !== "ENOENT") {
         throw new ReleaseLedgerError("unreadable", `release ledger at ${path2} could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not absent (#5987)`);
@@ -24521,7 +24688,7 @@ async function clearLedgerFile(path2, anchors, maxWaitMs) {
   return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
-      raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs23.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return { cleared: false };
       return { cleared: false, note: `release ledger at ${path2} could not be read for clearing (${e instanceof Error ? e.message : String(e)}) \u2014 left in place` };
@@ -24537,7 +24704,7 @@ async function clearLedgerFile(path2, anchors, maxWaitMs) {
     } catch (e) {
       return { cleared: false, note: `release ledger at ${path2} belongs to ${ledger.tag} @ ${ledger.tagSha.slice(0, 12)} \u2014 not this release; left in place (${e instanceof Error ? e.message : String(e)})` };
     }
-    await fence(() => (0, import_node_fs22.unlinkSync)(path2));
+    await fence(() => (0, import_node_fs23.unlinkSync)(path2));
     return { cleared: true, note: `cleared the release ledger at ${path2} for the live-proven aborted ${anchors.tag}` };
   }, { maxWaitMs });
 }
@@ -24697,7 +24864,7 @@ async function healStaleAlignmentLeg(deps, cwd, expected) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch {
       return void 0;
     }
@@ -24722,7 +24889,7 @@ async function healUnfoldedRunLegs(deps, cwd, model) {
   const path2 = releaseLedgerPath(cwd);
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -24791,7 +24958,7 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -24888,11 +25055,11 @@ async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref, fe
   if (!releaseAbsent) {
     throw new Error(`${label}: origin no longer has ${prior.tag} but its GitHub Release still exists \u2014 resolve the mixed external state before closing the ledger; nothing was written (${ref})`);
   }
-  const archivePath = (0, import_node_path22.join)((0, import_node_path22.dirname)(path2), `phases.archive-${prior.tag}.json`);
-  if ((0, import_node_fs22.existsSync)(archivePath)) {
+  const archivePath = (0, import_node_path23.join)((0, import_node_path23.dirname)(path2), `phases.archive-${prior.tag}.json`);
+  if ((0, import_node_fs23.existsSync)(archivePath)) {
     throw new Error(`${label}: archive already exists at ${archivePath} \u2014 preserving both ledger records; resolve the collision by hand; nothing was written (${ref})`);
   }
-  await fence(() => (0, import_node_fs22.renameSync)(path2, archivePath));
+  await fence(() => (0, import_node_fs23.renameSync)(path2, archivePath));
   return "deleted";
 }
 async function supersedeContentCausedPublishLeg(deps, cwd) {
@@ -24900,7 +25067,7 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -24982,7 +25149,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -25087,7 +25254,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
 async function reverifyPriorRunLegs(deps, path2, targetTag) {
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
   } catch {
     return;
   }
@@ -25107,7 +25274,7 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
   return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
-      raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
+      raw = (0, import_node_fs23.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return { ok: true };
       return { ok: false, error: `the release ledger at ${path2} could not be READ (${e instanceof Error ? e.message : String(e)}) \u2014 a failed read is unverified, not absent (#5987/#4713)` };
@@ -25145,15 +25312,15 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     if (liveSha.toLowerCase() !== prior.tagSha.toLowerCase()) {
       return { ok: false, error: `the completed ${prior.tag} ledger says phases-green but origin reports ${liveSha.slice(0, 12) || "no tag"} \u2260 ${prior.tagSha.slice(0, 12)} \u2014 refusing to archive on unproven state; resolve by hand (#5987)` };
     }
-    const archivePath = (0, import_node_path22.join)((0, import_node_path22.dirname)(path2), `phases.archive-${prior.tag}.json`);
+    const archivePath = (0, import_node_path23.join)((0, import_node_path23.dirname)(path2), `phases.archive-${prior.tag}.json`);
     try {
-      await fence(() => (0, import_node_fs22.unlinkSync)(archivePath));
+      await fence(() => (0, import_node_fs23.unlinkSync)(archivePath));
     } catch (e) {
       if (e.code !== "ENOENT") {
         return { ok: false, error: `could not clear the stale archive at ${archivePath} (${e instanceof Error ? e.message : String(e)}) \u2014 the ledger for ${prior.tag} stays active (#5987)` };
       }
     }
-    await fence(() => (0, import_node_fs22.renameSync)(path2, archivePath));
+    await fence(() => (0, import_node_fs23.renameSync)(path2, archivePath));
     return { ok: true, note: `archived the completed release ledger ${prior.tag} to ${archivePath} (live-proven at ${prior.tagSha.slice(0, 12)})` };
   });
 }
@@ -25181,7 +25348,7 @@ async function retryHotfixDeployLegs(deps, cwd, opts = {}) {
   return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
-      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+      prior = parseReleaseLedger((0, import_node_fs23.readFileSync)(path2, "utf8"));
     } catch (e) {
       throw new ReleaseLedgerError(
         "unreadable",
@@ -25372,10 +25539,10 @@ function readOriginWorkflowsDefault(root, ref) {
 }
 var NPM_REGISTRY = "https://registry.npmjs.org";
 async function probeRegistryWhoami(train) {
-  const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path23.join)((0, import_node_os14.tmpdir)(), "mmi-npmrc-"));
-  const rc = (0, import_node_path23.join)(dir, "npmrc");
+  const dir = (0, import_node_fs24.mkdtempSync)((0, import_node_path24.join)((0, import_node_os15.tmpdir)(), "mmi-npmrc-"));
+  const rc = (0, import_node_path24.join)(dir, "npmrc");
   try {
-    (0, import_node_fs23.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
+    (0, import_node_fs24.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
     await train.runSelf(["secrets", "use", "npm/NPM_TOKEN", "--slug", "_org", "--", "npm", "whoami", "--registry", NPM_REGISTRY, "--userconfig", rc]);
     return { kind: "ok", detail: "the registry answered a login" };
   } catch (e) {
@@ -25386,7 +25553,7 @@ async function probeRegistryWhoami(train) {
     if (/\bE401\b|401 Unauthorized/.test(stderr)) return { kind: "rejected", detail: "npm whoami answered 401 Unauthorized" };
     return { kind: "unverified", detail: first };
   } finally {
-    (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var REGISTRY_TOKEN_ENV = /\b(NODE_AUTH_TOKEN|NPM_TOKEN)\b/;
@@ -25404,7 +25571,7 @@ var defaultDeps2 = {
   ledgerPath: releaseLedgerPath,
   readLedgerRaw: (path2) => {
     try {
-      return (0, import_node_fs23.readFileSync)(path2, "utf8");
+      return (0, import_node_fs24.readFileSync)(path2, "utf8");
     } catch (e) {
       if (e.code === "ENOENT") return void 0;
       throw e;
@@ -25415,7 +25582,7 @@ var defaultDeps2 = {
   trainWriterHolder: liveTrainWriterHolder,
   readSurfacesRaw: (cwd) => {
     try {
-      return (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(cwd, "surfaces.json"), "utf8");
+      return (0, import_node_fs24.readFileSync)((0, import_node_path24.join)(cwd, "surfaces.json"), "utf8");
     } catch {
       return void 0;
     }
@@ -26005,7 +26172,7 @@ function formatTrainDoctor(v) {
 // src/release-plain-words.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_fs24 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 function releaseCutByNotes(cutBy) {
   return `## Internal
 Cut by ${formatSessionIdentity(cutBy)}
@@ -26030,7 +26197,7 @@ function validateSuiteReleaseSummary(path2) {
   if (!path2) throw new Error(`requires --announce-summary-file <path> before promoting any member \u2014 see ${SUMMARY_GUIDE}`);
   let content;
   try {
-    content = (0, import_node_fs24.readFileSync)(path2, "utf8");
+    content = (0, import_node_fs25.readFileSync)(path2, "utf8");
   } catch (e) {
     throw new Error(`could not read summary file ${path2}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
   }
@@ -26237,34 +26404,34 @@ function vercelVersionEnvDeps(deps) {
 // src/train-apply-phases.ts
 var TRAIN_BUMP_INTENTS = ["major", "minor", "patch"];
 function readLocalGateWorkflows() {
-  const dir = (0, import_node_path24.join)(".github", "workflows");
+  const dir = (0, import_node_path25.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs25.readdirSync)(dir);
+    names = (0, import_node_fs26.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter(isGateWorkflowPath)) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs26.readFileSync)((0, import_node_path25.join)(dir, name), "utf8") });
     } catch {
     }
   }
   return files;
 }
 function readLocalWorkflows() {
-  const dir = (0, import_node_path24.join)(".github", "workflows");
+  const dir = (0, import_node_path25.join)(".github", "workflows");
   let names;
   try {
-    names = (0, import_node_fs25.readdirSync)(dir);
+    names = (0, import_node_fs26.readdirSync)(dir);
   } catch {
     return null;
   }
   const files = [];
   for (const name of names.filter((n) => /\.ya?ml$/i.test(n))) {
     try {
-      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs25.readFileSync)((0, import_node_path24.join)(dir, name), "utf8") });
+      files.push({ path: `${dir}/${name}`.replace(/\\/g, "/"), body: (0, import_node_fs26.readFileSync)((0, import_node_path25.join)(dir, name), "utf8") });
     } catch {
     }
   }
@@ -27146,7 +27313,7 @@ async function activeRcandLedgerCandidate(deps, cwd) {
   }
   let prior;
   try {
-    prior = parseReleaseLedger((0, import_node_fs25.readFileSync)(path2, "utf8"));
+    prior = parseReleaseLedger((0, import_node_fs26.readFileSync)(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -30428,11 +30595,11 @@ function buildPluginCachePlan(home, running, deps, opts = {}) {
     return absent;
   }
   const versions = names.filter(isVersionDirName);
-  const prune = selectPrunablePluginVersions(versions, running, opts.installedVersion);
-  const pruneSet = new Set(prune);
+  const prune2 = selectPrunablePluginVersions(versions, running, opts.installedVersion);
+  const pruneSet = new Set(prune2);
   const keep = [...versions].sort((a, b) => compareVersions(b, a)).filter((v) => !pruneSet.has(v));
-  const bytes = opts.withBytes ? prune.reduce((sum, v) => sum + deps.dirBytes(`${cacheRoot}/${v}`), 0) : 0;
-  return { cacheRoot, present: true, keep, prune, bytes, running, ...stagingFields };
+  const bytes = opts.withBytes ? prune2.reduce((sum, v) => sum + deps.dirBytes(`${cacheRoot}/${v}`), 0) : 0;
+  return { cacheRoot, present: true, keep, prune: prune2, bytes, running, ...stagingFields };
 }
 function applyPluginCachePlan(plan, remove2, stagingGuard) {
   const removed = [];
@@ -30741,6 +30908,12 @@ function registerBoardCommands(program3) {
       if (!o.out) console.log(output);
       else console.log(`Wrote board read to ${o.out} (UTF-8, ${writeUtf8Receipt(o.out, output)} bytes)`);
     } catch (e) {
+      if (e instanceof BoardSnapshotFailure) {
+        if (o.json) console.log(JSON.stringify(e.receipt));
+        console.error(`mmi-cli board read failed: ${e.message}`);
+        process.exitCode = e.exitCode;
+        return;
+      }
       if (o.json && e && typeof e === "object" && "quota" in e && e.quota) console.log(JSON.stringify(e.quota));
       return failGraceful(`board read failed: ${withDiscoverMissDetail(e.message)}`);
     }
@@ -30781,7 +30954,7 @@ function registerBoardCommands(program3) {
     return `Claimed ${ref} for ${holder} - In Progress${reclaimed}`;
   }
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
-  board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--snapshot-only", "fail instead of falling back to your personal GraphQL pool when the Hub snapshot is unavailable \u2014 for ambient readers such as sidebars (#7203)").option("--min-cursor <n>", "board-event cursor (from `oracle board events`) the Hub snapshot must postdate; a cached snapshot older than that event is rebuilt (#7240)").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
+  board.command("read", { isDefault: true }).alias("list").description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--direct", "bypass the Hub snapshot and read the live board through direct GitHub GraphQL").option("--snapshot-only", "never fall back to your personal GraphQL pool; failure exits: 20 hub-unreachable, 21 app-quota-exhausted, 22 refused. With --json, stdout is {ok:false,outcome,reason[,resetAt,pool]} (pool is rest or graphql when known); success is unchanged").option("--min-cursor <n>", "board-event cursor (from `oracle board events`) the Hub snapshot must postdate; a cached snapshot older than that event is rebuilt (#7240)").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802)").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n").action((o) => runBoardRead(o));
   board.command("events").description("content-free board/CI change records after a cursor, from the Hub event feed (no GitHub call) \u2014 for real-time sidebars (#7235)").option("--since <cursor>", "cursor from the previous answer; omit on first read (answers the head cursor with resync:true)").option("--wait <seconds>", "hold up to this long (max 120), polling every 2s, and return on the first event or resync", "0").option("--repo <owner/repo>", "repo whose Hub config to use (defaults to git origin)").option("--json", "machine-readable output (already the default)").addHelpText("after", "\nPrints {cursor, events, resync, more[, hidden]}. Pass the returned cursor as the next --since.\nresync:true means records were missed (retention ~1h, or a gap): re-read the board with\n`mmi-cli oracle board read --snapshot-only --json`.\n").action(async (o) => {
     try {
       if (o.since !== void 0 && !/^\d{1,15}$/.test(o.since)) throw new Error("--since must be a non-negative integer cursor");
@@ -31022,9 +31195,9 @@ function registerBoardCommands(program3) {
 }
 // src/bootstrap-commands.ts
-var import_node_fs29 = require("node:fs");
-var import_node_os17 = require("node:os");
-var import_node_path28 = require("node:path");
+var import_node_fs30 = require("node:fs");
+var import_node_os18 = require("node:os");
+var import_node_path29 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -31208,8 +31381,8 @@ init_github_client();
 init_cli_shared();
 // src/port-registry.ts
-var import_node_fs26 = require("node:fs");
-var import_node_path25 = require("node:path");
+var import_node_fs27 = require("node:fs");
+var import_node_path26 = require("node:path");
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -31223,8 +31396,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs26.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs26.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs27.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs27.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -31252,22 +31425,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path25.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path25.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs26.existsSync)(registryPath) || !(0, import_node_fs26.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path26.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path26.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs27.existsSync)(registryPath) || !(0, import_node_fs27.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path25.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path25.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path26.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path26.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path25.dirname)(dir);
+    const parent = (0, import_node_path26.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path25.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path26.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -31284,7 +31457,7 @@ async function ensurePortRangeAtomic(repo, path2, allocate) {
   } catch (e) {
     const why = e.message;
     const missing = /@aws-sdk\/[\w-]+/.exec(why)?.[0];
-    throw new Error(`DDB port allocator failed for ${repo} \u2014 refusing to fall back to the frozen ${path2} (it would hand out a block the cursor already gave away). ` + (missing && /cannot find|not found|ERR_MODULE_NOT_FOUND/i.test(why) ? `Missing dependency ${missing}: run \`npm ci\` in ${(0, import_node_path25.dirname)(path2)}, then retry.` : "Check AWS credentials and that the registry table is reachable, then retry.") + ` Cause: ${why}`);
+    throw new Error(`DDB port allocator failed for ${repo} \u2014 refusing to fall back to the frozen ${path2} (it would hand out a block the cursor already gave away). ` + (missing && /cannot find|not found|ERR_MODULE_NOT_FOUND/i.test(why) ? `Missing dependency ${missing}: run \`npm ci\` in ${(0, import_node_path26.dirname)(path2)}, then retry.` : "Check AWS credentials and that the registry table is reachable, then retry.") + ` Cause: ${why}`);
   }
 }
@@ -31336,13 +31509,13 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 // src/box-commands.ts
-var import_node_fs28 = require("node:fs");
+var import_node_fs29 = require("node:fs");
 var import_node_child_process10 = require("node:child_process");
-var import_node_os16 = require("node:os");
-var import_node_path27 = require("node:path");
+var import_node_os17 = require("node:os");
+var import_node_path28 = require("node:path");
 // src/box-control.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 function parseManifest(text) {
@@ -31389,7 +31562,7 @@ function filesForBox(files, box) {
   return files.flatMap((file) => file.targets.filter((t) => t.box === box).map((t) => ({ file, dest: t.dest })));
 }
 function md5(content) {
-  return (0, import_node_crypto9.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto10.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -31468,9 +31641,9 @@ function applyRemoteScript(items, date) {
 init_clean_exit();
 // src/secrets-commands.ts
-var import_node_fs27 = require("node:fs");
-var import_node_path26 = require("node:path");
-var import_node_os15 = require("node:os");
+var import_node_fs28 = require("node:fs");
+var import_node_path27 = require("node:path");
+var import_node_os16 = require("node:os");
 init_cli_shared();
 init_hub_auth();
 init_github_client();
@@ -32626,18 +32799,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path26.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path27.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path26.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path26.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path27.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path27.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs27.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs27.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs28.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs28.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -32647,9 +32820,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs27.mkdtempSync)((0, import_node_path26.join)((0, import_node_os15.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path26.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs27.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs28.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path27.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs28.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -32661,7 +32834,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs27.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs28.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -32751,7 +32924,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs27.readFileSync)((0, import_node_path26.resolve)(o.file), "utf8");
+        body = (0, import_node_fs28.readFileSync)((0, import_node_path27.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -32887,7 +33060,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs27.unlinkSync)((0, import_node_path26.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs28.unlinkSync)((0, import_node_path27.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -33143,7 +33316,7 @@ function registerBoxCommands(program3) {
       }
       const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs28.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs29.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -33217,17 +33390,17 @@ function hubGitShow(ref) {
   return (path2) => git3(["show", `${ref}:${path2}`]);
 }
 function runOnBox(found, script) {
-  const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path27.join)((0, import_node_os16.tmpdir)(), "mmi-box-control-"));
+  const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-box-control-"));
   try {
-    const recipe = (0, import_node_path27.join)(dir, "recipe.sh");
-    (0, import_node_fs28.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    const recipe = (0, import_node_path28.join)(dir, "recipe.sh");
+    (0, import_node_fs29.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
     const r = (0, import_node_child_process10.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
     return r.stdout;
   } finally {
-    (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function formatControl(mode, box, rows) {
@@ -33355,7 +33528,7 @@ function renderDeployPortDoctor(report) {
 }
 // src/bootstrap-drift.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -33375,7 +33548,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto10.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -33538,7 +33711,7 @@ function renderPropagationReport(plan) {
 }
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -33551,7 +33724,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto11.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto12.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -34763,7 +34936,7 @@ function renderBootstrapVerifyReport(report) {
 }
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -34796,7 +34969,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto13.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
   const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
   return { ...scoped, baseSha, baseBranch };
@@ -34862,12 +35035,12 @@ async function verifyTargetedSeedPr(repo, number, plan, target, expected, client
 // src/bootstrap-commands.ts
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 async function gateRenderDiff(current, rendered) {
-  const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-gate-diff-"));
-  const before = (0, import_node_path28.join)(dir, "committed-gate.yml");
-  const after = (0, import_node_path28.join)(dir, "registry-render.yml");
+  const dir = (0, import_node_fs30.mkdtempSync)((0, import_node_path29.join)((0, import_node_os18.tmpdir)(), "mmi-gate-diff-"));
+  const before = (0, import_node_path29.join)(dir, "committed-gate.yml");
+  const after = (0, import_node_path29.join)(dir, "registry-render.yml");
   try {
-    (0, import_node_fs29.writeFileSync)(before, current);
-    (0, import_node_fs29.writeFileSync)(after, rendered);
+    (0, import_node_fs30.writeFileSync)(before, current);
+    (0, import_node_fs30.writeFileSync)(after, rendered);
     try {
       return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
     } catch (e) {
@@ -34876,7 +35049,7 @@ async function gateRenderDiff(current, rendered) {
       throw e;
     }
   } finally {
-    (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs30.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function bootstrapTrainDoctorDeps() {
@@ -34936,13 +35109,13 @@ function registerBootstrapCommands(program3) {
       })),
       pushAllowlistOwners: verifyOwners,
       pushAllowlistOwnersRead: verifyOwnersRead,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs29.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs29.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs30.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs30.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -35020,14 +35193,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs29.existsSync)(s.target) ? (0, import_node_fs29.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs30.existsSync)(s.target) ? (0, import_node_fs30.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -35235,24 +35408,24 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs29.existsSync)(p) ? (0, import_node_fs29.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs30.existsSync)(p) ? (0, import_node_fs30.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path29.join)((0, import_node_os18.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs30.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs29.unlinkSync)(tmp);
+          (0, import_node_fs30.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -35888,10 +36061,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -35900,9 +36073,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs29.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs29.readFileSync)(seed.target, "utf8");
-    const readSeedFile2 = (path2) => (0, import_node_fs29.existsSync)(path2) ? (0, import_node_fs29.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs30.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs30.readFileSync)(seed.target, "utf8");
+    const readSeedFile2 = (path2) => (0, import_node_fs30.existsSync)(path2) ? (0, import_node_fs30.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -35911,9 +36084,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos.length;
-    if ((0, import_node_fs29.existsSync)("projects.json")) {
+    if ((0, import_node_fs30.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs29.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs30.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -36083,15 +36256,15 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path29.join)((0, import_node_os18.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
+        (0, import_node_fs30.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
         try {
           await gh2(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs29.unlinkSync)(tmp);
+            (0, import_node_fs30.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -36160,10 +36333,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs29.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs30.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs29.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs30.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -36180,10 +36353,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs29.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs30.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs29.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs30.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -36260,13 +36433,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs29.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path29.join)((0, import_node_os18.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs30.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs29.unlinkSync)(tmp);
+          (0, import_node_fs30.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -36442,7 +36615,7 @@ init_github_client();
 init_cli_shared();
 // src/suite-status.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -36470,7 +36643,7 @@ function parseSuiteMapping(body) {
     return void 0;
   }
 }
-var sha256 = (b) => (0, import_node_crypto13.createHash)("sha256").update(b).digest("hex");
+var sha256 = (b) => (0, import_node_crypto14.createHash)("sha256").update(b).digest("hex");
 async function proveBundle(url, tag, fetchUrl) {
   const get = async (u) => {
     try {
@@ -36723,9 +36896,9 @@ async function waitSuiteDev(deps, opts) {
 }
 // src/suite-train.ts
-var import_node_fs30 = require("node:fs");
-var import_node_path29 = require("node:path");
-var import_node_crypto14 = require("node:crypto");
+var import_node_fs31 = require("node:fs");
+var import_node_path30 = require("node:path");
+var import_node_crypto15 = require("node:crypto");
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -36810,7 +36983,7 @@ function suiteReleaseTag(rc) {
 function readSuiteCut(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs30.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -36826,11 +36999,11 @@ function readSuiteCut(path2) {
   return record;
 }
 function writeSuiteCut(path2, record) {
-  (0, import_node_fs30.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto14.randomBytes)(8).toString("hex")}.tmp`;
+  (0, import_node_fs31.mkdirSync)((0, import_node_path30.dirname)(path2), { recursive: true });
+  const temp = `${path2}.${(0, import_node_crypto15.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    (0, import_node_fs30.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
-    (0, import_node_fs30.renameSync)(temp, path2);
+    (0, import_node_fs31.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
+    (0, import_node_fs31.renameSync)(temp, path2);
   } catch (e) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
@@ -36879,25 +37052,25 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
 async function retireFailedLeadRcLedger(deps, ownerGo) {
-  if (!(0, import_node_fs30.existsSync)(deps.ledgerPath)) return void 0;
+  if (!(0, import_node_fs31.existsSync)(deps.ledgerPath)) return void 0;
   return withLedgerLock(deps.ledgerPath, async (fence) => {
-    const ledger = parseReleaseLedger((0, import_node_fs30.readFileSync)(deps.ledgerPath, "utf8"));
+    const ledger = parseReleaseLedger((0, import_node_fs31.readFileSync)(deps.ledgerPath, "utf8"));
     const states = Object.values(ledger.phases).map((p) => p.state);
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
-    const archive = (0, import_node_path29.join)((0, import_node_path29.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
-    if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    const archive = (0, import_node_path30.join)((0, import_node_path30.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
+    if ((0, import_node_fs31.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
-    await fence(() => (0, import_node_fs30.renameSync)(deps.ledgerPath, archive));
+    await fence(() => (0, import_node_fs31.renameSync)(deps.ledgerPath, archive));
     return `${ledger.tag} (ledger archived to ${archive})`;
   });
 }
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
-  if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
-  (0, import_node_fs30.renameSync)(recordPath, archive);
+  if ((0, import_node_fs31.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
+  (0, import_node_fs31.renameSync)(recordPath, archive);
   return { archive, orphanTags: record.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
 async function suiteRestoreMainPins(deps) {
@@ -36963,12 +37136,12 @@ async function suiteRcand(deps, opts) {
   }
   if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
-    if ((0, import_node_fs30.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
-    (0, import_node_fs30.renameSync)(deps.recordPath, archive);
+    if ((0, import_node_fs31.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
+    (0, import_node_fs31.renameSync)(deps.recordPath, archive);
     record = void 0;
   }
   if (record && !record.pinPr && !record.leadRcTag && record.members.every((m) => !m.tag)) {
-    (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs31.rmSync)(deps.recordPath, { force: true });
     record = void 0;
   }
   if (!record) {
@@ -37022,7 +37195,7 @@ async function suiteRcand(deps, opts) {
     quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m)) && await deps.contains(SUITE_REPO, record.leadDevelopment, record.leadPreviousRc)) {
-    (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs31.rmSync)(deps.recordPath, { force: true });
     throw new Error("nothing to promote: neither MM-Work nor any module has new development commits since its rc; no suite cut started");
   }
   for (const member of quiet) {
@@ -37040,7 +37213,7 @@ async function suiteRcand(deps, opts) {
   }
   if (refusals.length) {
     const untouched = record.members.every((m) => !m.tag) && !record.pinPr;
-    if (untouched) (0, import_node_fs30.rmSync)(deps.recordPath, { force: true });
+    if (untouched) (0, import_node_fs31.rmSync)(deps.recordPath, { force: true });
     throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
@@ -37197,11 +37370,11 @@ Each member's live release must serve <data>/main/module.js at its main pin path
   }
   return record;
 }
-var hotfixRecordPath = (deps) => (0, import_node_path29.join)((0, import_node_path29.dirname)(deps.recordPath), "hotfix.json");
+var hotfixRecordPath = (deps) => (0, import_node_path30.join)((0, import_node_path30.dirname)(deps.recordPath), "hotfix.json");
 function readSuiteHotfix(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs30.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -37244,7 +37417,7 @@ async function suiteHotfix(deps, opts) {
   if (completed) record = void 0;
   if (record && record.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record.repo} is recorded; finish it (rerun with that member) first`);
   if (!record?.tag) await deps.validateHotfixSummary();
-  if (completed) (0, import_node_fs30.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
+  if (completed) (0, import_node_fs31.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
   const rec = record ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
   const save = () => writeSuiteHotfix(path2, rec);
   save();
@@ -37511,8 +37684,8 @@ async function runRcDataSwitch(deps, opts) {
 }
 // src/suite-train-io.ts
-var import_node_fs44 = require("node:fs");
-var import_node_path43 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path44 = require("node:path");
 init_cli_shared();
 // src/command-register-train-operations.ts
@@ -37867,8 +38040,8 @@ async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return { failures: [], skipped: [] };
   const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
   const { tmpdir: tmpdir12 } = await import("node:os");
-  const { join: join47 } = await import("node:path");
-  const dir = await mkdtemp2(join47(tmpdir12(), "mmi-hotfix-preflight-"));
+  const { join: join48 } = await import("node:path");
+  const dir = await mkdtemp2(join48(tmpdir12(), "mmi-hotfix-preflight-"));
   const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
   const skipped = [];
@@ -39189,9 +39362,9 @@ function checkHotfixCarries(options) {
 }
 // src/merge-cleanup.ts
-var import_node_fs32 = require("node:fs");
-var import_node_path31 = require("node:path");
-var import_node_os18 = require("node:os");
+var import_node_fs33 = require("node:fs");
+var import_node_path32 = require("node:path");
+var import_node_os19 = require("node:os");
 init_cli_shared();
 init_github_client();
@@ -39505,8 +39678,8 @@ async function runPrLand(prNumber, options, deps) {
 // src/test-policy-core.ts
 var import_node_child_process13 = require("node:child_process");
-var import_node_fs31 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs32 = require("node:fs");
+var import_node_path31 = require("node:path");
 // src/test-command-policy-shared.mjs
 var import_node_child_process12 = require("node:child_process");
@@ -39982,7 +40155,7 @@ function isMeaningfulRow(file) {
   return file.meaningful !== false;
 }
 function loadPolicy(root, readFile10 = readFileOrNull2) {
-  const raw = readFile10((0, import_node_path30.join)(root, POLICY_FILE));
+  const raw = readFile10((0, import_node_path31.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   return parsePolicy(raw, POLICY_FILE);
 }
@@ -40059,7 +40232,7 @@ function loadPolicySource(root, explicitRef, diffBase) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs31.readFileSync)(path2, "utf8");
+    return (0, import_node_fs32.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -40087,12 +40260,12 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path30.join)(root, p)));
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path31.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs31.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path30.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path31.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, meaningfulTestChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -40231,14 +40404,14 @@ function runTestPolicy(root, deps = {}) {
   }
   const loaded = deps.policy ? { policy: deps.policy, source: { ref: null, sha: null, path: POLICY_FILE } } : loadPolicySource(root, deps.policyRef, deps.base);
   const { policy, source: policySource } = loaded;
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs31.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs32.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : deps.policyRef ? resolveHotfixBase(root) : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const raw = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const changed = deps.changed ? raw : annotateChangeMeaning(raw, policy, (path2) => ({
     before: blobAt(base, path2, root),
-    after: readFileOrNull2((0, import_node_path30.join)(root, path2))
+    after: readFileOrNull2((0, import_node_path31.join)(root, path2))
   }));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride2(base, root) : { override: null, refusals: [] };
   const policyRefusals = policy.declared === false ? [{
@@ -40248,8 +40421,8 @@ function runTestPolicy(root, deps = {}) {
   A gate with no policy cannot decide which test commands are required or permitted.
 ` + (deps.base === HOTFIX_DIFF_BASE ? `  Hotfix lane (--base ${HOTFIX_DIFF_BASE}): pass --policy-ref <exact-${HOTFIX_POLICY_REF}-commit> so the current policy is read from ${HOTFIX_POLICY_REF}.` : `  Restore ${POLICY_FILE} on this branch; the policy file belongs on every non-hotfix lane.`)
   }] : [];
-  const present = (path2) => exists((0, import_node_path30.join)(root, path2));
-  const policyTree = policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path30.join)(root, p))) : null;
+  const present = (path2) => exists((0, import_node_path31.join)(root, path2));
+  const policyTree = policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path31.join)(root, p))) : null;
   const policyTreeExists = policyTree ? (abs) => policyTree.has(abs) : exists;
   const where = policySource.sha ? `${policySource.ref}@${policySource.sha}` : "this worktree";
   const removedByThisDiff = removedPaths(changed);
@@ -40529,13 +40702,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs32.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
-  const path2 = (0, import_node_path31.join)(dir, "body.txt");
-  (0, import_node_fs32.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  const dir = (0, import_node_fs33.mkdtempSync)((0, import_node_path32.join)((0, import_node_os19.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path32.join)(dir, "body.txt");
+  (0, import_node_fs33.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs32.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs33.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -40742,8 +40915,8 @@ async function deleteMergedRemoteBranch(options) {
 }
 // src/project-info-sync.ts
-var import_node_fs33 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_fs34 = require("node:fs");
+var import_node_path33 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -40790,14 +40963,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path32.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs33.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path33.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs34.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs33.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs34.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines2 = [
     `# ${projectName}`,
     "",
@@ -40816,8 +40989,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs33.existsSync)((0, import_node_path32.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs33.existsSync)((0, import_node_path32.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs34.existsSync)((0, import_node_path33.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs34.existsSync)((0, import_node_path33.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -40839,8 +41012,8 @@ async function syncProjectInfo(plan, client, apply) {
 }
 // src/train-commands.ts
-var import_node_fs34 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_path34 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -40855,7 +41028,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs34.readFileSync)((0, import_node_path33.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs35.readFileSync)((0, import_node_path34.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -40966,7 +41139,7 @@ function releaseProgressVerdict(status, subject = "Release") {
 // src/suite-pin.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path34 = require("node:path");
+var import_node_path35 = require("node:path");
 var SuitePinError = class _SuitePinError extends Error {
   diagnostic;
   constructor(repo, tag, error) {
@@ -41034,8 +41207,8 @@ async function openSuiteCutPinPr(deps, input) {
       if (input.carriedOnly) return { status: "unchanged" };
       throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
     }
-    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path35.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path35.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", prs.length ? branch : "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     if (prs.length) {
@@ -41047,7 +41220,7 @@ async function openSuiteCutPinPr(deps, input) {
       await run("git", ["switch", "-c", branch]);
     }
     for (const stage of ["rc", "main"]) {
-      const path2 = (0, import_node_path34.join)(scratch, `${stage}-pins.json`);
+      const path2 = (0, import_node_path35.join)(scratch, `${stage}-pins.json`);
       await (0, import_promises6.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
@@ -41100,12 +41273,12 @@ async function openSuiteRestorePinPr(deps, input) {
       }
     });
     if (!todo.length) return void 0;
-    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path35.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path35.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
-    const path2 = (0, import_node_path34.join)(scratch, "main-pins.json");
+    const path2 = (0, import_node_path35.join)(scratch, "main-pins.json");
     await (0, import_promises6.writeFile)(path2, JSON.stringify(todo.map((p) => ({ module: p.module, url: p.prior }))));
     await run("node", ["scripts/pin-modules.mjs", "--stage", "main", "--pins", path2]);
     await run("git", ["add", "seed/modules.json"]);
@@ -41179,8 +41352,8 @@ async function openSuitePinPr(deps, input) {
     if (newer.length) return { status: "superseded", pr: newer[0].url, url: pin };
     const open2 = onBranch.find((p) => p.state === "OPEN");
     if (open2 && tagOf(open2.title ?? "") === tag) return { status: "pending", pr: open2.url, url: pin };
-    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path35.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path35.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
@@ -41220,7 +41393,7 @@ async function openSuitePinPr(deps, input) {
 // src/command-register-collaboration.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -41244,11 +41417,11 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 // src/command-register-collaboration.ts
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 init_house_map();
 // src/issue-body.ts
-var import_node_os19 = require("node:os");
+var import_node_os20 = require("node:os");
 init_error_codes();
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
@@ -41261,7 +41434,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os19.platform)() === "win32") {
+  if ((0, import_node_os20.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -41354,8 +41527,8 @@ init_github_client();
 init_github_quota();
 // src/issue-commands.ts
-var import_node_fs35 = require("node:fs");
-var import_node_crypto15 = require("node:crypto");
+var import_node_fs36 = require("node:fs");
+var import_node_crypto16 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -41547,7 +41720,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs35.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs36.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -41828,7 +42001,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto15.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto16.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -42210,7 +42383,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs35.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs36.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) {
           const top = specs === null ? "null" : typeof specs === "object" ? `an object with keys: ${Object.keys(specs).join(", ") || "(none)"}` : `a ${typeof specs}`;
@@ -42287,8 +42460,8 @@ ${lines2}`, {
 }
 // src/post-merge-recon.ts
-var import_node_fs36 = require("node:fs");
-var import_node_path35 = require("node:path");
+var import_node_fs37 = require("node:fs");
+var import_node_path36 = require("node:path");
 // src/cross-repo-filing-issue.ts
 init_github_client();
@@ -42457,16 +42630,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs36.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
-  (0, import_node_fs36.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs37.mkdirSync)((0, import_node_path36.dirname)(path2), { recursive: true });
+  (0, import_node_fs37.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs36.existsSync)(path2)) return;
+  if (!(0, import_node_fs37.existsSync)(path2)) return;
   try {
-    (0, import_node_fs36.unlinkSync)(path2);
+    (0, import_node_fs37.unlinkSync)(path2);
   } catch {
   }
 }
@@ -42942,9 +43115,9 @@ function registerPrLifecycleCommands(program3) {
 // src/review-verdict.ts
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs37 = require("node:fs");
-var import_node_os20 = require("node:os");
-var import_node_path36 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_os21 = require("node:os");
+var import_node_path37 = require("node:path");
 init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
 var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
@@ -43109,15 +43282,15 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path36.join)((0, import_node_os20.tmpdir)(), "mmi-review-verdict-"));
-  const path2 = (0, import_node_path36.join)(dir, "body.md");
+  const dir = (0, import_node_fs38.mkdtempSync)((0, import_node_path37.join)((0, import_node_os21.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path37.join)(dir, "body.md");
   try {
-    (0, import_node_fs37.writeFileSync)(path2, body, "utf8");
+    (0, import_node_fs38.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
     return stdout.trim();
   } finally {
     try {
-      (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -43351,18 +43524,18 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
 }
 // src/worktree-residue-sweep.ts
-var import_node_fs42 = require("node:fs");
-var import_node_path41 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_path42 = require("node:path");
 // src/worktree-merge-cleanup.ts
-var import_node_fs41 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path41 = require("node:path");
 init_cli_shared();
 // src/stage-runner.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs39 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_fs40 = require("node:fs");
+var import_node_path39 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
@@ -43372,8 +43545,8 @@ function normalizeEol2(s) {
 }
 // src/env-detection.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path38 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
   return name.toLowerCase() === ".env";
@@ -43383,7 +43556,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs38.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs39.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -43391,13 +43564,13 @@ function findEnvFiles(root) {
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
-        walk2((0, import_node_path37.join)(dir, entry.name), relPath);
+        walk2((0, import_node_path38.join)(dir, entry.name), relPath);
         continue;
       }
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs38.lstatSync)((0, import_node_path37.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs39.lstatSync)((0, import_node_path38.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -43536,12 +43709,12 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path38.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs39.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path39.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs40.existsSync)(configured)) return configured;
   const candidates = [
-    (0, import_node_path38.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
-    ...process.env.LOCALAPPDATA ? [(0, import_node_path38.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
+    (0, import_node_path39.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
+    ...process.env.LOCALAPPDATA ? [(0, import_node_path39.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
-  const bash = candidates.find((path2) => (0, import_node_fs39.existsSync)(path2));
+  const bash = candidates.find((path2) => (0, import_node_fs40.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
   return bash;
 }
@@ -43679,7 +43852,7 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path38.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path39.join)(cwd, "tmp", "stage", "state.json");
 }
 function normPath(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -43896,8 +44069,8 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
-  const envFile = (0, import_node_path38.join)(cwd, ".env");
-  return (0, import_node_fs39.existsSync)(envFile) && envFileKeys((0, import_node_fs39.readFileSync)(envFile, "utf8")).has("PORT");
+  const envFile = (0, import_node_path39.join)(cwd, ".env");
+  return (0, import_node_fs40.existsSync)(envFile) && envFileKeys((0, import_node_fs40.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
   const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
@@ -43912,13 +44085,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs39.existsSync)((0, import_node_path38.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs40.existsSync)((0, import_node_path39.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs39.existsSync)((0, import_node_path38.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs40.existsSync)((0, import_node_path39.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -43934,21 +44107,21 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   }
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson), runtimeEnvSelects(configJson));
   if (!body) return {};
-  const overridePath = (0, import_node_path38.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs39.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
-  (0, import_node_fs39.writeFileSync)(overridePath, body, "utf8");
+  const overridePath = (0, import_node_path39.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
+  (0, import_node_fs40.mkdirSync)((0, import_node_path39.join)(cwd, "tmp", "stage"), { recursive: true });
+  (0, import_node_fs40.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path38.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path38.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs39.existsSync)(target) && (0, import_node_fs39.existsSync)(example)) {
-    (0, import_node_fs39.copyFileSync)(example, target);
-  } else if ((0, import_node_fs39.existsSync)(target) && (0, import_node_fs39.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs39.readFileSync)(example, "utf8"), (0, import_node_fs39.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs39.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs39.statSync)(target).mtimeMs
+  const target = (0, import_node_path39.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path39.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs40.existsSync)(target) && (0, import_node_fs40.existsSync)(example)) {
+    (0, import_node_fs40.copyFileSync)(example, target);
+  } else if ((0, import_node_fs40.existsSync)(target) && (0, import_node_fs40.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs40.readFileSync)(example, "utf8"), (0, import_node_fs40.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs40.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs40.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running /stage`;
@@ -43956,8 +44129,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs39.existsSync)(target)) {
-    (0, import_node_fs39.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs39.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs40.existsSync)(target)) {
+    (0, import_node_fs40.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs40.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -43987,20 +44160,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs39.existsSync)(path2)) return null;
+  if (!(0, import_node_fs40.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs39.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs40.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs39.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs40.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs39.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs40.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -44029,7 +44202,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
     );
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs39.rmSync)(path2, { force: true });
+    (0, import_node_fs40.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -44276,8 +44449,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs39.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs39.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs40.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs40.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -44292,8 +44465,8 @@ async function runStage(config = {}, opts = {}) {
 }
 // src/worktree-evidence-archive.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path40 = require("node:path");
 var JERV_ARTIFACT_RUN_SCOPE_ENV_VARS = ["JERV_RUN_ID", ...SESSION_ID_ENV_VARS];
 function sanitizeArchiveSegment(value, max = 80) {
   const scrubbed = value.replace(/[^A-Za-z0-9._@+-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -44308,24 +44481,24 @@ function resolveArtifactRunScope(env = process.env) {
 }
 function defaultIsDirectory(path2) {
   try {
-    return (0, import_node_fs40.lstatSync)(path2).isDirectory();
+    return (0, import_node_fs41.lstatSync)(path2).isDirectory();
   } catch {
     return false;
   }
 }
 function archiveWorktreeJervArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
+  const exists = deps.exists ?? import_node_fs41.existsSync;
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs41.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs41.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const resolveRoot = deps.resolveArchiveRoot ?? repoRuntimeStatePath;
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
-  const source = (0, import_node_path39.join)(args.worktreePath, ".jerv");
+  const source = (0, import_node_path40.join)(args.worktreePath, ".jerv");
   if (!exists(source)) return { status: "absent" };
   if (!isDirectory(source)) return { status: "skipped", reason: "jerv-not-a-directory" };
   const runScope = resolveArtifactRunScope(env);
@@ -44333,7 +44506,7 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "jerv-artifacts", runScope, branchSlug, stamp, ".jerv");
   try {
-    mkdirp((0, import_node_path39.dirname)(dest));
+    mkdirp((0, import_node_path40.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     return { status: "archived", path: dest, runScope };
@@ -44342,14 +44515,14 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   }
 }
 function defaultStat(path2) {
-  const st = (0, import_node_fs40.statSync)(path2);
+  const st = (0, import_node_fs41.statSync)(path2);
   return { mtimeMs: st.mtimeMs, size: st.size, isDirectory: () => st.isDirectory() };
 }
 function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
+  const exists = deps.exists ?? import_node_fs41.existsSync;
   const stat4 = deps.stat ?? defaultStat;
-  const readdir2 = deps.readdir ?? import_node_fs40.readdirSync;
-  const tmpRoot = (0, import_node_path39.join)(worktreePath, "tmp");
+  const readdir2 = deps.readdir ?? import_node_fs41.readdirSync;
+  const tmpRoot = (0, import_node_path40.join)(worktreePath, "tmp");
   if (!exists(tmpRoot)) return [];
   const entries = [];
   const walk2 = (dir) => {
@@ -44360,14 +44533,14 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
       return;
     }
     for (const name of names) {
-      const full = (0, import_node_path39.join)(dir, name);
+      const full = (0, import_node_path40.join)(dir, name);
       let st;
       try {
         st = stat4(full);
       } catch {
         continue;
       }
-      const relPath = (0, import_node_path39.relative)(worktreePath, full).replace(/\\/g, "/");
+      const relPath = (0, import_node_path40.relative)(worktreePath, full).replace(/\\/g, "/");
       if (st.isDirectory()) {
         if (st.mtimeMs > newerThanMs) entries.push({ relPath, bytes: 0, mtimeMs: st.mtimeMs });
         walk2(full);
@@ -44381,10 +44554,10 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
   return entries;
 }
 function archiveWorktreeTmpArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs40.existsSync;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }));
+  const exists = deps.exists ?? import_node_fs41.existsSync;
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs41.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs41.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -44392,7 +44565,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
   const scanned = scanWorktreeTmpEvidence(args.worktreePath, args.newerThanMs, deps);
-  const source = (0, import_node_path39.join)(args.worktreePath, "tmp");
+  const source = (0, import_node_path40.join)(args.worktreePath, "tmp");
   if (!scanned.length) return { status: "absent" };
   if (!exists(source)) return { status: "absent" };
   const runScope = resolveArtifactRunScope(env);
@@ -44400,7 +44573,7 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "worktree-artifacts", runScope, branchSlug, stamp, "tmp");
   try {
-    mkdirp((0, import_node_path39.dirname)(dest));
+    mkdirp((0, import_node_path40.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     const bytes = scanned.reduce((sum, e) => sum + e.bytes, 0);
@@ -44469,9 +44642,9 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path40.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path41.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs41.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs41.rmdirSync)(nm);
+    if ((0, import_node_fs42.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs42.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -44482,8 +44655,8 @@ function defaultSleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs41.rmdirSync, exists = import_node_fs41.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs41.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs42.rmdirSync, exists = import_node_fs42.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs42.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -44606,28 +44779,28 @@ async function preCleanWorktreeForRemoval(wtPath, execGit) {
 }
 async function listNestedIgnoredNodeModules(wtPath, execGit) {
   const out = await execGit(["-C", wtPath, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory"]).catch(() => "");
-  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path40.join)(wtPath, line.slice(0, -1)));
+  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path41.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs41.lstatSync)(path2);
+  const stat4 = (0, import_node_fs42.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs41.rmdirSync)(path2);
+      (0, import_node_fs42.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs41.unlinkSync)(path2);
+      (0, import_node_fs42.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs41.readdirSync)(path2)) safeRemoveTree((0, import_node_path40.join)(path2, entry));
-    (0, import_node_fs41.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs42.readdirSync)(path2)) safeRemoveTree((0, import_node_path41.join)(path2, entry));
+    (0, import_node_fs42.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs41.unlinkSync)(path2);
+  (0, import_node_fs42.unlinkSync)(path2);
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
-    safeRemoveTree((0, import_node_path40.join)(wtPath, "node_modules"));
+    safeRemoveTree((0, import_node_path41.join)(wtPath, "node_modules"));
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -44639,7 +44812,7 @@ function errorMessage(e) {
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs41.realpathSync)(path2));
+    return normPath2((0, import_node_fs42.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -44647,10 +44820,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs41.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs42.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs41.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs42.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -44666,17 +44839,17 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs41.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs42.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
-      const child2 = (0, import_node_path40.join)(dir, entry.name);
+      const child2 = (0, import_node_path41.join)(dir, entry.name);
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs41.realpathSync)(child2));
+          target = normPath2((0, import_node_fs42.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -44859,7 +45032,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs41.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs42.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -44999,7 +45172,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
   if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
   unlinkedReparsePoints.push(...preHelperGuard.unlinked);
-  if (pathExists((0, import_node_path40.join)(wtPath, "node_modules"))) {
+  if (pathExists((0, import_node_path41.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? removeWorktreeNodeModules)(wtPath);
     if (!nmRemoved.ok) {
       report.worktree = {
@@ -45135,18 +45308,18 @@ function renderPrMergeCleanupLines(cleanup) {
 // src/worktree-residue-sweep.ts
 var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
 function canonicalWorktreeRoot(primary) {
-  return (0, import_node_path41.join)((0, import_node_path41.dirname)(primary), "mmi-worktrees", (0, import_node_path41.basename)(primary));
+  return (0, import_node_path42.join)((0, import_node_path42.dirname)(primary), "mmi-worktrees", (0, import_node_path42.basename)(primary));
 }
 function norm(p) {
   const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? s.toLowerCase() : s;
 }
 function residueLedgerPath(gitCommonDir) {
-  return (0, import_node_path41.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
+  return (0, import_node_path42.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
 }
 function readPaths(file, deps) {
   try {
-    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs42.readFileSync)(f, "utf8")))(file));
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs43.readFileSync)(f, "utf8")))(file));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -45155,8 +45328,8 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs42.mkdirSync)((0, import_node_path41.dirname)(f), { recursive: true });
-      (0, import_node_fs42.writeFileSync)(f, t, "utf8");
+      (0, import_node_fs43.mkdirSync)((0, import_node_path42.dirname)(f), { recursive: true });
+      (0, import_node_fs43.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
 `);
@@ -45170,17 +45343,17 @@ function recordResidue(gitCommonDir, path2, deps = {}) {
   writePaths(file, paths, deps);
 }
 async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
-  const exists = deps.exists ?? import_node_fs42.existsSync;
-  const readDir = deps.readDir ?? ((p) => (0, import_node_fs42.readdirSync)(p));
+  const exists = deps.exists ?? import_node_fs43.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs43.readdirSync)(p));
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return (0, import_node_fs42.statSync)(p).isDirectory();
+      return (0, import_node_fs43.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   });
   const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
-  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs42.rmdirSync)(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs43.rmdirSync)(p));
   const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
   const live = new Set(registered.map(norm));
   const primary = registered[0] ? norm(registered[0]) : void 0;
@@ -45215,7 +45388,7 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     } catch {
     }
     for (const name of children) {
-      const child2 = (0, import_node_path41.join)(root, name);
+      const child2 = (0, import_node_path42.join)(root, name);
       const key = norm(child2);
       if (live.has(key) || key === primary || keptKeys.has(key) || !isDir(child2)) continue;
       let entries;
@@ -45258,10 +45431,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path42.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path43.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs43.existsSync)((0, import_node_path42.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs44.existsSync)((0, import_node_path43.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs44.existsSync)((0, import_node_path43.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -45273,8 +45446,8 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path42.join)(root, path2);
-      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path43.join)(root, path2);
+      return (0, import_node_fs44.existsSync)(fullPath) ? (0, import_node_fs44.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -46037,11 +46210,11 @@ ${list}`);
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path42.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
-    return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    const wfDir = (0, import_node_path43.join)(cwd, ".github", "workflows");
+    if (!(0, import_node_fs44.existsSync)(wfDir)) return [];
+    return (0, import_node_fs44.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path42.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs44.readFileSync)((0, import_node_path43.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -46246,7 +46419,7 @@ ${list}`);
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs43.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs44.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -46523,7 +46696,7 @@ ${list}`);
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs44.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -46555,7 +46728,7 @@ ${list}`);
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path42.join)((0, import_node_path42.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path43.join)((0, import_node_path43.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -46653,7 +46826,7 @@ ${list}`);
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs44.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -46767,7 +46940,7 @@ ${list}`);
     let residueSweep;
     if (!(foreignCwd && !foreignCheckout)) {
       try {
-        gitCommonDir = (0, import_node_path42.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
+        gitCommonDir = (0, import_node_path43.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
         residueSweep = await sweepWorktreeResidue(gitCommonDir, beforeWorktrees.map((w) => w.path));
       } catch {
       }
@@ -46785,7 +46958,7 @@ ${list}`);
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs43.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs44.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -48017,18 +48190,18 @@ function rcRunCauseFromLog(log) {
 function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
-var suiteStateDir = (root) => (0, import_node_path43.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+var suiteStateDir = (root) => (0, import_node_path44.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
 function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
-  const recordPath = (0, import_node_path43.join)(suiteStateDir(root), "cut.json");
-  const base = (0, import_node_path43.join)(suiteStateDir(root), "checkouts");
+  const recordPath = (0, import_node_path44.join)(suiteStateDir(root), "cut.json");
+  const base = (0, import_node_path44.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path43.join)(base, repo.split("/")[1]);
-    if (!(0, import_node_fs44.existsSync)(target)) {
-      (0, import_node_fs44.mkdirSync)(base, { recursive: true });
+    const target = (0, import_node_path44.join)(base, repo.split("/")[1]);
+    if (!(0, import_node_fs45.existsSync)(target)) {
+      (0, import_node_fs45.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs44.existsSync)((0, import_node_path43.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs45.existsSync)((0, import_node_path44.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -48351,9 +48524,9 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
-      (0, import_node_fs44.mkdirSync)(dir, { recursive: true });
-      const file = (0, import_node_path43.join)(dir, `notes-${leadTag}.md`);
-      (0, import_node_fs44.writeFileSync)(file, `${body}
+      (0, import_node_fs45.mkdirSync)(dir, { recursive: true });
+      const file = (0, import_node_path44.join)(dir, `notes-${leadTag}.md`);
+      (0, import_node_fs45.writeFileSync)(file, `${body}
 ${suiteMappingBlock(leadTag, mapping)}`);
       await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
@@ -48394,7 +48567,7 @@ ${suiteMappingBlock(leadTag, mapping)}`);
 // src/suite-commands.ts
 init_cli_shared();
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 function parseMemberSummaryFiles(entries) {
   const memberSummaryFiles = {};
   for (const entry of entries) {
@@ -48476,7 +48649,7 @@ function registerSuiteCommands(program3) {
       try {
         const io = suiteTrainIo(root);
         retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
-        if (retired && !(0, import_node_fs45.existsSync)(io.recordPath)) {
+        if (retired && !(0, import_node_fs46.existsSync)(io.recordPath)) {
           console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
           return;
         }
@@ -48665,9 +48838,9 @@ function suiteStatusDeps(github, registry2) {
 // src/packages-adopt-export.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_fs46 = require("node:fs");
-var import_node_os21 = require("node:os");
-var import_node_path44 = require("node:path");
+var import_node_fs47 = require("node:fs");
+var import_node_os22 = require("node:os");
+var import_node_path45 = require("node:path");
 var import_node_util6 = require("node:util");
 init_cli_shared();
@@ -49287,38 +49460,38 @@ function expectedFromRun(run, opts) {
 }
 async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
-  const packagePath = (0, import_node_path44.join)(opts.dir, "package.json");
-  const lockPath = (0, import_node_path44.join)(opts.dir, "package-lock.json");
-  const packageText = (0, import_node_fs46.readFileSync)(packagePath, "utf8");
-  const lockText = (0, import_node_fs46.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs46.mkdtempSync)((0, import_node_path44.join)((0, import_node_os21.tmpdir)(), "mmi-adopt-export-"));
+  const packagePath = (0, import_node_path45.join)(opts.dir, "package.json");
+  const lockPath = (0, import_node_path45.join)(opts.dir, "package-lock.json");
+  const packageText = (0, import_node_fs47.readFileSync)(packagePath, "utf8");
+  const lockText = (0, import_node_fs47.readFileSync)(lockPath, "utf8");
+  const work = (0, import_node_fs47.mkdtempSync)((0, import_node_path45.join)((0, import_node_os22.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs46.writeFileSync)((0, import_node_path44.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
-    const script = (0, import_node_path44.join)(work, "package_export.py");
-    (0, import_node_fs46.writeFileSync)(script, package_export_default);
+    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    const script = (0, import_node_path45.join)(work, "package_export.py");
+    (0, import_node_fs47.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
-    const verified = (0, import_node_path44.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path44.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const verified = (0, import_node_path45.join)(work, "verified");
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs47.readFileSync)((0, import_node_path45.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
-      await deps.npm(["cache", "add", (0, import_node_path44.join)(verified, `${short3}.tgz`)], opts.dir);
+      await deps.npm(["cache", "add", (0, import_node_path45.join)(verified, `${short3}.tgz`)], opts.dir);
     }
-    (0, import_node_fs46.writeFileSync)(packagePath, plan.packageText);
-    (0, import_node_fs46.writeFileSync)(lockPath, plan.lockText);
+    (0, import_node_fs47.writeFileSync)(packagePath, plan.packageText);
+    (0, import_node_fs47.writeFileSync)(lockPath, plan.lockText);
     try {
       await deps.npm(["ci", "--offline", "--ignore-scripts", "--no-audit", "--no-fund"], opts.dir);
     } catch (error) {
-      (0, import_node_fs46.writeFileSync)(packagePath, packageText);
-      (0, import_node_fs46.writeFileSync)(lockPath, lockText);
+      (0, import_node_fs47.writeFileSync)(packagePath, packageText);
+      (0, import_node_fs47.writeFileSync)(lockPath, lockText);
       throw new Error(`npm ci --offline failed, package.json and package-lock.json restored: ${error.message}`);
     }
     return plan.result;
   } finally {
-    (0, import_node_fs46.rmSync)(work, { recursive: true, force: true });
+    (0, import_node_fs47.rmSync)(work, { recursive: true, force: true });
   }
 }
 var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process18.execFile);
@@ -49383,12 +49556,12 @@ function registerPackagesCommands(program3) {
 init_cli_shared();
 // src/wave-status.ts
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 function readStageSummary(worktreePath) {
   const statePath = stageStatePath(worktreePath);
-  if (!(0, import_node_fs47.existsSync)(statePath)) return void 0;
+  if (!(0, import_node_fs48.existsSync)(statePath)) return void 0;
   try {
-    const state = JSON.parse((0, import_node_fs47.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs48.readFileSync)(statePath, "utf8"));
     const port = typeof state.port === "number" ? state.port : void 0;
     if (port == null || !Number.isInteger(port) || port <= 0) return void 0;
     return { port, url: typeof state.url === "string" ? state.url : void 0 };
@@ -49445,9 +49618,9 @@ async function collectWaveStatus(deps) {
 // src/discovery-commands.ts
 init_github_client();
 init_cli_shared();
-var import_node_fs48 = require("node:fs");
-var import_node_os22 = require("node:os");
-var import_node_path45 = require("node:path");
+var import_node_fs49 = require("node:fs");
+var import_node_os23 = require("node:os");
+var import_node_path46 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -49636,10 +49809,10 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os22.homedir)();
+  const home = (0, import_node_os23.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path45.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs48.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path45.join)(home, ".claude", "settings.json"), import_node_fs48.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path46.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs49.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path46.join)(home, ".claude", "settings.json"), import_node_fs49.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -51831,6 +52004,9 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
   });
 }
+// src/api-read.ts
+var import_node_fs50 = require("node:fs");
 // src/app-read-broker.ts
 init_cli_shared();
 var OWNER_REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -52200,7 +52376,10 @@ var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
 var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
 var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
 var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/jobs$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs";
+var ACTIONS_ARTIFACTS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/artifacts$`);
+var ACTIONS_ARTIFACT_ZIP_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/artifacts/\\d+/zip$`);
+var ACTIONS_JOB_LOGS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/jobs/\\d+/logs$`);
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>)";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
@@ -52210,6 +52389,9 @@ function parseApiGetPath(rawPath) {
   if (ACTIONS_RUNS_RE.test(path2)) return { kind: "actions-runs", path: path2, paginate: true };
   if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
   if (ACTIONS_JOBS_RE.test(path2)) return { kind: "actions-jobs", path: path2, paginate: true };
+  if (ACTIONS_ARTIFACTS_RE.test(path2)) return { kind: "actions-artifacts", path: path2, paginate: true };
+  if (ACTIONS_ARTIFACT_ZIP_RE.test(path2)) return { kind: "actions-artifact-zip", path: path2, paginate: false };
+  if (ACTIONS_JOB_LOGS_RE.test(path2)) return { kind: "actions-job-logs", path: path2, paginate: false };
   const q = path2.indexOf("?");
   const base = q === -1 ? path2 : path2.slice(0, q);
   const query = q === -1 ? "" : path2.slice(q + 1);
@@ -52218,6 +52400,8 @@ function parseApiGetPath(rawPath) {
   }
   throw new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
 }
+var ZIP_TIMEOUT_MS = 12e4;
+var ZIP_MAX_BUFFER = 512 * 1024 * 1024;
 function buildApiGetArgs(path2, accept) {
   const req = parseApiGetPath(path2);
   const args = ["api", req.path];
@@ -52230,22 +52414,28 @@ async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
 function registerApiReadCommands(program3, overrides) {
-  const spawn6 = overrides?.runner ?? (async (args, timeoutMs, env) => (await execFileP("gh", args, { timeout: timeoutMs, ...env ? { env } : {} })).stdout);
-  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs)");
+  const spawn6 = overrides?.runner ?? (async (args, timeoutMs, env, binary) => (await execFileP("gh", args, { timeout: timeoutMs, ...binary ? { encoding: "latin1", maxBuffer: ZIP_MAX_BUFFER } : {}, ...env ? { env } : {} })).stdout);
+  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts)");
   api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
     acceptHeaderFor(v);
     return v.trim().toLowerCase();
-  }, "json").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
+  }, "json").option("--out <file>", "write the response bytes to this file instead of stdout (required for, and only valid with, actions/artifacts/{id}/zip)").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
+    const zip = req.kind === "actions-artifact-zip" || req.kind === "actions-job-logs";
+    if (zip !== (o.out !== void 0)) return fail(`api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs`);
     const actionsRoute = req.kind.startsWith("actions-");
     if (actionsRoute) requireBrokerApp("api get");
     const env = actionsRoute || process.env.MMI_ACTOR === "app" ? brokerChildEnv() : void 0;
     let body;
     try {
       body = await runApiGet(
-        async (args, timeoutMs) => spawn6(args, timeoutMs, env),
+        async (args, timeoutMs) => zip ? spawn6(args, ZIP_TIMEOUT_MS, env, true) : spawn6(args, timeoutMs, env),
         req.path,
         o.accept
       );
+      if (zip) {
+        (0, import_node_fs50.writeFileSync)(o.out, body, "latin1");
+        return;
+      }
     } catch (e) {
       const err = e;
       return fail(`api get: ${(err.stderr || err.message || String(e)).trim()}`);
@@ -53102,8 +53292,8 @@ function registerSessionReport(program3) {
 }
 // src/stage-commands.ts
-var import_node_fs49 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_fs51 = require("node:fs");
+var import_node_path47 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -53351,8 +53541,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs49.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs51.existsSync)((0, import_node_path47.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs51.existsSync)((0, import_node_path47.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -53644,23 +53834,23 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 // src/tenant-artifact.ts
-var import_node_crypto16 = require("node:crypto");
-var import_node_fs50 = require("node:fs");
+var import_node_crypto17 = require("node:crypto");
+var import_node_fs52 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var MAX_BYTES = 5 * 1024 * 1024 * 1024;
+var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto16.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs50.createReadStream)(path2)) hash.update(chunk);
+  const hash = (0, import_node_crypto17.createHash)("sha256");
+  for await (const chunk of (0, import_node_fs52.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path47.resolve)(inputPath);
+  const path2 = (0, import_node_path48.resolve)(inputPath);
   const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
-  if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
+  if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES2) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES2} bytes`);
   const sha2563 = await sha256File(path2);
   const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256: sha2563 }, deps);
   if (!prepared.ok) {
@@ -53675,7 +53865,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs50.createReadStream)(path2);
+  const stream = (0, import_node_fs52.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -53814,7 +54004,7 @@ function renderVerifySecrets(body) {
 }
 // src/command-register-developer.ts
-var import_node_fs54 = require("node:fs");
+var import_node_fs56 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -53847,7 +54037,7 @@ async function resolveWhoami(deps) {
 }
 // src/command-register-developer.ts
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 init_house_map();
 init_hub_url();
@@ -53881,28 +54071,28 @@ async function executeWaveLand(plan, deps) {
 // src/dist-drift.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_crypto18 = require("node:crypto");
-var import_node_fs52 = require("node:fs");
-var import_node_os23 = require("node:os");
-var import_node_path49 = require("node:path");
+var import_node_crypto19 = require("node:crypto");
+var import_node_fs54 = require("node:fs");
+var import_node_os24 = require("node:os");
+var import_node_path50 = require("node:path");
 // ../scripts/distribution-digest.mjs
-var import_node_crypto17 = require("node:crypto");
-var import_node_fs51 = require("node:fs");
-var import_node_path48 = require("node:path");
+var import_node_crypto18 = require("node:crypto");
+var import_node_fs53 = require("node:fs");
+var import_node_path49 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path48.resolve)(root);
-  const target = (0, import_node_path48.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path48.sep}`)) {
+  const absoluteRoot = (0, import_node_path49.resolve)(root);
+  const target = (0, import_node_path49.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path49.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto17.createHash)("sha256");
+  const hash = (0, import_node_crypto18.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs51.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs51.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs53.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs53.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -53917,8 +54107,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs51.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs51.lstatSync)(absolute) };
+    if (!(0, import_node_fs53.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs53.lstatSync)(absolute) };
   }));
 }
@@ -53930,7 +54120,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha2562 = (bytes) => `sha256:${(0, import_node_crypto18.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2562 = (bytes) => `sha256:${(0, import_node_crypto19.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha2562(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha2562(rebuiltBytes) : ABSENT;
@@ -54002,13 +54192,13 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs52.existsSync)(path2) ? (0, import_node_fs52.readFileSync)(path2) : null;
+  return (0, import_node_fs54.existsSync)(path2) ? (0, import_node_fs54.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs52.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path49.join)(directory, entry.name);
+    for (const entry of (0, import_node_fs54.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path50.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -54018,10 +54208,10 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs52.readFileSync)((0, import_node_path49.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path49.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs54.readFileSync)((0, import_node_path50.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path50.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path49.join)(root, "distribution-bom.json");
+    return (0, import_node_path50.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
@@ -54034,35 +54224,35 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs52.mkdtempSync)((0, import_node_path49.join)((0, import_node_os23.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs54.mkdtempSync)((0, import_node_path50.join)((0, import_node_os24.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path49.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path49.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path49.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path49.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path50.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path50.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path50.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path50.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path49.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path50.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path49.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path49.join)(root, path2));
-    const distRoot = (0, import_node_path49.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path49.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs52.readFileSync)(bomPathFor(root), "utf8"));
+    const committed = (path2) => readOrNull((0, import_node_path50.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path50.join)(root, path2));
+    const distRoot = (0, import_node_path50.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path50.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs54.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path49.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path50.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path49.join)(overlay, entry.path);
-        (0, import_node_fs52.mkdirSync)((0, import_node_path49.dirname)(target), { recursive: true });
-        (0, import_node_fs52.writeFileSync)(target, entry.bytes);
+        const target = (0, import_node_path50.join)(overlay, entry.path);
+        (0, import_node_fs54.mkdirSync)((0, import_node_path50.dirname)(target), { recursive: true });
+        (0, import_node_fs54.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs52.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs54.rmSync)(stage, { recursive: true, force: true });
   }
 }
@@ -54163,7 +54353,7 @@ init_hub_auth();
 // src/schedules-lift-command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -54192,7 +54382,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path50.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path51.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -54275,8 +54465,8 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 // src/spawn-policy-core.ts
 var import_node_child_process20 = require("node:child_process");
-var import_node_fs53 = require("node:fs");
-var import_node_path51 = require("node:path");
+var import_node_fs55 = require("node:fs");
+var import_node_path52 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -54362,7 +54552,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs53.readFileSync)((0, import_node_path51.join)(root, file), "utf8");
+      raw = (0, import_node_fs55.readFileSync)((0, import_node_path52.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -54382,19 +54572,19 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path52.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs54.existsSync)(path2) ? (0, import_node_fs54.readFileSync)(path2, "utf8") : null;
+    const path2 = (0, import_node_path53.join)(process.cwd(), ".gitignore");
+    const current = (0, import_node_fs56.existsSync)(path2) ? (0, import_node_fs56.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs54.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs56.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs54.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs56.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -54657,12 +54847,12 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path53.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path54.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os24.homedir)()),
+      envHealLockPath((0, import_node_os25.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -54759,7 +54949,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os24.homedir)(),
+        (0, import_node_os25.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -54787,14 +54977,14 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os24.homedir)(),
+        (0, import_node_os25.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs55.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs57.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -54829,7 +55019,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path54.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -54838,7 +55028,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs55.existsSync)((0, import_node_path53.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path54.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -55187,10 +55377,13 @@ program2.addHelpText(
 var appActorCommand = "poll";
 function appActorDeps() {
   return {
-    fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, {
-      repo: APP_VAULT_REPO,
-      attribution: { command: appActorCommand, via: formatSessionIdentity(describeSessionIdentity()) }
-    }),
+    fetchSecret: async (key) => {
+      const deps = makeSecretsDeps(await loadConfig());
+      return readAppVaultSecret(() => fetchSecretValue(deps, key, {
+        repo: APP_VAULT_REPO,
+        attribution: { command: appActorCommand, via: formatSessionIdentity(describeSessionIdentity()) }
+      }, true));
+    },
     fetch: (url, init) => fetch(url, init)
   };
 }
@@ -55218,8 +55411,9 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--resume <run-id>", "run-task only: re-attach to an already-dispatched run (read-only, never re-dispatches) and print its receipt").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
+    if (o.resume !== void 0 && (action !== "run-task" || !/^\d+$/.test(o.resume) || o.task || o.artifact)) return fail("runtime tenant control: --resume <run-id> is run-task-only, takes a numeric run id, and cannot be combined with --task/--artifact");
     if (o.confirmDataLoss !== void 0 && (action !== "retire" || stage === "rc")) return fail("runtime tenant control: --confirm-data-loss is dev/main retire-only");
     if (action === "retire" && (stage === "dev" || stage === "main")) {
       if (o.confirmDataLoss !== void 0 && o.confirmDataLoss !== `${repo}/${stage}`) return fail(`runtime tenant control: --confirm-data-loss must match ${repo}/${stage} exactly`);
@@ -55244,11 +55438,11 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
       if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?Z$/.test(value)) return fail(`runtime tenant control: ${flag} must be a UTC time like 2026-10-07T13:10Z`);
     }
     if (action === "run-task") {
-      if (!o.task) return fail("runtime tenant control: run-task requires --task <declared-name>");
+      if (!o.task && o.resume === void 0) return fail("runtime tenant control: run-task requires --task <declared-name>");
     } else if (o.task || o.artifact) {
       return fail("runtime tenant control: --task/--artifact are valid only for run-task");
     }
-    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, edge: o.edge, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss });
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, edge: o.edge, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss, resume: o.resume === void 0 ? void 0 : Number(o.resume) });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines: lines3, failure } = renderVerifySecrets(body);
@@ -55552,7 +55746,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs55.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs57.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -55821,9 +56015,11 @@ projectTenantTasks.command("declare <name>").description("register a NEW tenant
   if (!res.ok) process.exitCode = 1;
 });
 var registry = program2.command("registry").description("the DDB org registry \u2014 org-level constants");
-registry.command("org").description("the org config (account id, region, orgProjectId, sagaApiUrl)").option("--json", "machine-readable output").action(async (_o) => {
+registry.command("org").description("the org config (account id, region, orgProjectId, sagaApiUrl)").option("--json", "machine-readable output").option("--github-spend-minutes <minutes>", "master-only App spend by route, caller and pool over the last 1\u201360 minutes").action(async (_o) => {
+  const minutes = _o.githubSpendMinutes === void 0 ? void 0 : Number(_o.githubSpendMinutes);
+  if (minutes !== void 0 && (!Number.isInteger(minutes) || minutes < 1 || minutes > 60)) return fail("github-spend-minutes must be an integer from 1 to 60");
   const cfg = await loadConfig();
-  const org = await fetchOrgConfig(registryClientDeps(cfg));
+  const org = await fetchOrgConfig(registryClientDeps(cfg), minutes);
   if (!org) return failGraceful("org config get: Hub API unreachable, unseeded, or this repo is not bootstrapped");
   console.log(JSON.stringify(org));
 });
@@ -55940,16 +56136,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path53.join)(root, path2);
-      return (0, import_node_fs55.existsSync)(fullPath) ? (0, import_node_fs55.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path54.join)(root, path2);
+      return (0, import_node_fs57.existsSync)(fullPath) ? (0, import_node_fs57.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path53.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path54.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs55.existsSync)((0, import_node_path53.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs55.existsSync)((0, import_node_path53.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs57.existsSync)((0, import_node_path54.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs57.existsSync)((0, import_node_path54.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -56079,10 +56275,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs55.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs55.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs57.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs57.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs55.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs55.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs57.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs57.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -56113,16 +56309,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs55.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs57.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path53.join)(path2, entry.name);
+    const child2 = (0, import_node_path54.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs55.statSync)(child2).size;
+        total += (0, import_node_fs57.statSync)(child2).size;
       } catch {
       }
     }
@@ -56130,25 +56326,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs55.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs57.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs55.existsSync)(p)) return [];
+  if (!(0, import_node_fs57.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs55.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs57.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs55.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs55.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs57.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs57.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs55.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs57.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path53.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs55.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path54.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs57.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -56162,10 +56358,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path53.join)(stagingRoot, name);
-      if (!(0, import_node_fs55.existsSync)(p)) return null;
+      const p = (0, import_node_path54.join)(stagingRoot, name);
+      if (!(0, import_node_fs57.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs55.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs57.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -56185,13 +56381,13 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os24.homedir)(),
+    (0, import_node_os25.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs55.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs57.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));