@mutmutco/codex-plugin 4.5.86 → 4.5.87

package/cli/dist/main.cjs

@@ -7447,25 +7447,6 @@ function workflowEntry(repo, workflowPath, yamlText) {
     harbourUnmanaged: isHarbourUnmanaged(yamlText)
   };
 }
-function decorateAwsModel(entries, registry2, verdicts) {
-  if (!registry2 || registry2.length === 0) return [...entries];
-  const rowById = new Map(registry2.map((r) => [r.id, r]));
-  const literalById = /* @__PURE__ */ new Map();
-  for (const v of verdicts ?? []) {
-    if (typeof v.modelId === "string" && v.modelId.trim() && !literalById.has(v.id)) {
-      literalById.set(v.id, v.modelId);
-    }
-  }
-  return entries.map((e) => {
-    if (!e.scheduleId) return e;
-    const row = rowById.get(e.scheduleId);
-    if (!row || row.executor !== "cursor-agent") return e;
-    const literal = literalById.get(e.scheduleId);
-    if (literal) return { ...e, model: literal };
-    if (row.model) return { ...e, model: `role: ${row.model}` };
-    return { ...e, model: "org-default" };
-  });
-}
 var DECLARED_ENTRIES = [
   { name: "mmi-backup (mm-central, mm-work, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh; every Docker volume is tarred and every running Postgres container is pg_dumpall'd beside it (#7147; source scripts/nightly-backup.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
   // #7148: a backup nobody restored is a hope. Monthly, restore the latest artifact of every
@@ -7511,12 +7492,10 @@ function formatSchedulesTable(entries, now = /* @__PURE__ */ new Date()) {
   const cadW = w((e) => e.cadence, "CADENCE");
   const exeW = w((e) => e.executor, "EXECUTOR");
   const llmW = w((e) => e.llm, "LLM");
-  const modelOf = (e) => e.model ?? "-";
-  const modW = w((e) => modelOf(e), "MODEL");
   const resW = w((e) => resolvedOf.get(e) ?? e.resolved, "RESOLVED");
-  const row = (n, c, x, l, m, r, s) => `${n.padEnd(nameW)}  ${c.padEnd(cadW)}  ${x.padEnd(exeW)}  ${l.padEnd(llmW)}  ${m.padEnd(modW)}  ${r.padEnd(resW)}  ${s}`;
-  const lines2 = [row("JOB", "CADENCE", "EXECUTOR", "LLM", "MODEL", "RESOLVED", "SOURCE")];
-  for (const e of entries) lines2.push(row(e.name, e.cadence, e.executor, e.llm, modelOf(e), resolvedOf.get(e) ?? e.resolved, e.source));
+  const row = (n, c, x, l, r, s) => `${n.padEnd(nameW)}  ${c.padEnd(cadW)}  ${x.padEnd(exeW)}  ${l.padEnd(llmW)}  ${r.padEnd(resW)}  ${s}`;
+  const lines2 = [row("JOB", "CADENCE", "EXECUTOR", "LLM", "RESOLVED", "SOURCE")];
+  for (const e of entries) lines2.push(row(e.name, e.cadence, e.executor, e.llm, resolvedOf.get(e) ?? e.resolved, e.source));
   return lines2.join("\n");
 }
 function withTickState(entry, now = /* @__PURE__ */ new Date()) {
@@ -7524,11 +7503,11 @@ function withTickState(entry, now = /* @__PURE__ */ new Date()) {
 }
 function renderDocSection(entries, generatedAtIso) {
   const lines2 = [
-    "| Job | Cadence | Executor | LLM | Model | Resolved | Source |",
-    "|---|---|---|---|---|---|---|"
+    "| Job | Cadence | Executor | LLM | Resolved | Source |",
+    "|---|---|---|---|---|---|"
   ];
   for (const e of entries) {
-    lines2.push(`| ${e.name} | \`${e.cadence}\` | ${e.executor} | ${e.llm} | ${e.model ?? "-"} | ${e.resolved} | ${e.source} |`);
+    lines2.push(`| ${e.name} | \`${e.cadence}\` | ${e.executor} | ${e.llm} | ${e.resolved} | ${e.source} |`);
   }
   return [
     DOC_START_MARKER,
@@ -7546,10 +7525,6 @@ function spliceDoc(docText, generatedSection) {
   }
   return docText.slice(0, start) + generatedSection + docText.slice(end + DOC_END_MARKER.length);
 }
-var HARBOUR_LLM_LAUNCHERS = /* @__PURE__ */ new Set(["cursor-agent"]);
-function isHarbourLlmLauncher(executor) {
-  return HARBOUR_LLM_LAUNCHERS.has(executor);
-}
 function splitCadence(cadence) {
   return cadence.split("+").map((c) => c.replace(/\s+/g, " ").trim()).filter(Boolean);
 }
@@ -7657,6 +7632,10 @@ function isHarbourUnmanaged(yamlText) {
 function strayCronDrifts(workflows) {
   return workflows.filter((w) => !isHarbourUnmanaged(w.yamlText)).filter((w) => workflowTriggersSchedule(w.yamlText)).map((w) => strayCronDrift(w.name)).sort((a, b) => a.name.localeCompare(b.name));
 }
+var HARBOUR_LLM_LAUNCHERS = /* @__PURE__ */ new Set(["codex-agent"]);
+function isHarbourLlmLauncher(executor) {
+  return HARBOUR_LLM_LAUNCHERS.has(executor);
+}
 function unlauncheredLlmDrift(entry) {
   if (entry.llm !== "yes") return null;
   if (isHarbourLlmLauncher(entry.executor)) return null;
@@ -7667,7 +7646,7 @@ function unlauncheredLlmDrift(entry) {
     name: entry.name,
     executor: entry.executor,
     detail: `llm: yes with executor outside the harbour launcher set (${allowed})`,
-    remedy: `move the lane to executor: ${allowed} and run it through the Hub harbour key (docs/schedules.md rule 4)`
+    remedy: `move the lane to executor: ${allowed} and run it through the Hub harbour (docs/schedules.md rule 3)`
   };
 }
 function unlauncheredLlmDrifts(entries) {
@@ -7739,8 +7718,8 @@ var SCHEDULE_HEADER_FIELDS = ["schedule", "what", "owner", "cadence", "executor"
 var SCHEDULE_EXECUTORS = /* @__PURE__ */ new Set([
   "github-actions",
   // deterministic workflow — clocked by the harbour, fired via workflow_dispatch
-  "cursor-agent",
-  // LLM lane — the harbour's ONLY launcher (docs/schedules.md rule 5)
+  "codex-agent",
+  // LLM lane — the harbour's ONLY scheduled-LLM launcher (docs/schedules.md rule 3, #7780)
   "lambda",
   // fleet function row — requires the `# target: mmi-fleet-*` header (#3205/#3246)
   "box systemd",
@@ -7821,8 +7800,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   if (llmFromHeader(yamlText) === "unknown") {
     throw new Error(`schedules register: ${expectedId} header \`llm: ${h.llm}\` does not classify (yes / no / embeddings) \u2014 an unreadable declaration would register a row whose LLM column lies.`);
   }
-  if (llmFromHeader(yamlText) === "yes" && h.executor !== "cursor-agent") {
-    throw new Error(`schedules register: ${expectedId} header \`llm: yes\` requires the harbour launcher \`executor: cursor-agent\` (declared: \`${h.executor}\`) \u2014 scheduled LLM work runs only through a harbour key (docs/schedules.md rule 5); change the executor or the llm value.`);
+  if (llmFromHeader(yamlText) === "yes" && h.executor !== "codex-agent") {
+    throw new Error(`schedules register: ${expectedId} header \`llm: yes\` requires the harbour launcher \`executor: codex-agent\` (declared: \`${h.executor}\`) \u2014 scheduled LLM work runs only through the Codex executor (docs/schedules.md rule 3, #7780); change the executor or the llm value.`);
   }
   const target = header.target;
   if (target !== void 0 && h.executor !== "lambda") {
@@ -7831,9 +7810,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   if (target !== void 0 && !/^mmi-fleet-[A-Za-z0-9_-]{1,130}$/.test(target)) {
     throw new Error(`schedules register: ${expectedId} header \`target: ${target}\` must be a bare lambda function name in the reserved fleet namespace \`mmi-fleet-*\` (allowed after the prefix: A-Z a-z 0-9 _ -; total max 140). The dispatcher can only invoke mmi-fleet-* functions.`);
   }
-  const model = header.model;
-  if (model !== void 0 && !/^[a-z][a-z0-9-]{0,30}$/.test(model)) {
-    throw new Error(`schedules register: ${expectedId} header \`model: ${model}\` must be a model ROLE KEY (lowercase kebab, max 31 chars \u2014 e.g. janitor, arbiter), never a model id \u2014 ids resolve from the vault at dispatch.`);
+  if (header.model !== void 0) {
+    throw new Error(`schedules register: ${expectedId} header \`model: ${header.model}\` is refused \u2014 the Codex executor pins its model (#7780), so no row declares one. Remove the line.`);
   }
   return {
     id: expectedId,
@@ -7847,8 +7825,7 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
     kill: h.kill,
     repo,
     sourcePath: workflowPath,
-    ...target !== void 0 ? { target } : {},
-    ...model !== void 0 ? { model } : {}
+    ...target !== void 0 ? { target } : {}
   };
 }
 function scheduleRecordsFromWorkflows(repo, files) {
@@ -7993,22 +7970,6 @@ async function fetchSchedulesList(deps) {
     return null;
   }
 }
-async function fetchRunVerdicts(deps) {
-  if (!deps.baseUrl) return null;
-  const token = await deps.token();
-  if (!token) return null;
-  try {
-    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/schedules/verdicts`, {
-      method: "GET",
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    if (!res.ok) return null;
-    const body = await res.json();
-    return Array.isArray(body?.runVerdicts) ? body.runVerdicts : null;
-  } catch {
-    return null;
-  }
-}
 async function fetchOrgConfig(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
@@ -11324,9 +11285,6 @@ function detectSurface(env) {
   if (env.MMI_AGENT_SURFACE === "jervcode" || has("PI_SESSION_ID")) {
     return "jervcode";
   }
-  if (env.MMI_AGENT_SURFACE === "cursor" || has("CURSOR_TRACE_ID") || has("CURSOR_USER") || has("CURSOR_SESSION_ID") || env.CURSOR_AGENT === "1" || has("CURSOR_EXTENSION_HOST_ROLE")) {
-    return "cursor";
-  }
   if (env.MMI_AGENT_SURFACE === "opencode" || has("OPENCODE_CLIENT") || has("OPENCODE_SERVER_USERNAME")) return "opencode";
   const isClaude = has("CLAUDECODE") || has("CLAUDE_CODE_ENTRYPOINT") || has("CLAUDE_PLUGIN_ROOT") || env.MMI_AGENT_SURFACE === "claude";
   const isVscode = env.TERM_PROGRAM === "vscode" || has("VSCODE_PID") || has("VSCODE_GIT_ASKPASS_NODE");
@@ -11341,8 +11299,6 @@ function surfaceToken(surface) {
       return "claude";
     case "codex":
       return "codex";
-    case "cursor":
-      return "cursor";
     case "jervcode":
       return "jervcode";
     case "hermes":
@@ -11362,8 +11318,6 @@ function reloadAction(surface) {
       return "restart Codex";
     case "opencode":
       return "restart OpenCode";
-    case "cursor":
-      return "reload the Cursor window";
     case "jervcode":
       return "restart JervCode (the package set is read at launch)";
     case "hermes":
@@ -11376,7 +11330,6 @@ function reloadAction(surface) {
 }
 var CLAUDE_RECOVERY = `claude plugin marketplace remove ${LEGACY_MMI_MARKETPLACE} && claude plugin marketplace remove mutmutco && claude plugin marketplace add mutmutco/MMI-Hub --ref main && claude plugin install mmi@mutmutco`;
 var CODEX_RECOVERY = "codex plugin remove mmi@mutmutco && codex plugin marketplace remove mutmutco && codex plugin marketplace add mutmutco/MMI-Hub --ref main && codex plugin add mmi@mutmutco";
-var CURSOR_RECOVERY = "mmi-cli plugin heal   # installs ~/.cursor/plugins/local/mmi from mutmutco/MMI-Hub";
 var PLUGIN_SURFACE_HEAL = {
   claude: {
     delivery: "plugin-cli",
@@ -11402,23 +11355,13 @@ var PLUGIN_SURFACE_HEAL = {
     ],
     fix: (surface) => `${CODEX_RECOVERY}   # then ${reloadAction(surface)} to load MMI commands`,
     updateRecipe: [CODEX_RECOVERY]
-  },
-  cursor: {
-    delivery: "local-checkout",
-    recovery: CURSOR_RECOVERY,
-    healSteps: null,
-    fix: (surface) => `${CURSOR_RECOVERY}   # then ${reloadAction(surface)}`,
-    updateRecipe: [CURSOR_RECOVERY]
   }
 };
 function nonClaudeSurfaceHealMessage(surface) {
   if (surface === "codex") {
     return "Codex ships an MMI plugin (#3563). Install or repair it with:\n  codex plugin marketplace add mutmutco/MMI-Hub && codex plugin add mmi@mutmutco\n  Update the CLI too: npm i -g @mutmutco/cli";
   }
-  if (surface === "cursor") {
-    return "Cursor ships an MMI plugin (#3920). Install or repair its managed local checkout with:\n  mmi-cli plugin heal\n  Then reload the Cursor window. For one-off CLI use, pass --plugin-dir <MMI-Hub checkout>.\n  Update the CLI too: npm i -g @mutmutco/cli";
-  }
-  return "No Hub-shipped MMI plugin on this host \u2014 the Hub ships plugins for Claude, Codex, Cursor, JervCode, and Hermes only.\n  Update the CLI instead: npm i -g @mutmutco/cli   (org rules ride an AGENTS.md authored outside the Hub)";
+  return "No Hub-shipped MMI plugin on this host \u2014 the Hub ships plugins for Claude, Codex, JervCode, and Hermes only.\n  Update the CLI instead: npm i -g @mutmutco/cli   (org rules ride an AGENTS.md authored outside the Hub)";
 }
 function healStepAborts(step, ok) {
   return !ok && step.gated;
@@ -11468,7 +11411,6 @@ function hermesConfigRoot(env = process.env, home = (0, import_node_os7.homedir)
 }
 function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os7.homedir)()) {
   if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path10.join)(home, ".codex");
-  if (surface === "cursor") return (0, import_node_path10.join)(home, ".cursor");
   if (surface === "hermes") return hermesConfigRoot(env, home);
   if (surface === "jervcode") {
     return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path10.join)(home, ".jerv", "agent");
@@ -11493,7 +11435,7 @@ function marketplaceCloneCandidates(surface, home, env = process.env) {
       (0, import_node_path10.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
     ];
   }
-  if (surface === "cursor" || surface === "hermes") return [];
+  if (surface === "hermes") return [];
   if (surface === "jervcode") return [];
   return [(0, import_node_path10.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
@@ -11538,15 +11480,6 @@ async function fetchNpmReleasedVersion() {
     return void 0;
   }
 }
-function cursorLocalPluginRoot(env = process.env, home = (0, import_node_os7.homedir)()) {
-  return (0, import_node_path10.join)(surfaceConfigRoot("cursor", env, home), "plugins", "local", "mmi");
-}
-function cursorPluginTreeHealthy(root, exists = import_node_fs12.existsSync) {
-  return [
-    ".cursor-plugin/plugin.json",
-    "skills/bootstrap/SKILL.md"
-  ].every((path2) => exists((0, import_node_path10.join)(root, ...path2.split("/"))));
-}
 var JERVCODE_NPM_PACKAGE = "@mutmutco/pi-plugin";
 function jervcodeAgentDirs(env = process.env, home = (0, import_node_os7.homedir)()) {
   const primary = surfaceConfigRoot("jervcode", env, home);
@@ -11633,10 +11566,10 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     // Codex's native projection is authoritative; its legacy installed_plugins.json may be empty
     // while `plugin list --json` proves the managed plugin installed (#6111).
     installRecordPresent: surface === "codex" ? codexStatus?.installed === true : hasUserInstallRecord(installed, MMI_PLUGIN_ID) || hasProjectInstallRecord(installed, MMI_PLUGIN_ID, process.cwd()) || // #4188: jervcode's install record is the settings-file packages[] entry itself.
-    surface === "jervcode" && piEntry !== null || surface === "cursor" && (0, import_node_fs12.existsSync)(cursorLocalPluginRoot()) || surface === "hermes" && (0, import_node_fs12.existsSync)(hermesPluginRoot()),
+    surface === "jervcode" && piEntry !== null || surface === "hermes" && (0, import_node_fs12.existsSync)(hermesPluginRoot()),
     // JervCode's settings entry and native local surfaces have no marketplace clone.
-    marketplaceClonePresent: surface === "cursor" || surface === "jervcode" || surface === "hermes" ? true : marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
-    pluginCachePresent: surface === "jervcode" ? mmiPiPackageHealthy() : surface === "hermes" ? hermesPluginTreeHealthy(hermesPluginRoot()) : surface === "cursor" ? cursorPluginTreeHealthy(cursorLocalPluginRoot()) : surface === "codex" ? Boolean(
+    marketplaceClonePresent: surface === "jervcode" || surface === "hermes" ? true : marketplaceClonePresent(surface, (0, import_node_os7.homedir)()),
+    pluginCachePresent: surface === "jervcode" ? mmiPiPackageHealthy() : surface === "hermes" ? hermesPluginTreeHealthy(hermesPluginRoot()) : surface === "codex" ? Boolean(
       codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
     ) : (0, import_node_fs12.existsSync)((0, import_node_path10.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
@@ -11652,84 +11585,6 @@ async function runPluginCli(bin, args, log) {
     return false;
   }
 }
-function canonicalCursorRemote(remote) {
-  return /^(?:https?:\/\/github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:|github\.com[:/])mutmutco\/MMI-Hub(?:\.git)?\/?$/i.test(remote.trim().replace(/\\/g, "/"));
-}
-function readJsonFile(path2) {
-  try {
-    return JSON.parse((0, import_node_fs12.readFileSync)(path2, "utf8"));
-  } catch {
-    return null;
-  }
-}
-async function cursorTreeManaged(target) {
-  if ((0, import_node_fs12.existsSync)((0, import_node_path10.join)(target, ".git"))) {
-    try {
-      const { stdout } = await runHostBin("git", ["-C", target, "remote", "get-url", "origin"], { timeout: 15e3 });
-      if (canonicalCursorRemote(stdout)) return { ok: true };
-      return { ok: false, detail: `refused to replace unrelated Cursor plugin directory at ${target}` };
-    } catch {
-      return { ok: false, detail: `refused to replace unmanaged Cursor plugin directory at ${target} (git checkout with no readable origin)` };
-    }
-  }
-  if (readJsonFile((0, import_node_path10.join)(target, "package.json"))?.name === "@mutmutco/cursor-plugin") return { ok: true };
-  if (readJsonFile((0, import_node_path10.join)(target, ".cursor-plugin", "plugin.json"))?.name === "mmi") return { ok: true };
-  return {
-    ok: false,
-    detail: `refused to replace unmanaged Cursor plugin directory at ${target} \u2014 no canonical git remote, no @mutmutco/cursor-plugin package.json and no MMI plugin manifest`
-  };
-}
-async function installCursorPluginCheckout(env = process.env) {
-  const configRoot = surfaceConfigRoot("cursor", env);
-  const pluginsRoot = (0, import_node_path10.join)(configRoot, "plugins");
-  const target = (0, import_node_path10.join)(pluginsRoot, "local", "mmi");
-  const source = env.MMI_CURSOR_PLUGIN_SOURCE?.trim();
-  if ((0, import_node_fs12.existsSync)(target) && !source) {
-    const managed = await cursorTreeManaged(target);
-    if (!managed.ok) return { ok: false, detail: managed.detail };
-  }
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.join)(pluginsRoot, "local"), { recursive: true });
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.join)(pluginsRoot, "staging"), { recursive: true });
-  (0, import_node_fs12.mkdirSync)((0, import_node_path10.join)(pluginsRoot, "quarantine"), { recursive: true });
-  const suffix = `${Date.now()}-${process.pid}`;
-  const staged = (0, import_node_path10.join)(pluginsRoot, "staging", `mmi-${suffix}`);
-  const quarantined = (0, import_node_path10.join)(pluginsRoot, "quarantine", `mmi-${suffix}`);
-  try {
-    if (source) {
-      (0, import_node_fs12.cpSync)(source, staged, {
-        recursive: true,
-        filter: (path2) => !path2.split(/[\\/]/).some((part) => part === ".git" || part === "node_modules")
-      });
-    } else {
-      await runHostBin("gh", ["repo", "clone", "mutmutco/MMI-Hub", staged, "--", "--branch", "main", "--depth", "1"], {
-        timeout: CLAUDE_PLUGIN_TIMEOUT_MS,
-        step: "gh repo clone mutmutco/MMI-Hub"
-      });
-    }
-    if (!cursorPluginTreeHealthy(staged)) {
-      (0, import_node_fs12.rmSync)(staged, { recursive: true, force: true });
-      return { ok: false, detail: "downloaded Cursor plugin is incomplete; existing install was preserved" };
-    }
-    let movedOld = false;
-    if ((0, import_node_fs12.existsSync)(target)) {
-      (0, import_node_fs12.renameSync)(target, quarantined);
-      movedOld = true;
-    }
-    try {
-      (0, import_node_fs12.renameSync)(staged, target);
-    } catch (error) {
-      if (movedOld && !(0, import_node_fs12.existsSync)(target)) (0, import_node_fs12.renameSync)(quarantined, target);
-      throw error;
-    }
-    return {
-      ok: true,
-      detail: movedOld ? `installed canonical Cursor plugin; previous checkout quarantined at ${quarantined}` : `installed canonical Cursor plugin at ${target}`
-    };
-  } catch (error) {
-    if ((0, import_node_fs12.existsSync)(staged)) (0, import_node_fs12.rmSync)(staged, { recursive: true, force: true });
-    return { ok: false, detail: error.message.trim().slice(0, 240).replace(/\s+/g, " ") };
-  }
-}
 async function marketplaceAddRefSupported(bin) {
   try {
     const { stdout, stderr } = await runHostBin(bin, ["plugin", "marketplace", "add", "--help"], {
@@ -11852,11 +11707,10 @@ async function healJervCodeForDoctor() {
 }
 async function healActivePluginForDoctor(surface = detectSurface(process.env), onStep) {
   const token = surfaceToken(surface);
-  if (token !== "claude" && token !== "codex" && token !== "cursor" && token !== "jervcode") {
+  if (token !== "claude" && token !== "codex" && token !== "jervcode") {
     return { ok: false, detail: `not a supported plugin surface (${surface})` };
   }
   if (token === "claude") return healClaudePluginForDoctor(surface, onStep);
-  if (token === "cursor") return installCursorPluginCheckout();
   if (token === "jervcode") return healJervCodeForDoctor();
   const steps = [];
   const applied = await applyPluginHeal(surface, (msg) => {
@@ -11952,7 +11806,7 @@ async function runGuard(readOrigin) {
   const surface = detectSurface(process.env);
   try {
     const token = surfaceToken(surface);
-    if (token !== "claude" && token !== "codex" && token !== "cursor" && token !== "jervcode") {
+    if (token !== "claude" && token !== "codex" && token !== "jervcode") {
       process.exitCode = 0;
       return;
     }
@@ -11966,9 +11820,8 @@ async function runGuard(readOrigin) {
     if (surfaceToken(surface) === "codex") {
       console.error("[mmi-guard] Could not inspect the active Codex plugin; run `mmi-cli plugin heal`.");
       process.exitCode = 1;
-    } else if (surfaceToken(surface) === "cursor" || surfaceToken(surface) === "jervcode") {
-      const host = surfaceToken(surface) === "cursor" ? "Cursor" : "JervCode";
-      console.error(`[mmi-guard] Could not inspect the active ${host} plugin; run \`mmi-cli plugin heal\`.`);
+    } else if (surfaceToken(surface) === "jervcode") {
+      console.error("[mmi-guard] Could not inspect the active JervCode plugin; run `mmi-cli plugin heal`.");
       process.exitCode = 1;
     } else {
       process.exitCode = 0;
@@ -11977,7 +11830,7 @@ async function runGuard(readOrigin) {
 }
 async function runPluginHeal(surface = detectSurface(process.env)) {
   const token = surfaceToken(surface);
-  if (token !== "claude" && token !== "codex" && token !== "cursor" && token !== "jervcode") {
+  if (token !== "claude" && token !== "codex" && token !== "jervcode") {
     console.log(nonClaudeSurfaceHealMessage(token ?? void 0));
     return;
   }
@@ -11994,17 +11847,15 @@ async function runPluginHeal(surface = detectSurface(process.env)) {
     return;
   }
   const descriptor = PLUGIN_SURFACE_HEAL[token];
-  const cursorResult = token === "cursor" ? await installCursorPluginCheckout() : void 0;
-  if (cursorResult) console.log(`  \u21BB ${cursorResult.detail}`);
-  const applied = cursorResult ? cursorResult.ok : await applyPluginHeal(surface, console.log, { force: true });
+  const applied = await applyPluginHeal(surface, console.log, { force: true });
   const healed = token !== "claude" ? applied && buildPluginGuardDecision(snapshotPluginGuardInput(surface, true)).state === "healthy" : applied;
   if (healed) {
     console.log(`  \u2713 MMI plugin reinstalled \u2014 ${reloadAction(surface)} to load MMI skills and commands.`);
   } else {
     process.exitCode = 1;
-    const refSupported = token === "cursor" ? false : await marketplaceAddRefSupported(token);
-    const recovery = token === "cursor" ? descriptor.recovery : refSupported ? descriptor.recovery : recoveryWithoutRef(descriptor.recovery);
-    const note = token === "cursor" ? "" : refAbsenceNote(token, refSupported);
+    const refSupported = await marketplaceAddRefSupported(token);
+    const recovery = refSupported ? descriptor.recovery : recoveryWithoutRef(descriptor.recovery);
+    const note = refAbsenceNote(token, refSupported);
     console.log(`  \u2717 Auto-heal failed or was skipped. Run manually:
   ${recovery}${note}${pluginReadGrantNote()}`);
   }
@@ -12017,7 +11868,6 @@ var SESSION_ID_ENV_VARS = [
   "CLAUDE_CODE_SESSION_ID",
   "CODEX_SESSION_ID",
   "CODEX_THREAD_ID",
-  "CURSOR_SESSION_ID",
   "HERMES_SESSION_ID",
   "PI_SESSION_ID",
   // #6193: lane runners spawn the CLI through the host's extension shell operations, which strip
@@ -16436,8 +16286,18 @@ async function foldReleaseVersion(deps, model, tag, foldPaths, sourceCommit = "H
   if (foldPaths.length === 0) return "no version manifest to fold \u2014 the tag is the version";
   const version = tag.replace(/^v/, "");
   let foldNoteExtra = "";
+  const timings = [];
+  const timed = async (label, fn) => {
+    const t0 = (deps.now ?? Date.now)();
+    try {
+      return await fn();
+    } finally {
+      timings.push(`${label} ${(((deps.now ?? Date.now)() - t0) / 1e3).toFixed(1)}s`);
+    }
+  };
+  const withTimings = (note) => `${note}; fold timings: ${timings.join(", ")}`;
   if (model === "hub-serverless") {
-    await deps.run("node", ["scripts/release-distribution.mjs", "prepare", version, "--source-commit", sourceCommit]);
+    await timed("release-distribution prepare", () => deps.run("node", ["scripts/release-distribution.mjs", "prepare", version, "--source-commit", sourceCommit]));
     if (verifyRelease) {
       await refuseDivergentPublishedNpmPack(deps, version);
     } else {
@@ -16445,10 +16305,10 @@ async function foldReleaseVersion(deps, model, tag, foldPaths, sourceCommit = "H
       if (restored) foldNoteExtra = `; ${restored}`;
     }
   } else {
-    const refresh = await refreshSharedInstallerDeps(deps);
+    const refresh = await timed("installer refresh", () => refreshSharedInstallerDeps(deps));
     if (refresh) foldNoteExtra = `; ${refresh}`;
-    await installAppFoldDeps(deps);
-    await deps.run("npm", ["version", version, "--no-git-tag-version", "--allow-same-version"]);
+    await timed("npm ci", () => installAppFoldDeps(deps));
+    await timed("npm version", () => deps.run("npm", ["version", version, "--no-git-tag-version", "--allow-same-version"]));
     const patch = Number(version.split(".")[2] ?? "0");
     if (model === "registry-publish" && Number.isFinite(patch) && patch > 0) {
       await alignExistingHotfixReleaseMarker(deps, version);
@@ -16467,12 +16327,12 @@ async function foldReleaseVersion(deps, model, tag, foldPaths, sourceCommit = "H
     );
   }
   const staged = (await deps.run("git", ["diff", "--cached", "--name-only"])).trim();
-  if (!staged) return `version fold: manifests already at ${version} \u2014 nothing committed${foldNoteExtra}`;
+  if (!staged) return withTimings(`version fold: manifests already at ${version} \u2014 nothing committed${foldNoteExtra}`);
   await deps.run("git", ["commit", "-m", `chore(release): bump distribution to ${tag}`]);
   if (model === "hub-serverless" && verifyRelease) {
-    await deps.run("node", ["scripts/release-distribution.mjs", "verify", version, "--skip-npm-view"]);
+    await timed("release-distribution verify", () => deps.run("node", ["scripts/release-distribution.mjs", "verify", version, "--skip-npm-view"]));
   }
-  return `version fold: distribution bumped to ${version} in the release commit${foldNoteExtra}`;
+  return withTimings(`version fold: distribution bumped to ${version} in the release commit${foldNoteExtra}`);
 }
 function foldPortManualCommand(model, version) {
   return model === "hub-serverless" ? `node scripts/release-distribution.mjs prepare ${version}` : `npm version ${version} --no-git-tag-version --allow-same-version`;
@@ -17268,10 +17128,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.86",
-    tag: "v4.5.86",
-    commit: "6485afaf5af8",
-    npm: "@mutmutco/cli@4.5.86"
+    version: "4.5.87",
+    tag: "v4.5.87",
+    commit: "c8eaaec639a7",
+    npm: "@mutmutco/cli@4.5.87"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17288,14 +17148,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.86"
+          v3Target: "v4.5.87"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.86 and redeploy the Hub Lambda from tag v4.5.86 (6485afaf5af8); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.86 (@mutmutco/cli@4.5.86, tag commit 6485afaf5af8 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.87 and redeploy the Hub Lambda from tag v4.5.87 (c8eaaec639a7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.87 (@mutmutco/cli@4.5.87, tag commit c8eaaec639a7 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19609,7 +19469,7 @@ var TRAIN_RULES_CONTEXTS_JQ = '[.[]|select(.type=="required_status_checks")|.par
 var TRAIN_CHECK_ATTEMPTS = 40;
 var TRAIN_QUEUED_CHECK_ATTEMPTS = 80;
 var TRAIN_CHECK_DELAY_MS = 15e3;
-var TRAIN_PR_ONLY_CONTEXTS = /* @__PURE__ */ new Set(["add-to-project", "mark-merged-pr-done", "guard", "verdict"]);
+var TRAIN_PR_ONLY_CONTEXTS = /* @__PURE__ */ new Set(["add-to-project", "mark-merged-pr-done"]);
 var TRAIN_PR_AUTOMATION_GRACE_ATTEMPTS = 3;
 var TRAIN_FRESH_RUN_GRACE_ATTEMPTS = 4;
 async function correlateRun(deps, args) {
@@ -19963,7 +19823,7 @@ async function alignRcForward(deps, ctx, tag) {
   return enqueueAlignmentAutoMerge(deps, ctx, number, url || void 0, `rc requires checks (${required.join(", ")}); opened alignment PR ${url || "(url unavailable)"}${supersededNote}`);
 }
 var FLEET_FOREIGN_VERDICT_GRACE_ATTEMPTS = 3;
-function resolveContextState(context, checkRuns, statuses) {
+function resolveContextState(context, checkRuns, statuses, opts = {}) {
   let sawFailure = false;
   let sawSuccess = false;
   let sawPending = false;
@@ -19982,11 +19842,12 @@ function resolveContextState(context, checkRuns, statuses) {
     else if (s.state === "failure" || s.state === "error") sawFailure = true;
     else sawPending = true;
   }
+  if (sawSuccess && opts.successWins) return "success";
   if (sawPending) return "pending";
   if (sawSuccess) return "success";
   return sawFailure ? "failed" : "pending";
 }
-async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince) {
+async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince, opts = {}) {
   if (required.length === 0) {
     return "no required status checks configured on the target branch \u2014 check wait skipped (GitHub push gate is the backstop)";
   }
@@ -20016,6 +19877,8 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince)
   let workflowRunNote = "";
   let workflowRunEverSeen = false;
   let hadQueuedWorkflowRun = false;
+  let freshActiveRun = false;
+  let anyActiveRun = false;
   const everObserved = /* @__PURE__ */ new Set();
   const autoSatisfied = /* @__PURE__ */ new Set();
   let fleetForeignStreak = 0;
@@ -20048,7 +19911,7 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince)
         "--limit",
         "100",
         "--json",
-        "databaseId,status,conclusion,headSha"
+        "databaseId,status,conclusion,headSha,createdAt"
       ]);
       const parsedWorkflowRuns = JSON.parse(workflowOut);
       if (!Array.isArray(parsedWorkflowRuns)) throw new Error("workflow-runs response was not an array");
@@ -20057,6 +19920,13 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince)
         workflowRunRead = "found";
         workflowRunEverSeen = true;
         const activeRun = matchingRuns.find((run) => run.status === "queued" || run.status === "in_progress");
+        freshActiveRun = freshThreshold !== void 0 && matchingRuns.some((run) => {
+          if (!["queued", "in_progress", "waiting", "pending"].includes(String(run.status))) return false;
+          const t = Date.parse(String(run.createdAt ?? ""));
+          return Number.isFinite(t) && t >= freshThreshold;
+        });
+        if (freshActiveRun) hadQueuedWorkflowRun = true;
+        anyActiveRun = matchingRuns.some((run) => ["queued", "in_progress", "waiting", "pending"].includes(String(run.status)));
         if (activeRun) {
           if (activeRun.status === "queued") hadQueuedWorkflowRun = true;
           workflowRunNote = activeRun.status === "queued" ? "Actions run is queued behind busy runners" : "Actions run is in progress";
@@ -20065,10 +19935,14 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince)
         }
       } else {
         workflowRunRead = "empty";
+        freshActiveRun = false;
+        anyActiveRun = false;
         workflowRunNote = "";
       }
     } catch (e) {
       workflowRunRead = "failed";
+      freshActiveRun = false;
+      anyActiveRun = false;
       workflowRunNote = `workflow-run lookup failed: ${e.message || String(e)}`;
     }
     for (const c of required) {
@@ -20080,7 +19954,7 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince)
       }
     }
     const pending = required.filter((c) => !autoSatisfied.has(c));
-    const holdStale = freshThreshold !== void 0 && attempt < TRAIN_FRESH_RUN_GRACE_ATTEMPTS;
+    const holdStale = freshThreshold !== void 0 && (attempt < TRAIN_FRESH_RUN_GRACE_ATTEMPTS || freshActiveRun);
     const states = pending.map((c) => {
       if (fleetPosted && c === FLEET_LOCKSTEP_CONTEXT) {
         const resolution = resolveFleetVerdictState(fleetPosted, statuses);
@@ -20092,6 +19966,11 @@ async function waitForRequiredTrainChecks(deps, ctx, sha, required, freshSince)
         fleetForeignStreak = 0;
         return [c, resolution.state];
       }
+      if (opts.exactCommitGreenSuffices) {
+        const state = resolveContextState(c, checkRuns, statuses, { successWins: true });
+        const inGrace = freshThreshold !== void 0 && attempt < TRAIN_FRESH_RUN_GRACE_ATTEMPTS;
+        return [c, state === "failed" && (anyActiveRun || inGrace) ? "pending" : state];
+      }
       if (holdStale) {
         const runsFor = checkRuns.filter((r) => r.name === c);
         if (runsFor.length > 0 && !runsFor.some(isFreshRun)) return [c, "pending"];
@@ -21372,6 +21251,10 @@ async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
     };
   }
   try {
+    const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+    if (isBundleOnlySuiteMember(ctx.repo, meta.suite)) {
+      return { status: "not-applicable", note: "bundle-only suite member has no rc runtime to retire" };
+    }
     await deps.run("git", ["fetch", "origin", "rc"]);
     const rcNow = clean2(await deps.run("git", ["rev-parse", "origin/rc"]));
     if (rcNow !== releasedRcSha) {
@@ -21904,14 +21787,6 @@ function installedClaudePluginVersion() {
     return void 0;
   }
 }
-function manifestVersion(path2) {
-  try {
-    const manifest = JSON.parse((0, import_node_fs20.readFileSync)(path2, "utf8"));
-    return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
-  } catch {
-    return void 0;
-  }
-}
 function readHermesPluginEvidence(env = process.env) {
   const host = hermesConfigRoot(env);
   const root = hermesPluginRoot(env);
@@ -21963,9 +21838,6 @@ function readHermesPluginEvidence(env = process.env) {
 function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "hermes") return readHermesPluginEvidence().installedVersion;
-  if (token === "cursor") {
-    return manifestVersion((0, import_node_path18.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
-  }
   if (token === "jervcode") {
     return installedJervCodePackageVersion();
   }
@@ -23747,17 +23619,23 @@ async function reverifyPersistedRunPhases(deps, path2, anchors, input) {
     async (current) => {
       if (!current) return { value: { ledger: void 0, notes } };
       const phases = { ...current.phases };
-      for (const phase of ["deploy", "publish"]) {
+      for (const phase of input.phases ?? ["deploy", "publish"]) {
         const rec = phases[phase];
         if (rec.updatedAt === "never") continue;
         if (rec.runId == null) {
-          if (rec.state === "complete") notes.push(`${phase}: persisted complete without a run id \u2014 the live deploy/publish re-derivation below decides the leg`);
+          if (rec.state === "complete") notes.push(`${phase}: persisted complete without a run id \u2014 live phase evidence decides the leg`);
           continue;
         }
-        if (rec.runProvenance !== "sha" && rec.runProvenance !== "dispatch") {
+        if (phase === "ordinaryCi" && rec.runRepo != null && rec.runRepo !== input.repo) {
+          throw new ReleaseLedgerError("invalid-record", `the persisted ordinaryCi run ${rec.runId} belongs to ${rec.runRepo}, not the release repo ${input.repo} \u2014 refusing unrelated run evidence (#7807)`);
+        }
+        if (phase === "ordinaryCi" && rec.sha != null && rec.sha.toLowerCase() !== input.sha.toLowerCase()) {
+          throw new ReleaseLedgerError("tag-sha-mismatch", `the persisted ordinaryCi boundary is for ${rec.sha.slice(0, 12)} but the active release tag is ${input.sha.slice(0, 12)} \u2014 refusing unrelated SHA evidence (#7807)`);
+        }
+        if (phase === "ordinaryCi" && rec.runProvenance !== "sha" || phase !== "ordinaryCi" && rec.runProvenance !== "sha" && rec.runProvenance !== "dispatch") {
           throw new ReleaseLedgerError(
             "invalid-record",
-            `the persisted ${phase} boundary names run ${rec.runId} without valid runProvenance ('sha'|'dispatch' required, got ${JSON.stringify(rec.runProvenance ?? null)}) \u2014 a run-backed boundary without provenance cannot be re-verified; failing closed (#5987)`
+            `the persisted ${phase} boundary names run ${rec.runId} without valid runProvenance ('sha'${phase === "ordinaryCi" ? "" : "|'dispatch'"} required, got ${JSON.stringify(rec.runProvenance ?? null)}) \u2014 a run-backed boundary without provenance cannot be re-verified; failing closed (#5987)`
           );
         }
         const runRepo = rec.runRepo ?? input.repo;
@@ -23792,7 +23670,8 @@ async function reverifyPersistedRunPhases(deps, path2, anchors, input) {
         }
         if (meta.conclusion === "success") {
           if (rec.state !== "complete") {
-            phases[phase] = { ...rec, state: "complete", note: `re-verified live: ${liveLabel} concluded success`, updatedAt: now().toISOString() };
+            const { error: _error, ...withoutPriorError } = rec;
+            phases[phase] = { ...withoutPriorError, state: "complete", note: `re-verified live: ${liveLabel} concluded success`, updatedAt: now().toISOString() };
             notes.push(`${phase}: ${liveLabel} re-verified green live`);
           }
           continue;
@@ -25070,6 +24949,19 @@ async function runTrainDoctor(input) {
     try {
       let ledger = parseReleaseLedger(ledgerRaw);
       let derived = deriveReleasePhaseStatus(ledger);
+      const ordinaryCi = ledger.phases.ordinaryCi;
+      if (healLedger && ordinaryCi.state === "failed" && ordinaryCi.runId != null) {
+        const outcome = await reverifyPersistedRunPhases(train, ledgerPath, {
+          repo: ledger.repo,
+          tag: ledger.tag,
+          tagSha: ledger.tagSha
+        }, { sha: ledger.tagSha, repo: ledger.repo, phases: ["ordinaryCi"] });
+        if (outcome.notes.some((note) => note.startsWith("ordinaryCi:") && note.includes("re-verified green live"))) {
+          add({ code: "ledger-ordinary-ci-rerun", severity: "healed", source: "origin", title: `the exact ordinaryCi run ${ordinaryCi.runId} for ${ledger.tag} is green on its recorded release SHA (#7807)`, remedy: "nothing \u2014 the ordinaryCi ledger leg now records the live green run" });
+          ledger = parseReleaseLedger(deps.readLedgerRaw(ledgerPath) ?? ledgerRaw);
+          derived = deriveReleasePhaseStatus(ledger);
+        }
+      }
       const deployModel = typeof meta?.deployModel === "string" && isDeployModel(meta.deployModel) ? meta.deployModel : void 0;
       if (healLedger && deployModel && derived.legs.some((l) => (l.phase === "deploy" || l.phase === "publish") && l.state === "pending")) {
         const run = await deps.healRunLegs(train, cwd, deployModel);
@@ -26174,7 +26066,9 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   const ledgerAnchors = { repo: ctx.repo, tag, tagSha: releaseSha };
   try {
     deps.warn?.("Release: Checking the package before publishing");
+    const dryRunStart = (deps.now ?? Date.now)();
     await verifyPublishDryRun(deps, ctx, meta, deployModel);
+    deps.warn?.(`Release: publish dry run took ${(((deps.now ?? Date.now)() - dryRunStart) / 1e3).toFixed(1)}s`);
   } catch (e) {
     throw await recoverFailedFold(deps, e, startBranch, preFold.mainSha, resumeCommand);
   }
@@ -26412,7 +26306,7 @@ async function runRcandResumeLocked(deps, options) {
   await requireCleanTree(deps);
   await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
-  const suiteRefusal = suiteMemberRefusal(ctx.repo, meta, "rcand", false, deps.suiteCut);
+  const suiteRefusal = suiteMemberRefusal(ctx.repo, meta, "rcand", options.suiteSolo === true, deps.suiteCut);
   if (suiteRefusal) throw new Error(`rcand --resume: ${suiteRefusal}`);
   const branchHints = await loadReleaseTrackBranchHints(deps);
   if (isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct") {
@@ -27725,7 +27619,6 @@ async function listWorkflowPaths(deps, repo, branch) {
     return e?.status === 404 ? [] : void 0;
   }
 }
-var AGENT_PR_BOOKKEEPING_CONTEXTS = /* @__PURE__ */ new Set(["guard", "verdict"]);
 function gateWorkflowFiles(prWorkflowPaths) {
   const files = prWorkflowPaths.map((p) => p.slice(p.lastIndexOf("/") + 1)).filter((f) => f !== "agent-pr.yml");
   return files.length ? files : DEFAULT_GATE_FILES;
@@ -28062,8 +27955,7 @@ async function auditRepoCi(repo, callerDeps) {
     }
   }
   if (explicitNoCi) {
-    const resolved = await getEmittedPrContexts();
-    const emitted = resolved?.filter((c) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(c));
+    const emitted = await getEmittedPrContexts();
     if (emitted && emitted.length > 0) {
       checks.push({
         ok: false,
@@ -28194,7 +28086,7 @@ async function auditRepoCi(repo, callerDeps) {
       if (hasRequiredChecks) {
         const gateFiles = new Set(gateWorkflowFiles(prWorkflowPaths));
         const gateWorkflows = (await getBranchWorkflows() ?? []).filter((wf) => gateFiles.has(wf.path.slice(wf.path.lastIndexOf("/") + 1)));
-        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job) && !branchPlan?.pending.some((entry) => entry.branch === baseBranch && entry.contexts.some((context) => contextMatchesJobId(job, context))));
+        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !branchPlan?.pending.some((entry) => entry.branch === baseBranch && entry.contexts.some((context) => contextMatchesJobId(job, context))));
         checks.push({
           ok: unblocking.length === 0,
           label: UNBLOCKING_GATE_JOBS_LABEL,
@@ -28217,8 +28109,7 @@ async function auditRepoCi(repo, callerDeps) {
           for (const ref of releaseBranches) {
             emittedByBranch[ref] = await resolveEmittedPrContexts(deps, repo, ref.replace("refs/heads/", ""));
           }
-          const ignore = /* @__PURE__ */ new Set([...AGENT_PR_BOOKKEEPING_CONTEXTS, ...TRAIN_PR_ONLY_CONTEXTS]);
-          const unreachable = unreachableReleaseContexts({ requiredContexts: liveContexts, releaseBranches, emittedByBranch, ignore });
+          const unreachable = unreachableReleaseContexts({ requiredContexts: liveContexts, releaseBranches, emittedByBranch, ignore: TRAIN_PR_ONLY_CONTEXTS });
           checks.push({
             ok: unreachable.length === 0,
             label: RELEASE_BRANCH_REACHABLE_LABEL,
@@ -28685,8 +28576,7 @@ async function authoritativeSafetyHold(authority, deps, repo, baseBranch, meta)
   if (authority.coversReleaseBranches && authority.source !== "registry META requiredChecks") {
     const track = resolveReleaseTrack(meta, void 0, repo);
     const releaseBranches = branchesForTrack(track).filter((b) => b !== baseBranch);
-    const ignore = /* @__PURE__ */ new Set([...AGENT_PR_BOOKKEEPING_CONTEXTS, ...TRAIN_PR_ONLY_CONTEXTS]);
-    const requiredForReleaseBranches = authority.contexts.filter((context) => !ignore.has(context));
+    const requiredForReleaseBranches = authority.contexts.filter((context) => !TRAIN_PR_ONLY_CONTEXTS.has(context));
     for (const branch of releaseBranches) {
       if (await branchPresence(deps, repo, branch) !== true) continue;
       const emittedThere = await resolveEmittedPrContexts(deps, repo, branch);
@@ -30507,7 +30397,7 @@ function trainPlan(command, options = {}) {
         { label: "fold the version bump into the release commit \u2014 runs inside the apply step, no separate bump PR", gated: true },
         { label: "tag release and publish GitHub Release", gated: true },
         { label: "trigger the deploy path for this repo model, returning Hub Actions run id/url data (and, with --watch, its outcome)", command: "tenant-container: gh workflow run tenant-deploy.yml ... then gh run list/watch", gated: true },
-        { label: "retire the rc runtime (rc is ephemeral \u2014 non-fatal, reported as rcRetirement)", command: "mmi-cli devops runtime tenant control <owner/repo> rc retire", gated: true },
+        ...!isBundleOnlySuiteMember(options.repo ?? "", options.suite) ? [{ label: "retire the rc runtime (rc is ephemeral \u2014 non-fatal, reported as rcRetirement)", command: "mmi-cli devops runtime tenant control <owner/repo> rc retire", gated: true }] : [],
         { label: "roll development forward and align rc to the released main", gated: true },
         { label: "synchronize the owning Project short description + thin README from the repo docs and current member repos", command: "mmi-cli oracle org project sync-info --apply", gated: true }
       ];
@@ -30515,6 +30405,8 @@ function trainPlan(command, options = {}) {
     return [
       authority,
       { label: "verify current branch is rc", gated: true },
+      // #7783: the version the apply will mint, read from the rc tag at origin/rc's head (never a stale higher cycle).
+      { label: `resolve the release tag from the rc head (${options.releaseTagError ? `error: ${options.releaseTagError}` : `releaseTag=${options.releaseTag ?? "(unresolved)"}`})`, command: "node scripts/next-version.mjs release", gated: true },
       { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
       { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
       { label: "preflight GitHub Actions hosted job start (billing/spending) before minting a tag", command: "train dispatches actions-job-start-canary.yml on MMI-Hub (#5604); exact-run --retry-publish skips this", gated: true },
@@ -31409,7 +31301,7 @@ var SETTABLE_VAR_HINTS = {
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
-  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",secretOutput?:{path,vault:{repo,key},overwrite?}}}; use {artifact} in argv when required; a secretOutput is master-only',
+  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",secretOutput?:{path,vault:{repo,key},overwrite?}}} \u2014 merged per entry, at most 20 stored in total; retire ONE task with --unset-task NAME; use {artifact} in argv when required; a secretOutput is master-only',
   secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
@@ -31440,6 +31332,18 @@ function duplicateVarKeyAcrossFlags(vars, sets) {
   }
   return null;
 }
+function tenantTaskWriteRefusal(existing, patch) {
+  const remove2 = Array.isArray(patch.tenantTasksRemove) ? patch.tenantTasksRemove : [];
+  const stored = existing?.tenantTasks ?? {};
+  const slug = existing?.slug ?? "this project";
+  const missing = remove2.filter((name) => stored[name] === void 0);
+  if (missing.length > 0) return `org project set: --unset-task ${missing.join(", ")} not declared in ${slug}'s tenantTasks (${Object.keys(stored).length} declared) \u2014 nothing to remove`;
+  const sent = patch.tenantTasks;
+  if (sent === null || sent === void 0) return null;
+  const merged = /* @__PURE__ */ new Set([...Object.keys(stored), ...Object.keys(sent)]);
+  if (merged.size > 20) return `org project set: ${slug} would hold ${merged.size} tenantTasks (${Object.keys(stored).length} declared today); the cap is 20 \u2014 retire some first with --unset-task <name>`;
+  return null;
+}
 function secretRemovalRefusal(existing, patch) {
   const remove2 = Array.isArray(patch.secretsRemove) ? patch.secretsRemove : [];
   if (remove2.length === 0) return null;
@@ -31614,12 +31518,26 @@ function buildProjectSetPatch(input) {
     }
     patch.secretsRemove = keys;
   }
+  if (input.unsetTasks?.length) {
+    if (patch.tenantTasks !== void 0) {
+      throw new Error("org project set: --unset-task cannot be combined with --var tenantTasks or --unset tenantTasks \u2014 pass one or the other");
+    }
+    const names = [];
+    for (const raw of input.unsetTasks) {
+      const name = raw.trim();
+      if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)) {
+        throw new Error(`org project set: --unset-task must be a task name (lowercase kebab-case) \u2014 got ${JSON.stringify(raw)}`);
+      }
+      if (!names.includes(name)) names.push(name);
+    }
+    patch.tenantTasksRemove = names;
+  }
   if (input.clearWebProfile) {
     patch.oauth = null;
     patch.edgeDomains = null;
   }
   if (Object.keys(patch).length === 0) {
-    throw new Error("org project set: nothing to set - pass --class, --project-type, --deploy-model, --release-track, --var KEY=VALUE, --unset KEY, --unset-secret KEY, and/or --clear-web-profile");
+    throw new Error("org project set: nothing to set - pass --class, --project-type, --deploy-model, --release-track, --var KEY=VALUE, --unset KEY, --unset-secret KEY, --unset-task NAME, and/or --clear-web-profile");
   }
   return patch;
 }
@@ -35796,8 +35714,24 @@ async function readSuiteStatus(deps) {
   })));
   if (!deps.leadTags || !deps.registryAt) return { suite: "mm-work", members: rows };
   const tags = await deps.leadTags().catch(() => []);
-  const latest = (rc) => tags.filter((t) => /^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(t) && t.includes("-rc.") === rc).sort((a, b) => compareVersions(b, a))[0];
-  const leadTag = { rc: latest(true), main: latest(false) };
+  const latest = (rc2) => tags.filter((t) => /^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(t) && t.includes("-rc.") === rc2).sort((a, b) => compareVersions(b, a))[0];
+  let rc;
+  let rcLabel = "n/a";
+  const rcTags = tags.filter((t) => /^v\d+\.\d+\.\d+-rc\.\d+$/.test(t)).sort((a, b) => compareVersions(b, a));
+  if (rcTags.length) {
+    const rcHead = await deps.head(rows[0].repo, "rc").catch(() => void 0);
+    if (rcHead === void 0) rcLabel = "unknown";
+    else {
+      for (const t of rcTags) {
+        if ((await deps.tagCommit(rows[0].repo, t).catch(() => void 0))?.toLowerCase() === rcHead?.toLowerCase()) {
+          rc = t;
+          break;
+        }
+      }
+      rcLabel = rc ?? "none at head";
+    }
+  }
+  const leadTag = { rc, main: latest(false) };
   const lead = rows[0].stages;
   for (const stage of ["rc", "main"]) {
     const tag = leadTag[stage];
@@ -35813,7 +35747,7 @@ async function readSuiteStatus(deps) {
     }
   }
   const recorded = leadTag.main && deps.leadReleaseBody ? parseSuiteMapping(await deps.leadReleaseBody(leadTag.main).catch(() => null)) : void 0;
-  return { suite: "mm-work", lead: { dev: lead[0].head, rc: leadTag.rc ?? "n/a", main: leadTag.main ?? "unknown", ...recorded ? { members: recorded } : {} }, members: rows };
+  return { suite: "mm-work", lead: { dev: lead[0].head, rc: rcLabel, main: leadTag.main ?? "unknown", ...recorded ? { members: recorded } : {} }, members: rows };
 }
 var short = (v) => /^[a-f0-9]{40}$/i.test(v) ? v.slice(0, 12) : v;
 var proofText = (p) => p ? p.state === "proven" ? "proven" : p.state === "mismatch" ? `mismatch (${p.detail})` : `unprovable (${p.detail})` : "";
@@ -35855,7 +35789,8 @@ async function setSuiteHold(deps, member, hold) {
   const after = await deps.read(slug);
   if (!after.ok || !after.project) throw new Error(`${found.repo}: write sent but read-back failed; verify with org project get`);
   const got = after.project.suiteHold ?? null;
-  if (JSON.stringify(got) !== JSON.stringify(hold)) throw new Error(`${found.repo}: read-back suiteHold ${JSON.stringify(got)} does not match what was written`);
+  const same2 = got === null || hold === null ? got === hold : got.reason === hold.reason && got.since === hold.since;
+  if (!same2) throw new Error(`${found.repo}: read-back suiteHold ${JSON.stringify(got)} does not match what was written`);
   if (track && after.project.releaseTrack !== track) throw new Error(`${found.repo}: releaseTrack changed from ${track} to ${after.project.releaseTrack ?? "unset"} by the write; restore it with org project set --release-track ${track}`);
   return hold ? `${found.repo}: HELD (${hold.reason})` : `${found.repo}: hold cleared`;
 }
@@ -36037,7 +35972,7 @@ async function carriedPins(deps, member, bundles) {
   }
   throw new Error(`${member.repo}: nothing new since rc, but no pinned MM-Work bundle carries development ${member.development.slice(0, 12)}; pin it before the suite cut`);
 }
-function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
+function abandonableCut(recordPath, ownerGo) {
   const record = readSuiteCut(recordPath);
   if (!record) throw new Error("no suite cut record to abandon");
   if (record.leadReleased || record.members.some((m) => m.released)) {
@@ -36046,6 +35981,19 @@ function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Dat
   if (record.pinPr && !ownerGo) {
     throw new Error(`the cut already opened pin PR ${record.pinPr}; its pins may be visible, so resume it (suite rcand --owner-go), release it (suite release), or retire it with suite abandon --owner-go`);
   }
+  return record;
+}
+async function suiteMarkAbandoned(deps, ownerGo = false) {
+  const record = abandonableCut(deps.recordPath, ownerGo);
+  const tags = [
+    ...record.members.flatMap((m) => m.tag && m.sha ? [{ repo: m.repo, tag: m.tag, sha: m.sha }] : []),
+    ...record.leadRcTag && record.leadRcSha ? [{ repo: SUITE_REPO, tag: record.leadRcTag, sha: record.leadRcSha }] : []
+  ];
+  for (const t of tags) await deps.markAbandoned(t.repo, t.tag, t.sha);
+  return tags.map((t) => `${t.repo}@${t.tag}`);
+}
+function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
+  const record = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
   if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
   (0, import_node_fs29.renameSync)(recordPath, archive);
@@ -36932,12 +36880,20 @@ ${lines2.join("\n")}
 Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
 }
 var CHERRY_PICKED_FROM = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
-async function findHotfixPickGaps(deps, sources, tolerated) {
-  if (sources.length === 0) return [];
+async function scanHotfixPickGaps(deps, sources, tolerated, rcRef) {
+  if (sources.length === 0) return { gaps: [], rcCarried: 0 };
   const namedShas = new Set(sources.map((s) => s.sha.toLowerCase()));
   const carried = /* @__PURE__ */ new Set();
   const mainOnly = await deps.run("git", ["log", "--no-merges", "--format=%B", "origin/development..origin/main"]);
   for (const m of mainOnly.matchAll(CHERRY_PICKED_FROM)) carried.add(m[1].toLowerCase());
+  const notOnRc = /* @__PURE__ */ new Set();
+  const rcPicked = /* @__PURE__ */ new Set();
+  if (rcRef) {
+    (await deps.run("git", ["log", "--no-merges", "--format=%H", `${rcRef}..origin/development`])).split("\n").map((s) => s.trim().toLowerCase()).filter(Boolean).forEach((s) => notOnRc.add(s));
+    const rcOnly = await deps.run("git", ["log", "--no-merges", "--format=%B", `origin/development..${rcRef}`]);
+    for (const m of rcOnly.matchAll(CHERRY_PICKED_FROM)) rcPicked.add(m[1].toLowerCase());
+  }
+  let rcCarried = 0;
   const gaps = [];
   const devOnly = (await deps.run("git", ["log", "--no-merges", "--reverse", "--format=%H%x09%s", "origin/main..origin/development"])).split("\n").map((s) => s.trim()).filter(Boolean);
   for (const line of devOnly) {
@@ -36945,11 +36901,37 @@ async function findHotfixPickGaps(deps, sources, tolerated) {
     if (!sha) continue;
     const lower = sha.toLowerCase();
     if (namedShas.has(lower) || carried.has(lower)) continue;
+    if (rcRef && (!notOnRc.has(lower) || rcPicked.has(lower))) {
+      rcCarried++;
+      continue;
+    }
     const paths = (await deps.run("git", ["show", "--no-color", "--name-only", "--pretty=format:", sha])).split("\n").map((s) => s.trim()).filter(Boolean);
     if (paths.length === 0 || paths.every((p) => pathIsTolerated(p, tolerated))) continue;
     gaps.push({ sha, subject: subjectParts.join("	") });
   }
-  return gaps;
+  return { gaps, rcCarried };
+}
+async function resolveActiveRcCandidate(deps) {
+  try {
+    await deps.run("git", ["rev-parse", "--verify", "--quiet", "origin/rc"]);
+  } catch {
+    return { reason: "origin/rc does not exist" };
+  }
+  try {
+    const rcTags = (await deps.run("git", ["tag", "--points-at", "origin/rc", "--list", "v*"])).split("\n").map((s) => s.trim()).filter((t) => /^v\d+\.\d+\.\d+-rc\.\d+$/.test(t));
+    const tag = rcTags.sort((a, b) => Number(a.split("-rc.")[1]) - Number(b.split("-rc.")[1])).pop();
+    if (!tag) return { reason: "no rc tag points at the origin/rc head, so it is not an active candidate" };
+    if ((await deps.run("git", ["ls-remote", "origin", `refs/abandoned-rc/${tag}`])).trim()) {
+      return { reason: `${tag} was abandoned (marker refs/abandoned-rc/${tag} on origin), so it is not an active candidate` };
+    }
+    const released = tag.replace(/-rc\.\d+$/, "");
+    if ((await deps.run("git", ["tag", "--list", released])).trim()) {
+      return { reason: `${released} is already released, so ${tag} is no longer a pending candidate` };
+    }
+    return { ref: "origin/rc", tag };
+  } catch (e) {
+    return { reason: `the origin/rc candidate could not be read (${e.message ?? e})` };
+  }
 }
 function formatHotfixPickGapRefusal(gaps, tag, fromSpecs) {
   const lines2 = gaps.map((g) => `  - ${g.sha.slice(0, 7)} ${g.subject}`);
@@ -37169,7 +37151,16 @@ async function runHotfixStartLocked(deps, options, doctor) {
   const label = sources.map((s) => s.label).join(", ");
   const { foldPaths, pickTolerated } = await resolveHotfixPickTolerated(deps, deployModel);
   const ackedShas = (options.ack ?? []).map((a) => a.trim().toLowerCase()).filter(Boolean);
-  const pickGaps = await findHotfixPickGaps(deps, sources, pickTolerated);
+  let rcCandidate;
+  if (resolveReleaseTrack(meta, void 0, ctx.repo) === "full") {
+    const found = await resolveActiveRcCandidate(deps);
+    if ("reason" in found) notes.push(`pick-completeness guard checked against origin/main only: ${found.reason} (#7799)`);
+    else rcCandidate = found;
+  }
+  const { gaps: pickGaps, rcCarried } = await scanHotfixPickGaps(deps, sources, pickTolerated, rcCandidate?.ref);
+  if (rcCandidate && rcCarried > 0) {
+    notes.push(`pick-completeness: ${rcCarried} development commit(s) carried by rc candidate ${rcCandidate.tag}, not counted as gaps (#7799)`);
+  }
   const unacked = pickGaps.filter((g) => {
     const sha = g.sha.toLowerCase();
     return !ackedShas.some((a) => sha.startsWith(a) || a.startsWith(sha));
@@ -37262,7 +37253,9 @@ async function runHotfixStartLocked(deps, options, doctor) {
 
 <!-- mmi-hotfix-carries: ${activeSources.map((s) => s.sha).join(",")} -->${pickGaps.length > 0 ? `
 
-<!-- mmi-hotfix-acked-excluded: ${pickGaps.map((g) => g.sha).join(",")} (#6994 pick-completeness) -->` : ""}
+<!-- mmi-hotfix-acked-excluded: ${pickGaps.map((g) => g.sha).join(",")} (#6994 pick-completeness) -->` : ""}${rcCandidate && rcCarried > 0 ? `
+
+<!-- mmi-hotfix-rc-carried: ${rcCarried} commits carried by ${rcCandidate.tag} -->` : ""}
 
 Merge this PR (human-initiated), then run \`mmi-cli devops hotfix release ${tag}\`.`
   ]));
@@ -37502,7 +37495,7 @@ async function waitForHotfixRequiredChecks(deps, ctx, mergedSha, required, fresh
   const recover = hooks.recover ?? transientRecoveryForFailedPhase;
   let checks;
   try {
-    checks = await wait(deps, ctx, mergedSha, required, freshSince);
+    checks = await wait(deps, ctx, mergedSha, required, freshSince, { exactCommitGreenSuffices: true });
   } catch (e) {
     const failureText = e instanceof Error ? e.message : String(e);
     let recovery;
@@ -37531,7 +37524,7 @@ release ledger: ${recoveryFailure} - manual intervention required`);
 
 ${recovery.note}`);
     try {
-      checks = await wait(deps, ctx, mergedSha, required, void 0);
+      checks = await wait(deps, ctx, mergedSha, required, void 0, { exactCommitGreenSuffices: true });
     } catch (e2) {
       const revalidationFailure = e2 instanceof Error ? e2.message : String(e2);
       const prior2 = (await ledger.load(anchors).catch(() => void 0))?.phases.ordinaryCi;
@@ -40048,6 +40041,30 @@ function releaseProgressVerdict(status, subject = "Release") {
 // src/suite-pin.ts
 var import_promises6 = require("node:fs/promises");
 var import_node_path34 = require("node:path");
+var SuitePinError = class _SuitePinError extends Error {
+  diagnostic;
+  constructor(repo, tag, error) {
+    const e = error instanceof _SuitePinError ? { ...error.diagnostic } : error && typeof error === "object" ? error : {};
+    const code = typeof e.code === "number" && Number.isInteger(e.code) && e.code > 0 && e.code <= 255 ? e.code : typeof e.code === "string" && /^(ETIMEDOUT|EACCES|EPERM|EBUSY|ENOENT|ENOSPC|EIO|EEXIST|ECONNRESET|ECONNREFUSED|EPIPE)$/.test(e.code) ? e.code : void 0;
+    const signal = typeof e.signal === "string" && /^(SIGTERM|SIGKILL|SIGINT|SIGHUP|SIGABRT|SIGPIPE)$/.test(e.signal) ? e.signal : void 0;
+    const hint = [error instanceof _SuitePinError ? error.message : e.message, e.stderr].filter((s) => typeof s === "string").map((s) => s.slice(0, 4096)).join("\n");
+    const carriedCategory = error instanceof _SuitePinError && typeof e.category === "string" && ["timeout", "permission", "index-lock", "terminated", "exit", "unknown"].includes(e.category) ? e.category : void 0;
+    const category = carriedCategory ?? (code === "ETIMEDOUT" ? "timeout" : code === "EACCES" || code === "EPERM" || /permission denied/i.test(hint) ? "permission" : /index\.lock.*(?:exists|unable|denied)|unable.*index\.lock/i.test(hint) ? "index-lock" : signal || e.killed === true ? "terminated" : typeof code === "number" ? "exit" : "unknown");
+    const diagnostic = {
+      category,
+      ...code !== void 0 ? { code } : {},
+      ...signal ? { signal } : {},
+      ...typeof e.killed === "boolean" ? { killed: e.killed } : {},
+      ...typeof e.durationMs === "number" && Number.isFinite(e.durationMs) && e.durationMs >= 0 && e.durationMs <= 864e5 ? { durationMs: e.durationMs } : {},
+      ...e.cleanupFailed === true ? { cleanupFailed: true } : {}
+    };
+    const safeRepo = /^[\w.-]+\/[\w.-]+$/.test(repo) && repo.length <= 200 ? repo : "[invalid repo]";
+    const safeTag = /^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(tag) && tag.length <= 80 ? tag : "[invalid tag]";
+    const reason = /closed without landing/.test(hint) ? "pin PR closed without landing" : /merged but development/.test(hint) ? "merged PR does not match the development pin" : /unreadable|META unreadable/.test(hint) ? "registry unreadable" : /not a declared MM-Work module/.test(hint) ? "not a declared MM-Work module" : /no .* bundle host/.test(hint) ? "bundle host missing" : diagnostic.category === "permission" ? "permission denied" : diagnostic.category;
+    super(`suite pin PR FAILED for ${safeRepo} ${safeTag}: ${reason}; remedy: open/merge the ${SUITE_REPO} development pin PR for ${safeRepo} ${safeTag}, then rerun the same train command; do not recut the tag \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#suite-pin-pr`);
+    this.diagnostic = diagnostic;
+  }
+};
 async function openSuiteCutPinPr(deps, input) {
   if (!/^[a-f0-9]{40}$/.test(input.cut) || !input.pins.length) throw new Error("suite pin PR needs an anchored cut and at least one module");
   const ids = input.pins.map((p) => p.module);
@@ -40190,8 +40207,8 @@ async function openSuiteRestorePinPr(deps, input) {
 }
 async function openSuitePinPr(deps, input) {
   const { repo, tag, stage } = input;
-  const remedy = `open/merge the ${SUITE_REPO} development pin PR for ${repo} ${tag}, then rerun the same train command; do not recut the tag \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#suite-pin-pr`;
   let scratch = "";
+  let failure;
   try {
     const get = JSON.parse(await deps.run("gh", ["api", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=development`]));
     if (!get.content) throw new Error("MM-Work seed/modules.json was unreadable");
@@ -40256,9 +40273,19 @@ async function openSuitePinPr(deps, input) {
       await run("gh", ["pr", "close", old2.url, "--repo", SUITE_REPO, "--comment", `Superseded by ${pr} (${member.id} ${stage} at ${tag}).`]);
     return { status: "pending", pr, url: pin };
   } catch (e) {
-    throw new Error(`suite pin PR FAILED for ${repo} ${tag}: ${e.message}; remedy: ${remedy}`);
+    failure = new SuitePinError(repo, tag, e);
+    throw failure;
   } finally {
-    if (scratch) await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
+    if (scratch) {
+      try {
+        await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
+      } catch (e) {
+        const cleanupFailure = failure ?? new SuitePinError(repo, tag, e);
+        cleanupFailure.diagnostic.cleanupFailed = true;
+        cleanupFailure.message += "; owned scratch cleanup also failed";
+        if (!failure) throw cleanupFailure;
+      }
+    }
   }
 }
 
@@ -45813,7 +45840,7 @@ async function requireFreshTrainCli(commandName) {
   process.exit(converge.reexecCode);
 }
 var GH_TRAIN_TIMEOUT_MS = 3e4;
-var GH_RUN_WATCH_TIMEOUT_MS = 90 * 6e4;
+var GH_RUN_WATCH_TIMEOUT_MS = 240 * 6e4;
 var NODE_PREPARE_TIMEOUT_MS = 10 * 6e4;
 var NODE_VERIFY_TIMEOUT_MS = 5 * 6e4;
 var NPM_TRAIN_TIMEOUT_MS = 6e4;
@@ -46235,10 +46262,43 @@ function emitTrainResult(label, output, out) {
   if (!out) printLine(output);
   else printLine(`Wrote ${label} result to ${out} (UTF-8, ${writeUtf8Receipt(out, output)} bytes)`);
 }
+var TrainPinFollowUpError = class extends Error {
+  constructor(completed, error) {
+    const failure = new SuitePinError(completed.repo, completed.tag, error);
+    super(failure.message);
+    this.completed = completed;
+    this.diagnostic = failure.diagnostic;
+  }
+  completed;
+  diagnostic;
+};
 function writeTrainFailureReceipt(commandName, json, out, error, suiteSolo = false) {
-  if (!out) return;
-  const output = json ? JSON.stringify({ command: `${commandName} --apply`, verdict: "failed", ...suiteSolo ? { suiteSolo: true, suitePin: { status: "failed", error: error.message } } : {}, error: error.message }, null, 2) : `mmi-cli ${commandName} --apply: FAILED \u2014 ${error.message}`;
-  emitTrainResult(`${commandName} apply`, output, out);
+  const completed = error instanceof TrainPinFollowUpError ? error.completed : void 0;
+  if (!out && !completed) return;
+  const command = commandName.includes(" ") ? commandName : `${commandName} --apply`;
+  const legs = completed?.releaseVerdict?.legs ?? (completed?.command === "hotfix-release" ? hotfixFollowUpLegs(completed.runs, completed.foldStatus, ledgerAlignmentFollowUpOutcome(completed.ledger), completed.foldNote, completed.deployNote) : []);
+  const failedLeg = { leg: "suite-pin-pr", status: "failed", error: error.message };
+  const failure = completed ? {
+    ...completed,
+    suiteSolo: true,
+    suitePin: { status: "failed", error: error.message, diagnostic: error.diagnostic },
+    failedLeg: "suite-pin-pr",
+    ...completed.command === "hotfix-release" ? { legs: [...legs, failedLeg] } : {},
+    releaseVerdict: {
+      releaseUrl: null,
+      ...completed.releaseVerdict,
+      releaseStatus: "succeeded",
+      followUpStatus: "failed",
+      promoted: true,
+      tag: completed.tag,
+      legs: [...legs, failedLeg]
+    }
+  } : { command, ...suiteSolo ? { suiteSolo: true } : {} };
+  const evidence = JSON.stringify({ ...failure, verdict: "failed", error: error.message }, null, 2);
+  const output = json ? evidence : `mmi-cli ${command}: FAILED \u2014 ${completed ? `${completed.repo} ${completed.tag} published; suite-pin-pr follow-up FAILED \u2014 ` : ""}${error.message}${completed ? `
+Completed train evidence and failed follow-up:
+${evidence}` : ""}`;
+  emitTrainResult(command, output, out);
 }
 function renderTenantRedeploy(r) {
   return `mmi-cli devops runtime tenant redeploy: ${r.repo} ${r.stage} (ref=${r.ref}) [${r.deployModel}]; ${renderDeployLine(r)}`;
@@ -46264,8 +46324,15 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const root = (await execFileP("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
     return openSuitePinPr({ root, run: async (file, args, cwd) => (await execFileP(file, args, { cwd, timeout: GIT_TIMEOUT_MS })).stdout }, { repo, tag, stage: "main" });
   }
+  async function pinCompletedMember(completed) {
+    try {
+      return await pinSoloMember(completed.repo, completed.tag);
+    } catch (e) {
+      throw new TrainPinFollowUpError(completed, e);
+    }
+  }
   for (const commandName of ["rcand", "release"]) {
-    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit project-admin or master approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded repo-authorized train after explicit approval (Hub: master only)").option("--suite-solo", "release one suite module alone (requires --owner-go; never valid on rcand)").option("--owner-go", "explicit owner approval for a suite-solo backend release").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
+    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit project-admin or master approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded repo-authorized train after explicit approval (Hub: master only)").option("--suite-solo", "release one suite module alone, or cut the suite lead alone (requires --owner-go; a member rcand is always refused)").option("--owner-go", "explicit owner approval for a suite-solo backend release").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
     const RELEASE_ONLY_FLAGS = [
       { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line release Slack summary; required for a new MMI-Hub --apply (#883/#3901) and for a product repo whose registry META sets `releaseChannel` (#6523), in its `releaseLanguage`; nothing is posted to a project channel without it" },
       { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
@@ -46451,7 +46518,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
             const raw2 = await withReleaseProgress(
               trainApplyDeps(),
               "Checking the existing release candidate",
-              (deps) => runRcandResume(deps, { watch: o.watch })
+              (deps) => runRcandResume(deps, { watch: o.watch, suiteSolo: o.suiteSolo })
             );
             return emitRcandContinuation("rcand --resume", raw2, o);
           }
@@ -46467,7 +46534,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
             () => runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo)
           );
           const { followUpStatus, releaseVerdict } = buildResumeReleaseVerdict(result, projectInfoSync);
-          const suitePin = o.suiteSolo ? await pinSoloMember(result.repo, result.tag) : void 0;
+          const suitePin = o.suiteSolo ? await pinCompletedMember({ ...result, projectInfoSync, releaseVerdict }) : void 0;
           if (suitePin?.status === "pending") {
             releaseVerdict.legs.push({ leg: "suite-pin-pr", status: "pending", error: `merge ${suitePin.pr} on MM-Work development, then verify the pin` });
             releaseVerdict.followUpStatus = "pending";
@@ -46480,6 +46547,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         } catch (e) {
           applyTrainFollowUpExit("failed");
           consoleIo.err(`mmi-cli: Release: ${progressSubject(commandName)} blocked \u2014 see the error below`);
+          writeTrainFailureReceipt(`${commandName} --resume`, o.json === true, o.out, e, o.suiteSolo === true);
           return failGraceful(`${commandName} --resume: ${e.message}`);
         }
       }
@@ -46533,8 +46601,8 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
               () => runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo)
             );
           }
-          const suitePin = o.suiteSolo && commandName === "release" ? await pinSoloMember(result.repo, result.tag) : void 0;
           const verdict = buildReleaseVerdict(commandName, result, projectInfoSync);
+          const suitePin = o.suiteSolo && commandName === "release" ? await pinCompletedMember({ ...result, projectInfoSync, releaseVerdict: verdict.releaseVerdict }) : void 0;
           if (suitePin?.status === "pending" && verdict.releaseVerdict) {
             verdict.releaseVerdict.legs.push({ leg: "suite-pin-pr", status: "pending", error: `merge ${suitePin.pr} on MM-Work development, then verify the pin` });
             verdict.releaseVerdict.followUpStatus = "pending";
@@ -46563,6 +46631,8 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       const repo = o.repo ?? await resolveRepo();
       const targets = commandName === "rcand" && !o.repo ? await resolveRcandPlanTargets() : void 0;
       let releaseTrack;
+      let suite;
+      let preOneZeroPlan = false;
       let releaseChannel = null;
       let releaseLanguage = "en";
       if (repo) {
@@ -46579,14 +46649,24 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         }
         const raw = read.project?.releaseTrack;
         if (isReleaseTrack(raw)) releaseTrack = raw;
+        suite = read.project?.suite;
+        preOneZeroPlan = preOneZeroInForce(read.project ?? void 0);
         releaseChannel = read.project?.releaseChannel?.trim() || null;
         releaseLanguage = read.project?.releaseLanguage?.trim() || "en";
       }
-      const steps = trainPlan(commandName, { ...targets ?? {}, repo, dev: o.dev, releaseTrack });
+      let releaseTarget;
+      if (commandName === "release" && !o.repo && !o.dev && releaseTrack !== "direct" && releaseTrack !== "trunk" && repo?.toLowerCase() !== "mutmutco/mmi-hub") {
+        try {
+          releaseTarget = { releaseTag: (await execFileP("node", ["scripts/next-version.mjs", "release", ...preOneZeroPlan ? ["--pre-one-zero"] : []], { timeout: 15e3 })).stdout.trim() };
+        } catch (e) {
+          releaseTarget = { releaseTagError: (e.stderr || e.message).trim() };
+        }
+      }
+      const steps = trainPlan(commandName, { ...targets ?? {}, ...releaseTarget ?? {}, repo, dev: o.dev, releaseTrack, suite });
       let doctor;
       if (repo && (!o.repo || (await resolveRepo())?.toLowerCase() === repo.toLowerCase())) {
         try {
-          doctor = await runTrainDoctor({ lane: commandName, dev: commandName === "release" && o.dev === true, heal: false, train: trainApplyDeps(), repo });
+          doctor = await runTrainDoctor({ lane: commandName, dev: commandName === "release" && o.dev === true, heal: false, train: trainApplyDeps(), repo, suiteSolo: o.suiteSolo === true });
         } catch (e) {
           consoleIo.err(`mmi-cli: train doctor did not complete: ${e.message}`);
         }
@@ -46674,10 +46754,10 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         foldPort
       }));
     } catch (e) {
-      if (sub === "release" && o.suiteSolo && o.out) {
-        const error = e.message;
-        emitTrainResult("hotfix release", o.json ? JSON.stringify({ command: "hotfix release", suiteSolo: true, suitePin: { status: "failed", error }, verdict: "failed" }, null, 2) : `hotfix release: suite pin PR FAILED \u2014 ${error}`, o.out);
+      if (sub === "release") {
+        writeTrainFailureReceipt("hotfix release", o.json || Boolean(hotfixCmd.opts().json), o.out, e, o.suiteSolo === true);
       }
+      applyTrainFollowUpExit("failed");
       return failGraceful(`hotfix ${sub}: ${e.message}`);
     }
   }
@@ -46705,7 +46785,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     }
     return runHotfixSub("release", async () => {
       const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [], suiteSolo: o.suiteSolo, ...o.ack ? { ack: o.ack.split(",").map((s) => s.trim()).filter(Boolean) } : {} });
-      const suitePin = o.suiteSolo ? await pinSoloMember(result.repo, result.tag) : void 0;
+      const suitePin = o.suiteSolo ? await pinCompletedMember(result) : void 0;
       const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
       return { ...result, projectInfoSync, ...o.suiteSolo ? { suiteSolo: true, suitePin } : {} };
     }, o, renderHotfixRelease);
@@ -47041,6 +47121,13 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
     publishMain,
     preflightMain,
     pin: (input) => openSuiteCutPinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, input),
+    markAbandoned: async (repo, tag, sha) => {
+      try {
+        await gh(["api", "-X", "POST", `repos/${repo}/git/refs`, "-f", `ref=refs/abandoned-rc/${tag}`, "-f", `sha=${sha}`]);
+      } catch (e) {
+        if (!/already exists/i.test(e.message)) throw e;
+      }
+    },
     restoreMain: (input) => openSuiteRestorePinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, input),
     verifyLeadCut: async (sha) => {
       const current = await gh(["api", `repos/${SUITE_REPO}/git/ref/heads/development`, "--jq", ".object.sha"]);
@@ -47205,9 +47292,11 @@ function registerSuiteCommands(program3) {
       const unlock = await acquireTrainWriterLock(root, "suite abandon");
       let result;
       let restored;
+      let marked;
       try {
         const io = suiteTrainIo(root);
         restored = o.ownerGo === true ? await suiteRestoreMainPins(io) : void 0;
+        marked = await suiteMarkAbandoned(io, o.ownerGo === true);
         result = suiteAbandon(io.recordPath, o.ownerGo === true);
       } finally {
         await unlock();
@@ -47216,6 +47305,7 @@ function registerSuiteCommands(program3) {
         `suite abandon: archived the cut record to ${result.archive}`,
         ...result.orphanTags.length ? ["  member rc tags left in place (immutable; the next cut reuses one still unreleased on its rc head, #7450):", ...result.orphanTags.map((t) => `  - ${t}`)] : ["  no member rc tag was minted"],
         ...restored ? [`  main pins the cut planned for unreleased tags are restored by ${restored.pr} (${restored.status}, #7758)`] : [],
+        ...marked.length ? [`  marked abandoned on origin, so the hotfix guard stops counting them as active (#7801): ${marked.join(", ")}`] : [],
         "  the next suite rcand --owner-go re-snapshots every member"
       ].join("\n"));
     } catch (e) {
@@ -47734,7 +47824,6 @@ Next command: ${report.nextCommand}`);
 var RESTART_LINE = "\u21BB Restart Claude to finish.";
 var HOST_RESTART_LINES = {
   codex: "\u21BB Restart Codex to finish.",
-  cursor: "\u21BB Restart Cursor to finish.",
   jervcode: "\u21BB Restart JervCode to finish."
 };
 function restartLineForHost(host) {
@@ -47966,92 +48055,6 @@ var surfaces_default = {
         "Hosted tools and disabled or untrusted hooks bypass local enforcement."
       ]
     },
-    {
-      token: "cursor",
-      displayName: "Cursor",
-      lifecycle: "active",
-      artifactIds: [
-        "mmi-cursor-plugin",
-        "mmi-skills",
-        "mmi-cli"
-      ],
-      plannedArtifactIds: [],
-      assembly: {
-        mode: "package-directory",
-        rootPath: "packages/cursor-plugin",
-        sync: [
-          {
-            mode: "directories",
-            sourcePath: "skills",
-            targetPath: "packages/cursor-plugin/skills"
-          },
-          {
-            mode: "files",
-            sourcePath: "bin",
-            targetPath: "packages/cursor-plugin/bin",
-            include: [
-              "mmi-cli",
-              "mmi-cli.cmd"
-            ]
-          },
-          {
-            mode: "files",
-            sourcePath: "cli",
-            targetPath: "packages/cursor-plugin/cli",
-            include: [
-              "dist/index.cjs",
-              "dist/main.cjs",
-              "package.json"
-            ]
-          },
-          {
-            mode: "files",
-            sourcePath: ".cursor-plugin",
-            targetPath: "packages/cursor-plugin/.cursor-plugin",
-            include: [
-              "plugin.json"
-            ]
-          }
-        ]
-      },
-      install: {
-        mechanism: "github-source",
-        locator: "~/.cursor/plugins/local/mmi"
-      },
-      upgrade: {
-        mechanism: "reinstall",
-        reload: "workspace"
-      },
-      skills: {
-        delivery: "plugin",
-        sourceSurfaceId: "mmi-skills",
-        artifactId: "mmi-skills",
-        invocation: {
-          entry: "/epic",
-          any: "/<skill>"
-        }
-      },
-      cli: {
-        delivery: "standalone",
-        artifactId: "mmi-cli"
-      },
-      ownership: {
-        trust: "host",
-        cache: "mmi-hub",
-        repair: "mmi-hub"
-      },
-      certification: {
-        hostCommand: "cursor-agent",
-        versionArgs: [
-          "--version"
-        ]
-      },
-      enforcementCeilings: [
-        "Cursor can replace MCP results only; it cannot rewrite ordinary tool output after execution, though MMI still detects secret-shaped output.",
-        "Final assistant output is outside Cursor hook control.",
-        "Cloud agents do not run sessionStart or sessionEnd hooks, and disabled plugins or untrusted workspaces enforce nothing."
-      ]
-    },
     {
       token: "jervcode",
       displayName: "JervCode",
@@ -48281,38 +48284,6 @@ var surfaces_default = {
       },
       publishVisibility: "public"
     },
-    {
-      id: "mmi-cursor-plugin",
-      classification: "packaging",
-      kind: "plugin",
-      ownerPath: "packages/cursor-plugin/package.json",
-      deliveryPath: "packages/cursor-plugin/package.json",
-      delivery: "npm",
-      applicability: "Cursor IDE and Cursor Agent CLI; npm package @mutmutco/cursor-plugin carrying the plugin manifest and skills. The managed checkout at ~/.cursor/plugins/local/mmi is switched to each release by the fleet updater (#4945).",
-      versionCoordinated: true,
-      surfaceToken: "cursor",
-      versionPaths: [
-        {
-          path: ".cursor-plugin/plugin.json",
-          pointer: "version"
-        },
-        {
-          path: "packages/cursor-plugin/package.json",
-          pointer: "version"
-        }
-      ],
-      additionalPaths: [
-        "packages/cursor-plugin/.cursor-plugin",
-        "packages/cursor-plugin/skills",
-        "packages/cursor-plugin/bin",
-        "packages/cursor-plugin/cli"
-      ],
-      artifactIdentity: {
-        kind: "npm-pack",
-        packagePath: "packages/cursor-plugin"
-      },
-      publishVisibility: "public"
-    },
     {
       id: "mmi-claude-marketplace",
       classification: "delivery",
@@ -48604,7 +48575,7 @@ var surfaces_default = {
 };
 
 // src/surface-doctor.ts
-var TOKENS = /* @__PURE__ */ new Set(["claude", "codex", "cursor", "jervcode", "hermes"]);
+var TOKENS = /* @__PURE__ */ new Set(["claude", "codex", "jervcode", "hermes"]);
 function isActiveToken(value) {
   return TOKENS.has(value);
 }
@@ -50511,20 +50482,12 @@ async function readOrFail(read) {
 async function defaultRegistryRead() {
   return fetchSchedulesList(registryClientDeps(await loadConfig()));
 }
-async function defaultRunVerdictRead() {
-  return fetchRunVerdicts(registryClientDeps(await loadConfig()));
-}
-function modelRoleKeyOf(row) {
-  const model = row.model;
-  return typeof model === "string" && model.trim() ? model : void 0;
-}
-async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defaultRegistryRead, readProjects = defaultProjectsRead, readRunVerdicts = defaultRunVerdictRead) {
-  const [gh2, aws, registryRead, projectsRead, runVerdictRead] = await Promise.all([
+async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defaultRegistryRead, readProjects = defaultProjectsRead) {
+  const [gh2, aws, registryRead, projectsRead] = await Promise.all([
     githubEntries(client),
     awsEntries(),
     readOrFail(readRegistry),
-    readOrFail(readProjects),
-    readOrFail(readRunVerdicts)
+    readOrFail(readProjects)
   ]);
   const readFailures = [];
   if (registryRead.state === "failed") {
@@ -50534,16 +50497,10 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
     readFailures.push(`registry: could not read the projects list \u2014 schedulesMode opt-outs unresolved (nothing suppressed) \u2014 ${projectsRead.error}`);
   }
   const registry2 = registryRead.state === "ok" ? registryRead.value : null;
-  const runVerdicts = runVerdictRead.state === "ok" ? runVerdictRead.value : null;
   const projects = projectsRead.state === "ok" ? projectsRead.value : null;
-  const decoratedAws = decorateAwsModel(
-    aws.entries,
-    registry2?.map((r) => ({ id: r.id, executor: r.executor, model: modelRoleKeyOf(r) })) ?? null,
-    runVerdicts
-  );
   const recon = assembleReconciliation(gh2.entries, new Set(gh2.readRepos), registry2, new Set(gh2.workflowNames), {
     // #3286: the harbour side joins registry rows against the live aws-scheduler clocks by scheduleId.
-    awsEntries: decoratedAws,
+    awsEntries: aws.entries,
     schedulerRead: Boolean(aws.schedulerRead)
   }, new Set(gh2.disabledWorkflowNames));
   const selfManaged = /* @__PURE__ */ new Set();
@@ -50557,7 +50514,7 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
   );
   const driftLines = reconciliation.map(renderDrift);
   return {
-    entries: sortEntries([...gh2.entries, ...decoratedAws, ...DECLARED_ENTRIES]),
+    entries: sortEntries([...gh2.entries, ...aws.entries, ...DECLARED_ENTRIES]),
     incomplete: [...gh2.incomplete, ...aws.incomplete, ...recon.incomplete, ...readFailures],
     drift: driftLines,
     reconciliation,
@@ -53282,7 +53239,7 @@ projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one
   }
   if (!result.ok) return failGraceful(`org project deploy retire: ${result.error ?? "read failed"}`);
 });
-project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").addOption(new Option("--class <class>", "deployable | content").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", 'read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets). SHAPE: a JSON object keyed by env name, each entry {"key":"UPPER_SNAKE" (repeat the env name), "purpose":"<non-empty>", "group":"<e.g. auth|database>", "owner":"<github login>", "stages":[] (empty = the one stageless shared value; else any of dev/rc/main), "consumers":["runtime"|"box"|?], "provider":"<optional>"}').option("--unset-secret <KEY...>", "remove exactly these #2244 catalog entries (repeatable; KEY or KEY@dev|rc|main). Refuses while a stage still requires the key \u2014 drop it from requiredRuntimeSecrets/requiredBuildSecrets first").option("--confirm-clear-secrets", "required to let --unset secrets wipe the WHOLE catalog (the refusal names how many entries that removes)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets (the WHOLE catalog \u2014 needs --confirm-clear-secrets), edgeDomains, requiredGcpApis, publishRequired, releaseChannel, releaseLanguage").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set [owner/repo]").description("upsert project META (idempotent merge; master-gated)").addOption(new Option("--class <class>", "deployable | content").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--var <KEY=VALUE...>", settableVarHelp()).option("--set <KEY=VALUE...>", "alias of --var (one KEY=VALUE per flag; repeat the flag to set several)").option("--secrets-file <path>", 'read the #2244 secrets catalog map (JSON) from a file and merge it per entry into the existing catalog (drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets). SHAPE: a JSON object keyed by env name, each entry {"key":"UPPER_SNAKE" (repeat the env name), "purpose":"<non-empty>", "group":"<e.g. auth|database>", "owner":"<github login>", "stages":[] (empty = the one stageless shared value; else any of dev/rc/main), "consumers":["runtime"|"box"|?], "provider":"<optional>"}').option("--unset-secret <KEY...>", "remove exactly these #2244 catalog entries (repeatable; KEY or KEY@dev|rc|main). Refuses while a stage still requires the key \u2014 drop it from requiredRuntimeSecrets/requiredBuildSecrets first").option("--unset-task <NAME...>", "retire exactly these tenant tasks (repeatable; lowercase kebab-case names). Refuses a name that is not declared. tenantTasks merges per entry and is capped at 20 stored in total").option("--confirm-clear-secrets", "required to let --unset secrets wipe the WHOLE catalog (the refusal names how many entries that removes)").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, requiredBuildSecrets, secrets (the WHOLE catalog \u2014 needs --confirm-clear-secrets), edgeDomains, requiredGcpApis, publishRequired, releaseChannel, releaseLanguage").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -53313,6 +53270,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
       vars,
       unsets: o.unset ?? [],
       unsetSecrets: o.unsetSecret ?? [],
+      unsetTasks: o.unsetTask ?? [],
       clearWebProfile: Boolean(o.clearWebProfile)
     });
   } catch (e) {
@@ -53323,6 +53281,8 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (clearRefusal) return fail(clearRefusal);
   const removalRefusal = secretRemovalRefusal(existing, patch);
   if (removalRefusal) return fail(removalRefusal);
+  const taskRefusal = tenantTaskWriteRefusal(existing, patch);
+  if (taskRefusal) return fail(taskRefusal);
   const boardError = boardLinkWriteError(patch, existing);
   if (boardError) return fail(`org project set: ${boardError}`);
   const res = await upsertProject(slug, { ...patch, repo }, registryClientDeps(cfg));