@mutmutco/codex-plugin 4.6.11 → 4.6.12

package/cli/dist/main.cjs

@@ -1409,13 +1409,7 @@ async function ghFilingAppEnv(file, args, requireApp = false) {
   if (!ghWriteTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || !requireApp && process.env.MMI_ACTOR?.trim() === "personal") return void 0;
   if (!isAppFilingWrite(args)) return void 0;
   const explicitApp = requireApp || process.env.MMI_ACTOR?.trim() === "app";
-  let token;
-  try {
-    token = await ghWriteTokenProvider();
-  } catch (e) {
-    if (explicitApp) throw e;
-    return void 0;
-  }
+  const token = await ghWriteTokenProvider();
   if (!token && explicitApp) {
     throw new Error("app actor: filing write token unavailable \u2014 refusing personal-token fallback under MMI_ACTOR=app");
   }
@@ -1642,7 +1636,7 @@ var init_cli_shared = __esm({
       try {
         return await tag(run(appEnv), "app_installation");
       } catch (e) {
-        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), ambient);
+        if (!reportsCredential && shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), ambient);
         throw e;
       }
     };
@@ -13512,7 +13506,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs64 = require("node:fs");
+var import_node_fs65 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 
@@ -15129,8 +15123,8 @@ function resolveVerbAliasShim(argv) {
 }
 
 // src/command-composition.ts
-var import_node_os27 = require("node:os");
-var import_node_path61 = require("node:path");
+var import_node_os28 = require("node:os");
+var import_node_path62 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs18 = require("node:fs");
@@ -16084,6 +16078,14 @@ async function pollToken() {
   });
   return pollTokenOnce;
 }
+async function refreshPollToken() {
+  if (process.env.MMI_ACTOR?.trim() === "personal" || !pollTokenProvider) return void 0;
+  pollTokenOnce = pollTokenProvider({ fresh: true }).catch((e) => {
+    if (e instanceof AppActorError && e.code === "mint-failed") throw e;
+    return void 0;
+  });
+  return pollTokenOnce;
+}
 async function ghReadEnv() {
   const appToken = await pollToken();
   return appToken ? { ...process.env, GH_TOKEN: appToken, MMI_GH_POOL: "app" } : void 0;
@@ -25439,11 +25441,25 @@ function createDocsIndexDeps(repoRoot2) {
 }
 
 // src/gate-budget.ts
-var BLESSED_RUN_WITH_BUDGET_SHA = "5ce541add569e54e7ca96de67a768577d3d604e4";
+var gate_budget_exports = {};
+__export(gate_budget_exports, {
+  BLESSED_JEV_FAILURES_SHA: () => BLESSED_JEV_FAILURES_SHA,
+  BLESSED_KIT_AGENT_FILES_SHA: () => BLESSED_KIT_AGENT_FILES_SHA,
+  BLESSED_RUNBOOK_GUARD_SHA: () => BLESSED_RUNBOOK_GUARD_SHA,
+  BLESSED_RUNNER_CHOICE_SHA: () => BLESSED_RUNNER_CHOICE_SHA,
+  BLESSED_RUNNER_GATE_SHA: () => BLESSED_RUNNER_GATE_SHA,
+  BLESSED_RUN_WITH_BUDGET_SHA: () => BLESSED_RUN_WITH_BUDGET_SHA,
+  BLESSED_VERDICT_RECEIPT_SHA: () => BLESSED_VERDICT_RECEIPT_SHA,
+  MAX_SECONDS_CEILING: () => MAX_SECONDS_CEILING,
+  checkGateBudget: () => checkGateBudget,
+  isGateWorkflowPath: () => isGateWorkflowPath
+});
+var BLESSED_RUN_WITH_BUDGET_SHA = "cb31a94c89729beac83500ad4d301132dcfe2e4c";
 var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
 var BLESSED_KIT_AGENT_FILES_SHA = "e976df208d891b215844386c1cac0f161946b6fa";
 var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
-var BLESSED_RUNNER_CHOICE_SHA = "";
+var BLESSED_VERDICT_RECEIPT_SHA = "";
+var BLESSED_RUNNER_CHOICE_SHA = "f6b691f966611ec2a3b688c74c92a92f23133f41";
 var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
@@ -25828,7 +25844,10 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     GATE_SERVICES_YAML: "",
     GATE_EXTRA_STEPS_YAML: "",
     // #9293: Jev failure-memory fetch/report steps from the blessed jev-failures pin (an empty pin renders none).
-    ...gateJevStepsYaml(BLESSED_JEV_FAILURES_SHA, runtime)
+    ...gateJevStepsYaml(BLESSED_JEV_FAILURES_SHA, runtime),
+    // Org CI H1: exact-SHA verdict receipt from the blessed verdict-receipt pin (an empty pin renders the legacy #8206 rc-tag step).
+    GATE_VERDICT_SHA: BLESSED_VERDICT_RECEIPT_SHA,
+    GATE_VERDICT_STEP_YAML: gateVerdictStepYaml(BLESSED_VERDICT_RECEIPT_SHA)
   };
   const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
   const trackBranches = track === "trunk" ? ["main"] : track === "single" ? ["development"] : track === "direct" ? ["development", "main"] : ["development", "rc", "main"];
@@ -25977,6 +25996,47 @@ function gateServicesYaml(services) {
   }
   return out;
 }
+var LEGACY_RC_REUSE_STEP_YAML = String.raw`
+      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
+      - name: Reuse development gate for rc tag
+        id: development-gate
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        with:
+          script: |
+            core.setOutput('reuse', 'false');
+            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
+            try {
+              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
+              const { data } = await github.rest.actions.listWorkflowRuns({
+                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
+                event: 'push', head_sha: context.sha, per_page: 100
+              });
+              // API returns newest first: a newer red/pending rerun must not reuse an older green.
+              const run = data.workflow_runs[0];
+              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
+                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
+              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
+                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
+              });
+              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
+              core.setOutput('reuse', 'true');
+              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
+            } catch (error) {
+              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
+            }`;
+function gateVerdictStepYaml(sha) {
+  if (!/^[0-9a-f]{40}$/.test(sha)) return LEGACY_RC_REUSE_STEP_YAML;
+  return [
+    "\n      # Org CI H1: exact-SHA verdict receipt. Any missing or partial proof reports reuse=false and the gate runs.",
+    "\n      - name: Reuse the exact-SHA gate verdict",
+    "\n        id: development-gate",
+    "\n        if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/{{GATE_FULL_RUN_BRANCH}}' || (startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-rc.'))) }}",
+    "\n        uses: mutmutco/MMI-Hub/.github/actions/verdict-receipt@{{GATE_VERDICT_SHA}}",
+    "\n        with:",
+    "\n          source: ${{ github.ref_type == 'tag' && 'push' || 'merge_group' }}",
+    "\n          queue-is-full-verdict: 'true'"
+  ].join("");
+}
 function gateJevStepsYaml(sha, runtime = "node") {
   if (!/^[0-9a-f]{40}$/.test(sha)) return { GATE_JEV_FETCH_YAML: "", GATE_JEV_REPORT_YAML: "" };
   const listFiles = runtime === "python" ? `git ls-files -z -- 'test_*.py' '*_test.py' | python3 -c "import sys,json;print(json.dumps([p for p in sys.stdin.read().split(chr(0)) if p]))" > .jerv/jev-test-files.json` : `git ls-files -z -- '*.test.*' '*.spec.*' | node -e "process.stdout.write(JSON.stringify(require('fs').readFileSync(0,'utf8').split('\\0').filter(Boolean)))" > .jerv/jev-test-files.json`;
@@ -27605,10 +27665,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.11",
-    tag: "v4.6.11",
-    commit: "cb31a94c8972",
-    npm: "@mutmutco/cli@4.6.11"
+    version: "4.6.12",
+    tag: "v4.6.12",
+    commit: "9d7baf6ad8c7",
+    npm: "@mutmutco/cli@4.6.12"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27625,14 +27685,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.11"
+          v3Target: "v4.6.12"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.11 and redeploy the Hub Lambda from tag v4.6.11 (cb31a94c8972); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.11 (@mutmutco/cli@4.6.11, tag commit cb31a94c8972 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.12 and redeploy the Hub Lambda from tag v4.6.12 (9d7baf6ad8c7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.12 (@mutmutco/cli@4.6.12, tag commit 9d7baf6ad8c7 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -38671,6 +38731,385 @@ async function runPipelineWithBump(bump, mode, input) {
   return { ...await runTrainApplyPipeline(mode, input), bump };
 }
 
+// src/hub-action-pins.ts
+var import_node_crypto11 = require("node:crypto");
+var import_node_fs32 = require("node:fs");
+var import_node_os17 = require("node:os");
+var import_node_path29 = require("node:path");
+
+// src/bootstrap-propagate.ts
+function archivedWaiver(repoMeta) {
+  return repoMeta?.archived === true ? "archived repository (read-only)" : void 0;
+}
+function assertPropagationCoverage(rosterCount, independentRegistryCount) {
+  if (rosterCount === 0) {
+    throw new Error("bootstrap propagate: roster read 0 repos \u2014 refusing to report a plan from a roster this command could not establish (#4232 coverage invariant)");
+  }
+  if (rosterCount < independentRegistryCount) {
+    throw new Error(
+      `bootstrap propagate: roster read ${rosterCount} repo(s) but the independent registry count is ${independentRegistryCount} \u2014 this read did not cover the fleet (#4232 coverage invariant)`
+    );
+  }
+}
+function assignWaves(repos, canarySlug) {
+  const waves = /* @__PURE__ */ new Map();
+  if (!canarySlug) return waves;
+  const rest = repos.filter((r) => r.slug !== canarySlug).slice().sort((a, b) => a.slug < b.slug ? -1 : a.slug > b.slug ? 1 : 0);
+  const canary = repos.find((r) => r.slug === canarySlug);
+  if (canary) waves.set(canary.repo, 0);
+  const wave1Count = Math.ceil(rest.length * 0.25);
+  rest.forEach((r, i) => waves.set(r.repo, i < wave1Count ? 1 : 2));
+  return waves;
+}
+function statusFor(read, currentSha) {
+  if (!read) return { status: "pending", record: {} };
+  if (read.drift === "match") return { status: "match", record: { mergeSha: read.pr?.mergeSha } };
+  if (read.prUnread) return { status: "red", record: {} };
+  const pr = read.pr;
+  if (!pr) return { status: "pending", record: {} };
+  if (pr.sourceSha && pr.sourceSha !== currentSha) return { status: "pending", record: {} };
+  if (pr.state === "closed") return { status: "closed-unmerged", record: { prNumber: pr.number, prUrl: pr.url } };
+  if (pr.checks === "red") return { status: "red", record: { prNumber: pr.number, prUrl: pr.url } };
+  return { status: "open-pending", record: { prNumber: pr.number, prUrl: pr.url, mergeSha: pr.mergeSha } };
+}
+var HALTING_STATUSES = /* @__PURE__ */ new Set(["red", "closed-unmerged"]);
+function planPropagationTick(input) {
+  const { target, repos, canarySlug, reads, isWorkflowSeed, functionGateSatisfied, currentSha } = input;
+  const sourcePilot = input.sourcePilot === true;
+  const readByRepo = new Map(reads.map((r) => [r.repo, r]));
+  const records = [];
+  const opened = [];
+  const waived = repos.filter((r) => r.waiver);
+  for (const r of waived) {
+    records.push({ repo: r.repo, target, wave: null, status: "skipped-waived", action: "none", detail: `waived: ${r.waiver}` });
+  }
+  const eligible = repos.filter((r) => !r.waiver);
+  const refusedNoCanary = !canarySlug || !sourcePilot && !eligible.some((r) => r.slug === canarySlug);
+  if (refusedNoCanary) {
+    for (const r of eligible) {
+      records.push({ repo: r.repo, target, wave: null, status: "not-yet-reached", action: "none", detail: "no canary declared for this target \u2014 refusing to plan any wave (#4238 canary requirement)" });
+    }
+    return { target, reposInScope: repos.length, canary: null, refusedNoCanary: true, halted: false, haltReason: null, opened, records };
+  }
+  const waveOf = assignWaves(eligible, canarySlug);
+  const byWave = { 0: [], 1: [], 2: [] };
+  for (const r of eligible) byWave[waveOf.get(r.repo) ?? 2].push(r);
+  let halted = false;
+  let haltReason = null;
+  let waveGateOpen = !(sourcePilot && isWorkflowSeed && !functionGateSatisfied);
+  for (const waveNum of [0, 1, 2]) {
+    const waveRepos = byWave[waveNum];
+    if (!waveRepos.length) continue;
+    if (!waveGateOpen || halted) {
+      for (const r of waveRepos) {
+        records.push({ repo: r.repo, target, wave: waveNum, status: "not-yet-reached", action: "none", detail: "prior wave not yet converged" });
+      }
+      continue;
+    }
+    let waveAllMatch = true;
+    let waveHasRed = false;
+    let waveHasClosed = false;
+    for (const r of waveRepos) {
+      const { status, record: record2 } = statusFor(readByRepo.get(r.repo), currentSha);
+      const shouldOpen = status === "pending" || status === "closed-unmerged";
+      if (shouldOpen) opened.push(r.repo);
+      records.push({
+        repo: r.repo,
+        target,
+        wave: waveNum,
+        status,
+        action: shouldOpen ? "open-pr" : "none",
+        detail: status === "closed-unmerged" ? `previous PR#${record2.prNumber} was closed unmerged and no open PR replaced it \u2014 opening a replacement against the live base this tick (#9232)` : status === "pending" ? "no open propagation PR and not yet matching \u2014 opening this tick" : status,
+        ...record2
+      });
+      if (status !== "match") waveAllMatch = false;
+      if (HALTING_STATUSES.has(status)) waveHasRed = true;
+      if (status === "closed-unmerged") waveHasClosed = true;
+    }
+    if (waveHasRed) {
+      halted = true;
+      haltReason = `wave ${waveNum} has a red or closed-unmerged PR \u2014 halting; no further wave opens (#4238 halt-and-alarm)` + (waveHasClosed ? "; the closed PR(s) were re-opened against the live base this tick (#9232) \u2014 land or close the replacement to advance" : "");
+      waveGateOpen = false;
+      continue;
+    }
+    if (waveNum === 0 && isWorkflowSeed && !functionGateSatisfied) {
+      waveGateOpen = false;
+      continue;
+    }
+    waveGateOpen = waveAllMatch;
+  }
+  return { target, reposInScope: repos.length, canary: canarySlug, refusedNoCanary: false, halted, haltReason, opened, records };
+}
+function summarizePropagationTick(plan) {
+  const parts = [];
+  parts.push(plan.opened.length ? `opened ${plan.opened.length} PR(s) this tick: ${plan.opened.join(", ")}` : "opened no PR this tick");
+  const stillNotCurrent = plan.records.filter((r) => r.status !== "match" && r.status !== "skipped-waived" && r.action !== "open-pr");
+  parts.push(stillNotCurrent.length ? `not current and not opened this tick: ${stillNotCurrent.map((r) => `${r.repo} (${r.status})`).join(", ")}` : "every in-scope repo either matches the Hub seed or had a PR opened this tick");
+  if (plan.halted) parts.push(`HALTED \u2014 ${plan.haltReason}`);
+  return parts.join("; ");
+}
+function renderPropagationReport(plan) {
+  const lines2 = [`bootstrap propagate \u2014 target ${plan.target}: ${plan.reposInScope} repo(s) in scope, canary=${plan.canary ?? "NONE"}`];
+  if (plan.refusedNoCanary) {
+    lines2.push("  REFUSED \u2014 no canary declared for this target; plan every repo not-yet-reached");
+    lines2.push(`  ${summarizePropagationTick(plan)}`);
+    return lines2.join("\n");
+  }
+  for (const r of plan.records) {
+    const wave = r.wave == null ? "-" : String(r.wave);
+    lines2.push(`  wave${wave.padEnd(2)} ${r.status.padEnd(16)} ${r.repo}${r.prNumber ? ` PR#${r.prNumber}` : ""} \u2014 ${r.detail}`);
+  }
+  lines2.push(`  ${summarizePropagationTick(plan)}`);
+  return lines2.join("\n");
+}
+
+// src/bootstrap-propagation-identity.ts
+var import_node_crypto10 = require("node:crypto");
+var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
+var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
+function safeBranchPart(value, maxLength, fallback) {
+  const safe = value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLength).replace(/-+$/g, "");
+  return safe || fallback;
+}
+function repoSlug2(repo) {
+  return repo.trim().split("/").pop()?.toLowerCase() || "repo";
+}
+function propagationBranch(repo, target) {
+  const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
+  const targetPart = safeBranchPart(target, 48, "target");
+  const hash = (0, import_node_crypto10.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
+}
+function legacyPropagationBranch(repo) {
+  return `${PROPAGATION_BRANCH_PREFIX}${repoSlug2(repo)}`;
+}
+function renderPropagationTargetMarker(target) {
+  return `<!-- ${TARGET_MARKER_NAME}: ${JSON.stringify(target)} -->`;
+}
+function targetMarkers(body) {
+  const present = body.includes(`${TARGET_MARKER_NAME}:`);
+  const targets = [];
+  const marker = new RegExp(`<!--\\s*${TARGET_MARKER_NAME}:\\s*(.*?)\\s*-->`, "g");
+  for (const match of body.matchAll(marker)) {
+    try {
+      const parsed = JSON.parse(match[1]);
+      if (typeof parsed === "string") targets.push(parsed);
+    } catch {
+    }
+  }
+  return { present, targets };
+}
+function canonicalProseTargets(body) {
+  const targets = [];
+  const command = /bootstrap propagate --target (.+?) --execute`/g;
+  const prose = /(?:org-owned copy of|declared marker-bounded block inside repo-owned) `([^`]+)` — the file this PR carries and nothing else/g;
+  for (const match of body.matchAll(command)) targets.push(match[1]);
+  for (const match of body.matchAll(prose)) targets.push(match[1]);
+  return targets;
+}
+function propagationPrMatchesTarget(pr, target, identity) {
+  const body = pr.body ?? "";
+  const markers = targetMarkers(body);
+  if (markers.present) {
+    if (markers.targets.length !== 1 || markers.targets[0] !== target) return false;
+    return !pr.files?.length || pr.files.length === 1 && pr.files[0] === target;
+  }
+  if (identity === "target-specific") return false;
+  const proseTargets = canonicalProseTargets(body);
+  if (proseTargets.some((candidate) => candidate !== target)) return false;
+  if (pr.files?.length) {
+    return pr.files.length === 1 && pr.files[0] === target;
+  }
+  return proseTargets.length > 0;
+}
+function propagationPrCandidatesForTarget(target, targetSpecificPrs, legacyPrs) {
+  const targetSpecific = targetSpecificPrs.filter((pr) => propagationPrMatchesTarget(pr, target, "target-specific"));
+  if (targetSpecific.length) return targetSpecific;
+  return legacyPrs.filter((pr) => propagationPrMatchesTarget(pr, target, "legacy"));
+}
+
+// src/hub-action-pins.ts
+var PIN_TARGET = "hub-action-pins";
+var HUB_REPO4 = "mutmutco/MMI-Hub";
+var FULL_SHA2 = /^[0-9a-f]{40}$/;
+var PIN_ACTION_ALIASES = {
+  BLESSED_RUNNER_GATE_SHA: ["runner-checkout", "runner-node-toolchain"],
+  BLESSED_KIT_AGENT_FILES_SHA: ["check-kit-agent-files"]
+};
+function blessedHubActionPins(constants = gate_budget_exports) {
+  const pins = /* @__PURE__ */ new Map();
+  for (const [name, sha] of Object.entries(constants)) {
+    const m = /^BLESSED_([A-Z0-9_]+)_SHA$/.exec(name);
+    if (!m || typeof sha !== "string" || !FULL_SHA2.test(sha)) continue;
+    for (const action of PIN_ACTION_ALIASES[name] ?? [m[1].toLowerCase().replace(/_/g, "-")]) pins.set(action, sha);
+  }
+  return pins;
+}
+function pinTableDigest(pins) {
+  return (0, import_node_crypto11.createHash)("sha1").update([...pins].map(([a, s]) => `${a}@${s}`).sort().join("\n")).digest("hex");
+}
+var HUB_ACTION_USE = /^(\s*-?\s*uses:\s*['"]?mutmutco\/mmi-hub\/\.github\/actions\/)([\w.-]+)@([^\s'"#]+)([^\n]*)$/i;
+function staleHubActionPins(body, pins = blessedHubActionPins()) {
+  const stale = [];
+  body.split("\n").forEach((text, i) => {
+    const m = HUB_ACTION_USE.exec(text);
+    const to = m ? pins.get(m[2]) : void 0;
+    if (!m || !to || m[3] === to || !(m[3] === "development" || FULL_SHA2.test(m[3]))) return;
+    stale.push({ line: i + 1, action: m[2], from: m[3], to });
+  });
+  return stale;
+}
+function rewriteHubActionPins(body, pins = blessedHubActionPins(), keep = () => false) {
+  const changes = staleHubActionPins(body, pins).filter((use) => !keep(use));
+  const lines2 = body.split("\n");
+  for (const c of changes) {
+    lines2[c.line - 1] = lines2[c.line - 1].replace(HUB_ACTION_USE, (_all, pre, action, _ref, rest) => `${pre}${action}@${c.to}${rest}`);
+  }
+  return { body: lines2.join("\n"), changes };
+}
+var ghJson = async (gh2, args) => JSON.parse((await gh2(args)).stdout || "null");
+var pinPathEnc = (p) => p.split("/").map(encodeURIComponent).join("/");
+async function readPinFile(gh2, repo, path2, ref) {
+  const f = await ghJson(gh2, ["api", `repos/${repo}/contents/${pinPathEnc(path2)}?ref=${encodeURIComponent(ref)}`]);
+  return f?.encoding === "base64" && typeof f.content === "string" ? { body: decodeGitHubContents(f.content), sha: f.sha } : null;
+}
+async function runPinTick(input) {
+  const { gh: gh2, repos } = input;
+  const pins = input.pins ?? blessedHubActionPins();
+  const digest = pinTableDigest(pins);
+  const ahead = /* @__PURE__ */ new Map();
+  const isAhead = (use) => {
+    if (!FULL_SHA2.test(use.from)) return Promise.resolve(false);
+    const key = `${use.to}...${use.from}`;
+    if (!ahead.has(key)) ahead.set(key, gh2(["api", `repos/${HUB_REPO4}/compare/${key}`, "--jq", ".status"]).then((o) => o.stdout.trim() === "ahead", () => false));
+    return ahead.get(key);
+  };
+  const keepSet = /* @__PURE__ */ new Set();
+  const keep = (use) => keepSet.has(`${use.to}...${use.from}`);
+  const reads = [];
+  const diffs = [];
+  for (const r of repos) {
+    if (r.waiver) continue;
+    const base = input.baseBranchOf(r.repo);
+    let listing = [];
+    try {
+      listing = await ghJson(gh2, ["api", `repos/${r.repo}/contents/.github/workflows?ref=${encodeURIComponent(base)}`]) ?? [];
+    } catch (e) {
+      if (!/HTTP 404|Not Found/i.test(e.message)) {
+        reads.push({ repo: r.repo, drift: "drift", prUnread: true });
+        continue;
+      }
+    }
+    const files = [];
+    for (const entry of listing) {
+      if (entry.type !== "file" || !entry.path || !/\.ya?ml$/.test(entry.path)) continue;
+      const file = await readPinFile(gh2, r.repo, entry.path, base);
+      if (!file) continue;
+      for (const use of staleHubActionPins(file.body, pins)) if (await isAhead(use)) keepSet.add(`${use.to}...${use.from}`);
+      const { changes } = rewriteHubActionPins(file.body, pins, keep);
+      if (changes.length) files.push({ path: entry.path, changes });
+    }
+    if (files.length) diffs.push({ repo: r.repo, files });
+    let pr;
+    let prUnread = false;
+    try {
+      const listed = await ghJson(gh2, ["pr", "list", "--repo", r.repo, "--head", propagationBranch(r.repo, PIN_TARGET), "--base", base, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit,body", "--limit", "100"]) ?? [];
+      const p = propagationPrCandidatesForTarget(PIN_TARGET, listed, [])[0];
+      if (p) {
+        const rollup = p.statusCheckRollup ?? [];
+        const checks = rollup.length === 0 ? "none" : rollup.some((c) => c.conclusion === "FAILURE" || c.state === "FAILURE") ? "red" : rollup.every((c) => c.conclusion === "SUCCESS" || c.state === "SUCCESS") ? "success" : "pending";
+        pr = {
+          number: p.number,
+          url: p.url,
+          checks,
+          mergeSha: p.mergeCommit?.oid,
+          state: p.state === "MERGED" ? "merged" : p.state === "CLOSED" ? "closed" : "open",
+          sourceSha: p.body?.match(/Hub action pins ([0-9a-f]{40})/)?.[1]
+        };
+      }
+    } catch {
+      prUnread = true;
+    }
+    reads.push({ repo: r.repo, drift: files.length ? "drift" : "match", pr, prUnread });
+  }
+  const plan = planPropagationTick({
+    target: PIN_TARGET,
+    repos,
+    canarySlug: input.canarySlug,
+    reads,
+    isWorkflowSeed: false,
+    functionGateSatisfied: true,
+    currentSha: digest,
+    sourcePilot: input.sourcePilot
+  });
+  if (!input.apply || plan.refusedNoCanary) return { plan, digest, diffs };
+  for (const rec of plan.records) {
+    if (rec.action !== "open-pr") continue;
+    const diff = diffs.find((d) => d.repo === rec.repo);
+    if (!diff) continue;
+    const base = input.baseBranchOf(rec.repo);
+    const branch = propagationBranch(rec.repo, PIN_TARGET);
+    const baseSha = (await gh2(["api", `repos/${rec.repo}/git/ref/heads/${base}`, "--jq", ".object.sha"])).stdout.trim();
+    let branchExists = true;
+    try {
+      await gh2(["api", `repos/${rec.repo}/git/ref/heads/${branch}`]);
+    } catch {
+      branchExists = false;
+    }
+    if (!branchExists) await gh2(["api", `repos/${rec.repo}/git/refs`, "-f", `ref=refs/heads/${branch}`, "-f", `sha=${baseSha}`]);
+    else await gh2(["api", "-X", "PATCH", `repos/${rec.repo}/git/refs/heads/${branch}`, "-f", `sha=${baseSha}`, "-F", "force=true"]);
+    const lines2 = [];
+    for (const { path: path2 } of diff.files) {
+      const file = await readPinFile(gh2, rec.repo, path2, branch);
+      if (!file) continue;
+      const next = rewriteHubActionPins(file.body, pins, keep);
+      if (!next.changes.length) continue;
+      lines2.push(...next.changes.map((c) => `- \`${path2}:${c.line}\` ${c.action}: \`${c.from.slice(0, 12)}\` \u2192 \`${c.to.slice(0, 12)}\``));
+      const tmp = (0, import_node_path29.join)((0, import_node_os17.tmpdir)(), `mmi-pin-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const put = { message: `ci: pin MMI-Hub actions in ${path2} to the blessed SHAs`, content: encodeGitHubContents(next.body), branch };
+      if (file.sha) put.sha = file.sha;
+      (0, import_node_fs32.writeFileSync)(tmp, JSON.stringify(put), "utf8");
+      try {
+        await gh2(["api", "-X", "PUT", `repos/${rec.repo}/contents/${pinPathEnc(path2)}`, "--input", tmp]);
+      } finally {
+        try {
+          (0, import_node_fs32.unlinkSync)(tmp);
+        } catch {
+        }
+      }
+    }
+    if (!lines2.length) continue;
+    const body = `Auto-opened by \`mmi-cli devops bootstrap propagate --pins --apply\` (org CI plan H4), wave ${rec.wave}.
+
+Moves each \`mutmutco/MMI-Hub/.github/actions/<x>\` pin in \`.github/workflows\` to the blessed SHA from MMI-Hub \`cli/src/gate-budget.ts\`. No other line changes.
+
+${lines2.join("\n")}
+
+Hub action pins ${digest}
+${renderPropagationTargetMarker(PIN_TARGET)}`;
+    const open2 = await ghJson(gh2, ["pr", "list", "--repo", rec.repo, "--head", branch, "--base", base, "--state", "open", "--json", "number,url,body"]) ?? [];
+    const decision = decideSeedPrAction(propagationPrCandidatesForTarget(PIN_TARGET, open2, []));
+    let prUrl;
+    if (decision.action === "reuse") {
+      prUrl = decision.url;
+      await gh2(["pr", "edit", prUrl, "--repo", rec.repo, "--body", body]);
+    } else {
+      if (!input.createPr) throw new Error("runPinTick: apply needs createPr");
+      prUrl = await input.createPr(["pr", "create", "--repo", rec.repo, "--base", base, "--head", branch, "--title", `ci: pin MMI-Hub actions to the blessed SHAs (wave ${rec.wave})`, "--body", body]);
+    }
+    if (rec.wave !== 0 && input.mayAutoMerge && await input.mayAutoMerge(rec.repo)) {
+      await gh2(["pr", "merge", prUrl, "--repo", rec.repo, "--auto", "--squash"]).catch(() => {
+      });
+    }
+    rec.prUrl = prUrl;
+  }
+  return { plan, digest, diffs };
+}
+function renderPinDiffs(tick) {
+  if (!tick.diffs.length) return "hub action pins: every in-scope repo already pins the blessed SHAs";
+  return tick.diffs.map((d) => [`${d.repo}:`, ...d.files.flatMap((f) => f.changes.map((c) => `  ${f.path}:${c.line} ${c.action} ${c.from === "development" ? "@development" : c.from.slice(0, 12)} -> ${c.to.slice(0, 12)}`))].join("\n")).join("\n");
+}
+
 // src/registry-repositories.ts
 function qualifyRegistryRepo(raw) {
   return raw.includes("/") ? raw : `mutmutco/${raw}`;
@@ -38681,7 +39120,7 @@ function registryRepoKey(repo) {
 
 // src/ci-audit.ts
 var import_yaml2 = __toESM(require_dist(), 1);
-var HUB_REPO4 = "mutmutco/MMI-Hub";
+var HUB_REPO5 = "mutmutco/MMI-Hub";
 var HUB_GATE_CONTEXTS = ["cli", "infra", "docs"];
 var PRODUCT_GATE_PATH = ".github/workflows/gate.yml";
 var PRODUCT_RULESET_REF = ".github/rulesets/mmi-product-required-checks.json";
@@ -38868,6 +39307,46 @@ function auditJevOutcomes(files) {
   }
   return checks;
 }
+var VERDICT_RECEIPT = /(?:^|\/)\.github\/actions\/verdict-receipt(?:@|$)/;
+function auditVerdictReceipt(files) {
+  const checks = [];
+  for (const { path: path2, body } of files) {
+    if (!isGateWorkflowPath(path2)) continue;
+    let doc;
+    try {
+      doc = (0, import_yaml2.parse)(body);
+    } catch {
+      continue;
+    }
+    if (!plainRecord(doc)) continue;
+    const on = doc.on;
+    const events = typeof on === "string" ? [on] : Array.isArray(on) ? on : plainRecord(on) ? Object.keys(on) : [];
+    if (!events.includes("merge_group") || !events.includes("push")) continue;
+    const push = plainRecord(on) ? on.push : void 0;
+    const branches = plainRecord(push) ? push.branches : void 0;
+    if (branches !== void 0 && !(Array.isArray(branches) ? branches : [branches]).includes("development")) continue;
+    const steps = Object.values(plainRecord(doc.jobs) ? doc.jobs : {}).flatMap((job) => plainRecord(job) && Array.isArray(job.steps) ? job.steps.filter(plainRecord) : []);
+    if (steps.some((s) => typeof s.uses === "string" && VERDICT_RECEIPT.test(s.uses))) continue;
+    if (!steps.some((s) => typeof s.uses === "string" && s.uses.includes("run-with-budget") || typeof s.run === "string" && RUNS_TESTS.test(s.run))) continue;
+    checks.push({
+      ok: true,
+      severity: "info",
+      label: `development push reuses the merge-queue verdict (org CI H1): ${path2}`,
+      detail: "this gate runs heavy jobs on merge_group and again on the development push of the same SHA, with no verdict-receipt step to reuse the queue verdict",
+      remediation: "Add mutmutco/MMI-Hub/.github/actions/verdict-receipt (source: merge_group, queue-is-full-verdict: true once merge_group is the full set) in the first job and skip heavy jobs when reuse == 'true' - see docs/Guides/operator.md#verdict-receipt"
+    });
+  }
+  return checks;
+}
+function auditHubActionPins(files) {
+  return files.flatMap(({ path: path2, body }) => staleHubActionPins(body).map((use) => ({
+    ok: true,
+    severity: "info",
+    label: `Hub action pin is the blessed SHA (H4): ${path2}:${use.line}`,
+    detail: `${use.action} pins ${use.from === "development" ? "@development (floating)" : use.from.slice(0, 12)}, blessed is ${use.to.slice(0, 12)}`,
+    remediation: "mmi-cli devops bootstrap propagate --pins --apply (from MMI-Hub), or re-pin by hand to the blessed SHA"
+  })));
+}
 var PENDING_LANDING_LABEL = "pending PRs landing (#8783)";
 var PENDING_LANDING_LIST_CAP = 50;
 var PENDING_LANDING_STALL_MS = 15 * 60 * 1e3;
@@ -38935,7 +39414,7 @@ function slugFromRepo(repo) {
   return (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
 }
 function classifyRepo(repo, meta) {
-  if (repo.toLowerCase() === HUB_REPO4.toLowerCase()) return "hub";
+  if (repo.toLowerCase() === HUB_REPO5.toLowerCase()) return "hub";
   if (meta?.class === "content") return "content";
   if (meta?.class === "deployable" || meta?.deployModel && meta.deployModel !== "content" && meta.deployModel !== "none") return "deployable";
   if (meta) return "deployable";
@@ -38964,7 +39443,7 @@ function pinContainsFloor(deps, floor, pin) {
   const key = `${floor}...${pin}`;
   let comparison = comparisons.get(key);
   if (!comparison) {
-    comparison = deps.client.rest("GET", `repos/${HUB_REPO4}/compare/${key}`).then((result) => result?.status === "ahead" || result?.status === "identical" ? true : result?.status === "behind" || result?.status === "diverged" ? false : void 0).catch(() => void 0);
+    comparison = deps.client.rest("GET", `repos/${HUB_REPO5}/compare/${key}`).then((result) => result?.status === "ahead" || result?.status === "identical" ? true : result?.status === "behind" || result?.status === "diverged" ? false : void 0).catch(() => void 0);
     comparisons.set(key, comparison);
   }
   return comparison;
@@ -39237,7 +39716,7 @@ function collectRegistryRepos(projects) {
       if (!seen.has(key)) seen.set(key, repo);
     }
   }
-  if (!seen.has(HUB_REPO4.toLowerCase())) seen.set(HUB_REPO4.toLowerCase(), HUB_REPO4);
+  if (!seen.has(HUB_REPO5.toLowerCase())) seen.set(HUB_REPO5.toLowerCase(), HUB_REPO5);
   return [...seen.values()].sort((a, b) => a.localeCompare(b));
 }
 async function prTriggeredWorkflowsOnRef(deps, repo, branch, repoClass) {
@@ -39663,6 +40142,8 @@ async function auditRepoCi(repo, callerDeps) {
       }
       checks.push(...auditSelfHostedRunnerHygiene(workflows));
       checks.push(...auditJevOutcomes(workflows));
+      checks.push(...auditVerdictReceipt(workflows));
+      if (repoClass !== "hub") checks.push(...auditHubActionPins(workflows));
       if (repoClass !== "hub") checks.push(...await auditSharedActionPins(workflows, deps));
     } else {
       checks.push({ ok: false, label: "runner workflow source is readable (#8958)", detail: "workflow source inventory unreadable" });
@@ -41226,10 +41707,10 @@ init_github_client();
 init_cli_shared();
 
 // src/pr-merge-queue.ts
-var import_node_crypto10 = require("node:crypto");
-var import_node_fs33 = require("node:fs");
-var import_node_os17 = require("node:os");
-var import_node_path30 = require("node:path");
+var import_node_crypto12 = require("node:crypto");
+var import_node_fs34 = require("node:fs");
+var import_node_os18 = require("node:os");
+var import_node_path31 = require("node:path");
 init_cli_shared();
 
 // src/pr-land.ts
@@ -41668,8 +42149,8 @@ var import_yaml3 = __toESM(require_dist(), 1);
 
 // src/test-policy-core.ts
 var import_node_child_process11 = require("node:child_process");
-var import_node_fs32 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_fs33 = require("node:fs");
+var import_node_path30 = require("node:path");
 
 // src/test-command-policy-shared.mjs
 var import_node_child_process10 = require("node:child_process");
@@ -42225,7 +42706,7 @@ function isMeaningfulRow(file) {
   return file.meaningful !== false;
 }
 function loadPolicy(root, readFile10 = readFileOrNull2) {
-  const raw = readFile10((0, import_node_path29.join)(root, POLICY_FILE));
+  const raw = readFile10((0, import_node_path30.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   return parsePolicy(raw, POLICY_FILE);
 }
@@ -42309,7 +42790,7 @@ function loadPolicySource(root, explicitRef, diffBase) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs32.readFileSync)(path2, "utf8");
+    return (0, import_node_fs33.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -42337,12 +42818,12 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, meaningfulTestChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path29.join)(root, p)));
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs33.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs33.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path29.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, meaningfulTestChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -42516,20 +42997,20 @@ function runTestPolicy(root, deps = {}) {
   if (deps.policyRef && (deps.policy !== void 0 || deps.changed !== void 0 || deps.override !== void 0 || deps.exists !== void 0)) {
     throw new Error("--policy-ref cannot be combined with injected policy, changed rows, override, or filesystem evidence");
   }
-  const candidateTree = candidate ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", candidate.head], root).split("\0").filter(Boolean).map((p) => (0, import_node_path29.join)(root, p))) : null;
+  const candidateTree = candidate ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", candidate.head], root).split("\0").filter(Boolean).map((p) => (0, import_node_path30.join)(root, p))) : null;
   const loaded = candidate ? {
-    policy: candidateTree.has((0, import_node_path29.join)(root, POLICY_FILE)) ? parsePolicy(git2(["show", `${candidate.head}:${POLICY_FILE}`], root), `${candidate.head}:${POLICY_FILE}`) : { mandatory: [], declared: false },
+    policy: candidateTree.has((0, import_node_path30.join)(root, POLICY_FILE)) ? parsePolicy(git2(["show", `${candidate.head}:${POLICY_FILE}`], root), `${candidate.head}:${POLICY_FILE}`) : { mandatory: [], declared: false },
     source: { ref: candidate.head, sha: candidate.head, path: POLICY_FILE }
   } : deps.policy ? { policy: deps.policy, source: { ref: null, sha: null, path: POLICY_FILE } } : loadPolicySource(root, deps.policyRef, deps.base);
   const { policy, source: policySource } = loaded;
-  const exists = candidateTree ? (path2) => candidateTree.has(path2) : deps.exists ?? ((path2) => (0, import_node_fs32.existsSync)(path2));
+  const exists = candidateTree ? (path2) => candidateTree.has(path2) : deps.exists ?? ((path2) => (0, import_node_fs33.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = candidate ? git2(["merge-base", candidate.head, candidate.base], root).trim() : deps.changed ? "(injected)" : deps.policyRef ? resolveHotfixBase(root) : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const raw = deps.changed ?? (refusal ? [] : changedFilesSince(base, root, candidate?.head));
   const changed = deps.changed ? raw : annotateChangeMeaning(raw, policy, (path2) => ({
     before: blobAt(base, path2, root),
-    after: candidate ? blobAt(candidate.head, path2, root) : readFileOrNull2((0, import_node_path29.join)(root, path2))
+    after: candidate ? blobAt(candidate.head, path2, root) : readFileOrNull2((0, import_node_path30.join)(root, path2))
   }));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride2(base, root, candidate?.head) : { override: null, refusals: [] };
   const policyRefusals = policy.declared === false ? [{
@@ -42539,8 +43020,8 @@ function runTestPolicy(root, deps = {}) {
   A gate with no policy cannot decide which test commands are required or permitted.
 ` + (deps.base === HOTFIX_DIFF_BASE ? `  Hotfix lane (--base ${HOTFIX_DIFF_BASE}): pass --policy-ref <exact-${HOTFIX_POLICY_REF}-commit> so the current policy is read from ${HOTFIX_POLICY_REF}.` : `  Restore ${POLICY_FILE} on this branch; the policy file belongs on every non-hotfix lane.`)
   }] : [];
-  const present = (path2) => exists((0, import_node_path29.join)(root, path2));
-  const policyTree = candidateTree ?? (policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path29.join)(root, p))) : null);
+  const present = (path2) => exists((0, import_node_path30.join)(root, path2));
+  const policyTree = candidateTree ?? (policySource.sha ? new Set(git2(["ls-tree", "-r", "-z", "--name-only", policySource.sha], root).split("\0").filter(Boolean).map((p) => (0, import_node_path30.join)(root, p))) : null);
   const policyTreeExists = policyTree ? (abs) => policyTree.has(abs) : exists;
   const where = policySource.sha ? `${policySource.ref}@${policySource.sha}` : "this worktree";
   const removedByThisDiff = removedPaths(changed);
@@ -42660,16 +43141,16 @@ var autoMergeApi = async (pr, repo, head) => {
 var ASYNC_HEADERS = ["-H", "Accept: application/vnd.github+json", "-H", "X-GitHub-Api-Version: 2026-03-10"];
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
 function admissionJournal(repo, pr, root) {
-  const stateRoot = root ?? (process.platform === "win32" ? (0, import_node_path30.join)(process.env.LOCALAPPDATA || (0, import_node_path30.join)((0, import_node_os17.homedir)(), "AppData", "Local"), "MMI Future", "mmi-cli", "queue-admissions") : (0, import_node_path30.join)(process.env.XDG_STATE_HOME || (0, import_node_path30.join)((0, import_node_os17.homedir)(), ".local", "state"), "mmi-cli", "queue-admissions"));
-  const directory = (0, import_node_path30.join)(stateRoot, (0, import_node_crypto10.createHash)("sha256").update(`${repo.toLowerCase()}#${pr}`).digest("hex"));
-  (0, import_node_fs33.mkdirSync)(directory, { recursive: true, mode: 448 });
-  const attempts = (0, import_node_fs33.readdirSync)(directory).map((name) => {
+  const stateRoot = root ?? (process.platform === "win32" ? (0, import_node_path31.join)(process.env.LOCALAPPDATA || (0, import_node_path31.join)((0, import_node_os18.homedir)(), "AppData", "Local"), "MMI Future", "mmi-cli", "queue-admissions") : (0, import_node_path31.join)(process.env.XDG_STATE_HOME || (0, import_node_path31.join)((0, import_node_os18.homedir)(), ".local", "state"), "mmi-cli", "queue-admissions"));
+  const directory = (0, import_node_path31.join)(stateRoot, (0, import_node_crypto12.createHash)("sha256").update(`${repo.toLowerCase()}#${pr}`).digest("hex"));
+  (0, import_node_fs34.mkdirSync)(directory, { recursive: true, mode: 448 });
+  const attempts = (0, import_node_fs34.readdirSync)(directory).map((name) => {
     if (!/^[1-9][0-9]*\.jsonl$/.test(name)) throw new Error("queue admission receipt directory contains an unrecognized record");
     return Number(name.slice(0, -6));
   }).sort((a, b) => a - b);
   if (attempts.some((number, index) => number !== index + 1)) throw new Error("queue admission receipt sequence is incomplete");
   const attempt = attempts.length;
-  const path2 = (number) => (0, import_node_path30.join)(directory, `${number}.jsonl`);
+  const path2 = (number) => (0, import_node_path31.join)(directory, `${number}.jsonl`);
   const validate = (value, previous) => {
     const row = value;
     if (!row || row.version !== 1 || row.repo !== repo.toLowerCase() || row.pr !== pr || !/^[a-f0-9]{40}$/i.test(row.head) || !UUID.test(row.intentId) || !Number.isSafeInteger(row.createdAt) || row.createdAt <= 0 || !Number.isSafeInteger(row.observedAt) || row.observedAt < row.createdAt || !["dispatching", "pending", "enqueued", "merged", "failed", "ejected"].includes(row.state) || row.credential !== void 0 && !["app_installation", "user"].includes(row.credential) || row.queueWitnessed !== void 0 && typeof row.queueWitnessed !== "boolean" || row.uuid !== void 0 && !UUID.test(row.uuid) || row.state === "pending" && !row.uuid || row.queueEntry !== void 0 && (!row.queueEntry || typeof row.queueEntry.headCommitOid !== "string" || !/^[a-f0-9]{40}$/i.test(row.queueEntry.headCommitOid) || typeof row.queueEntry.enqueuedAt !== "string" || !Number.isFinite(Date.parse(row.queueEntry.enqueuedAt)))) {
@@ -42684,7 +43165,7 @@ function admissionJournal(repo, pr, root) {
   };
   const load = (number = attempt) => {
     let previous;
-    for (const line of (0, import_node_fs33.readFileSync)(path2(number), "utf8").trimEnd().split("\n")) previous = validate(JSON.parse(line), previous);
+    for (const line of (0, import_node_fs34.readFileSync)(path2(number), "utf8").trimEnd().split("\n")) previous = validate(JSON.parse(line), previous);
     return previous;
   };
   return {
@@ -42699,9 +43180,9 @@ function admissionJournal(repo, pr, root) {
     },
     create(head) {
       const createdAt = Date.now();
-      const initial = { version: 1, repo: repo.toLowerCase(), pr, head, intentId: (0, import_node_crypto10.randomUUID)(), createdAt, observedAt: createdAt, state: "dispatching" };
+      const initial = { version: 1, repo: repo.toLowerCase(), pr, head, intentId: (0, import_node_crypto12.randomUUID)(), createdAt, observedAt: createdAt, state: "dispatching" };
       try {
-        (0, import_node_fs33.writeFileSync)(path2(attempt + 1), JSON.stringify(initial) + "\n", { flag: "wx", mode: 384, flush: true });
+        (0, import_node_fs34.writeFileSync)(path2(attempt + 1), JSON.stringify(initial) + "\n", { flag: "wx", mode: 384, flush: true });
       } catch (error) {
         if (error.code === "EEXIST") return false;
         throw error;
@@ -42721,7 +43202,7 @@ function admissionJournal(repo, pr, root) {
         ...queueWitnessed !== void 0 ? { queueWitnessed } : {},
         ...credential && previous.credential === void 0 ? { credential } : {}
       }, previous);
-      (0, import_node_fs33.appendFileSync)(path2(attempt), JSON.stringify(receipt) + "\n", { flush: true });
+      (0, import_node_fs34.appendFileSync)(path2(attempt), JSON.stringify(receipt) + "\n", { flush: true });
       load();
     }
   };
@@ -43614,6 +44095,15 @@ async function attachViaHubApp(cfg, contentNodeId) {
   const { addIssueToProjectViaHub: addIssueToProjectViaHub2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
   return addIssueToProjectViaHub2(cfg, contentNodeId);
 }
+var PROJECTS_PERMISSION_HINT = "the GitHub App needs the organization permission 'Projects: Read and write' (REST name organization_projects: write), set by an org owner under Organization settings > GitHub Apps > the App > Permissions & events, then accepted on the installation";
+async function attachOnIntegrationRefusal(detail, cfg, contentNodeId, attach = attachViaHubApp) {
+  if (!/Resource not accessible by integration/i.test(detail)) return void 0;
+  try {
+    return { projectItemId: await attach(cfg, contentNodeId) };
+  } catch (e) {
+    return { warning: `board attach refused: the gh login is an App installation token without Projects access (${detail}) and the Hub App leg failed (${e.message}). If the Hub reports the same refusal, ${PROJECTS_PERMISSION_HINT}` };
+  }
+}
 async function issueNodeIdForAttach(repo, number, ghView, client) {
   try {
     return (await ghView()).trim();
@@ -44223,9 +44713,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs37 = require("node:fs");
-var import_node_os20 = require("node:os");
-var import_node_path34 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_os21 = require("node:os");
+var import_node_path35 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -44410,8 +44900,8 @@ init_github_client();
 init_cli_shared();
 
 // src/port-registry.ts
-var import_node_fs34 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_path32 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -44425,8 +44915,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs34.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs34.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs35.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs35.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -44454,22 +44944,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path31.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path31.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs34.existsSync)(registryPath) || !(0, import_node_fs34.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path32.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path32.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs35.existsSync)(registryPath) || !(0, import_node_fs35.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path31.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path31.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path32.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path32.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path31.dirname)(dir);
+    const parent = (0, import_node_path32.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path31.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path32.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -44486,7 +44976,7 @@ async function ensurePortRangeAtomic(repo, path2, allocate) {
   } catch (e) {
     const why = e.message;
     const missing = /@aws-sdk\/[\w-]+/.exec(why)?.[0];
-    throw new Error(`DDB port allocator failed for ${repo} \u2014 refusing to fall back to the frozen ${path2} (it would hand out a block the cursor already gave away). ` + (missing && /cannot find|not found|ERR_MODULE_NOT_FOUND/i.test(why) ? `Missing dependency ${missing}: run \`npm ci\` in ${(0, import_node_path31.dirname)(path2)}, then retry.` : "Check AWS credentials and that the registry table is reachable, then retry.") + ` Cause: ${why}`);
+    throw new Error(`DDB port allocator failed for ${repo} \u2014 refusing to fall back to the frozen ${path2} (it would hand out a block the cursor already gave away). ` + (missing && /cannot find|not found|ERR_MODULE_NOT_FOUND/i.test(why) ? `Missing dependency ${missing}: run \`npm ci\` in ${(0, import_node_path32.dirname)(path2)}, then retry.` : "Check AWS credentials and that the registry table is reachable, then retry.") + ` Cause: ${why}`);
   }
 }
 
@@ -44538,13 +45028,13 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 
 // src/box-commands.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 var import_node_child_process12 = require("node:child_process");
-var import_node_os19 = require("node:os");
-var import_node_path33 = require("node:path");
+var import_node_os20 = require("node:os");
+var import_node_path34 = require("node:path");
 
 // src/box-control.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 var sshdPost = (dest) => `if sshd -t; then systemctl reload ssh; else rm -f ${dest}; echo 'sshd -t rejected ${dest}: removed, not reloaded' >&2; exit 1; fi`;
@@ -44648,7 +45138,7 @@ function laneCoverageAction(files, box, op) {
   return { notice: `LANE_COVERAGE: ${mismatch}` };
 }
 function md5(content) {
-  return (0, import_node_crypto11.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto13.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -44766,9 +45256,9 @@ init_clean_exit();
 init_cli_shared();
 
 // src/secrets-commands.ts
-var import_node_fs35 = require("node:fs");
-var import_node_path32 = require("node:path");
-var import_node_os18 = require("node:os");
+var import_node_fs36 = require("node:fs");
+var import_node_path33 = require("node:path");
+var import_node_os19 = require("node:os");
 init_cli_shared();
 init_hub_auth();
 init_github_client();
@@ -45964,18 +46454,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path32.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path33.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path32.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path32.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path33.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path33.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs35.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs35.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs36.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs36.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -45985,9 +46475,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs35.mkdtempSync)((0, import_node_path32.join)((0, import_node_os18.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path32.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs35.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs36.mkdtempSync)((0, import_node_path33.join)((0, import_node_os19.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path33.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs36.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -45999,7 +46489,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs35.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs36.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -46089,7 +46579,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs35.readFileSync)((0, import_node_path32.resolve)(o.file), "utf8");
+        body = (0, import_node_fs36.readFileSync)((0, import_node_path33.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -46225,7 +46715,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs35.unlinkSync)((0, import_node_path32.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs36.unlinkSync)((0, import_node_path33.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -46496,7 +46986,7 @@ function registerBoxCommands(program3) {
       }
       const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs36.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs37.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -46623,17 +47113,17 @@ function hubGitShow(ref) {
   return (path2) => git3(["show", `${ref}:${path2}`]);
 }
 function runOnBox(found, script) {
-  const dir = (0, import_node_fs36.mkdtempSync)((0, import_node_path33.join)((0, import_node_os19.tmpdir)(), "mmi-box-control-"));
+  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path34.join)((0, import_node_os20.tmpdir)(), "mmi-box-control-"));
   try {
-    const recipe = (0, import_node_path33.join)(dir, "recipe.sh");
-    (0, import_node_fs36.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    const recipe = (0, import_node_path34.join)(dir, "recipe.sh");
+    (0, import_node_fs37.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
     const r = (0, import_node_child_process12.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
     return r.stdout;
   } finally {
-    (0, import_node_fs36.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function formatControl(mode, box, rows) {
@@ -46761,7 +47251,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -46781,7 +47271,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto12.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto14.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -46831,197 +47321,6 @@ function renderSeedDriftReport(findings, reposAudited, seedsPerRepo) {
   return lines2.join("\n");
 }
 
-// src/bootstrap-propagate.ts
-function archivedWaiver(repoMeta) {
-  return repoMeta?.archived === true ? "archived repository (read-only)" : void 0;
-}
-function assertPropagationCoverage(rosterCount, independentRegistryCount) {
-  if (rosterCount === 0) {
-    throw new Error("bootstrap propagate: roster read 0 repos \u2014 refusing to report a plan from a roster this command could not establish (#4232 coverage invariant)");
-  }
-  if (rosterCount < independentRegistryCount) {
-    throw new Error(
-      `bootstrap propagate: roster read ${rosterCount} repo(s) but the independent registry count is ${independentRegistryCount} \u2014 this read did not cover the fleet (#4232 coverage invariant)`
-    );
-  }
-}
-function assignWaves(repos, canarySlug) {
-  const waves = /* @__PURE__ */ new Map();
-  if (!canarySlug) return waves;
-  const rest = repos.filter((r) => r.slug !== canarySlug).slice().sort((a, b) => a.slug < b.slug ? -1 : a.slug > b.slug ? 1 : 0);
-  const canary = repos.find((r) => r.slug === canarySlug);
-  if (canary) waves.set(canary.repo, 0);
-  const wave1Count = Math.ceil(rest.length * 0.25);
-  rest.forEach((r, i) => waves.set(r.repo, i < wave1Count ? 1 : 2));
-  return waves;
-}
-function statusFor(read, currentSha) {
-  if (!read) return { status: "pending", record: {} };
-  if (read.drift === "match") return { status: "match", record: { mergeSha: read.pr?.mergeSha } };
-  if (read.prUnread) return { status: "red", record: {} };
-  const pr = read.pr;
-  if (!pr) return { status: "pending", record: {} };
-  if (pr.sourceSha && pr.sourceSha !== currentSha) return { status: "pending", record: {} };
-  if (pr.state === "closed") return { status: "closed-unmerged", record: { prNumber: pr.number, prUrl: pr.url } };
-  if (pr.checks === "red") return { status: "red", record: { prNumber: pr.number, prUrl: pr.url } };
-  return { status: "open-pending", record: { prNumber: pr.number, prUrl: pr.url, mergeSha: pr.mergeSha } };
-}
-var HALTING_STATUSES = /* @__PURE__ */ new Set(["red", "closed-unmerged"]);
-function planPropagationTick(input) {
-  const { target, repos, canarySlug, reads, isWorkflowSeed, functionGateSatisfied, currentSha } = input;
-  const sourcePilot = input.sourcePilot === true;
-  const readByRepo = new Map(reads.map((r) => [r.repo, r]));
-  const records = [];
-  const opened = [];
-  const waived = repos.filter((r) => r.waiver);
-  for (const r of waived) {
-    records.push({ repo: r.repo, target, wave: null, status: "skipped-waived", action: "none", detail: `waived: ${r.waiver}` });
-  }
-  const eligible = repos.filter((r) => !r.waiver);
-  const refusedNoCanary = !canarySlug || !sourcePilot && !eligible.some((r) => r.slug === canarySlug);
-  if (refusedNoCanary) {
-    for (const r of eligible) {
-      records.push({ repo: r.repo, target, wave: null, status: "not-yet-reached", action: "none", detail: "no canary declared for this target \u2014 refusing to plan any wave (#4238 canary requirement)" });
-    }
-    return { target, reposInScope: repos.length, canary: null, refusedNoCanary: true, halted: false, haltReason: null, opened, records };
-  }
-  const waveOf = assignWaves(eligible, canarySlug);
-  const byWave = { 0: [], 1: [], 2: [] };
-  for (const r of eligible) byWave[waveOf.get(r.repo) ?? 2].push(r);
-  let halted = false;
-  let haltReason = null;
-  let waveGateOpen = !(sourcePilot && isWorkflowSeed && !functionGateSatisfied);
-  for (const waveNum of [0, 1, 2]) {
-    const waveRepos = byWave[waveNum];
-    if (!waveRepos.length) continue;
-    if (!waveGateOpen || halted) {
-      for (const r of waveRepos) {
-        records.push({ repo: r.repo, target, wave: waveNum, status: "not-yet-reached", action: "none", detail: "prior wave not yet converged" });
-      }
-      continue;
-    }
-    let waveAllMatch = true;
-    let waveHasRed = false;
-    let waveHasClosed = false;
-    for (const r of waveRepos) {
-      const { status, record: record2 } = statusFor(readByRepo.get(r.repo), currentSha);
-      const shouldOpen = status === "pending" || status === "closed-unmerged";
-      if (shouldOpen) opened.push(r.repo);
-      records.push({
-        repo: r.repo,
-        target,
-        wave: waveNum,
-        status,
-        action: shouldOpen ? "open-pr" : "none",
-        detail: status === "closed-unmerged" ? `previous PR#${record2.prNumber} was closed unmerged and no open PR replaced it \u2014 opening a replacement against the live base this tick (#9232)` : status === "pending" ? "no open propagation PR and not yet matching \u2014 opening this tick" : status,
-        ...record2
-      });
-      if (status !== "match") waveAllMatch = false;
-      if (HALTING_STATUSES.has(status)) waveHasRed = true;
-      if (status === "closed-unmerged") waveHasClosed = true;
-    }
-    if (waveHasRed) {
-      halted = true;
-      haltReason = `wave ${waveNum} has a red or closed-unmerged PR \u2014 halting; no further wave opens (#4238 halt-and-alarm)` + (waveHasClosed ? "; the closed PR(s) were re-opened against the live base this tick (#9232) \u2014 land or close the replacement to advance" : "");
-      waveGateOpen = false;
-      continue;
-    }
-    if (waveNum === 0 && isWorkflowSeed && !functionGateSatisfied) {
-      waveGateOpen = false;
-      continue;
-    }
-    waveGateOpen = waveAllMatch;
-  }
-  return { target, reposInScope: repos.length, canary: canarySlug, refusedNoCanary: false, halted, haltReason, opened, records };
-}
-function summarizePropagationTick(plan) {
-  const parts = [];
-  parts.push(plan.opened.length ? `opened ${plan.opened.length} PR(s) this tick: ${plan.opened.join(", ")}` : "opened no PR this tick");
-  const stillNotCurrent = plan.records.filter((r) => r.status !== "match" && r.status !== "skipped-waived" && r.action !== "open-pr");
-  parts.push(stillNotCurrent.length ? `not current and not opened this tick: ${stillNotCurrent.map((r) => `${r.repo} (${r.status})`).join(", ")}` : "every in-scope repo either matches the Hub seed or had a PR opened this tick");
-  if (plan.halted) parts.push(`HALTED \u2014 ${plan.haltReason}`);
-  return parts.join("; ");
-}
-function renderPropagationReport(plan) {
-  const lines2 = [`bootstrap propagate \u2014 target ${plan.target}: ${plan.reposInScope} repo(s) in scope, canary=${plan.canary ?? "NONE"}`];
-  if (plan.refusedNoCanary) {
-    lines2.push("  REFUSED \u2014 no canary declared for this target; plan every repo not-yet-reached");
-    lines2.push(`  ${summarizePropagationTick(plan)}`);
-    return lines2.join("\n");
-  }
-  for (const r of plan.records) {
-    const wave = r.wave == null ? "-" : String(r.wave);
-    lines2.push(`  wave${wave.padEnd(2)} ${r.status.padEnd(16)} ${r.repo}${r.prNumber ? ` PR#${r.prNumber}` : ""} \u2014 ${r.detail}`);
-  }
-  lines2.push(`  ${summarizePropagationTick(plan)}`);
-  return lines2.join("\n");
-}
-
-// src/bootstrap-propagation-identity.ts
-var import_node_crypto13 = require("node:crypto");
-var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
-var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
-function safeBranchPart(value, maxLength, fallback) {
-  const safe = value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLength).replace(/-+$/g, "");
-  return safe || fallback;
-}
-function repoSlug2(repo) {
-  return repo.trim().split("/").pop()?.toLowerCase() || "repo";
-}
-function propagationBranch(repo, target) {
-  const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
-  const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto13.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
-  return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
-}
-function legacyPropagationBranch(repo) {
-  return `${PROPAGATION_BRANCH_PREFIX}${repoSlug2(repo)}`;
-}
-function renderPropagationTargetMarker(target) {
-  return `<!-- ${TARGET_MARKER_NAME}: ${JSON.stringify(target)} -->`;
-}
-function targetMarkers(body) {
-  const present = body.includes(`${TARGET_MARKER_NAME}:`);
-  const targets = [];
-  const marker = new RegExp(`<!--\\s*${TARGET_MARKER_NAME}:\\s*(.*?)\\s*-->`, "g");
-  for (const match of body.matchAll(marker)) {
-    try {
-      const parsed = JSON.parse(match[1]);
-      if (typeof parsed === "string") targets.push(parsed);
-    } catch {
-    }
-  }
-  return { present, targets };
-}
-function canonicalProseTargets(body) {
-  const targets = [];
-  const command = /bootstrap propagate --target (.+?) --execute`/g;
-  const prose = /(?:org-owned copy of|declared marker-bounded block inside repo-owned) `([^`]+)` — the file this PR carries and nothing else/g;
-  for (const match of body.matchAll(command)) targets.push(match[1]);
-  for (const match of body.matchAll(prose)) targets.push(match[1]);
-  return targets;
-}
-function propagationPrMatchesTarget(pr, target, identity) {
-  const body = pr.body ?? "";
-  const markers = targetMarkers(body);
-  if (markers.present) {
-    if (markers.targets.length !== 1 || markers.targets[0] !== target) return false;
-    return !pr.files?.length || pr.files.length === 1 && pr.files[0] === target;
-  }
-  if (identity === "target-specific") return false;
-  const proseTargets = canonicalProseTargets(body);
-  if (proseTargets.some((candidate) => candidate !== target)) return false;
-  if (pr.files?.length) {
-    return pr.files.length === 1 && pr.files[0] === target;
-  }
-  return proseTargets.length > 0;
-}
-function propagationPrCandidatesForTarget(target, targetSpecificPrs, legacyPrs) {
-  const targetSpecific = targetSpecificPrs.filter((pr) => propagationPrMatchesTarget(pr, target, "target-specific"));
-  if (targetSpecific.length) return targetSpecific;
-  return legacyPrs.filter((pr) => propagationPrMatchesTarget(pr, target, "legacy"));
-}
-
 // src/bootstrap-rollback.ts
 function resolveRollbackRecord(records, repo, target) {
   const candidates = records.filter((r) => r.repo === repo && r.target === target && r.mergeSha);
@@ -47466,7 +47765,7 @@ var requiredIssueTemplates = [
 ];
 var requiredProductWorkflows = [".github/workflows/gate.yml"];
 var requiredProductRulesetRef = ".github/rulesets/mmi-product-required-checks.json";
-var HUB_REPO5 = "mutmutco/MMI-Hub";
+var HUB_REPO6 = "mutmutco/MMI-Hub";
 var requiredLabels = ["bug", "feature", "task"];
 var requiredPriorityOptions = ["Urgent", "High", "Medium", "Low"];
 var strayDefaultLabels = ["documentation", "duplicate", "enhancement", "good first issue", "help wanted", "invalid", "question", "wontfix"];
@@ -47880,7 +48179,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     checks.push({ ok: await contentExists2(deps, repo, baseBranch, path2), label: `issue template exists: ${path2}` });
   }
   let productContexts = [PRODUCT_GATE_CONTEXT];
-  if (repo !== HUB_REPO5 && repoClass === "deployable") {
+  if (repo !== HUB_REPO6 && repoClass === "deployable") {
     const rulesetRaw = await contentText(deps, repo, baseBranch, requiredProductRulesetRef);
     productContexts = committedRequiredContexts(rulesetRaw);
     const workflowCandidates = [.../* @__PURE__ */ new Set([
@@ -48124,7 +48423,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: coverage.ok ? void 0 : `${coverage.reason} (branches: ${coverage.branches.join(", ")})`
     });
   }
-  if (repo === HUB_REPO5) {
+  if (repo === HUB_REPO6) {
     const statusChecks = rulesetStatusChecks2(rulesets.filter((r) => r.target === "branch" && r.enforcement === "active"));
     const missing = requiredHubStatusChecks.filter((check) => !statusChecks.has(check));
     checks.push({
@@ -48222,7 +48521,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -48255,7 +48554,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto15.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
   const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
   return { ...scoped, baseSha, baseBranch };
@@ -48325,12 +48624,12 @@ var declaredProjectAdmins = (meta) => {
 };
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 async function gateRenderDiff(current, rendered) {
-  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path34.join)((0, import_node_os20.tmpdir)(), "mmi-gate-diff-"));
-  const before = (0, import_node_path34.join)(dir, "committed-gate.yml");
-  const after = (0, import_node_path34.join)(dir, "registry-render.yml");
+  const dir = (0, import_node_fs38.mkdtempSync)((0, import_node_path35.join)((0, import_node_os21.tmpdir)(), "mmi-gate-diff-"));
+  const before = (0, import_node_path35.join)(dir, "committed-gate.yml");
+  const after = (0, import_node_path35.join)(dir, "registry-render.yml");
   try {
-    (0, import_node_fs37.writeFileSync)(before, current);
-    (0, import_node_fs37.writeFileSync)(after, rendered);
+    (0, import_node_fs38.writeFileSync)(before, current);
+    (0, import_node_fs38.writeFileSync)(after, rendered);
     try {
       return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
     } catch (e) {
@@ -48339,7 +48638,7 @@ async function gateRenderDiff(current, rendered) {
       throw e;
     }
   } finally {
-    (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function bootstrapTrainDoctorDeps() {
@@ -48352,6 +48651,90 @@ function bootstrapTrainDoctorDeps() {
     }
   };
 }
+async function propagationScope(classes, what) {
+  const cfg = await loadConfig();
+  const projects = await fetchProjectsList(registryClientDeps(cfg));
+  if (!projects || projects.length === 0) {
+    return await failGraceful("bootstrap propagate: the registry roster is unreadable or empty \u2014 refusing to plan a tick from a scope this command could not establish (#4232 coverage invariant)");
+  }
+  const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
+  let independentCount = rosterRepos.length;
+  if ((0, import_node_fs38.existsSync)("projects.json")) {
+    try {
+      const local = JSON.parse((0, import_node_fs38.readFileSync)("projects.json", "utf8"));
+      const localRepos = /* @__PURE__ */ new Set();
+      for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
+        const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
+        if (full !== "mutmutco/mmi-hub") localRepos.add(full);
+      }
+      if (localRepos.size > 0) independentCount = localRepos.size;
+    } catch {
+    }
+  }
+  try {
+    assertPropagationCoverage(rosterRepos.length, independentCount);
+  } catch (e) {
+    return fail(e.message);
+  }
+  const bySlugMeta = new Map(projects.flatMap((p) => (p.repos ?? []).map((r) => [(r.includes("/") ? r : `mutmutco/${r}`).toLowerCase(), p])));
+  const classOf = (repo) => bySlugMeta.get(repo.toLowerCase())?.class ?? "deployable";
+  const seedClasses = classes ?? [...new Set(rosterRepos.map(classOf))];
+  const inClassRepos = rosterRepos.filter((repo) => seedClasses.includes(classOf(repo)));
+  const classPriority = [.../* @__PURE__ */ new Set(["deployable", ...seedClasses])].filter((c) => seedClasses.includes(c));
+  let canaryProject = null;
+  for (const cls of classPriority) {
+    const inClass = projects.filter((p) => p.seedCanary === true && (p.class ?? "deployable") === cls);
+    if (inClass.length === 0) continue;
+    if (inClass.length > 1) {
+      const slugs = inClass.map((p) => (p.repos ?? [])[0]?.split("/").pop() ?? "?").join(", ");
+      return fail(
+        `bootstrap propagate: ${what} (classes [${seedClasses.join(", ")}]) matches ${inClass.length} seedCanary:true repos in class '${cls}' (${slugs}) \u2014 exactly one seedCanary:true repo per class is required`
+      );
+    }
+    canaryProject = inClass[0];
+    break;
+  }
+  if (!canaryProject) {
+    return fail(
+      `bootstrap propagate: ${what} needs classes [${seedClasses.join(", ")}] but no registry repo with seedCanary:true carries a matching class \u2014 set seedCanary:true on an in-class repo (mmi-cli oracle org project set <slug> --var seedCanary=true)`
+    );
+  }
+  const canarySlug = (canaryProject.repos ?? [])[0]?.split("/").pop()?.toLowerCase() ?? null;
+  const canaryFullRepo = (canaryProject.repos ?? [])[0];
+  const sourcePilot = !!canaryFullRepo && (canaryFullRepo.includes("/") ? canaryFullRepo : `mutmutco/${canaryFullRepo}`).toLowerCase() === "mutmutco/mmi-hub";
+  return { projects, classOf, inClassRepos, canarySlug, sourcePilot };
+}
+async function propagatePins(apply, json) {
+  const source = await resolveHubSeedSource(execGitForSeedSource);
+  if (apply && !source.ok) return fail(`bootstrap propagate --pins --apply: ${source.reason}`);
+  const { classOf, inClassRepos, canarySlug, sourcePilot } = await propagationScope(null, "hub action pins");
+  const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
+  const repos = [];
+  for (const repo of inClassRepos) {
+    let waiver;
+    try {
+      waiver = archivedWaiver(JSON.parse((await gh2(["api", `repos/${repo}`])).stdout));
+    } catch {
+    }
+    repos.push({ repo, slug: repo.split("/").pop().toLowerCase(), waiver });
+  }
+  const tick = await runPinTick({
+    repos,
+    canarySlug,
+    sourcePilot,
+    gh: gh2,
+    apply,
+    baseBranchOf: (repo) => classOf(repo) === "content" ? "main" : "development",
+    createPr: async (args) => requireGhCreateOk(await ghCreate(args), "bootstrap propagate --pins pr create").url,
+    mayAutoMerge: (repo) => propagateMayAutoMerge(repo, classOf(repo), async (path2) => JSON.parse((await gh2(["api", path2])).stdout || "[]"))
+  });
+  if (json) console.log(JSON.stringify({ ...tick.plan, digest: tick.digest, diffs: tick.diffs, summary: summarizePropagationTick(tick.plan) }, null, 2));
+  else console.log(`${renderPinDiffs(tick)}
+
+${renderPropagationReport(tick.plan)}
+  pins: ${tick.digest}${source.ok ? ` from MMI-Hub@${source.sha}` : ""}`);
+  if (tick.plan.halted) process.exitCode = 1;
+}
 function registerBootstrapCommands(program3) {
   const bootstrap = program3.command("bootstrap").description("plan repo bootstrap operations; mutations require master-admin approval").option("--repo <owner/repo>", "target repo").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).option("--json", "machine-readable output").action((o) => {
     if (!o.repo) return fail("bootstrap: required option --repo <owner/repo> not specified");
@@ -48399,13 +48782,13 @@ function registerBootstrapCommands(program3) {
       })),
       pushAllowlistOwners: pushAllowlistAuthority(verifyOwners, declaredProjectAdmins(meta)),
       pushAllowlistOwnersRead: verifyOwnersRead,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs37.existsSync)(path2) ? (0, import_node_fs37.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs37.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs37.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs38.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs38.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -48483,14 +48866,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs37.existsSync)(s.target) ? (0, import_node_fs37.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs38.existsSync)(s.target) ? (0, import_node_fs38.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -48747,24 +49130,24 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs37.existsSync)(p) ? (0, import_node_fs37.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs38.existsSync)(p) ? (0, import_node_fs38.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path34.join)((0, import_node_os20.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path35.join)((0, import_node_os21.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs37.unlinkSync)(tmp);
+          (0, import_node_fs38.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -49398,13 +49781,14 @@ LIVE apply to ${repo}:
     if (deferredFailures.length) return failGraceful(`bootstrap apply: incomplete \u2014 every other step ran:
   ${deferredFailures.join("\n  ")}`);
   });
-  bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
+  bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an org-owned whole file or declared Hub-managed block)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").option("--pins", "H4: move every registered repo's mutmutco/MMI-Hub action pins to the blessed SHAs (cli/src/gate-budget.ts) instead of a seed target").option("--plan", "with --pins: print the per-repo pin diff only (the default)").option("--apply", "with --pins: LIVE \u2014 open/refresh one pin PR per repo in canary\u2192wave order").action(async () => {
+    if (rawFlag("--pins")) return propagatePins(rawFlag("--apply"), rawFlag("--json"));
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -49413,59 +49797,11 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs37.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs37.readFileSync)(seed.target, "utf8");
-    const readSeedFile2 = (path2) => (0, import_node_fs37.existsSync)(path2) ? (0, import_node_fs37.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs38.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs38.readFileSync)(seed.target, "utf8");
+    const readSeedFile2 = (path2) => (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
-    const cfg = await loadConfig();
-    const projects = await fetchProjectsList(registryClientDeps(cfg));
-    if (!projects || projects.length === 0) {
-      return failGraceful("bootstrap propagate: the registry roster is unreadable or empty \u2014 refusing to plan a tick from a scope this command could not establish (#4232 coverage invariant)");
-    }
-    const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
-    let independentCount = rosterRepos.length;
-    if ((0, import_node_fs37.existsSync)("projects.json")) {
-      try {
-        const local = JSON.parse((0, import_node_fs37.readFileSync)("projects.json", "utf8"));
-        const localRepos = /* @__PURE__ */ new Set();
-        for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
-          const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
-          if (full !== "mutmutco/mmi-hub") localRepos.add(full);
-        }
-        if (localRepos.size > 0) independentCount = localRepos.size;
-      } catch {
-      }
-    }
-    try {
-      assertPropagationCoverage(rosterRepos.length, independentCount);
-    } catch (e) {
-      return fail(e.message);
-    }
-    const bySlugMeta = new Map(projects.flatMap((p) => (p.repos ?? []).map((r) => [(r.includes("/") ? r : `mutmutco/${r}`).toLowerCase(), p])));
-    const classOf = (repo) => bySlugMeta.get(repo.toLowerCase())?.class ?? "deployable";
-    const inClassRepos = rosterRepos.filter((repo) => seed.classes.includes(classOf(repo)));
-    const classPriority = [.../* @__PURE__ */ new Set(["deployable", ...seed.classes])].filter((c) => seed.classes.includes(c));
-    let canaryProject = null;
-    for (const cls of classPriority) {
-      const inClass = projects.filter((p) => p.seedCanary === true && (p.class ?? "deployable") === cls);
-      if (inClass.length === 0) continue;
-      if (inClass.length > 1) {
-        const slugs = inClass.map((p) => (p.repos ?? [])[0]?.split("/").pop() ?? "?").join(", ");
-        return fail(
-          `bootstrap propagate: target '${seed.target}' (classes [${seed.classes.join(", ")}]) matches ${inClass.length} seedCanary:true repos in class '${cls}' (${slugs}) \u2014 exactly one seedCanary:true repo per class is required`
-        );
-      }
-      canaryProject = inClass[0];
-      break;
-    }
-    if (!canaryProject) {
-      return fail(
-        `bootstrap propagate: target '${seed.target}' needs classes [${seed.classes.join(", ")}] but no registry repo with seedCanary:true carries a matching class \u2014 set seedCanary:true on an in-class repo (mmi-cli oracle org project set <slug> --var seedCanary=true)`
-      );
-    }
-    const canarySlug = (canaryProject.repos ?? [])[0]?.split("/").pop()?.toLowerCase() ?? null;
-    const canaryFullRepo = (canaryProject.repos ?? [])[0];
-    const sourcePilot = !!canaryFullRepo && (canaryFullRepo.includes("/") ? canaryFullRepo : `mutmutco/${canaryFullRepo}`).toLowerCase() === "mutmutco/mmi-hub";
+    const { projects, classOf, inClassRepos, canarySlug, sourcePilot } = await propagationScope(seed.classes, `target '${seed.target}'`);
     const repos = inClassRepos.map((repo) => {
       const slug = repo.split("/").pop().toLowerCase();
       const waiver = seed.waivers?.[slug];
@@ -49582,7 +49918,7 @@ LIVE apply to ${repo}:
       if (plan.refusedNoCanary) return fail("bootstrap propagate --execute: no canary declared for this target \u2014 refusing to write (set seedCanary:true on exactly one registry repo)");
       const headSha = seedSource.sha;
       const sourceBlob = (await execGitForSeedSource(["rev-parse", `${headSha}:${seedSourcePath(seed)}`])).trim();
-      const runbookUnaffected = (0, import_node_fs37.existsSync)(RUNBOOK_UNAFFECTED_PATH) ? runbookUnaffectedReason(JSON.parse((0, import_node_fs37.readFileSync)(RUNBOOK_UNAFFECTED_PATH, "utf8")), seed.target, sourceBlob) : void 0;
+      const runbookUnaffected = (0, import_node_fs38.existsSync)(RUNBOOK_UNAFFECTED_PATH) ? runbookUnaffectedReason(JSON.parse((0, import_node_fs38.readFileSync)(RUNBOOK_UNAFFECTED_PATH, "utf8")), seed.target, sourceBlob) : void 0;
       for (const rec of plan.records) {
         if (rec.action !== "open-pr") continue;
         const baseBranch = classOf(rec.repo) === "content" ? "main" : "development";
@@ -49604,15 +49940,15 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path34.join)((0, import_node_os20.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path35.join)((0, import_node_os21.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha, runbookUnaffected)), "utf8");
+        (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha, runbookUnaffected)), "utf8");
         try {
           await gh2(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs37.unlinkSync)(tmp);
+            (0, import_node_fs38.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -49681,10 +50017,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -49701,10 +50037,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs37.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs38.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs37.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs38.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -49781,13 +50117,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path34.join)((0, import_node_os20.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path35.join)((0, import_node_os21.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs37.unlinkSync)(tmp);
+          (0, import_node_fs38.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -50100,7 +50436,7 @@ init_github_client();
 init_cli_shared();
 
 // src/suite-status.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -50128,7 +50464,7 @@ function parseSuiteMapping(body) {
     return void 0;
   }
 }
-var sha256 = (b) => (0, import_node_crypto15.createHash)("sha256").update(b).digest("hex");
+var sha256 = (b) => (0, import_node_crypto16.createHash)("sha256").update(b).digest("hex");
 async function proveBundle(url, tag, fetchUrl) {
   const get = async (u) => {
     try {
@@ -50383,9 +50719,9 @@ async function waitSuiteDev(deps, opts) {
 }
 
 // src/suite-train.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path35 = require("node:path");
-var import_node_crypto16 = require("node:crypto");
+var import_node_fs39 = require("node:fs");
+var import_node_path36 = require("node:path");
+var import_node_crypto17 = require("node:crypto");
 
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -50470,7 +50806,7 @@ function suiteReleaseTag(rc) {
 function readSuiteCut(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs38.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs39.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -50486,11 +50822,11 @@ function readSuiteCut(path2) {
   return record2;
 }
 function writeSuiteCut(path2, record2) {
-  (0, import_node_fs38.mkdirSync)((0, import_node_path35.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto16.randomBytes)(8).toString("hex")}.tmp`;
+  (0, import_node_fs39.mkdirSync)((0, import_node_path36.dirname)(path2), { recursive: true });
+  const temp = `${path2}.${(0, import_node_crypto17.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    (0, import_node_fs38.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
-    (0, import_node_fs38.renameSync)(temp, path2);
+    (0, import_node_fs39.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
+    (0, import_node_fs39.renameSync)(temp, path2);
   } catch (e) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
@@ -50539,25 +50875,25 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
 async function retireFailedLeadRcLedger(deps, ownerGo) {
-  if (!(0, import_node_fs38.existsSync)(deps.ledgerPath)) return void 0;
+  if (!(0, import_node_fs39.existsSync)(deps.ledgerPath)) return void 0;
   return withLedgerLock(deps.ledgerPath, async (fence) => {
-    const ledger = parseReleaseLedger((0, import_node_fs38.readFileSync)(deps.ledgerPath, "utf8"));
+    const ledger = parseReleaseLedger((0, import_node_fs39.readFileSync)(deps.ledgerPath, "utf8"));
     const states = Object.values(ledger.phases).map((p) => p.state);
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
-    const archive = (0, import_node_path35.join)((0, import_node_path35.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
-    if ((0, import_node_fs38.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    const archive = (0, import_node_path36.join)((0, import_node_path36.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
+    if ((0, import_node_fs39.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
-    await fence(() => (0, import_node_fs38.renameSync)(deps.ledgerPath, archive));
+    await fence(() => (0, import_node_fs39.renameSync)(deps.ledgerPath, archive));
     return `${ledger.tag} (ledger archived to ${archive})`;
   });
 }
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record2 = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record2.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
-  if ((0, import_node_fs38.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
-  (0, import_node_fs38.renameSync)(recordPath, archive);
+  if ((0, import_node_fs39.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
+  (0, import_node_fs39.renameSync)(recordPath, archive);
   return { archive, orphanTags: record2.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
 async function suiteRestoreMainPins(deps) {
@@ -50644,12 +50980,12 @@ async function suiteRcandRun(deps, opts) {
   }
   if ((record2?.announcement === "sent" || record2?.announcement === "skipped") && record2.leadReleased) {
     const archive = `${deps.recordPath}.${record2.leadRcTag}.json`;
-    if ((0, import_node_fs38.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
-    (0, import_node_fs38.renameSync)(deps.recordPath, archive);
+    if ((0, import_node_fs39.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
+    (0, import_node_fs39.renameSync)(deps.recordPath, archive);
     record2 = void 0;
   }
   if (record2 && !record2.pinPr && !record2.leadRcTag && record2.members.every((m) => !m.tag)) {
-    (0, import_node_fs38.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs39.rmSync)(deps.recordPath, { force: true });
     record2 = void 0;
   }
   if (!record2) {
@@ -50703,7 +51039,7 @@ async function suiteRcandRun(deps, opts) {
     quiet.push(member);
   }
   if (record2.members.every((m) => m.carried || quiet.includes(m)) && await deps.contains(SUITE_REPO, record2.leadDevelopment, record2.leadPreviousRc)) {
-    (0, import_node_fs38.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs39.rmSync)(deps.recordPath, { force: true });
     throw new Error("nothing to promote: neither MM-Work nor any module has new development commits since its rc; no suite cut started");
   }
   for (const member of quiet) {
@@ -50721,7 +51057,7 @@ async function suiteRcandRun(deps, opts) {
   }
   if (refusals.length) {
     const untouched = record2.members.every((m) => !m.tag) && !record2.pinPr;
-    if (untouched) (0, import_node_fs38.rmSync)(deps.recordPath, { force: true });
+    if (untouched) (0, import_node_fs39.rmSync)(deps.recordPath, { force: true });
     throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
@@ -50913,11 +51249,11 @@ Each member's live release must serve <data>/main/module.js at its main pin path
   }
   return record2;
 }
-var hotfixRecordPath = (deps) => (0, import_node_path35.join)((0, import_node_path35.dirname)(deps.recordPath), "hotfix.json");
+var hotfixRecordPath = (deps) => (0, import_node_path36.join)((0, import_node_path36.dirname)(deps.recordPath), "hotfix.json");
 function readSuiteHotfix(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs38.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs39.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -50960,7 +51296,7 @@ async function suiteHotfix(deps, opts) {
   if (completed) record2 = void 0;
   if (record2 && record2.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record2.repo} is recorded; finish it (rerun with that member) first`);
   if (!record2?.tag) await deps.validateHotfixSummary();
-  if (completed) (0, import_node_fs38.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
+  if (completed) (0, import_node_fs39.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
   const rec = record2 ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
   const save = () => writeSuiteHotfix(path2, rec);
   save();
@@ -51228,9 +51564,9 @@ async function runRcDataSwitch(deps, opts) {
 
 // src/suite-train-io.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_path48 = require("node:path");
-var import_node_fs51 = require("node:fs");
 var import_node_path49 = require("node:path");
+var import_node_fs52 = require("node:fs");
+var import_node_path50 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
@@ -51583,9 +51919,9 @@ A hotfix branch is cut from origin/main and carries ONLY the fixes --from names,
 async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return { failures: [], skipped: [] };
   const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
-  const { tmpdir: tmpdir12 } = await import("node:os");
+  const { tmpdir: tmpdir13 } = await import("node:os");
   const { join: join54 } = await import("node:path");
-  const dir = await mkdtemp2(join54(tmpdir12(), "mmi-hotfix-preflight-"));
+  const dir = await mkdtemp2(join54(tmpdir13(), "mmi-hotfix-preflight-"));
   const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
   const skipped = [];
@@ -52922,12 +53258,75 @@ function checkHotfixCarries(options) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs39 = require("node:fs");
-var import_node_path36 = require("node:path");
-var import_node_os21 = require("node:os");
+var import_node_fs40 = require("node:fs");
+var import_node_path37 = require("node:path");
+var import_node_os22 = require("node:os");
 init_cli_shared();
 init_github_client();
 
+// src/post-merge-app-route.ts
+init_cli_shared();
+init_github_client();
+var PostMergeCredentialError = class extends Error {
+  constructor(label, why) {
+    super(`post-merge credential refused (${label}): ${why}`);
+    this.name = "PostMergeCredentialError";
+  }
+};
+function isUnauthorized(e) {
+  if (e instanceof GitHubApiError) return e.status === 401;
+  const text = `${e?.stderr ?? ""} ${e?.message ?? ""}`;
+  return /HTTP 401|Bad credentials|gh auth login|set the GH_TOKEN environment variable/i.test(text);
+}
+async function appTokenFor(label, first) {
+  let token;
+  try {
+    token = await refreshPollToken();
+  } catch (e) {
+    throw new PostMergeCredentialError(label, `HTTP 401 on the gh login and the App installation token could not be minted (${e.message})`);
+  }
+  if (!token) throw new PostMergeCredentialError(label, `HTTP 401 on the gh login (${first.message.trim()}) and this host has no App installation token to retry on`);
+  return token;
+}
+async function ghWithAppOn401(label, args, options) {
+  try {
+    return await execFileP("gh", args, options);
+  } catch (e) {
+    if (!isUnauthorized(e)) throw e;
+    const token = await appTokenFor(label, e);
+    try {
+      return await execFileP("gh", args, { ...options, env: { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" } });
+    } catch (e2) {
+      if (!isUnauthorized(e2)) throw e2;
+      throw new PostMergeCredentialError(label, "still HTTP 401 with the App installation token (expired or revoked App credential)");
+    }
+  }
+}
+function withAppOn401(client, label = "post-merge") {
+  let app;
+  const run = async (call) => {
+    try {
+      return await call(app ?? client);
+    } catch (e) {
+      if (!isUnauthorized(e)) throw e;
+      if (app) throw new PostMergeCredentialError(label, "still HTTP 401 with the App installation token (expired or revoked App credential)");
+      const token = await appTokenFor(label, e);
+      app = createGitHubClient({ token: async () => token });
+      try {
+        return await call(app);
+      } catch (e2) {
+        if (isUnauthorized(e2)) throw new PostMergeCredentialError(label, "still HTTP 401 with the App installation token (expired or revoked App credential)");
+        throw e2;
+      }
+    }
+  };
+  return {
+    rest: (method, path2, init) => run((c) => c.rest(method, path2, init)),
+    restPaginate: (path2, init) => run((c) => c.restPaginate(path2, init)),
+    graphql: (query, variables, init) => run((c) => c.graphql(query, variables, init))
+  };
+}
+
 // src/board-advance.ts
 function repoOf2(ref) {
   if (!ref || typeof ref !== "object") return void 0;
@@ -53148,10 +53547,10 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
     // only for PRs into the default branch, so a PR into rc/main (a train or hotfix PR) never falls back.
     fallback: {
       fetchClaimed: async () => {
-        const { stdout } = await execFileP("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "body,baseRefName"], { timeout: GC_GH_TIMEOUT_MS });
+        const { stdout } = await ghWithAppOn401("PR body read", ["pr", "view", prNumber, ...repoArgs, "--json", "body,baseRefName"], { timeout: GC_GH_TIMEOUT_MS });
         const { body, baseRefName } = JSON.parse(stdout || "null") ?? {};
         if (typeof body !== "string" || typeof baseRefName !== "string") throw new Error("gh returned no PR body or base branch");
-        const repoView = await execFileP("gh", ["repo", "view", repo, "--json", "defaultBranchRef"], { timeout: GC_GH_TIMEOUT_MS });
+        const repoView = await ghWithAppOn401("default branch read", ["repo", "view", repo, "--json", "defaultBranchRef"], { timeout: GC_GH_TIMEOUT_MS });
         const defaultBranch = JSON.parse(repoView.stdout || "null")?.defaultBranchRef?.name;
         if (typeof defaultBranch !== "string" || !defaultBranch) throw new Error("gh returned no default branch");
         if (baseRefName !== defaultBranch) return [];
@@ -53159,7 +53558,7 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
       },
       closeIssue: async (n) => {
         try {
-          const view = await execFileP("gh", ["issue", "view", String(n), "--repo", repo, "--json", "state"], { timeout: GC_GH_TIMEOUT_MS });
+          const view = await ghWithAppOn401("issue state read", ["issue", "view", String(n), "--repo", repo, "--json", "state"], { timeout: GC_GH_TIMEOUT_MS });
           if (JSON.parse(view.stdout || "null")?.state !== "OPEN") return { state: "already-closed" };
           await execFileP("gh", [
             "issue",
@@ -53179,7 +53578,7 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
       }
     },
     fetchClosingIssues: async () => {
-      const { stdout } = await execFileP("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "closingIssuesReferences"], { timeout: GC_GH_TIMEOUT_MS });
+      const { stdout } = await ghWithAppOn401("closingIssuesReferences read", ["pr", "view", prNumber, ...repoArgs, "--json", "closingIssuesReferences"], { timeout: GC_GH_TIMEOUT_MS });
       const parsed = JSON.parse(stdout || "null");
       if (!parsed || typeof parsed !== "object" || !("closingIssuesReferences" in parsed)) {
         throw new Error("gh returned no closingIssuesReferences field for this PR");
@@ -53268,13 +53667,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path36.join)((0, import_node_os21.tmpdir)(), "mmi-squash-body-"));
-  const path2 = (0, import_node_path36.join)(dir, "body.txt");
-  (0, import_node_fs39.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path37.join)((0, import_node_os22.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path37.join)(dir, "body.txt");
+  (0, import_node_fs40.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs39.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -53541,9 +53940,9 @@ function hubReleaseCiRun(env) {
 }
 
 // src/release-custody.ts
-var import_node_crypto17 = require("node:crypto");
-var import_node_fs40 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_crypto18 = require("node:crypto");
+var import_node_fs41 = require("node:fs");
+var import_node_path38 = require("node:path");
 init_github_client();
 
 // src/release-custody-bootstrap.ts
@@ -53764,7 +54163,7 @@ var ReleaseCustodyError = class extends Error {
     this.name = "ReleaseCustodyError";
   }
 };
-var custodyDigest = (value) => (0, import_node_crypto17.createHash)("sha256").update(value).digest("hex");
+var custodyDigest = (value) => (0, import_node_crypto18.createHash)("sha256").update(value).digest("hex");
 function parseCustody(raw, repo) {
   const s = JSON.parse(raw);
   if (s.schema !== "mmi-release-custody/v1" || s.repo !== repo || !s.precutId || !Number.isSafeInteger(s.revision) || s.revision < 1 || !s.controller || !Number.isSafeInteger(s.controller.runId) || s.controller.runId <= 0 || !Number.isSafeInteger(s.controller.runAttempt) || s.controller.runAttempt <= 0 || !s.controller.token || !(s.ledger === null || typeof s.ledger === "string") || !s.archives || !s.effects) {
@@ -53852,7 +54251,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
       throw new ReleaseCustodyError(`previous controller run ${found.state.controller.runId} attempt ${found.state.controller.runAttempt} is not proven terminal`);
     }
     let state = {
-      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto17.randomUUID)(), effects: {}, ...await initialize() },
+      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto18.randomUUID)(), effects: {}, ...await initialize() },
       revision: (found.state?.revision ?? 0) + 1,
       controller
     };
@@ -53913,7 +54312,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
           proof: { kind: "ledger-lifecycle", controller: state.controller }
         };
       }
-      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto17.randomUUID)() : state.precutId };
+      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto18.randomUUID)() : state.precutId };
     });
   }
   async preserveLocal(raw) {
@@ -54013,7 +54412,7 @@ function reclassifySupersededArchives(state) {
 }
 function localRaw(path2) {
   try {
-    return (0, import_node_fs40.readFileSync)(path2, "utf8");
+    return (0, import_node_fs41.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -54022,14 +54421,14 @@ function localRaw(path2) {
 function hydrateLocal(path2, raw) {
   const previous = localRaw(path2);
   if (previous === raw) return;
-  (0, import_node_fs40.mkdirSync)((0, import_node_path37.dirname)(path2), { recursive: true });
+  (0, import_node_fs41.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
   if (previous !== null) {
     const ledger = parseReleaseLedger(previous);
-    const archive = (0, import_node_path37.join)((0, import_node_path37.dirname)(path2), `phases.local-${ledger.tagSha}-${custodyDigest(previous)}.json`);
-    if (!(0, import_node_fs40.existsSync)(archive)) (0, import_node_fs40.writeFileSync)(archive, previous, { flag: "wx" });
-    if (raw === null) (0, import_node_fs40.renameSync)(path2, `${path2}.retired-${custodyDigest(previous)}`);
+    const archive = (0, import_node_path38.join)((0, import_node_path38.dirname)(path2), `phases.local-${ledger.tagSha}-${custodyDigest(previous)}.json`);
+    if (!(0, import_node_fs41.existsSync)(archive)) (0, import_node_fs41.writeFileSync)(archive, previous, { flag: "wx" });
+    if (raw === null) (0, import_node_fs41.renameSync)(path2, `${path2}.retired-${custodyDigest(previous)}`);
   }
-  if (raw !== null) (0, import_node_fs40.writeFileSync)(path2, raw, "utf8");
+  if (raw !== null) (0, import_node_fs41.writeFileSync)(path2, raw, "utf8");
 }
 async function commandIdentity(file, args, run, repo) {
   if (file === "git" && args[0] === "push") {
@@ -54139,7 +54538,7 @@ function withHubReleaseCustody(deps) {
         if (!authority.ok || !authority.train || authority.authenticatedDelegation !== true) {
           throw new ReleaseCustodyError("repository custody requires the server-verified owner-triggered train session");
         }
-        const controller = { ...runIdentity, token: (0, import_node_crypto17.randomUUID)() };
+        const controller = { ...runIdentity, token: (0, import_node_crypto18.randomUUID)() };
         const raw = localRaw(path2);
         const requiredContexts = () => discoverRequiredCheckContexts(
           deps,
@@ -54219,8 +54618,8 @@ function withHubReleaseCustody(deps) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs41 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path39 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -54267,14 +54666,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path38.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs41.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path39.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs42.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs41.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs42.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines2 = [
     `# ${projectName}`,
     "",
@@ -54293,8 +54692,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs41.existsSync)((0, import_node_path38.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs41.existsSync)((0, import_node_path38.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs42.existsSync)((0, import_node_path39.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs42.existsSync)((0, import_node_path39.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -54316,8 +54715,8 @@ async function syncProjectInfo(plan, client, apply) {
 }
 
 // src/train-commands.ts
-var import_node_fs42 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_path40 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -54332,7 +54731,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs42.readFileSync)((0, import_node_path39.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs43.readFileSync)((0, import_node_path40.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -54443,7 +54842,7 @@ function releaseProgressVerdict(status, subject = "Release") {
 
 // src/suite-pin.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path40 = require("node:path");
+var import_node_path41 = require("node:path");
 var SuitePinError = class _SuitePinError extends Error {
   diagnostic;
   constructor(repo, tag, error) {
@@ -54511,8 +54910,8 @@ async function openSuiteCutPinPr(deps, input) {
       if (input.carriedOnly) return { status: "unchanged" };
       throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
     }
-    await (0, import_promises6.mkdir)((0, import_node_path40.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path40.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path41.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path41.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", prs.length ? branch : "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     if (prs.length) {
@@ -54524,7 +54923,7 @@ async function openSuiteCutPinPr(deps, input) {
       await run("git", ["switch", "-c", branch]);
     }
     for (const stage of ["rc", "main"]) {
-      const path2 = (0, import_node_path40.join)(scratch, `${stage}-pins.json`);
+      const path2 = (0, import_node_path41.join)(scratch, `${stage}-pins.json`);
       await (0, import_promises6.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
@@ -54577,12 +54976,12 @@ async function openSuiteRestorePinPr(deps, input) {
       }
     });
     if (!todo.length) return void 0;
-    await (0, import_promises6.mkdir)((0, import_node_path40.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path40.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path41.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path41.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
-    const path2 = (0, import_node_path40.join)(scratch, "main-pins.json");
+    const path2 = (0, import_node_path41.join)(scratch, "main-pins.json");
     await (0, import_promises6.writeFile)(path2, JSON.stringify(todo.map((p) => ({ module: p.module, url: p.prior }))));
     await run("node", ["scripts/pin-modules.mjs", "--stage", "main", "--pins", path2]);
     await run("git", ["add", "seed/modules.json"]);
@@ -54656,8 +55055,8 @@ async function openSuitePinPr(deps, input) {
     if (newer.length) return { status: "superseded", pr: newer[0].url, url: pin };
     const open2 = onBranch.find((p) => p.state === "OPEN");
     if (open2 && tagOf(open2.title ?? "") === tag) return { status: "pending", pr: open2.url, url: pin };
-    await (0, import_promises6.mkdir)((0, import_node_path40.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path40.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path41.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path41.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
@@ -54706,7 +55105,7 @@ function prTitleRefusal(title) {
 
 // src/command-register-collaboration.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs50 = require("node:fs");
+var import_node_fs51 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -54730,11 +55129,11 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 init_house_map();
 
 // src/issue-body.ts
-var import_node_os22 = require("node:os");
+var import_node_os23 = require("node:os");
 init_error_codes();
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
@@ -54747,7 +55146,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os22.platform)() === "win32") {
+  if ((0, import_node_os23.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -54847,8 +55246,8 @@ init_github_client();
 init_github_quota();
 
 // src/issue-commands.ts
-var import_node_fs43 = require("node:fs");
-var import_node_crypto18 = require("node:crypto");
+var import_node_fs44 = require("node:fs");
+var import_node_crypto19 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -55040,7 +55439,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs43.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs44.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -55149,8 +55548,11 @@ async function closeIssue(client, options, deps = {}) {
   }
   const appWriter = await selectClaimWriteClient(client, deps.appClient);
   if (reason === "completed" && options.evidence !== void 0) {
-    const ensureLabels = deps.ensureLabels ?? ensureLabelsExist;
-    await ensureLabels([CLOSED_MERGED_LOOP_STATE_LABEL], repo);
+    try {
+      await appWriter.rest("POST", `repos/${repo}/labels`, { body: { name: CLOSED_MERGED_LOOP_STATE_LABEL, color: "ededed" } });
+    } catch (e) {
+      if (!(e instanceof GitHubApiError && e.status === 422)) throw e;
+    }
     await appWriter.rest("POST", `repos/${repo}/issues/${parsed.number}/labels`, {
       body: { labels: [CLOSED_MERGED_LOOP_STATE_LABEL] }
     });
@@ -55322,7 +55724,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto18.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto19.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -55704,7 +56106,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs43.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs44.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) {
           const top = specs === null ? "null" : typeof specs === "object" ? `an object with keys: ${Object.keys(specs).join(", ") || "(none)"}` : `a ${typeof specs}`;
@@ -55781,8 +56183,8 @@ ${lines2}`, {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs44 = require("node:fs");
-var import_node_path41 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path42 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 init_github_client();
@@ -55842,7 +56244,8 @@ function explicitSameOrgIssueUrls(text, prRepo, closingNumbers) {
   }
   return [...found.values()];
 }
-async function reconcileCrossRepoFilingIssue(client, prRepo, prNumber) {
+async function reconcileCrossRepoFilingIssue(rawClient, prRepo, prNumber) {
+  const client = withAppOn401(rawClient, `cross-repo filing reconcile ${prRepo}#${prNumber}`);
   try {
     const pr = await client.rest("GET", `repos/${prRepo}/pulls/${prNumber}`);
     if (!pr.merged_at) return { status: "not-applicable" };
@@ -55874,7 +56277,7 @@ ${pr.body ?? ""}`;
     const issue = `${target.repo}#${target.number}`;
     if (target.state === "CLOSED") return { status: "already-closed", issue, url: target.url };
     const prUrl = pr.html_url ?? `https://github.com/${prRepo}/pull/${prNumber}`;
-    const comment = await client.rest("POST", `repos/${target.repo}/issues/${target.number}/comments`, {
+    const comment = await (await selectClaimWriteClient(client)).rest("POST", `repos/${target.repo}/issues/${target.number}/comments`, {
       body: { body: `Resolved by merged PR ${prUrl}.
 
 <!-- mmi-cross-repo-close:${prRepo}#${prNumber} -->` }
@@ -55951,16 +56354,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs44.mkdirSync)((0, import_node_path41.dirname)(path2), { recursive: true });
-  (0, import_node_fs44.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs45.mkdirSync)((0, import_node_path42.dirname)(path2), { recursive: true });
+  (0, import_node_fs45.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs44.existsSync)(path2)) return;
+  if (!(0, import_node_fs45.existsSync)(path2)) return;
   try {
-    (0, import_node_fs44.unlinkSync)(path2);
+    (0, import_node_fs45.unlinkSync)(path2);
   } catch {
   }
 }
@@ -56436,9 +56839,9 @@ function registerPrLifecycleCommands(program3) {
 
 // src/review-verdict.ts
 var import_node_child_process14 = require("node:child_process");
-var import_node_fs45 = require("node:fs");
-var import_node_os23 = require("node:os");
-var import_node_path42 = require("node:path");
+var import_node_fs46 = require("node:fs");
+var import_node_os24 = require("node:os");
+var import_node_path43 = require("node:path");
 init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
 var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
@@ -56603,15 +57006,15 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs45.mkdtempSync)((0, import_node_path42.join)((0, import_node_os23.tmpdir)(), "mmi-review-verdict-"));
-  const path2 = (0, import_node_path42.join)(dir, "body.md");
+  const dir = (0, import_node_fs46.mkdtempSync)((0, import_node_path43.join)((0, import_node_os24.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path43.join)(dir, "body.md");
   try {
-    (0, import_node_fs45.writeFileSync)(path2, body, "utf8");
+    (0, import_node_fs46.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
     return stdout.trim();
   } finally {
     try {
-      (0, import_node_fs45.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs46.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -57024,18 +57427,18 @@ function createPreparationDeps(input, io = {}) {
 }
 
 // src/worktree-residue-sweep.ts
-var import_node_fs49 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_fs50 = require("node:fs");
+var import_node_path47 = require("node:path");
 
 // src/worktree-merge-cleanup.ts
-var import_node_fs48 = require("node:fs");
-var import_node_path45 = require("node:path");
+var import_node_fs49 = require("node:fs");
+var import_node_path46 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs47 = require("node:fs");
-var import_node_path44 = require("node:path");
+var import_node_fs48 = require("node:fs");
+var import_node_path45 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
@@ -57045,8 +57448,8 @@ function normalizeEol2(s) {
 }
 
 // src/env-detection.ts
-var import_node_fs46 = require("node:fs");
-var import_node_path43 = require("node:path");
+var import_node_fs47 = require("node:fs");
+var import_node_path44 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
   return name.toLowerCase() === ".env";
@@ -57056,7 +57459,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs46.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs47.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -57064,13 +57467,13 @@ function findEnvFiles(root) {
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
-        walk2((0, import_node_path43.join)(dir, entry.name), relPath);
+        walk2((0, import_node_path44.join)(dir, entry.name), relPath);
         continue;
       }
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs46.lstatSync)((0, import_node_path43.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs47.lstatSync)((0, import_node_path44.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -57209,12 +57612,12 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path44.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs47.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path45.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs48.existsSync)(configured)) return configured;
   const candidates = [
-    (0, import_node_path44.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
-    ...process.env.LOCALAPPDATA ? [(0, import_node_path44.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
+    (0, import_node_path45.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
+    ...process.env.LOCALAPPDATA ? [(0, import_node_path45.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
-  const bash = candidates.find((path2) => (0, import_node_fs47.existsSync)(path2));
+  const bash = candidates.find((path2) => (0, import_node_fs48.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
   return bash;
 }
@@ -57352,7 +57755,7 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path44.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path45.join)(cwd, "tmp", "stage", "state.json");
 }
 function normPath(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -57569,8 +57972,8 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
-  const envFile = (0, import_node_path44.join)(cwd, ".env");
-  return (0, import_node_fs47.existsSync)(envFile) && envFileKeys((0, import_node_fs47.readFileSync)(envFile, "utf8")).has("PORT");
+  const envFile = (0, import_node_path45.join)(cwd, ".env");
+  return (0, import_node_fs48.existsSync)(envFile) && envFileKeys((0, import_node_fs48.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
   const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
@@ -57585,13 +57988,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs47.existsSync)((0, import_node_path44.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs48.existsSync)((0, import_node_path45.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs47.existsSync)((0, import_node_path44.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs48.existsSync)((0, import_node_path45.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -57607,21 +58010,21 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   }
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson), runtimeEnvSelects(configJson));
   if (!body) return {};
-  const overridePath = (0, import_node_path44.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs47.mkdirSync)((0, import_node_path44.join)(cwd, "tmp", "stage"), { recursive: true });
-  (0, import_node_fs47.writeFileSync)(overridePath, body, "utf8");
+  const overridePath = (0, import_node_path45.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
+  (0, import_node_fs48.mkdirSync)((0, import_node_path45.join)(cwd, "tmp", "stage"), { recursive: true });
+  (0, import_node_fs48.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path44.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path44.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs47.existsSync)(target) && (0, import_node_fs47.existsSync)(example)) {
-    (0, import_node_fs47.copyFileSync)(example, target);
-  } else if ((0, import_node_fs47.existsSync)(target) && (0, import_node_fs47.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs47.readFileSync)(example, "utf8"), (0, import_node_fs47.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs47.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs47.statSync)(target).mtimeMs
+  const target = (0, import_node_path45.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path45.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs48.existsSync)(target) && (0, import_node_fs48.existsSync)(example)) {
+    (0, import_node_fs48.copyFileSync)(example, target);
+  } else if ((0, import_node_fs48.existsSync)(target) && (0, import_node_fs48.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs48.readFileSync)(example, "utf8"), (0, import_node_fs48.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs48.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs48.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running mmi-cli stage`;
@@ -57629,8 +58032,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs47.existsSync)(target)) {
-    (0, import_node_fs47.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs47.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs48.existsSync)(target)) {
+    (0, import_node_fs48.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs48.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -57660,20 +58063,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs47.existsSync)(path2)) return null;
+  if (!(0, import_node_fs48.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs47.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs48.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs47.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs48.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs47.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs48.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -57702,7 +58105,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
     );
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs47.rmSync)(path2, { force: true });
+    (0, import_node_fs48.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -57949,8 +58352,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs47.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs47.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs48.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs48.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -57969,9 +58372,9 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path45.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path46.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs48.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs48.rmdirSync)(nm);
+    if ((0, import_node_fs49.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs49.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -57982,8 +58385,8 @@ function defaultSleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs48.rmdirSync, exists = import_node_fs48.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs48.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs49.rmdirSync, exists = import_node_fs49.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs49.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -58106,28 +58509,28 @@ async function preCleanWorktreeForRemoval(wtPath, execGit) {
 }
 async function listNestedIgnoredNodeModules(wtPath, execGit) {
   const out = await execGit(["-C", wtPath, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory"]).catch(() => "");
-  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path45.join)(wtPath, line.slice(0, -1)));
+  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path46.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs48.lstatSync)(path2);
+  const stat4 = (0, import_node_fs49.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs48.rmdirSync)(path2);
+      (0, import_node_fs49.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs48.unlinkSync)(path2);
+      (0, import_node_fs49.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs48.readdirSync)(path2)) safeRemoveTree((0, import_node_path45.join)(path2, entry));
-    (0, import_node_fs48.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs49.readdirSync)(path2)) safeRemoveTree((0, import_node_path46.join)(path2, entry));
+    (0, import_node_fs49.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs48.unlinkSync)(path2);
+  (0, import_node_fs49.unlinkSync)(path2);
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
-    safeRemoveTree((0, import_node_path45.join)(wtPath, "node_modules"));
+    safeRemoveTree((0, import_node_path46.join)(wtPath, "node_modules"));
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -58139,7 +58542,7 @@ function errorMessage(e) {
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs48.realpathSync)(path2));
+    return normPath2((0, import_node_fs49.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -58147,10 +58550,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs48.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs49.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs48.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs49.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -58166,17 +58569,17 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs48.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs49.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
-      const child2 = (0, import_node_path45.join)(dir, entry.name);
+      const child2 = (0, import_node_path46.join)(dir, entry.name);
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs48.realpathSync)(child2));
+          target = normPath2((0, import_node_fs49.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -58359,7 +58762,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs48.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs49.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -58499,7 +58902,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
   if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
   unlinkedReparsePoints.push(...preHelperGuard.unlinked);
-  if (pathExists((0, import_node_path45.join)(wtPath, "node_modules"))) {
+  if (pathExists((0, import_node_path46.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? removeWorktreeNodeModules)(wtPath);
     if (!nmRemoved.ok) {
       report.worktree = {
@@ -58635,18 +59038,18 @@ function renderPrMergeCleanupLines(cleanup) {
 // src/worktree-residue-sweep.ts
 var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
 function canonicalWorktreeRoot(primary) {
-  return (0, import_node_path46.join)((0, import_node_path46.dirname)(primary), "mmi-worktrees", (0, import_node_path46.basename)(primary));
+  return (0, import_node_path47.join)((0, import_node_path47.dirname)(primary), "mmi-worktrees", (0, import_node_path47.basename)(primary));
 }
 function norm(p) {
   const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? s.toLowerCase() : s;
 }
 function residueLedgerPath(gitCommonDir) {
-  return (0, import_node_path46.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
+  return (0, import_node_path47.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
 }
 function readPaths(file, deps) {
   try {
-    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs49.readFileSync)(f, "utf8")))(file));
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs50.readFileSync)(f, "utf8")))(file));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -58655,8 +59058,8 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs49.mkdirSync)((0, import_node_path46.dirname)(f), { recursive: true });
-      (0, import_node_fs49.writeFileSync)(f, t, "utf8");
+      (0, import_node_fs50.mkdirSync)((0, import_node_path47.dirname)(f), { recursive: true });
+      (0, import_node_fs50.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
 `);
@@ -58670,17 +59073,17 @@ function recordResidue(gitCommonDir, path2, deps = {}) {
   writePaths(file, paths, deps);
 }
 async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
-  const exists = deps.exists ?? import_node_fs49.existsSync;
-  const readDir = deps.readDir ?? ((p) => (0, import_node_fs49.readdirSync)(p));
+  const exists = deps.exists ?? import_node_fs50.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs50.readdirSync)(p));
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return (0, import_node_fs49.statSync)(p).isDirectory();
+      return (0, import_node_fs50.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   });
   const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
-  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs49.rmdirSync)(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs50.rmdirSync)(p));
   const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
   const live = new Set(registered.map(norm));
   const primary = registered[0] ? norm(registered[0]) : void 0;
@@ -58715,7 +59118,7 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     } catch {
     }
     for (const name of children) {
-      const child2 = (0, import_node_path46.join)(root, name);
+      const child2 = (0, import_node_path47.join)(root, name);
       const key = norm(child2);
       if (live.has(key) || key === primary || keptKeys.has(key) || !isDir(child2)) continue;
       let entries;
@@ -58758,10 +59161,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path47.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path48.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs50.existsSync)((0, import_node_path47.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs50.existsSync)((0, import_node_path47.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs51.existsSync)((0, import_node_path48.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs51.existsSync)((0, import_node_path48.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -58773,12 +59176,12 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path47.join)(root, path2);
-      return (0, import_node_fs50.existsSync)(fullPath) ? (0, import_node_fs50.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path48.join)(root, path2);
+      return (0, import_node_fs51.existsSync)(fullPath) ? (0, import_node_fs51.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
-async function ghJson(args, timeout = 1e4) {
+async function ghJson2(args, timeout = 1e4) {
   const { stdout } = await execFileP("gh", args, { timeout });
   return JSON.parse(stdout);
 }
@@ -58852,6 +59255,24 @@ async function attachToProject(issueNumber, repo, priority) {
       }
       return { onBoard: true };
     }
+    const viaHub = contentId ? await attachOnIntegrationRefusal(detail, cfg, contentId) : void 0;
+    if (viaHub && "projectItemId" in viaHub) {
+      if (priority) {
+        try {
+          await setBoardItemPriority(defaultGitHubClient(), cfg, viaHub.projectItemId, priority);
+        } catch (pe) {
+          const perr = pe;
+          process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(perr.stderr || perr.message || String(pe)).trim()}
+`);
+        }
+      }
+      return { projectItemId: viaHub.projectItemId, onBoard: true, credential: "app_installation" };
+    }
+    if (viaHub) {
+      process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${viaHub.warning}
+`);
+      return { onBoard: false };
+    }
     if (isRateLimitText(detail)) {
       if (targetRepo2) {
         try {
@@ -59146,7 +59567,7 @@ function registerCollaborationCommands(program3) {
   async function readParentField(number, repo) {
     let payload;
     try {
-      payload = await ghJson(["api", `repos/${repo}/issues/${number}`]);
+      payload = await ghJson2(["api", `repos/${repo}/issues/${number}`]);
     } catch (e) {
       const err = e;
       return { parentReadError: (err.stderr || err.message || String(e)).trim() };
@@ -59163,7 +59584,7 @@ function registerCollaborationCommands(program3) {
   }
   async function readIssueTypeField(number, repo) {
     try {
-      return { issueType: resolveIssueType(await ghJson(["api", `repos/${repo}/issues/${number}`])) };
+      return { issueType: resolveIssueType(await ghJson2(["api", `repos/${repo}/issues/${number}`])) };
     } catch (e) {
       const err = e;
       return { issueTypeReadError: (err.stderr || err.message || String(e)).trim() };
@@ -59209,7 +59630,7 @@ function registerCollaborationCommands(program3) {
         const decisions = parseDecisionMarkers(data2.comments);
         return { data: { ...data2, decisions }, parent: await readParentField(targetNumber, targetRepo2) };
       }
-      const data = await ghJson(["issue", "view", String(targetNumber), "--repo", targetRepo2, "--json", gh2.ghFields]);
+      const data = await ghJson2(["issue", "view", String(targetNumber), "--repo", targetRepo2, "--json", gh2.ghFields]);
       return { data, parent: await readParentField(targetNumber, targetRepo2) };
     };
     const readClosedBy = async (targetRepo2, targetNumber) => ({
@@ -59244,7 +59665,7 @@ function registerCollaborationCommands(program3) {
     const repo = await resolveRepo(o.repo);
     if (!repo) return fail("issue discover-related: could not resolve repo");
     try {
-      const issues = await ghJson([
+      const issues = await ghJson2([
         "issue",
         "list",
         "--repo",
@@ -59259,7 +59680,7 @@ function registerCollaborationCommands(program3) {
       const candidates = findRelatedIssues({ number, title: o.title, body: o.body }, issues);
       if (o.json) return console.log(JSON.stringify({ number, repo, candidates }, null, 2));
       if (!candidates.length) return;
-      const viewed = await ghJson([
+      const viewed = await ghJson2([
         "issue",
         "view",
         String(number),
@@ -59360,7 +59781,7 @@ function registerCollaborationCommands(program3) {
     const checked = o.off !== true;
     let body;
     try {
-      const viewed = await ghJson(["issue", "view", String(parsed.number), "--repo", repo, "--json", "body"]);
+      const viewed = await ghJson2(["issue", "view", String(parsed.number), "--repo", repo, "--json", "body"]);
       body = viewed.body ?? "";
     } catch (e) {
       return fail(`issue check: could not read ${repo}#${parsed.number}: ${e.message}`);
@@ -59461,7 +59882,7 @@ ${list}`);
     if (!o.force) {
       let openLessons = [];
       try {
-        openLessons = await ghJson([
+        openLessons = await ghJson2([
           "issue",
           "list",
           "--repo",
@@ -59598,7 +60019,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         console.log(JSON.stringify(data2));
         return;
       }
-      const data = await ghJson(["pr", "view", String(n), "--repo", repo, "--json", effective]);
+      const data = await ghJson2(["pr", "view", String(n), "--repo", repo, "--json", effective]);
       console.log(JSON.stringify(data));
     } catch (e) {
       const err = e;
@@ -59606,11 +60027,11 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path47.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs50.existsSync)(wfDir)) return [];
-    return (0, import_node_fs50.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    const wfDir = (0, import_node_path48.join)(cwd, ".github", "workflows");
+    if (!(0, import_node_fs51.existsSync)(wfDir)) return [];
+    return (0, import_node_fs51.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs50.readFileSync)((0, import_node_path47.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs51.readFileSync)((0, import_node_path48.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -59815,7 +60236,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs50.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs51.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -59896,7 +60317,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         await readClosingGuardInput(number, repoArgs, landRepoForGuard, "pr land"),
         async (n) => {
           if (!landRepoForGuard) return void 0;
-          const viewed = await ghJson(["issue", "view", String(n), "--repo", landRepoForGuard, "--json", "state"]);
+          const viewed = await ghJson2(["issue", "view", String(n), "--repo", landRepoForGuard, "--json", "state"]);
           return typeof viewed.state === "string" ? viewed.state : void 0;
         }
       );
@@ -60093,7 +60514,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const cleanupMerged = async (r) => {
       if (opts.preserveWorktree) return "cleanup skipped (--preserve-worktree)";
       const ran = await execFileP(process.execPath, [process.argv[1], ...canonicalArgvFor(["pr", "merge", r.pr, "--repo", r.repo])], {
-        cwd: (0, import_node_fs50.existsSync)(cwd0) ? cwd0 : primaryRoot0,
+        cwd: (0, import_node_fs51.existsSync)(cwd0) ? cwd0 : primaryRoot0,
         timeout: GH_MUTATION_TIMEOUT_MS * 3
       }).then((x) => ({ stdout: x.stdout, stderr: x.stderr }), (e) => ({ stdout: e.stdout ?? "", stderr: e.stderr ?? "" }));
       const json = ran.stdout.split("\n").reverse().find((l) => l.startsWith("{"));
@@ -60154,7 +60575,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
       await readClosingGuardInput(number, repoArgs, repoForPostCleanup, "pr merge"),
       async (n) => {
         if (!repoForPostCleanup) return void 0;
-        const viewed = await ghJson(["issue", "view", String(n), "--repo", repoForPostCleanup, "--json", "state"]);
+        const viewed = await ghJson2(["issue", "view", String(n), "--repo", repoForPostCleanup, "--json", "state"]);
         return typeof viewed.state === "string" ? viewed.state : void 0;
       }
     );
@@ -60164,7 +60585,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs50.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs51.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -60196,7 +60617,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path47.join)((0, import_node_path47.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path48.join)((0, import_node_path48.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -60315,7 +60736,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs50.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs51.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -60430,7 +60851,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     let residueSweep;
     if (!(foreignCwd && !foreignCheckout)) {
       try {
-        gitCommonDir = (0, import_node_path47.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
+        gitCommonDir = (0, import_node_path48.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
         residueSweep = await sweepWorktreeResidue(gitCommonDir, beforeWorktrees.map((w) => w.path));
       } catch {
       }
@@ -60448,7 +60869,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs50.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs51.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -61711,7 +62132,7 @@ function rcRunCauseFromLog(log) {
 function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
-var suiteStateDir = (root) => (0, import_node_path49.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+var suiteStateDir = (root) => (0, import_node_path50.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
 async function runSuiteMemberRcand(repo, previousRc, rcWasAbsent) {
   const deps = trainApplyDeps();
   deps.suiteCut = suiteCutContext(repo, SUITE_REPO);
@@ -61758,16 +62179,16 @@ async function rcandInCheckout(repo, deps, previousRc, rcWasAbsent) {
   }
 }
 function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
-  const recordPath = (0, import_node_path49.join)(suiteStateDir(root), "cut.json");
-  const base = (0, import_node_path49.join)(suiteStateDir(root), "checkouts");
+  const recordPath = (0, import_node_path50.join)(suiteStateDir(root), "cut.json");
+  const base = (0, import_node_path50.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path49.join)(base, repo.split("/")[1]);
-    if (!(0, import_node_fs51.existsSync)(target)) {
-      (0, import_node_fs51.mkdirSync)(base, { recursive: true });
+    const target = (0, import_node_path50.join)(base, repo.split("/")[1]);
+    if (!(0, import_node_fs52.existsSync)(target)) {
+      (0, import_node_fs52.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs51.existsSync)((0, import_node_path49.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs52.existsSync)((0, import_node_path50.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -61831,7 +62252,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (repo === SUITE_REPO) return inTrain(repo, (deps) => rcandInCheckout(repo, deps, previousRc, rcWasAbsent));
     const target = await checkout(repo);
     return new Promise((resolveResult, reject2) => {
-      const child2 = (0, import_node_child_process18.fork)((0, import_node_path48.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
+      const child2 = (0, import_node_child_process18.fork)((0, import_node_path49.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
         cwd: target,
         stdio: ["ignore", "inherit", "inherit", "ipc"],
         execArgv: []
@@ -62074,9 +62495,9 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
-      (0, import_node_fs51.mkdirSync)(dir, { recursive: true });
-      const file = (0, import_node_path49.join)(dir, `notes-${leadTag}.md`);
-      (0, import_node_fs51.writeFileSync)(file, `${body}
+      (0, import_node_fs52.mkdirSync)(dir, { recursive: true });
+      const file = (0, import_node_path50.join)(dir, `notes-${leadTag}.md`);
+      (0, import_node_fs52.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
       await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
@@ -62117,7 +62538,7 @@ ${suiteMappingBlock(leadTag, mapping)}`);
 
 // src/suite-commands.ts
 init_cli_shared();
-var import_node_fs52 = require("node:fs");
+var import_node_fs53 = require("node:fs");
 function parseMemberSummaryFiles(entries) {
   const memberSummaryFiles = {};
   for (const entry of entries) {
@@ -62211,7 +62632,7 @@ function registerSuiteCommands(program3) {
       try {
         const io = suiteTrainIo(root);
         retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
-        if (retired && !(0, import_node_fs52.existsSync)(io.recordPath)) {
+        if (retired && !(0, import_node_fs53.existsSync)(io.recordPath)) {
           console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
           return;
         }
@@ -62451,9 +62872,9 @@ function registerJevCommands(program3) {
 
 // src/packages-adopt-export.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_fs53 = require("node:fs");
-var import_node_os24 = require("node:os");
-var import_node_path50 = require("node:path");
+var import_node_fs54 = require("node:fs");
+var import_node_os25 = require("node:os");
+var import_node_path51 = require("node:path");
 var import_node_util6 = require("node:util");
 init_cli_shared();
 
@@ -63073,38 +63494,38 @@ function expectedFromRun(run, opts) {
 }
 async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
-  const packagePath = (0, import_node_path50.join)(opts.dir, "package.json");
-  const lockPath = (0, import_node_path50.join)(opts.dir, "package-lock.json");
-  const packageText = (0, import_node_fs53.readFileSync)(packagePath, "utf8");
-  const lockText = (0, import_node_fs53.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs53.mkdtempSync)((0, import_node_path50.join)((0, import_node_os24.tmpdir)(), "mmi-adopt-export-"));
+  const packagePath = (0, import_node_path51.join)(opts.dir, "package.json");
+  const lockPath = (0, import_node_path51.join)(opts.dir, "package-lock.json");
+  const packageText = (0, import_node_fs54.readFileSync)(packagePath, "utf8");
+  const lockText = (0, import_node_fs54.readFileSync)(lockPath, "utf8");
+  const work = (0, import_node_fs54.mkdtempSync)((0, import_node_path51.join)((0, import_node_os25.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs53.writeFileSync)((0, import_node_path50.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs53.writeFileSync)((0, import_node_path50.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs53.writeFileSync)((0, import_node_path50.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
-    const script = (0, import_node_path50.join)(work, "package_export.py");
-    (0, import_node_fs53.writeFileSync)(script, package_export_default);
+    (0, import_node_fs54.writeFileSync)((0, import_node_path51.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs54.writeFileSync)((0, import_node_path51.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs54.writeFileSync)((0, import_node_path51.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    const script = (0, import_node_path51.join)(work, "package_export.py");
+    (0, import_node_fs54.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
-    const verified = (0, import_node_path50.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs53.readFileSync)((0, import_node_path50.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const verified = (0, import_node_path51.join)(work, "verified");
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs54.readFileSync)((0, import_node_path51.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
-      await deps.npm(["cache", "add", (0, import_node_path50.join)(verified, `${short3}.tgz`)], opts.dir);
+      await deps.npm(["cache", "add", (0, import_node_path51.join)(verified, `${short3}.tgz`)], opts.dir);
     }
-    (0, import_node_fs53.writeFileSync)(packagePath, plan.packageText);
-    (0, import_node_fs53.writeFileSync)(lockPath, plan.lockText);
+    (0, import_node_fs54.writeFileSync)(packagePath, plan.packageText);
+    (0, import_node_fs54.writeFileSync)(lockPath, plan.lockText);
     try {
       await deps.npm(["ci", "--offline", "--ignore-scripts", "--no-audit", "--no-fund"], opts.dir);
     } catch (error) {
-      (0, import_node_fs53.writeFileSync)(packagePath, packageText);
-      (0, import_node_fs53.writeFileSync)(lockPath, lockText);
+      (0, import_node_fs54.writeFileSync)(packagePath, packageText);
+      (0, import_node_fs54.writeFileSync)(lockPath, lockText);
       throw new Error(`npm ci --offline failed, package.json and package-lock.json restored: ${error.message}`);
     }
     return plan.result;
   } finally {
-    (0, import_node_fs53.rmSync)(work, { recursive: true, force: true });
+    (0, import_node_fs54.rmSync)(work, { recursive: true, force: true });
   }
 }
 var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process19.execFile);
@@ -63208,12 +63629,12 @@ function registerPackagesCommands(program3) {
 init_cli_shared();
 
 // src/wave-status.ts
-var import_node_fs54 = require("node:fs");
+var import_node_fs55 = require("node:fs");
 function observeStage(worktreePath) {
   const statePath = stageStatePath(worktreePath);
   let raw;
   try {
-    raw = (0, import_node_fs54.readFileSync)(statePath, "utf8");
+    raw = (0, import_node_fs55.readFileSync)(statePath, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return { state: "ok", value: { running: false } };
     return { state: "unavailable", reason: "stage state could not be read" };
@@ -63280,9 +63701,9 @@ async function collectWaveStatus(deps) {
 // src/discovery-commands.ts
 init_github_client();
 init_cli_shared();
-var import_node_fs55 = require("node:fs");
-var import_node_os25 = require("node:os");
-var import_node_path51 = require("node:path");
+var import_node_fs56 = require("node:fs");
+var import_node_os26 = require("node:os");
+var import_node_path52 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 var defaultStatusDeps = {
   repo: resolveRepo,
@@ -63501,10 +63922,10 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os25.homedir)();
+  const home = (0, import_node_os26.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path51.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs55.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path51.join)(home, ".claude", "settings.json"), import_node_fs55.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path52.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs56.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path52.join)(home, ".claude", "settings.json"), import_node_fs56.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -65690,7 +66111,7 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
 }
 
 // src/api-read.ts
-var import_node_fs56 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 
 // src/run-log-read.ts
 init_cli_shared();
@@ -65887,7 +66308,7 @@ var BROKER_MAX_BUFFER = 64 * 1024 * 1024;
 var PR_QUEUE_QUERY = "query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){mergeQueueEntry{state position enqueuedAt estimatedTimeToMerge headCommit{oid}}}}}";
 function missingBrokerPrRepoMessage(subcommand, number) {
   const example = subcommand === "list" ? "mmi-cli devops read pr list --repo <owner/repo> --state open --json number,title,headRefName" : subcommand === "diff" ? `mmi-cli devops read pr diff ${number ?? "<number>"} --repo <owner/repo> --name-only` : `mmi-cli devops read pr queue ${number ?? "<number>"} --repo <owner/repo> --json`;
-  return `read pr ${subcommand}: required option '--repo <owner/repo>' not specified \u2014 broker PR ${subcommand} reads do not infer the repo from a worktree's git origin; pass --repo <owner/repo> explicitly (e.g. \`${example}\`)`;
+  return `read pr ${subcommand}: required option '--repo <owner/repo>' not specified \u2014 broker PR ${subcommand} reads could not resolve the repo from git origin; pass --repo <owner/repo> explicitly (e.g. \`${example}\`)`;
 }
 function buildPrQueueSpec(number, o) {
   const repo = parseBrokerRepo(o.repo, "--repo");
@@ -66282,25 +66703,38 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
     }
     await dispatchGh(spec, "read run watch");
   });
+  const resolvePrRepo = async (raw, subcommand, number) => {
+    if (raw) return raw;
+    try {
+      const resolved = await resolveRepo2(void 0);
+      if (resolved) return parseBrokerRepo(resolved, "--repo");
+    } catch {
+    }
+    fail(missingBrokerPrRepoMessage(subcommand, number));
+    return void 0;
+  };
   const pr = read.command("pr").description("pull-request reads \u2014 view/list/diff ride gh; queue uses fixed GraphQL; checks is REST-backed (deterministic closed-custody adapter; native was EMPTY only on the historical #3035 fixture)");
-  pr.command("list").description("list viewer-free PRs (author/viewer filters stay personal)").option("--repo <owner/repo>", "target repo (required \u2014 no git-origin default)", repoOpt).option("--json [fields]", "native gh JSON fields", jsonOpt).addOption(new Option("--state <state>", "open|closed|merged|all").choices(["open", "closed", "merged", "all"])).option("--base <branch>", "base branch", branchOpt).option("--head <branch>", "head branch", branchOpt).option("--label <label>", "filter by label", labelOpt).option("--search <query>", "viewer-free search", (v) => parseBrokerPrSearch(v)).option("--assignee <login>", "explicit assignee (viewer refused)", assigneeOpt).option("--limit <n>", "maximum PRs (1-100; larger values clamp to 100)", limitOpt).option("--jq <expr>", JQ_HELP, jqOpt).action(async (o) => {
-    if (!o.repo) return fail(missingBrokerPrRepoMessage("list"));
+  pr.command("list").description("list viewer-free PRs (author/viewer filters stay personal)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "native gh JSON fields", jsonOpt).addOption(new Option("--state <state>", "open|closed|merged|all").choices(["open", "closed", "merged", "all"])).option("--base <branch>", "base branch", branchOpt).option("--head <branch>", "head branch", branchOpt).option("--label <label>", "filter by label", labelOpt).option("--search <query>", "viewer-free search", (v) => parseBrokerPrSearch(v)).option("--assignee <login>", "explicit assignee (viewer refused)", assigneeOpt).option("--limit <n>", "maximum PRs (1-100; larger values clamp to 100)", limitOpt).option("--jq <expr>", JQ_HELP, jqOpt).action(async (o) => {
+    const repo = await resolvePrRepo(o.repo, "list");
+    if (!repo) return;
     let spec;
     try {
       requireJqJson(o.jq, o.json);
-      spec = buildPrListSpec(o);
+      spec = buildPrListSpec({ ...o, repo });
     } catch (e) {
       return fail(e.message);
     }
     await dispatchGh(spec, "read pr list", o.jq);
   });
-  pr.command("diff").description("read a bounded PR diff on the App pool").option("--repo <owner/repo>", "target repo (required \u2014 no git-origin default)", repoOpt).option("--name-only", "only changed file names").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
-    if (!o.repo) return fail(missingBrokerPrRepoMessage("diff", number));
-    await dispatchGh(buildPrDiffSpec(number, o), "read pr diff");
+  pr.command("diff").description("read a bounded PR diff on the App pool").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--name-only", "only changed file names").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+    const repo = await resolvePrRepo(o.repo, "diff", number);
+    if (!repo) return;
+    await dispatchGh(buildPrDiffSpec(number, { ...o, repo }), "read pr diff");
   });
-  pr.command("queue").description("read one PR mergeQueueEntry (fixed GraphQL query, no permission widening)").option("--repo <owner/repo>", "target repo (required \u2014 no git-origin default)", repoOpt).option("--json", "machine-readable mergeQueueEntry (null when not queued)").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
-    if (!o.repo) return fail(missingBrokerPrRepoMessage("queue", number));
-    const spec = buildPrQueueSpec(number, o);
+  pr.command("queue").description("read one PR mergeQueueEntry (fixed GraphQL query, no permission widening)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json", "machine-readable mergeQueueEntry (null when not queued)").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+    const repo = await resolvePrRepo(o.repo, "queue", number);
+    if (!repo) return;
+    const spec = buildPrQueueSpec(number, { ...o, repo });
     requireBrokerApp("read pr queue");
     try {
       process.exitCode = await runBrokerGh(async (args, opts) => {
@@ -66581,7 +67015,7 @@ function registerApiReadCommands(program3, overrides) {
       );
       if (o.jq !== void 0) body = await jqRun(o.jq, body, localJqEnv());
       if (zip) {
-        (0, import_node_fs56.writeFileSync)(o.out, body, "latin1");
+        (0, import_node_fs57.writeFileSync)(o.out, body, "latin1");
         return;
       }
     } catch (e) {
@@ -67497,8 +67931,8 @@ function registerSessionReport(program3) {
 }
 
 // src/stage-commands.ts
-var import_node_fs57 = require("node:fs");
-var import_node_path52 = require("node:path");
+var import_node_fs58 = require("node:fs");
+var import_node_path53 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -67746,8 +68180,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs57.existsSync)((0, import_node_path52.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs57.existsSync)((0, import_node_path52.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs58.existsSync)((0, import_node_path53.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs58.existsSync)((0, import_node_path53.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -68039,20 +68473,20 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto19 = require("node:crypto");
-var import_node_fs58 = require("node:fs");
+var import_node_crypto20 = require("node:crypto");
+var import_node_fs59 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
-var import_node_path53 = require("node:path");
+var import_node_path54 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto19.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs58.createReadStream)(path2)) hash.update(chunk);
+  const hash = (0, import_node_crypto20.createHash)("sha256");
+  for await (const chunk of (0, import_node_fs59.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path53.resolve)(inputPath);
+  const path2 = (0, import_node_path54.resolve)(inputPath);
   const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES2) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES2} bytes`);
@@ -68070,7 +68504,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs58.createReadStream)(path2);
+  const stream = (0, import_node_fs59.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -68424,7 +68858,7 @@ function renderVerifySecrets(body) {
 }
 
 // src/command-register-developer.ts
-var import_node_fs63 = require("node:fs");
+var import_node_fs64 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -68457,12 +68891,12 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path60 = require("node:path");
+var import_node_path61 = require("node:path");
 
 // src/doc-refs-command-source.ts
 var import_node_child_process21 = require("node:child_process");
-var import_node_fs59 = require("node:fs");
-var import_node_path54 = require("node:path");
+var import_node_fs60 = require("node:fs");
+var import_node_path55 = require("node:path");
 var BUNDLE_MANIFEST_TIMEOUT_MS = 12e4;
 var BUNDLE_MANIFEST_MAX_BUFFER = 64 * 1024 * 1024;
 var flagsOf = (options) => new Set((options ?? []).flatMap((option) => String(option?.flags ?? "").match(/--[\w-]+/g) ?? []));
@@ -68483,7 +68917,7 @@ function inventoryFromManifest(manifest, source) {
 function readBundleManifest(bundle, exec3 = import_node_child_process21.execFileSync) {
   try {
     const text = exec3(process.execPath, [bundle, "commands", "--all", "--json"], {
-      cwd: (0, import_node_path54.dirname)(bundle),
+      cwd: (0, import_node_path55.dirname)(bundle),
       encoding: "utf8",
       windowsHide: true,
       timeout: BUNDLE_MANIFEST_TIMEOUT_MS,
@@ -68499,19 +68933,19 @@ function readBundleManifest(bundle, exec3 = import_node_child_process21.execFile
 function isRunningBundle(bundle, argv1 = process.argv[1], platform2 = process.platform) {
   if (!argv1) return false;
   const norm2 = (path2) => {
-    const absolute = (0, import_node_path54.resolve)(path2);
+    const absolute = (0, import_node_path55.resolve)(path2);
     return platform2 === "win32" ? absolute.toLowerCase() : absolute;
   };
   const running = norm2(argv1);
-  if (!["main.cjs", "index.cjs"].includes((0, import_node_path54.basename)(running))) return false;
-  return (0, import_node_path54.dirname)(running) === (0, import_node_path54.dirname)(norm2(bundle));
+  if (!["main.cjs", "index.cjs"].includes((0, import_node_path55.basename)(running))) return false;
+  return (0, import_node_path55.dirname)(running) === (0, import_node_path55.dirname)(norm2(bundle));
 }
 function resolveCommandInventory(deps) {
-  const exists = deps.exists ?? import_node_fs59.existsSync;
+  const exists = deps.exists ?? import_node_fs60.existsSync;
   const read = deps.read ?? ((bundle) => readBundleManifest(bundle));
   const warnings = [];
   if (deps.from) {
-    const bundle = (0, import_node_path54.isAbsolute)(deps.from) ? deps.from : (0, import_node_path54.resolve)(deps.root, deps.from);
+    const bundle = (0, import_node_path55.isAbsolute)(deps.from) ? deps.from : (0, import_node_path55.resolve)(deps.root, deps.from);
     if (!exists(bundle)) {
       throw new Error(`docs refs --commands-from: ${bundle} does not exist \u2014 name the CLI bundle to read commands from (usually cli/dist/main.cjs)`);
     }
@@ -68521,7 +68955,7 @@ function resolveCommandInventory(deps) {
     }
     return { inventory: inventory2, warnings };
   }
-  const treeBundle = (0, import_node_path54.join)(deps.root, "cli", "dist", "main.cjs");
+  const treeBundle = (0, import_node_path55.join)(deps.root, "cli", "dist", "main.cjs");
   if (!exists(treeBundle) || isRunningBundle(treeBundle, deps.argv1, deps.platform)) {
     return { inventory: deps.inProcess(), warnings };
   }
@@ -68638,28 +69072,28 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process22 = require("node:child_process");
+var import_node_crypto22 = require("node:crypto");
+var import_node_fs62 = require("node:fs");
+var import_node_os27 = require("node:os");
+var import_node_path57 = require("node:path");
+
+// ../scripts/distribution-digest.mjs
 var import_node_crypto21 = require("node:crypto");
 var import_node_fs61 = require("node:fs");
-var import_node_os26 = require("node:os");
 var import_node_path56 = require("node:path");
-
-// ../scripts/distribution-digest.mjs
-var import_node_crypto20 = require("node:crypto");
-var import_node_fs60 = require("node:fs");
-var import_node_path55 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path55.resolve)(root);
-  const target = (0, import_node_path55.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path55.sep}`)) {
+  const absoluteRoot = (0, import_node_path56.resolve)(root);
+  const target = (0, import_node_path56.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path56.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto20.createHash)("sha256");
+  const hash = (0, import_node_crypto21.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs60.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs60.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs61.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs61.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -68674,8 +69108,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs60.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs60.lstatSync)(absolute) };
+    if (!(0, import_node_fs61.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs61.lstatSync)(absolute) };
   }));
 }
 
@@ -68688,7 +69122,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha2562 = (bytes) => `sha256:${(0, import_node_crypto21.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2562 = (bytes) => `sha256:${(0, import_node_crypto22.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha2562(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha2562(rebuiltBytes) : ABSENT;
@@ -68760,13 +69194,13 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs61.existsSync)(path2) ? (0, import_node_fs61.readFileSync)(path2) : null;
+  return (0, import_node_fs62.existsSync)(path2) ? (0, import_node_fs62.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs61.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path56.join)(directory, entry.name);
+    for (const entry of (0, import_node_fs62.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path57.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -68776,10 +69210,10 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs61.readFileSync)((0, import_node_path56.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path56.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs62.readFileSync)((0, import_node_path57.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path57.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path56.join)(root, "distribution-bom.json");
+    return (0, import_node_path57.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
@@ -68792,40 +69226,40 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs61.mkdtempSync)((0, import_node_path56.join)((0, import_node_os26.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs62.mkdtempSync)((0, import_node_path57.join)((0, import_node_os27.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path56.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path56.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path56.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path56.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path57.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path57.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path57.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path57.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path56.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path57.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path56.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path56.join)(root, path2));
-    const distRoot = (0, import_node_path56.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path56.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs61.readFileSync)(bomPathFor(root), "utf8"));
+    const committed = (path2) => readOrNull((0, import_node_path57.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path57.join)(root, path2));
+    const distRoot = (0, import_node_path57.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path57.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs62.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path56.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path57.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path56.join)(overlay, entry.path);
-        (0, import_node_fs61.mkdirSync)((0, import_node_path56.dirname)(target), { recursive: true });
-        (0, import_node_fs61.writeFileSync)(target, entry.bytes);
+        const target = (0, import_node_path57.join)(overlay, entry.path);
+        (0, import_node_fs62.mkdirSync)((0, import_node_path57.dirname)(target), { recursive: true });
+        (0, import_node_fs62.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs61.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs62.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
 // src/doc-refs-live.ts
-var import_node_path57 = require("node:path");
+var import_node_path58 = require("node:path");
 var concrete = (value) => !!value && !/[<>{}$]/.test(value);
 var liveOption = (tokens2, flag) => {
   const index = tokens2.indexOf(flag);
@@ -68898,7 +69332,7 @@ async function runLiveDocRefs(root, deps, live) {
   const offline = runDocRefs(root, { ...deps, runbooksOnly: true });
   const read = deps.readFile ?? readFileOrNull;
   const docs = Object.fromEntries((deps.listDocs ?? defaultListDocs)(root).flatMap((doc) => {
-    const body = read((0, import_node_path57.join)(root, doc));
+    const body = read((0, import_node_path58.join)(root, doc));
     return body !== null && isRunbook(doc, body) && !deps.isIgnored?.([doc]).has(doc) ? [[doc, body]] : [];
   }));
   const remote = await checkRunbookLive(docs, live);
@@ -69109,7 +69543,7 @@ async function diagnoseHub(deps) {
 
 // src/schedules-lift-command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path58 = require("node:path");
+var import_node_path59 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -69138,7 +69572,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path58.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path59.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -69221,8 +69655,8 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process24 = require("node:child_process");
-var import_node_fs62 = require("node:fs");
-var import_node_path59 = require("node:path");
+var import_node_fs63 = require("node:fs");
+var import_node_path60 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -69308,7 +69742,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs62.readFileSync)((0, import_node_path59.join)(root, file), "utf8");
+      raw = (0, import_node_fs63.readFileSync)((0, import_node_path60.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -69328,19 +69762,19 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path60.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs63.existsSync)(path2) ? (0, import_node_fs63.readFileSync)(path2, "utf8") : null;
+    const path2 = (0, import_node_path61.join)(process.cwd(), ".gitignore");
+    const current = (0, import_node_fs64.existsSync)(path2) ? (0, import_node_fs64.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs63.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs64.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs63.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs64.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -69657,12 +70091,12 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path61.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path62.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os27.homedir)()),
+      envHealLockPath((0, import_node_os28.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -69760,7 +70194,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os27.homedir)(),
+        (0, import_node_os28.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -69788,14 +70222,14 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os27.homedir)(),
+        (0, import_node_os28.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs64.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs65.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -69830,7 +70264,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs64.existsSync)((0, import_node_path61.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs65.existsSync)((0, import_node_path62.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -69839,7 +70273,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs64.existsSync)((0, import_node_path61.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs65.existsSync)((0, import_node_path62.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -70209,7 +70643,7 @@ function appActorDeps() {
     fetch: (url, init) => fetch(url, init)
   };
 }
-setPollTokenProvider(async () => activeAppToken() ?? pollTokenOrUndefined(appActorDeps()));
+setPollTokenProvider(async (o) => (o?.fresh ? void 0 : activeAppToken()) ?? pollTokenOrUndefined(appActorDeps()));
 setGhReadTokenProvider(pollToken);
 setGitHubReadTokenProvider(pollToken);
 var filingToken;
@@ -70217,7 +70651,10 @@ setGhWriteTokenProvider(() => {
   if (process.env.MMI_ACTOR?.trim() === "app") {
     return mintFilingWriteToken(appActorDeps()).then((t) => t.token);
   }
-  return filingToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, () => void 0);
+  return filingToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, (e) => {
+    if (e instanceof AppActorError && e.code === "vault-denied") return void 0;
+    throw e;
+  });
 });
 setClaimWriteTokenProvider(() => mintFilingWriteToken(appActorDeps()).then((t) => t.token));
 setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
@@ -70624,7 +71061,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs64.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs65.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -71016,16 +71453,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path61.join)(root, path2);
-      return (0, import_node_fs64.existsSync)(fullPath) ? (0, import_node_fs64.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path62.join)(root, path2);
+      return (0, import_node_fs65.existsSync)(fullPath) ? (0, import_node_fs65.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path61.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path62.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs64.existsSync)((0, import_node_path61.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs64.existsSync)((0, import_node_path61.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs65.existsSync)((0, import_node_path62.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs65.existsSync)((0, import_node_path62.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -71166,10 +71603,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs64.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs64.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs65.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs65.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs64.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs64.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs65.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs65.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -71200,16 +71637,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs64.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs65.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path61.join)(path2, entry.name);
+    const child2 = (0, import_node_path62.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs64.statSync)(child2).size;
+        total += (0, import_node_fs65.statSync)(child2).size;
       } catch {
       }
     }
@@ -71217,25 +71654,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs64.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs65.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs64.existsSync)(p)) return [];
+  if (!(0, import_node_fs65.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs64.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs65.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs64.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs64.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs65.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs65.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs64.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs65.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path61.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs64.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path62.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs65.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -71249,10 +71686,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path61.join)(stagingRoot, name);
-      if (!(0, import_node_fs64.existsSync)(p)) return null;
+      const p = (0, import_node_path62.join)(stagingRoot, name);
+      if (!(0, import_node_fs65.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs64.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs65.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -71272,13 +71709,13 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os27.homedir)(),
+    (0, import_node_os28.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs64.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs65.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -71288,7 +71725,7 @@ program2.command("archive-prune").description("inventory worktree evidence archi
   let primary = o.repoRoot;
   if (!primary) {
     const common = await gitOut(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-    primary = common ? (0, import_node_path61.dirname)(common) : "";
+    primary = common ? (0, import_node_path62.dirname)(common) : "";
   }
   if (!primary) {
     const detail = "archive-prune: not inside a git checkout (pass --repo-root <primary checkout>)";