@mutmutco/codex-plugin 4.6.22 → 4.6.24

package/cli/dist/main.cjs

@@ -710,6 +710,10 @@ function createGitHubClient(options = {}) {
       }
       return read();
     },
+    async restWithStatus(method, path2, init) {
+      const res = await request(method, joinUrl(baseUrl, path2), init);
+      return { status: res.status, body: await parseJson(res) };
+    },
     async restPaginate(path2, init) {
       const items = [];
       let url = withPerPage(joinUrl(baseUrl, path2));
@@ -1237,6 +1241,10 @@ var init_house_map = __esm({
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       run: "devops",
       // #9479: one named workflow run — the bounded `run cancel <id>` and `run rerun <id>` writes
+      vars: "devops",
+      // #9780: repository Actions variables — typed get/list/create/update/delete receipts
+      repo: "devops",
+      // #9779: canonical repository typed reads (archive status)
       ci: "devops",
       // the CI/gate audit
       jev: "devops",
@@ -1616,10 +1624,10 @@ var init_cli_shared = __esm({
       );
       const appEnv = options.env ? void 0 : await ghReadAppEnv(file, args) ?? await ghFilingAppEnv(file, args);
       const reportsCredential = !options.env && /(^|[\\/])gh(\.exe)?$/i.test(file) && isAppFilingWrite(args);
-      const tag = async (call, credential) => {
-        if (!reportsCredential) return call;
+      const tag = async (call3, credential) => {
+        if (!reportsCredential) return call3;
         try {
-          return { ...await call, credential };
+          return { ...await call3, credential };
         } catch (e) {
           if (e && typeof e === "object") e.credential = credential;
           throw e;
@@ -13519,7 +13527,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs65 = require("node:fs");
+var import_node_fs66 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 
@@ -15187,7 +15195,7 @@ function resolveVerbAliasShim(argv) {
 
 // src/command-composition.ts
 var import_node_os28 = require("node:os");
-var import_node_path62 = require("node:path");
+var import_node_path63 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs18 = require("node:fs");
@@ -15354,12 +15362,19 @@ var APP_POLL_PERMISSIONS = {
 var APP_JWT_BACKDATE_S = 60;
 var APP_JWT_TTL_S = 9 * 60;
 var AppActorError = class extends Error {
-  constructor(message2, code = "mint-failed") {
+  constructor(message2, code = "mint-failed", mintRefusal) {
     super(message2);
     this.code = code;
+    this.mintRefusal = mintRefusal;
   }
   code;
+  mintRefusal;
 };
+function sanitizeMintRefusalReason(raw) {
+  if (typeof raw !== "string") return void 0;
+  const cleaned = raw.replace(/-----BEGIN [^-]+-----[\s\S]*?(?:-----END [^-]+-----|$)/g, "[redacted]").replace(/\bBearer\s+\S+/gi, "Bearer [redacted]").replace(/\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.?[A-Za-z0-9_-]*/g, "[redacted]").replace(/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]+/g, "[redacted]").replace(/\s+/g, " ").trim();
+  return cleaned === "" ? void 0 : cleaned.slice(0, 200);
+}
 function commandPathOf(cmd) {
   const parts = [];
   let cursor = cmd;
@@ -15415,6 +15430,18 @@ var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
   ["run cancel", { metadata: "read", actions: "write" }],
   // #9587: one named run rerun (all or failed jobs) — same actions:write profile, nothing broader.
   ["run rerun", { metadata: "read", actions: "write" }],
+  // #9780: repository Actions variables — get/list mint only Variables:read; create/update/delete
+  // Variables:write. Repository scope only; no secret store, no rename, no workflow dispatch.
+  // #9790: the token key is `actions_variables` (as ci-reconcile.yml mints); `variables` was refused 422.
+  ["vars get", { metadata: "read", actions_variables: "read" }],
+  ["vars list", { metadata: "read", actions_variables: "read" }],
+  ["vars create", { metadata: "read", actions_variables: "write" }],
+  ["vars update", { metadata: "read", actions_variables: "write" }],
+  ["vars delete", { metadata: "read", actions_variables: "write" }],
+  // #9779: the archive-status read is a metadata:read-only repository read — nothing broader.
+  ["repo archive-status", { metadata: "read" }],
+  // #9788: historical merge-queue lifecycle — one fixed PullRequest.timelineItems GraphQL query; read-only.
+  ["read merge-queue lifecycle", { metadata: "read", pull_requests: "read" }],
   ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }],
   // #9614: closing an issue is an issue-state write — it rides the org App (mmi-github-app), so the close
   // is attributed to the App instead of the personal account. Nothing broader than issues.
@@ -15557,7 +15584,17 @@ async function mintFromMember(deps, permissions, keys) {
     throw new AppActorError(`app actor: token mint transport failed (${e?.constructor?.name ?? "Error"}) \u2014 automation fails closed, no personal-token fallback`);
   }
   if (!res.ok) {
-    throw new AppActorError(`app actor: installation token mint failed (HTTP ${res.status}) \u2014 automation fails closed, no personal-token fallback`);
+    let reason;
+    try {
+      reason = sanitizeMintRefusalReason((await res.json())?.message);
+    } catch {
+      reason = void 0;
+    }
+    throw new AppActorError(
+      `app actor: installation token mint failed (HTTP ${res.status}${reason ? `: ${reason}` : ""}) \u2014 automation fails closed, no personal-token fallback`,
+      "mint-failed",
+      { status: res.status, ...reason ? { reason } : {} }
+    );
   }
   let body;
   try {
@@ -17934,7 +17971,45 @@ function jobReportsPullRequestCheck(job) {
   });
   if (!directIf) return true;
   const expression = directIf.replace(/^\s*if:\s*/, "").trim().replace(/^\$\{\{\s*/, "").replace(/\s*\}\}$/, "").trim();
-  return !/^(?:github\.event_name\s*==\s*['"]push['"]|['"]push['"]\s*==\s*github\.event_name)$/.test(expression);
+  if (/pull_request/i.test(expression)) return true;
+  let rest = expression;
+  let valid = true;
+  const take = (pattern) => {
+    const match = rest.match(pattern);
+    if (!match) return void 0;
+    rest = rest.slice(match[0].length).trimStart();
+    return match[0];
+  };
+  const atom = () => {
+    if (take(/^\(/)) {
+      const possible2 = disjunction();
+      if (!take(/^\)/)) valid = false;
+      return possible2;
+    }
+    if (take(/^(?:github\.event_name\s*==\s*'[^']*'|github\.event_name\s*==\s*"[^"]*"|'[^']*'\s*==\s*github\.event_name|"[^"]*"\s*==\s*github\.event_name)/)) return false;
+    if (take(/^always\(\s*\)/)) return true;
+    if (take(/^needs\.[A-Za-z0-9_-]+\.outputs\.[A-Za-z0-9_-]+\s*(?:==|!=)\s*(?:'[^']*'|"[^"]*")/)) return true;
+    valid = false;
+    return true;
+  };
+  const conjunction = () => {
+    let possible2 = atom();
+    while (take(/^&&/)) {
+      const next = atom();
+      possible2 = possible2 && next;
+    }
+    return possible2;
+  };
+  const disjunction = () => {
+    let possible2 = conjunction();
+    while (take(/^\|\|/)) {
+      const next = conjunction();
+      possible2 = possible2 || next;
+    }
+    return possible2;
+  };
+  const possible = disjunction();
+  return !valid || rest.length > 0 || possible;
 }
 function workflowTriggersPullRequest(yaml) {
   const onBlock = extractOnBlock(yaml);
@@ -25428,7 +25503,9 @@ function checkRunbookClaims(root, docs, deps) {
           if (token === "--") break;
           const flag = token.split("=")[0];
           if (/^--[\w-]+$/.test(flag) && flag !== "--help" && !placeholder(flag) && !deps.commandOptions?.get(resolved)?.has(flag)) {
-            report("unknown-flag", `mmi-cli ${resolved}: ${flag}`);
+            const known = deps.commandOptions?.get(resolved);
+            const knownFlags = known?.size ? ` (known flags: ${[...known].sort().join(" ")})` : "";
+            report("unknown-flag", `mmi-cli ${resolved}: ${flag}${knownFlags} (source: ${deps.commandSource ?? "unspecified"})`);
           }
         }
       } else if (cmd === "npm") {
@@ -25667,7 +25744,7 @@ function runDocRefs(root, deps = {}) {
     findings.push(...checkCommands(docs, commandPaths).findings);
   }
   const runbooks = Object.fromEntries(Object.entries(docs).filter(([doc, body]) => isRunbook(doc, body)));
-  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile10, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions }));
+  findings.push(...checkRunbookClaims(root, runbooks, { readFile: readFile10, exists, isIgnored, trackedFirstSegments, commandPaths, commandOptions: deps.commandOptions, commandSource: deps.commandSource }));
   const warnings = [...refResult.warnings];
   if (deps.runbooksOnly && !Object.keys(runbooks).length) {
     warnings.push({ kind: "runbook-missing", doc: "docs/Guides/operator.md", line: 0, detail: "no operator runbook or <!-- runbook --> document exists" });
@@ -28089,10 +28166,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.22",
-    tag: "v4.6.22",
-    commit: "bc3629b50994",
-    npm: "@mutmutco/cli@4.6.22"
+    version: "4.6.24",
+    tag: "v4.6.24",
+    commit: "3632dffdf8a5",
+    npm: "@mutmutco/cli@4.6.24"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28109,14 +28186,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.22"
+          v3Target: "v4.6.24"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.22 and redeploy the Hub Lambda from tag v4.6.22 (bc3629b50994); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.22 (@mutmutco/cli@4.6.22, tag commit bc3629b50994 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.24 and redeploy the Hub Lambda from tag v4.6.24 (3632dffdf8a5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.24 (@mutmutco/cli@4.6.24, tag commit 3632dffdf8a5 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -41185,7 +41262,7 @@ var PRIMARY_GROUPS = [
   ["Setup and support", ["bootstrap", "secrets", "docs", "tests", "spawn", "dist"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
-var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["oauth", "org", "runtime", "plugin", "packages", "github", "archive-prune", "intercom", "jev"]);
+var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["oauth", "org", "runtime", "plugin", "packages", "github", "archive-prune", "intercom", "jev", "vars", "repo"]);
 var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup", "read", "run"]);
 var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "dist", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
@@ -41234,6 +41311,10 @@ var COMMAND_OWNERSHIP = {
   read: { module_owner: "cli/src/app-read-broker.ts", consumer: "agent-workflow" },
   run: { module_owner: "cli/src/merge-group-orphans.ts", consumer: "agent-workflow" },
   // #9479
+  vars: { module_owner: "cli/src/devops-vars.ts", consumer: "agent-workflow" },
+  // #9780 repository Actions variables
+  repo: { module_owner: "cli/src/repo-archive-status.ts", consumer: "agent-workflow" },
+  // #9779 archive-status read
   ci: { module_owner: "cli/src/ci-audit.ts", consumer: "release-operator" },
   rcand: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
   release: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
@@ -44436,6 +44517,1208 @@ function registerRunRerun(run, writeToken, projects) {
   });
 }
 
+// src/devops-vars.ts
+var import_node_crypto13 = require("node:crypto");
+init_github_client();
+init_cli_shared();
+var VARS_RECEIPT_SCHEMA = "mmi-cli.devops-vars/1";
+function parseVarsName(raw) {
+  const name = raw.trim();
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || name.length > 256) {
+    throw new Error(`<name> must match [A-Za-z_][A-Za-z0-9_]* (\u2264256 chars) \u2014 received '${raw.slice(0, 64)}'`);
+  }
+  return name;
+}
+function parseVarsValue(raw) {
+  if (typeof raw !== "string") throw new Error(`--value must be a string \u2014 received ${raw === null ? "null" : typeof raw}; values are preserved exactly, never coerced`);
+  if (raw.length > 49152) throw new Error(`--value exceeds GitHub's 48KB variable size limit (${raw.length} chars)`);
+  return raw;
+}
+function resolveCanonicalRepo(raw, projects) {
+  if (!Array.isArray(projects)) return { kind: "unavailable" };
+  const input = raw.trim();
+  if (!/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)?$/.test(input) || input.split("/").some((part) => part === "." || part === "..")) {
+    return { kind: "unregistered" };
+  }
+  const key = registryRepoKey(qualifyRegistryRepo(input));
+  const byKey = /* @__PURE__ */ new Map();
+  const aliasRepos = [];
+  const lower = input.toLowerCase();
+  for (const project2 of projects) {
+    if (!project2 || typeof project2 !== "object" || Array.isArray(project2)) continue;
+    if (!input.includes("/")) {
+      const alias = typeof project2.slug === "string" ? project2.slug : typeof project2.name === "string" ? project2.name : void 0;
+      if (typeof alias === "string" && alias.trim() !== "" && alias.toLowerCase() === lower && Array.isArray(project2.repos)) {
+        for (const r of project2.repos) if (typeof r === "string" && r.trim() !== "") aliasRepos.push(qualifyRegistryRepo(r.trim()));
+      }
+    }
+    if (!Array.isArray(project2.repos)) continue;
+    for (const r of project2.repos) {
+      if (typeof r !== "string" || r.trim() === "") continue;
+      const qualified = qualifyRegistryRepo(r.trim());
+      if (registryRepoKey(qualified) === key) byKey.set(key, byKey.get(key) ?? qualified);
+    }
+  }
+  const distinct = /* @__PURE__ */ new Map();
+  if (byKey.has(key)) distinct.set(key, byKey.get(key));
+  for (const r of aliasRepos) {
+    const rk = registryRepoKey(r);
+    if (!distinct.has(rk)) distinct.set(rk, r);
+  }
+  const hits = [...distinct.entries()];
+  if (hits.length === 1) {
+    const [hitKey, repo] = hits[0];
+    return { kind: "resolved", repo, via: hitKey === key ? "repo-name" : "project-alias" };
+  }
+  if (hits.length > 1) return { kind: "conflict", candidates: hits.map(([, repo]) => repo) };
+  return { kind: "unregistered" };
+}
+function classifyUpstreamError(e) {
+  if (e instanceof AppActorError) {
+    const status = e.mintRefusal?.status ?? 0;
+    return { status, reason: "mint-refused", mint: { status, reason: e.mintRefusal?.reason ?? e.message } };
+  }
+  if (e instanceof GitHubApiError) {
+    if (e.status === 404) return { status: 404, reason: "bare-404" };
+    if (e.status === 403 || e.status === 401) return { status: e.status, reason: "denied" };
+    return { status: e.status, reason: "transport-error" };
+  }
+  const name = e?.name ?? "";
+  if (name === "TimeoutError" || name === "AbortError" || /timeout|abort/i.test(String(e?.message ?? ""))) {
+    return { status: 0, reason: "timeout" };
+  }
+  return { status: 0, reason: "transport-error" };
+}
+async function call(deps, log, method, path2, body) {
+  try {
+    const res = await deps.transport.restWithStatus(method, path2, body !== void 0 ? { body } : void 0);
+    log.push({ method, path: path2, status: res.status });
+    return res;
+  } catch (e) {
+    if (!(e instanceof AppActorError)) log.push({ method, path: path2, status: classifyUpstreamError(e).status });
+    throw e;
+  }
+}
+function beginOp() {
+  return { startedAt: /* @__PURE__ */ new Date(), log: [] };
+}
+function receiptBase(deps, operation, repo, ctx, now) {
+  return {
+    schema: VARS_RECEIPT_SCHEMA,
+    operation,
+    repo,
+    window: { startedAt: ctx.startedAt.toISOString(), endedAt: now().toISOString(), atomicSnapshot: false },
+    actor: deps.actor ?? { credential: "app_installation" },
+    correlationId: (deps.correlationId ?? import_node_crypto13.randomUUID)(),
+    upstream: ctx.log
+  };
+}
+var VARS_PER_PAGE = 30;
+var VARS_MAX_PAGES = 100;
+function parseVariableEntry(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("variable entry is not an object");
+  const e = raw;
+  if (typeof e.name !== "string" || e.name === "") throw new Error("variable entry has no name");
+  if (e.value !== void 0 && typeof e.value !== "string") throw new Error(`variable '${e.name}' value is ${typeof e.value}, not a string \u2014 refusing to coerce`);
+  if (e.created_at !== void 0 && typeof e.created_at !== "string") throw new Error(`variable '${e.name}' created_at is not a string`);
+  if (e.updated_at !== void 0 && typeof e.updated_at !== "string") throw new Error(`variable '${e.name}' updated_at is not a string`);
+  return {
+    name: e.name,
+    ...e.value !== void 0 ? { value: e.value } : {},
+    ...e.created_at !== void 0 ? { createdAt: e.created_at } : {},
+    ...e.updated_at !== void 0 ? { updatedAt: e.updated_at } : {}
+  };
+}
+async function enumerateRepositoryVariables(deps, repo, log = []) {
+  const entries = [];
+  let total = -1;
+  for (let page = 1; page <= VARS_MAX_PAGES; page++) {
+    const { body } = await call(deps, log, "GET", `repos/${repo}/actions/variables?per_page=${VARS_PER_PAGE}&page=${page}`);
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return { complete: false, reason: "malformed-page", entries, pages: page, detail: `page ${page} body is not a JSON object` };
+    }
+    const envelope = body;
+    if (typeof envelope.total_count !== "number" || !Number.isInteger(envelope.total_count) || envelope.total_count < 0 || !Array.isArray(envelope.variables)) {
+      return { complete: false, reason: "malformed-page", entries, pages: page, detail: `page ${page} envelope has no integer total_count / variables array` };
+    }
+    if (total >= 0 && envelope.total_count !== total) {
+      return { complete: false, reason: "incomplete-pagination", entries, pages: page, detail: `total_count moved between pages (${total} \u2192 ${envelope.total_count}); the enumeration is not a snapshot` };
+    }
+    total = envelope.total_count;
+    try {
+      for (const raw of envelope.variables) entries.push(parseVariableEntry(raw));
+    } catch (e) {
+      return { complete: false, reason: "malformed-page", entries, pages: page, detail: `page ${page}: ${e.message}` };
+    }
+    const expectedPages = Math.max(1, Math.ceil(total / VARS_PER_PAGE));
+    if (expectedPages > VARS_MAX_PAGES) {
+      return { complete: false, reason: "page-bound-exceeded", entries, pages: page, detail: `total_count ${total} needs ${expectedPages} pages; the bounded read stops at ${VARS_MAX_PAGES}` };
+    }
+    if (page >= expectedPages) break;
+  }
+  if (entries.length !== total) {
+    return { complete: false, reason: "incomplete-pagination", entries, pages: Math.max(1, Math.ceil(total / VARS_PER_PAGE)), detail: `accumulated ${entries.length} entries but total_count is ${total}` };
+  }
+  return { complete: true, entries, totalVariables: total, pages: Math.max(1, Math.ceil(total / VARS_PER_PAGE)) };
+}
+function mintCapability(c, permission) {
+  return c.mint ? { permission, outcome: "mint-refused", status: c.mint.status, reason: c.mint.reason } : void 0;
+}
+function mintDetail(c) {
+  return `App token mint refused${c.mint?.status ? ` (HTTP ${c.mint.status})` : ""}: ${c.mint?.reason ?? "unknown"}`;
+}
+function findEntry(entries, name) {
+  const lower = name.toLowerCase();
+  return entries.find((e) => e.name.toLowerCase() === lower);
+}
+async function readVariable(deps, repo, name, log) {
+  let body;
+  try {
+    ({ body } = await call(deps, log, "GET", `repos/${repo}/actions/variables/${name}`));
+  } catch (e) {
+    const classified = classifyUpstreamError(e);
+    const { status, reason } = classified;
+    if (reason === "mint-refused") return { presence: "unknown", unknownReason: "mint-refused", detail: mintDetail(classified), capability: mintCapability(classified, deps.mintPermission ?? "variables:read") };
+    if (reason === "denied") return { presence: "unknown", unknownReason: "denied", detail: `HTTP ${status}: the App installation cannot read repository variables`, capability: { permission: "variables:read", outcome: "denied" } };
+    if (reason !== "bare-404") return { presence: "unknown", unknownReason: reason, detail: String(e.message).slice(0, 200) };
+    try {
+      const en = await enumerateRepositoryVariables(deps, repo, log);
+      if (!en.complete) return { presence: "unknown", unknownReason: en.reason, detail: `bare 404 on GET, and the absence proof failed: ${en.detail}` };
+      const hit = findEntry(en.entries, name);
+      if (hit) return { presence: "present", value: hit.value, observed: { ...hit.createdAt ? { createdAt: hit.createdAt } : {}, ...hit.updatedAt ? { updatedAt: hit.updatedAt } : {}, source: "enumeration" } };
+      return { presence: "absent", absenceProof: { provenBy: "complete-enumeration", pages: en.pages, perPage: VARS_PER_PAGE, totalVariables: en.totalVariables, nameExcluded: true } };
+    } catch (proofError) {
+      const proof = classifyUpstreamError(proofError);
+      if (proof.reason === "mint-refused") return { presence: "unknown", unknownReason: "mint-refused", detail: `bare 404 on GET, and the absence proof failed: ${mintDetail(proof)}`, capability: mintCapability(proof, deps.mintPermission ?? "variables:read") };
+      return { presence: "unknown", unknownReason: proof.reason === "bare-404" ? "transport-error" : proof.reason, detail: `bare 404 on GET, and the absence proof failed: ${String(proofError.message).slice(0, 160)}` };
+    }
+  }
+  try {
+    const entry = parseVariableEntry(body);
+    return { presence: "present", value: entry.value, observed: { ...entry.createdAt ? { createdAt: entry.createdAt } : {}, ...entry.updatedAt ? { updatedAt: entry.updatedAt } : {}, source: "get" } };
+  } catch (e) {
+    return { presence: "unknown", unknownReason: "parser-refused", detail: `HTTP 200 but the body could not be parsed as a variable: ${e.message}` };
+  }
+}
+async function getVariableReceipt(deps, repo, name) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const read = await readVariable(deps, repo, name, ctx.log);
+  return {
+    ...receiptBase(deps, "get", repo, ctx, now),
+    name,
+    presence: read.presence,
+    ...read.value !== void 0 ? { value: read.value } : {},
+    ...read.observed ? { observed: read.observed } : {},
+    ...read.absenceProof ? { absenceProof: read.absenceProof } : {},
+    ...read.unknownReason ? { unknownReason: read.unknownReason } : {},
+    ...read.capability ? { capability: read.capability } : {}
+  };
+}
+async function listVariablesReceipt(deps, repo) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  try {
+    const en = await enumerateRepositoryVariables(deps, repo, ctx.log);
+    if (en.complete) {
+      return {
+        ...receiptBase(deps, "list", repo, ctx, now),
+        pagination: { pages: en.pages, perPage: VARS_PER_PAGE, complete: true, totalVariables: en.totalVariables },
+        variables: en.entries.map(({ name, createdAt, updatedAt }) => ({ name, ...createdAt ? { createdAt } : {}, ...updatedAt ? { updatedAt } : {} }))
+      };
+    }
+    return {
+      ...receiptBase(deps, "list", repo, ctx, now),
+      pagination: { pages: en.pages, perPage: VARS_PER_PAGE, complete: false, reason: en.reason, detail: en.detail },
+      variables: en.entries.map(({ name, createdAt, updatedAt }) => ({ name, ...createdAt ? { createdAt } : {}, ...updatedAt ? { updatedAt } : {} })),
+      unknownReason: en.reason
+    };
+  } catch (e) {
+    const classified = classifyUpstreamError(e);
+    const { status, reason } = classified;
+    return {
+      ...receiptBase(deps, "list", repo, ctx, now),
+      pagination: { pages: 0, perPage: VARS_PER_PAGE, complete: false, reason },
+      variables: [],
+      unknownReason: reason,
+      ...reason === "mint-refused" ? { capability: mintCapability(classified, deps.mintPermission ?? "variables:read"), pagination: { pages: 0, perPage: VARS_PER_PAGE, complete: false, reason, detail: mintDetail(classified) } } : {},
+      ...reason === "denied" ? { capability: { permission: "variables:read", outcome: "denied" }, pagination: { pages: 0, perPage: VARS_PER_PAGE, complete: false, reason, detail: `HTTP ${status}: the App installation cannot list repository variables` } } : {}
+    };
+  }
+}
+async function readBaseline(deps, repo, name, log) {
+  const read = await readVariable(deps, repo, name, log);
+  if (read.presence === "present") return { presence: "present", value: read.value };
+  if (read.presence === "absent") return { presence: "absent" };
+  return { presence: "unknown", unknownReason: read.unknownReason, ...read.capability ? { capability: read.capability } : {} };
+}
+function rejectedWrite(base, baseline, reason, capability) {
+  return {
+    ...base,
+    outcome: "rejected",
+    casLimitation: "no-atomic-compare-and-swap",
+    baseline: { presence: "present", value: baseline.value, source: "get" },
+    reason,
+    ...capability ? { capability } : {}
+  };
+}
+function unknownWrite(base, baseline, reason, readback) {
+  return {
+    ...base,
+    outcome: "outcome-unknown",
+    casLimitation: "no-atomic-compare-and-swap",
+    baseline: baseline.presence === "present" ? { presence: "present", value: baseline.value, source: "get" } : baseline,
+    ...readback ? { readback } : {},
+    reason
+  };
+}
+async function createVariableReceipt(deps, repo, name, value) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  let en;
+  try {
+    en = await enumerateRepositoryVariables(deps, repo, ctx.log);
+  } catch (e) {
+    const classified = classifyUpstreamError(e);
+    const { status, reason } = classified;
+    return {
+      ...receiptBase(deps, "create", repo, ctx, now),
+      operation: "create",
+      name,
+      outcome: "not-dispatched",
+      casLimitation: "no-atomic-compare-and-swap",
+      baseline: { presence: "unknown", source: "complete-enumeration" },
+      reason: `no observed absent baseline: ${reason === "denied" ? `HTTP ${status}: the App installation cannot list repository variables` : reason === "mint-refused" ? mintDetail(classified) : String(e.message).slice(0, 160)}`,
+      ...reason === "denied" ? { capability: { permission: "variables:read", outcome: "denied" } } : {},
+      ...reason === "mint-refused" ? { capability: mintCapability(classified, deps.mintPermission ?? "variables:write") } : {}
+    };
+  }
+  const base = { ...receiptBase(deps, "create", repo, ctx, now), operation: "create", name, casLimitation: "no-atomic-compare-and-swap" };
+  if (!en.complete) {
+    return { ...base, outcome: "not-dispatched", baseline: { presence: "unknown", source: "complete-enumeration" }, reason: `no observed absent baseline: ${en.reason} (${en.detail})` };
+  }
+  const existing = findEntry(en.entries, name);
+  if (existing) {
+    return { ...base, outcome: "not-dispatched", baseline: { presence: "present", ...existing.value !== void 0 ? { value: existing.value } : {}, source: "complete-enumeration" }, reason: "variable already present \u2014 create only dispatches against an observed absent baseline (use update)" };
+  }
+  try {
+    await call(deps, ctx.log, "POST", `repos/${repo}/actions/variables`, { name, value });
+  } catch (e) {
+    const classified = classifyUpstreamError(e);
+    const { status, reason } = classified;
+    const absentBaseline = { presence: "absent", source: "complete-enumeration" };
+    if (reason === "mint-refused") return { ...base, outcome: "not-dispatched", baseline: absentBaseline, reason: mintDetail(classified), capability: mintCapability(classified, deps.mintPermission ?? "variables:write") };
+    if (reason === "denied") return { ...base, outcome: "rejected", baseline: absentBaseline, reason: `HTTP ${status}: the App installation lacks repository Variables write`, capability: { permission: "variables:write", outcome: "denied" } };
+    if (status === 404) return { ...base, outcome: "rejected", baseline: absentBaseline, reason: "HTTP 404: repository missing or not visible to the installation" };
+    if (status === 409 || status === 422) return { ...base, outcome: "rejected", baseline: absentBaseline, reason: `HTTP ${status}: ${String(e.message).slice(0, 160)}` };
+    return unknownWrite({ ...base, schema: VARS_RECEIPT_SCHEMA, operation: "create", repo }, { presence: "absent", source: "complete-enumeration" }, `${reason === "timeout" ? "dispatch timed out" : `HTTP ${status || "no response"}`}; the create MAY have applied \u2014 reconcile read-only, never replay`);
+  }
+  const rb = await readVariable(deps, repo, name, ctx.log);
+  if (rb.presence === "present") {
+    if (rb.value === value) {
+      return { ...base, outcome: "verified", baseline: { presence: "absent", source: "complete-enumeration" }, readback: { presence: "present", value: rb.value } };
+    }
+    return unknownWrite(base, { presence: "absent", source: "complete-enumeration" }, "read-back shows a different value than dispatched \u2014 a concurrent outside write is possible; reconcile read-only", { presence: "present", value: rb.value });
+  }
+  if (rb.presence === "absent") {
+    return unknownWrite(base, { presence: "absent", source: "complete-enumeration" }, "accepted but the read-back proves absence \u2014 reconcile read-only before any retry", { presence: "absent" });
+  }
+  return {
+    ...base,
+    outcome: "accepted-but-unverified",
+    baseline: { presence: "absent", source: "complete-enumeration" },
+    readback: { presence: "unknown" },
+    reason: `create accepted but the read-back could not verify: ${rb.unknownReason ?? "unknown"}`
+  };
+}
+async function updateVariableReceipt(deps, repo, name, value) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const base = { ...receiptBase(deps, "update", repo, ctx, now), operation: "update", name, casLimitation: "no-atomic-compare-and-swap" };
+  const baseline = await readBaseline(deps, repo, name, ctx.log);
+  if (baseline.presence !== "present") {
+    return {
+      ...base,
+      outcome: "not-dispatched",
+      baseline: { presence: baseline.presence, ...baseline.value !== void 0 ? { value: baseline.value } : {}, source: "get" },
+      reason: baseline.presence === "absent" ? "no present baseline \u2014 the enumeration proved absence (use create)" : `no retained present baseline (${baseline.unknownReason ?? "unknown"}); a bare 404 is never a present baseline`,
+      ...baseline.capability ? { capability: baseline.capability } : {}
+    };
+  }
+  const live = await readVariable(deps, repo, name, ctx.log);
+  if (live.presence !== "present" || live.value !== baseline.value) {
+    return {
+      ...base,
+      outcome: "not-dispatched",
+      baseline: { presence: "present", value: baseline.value, source: "get" },
+      ...live.presence === "present" ? { readback: { presence: "present", value: live.value } } : {},
+      reason: live.presence === "present" ? "concurrent change: the live value no longer matches the retained baseline \u2014 stopped for reconciliation" : `baseline unconfirmed before dispatch (${live.unknownReason ?? "unknown"}) \u2014 stopped`
+    };
+  }
+  try {
+    await call(deps, ctx.log, "PATCH", `repos/${repo}/actions/variables/${name}`, { value });
+  } catch (e) {
+    const classified = classifyUpstreamError(e);
+    const { status, reason } = classified;
+    if (reason === "mint-refused") return { ...base, outcome: "not-dispatched", baseline: { presence: "present", value: baseline.value, source: "get" }, reason: mintDetail(classified), capability: mintCapability(classified, deps.mintPermission ?? "variables:write") };
+    if (reason === "denied") return rejectedWrite(base, { presence: "present", value: baseline.value }, `HTTP ${status}: the App installation lacks repository Variables write`, { permission: "variables:write", outcome: "denied" });
+    if (status === 404) return rejectedWrite(base, { presence: "present", value: baseline.value }, "HTTP 404 at write: the variable vanished after the baseline check (concurrent deletion suspected) \u2014 reconcile read-only, never create");
+    if (status === 409 || status === 422) return rejectedWrite(base, { presence: "present", value: baseline.value }, `HTTP ${status}: ${String(e.message).slice(0, 160)}`);
+    return unknownWrite(base, { presence: "present", value: baseline.value }, `${reason === "timeout" ? "dispatch timed out" : `HTTP ${status || "no response"}`}; the update MAY have applied \u2014 reconcile read-only, never replay`);
+  }
+  const rb = await readVariable(deps, repo, name, ctx.log);
+  if (rb.presence === "present") {
+    if (rb.value === value) return { ...base, outcome: "verified", baseline: { presence: "present", value: baseline.value, source: "get" }, readback: { presence: "present", value: rb.value } };
+    return unknownWrite(base, { presence: "present", value: baseline.value }, "read-back shows a different value than dispatched \u2014 a concurrent outside write is possible; reconcile read-only", { presence: "present", value: rb.value });
+  }
+  if (rb.presence === "absent") {
+    return unknownWrite(base, { presence: "present", value: baseline.value }, "accepted but the read-back proves absence \u2014 reconcile read-only before any retry", { presence: "absent" });
+  }
+  return {
+    ...base,
+    outcome: "accepted-but-unverified",
+    baseline: { presence: "present", value: baseline.value, source: "get" },
+    readback: { presence: "unknown" },
+    reason: `update accepted but the read-back could not verify: ${rb.unknownReason ?? "unknown"}`
+  };
+}
+async function deleteVariableReceipt(deps, repo, name) {
+  const ctx = beginOp();
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const base = { ...receiptBase(deps, "delete", repo, ctx, now), operation: "delete", name, casLimitation: "no-atomic-compare-and-swap" };
+  const baseline = await readBaseline(deps, repo, name, ctx.log);
+  if (baseline.presence !== "present") {
+    return {
+      ...base,
+      outcome: "not-dispatched",
+      baseline: { presence: baseline.presence, ...baseline.value !== void 0 ? { value: baseline.value } : {}, source: "get" },
+      reason: baseline.presence === "absent" ? "no present baseline \u2014 the enumeration already proves absence; nothing to delete" : `no retained present baseline (${baseline.unknownReason ?? "unknown"}); a bare 404 never authorizes a delete`,
+      ...baseline.capability ? { capability: baseline.capability } : {}
+    };
+  }
+  const live = await readVariable(deps, repo, name, ctx.log);
+  if (live.presence !== "present" || live.value !== baseline.value) {
+    return {
+      ...base,
+      outcome: "not-dispatched",
+      baseline: { presence: "present", value: baseline.value, source: "get" },
+      ...live.presence === "present" ? { readback: { presence: "present", value: live.value } } : {},
+      reason: live.presence === "present" ? "concurrent change: the live value no longer matches the retained baseline \u2014 stopped for reconciliation" : `baseline unconfirmed before dispatch (${live.unknownReason ?? "unknown"}) \u2014 stopped`
+    };
+  }
+  try {
+    await call(deps, ctx.log, "DELETE", `repos/${repo}/actions/variables/${name}`);
+  } catch (e) {
+    const classified = classifyUpstreamError(e);
+    const { status, reason } = classified;
+    if (reason === "mint-refused") return { ...base, outcome: "not-dispatched", baseline: { presence: "present", value: baseline.value, source: "get" }, reason: mintDetail(classified), capability: mintCapability(classified, deps.mintPermission ?? "variables:write") };
+    if (reason === "denied") return rejectedWrite(base, { presence: "present", value: baseline.value }, `HTTP ${status}: the App installation lacks repository Variables write`, { permission: "variables:write", outcome: "denied" });
+    if (status === 404) return rejectedWrite(base, { presence: "present", value: baseline.value }, "HTTP 404 at write: the variable vanished after the baseline check (concurrent deletion suspected) \u2014 reconcile read-only");
+    if (status === 409 || status === 422) return rejectedWrite(base, { presence: "present", value: baseline.value }, `HTTP ${status}: ${String(e.message).slice(0, 160)}`);
+    return unknownWrite(base, { presence: "present", value: baseline.value }, `${reason === "timeout" ? "dispatch timed out" : `HTTP ${status || "no response"}`}; the delete MAY have applied \u2014 reconcile read-only, never replay`);
+  }
+  try {
+    const en = await enumerateRepositoryVariables(deps, repo);
+    if (en.complete && !findEntry(en.entries, name)) {
+      return { ...base, outcome: "verified", baseline: { presence: "present", value: baseline.value, source: "get" }, readback: { presence: "absent" }, reason: `absence proven by complete enumeration (${en.pages} page(s), ${en.totalVariables} variable(s), name excluded)` };
+    }
+    if (en.complete) {
+      const still = findEntry(en.entries, name);
+      return unknownWrite(base, { presence: "present", value: baseline.value }, "delete accepted but the variable is still enumerated \u2014 reconcile read-only, never replay", { presence: "present", ...still.value !== void 0 ? { value: still.value } : {} });
+    }
+    return {
+      ...base,
+      outcome: "accepted-but-unverified",
+      baseline: { presence: "present", value: baseline.value, source: "get" },
+      reason: `delete accepted but absence is unproven: ${en.reason} (${en.detail})`
+    };
+  } catch (e) {
+    return {
+      ...base,
+      outcome: "accepted-but-unverified",
+      baseline: { presence: "present", value: baseline.value, source: "get" },
+      reason: `delete accepted but absence is unproven (${classifyUpstreamError(e).reason}): ${String(e.message).slice(0, 160)}`
+    };
+  }
+}
+var VARS_HELP_AFTER = [
+  "",
+  "Presence semantics (#9780): present | absent | unknown. A bare 404 is UNKNOWN, never absence \u2014",
+  "absence is claimed only from a complete bounded enumeration excluding the exact name, with",
+  "pagination evidence. Truncated pagination, malformed pages, denial, parser refusal or timeout is",
+  "unknown. Values are preserved exactly (including `off`) and never coerced.",
+  "Mutations verify by read-back (delete: complete enumeration) \u2014 an HTTP success alone is never",
+  "verified; an ambiguous result is reported unknown and reconciled READ-ONLY, never replayed.",
+  "The pre-write check is NOT atomic compare-and-swap: a concurrent outside write between the check",
+  "and the dispatch is not prevented. Repository scope only \u2014 no organization/environment scope, no",
+  "secret store, no rename, no workflow dispatch, no credential fallback."
+].join("\n");
+function resolveRepoOrFail(raw, projects, verb) {
+  const resolution = resolveCanonicalRepo(raw, projects);
+  if (resolution.kind === "resolved") return resolution.repo;
+  if (resolution.kind === "conflict") return fail(`vars ${verb}: '${raw}' resolves to MULTIPLE registered repositories (${resolution.candidates.join(", ")}) \u2014 pass the exact owner/repo; ambiguous aliases are refused (#9780)`);
+  if (resolution.kind === "unavailable") return fail(`vars ${verb}: the Hub project registry is unreadable; refusing to address a repo this command cannot prove registered`);
+  return fail(`vars ${verb}: '${raw}' is not a registered repository in the Hub registry; App variables access is limited to registered repos \u2014 pass the exact owner/repo`);
+}
+function registerDevopsVarsCommands(program3, deps) {
+  const vars = program3.command("vars").description("repository Actions variables \u2014 typed get/list/create/update/delete on the org App (Variables read/write), Hub-registered repos only (#9780)");
+  const runRead = async (commandPath4, verb, repoArg, name, o) => {
+    const projects = await deps.projects();
+    const repo = resolveRepoOrFail(repoArg, projects, verb);
+    const ops = { transport: await deps.appClient(commandPath4), ...deps.actor ? { actor: deps.actor() } : {} };
+    const receipt = verb === "get" && name !== void 0 ? await getVariableReceipt(ops, repo, name) : await listVariablesReceipt(ops, repo);
+    if (o.json) console.log(JSON.stringify(receipt, null, 2));
+    else printReadText(receipt);
+    const failed2 = receipt.operation === "get" ? receipt.presence === "unknown" : !receipt.pagination.complete;
+    if (failed2) process.exitCode = 1;
+  };
+  const runMutation = async (commandPath4, verb, nameArg, value, repoArg, o) => {
+    let name;
+    let exactValue;
+    try {
+      name = parseVarsName(nameArg);
+      if (verb !== "delete") exactValue = parseVarsValue(value);
+    } catch (e) {
+      return fail(`vars ${verb}: ${e.message}`);
+    }
+    const projects = await deps.projects();
+    const repo = resolveRepoOrFail(repoArg, projects, verb);
+    const ops = { transport: await deps.appClient(commandPath4), mintPermission: "variables:write", ...deps.actor ? { actor: deps.actor() } : {} };
+    const receipt = verb === "create" ? await createVariableReceipt(ops, repo, name, exactValue) : verb === "update" ? await updateVariableReceipt(ops, repo, name, exactValue) : await deleteVariableReceipt(ops, repo, name);
+    if (o.json) console.log(JSON.stringify(receipt, null, 2));
+    else printMutationText(receipt);
+    if (receipt.outcome !== "verified") process.exitCode = 1;
+  };
+  vars.command("get <name>").description("exact variable baseline or typed observed absence/unknown \u2014 a bare 404 is unknown; absence needs a complete enumeration (#9780)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (name, o) => runRead("vars get", "get", o.repo ?? "", name, o));
+  vars.command("list").description("exhaustive bounded enumeration: names + provider timestamps only (never values), with pagination/completeness evidence (#9780)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (o) => runRead("vars list", "list", o.repo ?? "", void 0, o));
+  vars.command("create <name>").description("create ONLY against an observed absent baseline (complete enumeration); value preserved exactly; verified by read-back (#9780)").requiredOption("--value <value>", "exact string value (never coerced; e.g. the literal `off`)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (name, o) => runMutation("vars create", "create", name, o.value, o.repo ?? "", o));
+  vars.command("update <name>").description("replace ONLY against a retained present baseline, re-checked just before dispatch; concurrent changes stop the write (#9780)").requiredOption("--value <value>", "exact string value (never coerced)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (name, o) => runMutation("vars update", "update", name, o.value, o.repo ?? "", o));
+  vars.command("delete <name>").description("delete ONLY against a retained present baseline; absence proven afterwards by a complete enumeration (#9780)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").addHelpText("after", VARS_HELP_AFTER).action(async (name, o) => runMutation("vars delete", "delete", name, void 0, o.repo ?? "", o));
+}
+function printReadText(receipt) {
+  if (receipt.operation === "get") {
+    if (receipt.presence === "present") {
+      console.log(`vars get: ${receipt.repo} ${receipt.name} = ${JSON.stringify(receipt.value ?? "")} (presence: present, source: ${receipt.observed?.source ?? "get"})`);
+    } else if (receipt.presence === "absent") {
+      const p = receipt.absenceProof;
+      console.log(`vars get: ${receipt.repo} ${receipt.name} absent \u2014 proven by complete enumeration (${p.pages} page(s), ${p.totalVariables} variable(s), name excluded)`);
+    } else {
+      console.log(`vars get: ${receipt.repo} ${receipt.name} presence UNKNOWN (${receipt.unknownReason}${receipt.capability ? `, capability ${receipt.capability.outcome}` : ""}) \u2014 absence is never claimed from this read`);
+    }
+    return;
+  }
+  if (receipt.pagination.complete) {
+    console.log(`vars list: ${receipt.repo} \u2014 ${receipt.pagination.totalVariables} variable(s), complete (${receipt.pagination.pages} page(s)): ${receipt.variables.map((v) => v.name).join(", ") || "(none)"}`);
+  } else {
+    console.log(`vars list: ${receipt.repo} \u2014 INCOMPLETE enumeration (${receipt.pagination.reason ?? "unknown"}${receipt.pagination.detail ? `: ${receipt.pagination.detail}` : ""}); the names below are NOT the full set: ${receipt.variables.map((v) => v.name).join(", ") || "(none)"}`);
+  }
+}
+function printMutationText(receipt) {
+  const baseline = receipt.baseline.presence === "present" ? `baseline ${JSON.stringify(receipt.baseline.value ?? "")}` : `baseline ${receipt.baseline.presence}`;
+  const readback = receipt.readback ? `, read-back ${receipt.readback.presence}${receipt.readback.value !== void 0 ? ` ${JSON.stringify(receipt.readback.value)}` : ""}` : "";
+  console.log(`vars ${receipt.operation}: ${receipt.repo} ${receipt.name} \u2014 ${receipt.outcome} (${baseline}${readback})${receipt.reason ? ` \u2014 ${receipt.reason}` : ""} [no atomic compare-and-swap; writes are never replayed]`);
+}
+
+// src/repo-archive-status.ts
+var import_node_crypto14 = require("node:crypto");
+init_github_client();
+init_cli_shared();
+var ARCHIVE_STATUS_RECEIPT_SCHEMA = "mmi-cli.repo-archive-status/1";
+var ARCHIVE_SOURCE_TIME_NOTE = "GitHub exposes no archived_at; observedAt is this read's window end and the provider timestamps are the repository's own updated_at/pushed_at from the same response that carried the archived flag";
+async function call2(deps, log, method, path2) {
+  try {
+    const res = await deps.transport.restWithStatus(method, path2);
+    log.push({ method, path: path2, status: res.status });
+    return res;
+  } catch (e) {
+    if (e instanceof AppActorError) throw e;
+    const status = e instanceof GitHubApiError ? e.status : 0;
+    log.push({ method, path: path2, status });
+    throw e;
+  }
+}
+function classify2(e) {
+  if (e instanceof AppActorError) {
+    const status = e.mintRefusal?.status ?? 0;
+    return { status, reason: "mint-refused", mint: { status, reason: e.mintRefusal?.reason ?? e.message } };
+  }
+  if (e instanceof GitHubApiError) {
+    if (e.status === 404) return { status: 404, reason: "missing-or-invisible" };
+    if (e.status === 403 || e.status === 401) return { status: e.status, reason: "denied" };
+    return { status: e.status, reason: "transport-error" };
+  }
+  const name = e?.name ?? "";
+  if (name === "TimeoutError" || name === "AbortError" || /timeout|abort/i.test(String(e?.message ?? ""))) return { status: 0, reason: "timeout" };
+  return { status: 0, reason: "transport-error" };
+}
+async function readArchiveStatusReceipt(deps, repo) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const startedAt = now();
+  const log = [];
+  const base = {
+    schema: ARCHIVE_STATUS_RECEIPT_SCHEMA,
+    repo,
+    sourceTime: { observedAt: "", note: ARCHIVE_SOURCE_TIME_NOTE },
+    window: { startedAt: startedAt.toISOString(), endedAt: "", atomicSnapshot: false },
+    actor: deps.actor ?? { credential: "app_installation" },
+    correlationId: (deps.correlationId ?? import_node_crypto14.randomUUID)(),
+    upstream: log
+  };
+  try {
+    const { body } = await call2(deps, log, "GET", `repos/${repo}`);
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return { ...base, archived: "unknown", unknownReason: "parser-refused", sourceTime: { ...base.sourceTime, observedAt: now().toISOString() }, window: { ...base.window, endedAt: now().toISOString() } };
+    }
+    const payload = body;
+    if (typeof payload.archived !== "boolean") {
+      return { ...base, archived: "unknown", unknownReason: "parser-refused", sourceTime: { ...base.sourceTime, observedAt: now().toISOString() }, window: { ...base.window, endedAt: now().toISOString() } };
+    }
+    if (payload.updated_at !== void 0 && typeof payload.updated_at !== "string") payload.updated_at = void 0;
+    if (payload.pushed_at !== void 0 && typeof payload.pushed_at !== "string") payload.pushed_at = void 0;
+    return {
+      ...base,
+      archived: payload.archived,
+      sourceTime: {
+        observedAt: now().toISOString(),
+        ...typeof payload.updated_at === "string" ? { providerUpdatedAt: payload.updated_at } : {},
+        ...typeof payload.pushed_at === "string" ? { providerPushedAt: payload.pushed_at } : {},
+        note: ARCHIVE_SOURCE_TIME_NOTE
+      },
+      window: { ...base.window, endedAt: now().toISOString() }
+    };
+  } catch (e) {
+    const { reason, mint } = classify2(e);
+    return {
+      ...base,
+      archived: "unknown",
+      unknownReason: reason,
+      ...reason === "denied" ? { capability: { permission: "metadata:read", outcome: "denied" } } : {},
+      ...mint ? { capability: { permission: "metadata:read", outcome: "mint-refused", status: mint.status, reason: mint.reason } } : {},
+      ...reason === "missing-or-invisible" ? { sourceTime: { ...base.sourceTime, observedAt: now().toISOString(), note: `${ARCHIVE_SOURCE_TIME_NOTE} \u2014 HTTP 404: the repository is missing or not visible to the installation, which is NOT archived:false` } } : { sourceTime: { ...base.sourceTime, observedAt: now().toISOString() } },
+      window: { ...base.window, endedAt: now().toISOString() }
+    };
+  }
+}
+function registerRepoArchiveStatusCommand(program3, deps) {
+  const repoRoot2 = program3.command("repo").description("canonical repository typed reads \u2014 archive status (#9779)");
+  repoRoot2.command("archive-status").description("typed archived-state read for one canonical repository: archived + source time, App metadata:read; a 404 is missing-or-invisible, never archived:false (#9779)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").option("--json", "machine-readable receipt").action(async (o) => {
+    const projects = await deps.projects();
+    const resolution = resolveCanonicalRepo(o.repo ?? "", projects);
+    const repo = resolution.kind === "resolved" ? resolution.repo : resolution.kind === "conflict" ? fail(`repo archive-status: '${o.repo ?? ""}' resolves to MULTIPLE registered repositories (${resolution.candidates.join(", ")}) \u2014 pass the exact owner/repo (#9779)`) : resolution.kind === "unavailable" ? fail("repo archive-status: the Hub project registry is unreadable; refusing to address a repo this command cannot prove registered") : fail(`repo archive-status: '${o.repo ?? ""}' is not a registered repository in the Hub registry \u2014 pass the exact owner/repo`);
+    const receipt = await readArchiveStatusReceipt({ transport: await deps.appClient("repo archive-status"), ...deps.actor ? { actor: deps.actor() } : {} }, repo);
+    if (o.json) console.log(JSON.stringify(receipt, null, 2));
+    else if (receipt.archived === "unknown") console.log(`repo archive-status: ${receipt.repo} \u2014 archived state UNKNOWN (${receipt.unknownReason}${receipt.capability?.outcome === "mint-refused" ? `: App token mint refused${receipt.capability.status ? ` (HTTP ${receipt.capability.status})` : ""}: ${receipt.capability.reason}` : ""}) \u2014 never reads as not-archived`);
+    else console.log(`repo archive-status: ${receipt.repo} \u2014 archived: ${receipt.archived} (observed ${receipt.sourceTime.observedAt}${receipt.sourceTime.providerUpdatedAt ? `, provider updated_at ${receipt.sourceTime.providerUpdatedAt}` : ""})`);
+    if (receipt.archived === "unknown") process.exitCode = 1;
+  });
+}
+
+// src/merge-queue-lifecycle.ts
+var import_node_crypto15 = require("node:crypto");
+var import_node_fs35 = require("node:fs");
+var import_node_path32 = require("node:path");
+init_github_client();
+init_cli_shared();
+var LIFECYCLE_SCHEMA = "mmi-cli.merge-queue-lifecycle/1";
+var COHORT_SCHEMA = "mmi.merge-queue-cohort/1";
+var LIFECYCLE_SOURCE = {
+  provider: "github-graphql",
+  operation: "PullRequest.timelineItems",
+  itemTypes: ["ADDED_TO_MERGE_QUEUE_EVENT", "REMOVED_FROM_MERGE_QUEUE_EVENT", "MERGED_EVENT", "HEAD_REF_FORCE_PUSHED_EVENT", "BASE_REF_CHANGED_EVENT"],
+  schemaRef: "https://docs.github.com/public/fpt/schema.docs.graphql",
+  version: "merge-queue-lifecycle-source/1",
+  permission: "pull_requests:read"
+};
+var LIFECYCLE_QUERY = "query($owner:String!,$name:String!,$number:Int!,$after:String){repository(owner:$owner,name:$name){pullRequest(number:$number){number baseRefName mergedAt mergeCommit{oid} timelineItems(first:100,after:$after,itemTypes:[ADDED_TO_MERGE_QUEUE_EVENT,REMOVED_FROM_MERGE_QUEUE_EVENT,MERGED_EVENT,HEAD_REF_FORCE_PUSHED_EVENT,BASE_REF_CHANGED_EVENT]){pageInfo{hasNextPage endCursor} nodes{__typename ... on AddedToMergeQueueEvent{id createdAt} ... on RemovedFromMergeQueueEvent{id createdAt reason beforeCommit{oid}} ... on MergedEvent{id createdAt commit{oid}} ... on HeadRefForcePushedEvent{id createdAt beforeCommit{oid} afterCommit{oid}} ... on BaseRefChangedEvent{id createdAt previousRefName currentRefName}}}}}}";
+var UTC_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/;
+var SHA_RE2 = /^[0-9a-f]{40}$/;
+function parseUtc(raw, flag) {
+  if (!UTC_RE.test(raw) || Number.isNaN(Date.parse(raw))) throw new Error(`${flag} must be a UTC timestamp like 2026-11-02T00:00:00Z \u2014 received '${raw.slice(0, 40)}'`);
+  return raw;
+}
+function parseBound(raw, flag, max) {
+  if (!/^\d+$/.test(raw) || Number(raw) < 1 || Number(raw) > max) throw new Error(`${flag} must be an integer 1-${max} \u2014 received '${raw.slice(0, 20)}'`);
+  return Number(raw);
+}
+function optionalUtc(v, where) {
+  if (v === void 0) return void 0;
+  if (typeof v !== "string") throw new Error(`${where} must be a UTC timestamp string`);
+  return parseUtc(v, where);
+}
+function parseCohortManifest(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw new Error("cohort manifest is not valid JSON");
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("cohort manifest must be a JSON object");
+  const m = raw;
+  if (m.schema !== COHORT_SCHEMA) throw new Error(`cohort manifest schema must be '${COHORT_SCHEMA}'`);
+  if (typeof m.repo !== "string" || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(m.repo)) throw new Error("cohort manifest repo must be owner/repo");
+  if (typeof m.base_branch !== "string" || m.base_branch.trim() === "") throw new Error("cohort manifest base_branch is required");
+  const receipt = m.measurement_receipt;
+  if (!receipt || typeof receipt.id !== "string" || receipt.id.trim() === "" || typeof receipt.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(receipt.sha256)) {
+    throw new Error("cohort manifest measurement_receipt needs an id and a 64-hex sha256 binding the existing measurement");
+  }
+  const since = parseUtc(String(m.since ?? ""), "manifest since");
+  const until = parseUtc(String(m.until ?? ""), "manifest until");
+  if (!Array.isArray(m.prs) || m.prs.length === 0) throw new Error("cohort manifest prs must list explicit PR identities");
+  const seen = /* @__PURE__ */ new Set();
+  const prs = m.prs.map((p, i) => {
+    const row = p;
+    if (!row || !Number.isInteger(row.number) || row.number < 1) throw new Error(`cohort manifest prs[${i}].number must be a positive integer`);
+    const number = row.number;
+    if (seen.has(number)) throw new Error(`cohort manifest lists PR #${number} twice`);
+    seen.add(number);
+    if (row.excluded !== void 0 && (typeof row.excluded !== "string" || row.excluded.trim() === "")) throw new Error(`cohort manifest prs[${i}].excluded must be a reason string`);
+    return { number, ...typeof row.excluded === "string" ? { excluded: row.excluded } : {} };
+  });
+  const runs2 = m.runs === void 0 ? [] : m.runs;
+  if (!Array.isArray(runs2)) throw new Error("cohort manifest runs must be an array");
+  const parsedRuns = runs2.map((r, i) => {
+    const row = r;
+    const where = `cohort manifest runs[${i}]`;
+    if (!row || !Number.isInteger(row.run_id) || !Number.isInteger(row.run_attempt) || row.run_attempt < 1) throw new Error(`${where} needs integer run_id and run_attempt >= 1`);
+    if (typeof row.head_sha !== "string" || !SHA_RE2.test(row.head_sha)) throw new Error(`${where}.head_sha must be a full 40-hex SHA`);
+    if (!Array.isArray(row.members)) throw new Error(`${where}.members must list explicit PR memberships`);
+    const members = row.members.map((mem, j) => {
+      const mm = mem;
+      if (!mm || !Number.isInteger(mm.pr)) throw new Error(`${where}.members[${j}].pr must be an integer`);
+      if (mm.admission_event_id !== void 0 && (typeof mm.admission_event_id !== "string" || mm.admission_event_id === "")) throw new Error(`${where}.members[${j}].admission_event_id must be a provider event id`);
+      return { pr: mm.pr, ...typeof mm.admission_event_id === "string" ? { admission_event_id: mm.admission_event_id } : {} };
+    });
+    const started = optionalUtc(row.started_at, `${where}.started_at`);
+    const failureResult = optionalUtc(row.failure_result_at, `${where}.failure_result_at`);
+    const failureObserved = optionalUtc(row.failure_observed_at, `${where}.failure_observed_at`);
+    return {
+      run_id: row.run_id,
+      run_attempt: row.run_attempt,
+      head_sha: row.head_sha,
+      members,
+      ...started ? { started_at: started } : {},
+      ...failureResult ? { failure_result_at: failureResult } : {},
+      ...failureObserved ? { failure_observed_at: failureObserved } : {}
+    };
+  });
+  return { schema: COHORT_SCHEMA, repo: m.repo, base_branch: m.base_branch, measurement_receipt: { id: receipt.id, sha256: receipt.sha256 }, since, until, prs, runs: parsedRuns };
+}
+var oidOf = (v) => v && typeof v === "object" && typeof v.oid === "string" ? v.oid : null;
+function normalizeNodes(nodes, malformed) {
+  const out = [];
+  for (const node of nodes) {
+    const n = node;
+    if (!n || typeof n.id !== "string" || typeof n.createdAt !== "string") {
+      malformed.push("event-missing-id-or-createdAt");
+      continue;
+    }
+    const base = { id: n.id, at: n.createdAt };
+    switch (n.__typename) {
+      case "AddedToMergeQueueEvent":
+        out.push({ kind: "enqueued", ...base });
+        break;
+      case "RemovedFromMergeQueueEvent":
+        out.push({ kind: "removed", ...base, reason: typeof n.reason === "string" && n.reason !== "" ? n.reason : null, before_head: oidOf(n.beforeCommit) });
+        break;
+      case "MergedEvent":
+        out.push({ kind: "merged", ...base, merge_sha: oidOf(n.commit) });
+        break;
+      case "HeadRefForcePushedEvent":
+        out.push({ kind: "head_changed", ...base, before: oidOf(n.beforeCommit), after: oidOf(n.afterCommit) });
+        break;
+      case "BaseRefChangedEvent":
+        if (typeof n.previousRefName !== "string" || typeof n.currentRefName !== "string") {
+          malformed.push("base-change-missing-refs");
+          break;
+        }
+        out.push({ kind: "base_changed", ...base, from: n.previousRefName, to: n.currentRefName });
+        break;
+      default:
+        malformed.push(`unexpected-typename:${String(n.__typename).slice(0, 40)}`);
+    }
+  }
+  return out;
+}
+function classifyError(e) {
+  if (e instanceof GitHubApiError) {
+    if (e.rateLimited) return { code: "rate-limited", status: e.status };
+    const types = (e.graphqlErrors ?? []).map((g) => g.type ?? "");
+    if (e.status === 401 || e.status === 403 || types.includes("FORBIDDEN")) return { code: "permission-denied", status: e.status };
+    if (e.status === 404 || types.includes("NOT_FOUND")) return { code: "not-found-or-masked", status: e.status };
+    if (types.some((t) => t !== "")) return { code: "unsupported-source", status: e.status };
+    if (/did not include data/i.test(e.message)) return { code: "malformed-response", status: e.status };
+    return { code: "transport-error", status: e.status };
+  }
+  const name = e?.name ?? "";
+  if (name === "TimeoutError" || name === "AbortError" || /timeout|timed out|abort/i.test(String(e?.message ?? ""))) return { code: "timeout", status: 0 };
+  return { code: "transport-error", status: 0 };
+}
+function classifyRemovalReason(reason, headChangedBeforeReentry) {
+  if (headChangedBeforeReentry) return "head-change";
+  if (reason === null) return "unknown";
+  if (/manual|dequeued by|removed by|user/i.test(reason)) return "manual";
+  if (/fail|timed? ?out|timeout|check|status/i.test(reason)) return "failure-linked";
+  if (/conflict|protection|invalid|base|push|commit|head/i.test(reason)) return "invalidation";
+  return "unknown";
+}
+var secondsBetween = (from, to) => {
+  const d = (Date.parse(to) - Date.parse(from)) / 1e3;
+  if (!Number.isFinite(d)) return { value: null, reason: "unparseable-timestamp" };
+  if (d < 0) return { value: null, reason: "negative-duration" };
+  return { value: d };
+};
+var ZERO_BOUNCES = () => ({ manual: 0, "failure-linked": 0, "head-change": 0, invalidation: 0, unknown: 0 });
+function buildPrLifecycle(state, manifest, joins) {
+  const entry = manifest.prs.find((p) => p.number === state.number);
+  const anomalies = [...state.malformed ?? []];
+  const events = state.events.map((e, i) => ({ e, i })).filter(({ e }) => {
+    if (UTC_RE.test(e.at) && !Number.isNaN(Date.parse(e.at))) return true;
+    anomalies.push(`malformed-timestamp:${e.id}`);
+    return false;
+  });
+  for (let k = 1; k < events.length; k++) if (Date.parse(events[k].e.at) < Date.parse(events[k - 1].e.at)) anomalies.push(`out-of-order:${events[k].e.id}`);
+  const ordered = events.sort((a, b) => Date.parse(a.e.at) - Date.parse(b.e.at) || a.i - b.i).map(({ e }) => e);
+  const prBase = state.pr?.base_ref ?? null;
+  const baseChanges = ordered.filter((e) => e.kind === "base_changed");
+  const baseAt = (at) => {
+    const next = baseChanges.find((c) => Date.parse(c.at) > Date.parse(at));
+    if (next) return { value: next.from, reason: "derived-from-base-ref-changed-event" };
+    return prBase === null ? { value: null, reason: "base-unavailable" } : { value: prBase, reason: baseChanges.length ? "derived-from-base-ref-changed-event" : "current-base-no-recorded-change" };
+  };
+  const episodes = [];
+  let open2 = null;
+  let leftCensored = false;
+  let sawQueueEvent = false;
+  let mergedEvent = null;
+  for (const e of ordered) {
+    if (e.kind === "enqueued") {
+      if (open2) {
+        anomalies.push(`admission-without-removal:${e.id}`);
+        episodes.push(open2);
+      }
+      const prev = open2 ?? episodes[episodes.length - 1] ?? null;
+      const headChanged = prev ? ordered.some((h) => h.kind === "head_changed" && Date.parse(h.at) >= Date.parse(prev.terminal.at ?? prev.enqueued_at) && Date.parse(h.at) <= Date.parse(e.at)) : null;
+      open2 = {
+        episode_id: e.id,
+        enqueued_at: e.at,
+        head_sha: { value: null, reason: "source-omits-admission-head (AddedToMergeQueueEvent has no commit field)" },
+        base: baseAt(e.at),
+        terminal: { type: null, at: null, event_id: null, reason: null, reason_class: null, head_at_removal: null },
+        reentry_of: prev && prev.terminal.type === "removed" ? prev.episode_id : null,
+        head_changed_since_previous_episode: headChanged,
+        runs: [],
+        queue_wait_to_execution_seconds: { value: null, reason: "no-explicit-run-join" }
+      };
+      sawQueueEvent = true;
+    } else if (e.kind === "removed") {
+      if (!open2) {
+        if (!sawQueueEvent) leftCensored = true;
+        anomalies.push(`removal-without-admission:${e.id}`);
+        sawQueueEvent = true;
+        continue;
+      }
+      open2.terminal = { type: "removed", at: e.at, event_id: e.id, reason: e.reason, reason_class: null, head_at_removal: e.before_head };
+      episodes.push(open2);
+      open2 = null;
+    } else if (e.kind === "merged") {
+      mergedEvent = e;
+      if (open2) {
+        open2.terminal = { type: "merged", at: e.at, event_id: e.id, reason: null, reason_class: null, head_at_removal: null };
+        episodes.push(open2);
+        open2 = null;
+      }
+    }
+  }
+  if (open2) episodes.push(open2);
+  let bounceCount = 0;
+  const byReason = ZERO_BOUNCES();
+  episodes.forEach((ep, idx) => {
+    if (ep.terminal.type !== "removed") return;
+    const next = episodes[idx + 1];
+    const headChange = next ? next.head_changed_since_previous_episode === true : false;
+    ep.terminal.reason_class = classifyRemovalReason(ep.terminal.reason, headChange);
+    if (next && next.reentry_of === ep.episode_id) {
+      bounceCount++;
+      byReason[ep.terminal.reason_class]++;
+    }
+  });
+  for (const run of manifest.runs) {
+    for (const member of run.members) {
+      if (member.pr !== state.number) continue;
+      if (!member.admission_event_id) continue;
+      const ep = episodes.find((x) => x.episode_id === member.admission_event_id);
+      const join54 = joins.find((j) => j.run_id === run.run_id && j.run_attempt === run.run_attempt && j.pr === member.pr && j.admission_event_id === member.admission_event_id);
+      if (!join54) continue;
+      if (!ep) {
+        if (state.status === "complete") {
+          join54.status = "unresolved";
+          join54.reason = "admission-event-not-in-history";
+        } else {
+          join54.status = "unresolved";
+          join54.reason = "history-incomplete";
+        }
+        continue;
+      }
+      join54.status = "joined";
+      delete join54.reason;
+      ep.runs.push({ run_id: run.run_id, run_attempt: run.run_attempt, head_sha: run.head_sha });
+    }
+  }
+  const runOf = (ep) => manifest.runs.filter((r) => ep.runs.some((x) => x.run_id === r.run_id && x.run_attempt === r.run_attempt));
+  const earliest = (ep, field) => {
+    const vals = runOf(ep).map((r) => r[field]).filter((v) => typeof v === "string").sort((a, b) => Date.parse(a) - Date.parse(b));
+    return vals[0] ?? null;
+  };
+  for (const ep of episodes) {
+    if (!ep.runs.length) continue;
+    const started = earliest(ep, "started_at");
+    ep.queue_wait_to_execution_seconds = started ? secondsBetween(ep.enqueued_at, started) : { value: null, reason: "joined-run-has-no-execution-start" };
+  }
+  const mergedAt = state.pr?.merged_at ?? null;
+  let cohort;
+  let cohortReason;
+  if (entry.excluded || state.status === "excluded") {
+    cohort = "excluded";
+    cohortReason = `manifest-exclusion: ${entry.excluded ?? "excluded"}`;
+  } else if (state.status !== "complete") {
+    cohort = "unknown";
+    cohortReason = state.status === "failed" || state.status === "unsupported" ? `lookup-${state.status}:${state.error?.code ?? "unknown"}` : "history-incomplete";
+  } else if (mergedAt === null) {
+    cohort = "right-censored";
+    cohortReason = "not-merged-pending-or-closed";
+  } else if (Date.parse(mergedAt) >= Date.parse(manifest.until)) {
+    cohort = "right-censored";
+    cohortReason = "merged-at-or-after-until";
+  } else if (Date.parse(mergedAt) < Date.parse(manifest.since)) {
+    cohort = "outside-window";
+    cohortReason = "merged-before-since";
+  } else cohort = "eligible";
+  const blocked = () => {
+    if (state.status === "excluded") return "excluded-by-manifest";
+    if (state.status !== "complete") return state.status === "incomplete" || state.status === "pending" ? "history-incomplete" : `lookup-${state.status}`;
+    if (mergedAt === null) return "not-merged";
+    if (anomalies.some((a) => a.startsWith("malformed") || a.startsWith("event-missing") || a.startsWith("unexpected-typename") || a.startsWith("base-change-missing"))) return "malformed-history";
+    if (anomalies.some((a) => a.startsWith("out-of-order") || a.startsWith("admission-without-removal"))) return "contradictory-ordering";
+    if (mergedEvent && mergedEvent.at !== mergedAt && Date.parse(mergedEvent.at) !== Date.parse(mergedAt)) return "conflicting-merge-time";
+    if (mergedEvent && state.pr?.merge_sha && mergedEvent.merge_sha && mergedEvent.merge_sha !== state.pr.merge_sha) return "conflicting-merge-sha";
+    return null;
+  };
+  const block = blocked();
+  const nul = (reason) => ({ value: null, reason });
+  let first;
+  if (block) first = nul(block);
+  else if (leftCensored) first = nul("left-censored: removal precedes any recorded admission");
+  else if (!episodes.length) first = nul("no-verified-admission-in-history (not proof of queue bypass)");
+  else first = secondsBetween(episodes[0].enqueued_at, mergedAt);
+  const successful = episodes.filter((ep) => ep.terminal.type === "merged");
+  let success;
+  let successEp = null;
+  if (block) success = nul(block);
+  else if (successful.length !== 1) success = nul(successful.length ? "ambiguous-successful-episode" : "no-episode-terminated-by-merge");
+  else {
+    successEp = successful[0];
+    const headMoved = ordered.some((h) => h.kind === "head_changed" && Date.parse(h.at) > Date.parse(successEp.enqueued_at) && Date.parse(h.at) <= Date.parse(mergedAt));
+    success = headMoved ? nul("head-changed-within-successful-episode") : secondsBetween(successEp.enqueued_at, mergedAt);
+  }
+  const wait = block ? nul(block) : successEp ? successEp.queue_wait_to_execution_seconds : nul("no-successful-episode");
+  const failureEp = episodes.find((ep) => earliest(ep, "failure_result_at") !== null);
+  const observedEp = episodes.find((ep) => earliest(ep, "failure_observed_at") !== null);
+  const failureResult = failureEp ? secondsBetween(failureEp.enqueued_at, earliest(failureEp, "failure_result_at")) : nul("no-joined-failure-result-evidence");
+  const failureObserved = observedEp ? secondsBetween(observedEp.enqueued_at, earliest(observedEp, "failure_observed_at")) : nul("no-joined-failure-observation-evidence");
+  const historyUsable = state.status === "complete" && !leftCensored && !(block && block !== "not-merged");
+  const failureBlock = block === "not-merged" ? null : block;
+  return {
+    number: state.number,
+    lookup: state.status,
+    ...state.error ? { error: state.error } : {},
+    cohort,
+    ...cohortReason ? { cohort_reason: cohortReason } : {},
+    merged_at: mergedAt,
+    merge_sha: state.pr?.merge_sha ?? null,
+    base_ref: prBase,
+    head_transitions: ordered.filter((e) => e.kind === "head_changed").map((e) => ({ event_id: e.id, at: e.at, before: e.before, after: e.after })),
+    base_transitions: baseChanges.map((e) => ({ event_id: e.id, at: e.at, from: e.from, to: e.to })),
+    episodes,
+    events: ordered,
+    anomalies,
+    metrics: {
+      first_enqueue_to_merge_seconds: first,
+      successful_episode_enqueue_to_merge_seconds: success,
+      queue_wait_to_execution_seconds: wait,
+      enqueue_to_failure_result_seconds: { ...failureBlock ? nul(failureBlock) : failureResult, semantics: "provider-completion-time" },
+      enqueue_to_first_observed_failure_seconds: { ...failureBlock ? nul(failureBlock) : failureObserved, semantics: "measurement-poll-observation" },
+      bounce_count: historyUsable ? bounceCount : null,
+      bounce_by_reason: historyUsable ? byReason : null
+    }
+  };
+}
+function median(values) {
+  if (!values.length) return null;
+  const s = [...values].sort((a, b) => a - b);
+  const mid = Math.floor(s.length / 2);
+  return s.length % 2 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
+}
+function summarizeMetric(prs, key, definition, complete) {
+  const values = [];
+  const missing = {};
+  for (const pr of prs) {
+    if (pr.cohort !== "eligible") continue;
+    const m = pr.metrics[key];
+    if (m.value === null) missing[m.reason ?? "unknown"] = (missing[m.reason ?? "unknown"] ?? 0) + 1;
+    else values.push(m.value);
+  }
+  const count = (c) => prs.filter((p) => p.cohort === c).length;
+  const missingTotal = Object.values(missing).reduce((a, b) => a + b, 0);
+  return {
+    definition,
+    label: complete && missingTotal === 0 && count("unknown") === 0 ? "completed-cohort-median" : "available-case-median",
+    median_seconds: median(values),
+    cohort_denominator: prs.length,
+    eligible: values.length,
+    missing_by_reason: missing,
+    right_censored: count("right-censored"),
+    excluded: count("excluded"),
+    outside_window: count("outside-window"),
+    unknown: count("unknown")
+  };
+}
+async function readMergeQueueLifecycle(deps, req) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const started = now();
+  const deadlineMs = started.getTime() + req.deadlineSeconds * 1e3;
+  const [owner, name] = req.repo.split("/");
+  const prior = new Map((req.resume?.prs ?? []).map((p) => [p.number, p]));
+  const states = req.manifest.prs.map((p) => {
+    const was = prior.get(p.number);
+    if (was && was.status !== "incomplete" && was.status !== "pending") return was;
+    if (was) return { ...was, status: "pending" };
+    return { number: p.number, status: "pending", pages: 0, cursors: [], next_cursor: null, events: [], duplicates_dropped: 0 };
+  });
+  let pages = 0;
+  let eventCount = 0;
+  const exhausted = /* @__PURE__ */ new Set();
+  for (const st of states) {
+    if (st.status !== "pending") continue;
+    if (req.manifest.prs.find((p) => p.number === st.number)?.excluded) {
+      st.status = "excluded";
+      continue;
+    }
+    const ids = new Set(st.events.map((e) => e.id));
+    for (; ; ) {
+      if (exhausted.size) break;
+      if (pages >= req.maxPages) {
+        exhausted.add("max-pages");
+        break;
+      }
+      if (eventCount >= req.maxEvents) {
+        exhausted.add("max-events");
+        break;
+      }
+      const remainingMs = deadlineMs - now().getTime();
+      if (remainingMs <= 0) {
+        exhausted.add("deadline");
+        break;
+      }
+      const after = st.next_cursor;
+      let page;
+      try {
+        page = await deps.transport.graphql(LIFECYCLE_QUERY, { owner, name, number: st.number, after }, { timeoutMs: Math.min(6e4, remainingMs) });
+      } catch (e) {
+        const err = classifyError(e);
+        if (err.code === "rate-limited") {
+          exhausted.add("rate-limited");
+          st.error = err;
+          break;
+        }
+        st.status = err.code === "unsupported-source" ? "unsupported" : "failed";
+        st.error = err;
+        break;
+      }
+      pages++;
+      st.pages++;
+      st.cursors.push(after);
+      const pr = page?.repository?.pullRequest;
+      const items = pr?.timelineItems;
+      const hasNext = items?.pageInfo?.hasNextPage;
+      const endCursor = items?.pageInfo?.endCursor;
+      if (!pr || typeof pr.baseRefName !== "string" || !items || !Array.isArray(items.nodes) || typeof hasNext !== "boolean" || hasNext && typeof endCursor !== "string") {
+        st.status = "failed";
+        st.error = { code: pr === null ? "not-found-or-masked" : "malformed-response", status: 200 };
+        break;
+      }
+      st.pr = { base_ref: pr.baseRefName, merged_at: typeof pr.mergedAt === "string" ? pr.mergedAt : null, merge_sha: oidOf(pr.mergeCommit) };
+      const malformed = st.malformed ?? [];
+      for (const ev of normalizeNodes(items.nodes, malformed)) {
+        if (ids.has(ev.id)) {
+          st.duplicates_dropped++;
+          continue;
+        }
+        ids.add(ev.id);
+        st.events.push(ev);
+        eventCount++;
+      }
+      if (malformed.length) st.malformed = malformed;
+      if (!hasNext) {
+        st.status = "complete";
+        st.next_cursor = null;
+        break;
+      }
+      if (endCursor === after) {
+        st.status = "failed";
+        st.error = { code: "malformed-response", status: 200 };
+        break;
+      }
+      st.next_cursor = endCursor;
+    }
+    if (st.status === "pending") st.status = "incomplete";
+  }
+  const joins = [];
+  const cohortNumbers = new Set(req.manifest.prs.map((p) => p.number));
+  for (const run of req.manifest.runs) {
+    if (!run.members.length) {
+      joins.push({ run_id: run.run_id, run_attempt: run.run_attempt, pr: null, admission_event_id: null, status: "unresolved", reason: "no-explicit-pr-membership" });
+      continue;
+    }
+    const prsInRun = run.members.map((m) => m.pr);
+    for (const member of run.members) {
+      const base = { run_id: run.run_id, run_attempt: run.run_attempt, pr: member.pr, admission_event_id: member.admission_event_id ?? null };
+      if (!cohortNumbers.has(member.pr)) joins.push({ ...base, status: "unresolved", reason: "pr-not-in-cohort" });
+      else if (prsInRun.filter((n) => n === member.pr).length > 1) joins.push({ ...base, status: "unresolved", reason: "conflicting-membership" });
+      else if (!member.admission_event_id) joins.push({ ...base, status: "unresolved", reason: "no-explicit-episode-identity" });
+      else joins.push({ ...base, status: "unresolved", reason: "pending-history" });
+    }
+  }
+  const joinable = {
+    ...req.manifest,
+    runs: req.manifest.runs.map((r) => ({ ...r, members: r.members.filter((m) => joins.some((j) => j.run_id === r.run_id && j.run_attempt === r.run_attempt && j.pr === m.pr && j.reason === "pending-history")) }))
+  };
+  const prs = states.map((st) => buildPrLifecycle(st, joinable, joins));
+  for (const j of joins) if (j.reason === "pending-history") j.reason = "history-incomplete";
+  const complete = !exhausted.size && states.every((s) => s.status === "complete" || s.status === "excluded");
+  const bounceTotals = ZERO_BOUNCES();
+  let bounceTotal = 0;
+  let bouncePrs = 0;
+  for (const pr of prs) {
+    if (pr.metrics.bounce_count === null || pr.cohort === "excluded") continue;
+    bouncePrs++;
+    bounceTotal += pr.metrics.bounce_count;
+    for (const [k, v] of Object.entries(pr.metrics.bounce_by_reason)) bounceTotals[k] += v;
+  }
+  return {
+    schema: LIFECYCLE_SCHEMA,
+    repo: req.repo,
+    provider: "github.com",
+    base_branch: req.manifest.base_branch,
+    cohort: { manifest_sha256: req.manifestSha256, measurement_receipt: req.manifest.measurement_receipt, pr_count: req.manifest.prs.length, run_count: req.manifest.runs.length },
+    window: { since: req.since, until: req.until, semantics: "half-open [since, until) over merged_at; queue history is read from each PR timeline start, not truncated at since" },
+    observation: { started_at: started.toISOString(), ended_at: now().toISOString() },
+    source: LIFECYCLE_SOURCE,
+    actor: deps.actor ?? { credential: "app_installation" },
+    correlation_id: (deps.correlationId ?? import_node_crypto15.randomUUID)(),
+    bounds: { max_pages: req.maxPages, max_events: req.maxEvents, deadline_seconds: req.deadlineSeconds },
+    counts: { pages, events: eventCount, duplicates_dropped: states.reduce((a, s) => a + s.duplicates_dropped, 0) },
+    complete,
+    exhausted: [...exhausted],
+    continuation: complete ? null : {
+      repo: req.repo,
+      manifest_sha256: req.manifestSha256,
+      since: req.since,
+      until: req.until,
+      source_version: LIFECYCLE_SOURCE.version,
+      remaining: states.filter((s) => s.status === "incomplete" || s.status === "pending").map((s) => ({ pr: s.number, after: s.next_cursor }))
+    },
+    resumed_from: req.resume?.receipt_sha256 ?? null,
+    prs,
+    unresolved_joins: joins.filter((j) => j.status === "unresolved"),
+    joins,
+    medians: {
+      first_enqueue_to_merge_seconds: summarizeMetric(prs, "first_enqueue_to_merge_seconds", "merged_at minus the first verified admission of the complete PR queue journey (re-entries included)", complete),
+      successful_episode_enqueue_to_merge_seconds: summarizeMetric(prs, "successful_episode_enqueue_to_merge_seconds", "merged_at minus the admission of the unique episode terminated by the merge", complete),
+      queue_wait_to_execution_seconds: summarizeMetric(prs, "queue_wait_to_execution_seconds", "successful-episode admission to the earliest execution start of an explicitly joined run", complete)
+    },
+    bounces: { total: bounceTotal, by_reason: bounceTotals, prs_counted: bouncePrs },
+    checkpoint: { prs: states }
+  };
+}
+var sha256 = (text) => (0, import_node_crypto15.createHash)("sha256").update(text).digest("hex");
+function writeLifecycleReceipt(path2, receipt) {
+  const text = `${JSON.stringify(receipt, null, 2)}
+`;
+  (0, import_node_fs35.mkdirSync)((0, import_node_path32.dirname)(path2), { recursive: true });
+  (0, import_node_fs35.writeFileSync)(path2, text, { encoding: "utf8", flag: "wx" });
+  const back = (0, import_node_fs35.readFileSync)(path2);
+  if (back.toString("utf8") !== text) throw new Error(`receipt read-back mismatch at ${path2}`);
+  return { path: path2, sha256: sha256(back), bytes: back.length };
+}
+function loadCheckpoint(text, scope) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("checkpoint receipt is not valid JSON");
+  }
+  const r = parsed.result;
+  if (!r || r.schema !== LIFECYCLE_SCHEMA || !r.checkpoint || !Array.isArray(r.checkpoint.prs)) throw new Error("checkpoint is not a merge-queue lifecycle receipt");
+  const mismatch = [];
+  if (r.repo.toLowerCase() !== scope.repo.toLowerCase()) mismatch.push("repo");
+  if (r.cohort?.manifest_sha256 !== scope.manifestSha256) mismatch.push("cohort manifest");
+  if (r.window?.since !== scope.since || r.window?.until !== scope.until) mismatch.push("window");
+  if (r.source?.version !== LIFECYCLE_SOURCE.version) mismatch.push("source version");
+  if (mismatch.length) throw new Error(`checkpoint scope mismatch (${mismatch.join(", ")}) \u2014 a continuation is bound to the same repository, cohort, window and source; it never widens scope`);
+  return { receipt_sha256: sha256(text), prs: r.checkpoint.prs };
+}
+var LIFECYCLE_COMMAND_PATH = "read merge-queue lifecycle";
+function registerMergeQueueLifecycleCommand(readRoot, deps) {
+  readRoot.command("merge-queue").description("historical merge-queue reads (#9788)").command("lifecycle").description("typed per-PR merge-queue history for a retained cohort: one fixed GraphQL timeline query on the App pull_requests:read profile, bounded, receipt-bound; unknown values are null with a reason, never zero (#9788)").requiredOption("--repo <owner/repo>", "registered repository (owner/repo, repo name, or one unambiguous project alias)").requiredOption("--input <manifest>", `retained cohort manifest JSON (${COHORT_SCHEMA})`).requiredOption("--since <utc>", "window start, inclusive (UTC, e.g. 2026-11-02T00:00:00Z)").requiredOption("--until <utc>", "window end, exclusive (UTC)").requiredOption("--max-pages <n>", "page bound across the cohort (1-1000)").requiredOption("--max-events <n>", "event bound across the cohort (1-100000)").requiredOption("--deadline-seconds <n>", "wall-clock bound (1-3600)").requiredOption("--receipt <new-path>", "new append-only receipt file (refused if it exists)").option("--resume <prior-receipt>", "continue an incomplete read from its receipt (same repo, cohort, window and source only)").option("--json", "machine-readable result").action(async (o) => {
+    const label = "read merge-queue lifecycle";
+    let since, until, maxPages, maxEvents, deadlineSeconds, manifest, manifestText;
+    try {
+      since = parseUtc(o.since, "--since");
+      until = parseUtc(o.until, "--until");
+      if (Date.parse(since) >= Date.parse(until)) throw new Error("--since must be earlier than --until (half-open window)");
+      maxPages = parseBound(o.maxPages, "--max-pages", 1e3);
+      maxEvents = parseBound(o.maxEvents, "--max-events", 1e5);
+      deadlineSeconds = parseBound(o.deadlineSeconds, "--deadline-seconds", 3600);
+      manifestText = (0, import_node_fs35.readFileSync)(o.input, "utf8");
+      manifest = parseCohortManifest(manifestText);
+      if (manifest.since !== since || manifest.until !== until) throw new Error("--since/--until must equal the manifest window exactly; the authorized window is never widened or narrowed silently");
+    } catch (e) {
+      return fail(`${label}: ${e.message}`);
+    }
+    const resolution = resolveCanonicalRepo(o.repo, await deps.projects());
+    const repo = resolution.kind === "resolved" ? resolution.repo : resolution.kind === "conflict" ? fail(`${label}: '${o.repo}' resolves to MULTIPLE registered repositories (${resolution.candidates.join(", ")}) \u2014 pass the exact owner/repo`) : resolution.kind === "unavailable" ? fail(`${label}: the Hub project registry is unreadable; refusing to address a repo this command cannot prove registered`) : fail(`${label}: '${o.repo}' is not a registered repository in the Hub registry \u2014 pass the exact owner/repo`);
+    if (manifest.repo.toLowerCase() !== repo.toLowerCase()) return fail(`${label}: manifest repo ${manifest.repo} does not match --repo ${repo}; refusing before dispatch`);
+    const manifestSha256 = sha256(manifestText);
+    let resume;
+    try {
+      if (o.resume) resume = loadCheckpoint((0, import_node_fs35.readFileSync)(o.resume, "utf8"), { repo, manifestSha256, since, until });
+    } catch (e) {
+      return fail(`${label}: ${e.message}`);
+    }
+    const request = { repo, input: o.input, since, until, max_pages: maxPages, max_events: maxEvents, deadline_seconds: deadlineSeconds, resume: o.resume ?? null };
+    const result = await readMergeQueueLifecycle(
+      { transport: await deps.appClient(LIFECYCLE_COMMAND_PATH), ...deps.actor ? { actor: deps.actor() } : {} },
+      { repo, since, until, maxPages, maxEvents, deadlineSeconds, manifestSha256, manifest, ...resume ? { resume } : {} }
+    );
+    let receipt;
+    try {
+      receipt = writeLifecycleReceipt(o.receipt, { request, result });
+    } catch (e) {
+      const code = e.code;
+      return fail(`${label}: receipt not written (${code === "EEXIST" ? "path exists \u2014 receipts are append-only, pass a new path" : code ?? "write failed"})`);
+    }
+    const output = { ...result, receipt };
+    if (o.json) console.log(JSON.stringify(output, null, 2));
+    else {
+      const m = result.medians;
+      console.log(`${label}: ${repo} ${since}..${until} \u2014 ${result.complete ? "complete" : `INCOMPLETE (${result.exhausted.join(", ") || "lookup failures"})`}; pages ${result.counts.pages}, events ${result.counts.events}`);
+      for (const [k, s] of Object.entries(m)) console.log(`  ${k}: ${s.median_seconds ?? "UNKNOWN"} (${s.label}; eligible ${s.eligible}/${s.cohort_denominator}, right-censored ${s.right_censored}, unknown ${s.unknown})`);
+      console.log(`  bounces: ${result.bounces.total}; unresolved joins: ${result.unresolved_joins.length}; receipt ${receipt.path} sha256 ${receipt.sha256}`);
+    }
+    if (!result.complete) process.exitCode = 1;
+  });
+}
+
 // src/board-commands.ts
 init_cli_shared();
 
@@ -45063,9 +46346,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs38 = require("node:fs");
+var import_node_fs39 = require("node:fs");
 var import_node_os21 = require("node:os");
-var import_node_path35 = require("node:path");
+var import_node_path36 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -45250,8 +46533,8 @@ init_github_client();
 init_cli_shared();
 
 // src/port-registry.ts
-var import_node_fs35 = require("node:fs");
-var import_node_path32 = require("node:path");
+var import_node_fs36 = require("node:fs");
+var import_node_path33 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -45265,8 +46548,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs35.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs35.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs36.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs36.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -45294,22 +46577,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path32.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path32.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs35.existsSync)(registryPath) || !(0, import_node_fs35.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path33.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path33.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs36.existsSync)(registryPath) || !(0, import_node_fs36.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path32.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path32.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path33.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path33.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path32.dirname)(dir);
+    const parent = (0, import_node_path33.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path32.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path33.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -45326,7 +46609,7 @@ async function ensurePortRangeAtomic(repo, path2, allocate) {
   } catch (e) {
     const why = e.message;
     const missing = /@aws-sdk\/[\w-]+/.exec(why)?.[0];
-    throw new Error(`DDB port allocator failed for ${repo} \u2014 refusing to fall back to the frozen ${path2} (it would hand out a block the cursor already gave away). ` + (missing && /cannot find|not found|ERR_MODULE_NOT_FOUND/i.test(why) ? `Missing dependency ${missing}: run \`npm ci\` in ${(0, import_node_path32.dirname)(path2)}, then retry.` : "Check AWS credentials and that the registry table is reachable, then retry.") + ` Cause: ${why}`);
+    throw new Error(`DDB port allocator failed for ${repo} \u2014 refusing to fall back to the frozen ${path2} (it would hand out a block the cursor already gave away). ` + (missing && /cannot find|not found|ERR_MODULE_NOT_FOUND/i.test(why) ? `Missing dependency ${missing}: run \`npm ci\` in ${(0, import_node_path33.dirname)(path2)}, then retry.` : "Check AWS credentials and that the registry table is reachable, then retry.") + ` Cause: ${why}`);
   }
 }
 
@@ -45378,13 +46661,13 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 
 // src/box-commands.ts
-var import_node_fs37 = require("node:fs");
+var import_node_fs38 = require("node:fs");
 var import_node_child_process12 = require("node:child_process");
 var import_node_os20 = require("node:os");
-var import_node_path34 = require("node:path");
+var import_node_path35 = require("node:path");
 
 // src/box-control.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 var sshdPost = (dest) => `if sshd -t; then systemctl reload ssh; else rm -f ${dest}; echo 'sshd -t rejected ${dest}: removed, not reloaded' >&2; exit 1; fi`;
@@ -45488,7 +46771,7 @@ function laneCoverageAction(files, box, op) {
   return { notice: `LANE_COVERAGE: ${mismatch}` };
 }
 function md5(content) {
-  return (0, import_node_crypto13.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto16.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -45606,8 +46889,8 @@ init_clean_exit();
 init_cli_shared();
 
 // src/secrets-commands.ts
-var import_node_fs36 = require("node:fs");
-var import_node_path33 = require("node:path");
+var import_node_fs37 = require("node:fs");
+var import_node_path34 = require("node:path");
 var import_node_os19 = require("node:os");
 init_cli_shared();
 init_hub_auth();
@@ -46804,18 +48087,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path33.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path34.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path33.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path33.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path34.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path34.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs36.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs36.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs37.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs37.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -46825,9 +48108,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs36.mkdtempSync)((0, import_node_path33.join)((0, import_node_os19.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path33.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs36.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs37.mkdtempSync)((0, import_node_path34.join)((0, import_node_os19.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path34.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs37.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -46839,7 +48122,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs36.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs37.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -46929,7 +48212,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs36.readFileSync)((0, import_node_path33.resolve)(o.file), "utf8");
+        body = (0, import_node_fs37.readFileSync)((0, import_node_path34.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -47065,7 +48348,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs36.unlinkSync)((0, import_node_path33.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs37.unlinkSync)((0, import_node_path34.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -47381,7 +48664,7 @@ function registerBoxCommands(program3) {
       const stdinSource = o.body ? `"${o.body}"` : "<body.sh>";
       const wroteScript = o.ssh && o.script ? o.script : null;
       const runLine = wroteScript ? useStdin ? `bash "${wroteScript}" < ${stdinSource}` : `bash "${wroteScript}"` : void 0;
-      if (wroteScript) (0, import_node_fs37.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs38.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -47508,17 +48791,17 @@ function hubGitShow(ref) {
   return (path2) => git3(["show", `${ref}:${path2}`]);
 }
 function runOnBox(found, script) {
-  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path34.join)((0, import_node_os20.tmpdir)(), "mmi-box-control-"));
+  const dir = (0, import_node_fs38.mkdtempSync)((0, import_node_path35.join)((0, import_node_os20.tmpdir)(), "mmi-box-control-"));
   try {
-    const recipe = (0, import_node_path34.join)(dir, "recipe.sh");
-    (0, import_node_fs37.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    const recipe = (0, import_node_path35.join)(dir, "recipe.sh");
+    (0, import_node_fs38.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
     const r = (0, import_node_child_process12.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
     return r.stdout;
   } finally {
-    (0, import_node_fs37.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function formatControl(mode, box, rows) {
@@ -47646,7 +48929,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -47666,7 +48949,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto14.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto17.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -48916,7 +50199,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -48949,7 +50232,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto15.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto18.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
   const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
   return { ...scoped, baseSha, baseBranch };
@@ -49019,12 +50302,12 @@ var declaredProjectAdmins = (meta) => {
 };
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 async function gateRenderDiff(current, rendered) {
-  const dir = (0, import_node_fs38.mkdtempSync)((0, import_node_path35.join)((0, import_node_os21.tmpdir)(), "mmi-gate-diff-"));
-  const before = (0, import_node_path35.join)(dir, "committed-gate.yml");
-  const after = (0, import_node_path35.join)(dir, "registry-render.yml");
+  const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path36.join)((0, import_node_os21.tmpdir)(), "mmi-gate-diff-"));
+  const before = (0, import_node_path36.join)(dir, "committed-gate.yml");
+  const after = (0, import_node_path36.join)(dir, "registry-render.yml");
   try {
-    (0, import_node_fs38.writeFileSync)(before, current);
-    (0, import_node_fs38.writeFileSync)(after, rendered);
+    (0, import_node_fs39.writeFileSync)(before, current);
+    (0, import_node_fs39.writeFileSync)(after, rendered);
     try {
       return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
     } catch (e) {
@@ -49033,7 +50316,7 @@ async function gateRenderDiff(current, rendered) {
       throw e;
     }
   } finally {
-    (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs39.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function bootstrapTrainDoctorDeps() {
@@ -49054,9 +50337,9 @@ async function propagationScope(classes, what) {
   }
   const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
   let independentCount = rosterRepos.length;
-  if ((0, import_node_fs38.existsSync)("projects.json")) {
+  if ((0, import_node_fs39.existsSync)("projects.json")) {
     try {
-      const local = JSON.parse((0, import_node_fs38.readFileSync)("projects.json", "utf8"));
+      const local = JSON.parse((0, import_node_fs39.readFileSync)("projects.json", "utf8"));
       const localRepos = /* @__PURE__ */ new Set();
       for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
         const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -49181,13 +50464,13 @@ function registerBootstrapCommands(program3) {
       })),
       pushAllowlistOwners: pushAllowlistAuthority(verifyOwners, declaredProjectAdmins(meta)),
       pushAllowlistOwnersRead: verifyOwnersRead,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs39.existsSync)(path2) ? (0, import_node_fs39.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs38.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs38.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs39.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs39.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -49265,14 +50548,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs39.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs38.existsSync)(s.target) ? (0, import_node_fs38.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs39.existsSync)(s.target) ? (0, import_node_fs39.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -49528,24 +50811,24 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs39.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs38.existsSync)(p) ? (0, import_node_fs38.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs39.existsSync)(p) ? (0, import_node_fs39.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path35.join)((0, import_node_os21.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path36.join)((0, import_node_os21.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs39.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs38.unlinkSync)(tmp);
+          (0, import_node_fs39.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -50183,10 +51466,10 @@ LIVE apply to ${repo}:
     if (rawFlag("--pins")) return propagatePins(rawFlag("--apply"), rawFlag("--json"));
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs39.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -50195,9 +51478,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs38.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs38.readFileSync)(seed.target, "utf8");
-    const readSeedFile2 = (path2) => (0, import_node_fs38.existsSync)(path2) ? (0, import_node_fs38.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs39.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs39.readFileSync)(seed.target, "utf8");
+    const readSeedFile2 = (path2) => (0, import_node_fs39.existsSync)(path2) ? (0, import_node_fs39.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const { projects, classOf, inClassRepos, canarySlug, sourcePilot } = await propagationScope(seed.classes, `target '${seed.target}'`);
     const repos = inClassRepos.map((repo) => {
@@ -50316,7 +51599,7 @@ LIVE apply to ${repo}:
       if (plan.refusedNoCanary) return fail("bootstrap propagate --execute: no canary declared for this target \u2014 refusing to write (set seedCanary:true on exactly one registry repo)");
       const headSha = seedSource.sha;
       const sourceBlob = (await execGitForSeedSource(["rev-parse", `${headSha}:${seedSourcePath(seed)}`])).trim();
-      const runbookUnaffected = (0, import_node_fs38.existsSync)(RUNBOOK_UNAFFECTED_PATH) ? runbookUnaffectedReason(JSON.parse((0, import_node_fs38.readFileSync)(RUNBOOK_UNAFFECTED_PATH, "utf8")), seed.target, sourceBlob) : void 0;
+      const runbookUnaffected = (0, import_node_fs39.existsSync)(RUNBOOK_UNAFFECTED_PATH) ? runbookUnaffectedReason(JSON.parse((0, import_node_fs39.readFileSync)(RUNBOOK_UNAFFECTED_PATH, "utf8")), seed.target, sourceBlob) : void 0;
       for (const rec of plan.records) {
         if (rec.action !== "open-pr") continue;
         const baseBranch = classOf(rec.repo) === "content" ? "main" : "development";
@@ -50338,15 +51621,15 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path35.join)((0, import_node_os21.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path36.join)((0, import_node_os21.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha, runbookUnaffected)), "utf8");
+        (0, import_node_fs39.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha, runbookUnaffected)), "utf8");
         try {
           await gh2(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs38.unlinkSync)(tmp);
+            (0, import_node_fs39.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -50415,10 +51698,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs38.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs39.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs38.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -50435,10 +51718,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs38.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs39.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs38.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs39.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -50515,13 +51798,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path35.join)((0, import_node_os21.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs38.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path36.join)((0, import_node_os21.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs39.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs38.unlinkSync)(tmp);
+          (0, import_node_fs39.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -50834,7 +52117,7 @@ init_github_client();
 init_cli_shared();
 
 // src/suite-status.ts
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto19 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -50862,7 +52145,7 @@ function parseSuiteMapping(body) {
     return void 0;
   }
 }
-var sha256 = (b) => (0, import_node_crypto16.createHash)("sha256").update(b).digest("hex");
+var sha2562 = (b) => (0, import_node_crypto19.createHash)("sha256").update(b).digest("hex");
 async function proveBundle(url, tag, fetchUrl) {
   const get = async (u) => {
     try {
@@ -50874,7 +52157,7 @@ async function proveBundle(url, tag, fetchUrl) {
   const bundle = await get(url);
   if (typeof bundle === "string") return { state: "unprovable", detail: `bundle ${bundle}` };
   if (bundle.status !== 200) return { state: "unprovable", detail: `bundle HTTP ${bundle.status}` };
-  const served = sha256(bundle.body);
+  const served = sha2562(bundle.body);
   const recordUrl = new URL(url);
   recordUrl.search = "";
   recordUrl.pathname = recordUrl.pathname.replace(/[^/]*$/, "module.json");
@@ -51117,9 +52400,9 @@ async function waitSuiteDev(deps, opts) {
 }
 
 // src/suite-train.ts
-var import_node_fs39 = require("node:fs");
-var import_node_path36 = require("node:path");
-var import_node_crypto17 = require("node:crypto");
+var import_node_fs40 = require("node:fs");
+var import_node_path37 = require("node:path");
+var import_node_crypto20 = require("node:crypto");
 
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -51204,7 +52487,7 @@ function suiteReleaseTag(rc) {
 function readSuiteCut(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs39.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs40.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -51220,11 +52503,11 @@ function readSuiteCut(path2) {
   return record2;
 }
 function writeSuiteCut(path2, record2) {
-  (0, import_node_fs39.mkdirSync)((0, import_node_path36.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto17.randomBytes)(8).toString("hex")}.tmp`;
+  (0, import_node_fs40.mkdirSync)((0, import_node_path37.dirname)(path2), { recursive: true });
+  const temp = `${path2}.${(0, import_node_crypto20.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    (0, import_node_fs39.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
-    (0, import_node_fs39.renameSync)(temp, path2);
+    (0, import_node_fs40.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
+    (0, import_node_fs40.renameSync)(temp, path2);
   } catch (e) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
@@ -51273,25 +52556,25 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
 async function retireFailedLeadRcLedger(deps, ownerGo) {
-  if (!(0, import_node_fs39.existsSync)(deps.ledgerPath)) return void 0;
+  if (!(0, import_node_fs40.existsSync)(deps.ledgerPath)) return void 0;
   return withLedgerLock(deps.ledgerPath, async (fence) => {
-    const ledger = parseReleaseLedger((0, import_node_fs39.readFileSync)(deps.ledgerPath, "utf8"));
+    const ledger = parseReleaseLedger((0, import_node_fs40.readFileSync)(deps.ledgerPath, "utf8"));
     const states = Object.values(ledger.phases).map((p) => p.state);
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
-    const archive = (0, import_node_path36.join)((0, import_node_path36.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
-    if ((0, import_node_fs39.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    const archive = (0, import_node_path37.join)((0, import_node_path37.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
+    if ((0, import_node_fs40.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
-    await fence(() => (0, import_node_fs39.renameSync)(deps.ledgerPath, archive));
+    await fence(() => (0, import_node_fs40.renameSync)(deps.ledgerPath, archive));
     return `${ledger.tag} (ledger archived to ${archive})`;
   });
 }
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record2 = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record2.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
-  if ((0, import_node_fs39.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
-  (0, import_node_fs39.renameSync)(recordPath, archive);
+  if ((0, import_node_fs40.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
+  (0, import_node_fs40.renameSync)(recordPath, archive);
   return { archive, orphanTags: record2.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
 async function suiteRestoreMainPins(deps) {
@@ -51378,12 +52661,12 @@ async function suiteRcandRun(deps, opts) {
   }
   if ((record2?.announcement === "sent" || record2?.announcement === "skipped") && record2.leadReleased) {
     const archive = `${deps.recordPath}.${record2.leadRcTag}.json`;
-    if ((0, import_node_fs39.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
-    (0, import_node_fs39.renameSync)(deps.recordPath, archive);
+    if ((0, import_node_fs40.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
+    (0, import_node_fs40.renameSync)(deps.recordPath, archive);
     record2 = void 0;
   }
   if (record2 && !record2.pinPr && !record2.leadRcTag && record2.members.every((m) => !m.tag)) {
-    (0, import_node_fs39.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs40.rmSync)(deps.recordPath, { force: true });
     record2 = void 0;
   }
   if (!record2) {
@@ -51437,7 +52720,7 @@ async function suiteRcandRun(deps, opts) {
     quiet.push(member);
   }
   if (record2.members.every((m) => m.carried || quiet.includes(m)) && await deps.contains(SUITE_REPO, record2.leadDevelopment, record2.leadPreviousRc)) {
-    (0, import_node_fs39.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs40.rmSync)(deps.recordPath, { force: true });
     throw new Error("nothing to promote: neither MM-Work nor any module has new development commits since its rc; no suite cut started");
   }
   for (const member of quiet) {
@@ -51455,7 +52738,7 @@ async function suiteRcandRun(deps, opts) {
   }
   if (refusals.length) {
     const untouched = record2.members.every((m) => !m.tag) && !record2.pinPr;
-    if (untouched) (0, import_node_fs39.rmSync)(deps.recordPath, { force: true });
+    if (untouched) (0, import_node_fs40.rmSync)(deps.recordPath, { force: true });
     throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
@@ -51647,11 +52930,11 @@ Each member's live release must serve <data>/main/module.js at its main pin path
   }
   return record2;
 }
-var hotfixRecordPath = (deps) => (0, import_node_path36.join)((0, import_node_path36.dirname)(deps.recordPath), "hotfix.json");
+var hotfixRecordPath = (deps) => (0, import_node_path37.join)((0, import_node_path37.dirname)(deps.recordPath), "hotfix.json");
 function readSuiteHotfix(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs39.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs40.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -51694,7 +52977,7 @@ async function suiteHotfix(deps, opts) {
   if (completed) record2 = void 0;
   if (record2 && record2.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record2.repo} is recorded; finish it (rerun with that member) first`);
   if (!record2?.tag) await deps.validateHotfixSummary();
-  if (completed) (0, import_node_fs39.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
+  if (completed) (0, import_node_fs40.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
   const rec = record2 ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
   const save = () => writeSuiteHotfix(path2, rec);
   save();
@@ -51962,9 +53245,9 @@ async function runRcDataSwitch(deps, opts) {
 
 // src/suite-train-io.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_path49 = require("node:path");
-var import_node_fs53 = require("node:fs");
 var import_node_path50 = require("node:path");
+var import_node_fs54 = require("node:fs");
+var import_node_path51 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
@@ -53656,8 +54939,8 @@ function checkHotfixCarries(options) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path38 = require("node:path");
 var import_node_os22 = require("node:os");
 init_cli_shared();
 init_github_client();
@@ -53702,16 +54985,16 @@ async function ghWithAppOn401(label, args, options) {
 }
 function withAppOn401(client, label = "post-merge") {
   let app;
-  const run = async (call) => {
+  const run = async (call3) => {
     try {
-      return await call(app ?? client);
+      return await call3(app ?? client);
     } catch (e) {
       if (!isUnauthorized(e)) throw e;
       if (app) throw new PostMergeCredentialError(label, "still HTTP 401 with the App installation token (expired or revoked App credential)");
       const token = await appTokenFor(label, e);
       app = createGitHubClient({ token: async () => token });
       try {
-        return await call(app);
+        return await call3(app);
       } catch (e2) {
         if (isUnauthorized(e2)) throw new PostMergeCredentialError(label, "still HTTP 401 with the App installation token (expired or revoked App credential)");
         throw e2;
@@ -54065,13 +55348,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path37.join)((0, import_node_os22.tmpdir)(), "mmi-squash-body-"));
-  const path2 = (0, import_node_path37.join)(dir, "body.txt");
-  (0, import_node_fs40.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  const dir = (0, import_node_fs41.mkdtempSync)((0, import_node_path38.join)((0, import_node_os22.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path38.join)(dir, "body.txt");
+  (0, import_node_fs41.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs41.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -54322,9 +55605,9 @@ async function deleteMergedRemoteBranch(options) {
 init_github_client();
 
 // src/release-custody.ts
-var import_node_crypto18 = require("node:crypto");
-var import_node_fs41 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_crypto21 = require("node:crypto");
+var import_node_fs42 = require("node:fs");
+var import_node_path39 = require("node:path");
 init_github_client();
 
 // src/release-custody-bootstrap.ts
@@ -54545,7 +55828,7 @@ var ReleaseCustodyError = class extends Error {
     this.name = "ReleaseCustodyError";
   }
 };
-var custodyDigest = (value) => (0, import_node_crypto18.createHash)("sha256").update(value).digest("hex");
+var custodyDigest = (value) => (0, import_node_crypto21.createHash)("sha256").update(value).digest("hex");
 function parseCustody(raw, repo) {
   const s = JSON.parse(raw);
   if (s.schema !== "mmi-release-custody/v1" || s.repo !== repo || !s.precutId || !Number.isSafeInteger(s.revision) || s.revision < 1 || !s.controller || !Number.isSafeInteger(s.controller.runId) || s.controller.runId <= 0 || !Number.isSafeInteger(s.controller.runAttempt) || s.controller.runAttempt <= 0 || !s.controller.token || !(s.ledger === null || typeof s.ledger === "string") || !s.archives || !s.effects) {
@@ -54633,7 +55916,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
       throw new ReleaseCustodyError(`previous controller run ${found.state.controller.runId} attempt ${found.state.controller.runAttempt} is not proven terminal`);
     }
     let state = {
-      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto18.randomUUID)(), effects: {}, ...await initialize() },
+      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto21.randomUUID)(), effects: {}, ...await initialize() },
       revision: (found.state?.revision ?? 0) + 1,
       controller
     };
@@ -54694,7 +55977,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
           proof: { kind: "ledger-lifecycle", controller: state.controller }
         };
       }
-      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto18.randomUUID)() : state.precutId };
+      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto21.randomUUID)() : state.precutId };
     });
   }
   async preserveLocal(raw) {
@@ -54794,7 +56077,7 @@ function reclassifySupersededArchives(state) {
 }
 function localRaw(path2) {
   try {
-    return (0, import_node_fs41.readFileSync)(path2, "utf8");
+    return (0, import_node_fs42.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -54803,14 +56086,14 @@ function localRaw(path2) {
 function hydrateLocal(path2, raw) {
   const previous = localRaw(path2);
   if (previous === raw) return;
-  (0, import_node_fs41.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
+  (0, import_node_fs42.mkdirSync)((0, import_node_path39.dirname)(path2), { recursive: true });
   if (previous !== null) {
     const ledger = parseReleaseLedger(previous);
-    const archive = (0, import_node_path38.join)((0, import_node_path38.dirname)(path2), `phases.local-${ledger.tagSha}-${custodyDigest(previous)}.json`);
-    if (!(0, import_node_fs41.existsSync)(archive)) (0, import_node_fs41.writeFileSync)(archive, previous, { flag: "wx" });
-    if (raw === null) (0, import_node_fs41.renameSync)(path2, `${path2}.retired-${custodyDigest(previous)}`);
+    const archive = (0, import_node_path39.join)((0, import_node_path39.dirname)(path2), `phases.local-${ledger.tagSha}-${custodyDigest(previous)}.json`);
+    if (!(0, import_node_fs42.existsSync)(archive)) (0, import_node_fs42.writeFileSync)(archive, previous, { flag: "wx" });
+    if (raw === null) (0, import_node_fs42.renameSync)(path2, `${path2}.retired-${custodyDigest(previous)}`);
   }
-  if (raw !== null) (0, import_node_fs41.writeFileSync)(path2, raw, "utf8");
+  if (raw !== null) (0, import_node_fs42.writeFileSync)(path2, raw, "utf8");
 }
 async function commandIdentity(file, args, run, repo) {
   if (file === "git" && args[0] === "push") {
@@ -54920,7 +56203,7 @@ function withHubReleaseCustody(deps) {
         if (!authority.ok || !authority.train || authority.authenticatedDelegation !== true) {
           throw new ReleaseCustodyError("repository custody requires the server-verified owner-triggered train session");
         }
-        const controller = { ...runIdentity, token: (0, import_node_crypto18.randomUUID)() };
+        const controller = { ...runIdentity, token: (0, import_node_crypto21.randomUUID)() };
         const raw = localRaw(path2);
         const requiredContexts = () => discoverRequiredCheckContexts(
           deps,
@@ -55000,8 +56283,8 @@ function withHubReleaseCustody(deps) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs42 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_path40 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -55048,14 +56331,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path39.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs42.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path40.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs43.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs42.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs43.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines2 = [
     `# ${projectName}`,
     "",
@@ -55074,8 +56357,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs42.existsSync)((0, import_node_path39.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs42.existsSync)((0, import_node_path39.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs43.existsSync)((0, import_node_path40.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs43.existsSync)((0, import_node_path40.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -55097,8 +56380,8 @@ async function syncProjectInfo(plan, client, apply) {
 }
 
 // src/train-commands.ts
-var import_node_fs43 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs44 = require("node:fs");
+var import_node_path41 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -55113,7 +56396,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs43.readFileSync)((0, import_node_path40.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs44.readFileSync)((0, import_node_path41.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -55224,7 +56507,7 @@ function releaseProgressVerdict(status, subject = "Release") {
 
 // src/suite-pin.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path41 = require("node:path");
+var import_node_path42 = require("node:path");
 var SuitePinError = class _SuitePinError extends Error {
   diagnostic;
   constructor(repo, tag, error) {
@@ -55292,8 +56575,8 @@ async function openSuiteCutPinPr(deps, input) {
       if (input.carriedOnly) return { status: "unchanged" };
       throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
     }
-    await (0, import_promises6.mkdir)((0, import_node_path41.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path41.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path42.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path42.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", prs.length ? branch : "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     if (prs.length) {
@@ -55305,7 +56588,7 @@ async function openSuiteCutPinPr(deps, input) {
       await run("git", ["switch", "-c", branch]);
     }
     for (const stage of ["rc", "main"]) {
-      const path2 = (0, import_node_path41.join)(scratch, `${stage}-pins.json`);
+      const path2 = (0, import_node_path42.join)(scratch, `${stage}-pins.json`);
       await (0, import_promises6.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
@@ -55358,12 +56641,12 @@ async function openSuiteRestorePinPr(deps, input) {
       }
     });
     if (!todo.length) return void 0;
-    await (0, import_promises6.mkdir)((0, import_node_path41.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path41.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path42.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path42.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
-    const path2 = (0, import_node_path41.join)(scratch, "main-pins.json");
+    const path2 = (0, import_node_path42.join)(scratch, "main-pins.json");
     await (0, import_promises6.writeFile)(path2, JSON.stringify(todo.map((p) => ({ module: p.module, url: p.prior }))));
     await run("node", ["scripts/pin-modules.mjs", "--stage", "main", "--pins", path2]);
     await run("git", ["add", "seed/modules.json"]);
@@ -55437,8 +56720,8 @@ async function openSuitePinPr(deps, input) {
     if (newer.length) return { status: "superseded", pr: newer[0].url, url: pin };
     const open2 = onBranch.find((p) => p.state === "OPEN");
     if (open2 && tagOf(open2.title ?? "") === tag) return { status: "pending", pr: open2.url, url: pin };
-    await (0, import_promises6.mkdir)((0, import_node_path41.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path41.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path42.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path42.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
@@ -55490,7 +56773,7 @@ function prTitleRefusal(title) {
 
 // src/command-register-collaboration.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_fs52 = require("node:fs");
+var import_node_fs53 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -55514,7 +56797,7 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path48 = require("node:path");
+var import_node_path49 = require("node:path");
 init_house_map();
 
 // src/issue-body.ts
@@ -55631,8 +56914,8 @@ init_github_client();
 init_github_quota();
 
 // src/issue-commands.ts
-var import_node_fs44 = require("node:fs");
-var import_node_crypto19 = require("node:crypto");
+var import_node_fs45 = require("node:fs");
+var import_node_crypto22 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -55824,7 +57107,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs44.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs45.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -56109,7 +57392,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto19.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto22.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -56491,7 +57774,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs44.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs45.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) {
           const top = specs === null ? "null" : typeof specs === "object" ? `an object with keys: ${Object.keys(specs).join(", ") || "(none)"}` : `a ${typeof specs}`;
@@ -56568,8 +57851,8 @@ ${lines2}`, {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs45 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_fs46 = require("node:fs");
+var import_node_path43 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 init_github_client();
@@ -56739,16 +58022,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs45.mkdirSync)((0, import_node_path42.dirname)(path2), { recursive: true });
-  (0, import_node_fs45.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs46.mkdirSync)((0, import_node_path43.dirname)(path2), { recursive: true });
+  (0, import_node_fs46.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs45.existsSync)(path2)) return;
+  if (!(0, import_node_fs46.existsSync)(path2)) return;
   try {
-    (0, import_node_fs45.unlinkSync)(path2);
+    (0, import_node_fs46.unlinkSync)(path2);
   } catch {
   }
 }
@@ -56783,7 +58066,7 @@ var import_promises7 = require("node:fs/promises");
 init_cli_shared();
 
 // src/api-read.ts
-var import_node_fs46 = require("node:fs");
+var import_node_fs47 = require("node:fs");
 init_cli_shared();
 var API_ACCEPT_HEADERS = {
   json: "application/vnd.github+json",
@@ -57048,7 +58331,7 @@ function registerApiReadCommands(program3, overrides) {
       if (req.workflowRuns) body = sliceWorkflowRunsPage(body, req.workflowRuns);
       if (o.jq !== void 0) body = await jqRun(o.jq, body, localJqEnv(), ...bindings.length ? [bindings] : []);
       if (zip) {
-        (0, import_node_fs46.writeFileSync)(o.out, body, "latin1");
+        (0, import_node_fs47.writeFileSync)(o.out, body, "latin1");
         return;
       }
     } catch (e) {
@@ -57147,6 +58430,8 @@ function registerApiReadCommands(program3, overrides) {
 // src/run-log-read.ts
 init_cli_shared();
 var FAILED2 = /* @__PURE__ */ new Set(["failure", "cancelled", "timed_out"]);
+var RUN_LOG_RANGE_LINE_CAP = 2e3;
+var RUN_LOG_RANGE_CHAR_CAP = 32 * 1024;
 function logRepo(raw) {
   const repo = parseBrokerRepo(raw, "--repo");
   if (repo.split("/").some((s) => s === "." || s === "..")) throw new Error("read run log: --repo refuses dot segments");
@@ -57165,6 +58450,78 @@ function sliceRunLog(text, tail) {
   });
   return { errorLines: lines2.filter((_, i) => context.has(i)), tail: lines2.slice(-tail) };
 }
+function parseLineRange(raw) {
+  const match = /^(\d+):(\d+)$/.exec(raw.trim());
+  if (!match) throw new Error(`read run log: --lines must be <start:end> line numbers, e.g. --lines 1:2000 (received '${raw}')`);
+  const start = Number(match[1]);
+  const end = Number(match[2]);
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 1 || end < start) {
+    throw new Error(`read run log: --lines must be a 1-based start:end range with start <= end and safe-integer bounds (received '${raw}')`);
+  }
+  return { start, end };
+}
+async function readRunLogRange(id, o, runner, env = brokerChildEnv()) {
+  const { start, end: requestedEnd } = parseLineRange(o.lines);
+  if (o.tail !== void 0) throw new Error("read run log: --lines and --tail are mutually exclusive (the range already bounds the returned lines)");
+  if (o.failed) throw new Error("read run log: --lines and --failed are mutually exclusive (--lines reads exactly one named job)");
+  if (o.attempt === void 0) throw new Error("read run log: --lines requires an explicit --attempt <n> (1-1000) \u2014 Actions job ids are minted per attempt, so the id must name one attempt");
+  if (o.job === void 0 || !/^\d+$/.test(o.job.trim())) throw new Error("read run log: --lines requires a numeric --job <id> \u2014 job names are ambiguous across attempts; take the id from the attempt-pinned jobs read");
+  const runId = parseBrokerId(id, "run id");
+  const repo = logRepo(o.repo);
+  const attempt = parseBrokerInt(o.attempt, "--attempt", 1, 1e3);
+  const jobId = Number(parseBrokerId(o.job, "job id"));
+  if (!Number.isSafeInteger(jobId) || jobId < 1) throw new Error(`read run log: --lines requires a numeric --job id (received '${o.job}')`);
+  const pages = JSON.parse(await readAppApi(`repos/${repo}/actions/runs/${runId}/attempts/${attempt}/jobs`, runner));
+  const listed = pages.flatMap((page) => page.jobs);
+  const job = listed.find((candidate) => candidate.id === jobId);
+  if (!job) {
+    const shown = listed.slice(0, 30).map((j) => `${j.name} (${j.id})`).join(", ");
+    return {
+      result: { runId, repo, jobs: [] },
+      exitCode: 1,
+      message: `read run log: job ${jobId} is not in run ${runId} attempt ${attempt} \u2014 Actions job ids are minted per workflow run and per re-run attempt, so only an id from this attempt's listing matches; jobs in run ${runId} attempt ${attempt}: ${shown || "none"}${listed.length > 30 ? `, \u2026+${listed.length - 30} more` : ""}`
+    };
+  }
+  const text = await readAppApi(`repos/${repo}/actions/jobs/${job.id}/logs`, runner);
+  const redacted = redactPrivateCredential(text, env);
+  const all = redacted.replace(/\r\n/g, "\n").split("\n");
+  if (all.at(-1) === "") all.pop();
+  const total = all.length;
+  if (start > total) {
+    return {
+      result: { runId, repo, jobs: [] },
+      exitCode: 1,
+      message: `read run log: --lines ${start}:${requestedEnd} starts beyond the end of the log \u2014 job ${job.name} (${job.id}) attempt ${attempt} retains ${total} lines; nothing to return`
+    };
+  }
+  const requestedCount = requestedEnd - start + 1;
+  const selected = all.slice(start - 1, Math.min(requestedEnd, start - 1 + RUN_LOG_RANGE_LINE_CAP));
+  let truncated = requestedCount > selected.length;
+  let section = selected.join("\n");
+  let charCut = false;
+  if (section.length > RUN_LOG_RANGE_CHAR_CAP) {
+    section = section.slice(0, RUN_LOG_RANGE_CHAR_CAP);
+    charCut = true;
+    truncated = true;
+  }
+  const lines2 = section.split("\n");
+  if (charCut && lines2.at(-1) === "") lines2.pop();
+  return {
+    result: {
+      runId,
+      repo,
+      attempt,
+      job: { id: job.id, name: job.name, conclusion: job.conclusion },
+      lines: lines2,
+      start,
+      end: start + lines2.length - 1,
+      requestedEnd,
+      total,
+      truncated
+    },
+    exitCode: 0
+  };
+}
 async function readRunLog(id, o, runner) {
   const runId = parseBrokerId(id, "run id");
   const repo = logRepo(o.repo);
@@ -57190,14 +58547,17 @@ async function readRunLog(id, o, runner) {
   return { result, exitCode: 0 };
 }
 function registerRunLogRead(run, runner) {
-  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name or numeric job id").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3)), "200").option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).option("--json", "emit runId, repo and jobs with failedStep/errorLines/tail").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
+  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136), or a bounded --lines range from one attempt-pinned job (#9773); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name or numeric job id").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3))).option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).addOption(new Option("--lines <start:end>", "read lines start:end of one job (needs --attempt and a numeric --job id; capped at 2000 lines and 32KiB characters; conflicts with --tail/--failed)").conflicts("failed")).option("--json", "emit the read as JSON (jobs with failedStep/errorLines/tail, or the --lines selection)").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
     requireBrokerApp("read run log");
     const env = brokerChildEnv();
     try {
-      const { result, message: message2, exitCode } = await readRunLog(id, o, runner);
-      if (message2 && (!o.json || exitCode !== 0)) printLine(message2);
+      const { result, message: message2, exitCode } = o.lines === void 0 ? await readRunLog(id, o, runner) : await readRunLogRange(id, o, runner, env);
+      if (message2 && (!o.json || exitCode !== 0)) printLine(redactPrivateCredential(message2, env));
       else if (o.json) printLine(redactPrivateCredential(JSON.stringify(result), env));
-      else for (const job of result.jobs) {
+      else if ("lines" in result) {
+        printLine(redactPrivateCredential(`== ${result.job.name} (${result.job.id}) ${result.job.conclusion}: lines ${result.start}-${result.end} of ${result.total} (attempt ${result.attempt}${result.truncated ? ", truncated" : ""})`, env));
+        for (const line of result.lines) printLine(redactPrivateCredential(line, env));
+      } else for (const job of result.jobs) {
         printLine(redactPrivateCredential(`== ${job.name} (${job.id}) ${job.conclusion}: failing step "${job.failedStep ?? "none"}"`, env));
         for (const line of [...job.errorLines, ...job.tail]) printLine(redactPrivateCredential(line, env));
       }
@@ -57383,7 +58743,7 @@ function parseBrokerPrState(raw) {
 function buildPrListSpec(o) {
   const repo = parseBrokerRepo(o.repo, "--repo");
   const fields = rejectPrViewQueueFields(parseBrokerJsonFields(o.json), "<number>", repo, "list");
-  const args = withJson(withRepo(["pr", "list"], repo), fields, o.json);
+  const args = withJson(withRepo(["pr", "list"], repo), fields, o.json, PR_LIST_JSON_FIELDS);
   const state = parseBrokerPrState(o.state);
   if (state) args.push("--state", state);
   for (const flag of ["base", "head"]) {
@@ -57402,9 +58762,11 @@ function buildPrListSpec(o) {
 function withRepo(args, repo) {
   return repo ? [...args, "--repo", repo] : args;
 }
-function withJson(args, jsonFields, jsonFlag) {
+function withJson(args, jsonFields, jsonFlag, bareDefault) {
   if (jsonFlag === void 0 || jsonFlag === false) return args;
-  return typeof jsonFields === "string" ? [...args, "--json", jsonFields] : [...args, "--json"];
+  const fields = typeof jsonFields === "string" ? jsonFields : bareDefault;
+  if (fields === void 0) throw new Error(`read: --json needs a comma-separated field list for gh ${args.slice(0, 2).join(" ")} (e.g. --json number,title,state)`);
+  return [...args, "--json", fields];
 }
 function buildRunViewSpec(id, o) {
   const args = withJson(withRepo(["run", "view", parseBrokerId(id, "run id"), ...o.attempt !== void 0 ? ["--attempt", String(parseBrokerInt(o.attempt, "--attempt", 1, 1e3))] : []], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
@@ -57422,8 +58784,11 @@ function parseBrokerCommit(v) {
   if (!/^[0-9a-f]{40}$/i.test(v)) throw new Error(`read: --commit must be a full 40-character commit SHA (received '${v}')`);
   return v;
 }
+var PR_LIST_JSON_FIELDS = "number,title,state,isDraft,headRefName,baseRefName,author,createdAt,updatedAt,url";
+var ISSUE_LIST_JSON_FIELDS = "number,title,state,labels,assignees,createdAt,updatedAt,url";
+var RUN_LIST_JSON_FIELDS = "attempt,conclusion,createdAt,databaseId,displayTitle,event,headBranch,headSha,name,number,startedAt,status,updatedAt,url,workflowDatabaseId,workflowName";
 function buildRunListSpec(o) {
-  const args = withJson(withRepo(["run", "list"], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
+  const args = withJson(withRepo(["run", "list"], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json, RUN_LIST_JSON_FIELDS);
   const workflow = parseBrokerWorkflow(o.workflow);
   if (workflow) args.push("--workflow", workflow);
   const branch = parseBrokerBranch(o.branch);
@@ -57506,7 +58871,7 @@ function parseBrokerLabel(raw) {
   return raw;
 }
 function buildIssueListSpec(o) {
-  const args = withJson(withRepo(["issue", "list"], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
+  const args = withJson(withRepo(["issue", "list"], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json, ISSUE_LIST_JSON_FIELDS);
   const search = parseBrokerSearch(o.search);
   if (search !== void 0) args.push("--search", search);
   const assignee = parseBrokerAssignee(o.assignee);
@@ -58507,9 +59872,9 @@ function registerPrLifecycleCommands(program3) {
 
 // src/review-verdict.ts
 var import_node_child_process15 = require("node:child_process");
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 var import_node_os24 = require("node:os");
-var import_node_path43 = require("node:path");
+var import_node_path44 = require("node:path");
 init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
 var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
@@ -58674,15 +60039,15 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs47.mkdtempSync)((0, import_node_path43.join)((0, import_node_os24.tmpdir)(), "mmi-review-verdict-"));
-  const path2 = (0, import_node_path43.join)(dir, "body.md");
+  const dir = (0, import_node_fs48.mkdtempSync)((0, import_node_path44.join)((0, import_node_os24.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path44.join)(dir, "body.md");
   try {
-    (0, import_node_fs47.writeFileSync)(path2, body, "utf8");
+    (0, import_node_fs48.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
     return stdout.trim();
   } finally {
     try {
-      (0, import_node_fs47.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs48.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -59095,18 +60460,18 @@ function createPreparationDeps(input, io = {}) {
 }
 
 // src/worktree-residue-sweep.ts
-var import_node_fs51 = require("node:fs");
-var import_node_path47 = require("node:path");
+var import_node_fs52 = require("node:fs");
+var import_node_path48 = require("node:path");
 
 // src/worktree-merge-cleanup.ts
-var import_node_fs50 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_fs51 = require("node:fs");
+var import_node_path47 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs49 = require("node:fs");
-var import_node_path45 = require("node:path");
+var import_node_fs50 = require("node:fs");
+var import_node_path46 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
@@ -59116,8 +60481,8 @@ function normalizeEol2(s) {
 }
 
 // src/env-detection.ts
-var import_node_fs48 = require("node:fs");
-var import_node_path44 = require("node:path");
+var import_node_fs49 = require("node:fs");
+var import_node_path45 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
   return name.toLowerCase() === ".env";
@@ -59127,7 +60492,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs48.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs49.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -59135,13 +60500,13 @@ function findEnvFiles(root) {
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
-        walk2((0, import_node_path44.join)(dir, entry.name), relPath);
+        walk2((0, import_node_path45.join)(dir, entry.name), relPath);
         continue;
       }
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs48.lstatSync)((0, import_node_path44.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs49.lstatSync)((0, import_node_path45.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -59280,12 +60645,12 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path45.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs49.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path46.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs50.existsSync)(configured)) return configured;
   const candidates = [
-    (0, import_node_path45.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
-    ...process.env.LOCALAPPDATA ? [(0, import_node_path45.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
+    (0, import_node_path46.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
+    ...process.env.LOCALAPPDATA ? [(0, import_node_path46.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
-  const bash = candidates.find((path2) => (0, import_node_fs49.existsSync)(path2));
+  const bash = candidates.find((path2) => (0, import_node_fs50.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
   return bash;
 }
@@ -59423,7 +60788,7 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path45.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path46.join)(cwd, "tmp", "stage", "state.json");
 }
 function normPath(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -59640,8 +61005,8 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
-  const envFile = (0, import_node_path45.join)(cwd, ".env");
-  return (0, import_node_fs49.existsSync)(envFile) && envFileKeys((0, import_node_fs49.readFileSync)(envFile, "utf8")).has("PORT");
+  const envFile = (0, import_node_path46.join)(cwd, ".env");
+  return (0, import_node_fs50.existsSync)(envFile) && envFileKeys((0, import_node_fs50.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
   const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
@@ -59656,13 +61021,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs49.existsSync)((0, import_node_path45.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs50.existsSync)((0, import_node_path46.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs49.existsSync)((0, import_node_path45.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs50.existsSync)((0, import_node_path46.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -59678,21 +61043,21 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   }
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson), runtimeEnvSelects(configJson));
   if (!body) return {};
-  const overridePath = (0, import_node_path45.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs49.mkdirSync)((0, import_node_path45.join)(cwd, "tmp", "stage"), { recursive: true });
-  (0, import_node_fs49.writeFileSync)(overridePath, body, "utf8");
+  const overridePath = (0, import_node_path46.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
+  (0, import_node_fs50.mkdirSync)((0, import_node_path46.join)(cwd, "tmp", "stage"), { recursive: true });
+  (0, import_node_fs50.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path45.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path45.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs49.existsSync)(target) && (0, import_node_fs49.existsSync)(example)) {
-    (0, import_node_fs49.copyFileSync)(example, target);
-  } else if ((0, import_node_fs49.existsSync)(target) && (0, import_node_fs49.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs49.readFileSync)(example, "utf8"), (0, import_node_fs49.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs49.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs49.statSync)(target).mtimeMs
+  const target = (0, import_node_path46.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path46.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs50.existsSync)(target) && (0, import_node_fs50.existsSync)(example)) {
+    (0, import_node_fs50.copyFileSync)(example, target);
+  } else if ((0, import_node_fs50.existsSync)(target) && (0, import_node_fs50.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs50.readFileSync)(example, "utf8"), (0, import_node_fs50.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs50.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs50.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running mmi-cli stage`;
@@ -59700,8 +61065,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs49.existsSync)(target)) {
-    (0, import_node_fs49.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs49.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs50.existsSync)(target)) {
+    (0, import_node_fs50.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs50.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -59731,20 +61096,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs49.existsSync)(path2)) return null;
+  if (!(0, import_node_fs50.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs49.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs50.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs49.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs50.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs49.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs50.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -59773,7 +61138,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
     );
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs49.rmSync)(path2, { force: true });
+    (0, import_node_fs50.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -60020,8 +61385,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs49.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs49.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs50.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs50.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -60040,9 +61405,9 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path46.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path47.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs50.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs50.rmdirSync)(nm);
+    if ((0, import_node_fs51.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs51.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -60053,8 +61418,8 @@ function defaultSleep2(ms) {
   return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs50.rmdirSync, exists = import_node_fs50.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs50.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs51.rmdirSync, exists = import_node_fs51.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs51.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -60177,28 +61542,28 @@ async function preCleanWorktreeForRemoval(wtPath, execGit) {
 }
 async function listNestedIgnoredNodeModules(wtPath, execGit) {
   const out = await execGit(["-C", wtPath, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory"]).catch(() => "");
-  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path46.join)(wtPath, line.slice(0, -1)));
+  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path47.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs50.lstatSync)(path2);
+  const stat4 = (0, import_node_fs51.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs50.rmdirSync)(path2);
+      (0, import_node_fs51.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs50.unlinkSync)(path2);
+      (0, import_node_fs51.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs50.readdirSync)(path2)) safeRemoveTree((0, import_node_path46.join)(path2, entry));
-    (0, import_node_fs50.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs51.readdirSync)(path2)) safeRemoveTree((0, import_node_path47.join)(path2, entry));
+    (0, import_node_fs51.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs50.unlinkSync)(path2);
+  (0, import_node_fs51.unlinkSync)(path2);
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
-    safeRemoveTree((0, import_node_path46.join)(wtPath, "node_modules"));
+    safeRemoveTree((0, import_node_path47.join)(wtPath, "node_modules"));
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -60210,7 +61575,7 @@ function errorMessage(e) {
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs50.realpathSync)(path2));
+    return normPath2((0, import_node_fs51.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -60218,10 +61583,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs50.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs51.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs50.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs51.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -60237,17 +61602,17 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs50.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs51.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
-      const child2 = (0, import_node_path46.join)(dir, entry.name);
+      const child2 = (0, import_node_path47.join)(dir, entry.name);
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs50.realpathSync)(child2));
+          target = normPath2((0, import_node_fs51.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -60430,7 +61795,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs50.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs51.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -60570,7 +61935,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
   if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
   unlinkedReparsePoints.push(...preHelperGuard.unlinked);
-  if (pathExists((0, import_node_path46.join)(wtPath, "node_modules"))) {
+  if (pathExists((0, import_node_path47.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? removeWorktreeNodeModules)(wtPath);
     if (!nmRemoved.ok) {
       report.worktree = {
@@ -60706,18 +62071,18 @@ function renderPrMergeCleanupLines(cleanup) {
 // src/worktree-residue-sweep.ts
 var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
 function canonicalWorktreeRoot(primary) {
-  return (0, import_node_path47.join)((0, import_node_path47.dirname)(primary), "mmi-worktrees", (0, import_node_path47.basename)(primary));
+  return (0, import_node_path48.join)((0, import_node_path48.dirname)(primary), "mmi-worktrees", (0, import_node_path48.basename)(primary));
 }
 function norm(p) {
   const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? s.toLowerCase() : s;
 }
 function residueLedgerPath(gitCommonDir) {
-  return (0, import_node_path47.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
+  return (0, import_node_path48.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
 }
 function readPaths(file, deps) {
   try {
-    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs51.readFileSync)(f, "utf8")))(file));
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs52.readFileSync)(f, "utf8")))(file));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -60726,8 +62091,8 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs51.mkdirSync)((0, import_node_path47.dirname)(f), { recursive: true });
-      (0, import_node_fs51.writeFileSync)(f, t, "utf8");
+      (0, import_node_fs52.mkdirSync)((0, import_node_path48.dirname)(f), { recursive: true });
+      (0, import_node_fs52.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
 `);
@@ -60741,17 +62106,17 @@ function recordResidue(gitCommonDir, path2, deps = {}) {
   writePaths(file, paths, deps);
 }
 async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
-  const exists = deps.exists ?? import_node_fs51.existsSync;
-  const readDir = deps.readDir ?? ((p) => (0, import_node_fs51.readdirSync)(p));
+  const exists = deps.exists ?? import_node_fs52.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs52.readdirSync)(p));
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return (0, import_node_fs51.statSync)(p).isDirectory();
+      return (0, import_node_fs52.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   });
   const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
-  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs51.rmdirSync)(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs52.rmdirSync)(p));
   const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
   const live = new Set(registered.map(norm));
   const primary = registered[0] ? norm(registered[0]) : void 0;
@@ -60786,7 +62151,7 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     } catch {
     }
     for (const name of children) {
-      const child2 = (0, import_node_path47.join)(root, name);
+      const child2 = (0, import_node_path48.join)(root, name);
       const key = norm(child2);
       if (live.has(key) || key === primary || keptKeys.has(key) || !isDir(child2)) continue;
       let entries;
@@ -60829,10 +62194,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path48.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path49.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs52.existsSync)((0, import_node_path48.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs52.existsSync)((0, import_node_path48.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs53.existsSync)((0, import_node_path49.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs53.existsSync)((0, import_node_path49.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -60844,8 +62209,8 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path48.join)(root, path2);
-      return (0, import_node_fs52.existsSync)(fullPath) ? (0, import_node_fs52.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path49.join)(root, path2);
+      return (0, import_node_fs53.existsSync)(fullPath) ? (0, import_node_fs53.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -61712,11 +63077,11 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path48.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs52.existsSync)(wfDir)) return [];
-    return (0, import_node_fs52.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    const wfDir = (0, import_node_path49.join)(cwd, ".github", "workflows");
+    if (!(0, import_node_fs53.existsSync)(wfDir)) return [];
+    return (0, import_node_fs53.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs52.readFileSync)((0, import_node_path48.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs53.readFileSync)((0, import_node_path49.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -61921,7 +63286,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs52.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs53.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -62199,7 +63564,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const cleanupMerged = async (r) => {
       if (opts.preserveWorktree) return "cleanup skipped (--preserve-worktree)";
       const ran = await execFileP(process.execPath, [process.argv[1], ...canonicalArgvFor(["pr", "merge", r.pr, "--repo", r.repo])], {
-        cwd: (0, import_node_fs52.existsSync)(cwd0) ? cwd0 : primaryRoot0,
+        cwd: (0, import_node_fs53.existsSync)(cwd0) ? cwd0 : primaryRoot0,
         timeout: GH_MUTATION_TIMEOUT_MS * 3
       }).then((x) => ({ stdout: x.stdout, stderr: x.stderr }), (e) => ({ stdout: e.stdout ?? "", stderr: e.stderr ?? "" }));
       const json = ran.stdout.split("\n").reverse().find((l) => l.startsWith("{"));
@@ -62270,7 +63635,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs52.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs53.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -62302,7 +63667,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path48.join)((0, import_node_path48.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path49.join)((0, import_node_path49.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -62421,7 +63786,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs52.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs53.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -62536,7 +63901,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     let residueSweep;
     if (!(foreignCwd && !foreignCheckout)) {
       try {
-        gitCommonDir = (0, import_node_path48.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
+        gitCommonDir = (0, import_node_path49.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
         residueSweep = await sweepWorktreeResidue(gitCommonDir, beforeWorktrees.map((w) => w.path));
       } catch {
       }
@@ -62554,7 +63919,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs52.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs53.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -63820,7 +65185,7 @@ function rcRunCauseFromLog(log) {
 function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
-var suiteStateDir = (root) => (0, import_node_path50.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+var suiteStateDir = (root) => (0, import_node_path51.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
 async function runSuiteMemberRcand(repo, previousRc, rcWasAbsent) {
   const deps = trainApplyDeps();
   deps.suiteCut = suiteCutContext(repo, SUITE_REPO);
@@ -63867,16 +65232,16 @@ async function rcandInCheckout(repo, deps, previousRc, rcWasAbsent) {
   }
 }
 function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
-  const recordPath = (0, import_node_path50.join)(suiteStateDir(root), "cut.json");
-  const base = (0, import_node_path50.join)(suiteStateDir(root), "checkouts");
+  const recordPath = (0, import_node_path51.join)(suiteStateDir(root), "cut.json");
+  const base = (0, import_node_path51.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path50.join)(base, repo.split("/")[1]);
-    if (!(0, import_node_fs53.existsSync)(target)) {
-      (0, import_node_fs53.mkdirSync)(base, { recursive: true });
+    const target = (0, import_node_path51.join)(base, repo.split("/")[1]);
+    if (!(0, import_node_fs54.existsSync)(target)) {
+      (0, import_node_fs54.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs53.existsSync)((0, import_node_path50.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs54.existsSync)((0, import_node_path51.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -63940,7 +65305,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (repo === SUITE_REPO) return inTrain(repo, (deps) => rcandInCheckout(repo, deps, previousRc, rcWasAbsent));
     const target = await checkout(repo);
     return new Promise((resolveResult, reject2) => {
-      const child2 = (0, import_node_child_process19.fork)((0, import_node_path49.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
+      const child2 = (0, import_node_child_process19.fork)((0, import_node_path50.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
         cwd: target,
         stdio: ["ignore", "inherit", "inherit", "ipc"],
         execArgv: []
@@ -64183,9 +65548,9 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
-      (0, import_node_fs53.mkdirSync)(dir, { recursive: true });
-      const file = (0, import_node_path50.join)(dir, `notes-${leadTag}.md`);
-      (0, import_node_fs53.writeFileSync)(file, `${body}
+      (0, import_node_fs54.mkdirSync)(dir, { recursive: true });
+      const file = (0, import_node_path51.join)(dir, `notes-${leadTag}.md`);
+      (0, import_node_fs54.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
       await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
@@ -64226,7 +65591,7 @@ ${suiteMappingBlock(leadTag, mapping)}`);
 
 // src/suite-commands.ts
 init_cli_shared();
-var import_node_fs54 = require("node:fs");
+var import_node_fs55 = require("node:fs");
 function parseMemberSummaryFiles(entries) {
   const memberSummaryFiles = {};
   for (const entry of entries) {
@@ -64320,7 +65685,7 @@ function registerSuiteCommands(program3) {
       try {
         const io = suiteTrainIo(root);
         retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
-        if (retired && !(0, import_node_fs54.existsSync)(io.recordPath)) {
+        if (retired && !(0, import_node_fs55.existsSync)(io.recordPath)) {
           console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
           return;
         }
@@ -64560,9 +65925,9 @@ function registerJevCommands(program3) {
 
 // src/packages-adopt-export.ts
 var import_node_child_process20 = require("node:child_process");
-var import_node_fs55 = require("node:fs");
+var import_node_fs56 = require("node:fs");
 var import_node_os25 = require("node:os");
-var import_node_path51 = require("node:path");
+var import_node_path52 = require("node:path");
 var import_node_util6 = require("node:util");
 init_cli_shared();
 
@@ -65182,38 +66547,38 @@ function expectedFromRun(run, opts) {
 }
 async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
-  const packagePath = (0, import_node_path51.join)(opts.dir, "package.json");
-  const lockPath = (0, import_node_path51.join)(opts.dir, "package-lock.json");
-  const packageText = (0, import_node_fs55.readFileSync)(packagePath, "utf8");
-  const lockText = (0, import_node_fs55.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs55.mkdtempSync)((0, import_node_path51.join)((0, import_node_os25.tmpdir)(), "mmi-adopt-export-"));
+  const packagePath = (0, import_node_path52.join)(opts.dir, "package.json");
+  const lockPath = (0, import_node_path52.join)(opts.dir, "package-lock.json");
+  const packageText = (0, import_node_fs56.readFileSync)(packagePath, "utf8");
+  const lockText = (0, import_node_fs56.readFileSync)(lockPath, "utf8");
+  const work = (0, import_node_fs56.mkdtempSync)((0, import_node_path52.join)((0, import_node_os25.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs55.writeFileSync)((0, import_node_path51.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs55.writeFileSync)((0, import_node_path51.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs55.writeFileSync)((0, import_node_path51.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
-    const script = (0, import_node_path51.join)(work, "package_export.py");
-    (0, import_node_fs55.writeFileSync)(script, package_export_default);
+    (0, import_node_fs56.writeFileSync)((0, import_node_path52.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs56.writeFileSync)((0, import_node_path52.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs56.writeFileSync)((0, import_node_path52.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    const script = (0, import_node_path52.join)(work, "package_export.py");
+    (0, import_node_fs56.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
-    const verified = (0, import_node_path51.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs55.readFileSync)((0, import_node_path51.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const verified = (0, import_node_path52.join)(work, "verified");
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs56.readFileSync)((0, import_node_path52.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
-      await deps.npm(["cache", "add", (0, import_node_path51.join)(verified, `${short3}.tgz`)], opts.dir);
+      await deps.npm(["cache", "add", (0, import_node_path52.join)(verified, `${short3}.tgz`)], opts.dir);
     }
-    (0, import_node_fs55.writeFileSync)(packagePath, plan.packageText);
-    (0, import_node_fs55.writeFileSync)(lockPath, plan.lockText);
+    (0, import_node_fs56.writeFileSync)(packagePath, plan.packageText);
+    (0, import_node_fs56.writeFileSync)(lockPath, plan.lockText);
     try {
       await deps.npm(["ci", "--offline", "--ignore-scripts", "--no-audit", "--no-fund"], opts.dir);
     } catch (error) {
-      (0, import_node_fs55.writeFileSync)(packagePath, packageText);
-      (0, import_node_fs55.writeFileSync)(lockPath, lockText);
+      (0, import_node_fs56.writeFileSync)(packagePath, packageText);
+      (0, import_node_fs56.writeFileSync)(lockPath, lockText);
       throw new Error(`npm ci --offline failed, package.json and package-lock.json restored: ${error.message}`);
     }
     return plan.result;
   } finally {
-    (0, import_node_fs55.rmSync)(work, { recursive: true, force: true });
+    (0, import_node_fs56.rmSync)(work, { recursive: true, force: true });
   }
 }
 var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process20.execFile);
@@ -65317,12 +66682,12 @@ function registerPackagesCommands(program3) {
 init_cli_shared();
 
 // src/wave-status.ts
-var import_node_fs56 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 function observeStage(worktreePath) {
   const statePath = stageStatePath(worktreePath);
   let raw;
   try {
-    raw = (0, import_node_fs56.readFileSync)(statePath, "utf8");
+    raw = (0, import_node_fs57.readFileSync)(statePath, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return { state: "ok", value: { running: false } };
     return { state: "unavailable", reason: "stage state could not be read" };
@@ -65389,9 +66754,9 @@ async function collectWaveStatus(deps) {
 // src/discovery-commands.ts
 init_github_client();
 init_cli_shared();
-var import_node_fs57 = require("node:fs");
+var import_node_fs58 = require("node:fs");
 var import_node_os26 = require("node:os");
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 var defaultStatusDeps = {
   repo: resolveRepo,
@@ -65612,8 +66977,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os26.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path52.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs57.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path52.join)(home, ".claude", "settings.json"), import_node_fs57.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path53.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs58.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path53.join)(home, ".claude", "settings.json"), import_node_fs58.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -68744,8 +70109,8 @@ function registerSessionReport(program3) {
 }
 
 // src/stage-commands.ts
-var import_node_fs58 = require("node:fs");
-var import_node_path53 = require("node:path");
+var import_node_fs59 = require("node:fs");
+var import_node_path54 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -68993,8 +70358,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs58.existsSync)((0, import_node_path53.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs58.existsSync)((0, import_node_path53.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs59.existsSync)((0, import_node_path54.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs59.existsSync)((0, import_node_path54.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -69286,25 +70651,25 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto20 = require("node:crypto");
-var import_node_fs59 = require("node:fs");
+var import_node_crypto23 = require("node:crypto");
+var import_node_fs60 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
-var import_node_path54 = require("node:path");
+var import_node_path55 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto20.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs59.createReadStream)(path2)) hash.update(chunk);
+  const hash = (0, import_node_crypto23.createHash)("sha256");
+  for await (const chunk of (0, import_node_fs60.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path54.resolve)(inputPath);
+  const path2 = (0, import_node_path55.resolve)(inputPath);
   const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES2) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES2} bytes`);
-  const sha2563 = await sha256File(path2);
-  const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256: sha2563 }, deps);
+  const sha2564 = await sha256File(path2);
+  const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256: sha2564 }, deps);
   if (!prepared.ok) {
     const detail = prepared.body?.error ?? prepared.error ?? `HTTP ${prepared.status}`;
     throw new Error(`tenant artifact put: ${detail}`);
@@ -69317,7 +70682,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs59.createReadStream)(path2);
+  const stream = (0, import_node_fs60.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -69332,8 +70697,8 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     throw error;
   }
   if (!uploaded.ok) throw new Error(`tenant artifact put: object upload failed (HTTP ${uploaded.status})`);
-  if (body.size !== info.size || body.sha256 !== sha2563 || typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt))) throw new Error("tenant artifact put: Hub returned inconsistent artifact metadata");
-  return { artifactId: body.artifactId, repo, stage, size: info.size, sha256: sha2563, expiresAt: body.expiresAt };
+  if (body.size !== info.size || body.sha256 !== sha2564 || typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt))) throw new Error("tenant artifact put: Hub returned inconsistent artifact metadata");
+  return { artifactId: body.artifactId, repo, stage, size: info.size, sha256: sha2564, expiresAt: body.expiresAt };
 }
 
 // src/tenant-logs.ts
@@ -69671,7 +71036,7 @@ function renderVerifySecrets(body) {
 }
 
 // src/command-register-developer.ts
-var import_node_fs64 = require("node:fs");
+var import_node_fs65 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -69704,12 +71069,12 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path61 = require("node:path");
+var import_node_path62 = require("node:path");
 
 // src/doc-refs-command-source.ts
 var import_node_child_process21 = require("node:child_process");
-var import_node_fs60 = require("node:fs");
-var import_node_path55 = require("node:path");
+var import_node_fs61 = require("node:fs");
+var import_node_path56 = require("node:path");
 var BUNDLE_MANIFEST_TIMEOUT_MS = 12e4;
 var BUNDLE_MANIFEST_MAX_BUFFER = 64 * 1024 * 1024;
 var flagsOf = (options) => new Set((options ?? []).flatMap((option) => String(option?.flags ?? "").match(/--[\w-]+/g) ?? []));
@@ -69730,7 +71095,7 @@ function inventoryFromManifest(manifest, source) {
 function readBundleManifest(bundle, exec3 = import_node_child_process21.execFileSync) {
   try {
     const text = exec3(process.execPath, [bundle, "commands", "--all", "--json"], {
-      cwd: (0, import_node_path55.dirname)(bundle),
+      cwd: (0, import_node_path56.dirname)(bundle),
       encoding: "utf8",
       windowsHide: true,
       timeout: BUNDLE_MANIFEST_TIMEOUT_MS,
@@ -69746,19 +71111,19 @@ function readBundleManifest(bundle, exec3 = import_node_child_process21.execFile
 function isRunningBundle(bundle, argv1 = process.argv[1], platform2 = process.platform) {
   if (!argv1) return false;
   const norm2 = (path2) => {
-    const absolute = (0, import_node_path55.resolve)(path2);
+    const absolute = (0, import_node_path56.resolve)(path2);
     return platform2 === "win32" ? absolute.toLowerCase() : absolute;
   };
   const running = norm2(argv1);
-  if (!["main.cjs", "index.cjs"].includes((0, import_node_path55.basename)(running))) return false;
-  return (0, import_node_path55.dirname)(running) === (0, import_node_path55.dirname)(norm2(bundle));
+  if (!["main.cjs", "index.cjs"].includes((0, import_node_path56.basename)(running))) return false;
+  return (0, import_node_path56.dirname)(running) === (0, import_node_path56.dirname)(norm2(bundle));
 }
 function resolveCommandInventory(deps) {
-  const exists = deps.exists ?? import_node_fs60.existsSync;
+  const exists = deps.exists ?? import_node_fs61.existsSync;
   const read = deps.read ?? ((bundle) => readBundleManifest(bundle));
   const warnings = [];
   if (deps.from) {
-    const bundle = (0, import_node_path55.isAbsolute)(deps.from) ? deps.from : (0, import_node_path55.resolve)(deps.root, deps.from);
+    const bundle = (0, import_node_path56.isAbsolute)(deps.from) ? deps.from : (0, import_node_path56.resolve)(deps.root, deps.from);
     if (!exists(bundle)) {
       throw new Error(`docs refs --commands-from: ${bundle} does not exist \u2014 name the CLI bundle to read commands from (usually cli/dist/main.cjs)`);
     }
@@ -69768,7 +71133,7 @@ function resolveCommandInventory(deps) {
     }
     return { inventory: inventory2, warnings };
   }
-  const treeBundle = (0, import_node_path55.join)(deps.root, "cli", "dist", "main.cjs");
+  const treeBundle = (0, import_node_path56.join)(deps.root, "cli", "dist", "main.cjs");
   if (!exists(treeBundle) || isRunningBundle(treeBundle, deps.argv1, deps.platform)) {
     return { inventory: deps.inProcess(), warnings };
   }
@@ -69885,28 +71250,28 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process22 = require("node:child_process");
-var import_node_crypto22 = require("node:crypto");
-var import_node_fs62 = require("node:fs");
+var import_node_crypto25 = require("node:crypto");
+var import_node_fs63 = require("node:fs");
 var import_node_os27 = require("node:os");
-var import_node_path57 = require("node:path");
+var import_node_path58 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto21 = require("node:crypto");
-var import_node_fs61 = require("node:fs");
-var import_node_path56 = require("node:path");
+var import_node_crypto24 = require("node:crypto");
+var import_node_fs62 = require("node:fs");
+var import_node_path57 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path56.resolve)(root);
-  const target = (0, import_node_path56.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path56.sep}`)) {
+  const absoluteRoot = (0, import_node_path57.resolve)(root);
+  const target = (0, import_node_path57.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path57.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto21.createHash)("sha256");
+  const hash = (0, import_node_crypto24.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs61.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs61.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs62.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs62.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -69921,8 +71286,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs61.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs61.lstatSync)(absolute) };
+    if (!(0, import_node_fs62.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs62.lstatSync)(absolute) };
   }));
 }
 
@@ -69935,10 +71300,10 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha2562 = (bytes) => `sha256:${(0, import_node_crypto22.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2563 = (bytes) => `sha256:${(0, import_node_crypto25.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
-  const committed = committedBytes ? sha2562(committedBytes) : ABSENT;
-  const rebuiltExpected = rebuiltBytes ? sha2562(rebuiltBytes) : ABSENT;
+  const committed = committedBytes ? sha2563(committedBytes) : ABSENT;
+  const rebuiltExpected = rebuiltBytes ? sha2563(rebuiltBytes) : ABSENT;
   return { path: path2, status: committed === rebuiltExpected ? "current" : "stale", committed, rebuiltExpected };
 }
 function distTreeIdentity(labels, rebuilt, committed, digest) {
@@ -70007,13 +71372,13 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs62.existsSync)(path2) ? (0, import_node_fs62.readFileSync)(path2) : null;
+  return (0, import_node_fs63.existsSync)(path2) ? (0, import_node_fs63.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs62.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path57.join)(directory, entry.name);
+    for (const entry of (0, import_node_fs63.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path58.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -70023,10 +71388,10 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs62.readFileSync)((0, import_node_path57.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path57.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs63.readFileSync)((0, import_node_path58.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path58.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path57.join)(root, "distribution-bom.json");
+    return (0, import_node_path58.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
@@ -70039,40 +71404,40 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs62.mkdtempSync)((0, import_node_path57.join)((0, import_node_os27.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs63.mkdtempSync)((0, import_node_path58.join)((0, import_node_os27.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path57.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path57.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path57.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path57.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path58.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path58.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path58.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path58.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path57.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path58.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path57.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path57.join)(root, path2));
-    const distRoot = (0, import_node_path57.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path57.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs62.readFileSync)(bomPathFor(root), "utf8"));
+    const committed = (path2) => readOrNull((0, import_node_path58.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path58.join)(root, path2));
+    const distRoot = (0, import_node_path58.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path58.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs63.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path57.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path58.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path57.join)(overlay, entry.path);
-        (0, import_node_fs62.mkdirSync)((0, import_node_path57.dirname)(target), { recursive: true });
-        (0, import_node_fs62.writeFileSync)(target, entry.bytes);
+        const target = (0, import_node_path58.join)(overlay, entry.path);
+        (0, import_node_fs63.mkdirSync)((0, import_node_path58.dirname)(target), { recursive: true });
+        (0, import_node_fs63.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs62.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs63.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
 // src/doc-refs-live.ts
-var import_node_path58 = require("node:path");
+var import_node_path59 = require("node:path");
 var concrete = (value) => !!value && !/[<>{}$]/.test(value);
 var liveOption = (tokens2, flag) => {
   const index = tokens2.indexOf(flag);
@@ -70145,7 +71510,7 @@ async function runLiveDocRefs(root, deps, live) {
   const offline = runDocRefs(root, { ...deps, runbooksOnly: true });
   const read = deps.readFile ?? readFileOrNull;
   const docs = Object.fromEntries((deps.listDocs ?? defaultListDocs)(root).flatMap((doc) => {
-    const body = read((0, import_node_path58.join)(root, doc));
+    const body = read((0, import_node_path59.join)(root, doc));
     return body !== null && isRunbook(doc, body) && !deps.isIgnored?.([doc]).has(doc) ? [[doc, body]] : [];
   }));
   const remote = await checkRunbookLive(docs, live);
@@ -70356,7 +71721,7 @@ async function diagnoseHub(deps) {
 
 // src/schedules-lift-command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path59 = require("node:path");
+var import_node_path60 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -70385,7 +71750,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path59.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path60.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -70468,8 +71833,8 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process24 = require("node:child_process");
-var import_node_fs63 = require("node:fs");
-var import_node_path60 = require("node:path");
+var import_node_fs64 = require("node:fs");
+var import_node_path61 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -70504,10 +71869,10 @@ function findViolationsInSource(raw) {
   if (imported.size === 0) return [];
   const rawLines = raw.split("\n");
   const src = stripComments(raw);
-  const call = new RegExp(CALL_SOURCE, "g");
+  const call3 = new RegExp(CALL_SOURCE, "g");
   const found = [];
   let m;
-  while (m = call.exec(src)) {
+  while (m = call3.exec(src)) {
     const callee = m[2];
     if (!imported.has(callee)) continue;
     const open2 = m.index + m[0].length - 1;
@@ -70555,7 +71920,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs63.readFileSync)((0, import_node_path60.join)(root, file), "utf8");
+      raw = (0, import_node_fs64.readFileSync)((0, import_node_path61.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -70575,19 +71940,19 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path61.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs64.existsSync)(path2) ? (0, import_node_fs64.readFileSync)(path2, "utf8") : null;
+    const path2 = (0, import_node_path62.join)(process.cwd(), ".gitignore");
+    const current = (0, import_node_fs65.existsSync)(path2) ? (0, import_node_fs65.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs64.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs65.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs64.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs65.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -70779,8 +72144,8 @@ function registerDeveloperCommands(program3) {
         return { commandPaths: new Set(manifest.index.map((entry) => entry.path)), commandOptions: commandOptions2, source: "in-process" };
       };
       const resolved = resolveCommandInventory({ root, from: o.commandsFrom, inProcess });
-      const { commandPaths, commandOptions } = resolved.inventory;
-      const deps = { commandPaths, commandOptions, base: o.base, runbooksOnly: o.runbooksOnly };
+      const { commandPaths, commandOptions, source } = resolved.inventory;
+      const deps = { commandPaths, commandOptions, commandSource: source, base: o.base, runbooksOnly: o.runbooksOnly };
       const result = o.live ? await runLiveDocRefs(root, deps, createRunbookLiveDeps(process.argv[1])) : runDocRefs(root, deps);
       result.warnings.push(...resolved.warnings);
       if (o.json) {
@@ -70904,7 +72269,7 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path62.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path63.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -71042,7 +72407,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs65.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs66.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -71077,7 +72442,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs65.existsSync)((0, import_node_path62.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs66.existsSync)((0, import_node_path63.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -71086,7 +72451,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs65.existsSync)((0, import_node_path62.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs66.existsSync)((0, import_node_path63.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -71477,7 +72842,22 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
   appActorCommand = commandPath4;
   setAuditCommand(commandPath4);
   if (commandPath4 !== "whoami diagnose-hub") emitCliCallTelemetry(commandPath4);
-  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel" || commandPath4 === "run rerun") return;
+  const LAZY_APP_MINT_COMMANDS = /* @__PURE__ */ new Set([
+    "ci cancel-orphans",
+    "run cancel",
+    "run rerun",
+    // #9779/#9780: the vars verbs and archive-status validate --repo/name/value before the first
+    // dispatch, so their scoped App mint waits for the action handler like the run writes above.
+    "vars get",
+    "vars list",
+    "vars create",
+    "vars update",
+    "vars delete",
+    "repo archive-status",
+    // #9788: the lifecycle read validates its manifest/window/bounds before its scoped mint.
+    "read merge-queue lifecycle"
+  ]);
+  if (LAZY_APP_MINT_COMMANDS.has(commandPath4)) return;
   try {
     await activateAppActor(commandPath4, process.env, () => APP_WRITE_COMMANDS.has(commandPath4) ? mintCommandWriteToken(appActorDeps(), commandPath4) : mintInstallationToken(appActorDeps()));
   } catch (e) {
@@ -71874,7 +73254,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs65.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs66.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -72266,16 +73646,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path62.join)(root, path2);
-      return (0, import_node_fs65.existsSync)(fullPath) ? (0, import_node_fs65.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path63.join)(root, path2);
+      return (0, import_node_fs66.existsSync)(fullPath) ? (0, import_node_fs66.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path62.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path63.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs65.existsSync)((0, import_node_path62.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs65.existsSync)((0, import_node_path62.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs66.existsSync)((0, import_node_path63.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs66.existsSync)((0, import_node_path63.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -72319,6 +73699,20 @@ registerRunRerun(
   async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run rerun")).token,
   async () => fetchProjectsList(registryClientDeps(await loadConfig()))
 );
+var varsAppClient = (commandPath4) => async () => (
+  // The concrete client always provides restWithStatus (optional on the interface only so hand-built
+  // test stubs of GitHubClient keep compiling).
+  createGitHubClient({ token: async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), commandPath4)).token })
+);
+var varsProjects = async () => fetchProjectsList(registryClientDeps(await loadConfig()));
+var varsActor = () => ({ credential: "app_installation", ...activeAppQuotaScope() ? { quotaScope: activeAppQuotaScope() } : {} });
+registerDevopsVarsCommands(program2, { appClient: (commandPath4) => varsAppClient(commandPath4)(), projects: varsProjects, actor: varsActor });
+registerRepoArchiveStatusCommand(program2, { appClient: (commandPath4) => varsAppClient(commandPath4)(), projects: varsProjects, actor: varsActor });
+registerMergeQueueLifecycleCommand(program2.commands.find((c) => c.name() === "read"), {
+  appClient: async (commandPath4) => createGitHubClient({ token: async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), commandPath4)).token }),
+  projects: varsProjects,
+  actor: varsActor
+});
 ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {
     return fail("ci reconcile: --apply and --park-ruleset ask for opposite things; pass one");
@@ -72418,10 +73812,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs65.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs65.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs66.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs66.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs65.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs65.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs66.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs66.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -72458,16 +73852,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs65.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs66.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path62.join)(path2, entry.name);
+    const child2 = (0, import_node_path63.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs65.statSync)(child2).size;
+        total += (0, import_node_fs66.statSync)(child2).size;
       } catch {
       }
     }
@@ -72475,25 +73869,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs65.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs66.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs65.existsSync)(p)) return [];
+  if (!(0, import_node_fs66.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs65.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs66.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs65.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs65.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs66.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs66.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs65.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs66.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path62.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs65.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path63.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs66.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -72507,10 +73901,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path62.join)(stagingRoot, name);
-      if (!(0, import_node_fs65.existsSync)(p)) return null;
+      const p = (0, import_node_path63.join)(stagingRoot, name);
+      if (!(0, import_node_fs66.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs65.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs66.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -72536,7 +73930,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs65.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs66.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -72546,7 +73940,7 @@ program2.command("archive-prune").description("inventory worktree evidence archi
   let primary = o.repoRoot;
   if (!primary) {
     const common = await gitOut(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-    primary = common ? (0, import_node_path62.dirname)(common) : "";
+    primary = common ? (0, import_node_path63.dirname)(common) : "";
   }
   if (!primary) {
     const detail = "archive-prune: not inside a git checkout (pass --repo-root <primary checkout>)";