@mutmutco/codex-plugin 4.6.24 → 4.6.26

package/cli/dist/main.cjs

@@ -157,19 +157,19 @@ function hardExit(code) {
   process.exit(code);
 }
 function flushStream(stream) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     try {
-      stream.write("", () => resolve7());
+      stream.write("", () => resolve8());
     } catch {
-      resolve7();
+      resolve8();
     }
   });
 }
 async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
   await Promise.race([
     Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
-    new Promise((resolve7) => {
-      setTimeout(resolve7, timeoutMs).unref?.();
+    new Promise((resolve8) => {
+      setTimeout(resolve8, timeoutMs).unref?.();
     })
   ]);
 }
@@ -177,7 +177,7 @@ async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
   await flushStdio();
-  await new Promise((resolve7) => setImmediate(resolve7));
+  await new Promise((resolve8) => setImmediate(resolve8));
   return void 0;
 }
 async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
@@ -454,9 +454,9 @@ var init_gh_read_route = __esm({
 function commandPath() {
   if (cachedCommand !== void 0) return cachedCommand;
   const words = [];
-  for (const arg of process.argv.slice(2)) {
-    if (arg.startsWith("-") || words.length === 3) break;
-    words.push(arg);
+  for (const arg2 of process.argv.slice(2)) {
+    if (arg2.startsWith("-") || words.length === 3) break;
+    words.push(arg2);
   }
   return cachedCommand = words.join(" ") || "(none)";
 }
@@ -851,7 +851,7 @@ function rateLimitedReceipt(opts) {
   };
 }
 async function runWithRateLimitBackoff(operation, opts) {
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = opts.now ?? Date.now;
   const log = opts.log ?? ((message2) => console.warn(message2));
   const capMs = opts.capMs ?? RATE_LIMIT_WAIT_CAP_MS;
@@ -941,7 +941,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -1346,8 +1346,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve7) => {
-    timer = setTimeout(resolve7, timeoutMs);
+  const timeout = new Promise((resolve8) => {
+    timer = setTimeout(resolve8, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -1444,12 +1444,12 @@ function killProcessTree(pid) {
 function execFileHard(file, args, options) {
   const { timeout, step, ...rest } = options;
   const started = Date.now();
-  return new Promise((resolve7, reject2) => {
+  return new Promise((resolve8, reject2) => {
     const child2 = (0, import_node_child_process.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
       clearTimeout(timer);
       if (expired) return;
       if (error) reject2(error);
-      else resolve7({ stdout: String(stdout), stderr: String(stderr) });
+      else resolve8({ stdout: String(stdout), stderr: String(stderr) });
     });
     let expired = false;
     const timer = setTimeout(() => {
@@ -1585,12 +1585,12 @@ function installBrokenPipeGuard(stream) {
   });
 }
 function rawFlag(flag) {
-  return process.argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
+  return process.argv.some((arg2) => arg2 === flag || arg2.startsWith(`${flag}=`));
 }
 function rawValue(flag, fallback) {
   const index = process.argv.indexOf(flag);
   if (index >= 0 && process.argv[index + 1]) return process.argv[index + 1];
-  const inline = process.argv.find((arg) => arg.startsWith(`${flag}=`));
+  const inline = process.argv.find((arg2) => arg2.startsWith(`${flag}=`));
   return inline ? inline.slice(flag.length + 1) : fallback;
 }
 function printLine(value) {
@@ -2276,19 +2276,19 @@ var require_toJS = __commonJS({
   "node_modules/yaml/dist/nodes/toJS.js"(exports2) {
     "use strict";
     var identity = require_identity();
-    function toJS(value, arg, ctx) {
+    function toJS(value, arg2, ctx) {
       if (Array.isArray(value))
         return value.map((v, i) => toJS(v, String(i), ctx));
       if (value && typeof value.toJSON === "function") {
         if (!ctx || !identity.hasAnchor(value))
-          return value.toJSON(arg, ctx);
+          return value.toJSON(arg2, ctx);
         const data = { aliasCount: 0, count: 1, res: void 0 };
         ctx.anchors.set(value, data);
         ctx.onCreate = (res2) => {
           data.res = res2;
           delete ctx.onCreate;
         };
-        const res = value.toJSON(arg, ctx);
+        const res = value.toJSON(arg2, ctx);
         if (ctx.onCreate)
           ctx.onCreate(res);
         return res;
@@ -2471,8 +2471,8 @@ var require_Scalar = __commonJS({
         super(identity.SCALAR);
         this.value = value;
       }
-      toJSON(arg, ctx) {
-        return ctx?.keep ? this.value : toJS.toJS(this.value, arg, ctx);
+      toJSON(arg2, ctx) {
+        return ctx?.keep ? this.value : toJS.toJS(this.value, arg2, ctx);
       }
       toString() {
         return String(this.value);
@@ -10271,16 +10271,16 @@ var Argument = class {
    */
   choices(values) {
     this.argChoices = values.slice();
-    this.parseArg = (arg, previous) => {
-      if (!this.argChoices.includes(arg)) {
+    this.parseArg = (arg2, previous) => {
+      if (!this.argChoices.includes(arg2)) {
         throw new InvalidArgumentError(
           `Allowed choices are ${this.argChoices.join(", ")}.`
         );
       }
       if (this.variadic) {
-        return this._collectValue(arg, previous);
+        return this._collectValue(arg2, previous);
       }
-      return arg;
+      return arg2;
     };
     return this;
   }
@@ -10303,9 +10303,9 @@ var Argument = class {
     return this;
   }
 };
-function humanReadableArgName(arg) {
-  const nameOutput = arg.name() + (arg.variadic === true ? "..." : "");
-  return arg.required ? "<" + nameOutput + ">" : "[" + nameOutput + "]";
+function humanReadableArgName(arg2) {
+  const nameOutput = arg2.name() + (arg2.variadic === true ? "..." : "");
+  return arg2.required ? "<" + nameOutput + ">" : "[" + nameOutput + "]";
 }
 
 // node_modules/commander/lib/command.js
@@ -10442,7 +10442,7 @@ var Help = class {
    * @returns {string}
    */
   subcommandTerm(cmd) {
-    const args = cmd.registeredArguments.map((arg) => humanReadableArgName(arg)).join(" ");
+    const args = cmd.registeredArguments.map((arg2) => humanReadableArgName(arg2)).join(" ");
     return cmd._name + (cmd._aliases[0] ? "|" + cmd._aliases[0] : "") + (cmd.options.length ? " [options]" : "") + // simplistic check for non-help option
     (args ? " " + args : "");
   }
@@ -10964,8 +10964,8 @@ var Option = class {
    * @param {*} arg
    * @return {Option}
    */
-  preset(arg) {
-    this.presetArg = arg;
+  preset(arg2) {
+    this.presetArg = arg2;
     return this;
   }
   /**
@@ -11065,16 +11065,16 @@ var Option = class {
    */
   choices(values) {
     this.argChoices = values.slice();
-    this.parseArg = (arg, previous) => {
-      if (!this.argChoices.includes(arg)) {
+    this.parseArg = (arg2, previous) => {
+      if (!this.argChoices.includes(arg2)) {
         throw new InvalidArgumentError(
           `Allowed choices are ${this.argChoices.join(", ")}.`
         );
       }
       if (this.variadic) {
-        return this._collectValue(arg, previous);
+        return this._collectValue(arg2, previous);
       }
-      return arg;
+      return arg2;
     };
     return this;
   }
@@ -11118,8 +11118,8 @@ var Option = class {
    * @return {boolean}
    * @package
    */
-  is(arg) {
-    return this.short === arg || this.long === arg;
+  is(arg2) {
+    return this.short === arg2 || this.long === arg2;
   }
   /**
    * Return whether a boolean option.
@@ -12455,9 +12455,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @private
    */
   _checkNumberOfArguments() {
-    this.registeredArguments.forEach((arg, i) => {
-      if (arg.required && this.args[i] == null) {
-        this.missingArgument(arg.name());
+    this.registeredArguments.forEach((arg2, i) => {
+      if (arg2.required && this.args[i] == null) {
+        this.missingArgument(arg2.name());
       }
     });
     if (this.registeredArguments.length > 0 && this.registeredArguments[this.registeredArguments.length - 1].variadic) {
@@ -12668,8 +12668,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @return {Option}
    * @package
    */
-  _findOption(arg) {
-    return this.options.find((option) => option.is(arg));
+  _findOption(arg2) {
+    return this.options.find((option) => option.is(arg2));
   }
   /**
    * Display an error message if a mandatory option does not have a value.
@@ -12743,11 +12743,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
     const operands = [];
     const unknown = [];
     let dest = operands;
-    function maybeOption(arg) {
-      return arg.length > 1 && arg[0] === "-";
+    function maybeOption(arg2) {
+      return arg2.length > 1 && arg2[0] === "-";
     }
-    const negativeNumberArg = (arg) => {
-      if (!/^-(\d+|\d*\.\d+)(e[+-]?\d+)?$/.test(arg)) return false;
+    const negativeNumberArg = (arg2) => {
+      if (!/^-(\d+|\d*\.\d+)(e[+-]?\d+)?$/.test(arg2)) return false;
       return !this._getCommandAndAncestors().some(
         (cmd) => cmd.options.map((opt) => opt.short).some((short3) => /^-\d$/.test(short3))
       );
@@ -12756,20 +12756,20 @@ Expecting one of '${allowedValues.join("', '")}'`);
     let activeGroup = null;
     let i = 0;
     while (i < args.length || activeGroup) {
-      const arg = activeGroup ?? args[i++];
+      const arg2 = activeGroup ?? args[i++];
       activeGroup = null;
-      if (arg === "--") {
-        if (dest === unknown) dest.push(arg);
+      if (arg2 === "--") {
+        if (dest === unknown) dest.push(arg2);
         dest.push(...args.slice(i));
         break;
       }
-      if (activeVariadicOption && (!maybeOption(arg) || negativeNumberArg(arg))) {
-        this.emit(`option:${activeVariadicOption.name()}`, arg);
+      if (activeVariadicOption && (!maybeOption(arg2) || negativeNumberArg(arg2))) {
+        this.emit(`option:${activeVariadicOption.name()}`, arg2);
         continue;
       }
       activeVariadicOption = null;
-      if (maybeOption(arg)) {
-        const option = this._findOption(arg);
+      if (maybeOption(arg2)) {
+        const option = this._findOption(arg2);
         if (option) {
           if (option.required) {
             const value = args[i++];
@@ -12788,47 +12788,47 @@ Expecting one of '${allowedValues.join("', '")}'`);
           continue;
         }
       }
-      if (arg.length > 2 && arg[0] === "-" && arg[1] !== "-") {
-        const option = this._findOption(`-${arg[1]}`);
+      if (arg2.length > 2 && arg2[0] === "-" && arg2[1] !== "-") {
+        const option = this._findOption(`-${arg2[1]}`);
         if (option) {
           if (option.required || option.optional && this._combineFlagAndOptionalValue) {
-            this.emit(`option:${option.name()}`, arg.slice(2));
+            this.emit(`option:${option.name()}`, arg2.slice(2));
           } else {
             this.emit(`option:${option.name()}`);
-            activeGroup = `-${arg.slice(2)}`;
+            activeGroup = `-${arg2.slice(2)}`;
           }
           continue;
         }
       }
-      if (/^--[^=]+=/.test(arg)) {
-        const index = arg.indexOf("=");
-        const option = this._findOption(arg.slice(0, index));
+      if (/^--[^=]+=/.test(arg2)) {
+        const index = arg2.indexOf("=");
+        const option = this._findOption(arg2.slice(0, index));
         if (option && (option.required || option.optional)) {
-          this.emit(`option:${option.name()}`, arg.slice(index + 1));
+          this.emit(`option:${option.name()}`, arg2.slice(index + 1));
           continue;
         }
       }
-      if (dest === operands && maybeOption(arg) && !(this.commands.length === 0 && negativeNumberArg(arg))) {
+      if (dest === operands && maybeOption(arg2) && !(this.commands.length === 0 && negativeNumberArg(arg2))) {
         dest = unknown;
       }
       if ((this._enablePositionalOptions || this._passThroughOptions) && operands.length === 0 && unknown.length === 0) {
-        if (this._findCommand(arg)) {
-          operands.push(arg);
+        if (this._findCommand(arg2)) {
+          operands.push(arg2);
           unknown.push(...args.slice(i));
           break;
-        } else if (this._getHelpCommand() && arg === this._getHelpCommand().name()) {
-          operands.push(arg, ...args.slice(i));
+        } else if (this._getHelpCommand() && arg2 === this._getHelpCommand().name()) {
+          operands.push(arg2, ...args.slice(i));
           break;
         } else if (this._defaultCommandName) {
-          unknown.push(arg, ...args.slice(i));
+          unknown.push(arg2, ...args.slice(i));
           break;
         }
       }
       if (this._passThroughOptions) {
-        dest.push(arg, ...args.slice(i));
+        dest.push(arg2, ...args.slice(i));
         break;
       }
-      dest.push(arg);
+      dest.push(arg2);
     }
     return { operands, unknown };
   }
@@ -13156,8 +13156,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
   usage(str2) {
     if (str2 === void 0) {
       if (this._usage) return this._usage;
-      const args = this.registeredArguments.map((arg) => {
-        return humanReadableArgName(arg);
+      const args = this.registeredArguments.map((arg2) => {
+        return humanReadableArgName(arg2);
       });
       return [].concat(
         this.options.length || this._helpOption !== null ? "[options]" : [],
@@ -13479,7 +13479,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
    */
   _outputHelpIfRequested(args) {
     const helpOption = this._getHelpOption();
-    const helpRequested = helpOption && args.find((arg) => helpOption.is(arg));
+    const helpRequested = helpOption && args.find((arg2) => helpOption.is(arg2));
     if (helpRequested) {
       this.outputHelp();
       this._exit(0, "commander.helpDisplayed", "(outputHelp)");
@@ -13487,24 +13487,24 @@ Expecting one of '${allowedValues.join("', '")}'`);
   }
 };
 function incrementNodeInspectorPort(args) {
-  return args.map((arg) => {
-    if (!arg.startsWith("--inspect")) {
-      return arg;
+  return args.map((arg2) => {
+    if (!arg2.startsWith("--inspect")) {
+      return arg2;
     }
     let debugOption;
     let debugHost = "127.0.0.1";
     let debugPort = "9229";
     let match;
-    if ((match = arg.match(/^(--inspect(-brk)?)$/)) !== null) {
+    if ((match = arg2.match(/^(--inspect(-brk)?)$/)) !== null) {
       debugOption = match[1];
-    } else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+)$/)) !== null) {
+    } else if ((match = arg2.match(/^(--inspect(-brk|-port)?)=([^:]+)$/)) !== null) {
       debugOption = match[1];
       if (/^\d+$/.test(match[3])) {
         debugPort = match[3];
       } else {
         debugHost = match[3];
       }
-    } else if ((match = arg.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/)) !== null) {
+    } else if ((match = arg2.match(/^(--inspect(-brk|-port)?)=([^:]+):(\d+)$/)) !== null) {
       debugOption = match[1];
       debugHost = match[3];
       debugPort = match[4];
@@ -13512,7 +13512,7 @@ function incrementNodeInspectorPort(args) {
     if (debugOption && debugPort !== "0") {
       return `${debugOption}=${debugHost}:${parseInt(debugPort) + 1}`;
     }
-    return arg;
+    return arg2;
   });
 }
 function useColor() {
@@ -13527,7 +13527,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs66 = require("node:fs");
+var import_node_fs67 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 
@@ -15195,7 +15195,7 @@ function resolveVerbAliasShim(argv) {
 
 // src/command-composition.ts
 var import_node_os28 = require("node:os");
-var import_node_path63 = require("node:path");
+var import_node_path64 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs18 = require("node:fs");
@@ -15495,7 +15495,7 @@ function setStatusWriteTokenProvider(provider) {
   statusWriteTokenProvider = provider;
 }
 async function fleetStatusWriteEnv(args) {
-  if (args[0] !== "api" || args[1] !== "-X" || args[2] !== "POST" || !/^repos\/[^/]+\/[^/]+\/statuses\/[^/]+$/.test(args[3] ?? "") || !args.some((arg, i) => arg === "context=fleet-lockstep" && args[i - 1] === "-f")) return void 0;
+  if (args[0] !== "api" || args[1] !== "-X" || args[2] !== "POST" || !/^repos\/[^/]+\/[^/]+\/statuses\/[^/]+$/.test(args[3] ?? "") || !args.some((arg2, i) => arg2 === "context=fleet-lockstep" && args[i - 1] === "-f")) return void 0;
   if (!statusWriteTokenProvider) throw new AppActorError("app actor: status-write provider not installed");
   try {
     const { token } = await statusWriteTokenProvider();
@@ -16482,7 +16482,7 @@ async function readRestPrSnapshotWithRetry(prNumber, repo, gh2 = defaultGhApi, o
   const retries = options?.retries ?? PR_SNAPSHOT_READ_RETRIES;
   const untilMs = options?.retryTransientUntilMs;
   const delayMs = options?.delayMs ?? (untilMs !== void 0 ? PR_CHECKS_POLL_MS : PR_SNAPSHOT_READ_DELAY_MS);
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = options?.now ?? (() => Date.now());
   let lastError = "no attempt completed";
   let attempt = 0;
@@ -16512,7 +16512,7 @@ var PR_LAND_PINNED_HEAD_READ_BUDGET_MS = 6e4;
 var PR_LAND_PINNED_HEAD_READ_404_ATTEMPTS = 3;
 async function readPrLandPinnedHeadSha(prNumber, repo, gh2 = defaultGhApi, options) {
   const delayMs = options?.delayMs ?? PR_SNAPSHOT_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   let notFound = 0;
   for (; ; ) {
     const read = await readRestPrSnapshotWithRetry(prNumber, repo, gh2, {
@@ -18327,9 +18327,9 @@ function extractWorkflowCrons(yamlText) {
 function workflowEntry(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   if (!crons.length) return null;
-  const basename5 = workflowPath.split("/").pop() ?? workflowPath;
+  const basename6 = workflowPath.split("/").pop() ?? workflowPath;
   return {
-    name: `${repo}/${basename5.replace(/\.ya?ml$/, "")}`,
+    name: `${repo}/${basename6.replace(/\.ya?ml$/, "")}`,
     cadence: crons.join(" + "),
     executor: "github-actions",
     llm: llmFromHeader(yamlText),
@@ -18663,8 +18663,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   const header = parseScheduleHeader(yamlText);
   if (!crons.length && !header.schedule) return null;
-  const basename5 = workflowPath.split("/").pop() ?? workflowPath;
-  const expectedId = `${repo}/${basename5.replace(/\.ya?ml$/, "")}`;
+  const basename6 = workflowPath.split("/").pop() ?? workflowPath;
+  const expectedId = `${repo}/${basename6.replace(/\.ya?ml$/, "")}`;
   if (isHarbourUnmanaged(yamlText)) return null;
   const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
   if (missing.length) {
@@ -20851,7 +20851,7 @@ async function createPrViaRestFallback(args, swappedArgs, deps, knownPools) {
 }
 async function ghCreate(args, deps = {}) {
   const exec3 = deps.exec ?? execFileP;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = deps.now ?? Date.now;
   const read = deps.readFile ?? import_promises.readFile;
   const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec3, input));
@@ -21660,8 +21660,8 @@ function resolveUseEnvNames(keys, name) {
   }
   return { ok: true, entries };
 }
-function referencesDollarEnv(arg, name) {
-  return arg.includes(`\${${name}}`) || new RegExp(`\\$${name}(?![A-Za-z0-9_])`).test(arg);
+function referencesDollarEnv(arg2, name) {
+  return arg2.includes(`\${${name}}`) || new RegExp(`\\$${name}(?![A-Za-z0-9_])`).test(arg2);
 }
 function isShellScriptCommand(command) {
   const exe = (command[0] ?? "").split(/[/\\]/).pop()?.toLowerCase().replace(/\.exe$/, "") ?? "";
@@ -21669,9 +21669,9 @@ function isShellScriptCommand(command) {
 }
 function secretsUseDollarHint(command, envNames) {
   if (isShellScriptCommand(command)) return null;
-  for (const arg of command) {
+  for (const arg2 of command) {
     for (const name of envNames) {
-      if (!referencesDollarEnv(arg, name)) continue;
+      if (!referencesDollarEnv(arg2, name)) continue;
       return `secrets use: ${command[0]} receives the literal text $${name} \u2014 the value is injected into the CHILD's env, and ${command[0]} does not expand variables in its arguments. Wrap the consumer in a shell so expansion happens inside: bash -c 'your-command "$${name}"'`;
     }
   }
@@ -21681,8 +21681,8 @@ var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
     closeHttpPool().then(() => true),
-    new Promise((resolve7) => {
-      setTimeout(() => resolve7(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
+    new Promise((resolve8) => {
+      setTimeout(() => resolve8(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
     })
   ]);
   if (!drained) destroyHttpPool();
@@ -24653,7 +24653,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -25243,6 +25243,9 @@ var CMD_RE = /`mmi-cli ((?:[a-z][a-z-]*)(?: [a-z][a-z-]*){0,3})/g;
 var RETIRED_RE = /\b(retired|historical|removed|deleted|gone|no longer|superseded|legacy)\b/i;
 var ROOT_DOCS = ["README.md", "architecture.md"];
 var SKIP_WALK = ["docs/decisions/"];
+function formatDocRefFinding(finding) {
+  return `${finding.doc}:${finding.line} [${finding.kind}] ${finding.detail}${finding.suggest?.length ? ` (did you mean ${finding.suggest[0]}?)` : ""}`;
+}
 function refFirstSegment(ref) {
   return ref.replace(/^(\.\/)+/, "").split("/")[0];
 }
@@ -25663,21 +25666,14 @@ function defaultIsIgnored(root, relPaths, exec3 = import_node_child_process6.exe
     throw error;
   }
 }
-function defaultTrackedFirstSegments(root, firstSegments, exec3 = import_node_child_process6.execFileSync) {
-  if (firstSegments.length === 0) return /* @__PURE__ */ new Set();
+function defaultTrackedFiles(root, firstSegments, exec3 = import_node_child_process6.execFileSync) {
   try {
     const out = exec3("git", ["ls-files", "-z", "--", ...firstSegments.map((s) => `:(literal)${s}`)], {
       cwd: root,
       encoding: "utf8",
       maxBuffer: CHECK_IGNORE_MAX_BUFFER
     });
-    const tracked = /* @__PURE__ */ new Set();
-    for (const path2 of out.split("\0")) {
-      if (path2) for (const segment of firstSegments) {
-        if (path2 === segment || path2.startsWith(`${segment}/`)) tracked.add(segment);
-      }
-    }
-    return tracked;
+    return out.split("\0").filter(Boolean);
   } catch (error) {
     if (error?.status === 128) return null;
     if (error?.code === "ENOENT") return null;
@@ -25721,7 +25717,12 @@ function runDocRefs(root, deps = {}) {
   const exists = deps.exists ?? import_node_fs19.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
-  const trackedFirstSegments = deps.trackedFirstSegments ?? ((segs) => defaultTrackedFirstSegments(root, segs));
+  let inventory;
+  const trackedFiles = () => inventory === void 0 ? inventory = deps.trackedFiles ? deps.trackedFiles() : deps.trackedFirstSegments ? null : defaultTrackedFiles(root, []) : inventory;
+  const trackedFirstSegments = deps.trackedFirstSegments ?? ((segs) => {
+    const files = trackedFiles();
+    return files == null ? null : new Set(segs.filter((seg) => files.some((path2) => path2 === seg || path2.startsWith(`${seg}/`))));
+  });
   const commandPaths = deps.commandPaths ?? null;
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
@@ -25761,6 +25762,18 @@ ${sourceMessages}`;
     (override ? warnings : findings).push(...stale);
     if (!/^Seed-Runbook-Affected:[ \t]*\S.*$/m.test(allMessages)) findings.push(...seedStale);
   }
+  for (const finding of findings) {
+    if (finding.kind !== "missing-path") continue;
+    const directory = import_node_path16.posix.dirname(import_node_path16.posix.normalize(finding.detail)).split("/");
+    const distance = (path2) => {
+      const parts = import_node_path16.posix.dirname(path2).split("/");
+      let common = 0;
+      while (common < directory.length && common < parts.length && directory[common] === parts[common]) common += 1;
+      return directory.length + parts.length - 2 * common;
+    };
+    const suggest = [...new Set(trackedFiles() ?? [])].filter((path2) => import_node_path16.posix.basename(path2) === import_node_path16.posix.basename(finding.detail) && exists((0, import_node_path16.join)(root, path2))).sort((a, b) => distance(a) - distance(b) || a.localeCompare(b)).slice(0, 3);
+    if (suggest.length) finding.suggest = suggest;
+  }
   return {
     ok: findings.length === 0,
     findings,
@@ -28166,10 +28179,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.24",
-    tag: "v4.6.24",
-    commit: "3632dffdf8a5",
-    npm: "@mutmutco/cli@4.6.24"
+    version: "4.6.26",
+    tag: "v4.6.26",
+    commit: "bab0b3157d41",
+    npm: "@mutmutco/cli@4.6.26"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28186,14 +28199,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.24"
+          v3Target: "v4.6.26"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.24 and redeploy the Hub Lambda from tag v4.6.24 (3632dffdf8a5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.24 (@mutmutco/cli@4.6.24, tag commit 3632dffdf8a5 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.26 and redeploy the Hub Lambda from tag v4.6.26 (bab0b3157d41); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.26 (@mutmutco/cli@4.6.26, tag commit bab0b3157d41 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -30288,7 +30301,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve7, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve8, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -30302,7 +30315,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve7, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve7}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve8}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -30500,7 +30513,7 @@ var CORRELATE_SKEW_SLACK_MS = 1e4;
 var CORRELATE_PAGE_LIMIT = 50;
 var RUN_CONFIRM_ATTEMPTS = 3;
 var RUN_CONFIRM_DELAY_MS = 1e3;
-var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var defaultSleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep;
 }
@@ -32391,7 +32404,7 @@ async function discoverShaWorkflowRuns(deps, repo, headSha, seenRunIds) {
   }
   return extra;
 }
-async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince, autoRunHeadSha, dispatchFailure = "throw", publishDir) {
+async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince, autoRunHeadSha, dispatchFailure = "throw", publishDir, rollback = false) {
   if (validSuiteCutContext(ctx.repo, deps.suiteCut) && stage !== "dev") {
     return { note: "suite bundle-only: live backend not deployed", deployStatus: "success" };
   }
@@ -32399,7 +32412,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
     deps.warn?.("Release: Starting deployment");
     const since = (deps.now ?? Date.now)();
     try {
-      await dispatchTenantDeployWithRetry(deps, { repo: ctx.repo, slug: ctx.slug, ref, stage });
+      await dispatchTenantDeployWithRetry(deps, { repo: ctx.repo, slug: ctx.slug, ref, stage, ...rollback ? { rollback: true } : {} });
     } catch (e) {
       if (dispatchFailure === "throw") throw e;
       const msg = e instanceof Error ? e.message : String(e);
@@ -32484,19 +32497,19 @@ async function buildEnvironments(deps, ctx, model, deployStatus, retirement) {
   const mainDomains = domains?.main;
   const rcDomains = domains?.rc;
   const healthStatus = deployStatus === "success" ? "success" : deployStatus === "failure" ? "failure" : "pending";
-  const main = { healthStatus };
+  const main2 = { healthStatus };
   if (mainDomains?.length) {
-    main.domains = mainDomains;
-    main.healthUrl = `https://${mainDomains[0]}/`;
+    main2.domains = mainDomains;
+    main2.healthUrl = `https://${mainDomains[0]}/`;
   }
   const rc = { retirement: retirement.status };
   if (retirement.category) rc.retirementCategory = retirement.category;
   if (rcDomains?.length) rc.domains = rcDomains;
   if (domainsRead === "failed") {
-    main.domainsRead = "failed";
+    main2.domainsRead = "failed";
     rc.domainsRead = "failed";
   }
-  return { main, rc };
+  return { main: main2, rc };
 }
 var RETIRE_MAX_ATTEMPTS = 3;
 var RETIRE_BACKOFF_MS = 1500;
@@ -32577,14 +32590,27 @@ async function runTenantRedeploy(deps, options) {
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), repo);
   const deployModel = requireDeployModel(meta, repo);
   const singleTrackMain = stage === "main" && meta.releaseTrack === "single";
-  if (singleTrackMain && options.ref === "main") {
-    throw new Error(`${repo} is single-track: its \`main\` branch is stale, so --ref main would roll main back. Pin --ref <last good deployed SHA or development head>, or omit --ref to deploy development.`);
+  if (options.rollback && !options.ref) throw new Error("--rollback requires --ref");
+  const deployed = await deps.readDeployedSha?.(ctx.slug, stage).catch(() => void 0);
+  let ref = options.ref ?? deployed ?? (stage === "dev" || singleTrackMain ? "development" : stage);
+  if (!deployed) {
+    deps.warn?.(`Serving DEPLOY#${stage} stamp unreadable or absent; falling back to ${ref}.`);
+  } else if (options.ref) {
+    if (!deps.compareDeployRef) throw new Error("Deploy ancestry comparison unavailable");
+    const relation = await deps.compareDeployRef(repo, deployed, options.ref);
+    if (!["ahead", "identical", "behind", "diverged"].includes(relation)) throw new Error("Invalid deploy ancestry comparison");
+    if (relation === "behind") {
+      if (options.rollback) deps.warn?.(`rolling back ${stage} from ${deployed} to ${options.ref}`);
+      else {
+        deps.warn?.(`${options.ref} is older than the serving release ${deployed}; redeploying the serving SHA instead (use --rollback for a deliberate rollback).`);
+        ref = deployed;
+      }
+    }
   }
-  const ref = options.ref ?? (stage === "dev" || singleTrackMain ? "development" : stage);
   if (!isCentralDispatchModel(deployModel)) {
     throw new Error(`${repo} is ${deployModel}, not a centrally-dispatched model (tenant-container/solo-container/static-cdn) \u2014 there is no central tenant-deploy run to retry (its deploy fires from its own workflow)`);
   }
-  const d = await dispatchDeploy(deps, ctx, stage, ref, deployModel, watch);
+  const d = await dispatchDeploy(deps, ctx, stage, ref, deployModel, watch, void 0, void 0, "throw", void 0, options.rollback);
   return { ...ctx, command: "tenant-redeploy", stage, ref, deployModel, dispatch: d.note, runId: d.runId, runUrl: d.runUrl, workflowRuns: d.workflowRuns, deployStatus: d.deployStatus };
 }
 async function runTenantReconcile(deps, options) {
@@ -33804,7 +33830,7 @@ function lockTokenPid(token) {
   const m = /^(\d+)-/.exec(token);
   return m ? Number(m[1]) : void 0;
 }
-var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
   lockPath;
@@ -34694,7 +34720,7 @@ async function defaultWatchRun(deps, runId, repo) {
     watchSaidSuccess = false;
   }
   for (let attempt = 0; attempt < RUN_CONFIRM_ATTEMPTS2; attempt++) {
-    if (attempt > 0) await new Promise((resolve7) => setTimeout(resolve7, RUN_CONFIRM_DELAY_MS2));
+    if (attempt > 0) await new Promise((resolve8) => setTimeout(resolve8, RUN_CONFIRM_DELAY_MS2));
     try {
       const parsed = JSON.parse(await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--json", "status,conclusion"]));
       if (parsed.status === "completed") return parsed.conclusion === "success" ? "success" : "failure";
@@ -35758,11 +35784,11 @@ var defaultDeps = {
   // #5813: the caller supplies that command line. `process.argv` is NOT it — the house shim splices
   // the house root out in place, so re-reading it here re-ran the removed flat alias (`release …`
   // instead of `devops release …`) and the converged child refused with exit 2.
-  reexec: (argv) => new Promise((resolve7) => {
+  reexec: (argv) => new Promise((resolve8) => {
     const args = [...argv];
     const child2 = isWin2 ? (0, import_node_child_process8.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", windowsHide: true }) : (0, import_node_child_process8.spawn)("mmi-cli", args, { stdio: "inherit", windowsHide: true });
-    child2.on("exit", (code) => resolve7(code ?? 1));
-    child2.on("error", () => resolve7(1));
+    child2.on("exit", (code) => resolve8(code ?? 1));
+    child2.on("error", () => resolve8(1));
   }),
   // stderr only — stdout may be carrying --json output.
   warn: (line) => console.error(line)
@@ -35919,7 +35945,7 @@ var defaultDeps2 = {
     }
   },
   registryWhoami: probeRegistryWhoami,
-  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+  sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
   env: process.env
 };
 function message(e) {
@@ -41535,9 +41561,9 @@ function readCommonMistakes(cmd) {
   const notes = cmd[COMMON_MISTAKES];
   return Array.isArray(notes) && notes.length ? notes : void 0;
 }
-function buildArgument(arg) {
-  const out = { name: arg.name(), required: arg.required, variadic: arg.variadic };
-  if (arg.description) out.description = arg.description;
+function buildArgument(arg2) {
+  const out = { name: arg2.name(), required: arg2.required, variadic: arg2.variadic };
+  if (arg2.description) out.description = arg2.description;
   return out;
 }
 function buildOption(opt) {
@@ -41767,9 +41793,9 @@ function buildDoorsCatalog(tree) {
     };
   });
 }
-function argSignature(arg) {
-  const inner = arg.variadic ? `${arg.name}...` : arg.name;
-  return arg.required ? `<${inner}>` : `[${inner}]`;
+function argSignature(arg2) {
+  const inner = arg2.variadic ? `${arg2.name}...` : arg2.name;
+  return arg2.required ? `<${inner}>` : `[${inner}]`;
 }
 function formatManifestHuman(manifest, options = {}) {
   const root = options.all ? manifest.tree : manifest.primary_tree;
@@ -42190,7 +42216,7 @@ async function updatePrHeadFromBase(input) {
   } catch (e) {
     throw new Error(`GitHub could not update ${input.head} from ${input.base} (${e.message.trim()}) \u2014 ${remedy}`);
   }
-  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   for (let attempt = 0; attempt < PR_HEAD_UPDATE_API_READ_RETRIES; attempt++) {
     const to = await readHead2();
     if (to && to !== from) return { from, to, base: input.base, via: "update-branch-api" };
@@ -42213,7 +42239,7 @@ var PR_LAND_MERGE_RETRY_DELAY_MS = 3e4;
 async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   const now = deps.now ?? (() => Date.now());
   const deadline = now() + PR_LAND_ENQUEUE_TIMEOUT_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const first = await deps.mergeAuto(prNumber, repo);
   let result = first;
   let transientRetried = false;
@@ -42252,7 +42278,7 @@ var AUTO_MERGE_CONFIRM_DELAY_MS = 15e3;
 async function confirmAutoMergeEnqueued(deps, options) {
   const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
   const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   for (let attempt = 0; attempt < retries; attempt++) {
     if (await deps.readMerged().catch(() => false)) return "merged";
     const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
@@ -42269,7 +42295,7 @@ async function confirmAutoMergeEnqueued(deps, options) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -42421,7 +42447,7 @@ async function runPrLandOnce(prNumber, options, deps) {
       if (read.isInMergeQueue || read.state === "MERGED") confirmed = read;
     }
     if (!confirmed) {
-      await (deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(deps.pollDelayMs?.(0) ?? PR_LAND_POLL_MS);
+      await (deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))))(deps.pollDelayMs?.(0) ?? PR_LAND_POLL_MS);
     }
     return pollPrMergeQueue(prNumber, options, deps, base, confirmed, deadline);
   }
@@ -42460,7 +42486,7 @@ function queueMerged(base, deps) {
 }
 async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
   const now = deps.now ?? (() => Date.now());
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const timeoutMs = options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS;
   const deadline = deadlineMs ?? now() + timeoutMs;
   let attempt = 0;
@@ -43401,9 +43427,9 @@ function changedFilesSince(base, cwd, head) {
   const raw = git2(["diff", "--name-status", "-M", base, ...head ? [head] : [], "--"], cwd).trim();
   const changed = raw ? raw.split("\n").map((line) => {
     const parts = line.split("	");
-    const norm2 = (p) => p.replace(/\\/g, "/");
-    const row = { status: parts[0][0], path: norm2(parts[parts.length - 1]) };
-    if (parts.length > 2) row.from = norm2(parts[1]);
+    const norm3 = (p) => p.replace(/\\/g, "/");
+    const row = { status: parts[0][0], path: norm3(parts[parts.length - 1]) };
+    if (parts.length > 2) row.from = norm3(parts[1]);
     return row;
   }) : [];
   if (head) return changed;
@@ -43681,7 +43707,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
   const rejected = (reason) => admissionRejected(reason, repo, pr);
   const reconcile = async (reason, recordEntry = false, resumingSaved = false) => {
     const maxReads = options.enqueueOnly ? 3 : 1;
-    const sleep3 = options.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+    const sleep3 = options.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
     for (let readAttempt = 0; readAttempt < maxReads; readAttempt++) {
       if (readAttempt) await sleep3(readAttempt * 1e3);
       try {
@@ -43836,7 +43862,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     }
     receipt = { ...receipt, state: "pending", uuid: details.uuid };
   }
-  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   for (let attempt = 0; attempt < 3; attempt++) {
     if (attempt) await sleep2(attempt * 1e3);
     try {
@@ -44306,7 +44332,7 @@ function observeQueuedAdmission(repo, pr, snapshot, receiptDirectory) {
 var SETTLE_POLLS = 6;
 var SETTLE_MS = 5e3;
 async function settled(repo, id, deps) {
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   let status = "unknown";
   for (let poll = 0; poll < SETTLE_POLLS; poll++) {
     await sleep2(SETTLE_MS);
@@ -46051,8 +46077,14 @@ function registerBoardCommands(program3) {
         process.exitCode = e.exitCode;
         return;
       }
-      if (o.json && e && typeof e === "object" && "quota" in e && e.quota) console.log(JSON.stringify(e.quota));
-      return failGraceful(`board read failed: ${withDiscoverMissDetail(e.message)}`);
+      const message2 = `board read failed: ${withDiscoverMissDetail(e.message)}`;
+      if (o.json) {
+        if (e && typeof e === "object" && "quota" in e && e.quota) console.log(JSON.stringify(e.quota));
+        else console.log(formatErrorEnvelope(message2, {
+          code: /\b(401|403)\b|auth|credential|token/i.test(message2) ? ERROR_CODES.ERR_NO_AUTH : /no MMI project detected|\b404\b|not found/i.test(message2) ? ERROR_CODES.ERR_NOT_FOUND : ERROR_CODES.ERR_PARTIAL
+        }));
+      }
+      return failGraceful(message2);
     }
   }
   function formatClaimHolder(holder) {
@@ -46346,9 +46378,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_os21 = require("node:os");
-var import_node_path36 = require("node:path");
+var import_node_path37 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -46661,10 +46693,10 @@ async function assignPersistedPortRange(repo, slug, reg, opts) {
 }
 
 // src/box-commands.ts
-var import_node_fs38 = require("node:fs");
+var import_node_fs39 = require("node:fs");
 var import_node_child_process12 = require("node:child_process");
 var import_node_os20 = require("node:os");
-var import_node_path35 = require("node:path");
+var import_node_path36 = require("node:path");
 
 // src/box-control.ts
 var import_node_crypto16 = require("node:crypto");
@@ -47411,16 +47443,16 @@ function parseTenantTasksVar(raw) {
     const task = rawTask;
     if (Object.keys(task).some((key) => !["service", "command", "stages", "timeoutSeconds", "artifact", "output", "secretOutput"].includes(key))) throw new Error(`org project set: tenantTasks.${name} has an unknown field`);
     if (typeof task.service !== "string" || !serviceRe.test(task.service)) throw new Error(`org project set: tenantTasks.${name}.service has an unsafe shape`);
-    if (!Array.isArray(task.command) || task.command.length < 1 || task.command.length > 32 || task.command.some((arg) => typeof arg !== "string" || arg.length < 1 || arg.length > 256 || /[\u0000\r\n]/.test(arg))) throw new Error(`org project set: tenantTasks.${name}.command must be 1-32 bounded argv strings`);
+    if (!Array.isArray(task.command) || task.command.length < 1 || task.command.length > 32 || task.command.some((arg2) => typeof arg2 !== "string" || arg2.length < 1 || arg2.length > 256 || /[\u0000\r\n]/.test(arg2))) throw new Error(`org project set: tenantTasks.${name}.command must be 1-32 bounded argv strings`);
     if (!Array.isArray(task.stages) || task.stages.length < 1 || task.stages.length > 3 || task.stages.some((stage) => typeof stage !== "string" || !validStages.has(stage)) || new Set(task.stages).size !== task.stages.length) throw new Error(`org project set: tenantTasks.${name}.stages must be unique dev/rc/main values`);
     const maxTimeout = task.secretOutput !== void 0 ? 3600 : 10800;
     if (task.timeoutSeconds !== void 0 && (!Number.isInteger(task.timeoutSeconds) || task.timeoutSeconds < 1 || task.timeoutSeconds > maxTimeout)) throw new Error(`org project set: tenantTasks.${name}.timeoutSeconds must be an integer 1..${maxTimeout}`);
     const artifact = task.artifact ?? "none";
     if (artifact !== "none" && artifact !== "required") throw new Error(`org project set: tenantTasks.${name}.artifact must be none or required`);
-    const carriesPlaceholder = task.command.some((arg) => arg.includes("{artifact}"));
+    const carriesPlaceholder = task.command.some((arg2) => arg2.includes("{artifact}"));
     if (artifact === "required" !== carriesPlaceholder) throw new Error(`org project set: tenantTasks.${name} must use {artifact} exactly when artifact is required`);
     if (task.output !== void 0 && task.output !== "file") throw new Error(`org project set: tenantTasks.${name}.output must be file, use {output}, and cannot combine with secretOutput`);
-    const outputPlaceholder = task.command.some((arg) => arg.includes("{output}"));
+    const outputPlaceholder = task.command.some((arg2) => arg2.includes("{output}"));
     if (task.output === "file" !== outputPlaceholder || task.output !== void 0 && task.secretOutput !== void 0) throw new Error(`org project set: tenantTasks.${name}.output must be file, use {output}, and cannot combine with secretOutput`);
     out[name] = {
       service: task.service,
@@ -48554,6 +48586,276 @@ ${formatSshRecipe(box, remoteCommand)}
 `;
 }
 
+// ../infra/hetzner/cloud-firewall.mjs
+var import_node_fs38 = require("node:fs");
+var import_node_url = require("node:url");
+var import_node_path35 = require("node:path");
+var import_meta = {};
+var HZ = "https://api.hetzner.cloud/v1";
+var APPLY = process.env.FIREWALL_APPLY === "1";
+var ANY = ["0.0.0.0/0", "::/0"];
+function arg(name) {
+  const i = process.argv.indexOf(`--${name}`);
+  return i >= 0 && i + 1 < process.argv.length ? process.argv[i + 1] : void 0;
+}
+async function hetzner(token, path2, init = {}) {
+  if (!token) throw new Error("no Hetzner Cloud API token (inject it with mmi-cli vault secrets use ... --name HZ_TOKEN)");
+  const res = await fetch(`${HZ}${path2}`, {
+    ...init,
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    signal: AbortSignal.timeout(3e4)
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(`Hetzner ${init.method ?? "GET"} ${path2.split("?")[0]} failed: ${res.status} ${body?.error?.code ?? ""} ${body?.error?.message ?? ""}`);
+  return body;
+}
+async function hz(path2, init = {}) {
+  return hetzner(process.env.HZ_TOKEN, path2, init);
+}
+function buildRules(cloudflare, extras = []) {
+  const cf = [...cloudflare.ipv4, ...cloudflare.ipv6];
+  if (!cloudflare.ipv4.length || !cloudflare.ipv6.length) throw new Error("refusing an empty Cloudflare range list (it would block every site)");
+  const rules = [
+    { direction: "in", protocol: "tcp", port: "22", source_ips: ANY, description: "SSH (deploy, reconcile, runner)" },
+    { direction: "in", protocol: "icmp", source_ips: ANY, description: "ICMP" },
+    { direction: "in", protocol: "tcp", port: "80", source_ips: cf, description: "HTTP from Cloudflare only" },
+    { direction: "in", protocol: "tcp", port: "443", source_ips: cf, description: "HTTPS from Cloudflare only" }
+  ];
+  for (const e of extras) {
+    if (!["tcp", "udp"].includes(e.protocol) || !/^\d{1,5}(-\d{1,5})?$/.test(String(e.port)) || !e.description) {
+      throw new Error(`invalid firewall extra ${JSON.stringify(e)}: needs protocol tcp|udp, port N or N-M, description`);
+    }
+    rules.push({ direction: "in", protocol: e.protocol, port: String(e.port), source_ips: ANY, description: e.description.slice(0, 255) });
+  }
+  return rules;
+}
+async function cloudflareRanges() {
+  const res = await fetch("https://api.cloudflare.com/client/v4/ips", { signal: AbortSignal.timeout(3e4) });
+  const body = await res.json();
+  if (!res.ok || !body?.success) throw new Error(`Cloudflare IP list unreadable: ${res.status}`);
+  return { ipv4: body.result.ipv4_cidrs ?? [], ipv6: body.result.ipv6_cidrs ?? [] };
+}
+var norm = (rules) => JSON.stringify(rules.map((r) => ({ ...r, source_ips: [...r.source_ips ?? []].sort() })).map(({ direction, protocol, port, source_ips }) => ({ direction, protocol, port: port ?? null, source_ips })));
+function declaredExtras(box) {
+  const extrasFile = JSON.parse((0, import_node_fs38.readFileSync)((0, import_node_url.fileURLToPath)(new URL("./firewall-extras.json", import_meta.url)), "utf8"));
+  return Object.prototype.hasOwnProperty.call(extrasFile, box) ? extrasFile[box] : void 0;
+}
+async function main() {
+  const box = arg("box");
+  if (!box || !/^[a-z0-9-]+$/.test(box)) {
+    console.error("cloud-firewall: --box <hetzner server name> is required");
+    process.exit(64);
+  }
+  const detach2 = process.argv.includes("--detach");
+  const name = `mmi-${box}`;
+  const servers = (await hz(`/servers?name=${encodeURIComponent(box)}`)).servers ?? [];
+  if (servers.length !== 1) throw new Error(`expected exactly one server named ${box} in this project, found ${servers.length}`);
+  const server = servers[0];
+  const existing = ((await hz(`/firewalls?name=${encodeURIComponent(name)}`)).firewalls ?? [])[0];
+  const applied = Boolean(existing?.applied_to?.some((a) => a.server?.id === server.id));
+  console.log(`cloud-firewall: box=${box} server=${server.id} ip=${server.public_net?.ipv4?.ip} firewall=${existing ? `${name}#${existing.id}` : `${name} (absent)`} applied=${applied} mode=${APPLY ? "LIVE" : "DRY-RUN"}${detach2 ? " action=detach" : ""}`);
+  if (detach2) {
+    if (!existing || !applied) {
+      console.log("cloud-firewall: not applied to this server \u2014 nothing to detach");
+      return;
+    }
+    if (!APPLY) {
+      console.log("cloud-firewall: dry-run (FIREWALL_APPLY=1 to detach)");
+      return;
+    }
+    await hz(`/firewalls/${existing.id}/actions/remove_from_resources`, { method: "POST", body: JSON.stringify({ remove_from: [{ type: "server", server: { id: server.id } }] }) });
+    console.log(`cloud-firewall: detached ${name} from ${box}`);
+    return;
+  }
+  const extras = declaredExtras(box);
+  if (extras === void 0) throw new Error(`${box} has no entry in firewall-extras.json; declare it (an empty list is fine) before applying`);
+  const rules = buildRules(await cloudflareRanges(), extras);
+  for (const r of rules) console.log(`  in ${r.protocol}${r.port ? `/${r.port}` : ""} from ${r.source_ips.length > 2 ? `${r.source_ips.length} Cloudflare ranges` : r.source_ips.join(",")} \u2014 ${r.description}`);
+  const rulesChanged = !existing || norm(existing.rules) !== norm(rules);
+  console.log(`cloud-firewall: rules ${rulesChanged ? "would change" : "unchanged"}; apply-to-server ${applied ? "already done" : "needed"}`);
+  if (!APPLY) {
+    console.log("cloud-firewall: dry-run (FIREWALL_APPLY=1 to write)");
+    return;
+  }
+  let id = existing?.id;
+  if (!existing) {
+    id = (await hz("/firewalls", { method: "POST", body: JSON.stringify({ name, labels: { managed_by: "mmi-hub", box }, rules }) })).firewall.id;
+    console.log(`cloud-firewall: created ${name}#${id}`);
+  } else if (rulesChanged) {
+    await hz(`/firewalls/${id}/actions/set_rules`, { method: "POST", body: JSON.stringify({ rules }) });
+    console.log(`cloud-firewall: updated rules on ${name}#${id}`);
+  }
+  if (!applied) {
+    await hz(`/firewalls/${id}/actions/apply_to_resources`, { method: "POST", body: JSON.stringify({ apply_to: [{ type: "server", server: { id: server.id } }] }) });
+    console.log(`cloud-firewall: applied ${name} to ${box}`);
+  }
+}
+if (process.argv[1] && (0, import_node_path35.basename)(process.argv[1]).toLowerCase() === "cloud-firewall.mjs") {
+  main().catch((err) => {
+    console.error(`cloud-firewall: failed: ${err.message}`);
+    process.exit(1);
+  });
+}
+
+// ../infra/hetzner/firewall-extras.json
+var firewall_extras_default = {
+  $comment: "#7356: per-box inbound exceptions to the Cloudflare-only Hetzner Cloud Firewall (cloud-firewall.mjs). Every entry names its owner and reason. Web traffic (80/443) is always Cloudflare-only and SSH (22) is always open; list only what must reach the box directly.",
+  "mm-work": [
+    { protocol: "tcp", port: "7881", description: "MM-Chat dev huddles LiveKit RTC over TCP (MMI-Hub#7353, owner-approved 2026-09-26)" },
+    { protocol: "udp", port: "7882", description: "MM-Chat dev huddles LiveKit RTC over UDP (MMI-Hub#7353, owner-approved 2026-09-26)" },
+    { protocol: "tcp", port: "7891", description: "MM-Chat main huddles LiveKit RTC over TCP (MMI-Hub#7907, owner-approved 2026-10-06)" },
+    { protocol: "udp", port: "7892", description: "MM-Chat main huddles LiveKit RTC over UDP (MMI-Hub#7907, owner-approved 2026-10-06)" }
+  ],
+  "mm-central": [],
+  "mm-recorder": [],
+  "mmi-runner": [],
+  "mmi-runner2": []
+};
+
+// ../shared/runner-hosts.ts
+var RUNNER_HOSTS = ["mmi-runner", "mmi-runner2"];
+
+// src/box-firewall.ts
+function declaredExtrasFromBundle(box) {
+  const file = firewall_extras_default;
+  return Object.prototype.hasOwnProperty.call(file, box) ? file[box] : void 0;
+}
+var FirewallRefusal = class extends Error {
+};
+var FIREWALL_NAME_PREFIX = "mmi-";
+var ACTION_POLL_MS = 2500;
+var ACTION_POLL_ATTEMPTS = 20;
+async function runBoxFirewall(boxName, mode, live, deps) {
+  const runner = RUNNER_HOSTS.find((h) => h.toLowerCase() === boxName.toLowerCase());
+  if (!runner) {
+    throw new FirewallRefusal(
+      `box firewall: '${boxName}' is not a registered runner box \u2014 this command manages only the firewalls of ${RUNNER_HOSTS.join(" and ")} (the reviewed runner policy does not cover any other box)`
+    );
+  }
+  const token = await deps.fetchToken();
+  const firewallName = `${FIREWALL_NAME_PREFIX}${runner}`;
+  if (live === false && mode !== "plan") {
+    throw new FirewallRefusal(`box firewall: ${mode} is a mutation \u2014 it needs --apply`);
+  }
+  const servers = (await deps.hetzner(token, `/servers?name=${encodeURIComponent(runner)}`)).servers ?? [];
+  if (servers.length !== 1) {
+    throw new FirewallRefusal(`box firewall: expected exactly one server named ${runner} in the MM project, found ${servers.length} \u2014 refusing to guess the target`);
+  }
+  const server = servers[0];
+  const observedAt = deps.now();
+  const existing = ((await deps.hetzner(token, `/firewalls?name=${encodeURIComponent(firewallName)}`)).firewalls ?? [])[0];
+  const applied = Boolean(existing?.applied_to?.some((a) => a.server?.id === server.id));
+  const target = {
+    operation: mode,
+    live,
+    box: runner,
+    server: { id: server.id, name: server.name, ...server.public_net?.ipv4?.ip ? { ipv4: server.public_net.ipv4.ip } : {} },
+    firewall: existing ? { id: existing.id, name: existing.name } : null,
+    applied,
+    rulesChanged: false,
+    currentRules: existing?.rules ?? [],
+    plannedRules: null,
+    actions: [],
+    readback: void 0,
+    note: void 0,
+    ambiguous: false,
+    ok: false,
+    observedAt
+  };
+  if (mode === "detach") {
+    if (!existing || !applied) {
+      return { ...target, ok: true, note: `firewall ${firewallName} is ${existing ? "not applied to" : "absent for"} this server \u2014 nothing to detach` };
+    }
+    const action = await actionPost(deps, token, existing.id, "remove_from_resources", { remove_from: [{ type: "server", server: { id: server.id } }] });
+    const waited = await waitForAction(deps, token, action);
+    target.actions.push(actionReceipt("remove_from_resources", waited));
+    target.ambiguous = waited.ambiguous;
+    const readback2 = await readbackState(deps, token, existing.id, server.id, null, deps.now());
+    target.readback = readback2;
+    target.ok = !waited.ambiguous && readback2.attached === false;
+    if (target.ok) target.note = `detached ${firewallName} from ${runner}`;
+    return target;
+  }
+  const extras = deps.declaredExtras(runner);
+  if (extras === void 0) {
+    throw new FirewallRefusal(`box firewall: ${runner} has no entry in infra/hetzner/firewall-extras.json; declare it (an empty list is fine) before planning or applying`);
+  }
+  const planned = buildRules(await deps.cloudflareRanges(), extras);
+  target.plannedRules = planned;
+  const rulesChanged = !existing || norm(existing.rules ?? []) !== norm(planned);
+  target.rulesChanged = rulesChanged;
+  if (mode === "plan") {
+    target.ok = !rulesChanged && applied;
+    if (target.ok) target.note = `firewall ${firewallName}#${existing.id} matches the reviewed policy and is applied`;
+    return target;
+  }
+  let firewallId = existing?.id;
+  if (!existing) {
+    const created = await deps.hetzner(token, "/firewalls", {
+      method: "POST",
+      body: JSON.stringify({ name: firewallName, labels: { managed_by: "mmi-hub", box: runner }, rules: planned })
+    });
+    firewallId = created.firewall.id;
+    target.actions.push({ id: firewallId, kind: "create", status: "created" });
+  } else if (rulesChanged) {
+    const action = await actionPost(deps, token, firewallId, "set_rules", { rules: planned });
+    const waited = await waitForAction(deps, token, action);
+    target.actions.push(actionReceipt("set_rules", waited));
+    target.ambiguous ||= waited.ambiguous;
+    if (waited.ambiguous || waited.action.status === "error") {
+      const readback2 = await readbackState(deps, token, firewallId, server.id, planned, deps.now());
+      target.readback = readback2;
+      return target;
+    }
+  }
+  if (!applied) {
+    const action = await actionPost(deps, token, firewallId, "apply_to_resources", { apply_to: [{ type: "server", server: { id: server.id } }] });
+    const waited = await waitForAction(deps, token, action);
+    target.actions.push(actionReceipt("apply_to_resources", waited));
+    target.ambiguous ||= waited.ambiguous;
+    if (waited.action.status === "error") {
+      const readback2 = await readbackState(deps, token, firewallId, server.id, planned, deps.now());
+      target.readback = readback2;
+      return target;
+    }
+  }
+  const readback = await readbackState(deps, token, firewallId, server.id, planned, deps.now());
+  target.firewall = { id: firewallId, name: firewallName };
+  target.readback = readback;
+  target.ok = !target.ambiguous && readback.attached && readback.rulesMatch === true;
+  if (target.ok) target.note = `firewall ${firewallName}#${firewallId} applied to ${runner} and read back independently`;
+  return target;
+}
+async function actionPost(deps, token, firewallId, kind, body) {
+  const res = await deps.hetzner(token, `/firewalls/${firewallId}/actions/${kind}`, { method: "POST", body: JSON.stringify(body) });
+  return res.action;
+}
+async function waitForAction(deps, token, accepted) {
+  let last = accepted;
+  for (let attempt = 0; attempt < ACTION_POLL_ATTEMPTS; attempt += 1) {
+    const res = await deps.hetzner(token, `/firewalls/actions/${accepted.id}`);
+    last = res.action ?? last;
+    if (last.status === "success" || last.status === "error") return { action: last, ambiguous: false };
+    await deps.sleep(ACTION_POLL_MS);
+  }
+  return { action: last, ambiguous: true };
+}
+function actionReceipt(kind, waited) {
+  return {
+    id: waited.action.id,
+    kind,
+    status: waited.ambiguous ? "running (wait bound exhausted \u2014 ambiguous)" : waited.action.status,
+    ...waited.action.error ? { error: { code: waited.action.error.code, message: waited.action.error.message } } : {}
+  };
+}
+async function readbackState(deps, token, firewallId, serverId, planned, at) {
+  const firewall = (await deps.hetzner(token, `/firewalls/${firewallId}`)).firewall;
+  const server = (await deps.hetzner(token, `/servers/${serverId}`)).server;
+  const attached = server != null && server.id === serverId && Boolean(firewall?.applied_to?.some((a) => a.server?.id === serverId));
+  const rulesMatch = planned ? norm(firewall?.rules ?? []) === norm(planned) : null;
+  return { observedAt: at, attached, rulesMatch };
+}
+
 // src/box-commands.ts
 var HETZNER_API = "https://api.hetzner.cloud/v1/servers";
 var HETZNER_TIMEOUT_MS = 15e3;
@@ -48664,7 +48966,7 @@ function registerBoxCommands(program3) {
       const stdinSource = o.body ? `"${o.body}"` : "<body.sh>";
       const wroteScript = o.ssh && o.script ? o.script : null;
       const runLine = wroteScript ? useStdin ? `bash "${wroteScript}" < ${stdinSource}` : `bash "${wroteScript}"` : void 0;
-      if (wroteScript) (0, import_node_fs38.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs39.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -48775,6 +49077,79 @@ ${SSH_RECIPE_AGENT_NOTE}`);
       process.exitCode = 2;
     }
   });
+  box.command("firewall <box>").description("the registered runner boxes' Hetzner Cloud Firewall (#9786): --plan (default, read-only) reports the exact current rules and attachment against the reviewed policy; --apply writes it; --detach --apply is the rollback").option("--plan", "read-only: current firewall, attachment and exact rules, and the diff against the reviewed policy (the default)").option("--apply", "create/update the approved firewall (policy #7359, SSH stays world-open) and attach it to exactly this server; waits for each provider action, then re-reads the firewall and attachment independently").option("--detach", "with --apply: detach this exact firewall from this exact server (rollback; a route independent of SSH)").option("--json", "machine-readable receipt").action(async (name, o) => {
+    try {
+      if (o.apply && o.plan) throw new UsageError("box firewall: --plan and --apply are exclusive");
+      if (o.detach && !o.apply) throw new UsageError("box firewall: --detach is a mutation \u2014 it needs --apply");
+      if (!o.apply && !o.plan) o.plan = true;
+      const mode = o.detach ? "detach" : o.apply ? "apply" : "plan";
+      const deps = firewallDeps();
+      if (mode === "plan") {
+        const receipt2 = await runBoxFirewall(name, mode, false, deps);
+        renderFirewallReceipt(receipt2, o.json === true);
+        process.exitCode = receipt2.ok ? 0 : 1;
+        return;
+      }
+      const { boxes, incomplete } = await fetchInventory();
+      const found = lookupBox(name, boxes, incomplete);
+      if (found.kind !== "found") {
+        const why = found.kind === "unknown" ? `the inventory is incomplete (${found.reasons.join("; ")})` : `no box named '${name}'`;
+        throw new UnreadableError(`box firewall: ${why}`);
+      }
+      const receipt = await runBoxFirewall(found.box.name, mode, true, deps);
+      if (!o.json) warnIncomplete(incomplete);
+      renderFirewallReceipt(receipt, o.json === true);
+      process.exitCode = receipt.ok ? 0 : 1;
+    } catch (e) {
+      const message2 = e instanceof FirewallRefusal ? e.message : e.message;
+      if (o.json) console.log(JSON.stringify({ box: name, ok: false, refused: e instanceof FirewallRefusal, error: message2 }, null, 2));
+      else console.error(message2);
+      process.exitCode = 2;
+    }
+  });
+}
+function renderFirewallReceipt(r, json) {
+  if (json) {
+    console.log(JSON.stringify(r, null, 2));
+    return;
+  }
+  const fw = r.firewall ? `${r.firewall.name}#${r.firewall.id}` : `mmi-${r.box} (absent)`;
+  const lines2 = [
+    `${r.box} \u2014 firewall ${r.operation}${r.live ? " (LIVE)" : " (dry-run)"}`,
+    `  server: #${r.server.id}${r.server.ipv4 ? ` (${r.server.ipv4})` : ""}`,
+    `  firewall: ${fw}, ${r.applied ? "attached to this server" : "not attached to this server"}`
+  ];
+  if (r.plannedRules) {
+    lines2.push(`  rules: ${r.rulesChanged ? "WOULD CHANGE \u2014 planned set differs from the provider" : "match the reviewed policy"}`);
+    for (const rule of r.plannedRules) {
+      const from = rule.source_ips.length > 2 ? `${rule.source_ips.length} Cloudflare ranges` : rule.source_ips.join(", ");
+      lines2.push(`    in ${rule.protocol}${rule.port ? `/${rule.port}` : ""} from ${from} \u2014 ${rule.description}`);
+    }
+  }
+  for (const a of r.actions) lines2.push(`  action ${a.kind} #${a.id}: ${a.status}${a.error ? ` \u2014 ${a.error.code ?? ""} ${a.error.message ?? ""}` : ""}`);
+  if (r.readback) {
+    lines2.push(`  readback (independent, ${r.readback.observedAt}): attached=${r.readback.attached}${r.readback.rulesMatch === null ? "" : ` rulesMatch=${r.readback.rulesMatch}`}`);
+  }
+  if (r.ambiguous) lines2.push("  AMBIGUOUS: a provider action never reached success/error \u2014 treat the outcome as unknown, do not blindly rerun the mutation");
+  lines2.push(`  ${r.ok ? "OK" : "NOT OK"}${r.note ? ` \u2014 ${r.note}` : ""} (observed ${r.observedAt})`);
+  console.log(lines2.join("\n"));
+}
+function firewallDeps() {
+  return {
+    hetzner: (token, path2, init) => hetzner(token, path2, init),
+    cloudflareRanges: () => cloudflareRanges(),
+    declaredExtras: (boxName) => declaredExtrasFromBundle(boxName),
+    fetchToken: async () => {
+      let token = null;
+      await withSecrets(async (secretsDeps) => {
+        token = await fetchSecretValue(secretsDeps, PROJECT_API_TOKEN.MM, { slug: HETZNER_VAULT_SLUG }, true);
+      });
+      if (!token) throw new Error("box firewall: could not read the Hetzner MM API token from the vault (the value is never printed)");
+      return token;
+    },
+    sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
+    now: () => (/* @__PURE__ */ new Date()).toISOString()
+  };
 }
 var UsageError = class extends Error {
 };
@@ -48791,17 +49166,17 @@ function hubGitShow(ref) {
   return (path2) => git3(["show", `${ref}:${path2}`]);
 }
 function runOnBox(found, script) {
-  const dir = (0, import_node_fs38.mkdtempSync)((0, import_node_path35.join)((0, import_node_os20.tmpdir)(), "mmi-box-control-"));
+  const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path36.join)((0, import_node_os20.tmpdir)(), "mmi-box-control-"));
   try {
-    const recipe = (0, import_node_path35.join)(dir, "recipe.sh");
-    (0, import_node_fs38.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
+    const recipe = (0, import_node_path36.join)(dir, "recipe.sh");
+    (0, import_node_fs39.writeFileSync)(recipe, sshRecipeScript(found, "sh -s"), "utf8");
     const r = (0, import_node_child_process12.spawnSync)("bash", [recipe], { input: script, encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 18e4, windowsHide: true });
     if (r.status !== 0) {
       throw new UnreadableError(`box control: the ssh session to ${found.name} failed (exit ${r.status ?? r.signal}): ${(r.stderr || "").trim().split("\n").slice(-3).join(" | ")}`);
     }
     return r.stdout;
   } finally {
-    (0, import_node_fs38.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs39.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function formatControl(mode, box, rows) {
@@ -50302,12 +50677,12 @@ var declaredProjectAdmins = (meta) => {
 };
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 async function gateRenderDiff(current, rendered) {
-  const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path36.join)((0, import_node_os21.tmpdir)(), "mmi-gate-diff-"));
-  const before = (0, import_node_path36.join)(dir, "committed-gate.yml");
-  const after = (0, import_node_path36.join)(dir, "registry-render.yml");
+  const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path37.join)((0, import_node_os21.tmpdir)(), "mmi-gate-diff-"));
+  const before = (0, import_node_path37.join)(dir, "committed-gate.yml");
+  const after = (0, import_node_path37.join)(dir, "registry-render.yml");
   try {
-    (0, import_node_fs39.writeFileSync)(before, current);
-    (0, import_node_fs39.writeFileSync)(after, rendered);
+    (0, import_node_fs40.writeFileSync)(before, current);
+    (0, import_node_fs40.writeFileSync)(after, rendered);
     try {
       return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
     } catch (e) {
@@ -50316,7 +50691,7 @@ async function gateRenderDiff(current, rendered) {
       throw e;
     }
   } finally {
-    (0, import_node_fs39.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
   }
 }
 function bootstrapTrainDoctorDeps() {
@@ -50337,9 +50712,9 @@ async function propagationScope(classes, what) {
   }
   const rosterRepos = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
   let independentCount = rosterRepos.length;
-  if ((0, import_node_fs39.existsSync)("projects.json")) {
+  if ((0, import_node_fs40.existsSync)("projects.json")) {
     try {
-      const local = JSON.parse((0, import_node_fs39.readFileSync)("projects.json", "utf8"));
+      const local = JSON.parse((0, import_node_fs40.readFileSync)("projects.json", "utf8"));
       const localRepos = /* @__PURE__ */ new Set();
       for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
         const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -50464,13 +50839,13 @@ function registerBootstrapCommands(program3) {
       })),
       pushAllowlistOwners: pushAllowlistAuthority(verifyOwners, declaredProjectAdmins(meta)),
       pushAllowlistOwnersRead: verifyOwnersRead,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs39.existsSync)(path2) ? (0, import_node_fs39.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs40.existsSync)(path2) ? (0, import_node_fs40.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs39.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs39.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs40.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs40.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -50548,14 +50923,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs39.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs40.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs40.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs39.existsSync)(s.target) ? (0, import_node_fs39.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs40.existsSync)(s.target) ? (0, import_node_fs40.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -50811,24 +51186,24 @@ function registerBootstrapCommands(program3) {
       return;
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs39.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs40.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs40.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile10 = (p) => (0, import_node_fs39.existsSync)(p) ? (0, import_node_fs39.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs40.existsSync)(p) ? (0, import_node_fs40.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path36.join)((0, import_node_os21.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs39.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path37.join)((0, import_node_os21.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs40.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs39.unlinkSync)(tmp);
+          (0, import_node_fs40.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -51466,10 +51841,10 @@ LIVE apply to ${repo}:
     if (rawFlag("--pins")) return propagatePins(rawFlag("--apply"), rawFlag("--json"));
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs39.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs40.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs40.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -51478,9 +51853,9 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no centrally propagatable seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!seed.managedBlock && !(0, import_node_fs39.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = seed.managedBlock ? null : (0, import_node_fs39.readFileSync)(seed.target, "utf8");
-    const readSeedFile2 = (path2) => (0, import_node_fs39.existsSync)(path2) ? (0, import_node_fs39.readFileSync)(path2, "utf8") : null;
+    if (!seed.managedBlock && !(0, import_node_fs40.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = seed.managedBlock ? null : (0, import_node_fs40.readFileSync)(seed.target, "utf8");
+    const readSeedFile2 = (path2) => (0, import_node_fs40.existsSync)(path2) ? (0, import_node_fs40.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const { projects, classOf, inClassRepos, canarySlug, sourcePilot } = await propagationScope(seed.classes, `target '${seed.target}'`);
     const repos = inClassRepos.map((repo) => {
@@ -51599,7 +51974,7 @@ LIVE apply to ${repo}:
       if (plan.refusedNoCanary) return fail("bootstrap propagate --execute: no canary declared for this target \u2014 refusing to write (set seedCanary:true on exactly one registry repo)");
       const headSha = seedSource.sha;
       const sourceBlob = (await execGitForSeedSource(["rev-parse", `${headSha}:${seedSourcePath(seed)}`])).trim();
-      const runbookUnaffected = (0, import_node_fs39.existsSync)(RUNBOOK_UNAFFECTED_PATH) ? runbookUnaffectedReason(JSON.parse((0, import_node_fs39.readFileSync)(RUNBOOK_UNAFFECTED_PATH, "utf8")), seed.target, sourceBlob) : void 0;
+      const runbookUnaffected = (0, import_node_fs40.existsSync)(RUNBOOK_UNAFFECTED_PATH) ? runbookUnaffectedReason(JSON.parse((0, import_node_fs40.readFileSync)(RUNBOOK_UNAFFECTED_PATH, "utf8")), seed.target, sourceBlob) : void 0;
       for (const rec of plan.records) {
         if (rec.action !== "open-pr") continue;
         const baseBranch = classOf(rec.repo) === "content" ? "main" : "development";
@@ -51621,15 +51996,15 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path36.join)((0, import_node_os21.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path37.join)((0, import_node_os21.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
-        (0, import_node_fs39.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha, runbookUnaffected)), "utf8");
+        (0, import_node_fs40.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha, runbookUnaffected)), "utf8");
         try {
           await gh2(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs39.unlinkSync)(tmp);
+            (0, import_node_fs40.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -51698,10 +52073,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs39.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs40.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs39.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs40.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -51718,10 +52093,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs39.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs40.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs39.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs40.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -51798,13 +52173,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path36.join)((0, import_node_os21.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs39.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path37.join)((0, import_node_os21.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs40.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh2(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs39.unlinkSync)(tmp);
+          (0, import_node_fs40.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -52309,8 +52684,8 @@ function formatSuiteMarkdown(report) {
   const lines2 = ["| Member | dev | rc | main | Pinned by suite |", "| --- | --- | --- | --- | --- |"];
   if (report.lead) lines2.push(`| MM-Work (suite) | ${short(report.lead.dev)} | ${report.lead.rc} | ${report.lead.main} | - |`);
   for (const m of report.members.slice(report.lead ? 1 : 0)) {
-    const [dev, rc, main] = ["dev", "rc", "main"].map((s) => m.stages.find((x) => x.stage === s));
-    lines2.push(`| ${m.repo.split("/")[1]} | ${cell(dev)} | ${cell(rc)} | ${cell(main)} | ${[by(rc, "rc"), by(main, "main")].filter(Boolean).join(", ") || "-"} |`);
+    const [dev, rc, main2] = ["dev", "rc", "main"].map((s) => m.stages.find((x) => x.stage === s));
+    lines2.push(`| ${m.repo.split("/")[1]} | ${cell(dev)} | ${cell(rc)} | ${cell(main2)} | ${[by(rc, "rc"), by(main2, "main")].filter(Boolean).join(", ") || "-"} |`);
   }
   return lines2.join("\n");
 }
@@ -52400,8 +52775,8 @@ async function waitSuiteDev(deps, opts) {
 }
 
 // src/suite-train.ts
-var import_node_fs40 = require("node:fs");
-var import_node_path37 = require("node:path");
+var import_node_fs41 = require("node:fs");
+var import_node_path38 = require("node:path");
 var import_node_crypto20 = require("node:crypto");
 
 // src/kit-version.ts
@@ -52487,7 +52862,7 @@ function suiteReleaseTag(rc) {
 function readSuiteCut(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs40.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs41.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -52503,11 +52878,11 @@ function readSuiteCut(path2) {
   return record2;
 }
 function writeSuiteCut(path2, record2) {
-  (0, import_node_fs40.mkdirSync)((0, import_node_path37.dirname)(path2), { recursive: true });
+  (0, import_node_fs41.mkdirSync)((0, import_node_path38.dirname)(path2), { recursive: true });
   const temp = `${path2}.${(0, import_node_crypto20.randomBytes)(8).toString("hex")}.tmp`;
   try {
-    (0, import_node_fs40.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
-    (0, import_node_fs40.renameSync)(temp, path2);
+    (0, import_node_fs41.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
+    (0, import_node_fs41.renameSync)(temp, path2);
   } catch (e) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
@@ -52523,15 +52898,15 @@ function pinVersion(url) {
   }
 }
 async function carriedPins(deps, member, bundles) {
-  const main = bundles.main;
-  if (!main || !RELEASE_TAG.test(pinVersion(main))) throw new Error(`${member.repo}: nothing new since rc, but its MM-Work main pin ${main ?? "(none)"} has no ?v=vX.Y.Z release; pin it before the suite cut`);
-  if (!await deps.tagSha(member.repo, pinVersion(main))) throw new Error(`${member.repo}: nothing new since rc, but its MM-Work main pin names ${pinVersion(main)}, which was never released; release it or pin its live release before the suite cut`);
-  const mainPin = mainPinFor(new URL(main).host, bundles, pinVersion(main));
-  for (const url of [bundles.rc, main]) {
+  const main2 = bundles.main;
+  if (!main2 || !RELEASE_TAG.test(pinVersion(main2))) throw new Error(`${member.repo}: nothing new since rc, but its MM-Work main pin ${main2 ?? "(none)"} has no ?v=vX.Y.Z release; pin it before the suite cut`);
+  if (!await deps.tagSha(member.repo, pinVersion(main2))) throw new Error(`${member.repo}: nothing new since rc, but its MM-Work main pin names ${pinVersion(main2)}, which was never released; release it or pin its live release before the suite cut`);
+  const mainPin = mainPinFor(new URL(main2).host, bundles, pinVersion(main2));
+  for (const url of [bundles.rc, main2]) {
     const tag = pinVersion(url);
     if (!RC_TAG.test(tag) && !RELEASE_TAG.test(tag)) continue;
     const sha = await deps.tagSha(member.repo, tag);
-    if (sha && await deps.contains(member.repo, member.development, sha)) return { rcPin: url === main ? mainPin : url, mainPin };
+    if (sha && await deps.contains(member.repo, member.development, sha)) return { rcPin: url === main2 ? mainPin : url, mainPin };
   }
   throw new Error(`${member.repo}: nothing new since rc, but no pinned MM-Work bundle carries development ${member.development.slice(0, 12)}; pin it before the suite cut`);
 }
@@ -52556,25 +52931,25 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
 async function retireFailedLeadRcLedger(deps, ownerGo) {
-  if (!(0, import_node_fs40.existsSync)(deps.ledgerPath)) return void 0;
+  if (!(0, import_node_fs41.existsSync)(deps.ledgerPath)) return void 0;
   return withLedgerLock(deps.ledgerPath, async (fence) => {
-    const ledger = parseReleaseLedger((0, import_node_fs40.readFileSync)(deps.ledgerPath, "utf8"));
+    const ledger = parseReleaseLedger((0, import_node_fs41.readFileSync)(deps.ledgerPath, "utf8"));
     const states = Object.values(ledger.phases).map((p) => p.state);
     if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
     if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
     if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
-    const archive = (0, import_node_path37.join)((0, import_node_path37.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
-    if ((0, import_node_fs40.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    const archive = (0, import_node_path38.join)((0, import_node_path38.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
+    if ((0, import_node_fs41.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
     await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
-    await fence(() => (0, import_node_fs40.renameSync)(deps.ledgerPath, archive));
+    await fence(() => (0, import_node_fs41.renameSync)(deps.ledgerPath, archive));
     return `${ledger.tag} (ledger archived to ${archive})`;
   });
 }
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record2 = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record2.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
-  if ((0, import_node_fs40.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
-  (0, import_node_fs40.renameSync)(recordPath, archive);
+  if ((0, import_node_fs41.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
+  (0, import_node_fs41.renameSync)(recordPath, archive);
   return { archive, orphanTags: record2.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
 async function suiteRestoreMainPins(deps) {
@@ -52661,12 +53036,12 @@ async function suiteRcandRun(deps, opts) {
   }
   if ((record2?.announcement === "sent" || record2?.announcement === "skipped") && record2.leadReleased) {
     const archive = `${deps.recordPath}.${record2.leadRcTag}.json`;
-    if ((0, import_node_fs40.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
-    (0, import_node_fs40.renameSync)(deps.recordPath, archive);
+    if ((0, import_node_fs41.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
+    (0, import_node_fs41.renameSync)(deps.recordPath, archive);
     record2 = void 0;
   }
   if (record2 && !record2.pinPr && !record2.leadRcTag && record2.members.every((m) => !m.tag)) {
-    (0, import_node_fs40.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs41.rmSync)(deps.recordPath, { force: true });
     record2 = void 0;
   }
   if (!record2) {
@@ -52720,7 +53095,7 @@ async function suiteRcandRun(deps, opts) {
     quiet.push(member);
   }
   if (record2.members.every((m) => m.carried || quiet.includes(m)) && await deps.contains(SUITE_REPO, record2.leadDevelopment, record2.leadPreviousRc)) {
-    (0, import_node_fs40.rmSync)(deps.recordPath, { force: true });
+    (0, import_node_fs41.rmSync)(deps.recordPath, { force: true });
     throw new Error("nothing to promote: neither MM-Work nor any module has new development commits since its rc; no suite cut started");
   }
   for (const member of quiet) {
@@ -52738,7 +53113,7 @@ async function suiteRcandRun(deps, opts) {
   }
   if (refusals.length) {
     const untouched = record2.members.every((m) => !m.tag) && !record2.pinPr;
-    if (untouched) (0, import_node_fs40.rmSync)(deps.recordPath, { force: true });
+    if (untouched) (0, import_node_fs41.rmSync)(deps.recordPath, { force: true });
     throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
@@ -52757,7 +53132,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
   let running = 0;
   const waiting = [];
   const results = await Promise.allSettled(record2.members.map(async (member) => {
-    if (running >= 4) await new Promise((resolve7) => waiting.push(resolve7));
+    if (running >= 4) await new Promise((resolve8) => waiting.push(resolve8));
     else running++;
     try {
       if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
@@ -52930,11 +53305,11 @@ Each member's live release must serve <data>/main/module.js at its main pin path
   }
   return record2;
 }
-var hotfixRecordPath = (deps) => (0, import_node_path37.join)((0, import_node_path37.dirname)(deps.recordPath), "hotfix.json");
+var hotfixRecordPath = (deps) => (0, import_node_path38.join)((0, import_node_path38.dirname)(deps.recordPath), "hotfix.json");
 function readSuiteHotfix(path2) {
   let raw;
   try {
-    raw = (0, import_node_fs40.readFileSync)(path2, "utf8");
+    raw = (0, import_node_fs41.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -52977,7 +53352,7 @@ async function suiteHotfix(deps, opts) {
   if (completed) record2 = void 0;
   if (record2 && record2.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record2.repo} is recorded; finish it (rerun with that member) first`);
   if (!record2?.tag) await deps.validateHotfixSummary();
-  if (completed) (0, import_node_fs40.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
+  if (completed) (0, import_node_fs41.renameSync)(path2, `${path2}.${completed.leadTag}.json`);
   const rec = record2 ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
   const save = () => writeSuiteHotfix(path2, rec);
   save();
@@ -53245,9 +53620,9 @@ async function runRcDataSwitch(deps, opts) {
 
 // src/suite-train-io.ts
 var import_node_child_process19 = require("node:child_process");
-var import_node_path50 = require("node:path");
-var import_node_fs54 = require("node:fs");
 var import_node_path51 = require("node:path");
+var import_node_fs55 = require("node:fs");
+var import_node_path52 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
@@ -53428,7 +53803,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -54939,8 +55314,8 @@ function checkHotfixCarries(options) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs41 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_node_path39 = require("node:path");
 var import_node_os22 = require("node:os");
 init_cli_shared();
 init_github_client();
@@ -55348,13 +55723,13 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs41.mkdtempSync)((0, import_node_path38.join)((0, import_node_os22.tmpdir)(), "mmi-squash-body-"));
-  const path2 = (0, import_node_path38.join)(dir, "body.txt");
-  (0, import_node_fs41.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
+  const dir = (0, import_node_fs42.mkdtempSync)((0, import_node_path39.join)((0, import_node_os22.tmpdir)(), "mmi-squash-body-"));
+  const path2 = (0, import_node_path39.join)(dir, "body.txt");
+  (0, import_node_fs42.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
   return { path: path2, cleanup: () => {
     try {
-      (0, import_node_fs41.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs42.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   } };
@@ -55606,8 +55981,8 @@ init_github_client();
 
 // src/release-custody.ts
 var import_node_crypto21 = require("node:crypto");
-var import_node_fs42 = require("node:fs");
-var import_node_path39 = require("node:path");
+var import_node_fs43 = require("node:fs");
+var import_node_path40 = require("node:path");
 init_github_client();
 
 // src/release-custody-bootstrap.ts
@@ -55740,9 +56115,9 @@ async function verifyCustodyBootstrap(value, api, controller, requiredContexts,
   if (legacy.length > 20) reject("local evidence exceeds the bounded migration limit");
   const root = `repos/${HUB_RELEASE_REPO}`;
   const tag = await api.rest("GET", `${root}/git/ref/tags/${input.tag}`);
-  const main = await api.rest("GET", `${root}/git/ref/heads/main`);
+  const main2 = await api.rest("GET", `${root}/git/ref/heads/main`);
   const release = await api.rest("GET", `${root}/releases/tags/${input.tag}`);
-  if (tag.object.sha !== input.tagSha || main.object.sha !== input.tagSha || release.tag_name !== input.tag || release.draft || release.prerelease || !Number.isFinite(Date.parse(release.published_at))) reject("tag, main and published Release do not identify one completed cut");
+  if (tag.object.sha !== input.tagSha || main2.object.sha !== input.tagSha || release.tag_name !== input.tag || release.draft || release.prerelease || !Number.isFinite(Date.parse(release.published_at))) reject("tag, main and published Release do not identify one completed cut");
   const observed = {};
   for (const name of ["gate", "publish", "deploy", "installer", "tenant"]) {
     const run = await runAttempt(api, input[name]);
@@ -56077,7 +56452,7 @@ function reclassifySupersededArchives(state) {
 }
 function localRaw(path2) {
   try {
-    return (0, import_node_fs42.readFileSync)(path2, "utf8");
+    return (0, import_node_fs43.readFileSync)(path2, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw e;
@@ -56086,19 +56461,19 @@ function localRaw(path2) {
 function hydrateLocal(path2, raw) {
   const previous = localRaw(path2);
   if (previous === raw) return;
-  (0, import_node_fs42.mkdirSync)((0, import_node_path39.dirname)(path2), { recursive: true });
+  (0, import_node_fs43.mkdirSync)((0, import_node_path40.dirname)(path2), { recursive: true });
   if (previous !== null) {
     const ledger = parseReleaseLedger(previous);
-    const archive = (0, import_node_path39.join)((0, import_node_path39.dirname)(path2), `phases.local-${ledger.tagSha}-${custodyDigest(previous)}.json`);
-    if (!(0, import_node_fs42.existsSync)(archive)) (0, import_node_fs42.writeFileSync)(archive, previous, { flag: "wx" });
-    if (raw === null) (0, import_node_fs42.renameSync)(path2, `${path2}.retired-${custodyDigest(previous)}`);
+    const archive = (0, import_node_path40.join)((0, import_node_path40.dirname)(path2), `phases.local-${ledger.tagSha}-${custodyDigest(previous)}.json`);
+    if (!(0, import_node_fs43.existsSync)(archive)) (0, import_node_fs43.writeFileSync)(archive, previous, { flag: "wx" });
+    if (raw === null) (0, import_node_fs43.renameSync)(path2, `${path2}.retired-${custodyDigest(previous)}`);
   }
-  if (raw !== null) (0, import_node_fs42.writeFileSync)(path2, raw, "utf8");
+  if (raw !== null) (0, import_node_fs43.writeFileSync)(path2, raw, "utf8");
 }
 async function commandIdentity(file, args, run, repo) {
   if (file === "git" && args[0] === "push") {
     const deleting = args.includes("--delete");
-    const refs = args.slice(2).filter((arg) => !arg.startsWith("-"));
+    const refs = args.slice(2).filter((arg2) => !arg2.startsWith("-"));
     const targets = [];
     for (const refspec of refs) {
       const [source, destination] = refspec.split(":");
@@ -56113,7 +56488,7 @@ async function commandIdentity(file, args, run, repo) {
     return { kind: "github-release", identity: { repo, tag, sha: (await run("git", ["rev-parse", `${tag}^{commit}`])).trim() } };
   }
   if (file === "gh" && args[0] === "workflow" && args[1] === "run") {
-    const fields = Object.fromEntries(args.flatMap((arg, i) => ["-f", "--field", "-F", "--raw-field"].includes(arg) ? [args[i + 1].split(/=(.*)/s).slice(0, 2)] : []));
+    const fields = Object.fromEntries(args.flatMap((arg2, i) => ["-f", "--field", "-F", "--raw-field"].includes(arg2) ? [args[i + 1].split(/=(.*)/s).slice(0, 2)] : []));
     const ref = args.includes("--ref") ? args[args.indexOf("--ref") + 1] : "main";
     const sha = (await run("git", ["rev-parse", `origin/${ref}`])).trim();
     const before = JSON.parse(await run("gh", [
@@ -56130,7 +56505,7 @@ async function commandIdentity(file, args, run, repo) {
     return { kind: "workflow-rerun", identity: { repo, runId, attempt: prior.run_attempt + 1 } };
   }
   if (file === "gh" && !["run", "release", "pr", "api", "workflow"].includes(args[0])) return null;
-  const write = file === "gh" && (args[0] === "pr" && ["create", "merge", "close", "edit"].includes(args[1]) || args[0] === "release" && ["delete", "edit", "upload"].includes(args[1]) || args[0] === "api" && (args[1] === "graphql" ? args.some((arg) => /(?:^query=|^)\s*mutation\b/.test(arg)) : args.some((arg) => ["POST", "PUT", "PATCH", "DELETE"].includes(arg)) || args.includes("-f") || args.includes("-F") || args.includes("--input")));
+  const write = file === "gh" && (args[0] === "pr" && ["create", "merge", "close", "edit"].includes(args[1]) || args[0] === "release" && ["delete", "edit", "upload"].includes(args[1]) || args[0] === "api" && (args[1] === "graphql" ? args.some((arg2) => /(?:^query=|^)\s*mutation\b/.test(arg2)) : args.some((arg2) => ["POST", "PUT", "PATCH", "DELETE"].includes(arg2)) || args.includes("-f") || args.includes("-F") || args.includes("--input")));
   return write ? { kind: "github-write", identity: { repo, command: args } } : null;
 }
 function effectObserver(api) {
@@ -56283,8 +56658,8 @@ function withHubReleaseCustody(deps) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs43 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs44 = require("node:fs");
+var import_node_path41 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -56331,14 +56706,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path40.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs43.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path41.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs44.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs43.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs44.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines2 = [
     `# ${projectName}`,
     "",
@@ -56357,8 +56732,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs43.existsSync)((0, import_node_path40.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
-    (0, import_node_fs43.existsSync)((0, import_node_path40.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
+    (0, import_node_fs44.existsSync)((0, import_node_path41.join)(repoRoot2, "architecture.md")) ? `- [Hub architecture](${targetBase}/blob/${targetBranch}/architecture.md)` : "",
+    (0, import_node_fs44.existsSync)((0, import_node_path41.join)(repoRoot2, "docs", "Architecture", "agentic-dev-environment.md")) ? `- [Agentic development environment](${targetBase}/blob/${targetBranch}/docs/Architecture/agentic-dev-environment.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines2.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines2.join("\n")}
@@ -56380,8 +56755,8 @@ async function syncProjectInfo(plan, client, apply) {
 }
 
 // src/train-commands.ts
-var import_node_fs44 = require("node:fs");
-var import_node_path41 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path42 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -56396,7 +56771,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs44.readFileSync)((0, import_node_path41.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -56507,7 +56882,7 @@ function releaseProgressVerdict(status, subject = "Release") {
 
 // src/suite-pin.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 var SuitePinError = class _SuitePinError extends Error {
   diagnostic;
   constructor(repo, tag, error) {
@@ -56575,8 +56950,8 @@ async function openSuiteCutPinPr(deps, input) {
       if (input.carriedOnly) return { status: "unchanged" };
       throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
     }
-    await (0, import_promises6.mkdir)((0, import_node_path42.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path42.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path43.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path43.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", prs.length ? branch : "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     if (prs.length) {
@@ -56588,7 +56963,7 @@ async function openSuiteCutPinPr(deps, input) {
       await run("git", ["switch", "-c", branch]);
     }
     for (const stage of ["rc", "main"]) {
-      const path2 = (0, import_node_path42.join)(scratch, `${stage}-pins.json`);
+      const path2 = (0, import_node_path43.join)(scratch, `${stage}-pins.json`);
       await (0, import_promises6.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
@@ -56641,12 +57016,12 @@ async function openSuiteRestorePinPr(deps, input) {
       }
     });
     if (!todo.length) return void 0;
-    await (0, import_promises6.mkdir)((0, import_node_path42.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path42.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path43.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path43.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
-    const path2 = (0, import_node_path42.join)(scratch, "main-pins.json");
+    const path2 = (0, import_node_path43.join)(scratch, "main-pins.json");
     await (0, import_promises6.writeFile)(path2, JSON.stringify(todo.map((p) => ({ module: p.module, url: p.prior }))));
     await run("node", ["scripts/pin-modules.mjs", "--stage", "main", "--pins", path2]);
     await run("git", ["add", "seed/modules.json"]);
@@ -56720,8 +57095,8 @@ async function openSuitePinPr(deps, input) {
     if (newer.length) return { status: "superseded", pr: newer[0].url, url: pin };
     const open2 = onBranch.find((p) => p.state === "OPEN");
     if (open2 && tagOf(open2.title ?? "") === tag) return { status: "pending", pr: open2.url, url: pin };
-    await (0, import_promises6.mkdir)((0, import_node_path42.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path42.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path43.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path43.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     await run("git", ["switch", "-c", branch]);
@@ -56773,7 +57148,7 @@ function prTitleRefusal(title) {
 
 // src/command-register-collaboration.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_fs53 = require("node:fs");
+var import_node_fs54 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -56797,7 +57172,7 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path49 = require("node:path");
+var import_node_path50 = require("node:path");
 init_house_map();
 
 // src/issue-body.ts
@@ -56914,7 +57289,7 @@ init_github_client();
 init_github_quota();
 
 // src/issue-commands.ts
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 var import_node_crypto22 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
@@ -57107,7 +57482,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs45.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs46.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -57774,7 +58149,7 @@ function extendCreateCommand(issue, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs45.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs46.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) {
           const top = specs === null ? "null" : typeof specs === "object" ? `an object with keys: ${Object.keys(specs).join(", ") || "(none)"}` : `a ${typeof specs}`;
@@ -57851,8 +58226,8 @@ ${lines2}`, {
 }
 
 // src/post-merge-recon.ts
-var import_node_fs46 = require("node:fs");
-var import_node_path43 = require("node:path");
+var import_node_fs47 = require("node:fs");
+var import_node_path44 = require("node:path");
 
 // src/cross-repo-filing-issue.ts
 init_github_client();
@@ -58022,16 +58397,16 @@ function buildPostMergeReconRecovery(input) {
 }
 function writePostMergeReconRecovery(cwd, recovery) {
   const path2 = postMergeReconStatePath(cwd, recovery.repo, recovery.pr);
-  (0, import_node_fs46.mkdirSync)((0, import_node_path43.dirname)(path2), { recursive: true });
-  (0, import_node_fs46.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
+  (0, import_node_fs47.mkdirSync)((0, import_node_path44.dirname)(path2), { recursive: true });
+  (0, import_node_fs47.writeFileSync)(path2, `${JSON.stringify(recovery, null, 2)}
 `, "utf8");
   return path2;
 }
 function clearPostMergeReconRecovery(cwd, repo, pr) {
   const path2 = postMergeReconStatePath(cwd, repo, pr);
-  if (!(0, import_node_fs46.existsSync)(path2)) return;
+  if (!(0, import_node_fs47.existsSync)(path2)) return;
   try {
-    (0, import_node_fs46.unlinkSync)(path2);
+    (0, import_node_fs47.unlinkSync)(path2);
   } catch {
   }
 }
@@ -58066,7 +58441,7 @@ var import_promises7 = require("node:fs/promises");
 init_cli_shared();
 
 // src/api-read.ts
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 init_cli_shared();
 var API_ACCEPT_HEADERS = {
   json: "application/vnd.github+json",
@@ -58331,7 +58706,7 @@ function registerApiReadCommands(program3, overrides) {
       if (req.workflowRuns) body = sliceWorkflowRunsPage(body, req.workflowRuns);
       if (o.jq !== void 0) body = await jqRun(o.jq, body, localJqEnv(), ...bindings.length ? [bindings] : []);
       if (zip) {
-        (0, import_node_fs47.writeFileSync)(o.out, body, "latin1");
+        (0, import_node_fs48.writeFileSync)(o.out, body, "latin1");
         return;
       }
     } catch (e) {
@@ -59872,9 +60247,9 @@ function registerPrLifecycleCommands(program3) {
 
 // src/review-verdict.ts
 var import_node_child_process15 = require("node:child_process");
-var import_node_fs48 = require("node:fs");
+var import_node_fs49 = require("node:fs");
 var import_node_os24 = require("node:os");
-var import_node_path44 = require("node:path");
+var import_node_path45 = require("node:path");
 init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
 var REVIEW_VERDICTS = ["PROCEED", "CORRECT", "ESCALATE"];
@@ -59970,7 +60345,7 @@ async function checkPrReview(number, repo, head, deps = {
   }
 }
 function computePrPatchId(number, repo) {
-  return new Promise((resolve7, reject2) => {
+  return new Promise((resolve8, reject2) => {
     const gh2 = (0, import_node_child_process15.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     const git3 = (0, import_node_child_process15.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
     let out = "";
@@ -60008,7 +60383,7 @@ function computePrPatchId(number, repo) {
       if (gitCode !== 0) return reject2(new Error(`git patch-id --stable exited ${gitCode}: ${gitErr.trim()}`));
       const id = out.trim().split(/\s+/)[0];
       if (!/^[0-9a-f]{40}$/.test(id ?? "")) return reject2(new Error(`patch-id: PR #${number} diff is empty or unreadable (gh: ${ghErr.trim() || "no stderr"})`));
-      resolve7(id);
+      resolve8(id);
     };
     gh2.on("close", (code) => {
       ghCode = code;
@@ -60039,15 +60414,15 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs48.mkdtempSync)((0, import_node_path44.join)((0, import_node_os24.tmpdir)(), "mmi-review-verdict-"));
-  const path2 = (0, import_node_path44.join)(dir, "body.md");
+  const dir = (0, import_node_fs49.mkdtempSync)((0, import_node_path45.join)((0, import_node_os24.tmpdir)(), "mmi-review-verdict-"));
+  const path2 = (0, import_node_path45.join)(dir, "body.md");
   try {
-    (0, import_node_fs48.writeFileSync)(path2, body, "utf8");
+    (0, import_node_fs49.writeFileSync)(path2, body, "utf8");
     const { stdout } = await execFileP("gh", ["pr", "comment", number, "--repo", repo, "--body-file", path2], { timeout: GH_MUTATION_TIMEOUT_MS });
     return stdout.trim();
   } finally {
     try {
-      (0, import_node_fs48.rmSync)(dir, { recursive: true, force: true });
+      (0, import_node_fs49.rmSync)(dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -60202,7 +60577,7 @@ init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
   if (paths.length === 0) return Promise.resolve([]);
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const chunks = [];
     let settled2 = false;
     const child2 = (0, import_node_child_process16.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
@@ -60210,7 +60585,7 @@ function catFileBatch(root, ref, paths) {
       if (settled2) return;
       settled2 = true;
       clearTimeout(timer);
-      resolve7(ok ? parseCatFileBatch(Buffer.concat(chunks), paths.length) : []);
+      resolve8(ok ? parseCatFileBatch(Buffer.concat(chunks), paths.length) : []);
     };
     const timer = setTimeout(() => {
       child2.kill("SIGKILL");
@@ -60460,18 +60835,18 @@ function createPreparationDeps(input, io = {}) {
 }
 
 // src/worktree-residue-sweep.ts
-var import_node_fs52 = require("node:fs");
-var import_node_path48 = require("node:path");
+var import_node_fs53 = require("node:fs");
+var import_node_path49 = require("node:path");
 
 // src/worktree-merge-cleanup.ts
-var import_node_fs51 = require("node:fs");
-var import_node_path47 = require("node:path");
+var import_node_fs52 = require("node:fs");
+var import_node_path48 = require("node:path");
 init_cli_shared();
 
 // src/stage-runner.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs50 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_fs51 = require("node:fs");
+var import_node_path47 = require("node:path");
 var import_node_net = require("node:net");
 var import_node_util5 = require("node:util");
 
@@ -60481,8 +60856,8 @@ function normalizeEol2(s) {
 }
 
 // src/env-detection.ts
-var import_node_fs49 = require("node:fs");
-var import_node_path45 = require("node:path");
+var import_node_fs50 = require("node:fs");
+var import_node_path46 = require("node:path");
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".jerv", ".pi", ".venv", "venv"]);
 function isEnvBaseName(name) {
   return name.toLowerCase() === ".env";
@@ -60492,7 +60867,7 @@ function findEnvFiles(root) {
   const walk2 = (dir, rel) => {
     let entries;
     try {
-      entries = (0, import_node_fs49.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs50.readdirSync)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -60500,13 +60875,13 @@ function findEnvFiles(root) {
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         if (SKIPPED_DIRS.has(entry.name)) continue;
-        walk2((0, import_node_path45.join)(dir, entry.name), relPath);
+        walk2((0, import_node_path46.join)(dir, entry.name), relPath);
         continue;
       }
       if (isEnvBaseName(entry.name)) {
         let isDir = false;
         try {
-          isDir = (0, import_node_fs49.lstatSync)((0, import_node_path45.join)(dir, entry.name)).isDirectory();
+          isDir = (0, import_node_fs50.lstatSync)((0, import_node_path46.join)(dir, entry.name)).isDirectory();
         } catch {
         }
         if (!isDir) found.push(relPath);
@@ -60645,12 +61020,12 @@ var DOCKER_TIMEOUT_MS = 15e3;
 function stageBash() {
   if (process.platform !== "win32") return "bash";
   const configured = process.env.SHELL;
-  if (configured && (0, import_node_path46.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs50.existsSync)(configured)) return configured;
+  if (configured && (0, import_node_path47.isAbsolute)(configured) && /[/\\]bash(?:\.exe)?$/i.test(configured) && !/[/\\](?:System32|Sysnative)[/\\]bash(?:\.exe)?$/i.test(configured) && (0, import_node_fs51.existsSync)(configured)) return configured;
   const candidates = [
-    (0, import_node_path46.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
-    ...process.env.LOCALAPPDATA ? [(0, import_node_path46.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
+    (0, import_node_path47.join)(process.env.ProgramFiles || "C:\\Program Files", "Git", "bin", "bash.exe"),
+    ...process.env.LOCALAPPDATA ? [(0, import_node_path47.join)(process.env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe")] : []
   ];
-  const bash = candidates.find((path2) => (0, import_node_fs50.existsSync)(path2));
+  const bash = candidates.find((path2) => (0, import_node_fs51.existsSync)(path2));
   if (!bash) throw new Error("Local stages require Git Bash on Windows. Install Git for Windows or set SHELL to its absolute bash.exe path.");
   return bash;
 }
@@ -60671,7 +61046,7 @@ function healthPollIntervalMs() {
   return HEALTH_POLL_INTERVAL_MS;
 }
 function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
-  return new Promise((resolve7, reject2) => {
+  return new Promise((resolve8, reject2) => {
     let settled2 = false;
     const finish = (fn) => {
       if (settled2) return;
@@ -60681,7 +61056,7 @@ function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
       child2.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve7), graceMs);
+    const timer = setTimeout(() => finish(resolve8), graceMs);
     child2.on("error", (err) => finish(() => reject2(new Error(`stage process failed to start: ${err.message}`))));
     child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -60788,7 +61163,7 @@ function appendForceRecreate(up) {
   return `${up.trimEnd()} --force-recreate`;
 }
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path46.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path47.join)(cwd, "tmp", "stage", "state.json");
 }
 function normPath(path2) {
   return path2.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
@@ -60874,10 +61249,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve7(false));
-    srv.once("listening", () => srv.close(() => resolve7(true)));
+    srv.once("error", () => resolve8(false));
+    srv.once("listening", () => srv.close(() => resolve8(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -61005,8 +61380,8 @@ function stageProcessEnv(stagePort, extraEnv) {
 }
 function composeResolvesPort(cwd) {
   if (process.env.PORT) return true;
-  const envFile = (0, import_node_path46.join)(cwd, ".env");
-  return (0, import_node_fs50.existsSync)(envFile) && envFileKeys((0, import_node_fs50.readFileSync)(envFile, "utf8")).has("PORT");
+  const envFile = (0, import_node_path47.join)(cwd, ".env");
+  return (0, import_node_fs51.existsSync)(envFile) && envFileKeys((0, import_node_fs51.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
   const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
@@ -61021,13 +61396,13 @@ function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
 function stageComposeFiles(cwd) {
   const files = ["docker-compose.yml"];
   for (const conventional of ["docker-compose.override.yml", "docker-compose.override.yaml"]) {
-    if ((0, import_node_fs50.existsSync)((0, import_node_path46.join)(cwd, conventional))) files.push(conventional);
+    if ((0, import_node_fs51.existsSync)((0, import_node_path47.join)(cwd, conventional))) files.push(conventional);
   }
   return [...files, RUNTIME_ENV_OVERRIDE_RELPATH];
 }
 async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   const keys = Object.keys(vaultEnvMerge ?? {});
-  if (!keys.length || !(0, import_node_fs50.existsSync)((0, import_node_path46.join)(cwd, "docker-compose.yml"))) return {};
+  if (!keys.length || !(0, import_node_fs51.existsSync)((0, import_node_path47.join)(cwd, "docker-compose.yml"))) return {};
   let configJson;
   try {
     const { stdout } = await execFileP3("docker", ["compose", "config", "--format", "json"], {
@@ -61043,21 +61418,21 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   }
   const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson), runtimeEnvSelects(configJson));
   if (!body) return {};
-  const overridePath = (0, import_node_path46.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
-  (0, import_node_fs50.mkdirSync)((0, import_node_path46.join)(cwd, "tmp", "stage"), { recursive: true });
-  (0, import_node_fs50.writeFileSync)(overridePath, body, "utf8");
+  const overridePath = (0, import_node_path47.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
+  (0, import_node_fs51.mkdirSync)((0, import_node_path47.join)(cwd, "tmp", "stage"), { recursive: true });
+  (0, import_node_fs51.writeFileSync)(overridePath, body, "utf8");
   return stageComposeFileEnv(stageComposeFiles(cwd));
 }
 async function ensureStageRuntimeEnv(config, opts, cwd) {
   if (!config.ensureEnv) return;
-  const target = (0, import_node_path46.join)(cwd, config.ensureEnv.target);
-  const example = (0, import_node_path46.join)(cwd, config.ensureEnv.example);
-  if (!(0, import_node_fs50.existsSync)(target) && (0, import_node_fs50.existsSync)(example)) {
-    (0, import_node_fs50.copyFileSync)(example, target);
-  } else if ((0, import_node_fs50.existsSync)(target) && (0, import_node_fs50.existsSync)(example)) {
-    const stale = detectStaleEnvFile((0, import_node_fs50.readFileSync)(example, "utf8"), (0, import_node_fs50.readFileSync)(target, "utf8"), {
-      exampleMtimeMs: (0, import_node_fs50.statSync)(example).mtimeMs,
-      targetMtimeMs: (0, import_node_fs50.statSync)(target).mtimeMs
+  const target = (0, import_node_path47.join)(cwd, config.ensureEnv.target);
+  const example = (0, import_node_path47.join)(cwd, config.ensureEnv.example);
+  if (!(0, import_node_fs51.existsSync)(target) && (0, import_node_fs51.existsSync)(example)) {
+    (0, import_node_fs51.copyFileSync)(example, target);
+  } else if ((0, import_node_fs51.existsSync)(target) && (0, import_node_fs51.existsSync)(example)) {
+    const stale = detectStaleEnvFile((0, import_node_fs51.readFileSync)(example, "utf8"), (0, import_node_fs51.readFileSync)(target, "utf8"), {
+      exampleMtimeMs: (0, import_node_fs51.statSync)(example).mtimeMs,
+      targetMtimeMs: (0, import_node_fs51.statSync)(target).mtimeMs
     });
     if (stale) {
       const msg = `stale ${config.ensureEnv.target} (${stale}) \u2014 delete it or refresh from ${config.ensureEnv.example} before re-running mmi-cli stage`;
@@ -61065,8 +61440,8 @@ async function ensureStageRuntimeEnv(config, opts, cwd) {
       console.error(`mmi-cli stage: ${msg} (allowed via --allow-stale-env)`);
     }
   }
-  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs50.existsSync)(target)) {
-    (0, import_node_fs50.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs50.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
+  if (opts.vaultEnvMerge && Object.keys(opts.vaultEnvMerge).length && (0, import_node_fs51.existsSync)(target)) {
+    (0, import_node_fs51.writeFileSync)(target, mergeEnvSecretsIntoFile((0, import_node_fs51.readFileSync)(target, "utf8"), opts.vaultEnvMerge), "utf8");
   }
 }
 async function gitText(cwd, args) {
@@ -61096,20 +61471,20 @@ async function resolveGlobalStatePath(cwd, explicit) {
   return void 0;
 }
 function readState(path2) {
-  if (!(0, import_node_fs50.existsSync)(path2)) return null;
+  if (!(0, import_node_fs51.existsSync)(path2)) return null;
   try {
-    return JSON.parse((0, import_node_fs50.readFileSync)(path2, "utf8"));
+    return JSON.parse((0, import_node_fs51.readFileSync)(path2, "utf8"));
   } catch {
     return null;
   }
 }
 function mkdirFor(path2) {
   const dir = path2.slice(0, Math.max(path2.lastIndexOf("/"), path2.lastIndexOf("\\")));
-  (0, import_node_fs50.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs51.mkdirSync)(dir, { recursive: true });
 }
 function writeState(path2, state) {
   mkdirFor(path2);
-  (0, import_node_fs50.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
+  (0, import_node_fs51.writeFileSync)(path2, JSON.stringify(state, null, 2), "utf8");
 }
 function writeStagePortReservation(port, cwd, statePath, globalStatePath, now) {
   const reservation = {
@@ -61138,7 +61513,7 @@ async function cleanupStageState(state, paths, timeoutMs, fallbackCwd, currentEn
     );
   }
   for (const path2 of [...new Set(paths.filter((p) => Boolean(p)))]) {
-    (0, import_node_fs50.rmSync)(path2, { force: true });
+    (0, import_node_fs51.rmSync)(path2, { force: true });
   }
 }
 async function killTree(pid) {
@@ -61155,7 +61530,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve7) => setTimeout(resolve7, 500));
+  await new Promise((resolve8) => setTimeout(resolve8, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -61228,7 +61603,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve7) => setTimeout(resolve7, healthPollIntervalMs()));
+    await new Promise((resolve8) => setTimeout(resolve8, healthPollIntervalMs()));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -61385,8 +61760,8 @@ async function runStage(config = {}, opts = {}) {
       });
     }
   } catch (e) {
-    (0, import_node_fs50.rmSync)(statePath, { force: true });
-    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs50.rmSync)(globalStatePath, { force: true });
+    (0, import_node_fs51.rmSync)(statePath, { force: true });
+    if (globalStatePath && globalStatePath !== statePath) (0, import_node_fs51.rmSync)(globalStatePath, { force: true });
     throw e;
   }
   const started = await startStage(config, {
@@ -61405,9 +61780,9 @@ function normPath2(p) {
   return p.replace(/\\/g, "/").replace(/\/+$/, "");
 }
 function unlinkNodeModulesJunction(wtPath) {
-  const nm = (0, import_node_path47.join)(wtPath, "node_modules");
+  const nm = (0, import_node_path48.join)(wtPath, "node_modules");
   try {
-    if ((0, import_node_fs51.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs51.rmdirSync)(nm);
+    if ((0, import_node_fs52.lstatSync)(nm).isSymbolicLink()) (0, import_node_fs52.rmdirSync)(nm);
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -61415,11 +61790,11 @@ function unlinkNodeModulesJunction(wtPath) {
   }
 }
 function defaultSleep2(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
-  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs51.rmdirSync, exists = import_node_fs51.existsSync } = options;
-  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs51.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
+  const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs52.rmdirSync, exists = import_node_fs52.existsSync } = options;
+  const removeRecursive = options.removeRecursive ?? ((path2) => (0, import_node_fs52.rmSync)(path2, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 }));
   const junction = unlinkNodeModulesJunction(wtPath);
   if (!junction.ok) return junction;
   try {
@@ -61542,28 +61917,28 @@ async function preCleanWorktreeForRemoval(wtPath, execGit) {
 }
 async function listNestedIgnoredNodeModules(wtPath, execGit) {
   const out = await execGit(["-C", wtPath, "ls-files", "--others", "--ignored", "--exclude-standard", "--directory"]).catch(() => "");
-  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path47.join)(wtPath, line.slice(0, -1)));
+  return out.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.endsWith("node_modules/") && line !== "node_modules/").map((line) => (0, import_node_path48.join)(wtPath, line.slice(0, -1)));
 }
 function safeRemoveTree(path2) {
-  const stat4 = (0, import_node_fs51.lstatSync)(path2);
+  const stat4 = (0, import_node_fs52.lstatSync)(path2);
   if (stat4.isSymbolicLink()) {
     try {
-      (0, import_node_fs51.rmdirSync)(path2);
+      (0, import_node_fs52.rmdirSync)(path2);
     } catch {
-      (0, import_node_fs51.unlinkSync)(path2);
+      (0, import_node_fs52.unlinkSync)(path2);
     }
     return;
   }
   if (stat4.isDirectory()) {
-    for (const entry of (0, import_node_fs51.readdirSync)(path2)) safeRemoveTree((0, import_node_path47.join)(path2, entry));
-    (0, import_node_fs51.rmdirSync)(path2);
+    for (const entry of (0, import_node_fs52.readdirSync)(path2)) safeRemoveTree((0, import_node_path48.join)(path2, entry));
+    (0, import_node_fs52.rmdirSync)(path2);
     return;
   }
-  (0, import_node_fs51.unlinkSync)(path2);
+  (0, import_node_fs52.unlinkSync)(path2);
 }
 async function removeWorktreeNodeModules(wtPath) {
   try {
-    safeRemoveTree((0, import_node_path47.join)(wtPath, "node_modules"));
+    safeRemoveTree((0, import_node_path48.join)(wtPath, "node_modules"));
     return { ok: true };
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true };
@@ -61575,7 +61950,7 @@ function errorMessage(e) {
 }
 function resolvedOrRaw(path2) {
   try {
-    return normPath2((0, import_node_fs51.realpathSync)(path2));
+    return normPath2((0, import_node_fs52.realpathSync)(path2));
   } catch {
     return normPath2(path2);
   }
@@ -61583,10 +61958,10 @@ function resolvedOrRaw(path2) {
 function unlinkEscapingReparsePoints(root, primaryRoot) {
   let realRoot;
   try {
-    if ((0, import_node_fs51.lstatSync)(root).isSymbolicLink()) {
+    if ((0, import_node_fs52.lstatSync)(root).isSymbolicLink()) {
       return { ok: false, error: `delete root ${normPath2(root)} is a reparse point resolving to ${resolvedOrRaw(root)}` };
     }
-    realRoot = normPath2((0, import_node_fs51.realpathSync)(root));
+    realRoot = normPath2((0, import_node_fs52.realpathSync)(root));
   } catch (e) {
     if (e.code === "ENOENT") return { ok: true, unlinked: [] };
     return { ok: false, error: `cannot resolve delete root ${normPath2(root)}: ${errorMessage(e)}` };
@@ -61602,17 +61977,17 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = (0, import_node_fs51.readdirSync)(dir, { withFileTypes: true });
+      entries = (0, import_node_fs52.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
       if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
-      const child2 = (0, import_node_path47.join)(dir, entry.name);
+      const child2 = (0, import_node_path48.join)(dir, entry.name);
       if (entry.isSymbolicLink()) {
         let target = "";
         try {
-          target = normPath2((0, import_node_fs51.realpathSync)(child2));
+          target = normPath2((0, import_node_fs52.realpathSync)(child2));
         } catch {
           target = "";
         }
@@ -61795,7 +62170,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
     return report;
   }
   const execGit = options.execGit ?? (async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
-  const pathExists = options.pathExists ?? import_node_fs51.existsSync;
+  const pathExists = options.pathExists ?? import_node_fs52.existsSync;
   let afterWorktrees = [];
   try {
     afterWorktrees = parseGitWorktreePorcelain(await execGit(["worktree", "list", "--porcelain"]));
@@ -61935,7 +62310,7 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   const preHelperGuard = unlinkEscapingReparsePoints(wtPath, options.primaryRoot);
   if (!preHelperGuard.ok) return refuseReparseEscape(preHelperGuard.error);
   unlinkedReparsePoints.push(...preHelperGuard.unlinked);
-  if (pathExists((0, import_node_path47.join)(wtPath, "node_modules"))) {
+  if (pathExists((0, import_node_path48.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? removeWorktreeNodeModules)(wtPath);
     if (!nmRemoved.ok) {
       report.worktree = {
@@ -62071,18 +62446,18 @@ function renderPrMergeCleanupLines(cleanup) {
 // src/worktree-residue-sweep.ts
 var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
 function canonicalWorktreeRoot(primary) {
-  return (0, import_node_path48.join)((0, import_node_path48.dirname)(primary), "mmi-worktrees", (0, import_node_path48.basename)(primary));
+  return (0, import_node_path49.join)((0, import_node_path49.dirname)(primary), "mmi-worktrees", (0, import_node_path49.basename)(primary));
 }
-function norm(p) {
+function norm2(p) {
   const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? s.toLowerCase() : s;
 }
 function residueLedgerPath(gitCommonDir) {
-  return (0, import_node_path48.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
+  return (0, import_node_path49.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
 }
 function readPaths(file, deps) {
   try {
-    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs52.readFileSync)(f, "utf8")))(file));
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs53.readFileSync)(f, "utf8")))(file));
     return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -62091,8 +62466,8 @@ function readPaths(file, deps) {
 function writePaths(file, paths, deps) {
   try {
     const write = deps.writeLedger ?? ((f, t) => {
-      (0, import_node_fs52.mkdirSync)((0, import_node_path48.dirname)(f), { recursive: true });
-      (0, import_node_fs52.writeFileSync)(f, t, "utf8");
+      (0, import_node_fs53.mkdirSync)((0, import_node_path49.dirname)(f), { recursive: true });
+      (0, import_node_fs53.writeFileSync)(f, t, "utf8");
     });
     write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
 `);
@@ -62102,29 +62477,29 @@ function writePaths(file, paths, deps) {
 function recordResidue(gitCommonDir, path2, deps = {}) {
   const file = residueLedgerPath(gitCommonDir);
   const paths = readPaths(file, deps);
-  if (!paths.some((p) => norm(p) === norm(path2))) paths.push(path2);
+  if (!paths.some((p) => norm2(p) === norm2(path2))) paths.push(path2);
   writePaths(file, paths, deps);
 }
 async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
-  const exists = deps.exists ?? import_node_fs52.existsSync;
-  const readDir = deps.readDir ?? ((p) => (0, import_node_fs52.readdirSync)(p));
+  const exists = deps.exists ?? import_node_fs53.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs53.readdirSync)(p));
   const isDir = deps.isDir ?? ((p) => {
     try {
-      return (0, import_node_fs52.statSync)(p).isDirectory();
+      return (0, import_node_fs53.statSync)(p).isDirectory();
     } catch {
       return false;
     }
   });
   const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
-  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs52.rmdirSync)(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs53.rmdirSync)(p));
   const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
-  const live = new Set(registered.map(norm));
-  const primary = registered[0] ? norm(registered[0]) : void 0;
+  const live = new Set(registered.map(norm2));
+  const primary = registered[0] ? norm2(registered[0]) : void 0;
   const file = residueLedgerPath(gitCommonDir);
   const recorded = readPaths(file, deps);
   const remaining = [];
   for (const path2 of recorded) {
-    const key = norm(path2);
+    const key = norm2(path2);
     if (live.has(key) || key === primary) {
       report.dropped.push(path2);
       continue;
@@ -62141,9 +62516,9 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     }
   }
   if (recorded.length) writePaths(file, remaining, deps);
-  const keptKeys = new Set(remaining.map(norm));
+  const keptKeys = new Set(remaining.map(norm2));
   const root = registered[0] ? canonicalWorktreeRoot(registered[0]) : void 0;
-  if (root && isDir(root) && !live.has(norm(root))) {
+  if (root && isDir(root) && !live.has(norm2(root))) {
     report.root = root;
     let children = [];
     try {
@@ -62151,8 +62526,8 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     } catch {
     }
     for (const name of children) {
-      const child2 = (0, import_node_path48.join)(root, name);
-      const key = norm(child2);
+      const child2 = (0, import_node_path49.join)(root, name);
+      const key = norm2(child2);
       if (live.has(key) || key === primary || keptKeys.has(key) || !isDir(child2)) continue;
       let entries;
       try {
@@ -62194,10 +62569,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path49.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path50.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs53.existsSync)((0, import_node_path49.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs53.existsSync)((0, import_node_path49.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs54.existsSync)((0, import_node_path50.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs54.existsSync)((0, import_node_path50.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -62209,8 +62584,8 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path49.join)(root, path2);
-      return (0, import_node_fs53.existsSync)(fullPath) ? (0, import_node_fs53.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path50.join)(root, path2);
+      return (0, import_node_fs54.existsSync)(fullPath) ? (0, import_node_fs54.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -63077,11 +63452,11 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path49.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs53.existsSync)(wfDir)) return [];
-    return (0, import_node_fs53.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    const wfDir = (0, import_node_path50.join)(cwd, ".github", "workflows");
+    if (!(0, import_node_fs54.existsSync)(wfDir)) return [];
+    return (0, import_node_fs54.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs53.readFileSync)((0, import_node_path49.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs54.readFileSync)((0, import_node_path50.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -63269,7 +63644,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
       // #5400: after grace, name "GitHub delivered zero runs" instead of burning the full budget as pending.
       pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr checks-wait", number, repo),
       baseBranch,
-      sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+      sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
       log: (message2) => console.warn(message2),
       timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
       // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
@@ -63286,7 +63661,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs53.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs54.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -63449,7 +63824,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
             // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
             pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
             baseBranch: "development",
-            sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+            sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
             log: (message2) => console.warn(message2),
             // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
             // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
@@ -63513,7 +63888,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
             } else {
               lastFailure2 = void 0;
             }
-            await new Promise((resolve7) => setTimeout(resolve7, PR_LAND_POLL_MS));
+            await new Promise((resolve8) => setTimeout(resolve8, PR_LAND_POLL_MS));
           }
           if (lastFailure2) {
             throw new Error(
@@ -63564,7 +63939,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const cleanupMerged = async (r) => {
       if (opts.preserveWorktree) return "cleanup skipped (--preserve-worktree)";
       const ran = await execFileP(process.execPath, [process.argv[1], ...canonicalArgvFor(["pr", "merge", r.pr, "--repo", r.repo])], {
-        cwd: (0, import_node_fs53.existsSync)(cwd0) ? cwd0 : primaryRoot0,
+        cwd: (0, import_node_fs54.existsSync)(cwd0) ? cwd0 : primaryRoot0,
         timeout: GH_MUTATION_TIMEOUT_MS * 3
       }).then((x) => ({ stdout: x.stdout, stderr: x.stderr }), (e) => ({ stdout: e.stdout ?? "", stderr: e.stderr ?? "" }));
       const json = ran.stdout.split("\n").reverse().find((l) => l.startsWith("{"));
@@ -63635,7 +64010,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs53.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs54.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -63667,7 +64042,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path49.join)((0, import_node_path49.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path50.join)((0, import_node_path50.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -63705,7 +64080,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         checksDiagnosticCommand: `gh pr checks ${number} --repo ${repo}`,
         pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr merge --wait", number, repo),
         baseBranch,
-        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+        sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
         progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -63786,7 +64161,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs53.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs54.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -63795,7 +64170,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
       }
       if (!o.auto && mergeRejectedBaseBranchModified(message2)) {
         console.warn(`pr merge: the base branch was modified by a concurrent merge \u2014 waiting ${PR_MERGE_BASE_RACE_RETRY_DELAY_MS / 1e3}s and retrying PR #${number}'s merge once (#6052).`);
-        await new Promise((resolve7) => setTimeout(resolve7, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
+        await new Promise((resolve8) => setTimeout(resolve8, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
         await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
           const m2 = String(e2.message || "");
           if (/already been merged/i.test(m2)) {
@@ -63901,7 +64276,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     let residueSweep;
     if (!(foreignCwd && !foreignCheckout)) {
       try {
-        gitCommonDir = (0, import_node_path49.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
+        gitCommonDir = (0, import_node_path50.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
         residueSweep = await sweepWorktreeResidue(gitCommonDir, beforeWorktrees.map((w) => w.path));
       } catch {
       }
@@ -63919,7 +64294,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs53.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs54.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -64060,7 +64435,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
           console.warn(`ci checks-wait: zero-runs probe FAILED (${read.error}) \u2014 not treating as delivery failure this cycle`);
           return null;
         },
-        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+        sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: timeoutMs ?? PR_CHECKS_TIMEOUT_MS,
         progress: ({ state, elapsedMs, remainingMs, detail }) => console.warn(`ci checks-wait: ${detail && detail.startsWith("pending (") ? detail : state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -64197,8 +64572,14 @@ function trainApplyDeps() {
     },
     // Hub-App-authority dispatch of the central tenant deploy (#953) — the Hub fires the
     // workflow_dispatch with its App token, so the caller needs no MMI-Hub Actions write.
-    dispatchTenantDeploy: async ({ repo, stage, ref }) => {
-      const res = await tenantDeploy({ repo, stage, ref }, registryClientDeps(await loadConfig()));
+    readDeployedSha: async (slug, stage) => (await fetchDeployFactsBySlug(slug, registryClientDeps(await loadConfig())))?.stages[stage]?.deployedTag,
+    compareDeployRef: async (repo, base, head) => (await defaultGitHubClient().rest(
+      "GET",
+      `repos/${repo}/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}?per_page=1`,
+      { timeoutMs: GH_TRAIN_TIMEOUT_MS }
+    )).status,
+    dispatchTenantDeploy: async ({ repo, stage, ref, rollback }) => {
+      const res = await tenantDeploy({ repo, stage, ref, ...rollback ? { rollback } : {} }, registryClientDeps(await loadConfig()));
       if (!res.ok) {
         const detail = res.body?.error ?? res.error ?? `HTTP ${res.status}`;
         throw new Error(`tenant deploy dispatch failed: ${detail}`);
@@ -64450,7 +64831,7 @@ function hotfixFollowUpLegs(runs2, foldPort, alignment, foldNote, deployNote) {
   }
   return legs;
 }
-async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))) {
+async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))) {
   for (let attempt = 0; ; attempt++) {
     try {
       return await cb(repo, true);
@@ -65185,7 +65566,7 @@ function rcRunCauseFromLog(log) {
 function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
-var suiteStateDir = (root) => (0, import_node_path51.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+var suiteStateDir = (root) => (0, import_node_path52.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
 async function runSuiteMemberRcand(repo, previousRc, rcWasAbsent) {
   const deps = trainApplyDeps();
   deps.suiteCut = suiteCutContext(repo, SUITE_REPO);
@@ -65204,8 +65585,8 @@ async function rcandInCheckout(repo, deps, previousRc, rcWasAbsent) {
     const meta = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
     if (!meta.ok || meta.project?.releaseTrack !== "full" || meta.project.suite !== "mm-work")
       throw new Error(`${repo}: first rc branch requires releaseTrack full and suite=mm-work in META; no branch created`);
-    const main = (await deps.run("git", ["rev-parse", "origin/main"])).trim();
-    if (main.toLowerCase() !== previousRc.toLowerCase()) throw new Error(`${repo}: main moved since the cut snapshot; no rc branch created`);
+    const main2 = (await deps.run("git", ["rev-parse", "origin/main"])).trim();
+    if (main2.toLowerCase() !== previousRc.toLowerCase()) throw new Error(`${repo}: main moved since the cut snapshot; no rc branch created`);
     await deps.run("git", ["push", "origin", `${previousRc}:refs/heads/rc`]);
     await deps.run("git", ["fetch", "origin", "rc"]);
     rcNow = (await deps.run("git", ["rev-parse", "origin/rc"])).trim();
@@ -65232,16 +65613,16 @@ async function rcandInCheckout(repo, deps, previousRc, rcWasAbsent) {
   }
 }
 function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
-  const recordPath = (0, import_node_path51.join)(suiteStateDir(root), "cut.json");
-  const base = (0, import_node_path51.join)(suiteStateDir(root), "checkouts");
+  const recordPath = (0, import_node_path52.join)(suiteStateDir(root), "cut.json");
+  const base = (0, import_node_path52.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path51.join)(base, repo.split("/")[1]);
-    if (!(0, import_node_fs54.existsSync)(target)) {
-      (0, import_node_fs54.mkdirSync)(base, { recursive: true });
+    const target = (0, import_node_path52.join)(base, repo.split("/")[1]);
+    if (!(0, import_node_fs55.existsSync)(target)) {
+      (0, import_node_fs55.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs54.existsSync)((0, import_node_path51.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs55.existsSync)((0, import_node_path52.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -65305,7 +65686,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (repo === SUITE_REPO) return inTrain(repo, (deps) => rcandInCheckout(repo, deps, previousRc, rcWasAbsent));
     const target = await checkout(repo);
     return new Promise((resolveResult, reject2) => {
-      const child2 = (0, import_node_child_process19.fork)((0, import_node_path50.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
+      const child2 = (0, import_node_child_process19.fork)((0, import_node_path51.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
         cwd: target,
         stdio: ["ignore", "inherit", "inherit", "ipc"],
         execArgv: []
@@ -65377,7 +65758,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (!reuse) await gh(["workflow", "run", "module-rc-publish.yml", "--repo", "mutmutco/MMI-Hub", ...fields.flatMap((f) => ["--field", f])]);
     let candidate = reuse;
     for (let i = 0; !candidate && i < 25; i++) {
-      await new Promise((resolve7) => setTimeout(resolve7, 1e3));
+      await new Promise((resolve8) => setTimeout(resolve8, 1e3));
       candidate = (await rcRuns()).find((r) => r.displayTitle === title && Date.parse(r.createdAt) >= since);
     }
     if (!candidate) throw new Error(`workflow dispatch outcome ambiguous for "${title}"; inspect Actions before retrying`);
@@ -65533,7 +65914,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       for (let i = 0; ; i++) {
         const pin = await openSuitePinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, { repo, tag, stage: "main" });
         if (pin.status !== "pending" || i >= 40) return pin;
-        await new Promise((resolve7) => setTimeout(resolve7, 3e4));
+        await new Promise((resolve8) => setTimeout(resolve8, 3e4));
       }
     },
     suiteMapping: async (leadTag) => {
@@ -65548,9 +65929,9 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
-      (0, import_node_fs54.mkdirSync)(dir, { recursive: true });
-      const file = (0, import_node_path51.join)(dir, `notes-${leadTag}.md`);
-      (0, import_node_fs54.writeFileSync)(file, `${body}
+      (0, import_node_fs55.mkdirSync)(dir, { recursive: true });
+      const file = (0, import_node_path52.join)(dir, `notes-${leadTag}.md`);
+      (0, import_node_fs55.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
       await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
@@ -65591,7 +65972,7 @@ ${suiteMappingBlock(leadTag, mapping)}`);
 
 // src/suite-commands.ts
 init_cli_shared();
-var import_node_fs55 = require("node:fs");
+var import_node_fs56 = require("node:fs");
 function parseMemberSummaryFiles(entries) {
   const memberSummaryFiles = {};
   for (const entry of entries) {
@@ -65615,7 +65996,7 @@ function suiteRcDataProdDeps() {
       const rc = facts.stages.rc;
       return rc?.present ? rc.substrate ?? "an unnamed substrate" : null;
     },
-    sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
+    sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))
   };
 }
 function registerSuiteCommands(program3) {
@@ -65685,7 +66066,7 @@ function registerSuiteCommands(program3) {
       try {
         const io = suiteTrainIo(root);
         retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
-        if (retired && !(0, import_node_fs55.existsSync)(io.recordPath)) {
+        if (retired && !(0, import_node_fs56.existsSync)(io.recordPath)) {
           console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
           return;
         }
@@ -65925,9 +66306,9 @@ function registerJevCommands(program3) {
 
 // src/packages-adopt-export.ts
 var import_node_child_process20 = require("node:child_process");
-var import_node_fs56 = require("node:fs");
+var import_node_fs57 = require("node:fs");
 var import_node_os25 = require("node:os");
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 var import_node_util6 = require("node:util");
 init_cli_shared();
 
@@ -66547,38 +66928,38 @@ function expectedFromRun(run, opts) {
 }
 async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
-  const packagePath = (0, import_node_path52.join)(opts.dir, "package.json");
-  const lockPath = (0, import_node_path52.join)(opts.dir, "package-lock.json");
-  const packageText = (0, import_node_fs56.readFileSync)(packagePath, "utf8");
-  const lockText = (0, import_node_fs56.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs56.mkdtempSync)((0, import_node_path52.join)((0, import_node_os25.tmpdir)(), "mmi-adopt-export-"));
+  const packagePath = (0, import_node_path53.join)(opts.dir, "package.json");
+  const lockPath = (0, import_node_path53.join)(opts.dir, "package-lock.json");
+  const packageText = (0, import_node_fs57.readFileSync)(packagePath, "utf8");
+  const lockText = (0, import_node_fs57.readFileSync)(lockPath, "utf8");
+  const work = (0, import_node_fs57.mkdtempSync)((0, import_node_path53.join)((0, import_node_os25.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs56.writeFileSync)((0, import_node_path52.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs56.writeFileSync)((0, import_node_path52.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs56.writeFileSync)((0, import_node_path52.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
-    const script = (0, import_node_path52.join)(work, "package_export.py");
-    (0, import_node_fs56.writeFileSync)(script, package_export_default);
+    (0, import_node_fs57.writeFileSync)((0, import_node_path53.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs57.writeFileSync)((0, import_node_path53.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs57.writeFileSync)((0, import_node_path53.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    const script = (0, import_node_path53.join)(work, "package_export.py");
+    (0, import_node_fs57.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
-    const verified = (0, import_node_path52.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs56.readFileSync)((0, import_node_path52.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const verified = (0, import_node_path53.join)(work, "verified");
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs57.readFileSync)((0, import_node_path53.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
-      await deps.npm(["cache", "add", (0, import_node_path52.join)(verified, `${short3}.tgz`)], opts.dir);
+      await deps.npm(["cache", "add", (0, import_node_path53.join)(verified, `${short3}.tgz`)], opts.dir);
     }
-    (0, import_node_fs56.writeFileSync)(packagePath, plan.packageText);
-    (0, import_node_fs56.writeFileSync)(lockPath, plan.lockText);
+    (0, import_node_fs57.writeFileSync)(packagePath, plan.packageText);
+    (0, import_node_fs57.writeFileSync)(lockPath, plan.lockText);
     try {
       await deps.npm(["ci", "--offline", "--ignore-scripts", "--no-audit", "--no-fund"], opts.dir);
     } catch (error) {
-      (0, import_node_fs56.writeFileSync)(packagePath, packageText);
-      (0, import_node_fs56.writeFileSync)(lockPath, lockText);
+      (0, import_node_fs57.writeFileSync)(packagePath, packageText);
+      (0, import_node_fs57.writeFileSync)(lockPath, lockText);
       throw new Error(`npm ci --offline failed, package.json and package-lock.json restored: ${error.message}`);
     }
     return plan.result;
   } finally {
-    (0, import_node_fs56.rmSync)(work, { recursive: true, force: true });
+    (0, import_node_fs57.rmSync)(work, { recursive: true, force: true });
   }
 }
 var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process20.execFile);
@@ -66682,12 +67063,12 @@ function registerPackagesCommands(program3) {
 init_cli_shared();
 
 // src/wave-status.ts
-var import_node_fs57 = require("node:fs");
+var import_node_fs58 = require("node:fs");
 function observeStage(worktreePath) {
   const statePath = stageStatePath(worktreePath);
   let raw;
   try {
-    raw = (0, import_node_fs57.readFileSync)(statePath, "utf8");
+    raw = (0, import_node_fs58.readFileSync)(statePath, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return { state: "ok", value: { running: false } };
     return { state: "unavailable", reason: "stage state could not be read" };
@@ -66754,9 +67135,9 @@ async function collectWaveStatus(deps) {
 // src/discovery-commands.ts
 init_github_client();
 init_cli_shared();
-var import_node_fs58 = require("node:fs");
+var import_node_fs59 = require("node:fs");
 var import_node_os26 = require("node:os");
-var import_node_path53 = require("node:path");
+var import_node_path54 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 var defaultStatusDeps = {
   repo: resolveRepo,
@@ -66977,8 +67358,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os26.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path53.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs58.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path53.join)(home, ".claude", "settings.json"), import_node_fs58.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path54.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs59.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path54.join)(home, ".claude", "settings.json"), import_node_fs59.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -68679,9 +69060,9 @@ function formatExplainGroup(cmd, rootName) {
   lines2.push(...formatOwnDetail(cmd));
   lines2.push("Commands:");
   for (const child2 of cmd.subcommands) {
-    const args = child2.arguments.map((arg) => {
-      const name = arg.variadic ? `${arg.name}...` : arg.name;
-      return arg.required ? `<${name}>` : `[${name}]`;
+    const args = child2.arguments.map((arg2) => {
+      const name = arg2.variadic ? `${arg2.name}...` : arg2.name;
+      return arg2.required ? `<${name}>` : `[${name}]`;
     }).join(" ");
     lines2.push(`  ${canonical(child2)}${args ? ` ${args}` : ""}${child2.description ? ` \u2014 ${child2.description}` : ""}`);
   }
@@ -68702,11 +69083,11 @@ function briefCommand(cmd) {
   return {
     path: cmd.path,
     ...cmd.description ? { description: cmd.description } : {},
-    arguments: cmd.arguments.map((arg) => ({
-      name: arg.name,
-      required: arg.required,
-      ...arg.variadic ? { variadic: true } : {},
-      ...arg.description ? { description: arg.description } : {}
+    arguments: cmd.arguments.map((arg2) => ({
+      name: arg2.name,
+      required: arg2.required,
+      ...arg2.variadic ? { variadic: true } : {},
+      ...arg2.description ? { description: arg2.description } : {}
     })),
     options: ownOptions(cmd).map((opt) => ({
       flags: opt.flags,
@@ -68729,15 +69110,15 @@ function explainBriefManifest(manifest, command) {
 }
 function formatExplainBrief(cmd, rootName) {
   const lines2 = [`${rootName} ${cmd.path}${cmd.description ? ` \u2014 ${cmd.description}` : ""}`];
-  for (const arg of cmd.arguments) {
-    const flag = arg.required ? `<${arg.name}>` : `[${arg.name}]`;
-    lines2.push(`  ${flag}  ${arg.required ? "required" : "optional"}${arg.description ? `  ${arg.description}` : ""}`);
+  for (const arg2 of cmd.arguments) {
+    const flag = arg2.required ? `<${arg2.name}>` : `[${arg2.name}]`;
+    lines2.push(`  ${flag}  ${arg2.required ? "required" : "optional"}${arg2.description ? `  ${arg2.description}` : ""}`);
   }
   for (const opt of ownOptions(cmd)) {
     lines2.push(`  ${opt.flags}  ${opt.takesValue ? "takes-value" : "flag"}${opt.mandatory ? " required" : ""}${opt.description ? `  ${opt.description}` : ""}`);
   }
   for (const child2 of cmd.subcommands) {
-    const args = child2.arguments.map((arg) => arg.required ? `<${arg.name}>` : `[${arg.name}]`).join(" ");
+    const args = child2.arguments.map((arg2) => arg2.required ? `<${arg2.name}>` : `[${arg2.name}]`).join(" ");
     lines2.push(`${child2.path}${args ? ` ${args}` : ""}${child2.description ? ` \u2014 ${child2.description}` : ""}`);
     for (const opt of ownOptions(child2)) {
       lines2.push(`  ${opt.flags}  ${opt.takesValue ? "takes-value" : "flag"}${opt.mandatory ? " required" : ""}${opt.description ? `  ${opt.description}` : ""}`);
@@ -69644,8 +70025,8 @@ async function repoWorkflowEntries(client, repo) {
   for (const wf of workflowsList) {
     if (typeof wf?.path !== "string" || !wf.path) continue;
     if (!wf.path.startsWith(".github/workflows/")) continue;
-    const basename5 = wf.path.split("/").pop() ?? wf.path;
-    const name = `${repo}/${basename5.replace(/\.ya?ml$/, "")}`;
+    const basename6 = wf.path.split("/").pop() ?? wf.path;
+    const name = `${repo}/${basename6.replace(/\.ya?ml$/, "")}`;
     if (wf.state !== "active") {
       disabled.push(name);
       continue;
@@ -70109,8 +70490,8 @@ function registerSessionReport(program3) {
 }
 
 // src/stage-commands.ts
-var import_node_fs59 = require("node:fs");
-var import_node_path54 = require("node:path");
+var import_node_fs60 = require("node:fs");
+var import_node_path55 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -70358,8 +70739,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs59.existsSync)((0, import_node_path54.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs59.existsSync)((0, import_node_path54.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs60.existsSync)((0, import_node_path55.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs60.existsSync)((0, import_node_path55.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -70652,19 +71033,19 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 
 // src/tenant-artifact.ts
 var import_node_crypto23 = require("node:crypto");
-var import_node_fs60 = require("node:fs");
+var import_node_fs61 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
-var import_node_path55 = require("node:path");
+var import_node_path56 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
   const hash = (0, import_node_crypto23.createHash)("sha256");
-  for await (const chunk of (0, import_node_fs60.createReadStream)(path2)) hash.update(chunk);
+  for await (const chunk of (0, import_node_fs61.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path55.resolve)(inputPath);
+  const path2 = (0, import_node_path56.resolve)(inputPath);
   const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES2) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES2} bytes`);
@@ -70682,7 +71063,7 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     return [key, value];
   }));
   headers["content-length"] = String(info.size);
-  const stream = (0, import_node_fs60.createReadStream)(path2);
+  const stream = (0, import_node_fs61.createReadStream)(path2);
   let uploaded;
   try {
     uploaded = await fetch(body.uploadUrl, {
@@ -71036,7 +71417,7 @@ function renderVerifySecrets(body) {
 }
 
 // src/command-register-developer.ts
-var import_node_fs65 = require("node:fs");
+var import_node_fs66 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -71069,12 +71450,13 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path62 = require("node:path");
+var import_node_path63 = require("node:path");
 
 // src/doc-refs-command-source.ts
 var import_node_child_process21 = require("node:child_process");
-var import_node_fs61 = require("node:fs");
-var import_node_path56 = require("node:path");
+var import_node_fs62 = require("node:fs");
+var import_node_path57 = require("node:path");
+var IN_PROCESS_SOURCE = "in-process";
 var BUNDLE_MANIFEST_TIMEOUT_MS = 12e4;
 var BUNDLE_MANIFEST_MAX_BUFFER = 64 * 1024 * 1024;
 var flagsOf = (options) => new Set((options ?? []).flatMap((option) => String(option?.flags ?? "").match(/--[\w-]+/g) ?? []));
@@ -71095,7 +71477,7 @@ function inventoryFromManifest(manifest, source) {
 function readBundleManifest(bundle, exec3 = import_node_child_process21.execFileSync) {
   try {
     const text = exec3(process.execPath, [bundle, "commands", "--all", "--json"], {
-      cwd: (0, import_node_path56.dirname)(bundle),
+      cwd: (0, import_node_path57.dirname)(bundle),
       encoding: "utf8",
       windowsHide: true,
       timeout: BUNDLE_MANIFEST_TIMEOUT_MS,
@@ -71110,20 +71492,29 @@ function readBundleManifest(bundle, exec3 = import_node_child_process21.execFile
 }
 function isRunningBundle(bundle, argv1 = process.argv[1], platform2 = process.platform) {
   if (!argv1) return false;
-  const norm2 = (path2) => {
-    const absolute = (0, import_node_path56.resolve)(path2);
+  const norm3 = (path2) => {
+    const absolute = (0, import_node_path57.resolve)(path2);
     return platform2 === "win32" ? absolute.toLowerCase() : absolute;
   };
-  const running = norm2(argv1);
-  if (!["main.cjs", "index.cjs"].includes((0, import_node_path56.basename)(running))) return false;
-  return (0, import_node_path56.dirname)(running) === (0, import_node_path56.dirname)(norm2(bundle));
+  const running = norm3(argv1);
+  if (!["main.cjs", "index.cjs"].includes((0, import_node_path57.basename)(running))) return false;
+  return (0, import_node_path57.dirname)(running) === (0, import_node_path57.dirname)(norm3(bundle));
+}
+function nameUnknownCommandSources(findings, source, root) {
+  const checkoutBundle = (0, import_node_path57.resolve)(root, "cli", "dist", "main.cjs");
+  const recovery = source !== IN_PROCESS_SOURCE && (0, import_node_path57.resolve)(source) === checkoutBundle ? "; rebuild with `npm --prefix cli run build` and retry, or pass `--commands-from <bundle>`" : "";
+  for (const finding of findings) {
+    if (finding.kind !== "unknown-command") continue;
+    finding.commandSource = source;
+    finding.detail += ` (source: ${source}${recovery})`;
+  }
 }
 function resolveCommandInventory(deps) {
-  const exists = deps.exists ?? import_node_fs61.existsSync;
+  const exists = deps.exists ?? import_node_fs62.existsSync;
   const read = deps.read ?? ((bundle) => readBundleManifest(bundle));
   const warnings = [];
   if (deps.from) {
-    const bundle = (0, import_node_path56.isAbsolute)(deps.from) ? deps.from : (0, import_node_path56.resolve)(deps.root, deps.from);
+    const bundle = (0, import_node_path57.isAbsolute)(deps.from) ? deps.from : (0, import_node_path57.resolve)(deps.root, deps.from);
     if (!exists(bundle)) {
       throw new Error(`docs refs --commands-from: ${bundle} does not exist \u2014 name the CLI bundle to read commands from (usually cli/dist/main.cjs)`);
     }
@@ -71133,10 +71524,13 @@ function resolveCommandInventory(deps) {
     }
     return { inventory: inventory2, warnings };
   }
-  const treeBundle = (0, import_node_path56.join)(deps.root, "cli", "dist", "main.cjs");
-  if (!exists(treeBundle) || isRunningBundle(treeBundle, deps.argv1, deps.platform)) {
+  const treeBundle = (0, import_node_path57.join)(deps.root, "cli", "dist", "main.cjs");
+  if (!exists(treeBundle)) {
     return { inventory: deps.inProcess(), warnings };
   }
+  if (isRunningBundle(treeBundle, deps.argv1, deps.platform)) {
+    return { inventory: { ...deps.inProcess(), source: treeBundle }, warnings };
+  }
   const inventory = inventoryFromManifest(read(treeBundle), treeBundle);
   if (!inventory) {
     warnings.push({
@@ -71251,19 +71645,19 @@ async function executeWaveLand(plan, deps) {
 // src/dist-drift.ts
 var import_node_child_process22 = require("node:child_process");
 var import_node_crypto25 = require("node:crypto");
-var import_node_fs63 = require("node:fs");
+var import_node_fs64 = require("node:fs");
 var import_node_os27 = require("node:os");
-var import_node_path58 = require("node:path");
+var import_node_path59 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
 var import_node_crypto24 = require("node:crypto");
-var import_node_fs62 = require("node:fs");
-var import_node_path57 = require("node:path");
+var import_node_fs63 = require("node:fs");
+var import_node_path58 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path57.resolve)(root);
-  const target = (0, import_node_path57.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path57.sep}`)) {
+  const absoluteRoot = (0, import_node_path58.resolve)(root);
+  const target = (0, import_node_path58.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path58.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
@@ -71271,7 +71665,7 @@ function repoPath(root, declaredPath, label) {
 function digestFiles(files) {
   const hash = (0, import_node_crypto24.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs62.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs62.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs63.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs63.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -71286,8 +71680,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs62.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs62.lstatSync)(absolute) };
+    if (!(0, import_node_fs63.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs63.lstatSync)(absolute) };
   }));
 }
 
@@ -71372,13 +71766,13 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs63.existsSync)(path2) ? (0, import_node_fs63.readFileSync)(path2) : null;
+  return (0, import_node_fs64.existsSync)(path2) ? (0, import_node_fs64.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs63.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path58.join)(directory, entry.name);
+    for (const entry of (0, import_node_fs64.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path59.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -71388,10 +71782,10 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs63.readFileSync)((0, import_node_path58.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path58.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs64.readFileSync)((0, import_node_path59.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path59.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path58.join)(root, "distribution-bom.json");
+    return (0, import_node_path59.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
@@ -71404,40 +71798,40 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs63.mkdtempSync)((0, import_node_path58.join)((0, import_node_os27.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs64.mkdtempSync)((0, import_node_path59.join)((0, import_node_os27.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path58.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path58.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path58.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path58.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path59.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path59.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path59.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path59.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path58.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path59.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path58.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path58.join)(root, path2));
-    const distRoot = (0, import_node_path58.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path58.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs63.readFileSync)(bomPathFor(root), "utf8"));
+    const committed = (path2) => readOrNull((0, import_node_path59.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path59.join)(root, path2));
+    const distRoot = (0, import_node_path59.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path59.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs64.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path58.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path59.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path58.join)(overlay, entry.path);
-        (0, import_node_fs63.mkdirSync)((0, import_node_path58.dirname)(target), { recursive: true });
-        (0, import_node_fs63.writeFileSync)(target, entry.bytes);
+        const target = (0, import_node_path59.join)(overlay, entry.path);
+        (0, import_node_fs64.mkdirSync)((0, import_node_path59.dirname)(target), { recursive: true });
+        (0, import_node_fs64.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs63.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs64.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
 // src/doc-refs-live.ts
-var import_node_path59 = require("node:path");
+var import_node_path60 = require("node:path");
 var concrete = (value) => !!value && !/[<>{}$]/.test(value);
 var liveOption = (tokens2, flag) => {
   const index = tokens2.indexOf(flag);
@@ -71510,7 +71904,7 @@ async function runLiveDocRefs(root, deps, live) {
   const offline = runDocRefs(root, { ...deps, runbooksOnly: true });
   const read = deps.readFile ?? readFileOrNull;
   const docs = Object.fromEntries((deps.listDocs ?? defaultListDocs)(root).flatMap((doc) => {
-    const body = read((0, import_node_path59.join)(root, doc));
+    const body = read((0, import_node_path60.join)(root, doc));
     return body !== null && isRunbook(doc, body) && !deps.isIgnored?.([doc]).has(doc) ? [[doc, body]] : [];
   }));
   const remote = await checkRunbookLive(docs, live);
@@ -71547,7 +71941,7 @@ function createRunbookLiveDeps(cliBin) {
       };
       const first = await probe().catch(() => 599);
       if (first < 500) return first;
-      await new Promise((resolve7) => setTimeout(resolve7, 2e4));
+      await new Promise((resolve8) => setTimeout(resolve8, 2e4));
       return probe();
     }
   };
@@ -71721,7 +72115,7 @@ async function diagnoseHub(deps) {
 
 // src/schedules-lift-command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path60 = require("node:path");
+var import_node_path61 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -71750,7 +72144,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path60.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path61.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -71833,8 +72227,8 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process24 = require("node:child_process");
-var import_node_fs64 = require("node:fs");
-var import_node_path61 = require("node:path");
+var import_node_fs65 = require("node:fs");
+var import_node_path62 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -71920,7 +72314,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs64.readFileSync)((0, import_node_path61.join)(root, file), "utf8");
+      raw = (0, import_node_fs65.readFileSync)((0, import_node_path62.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -71940,19 +72334,19 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path62.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs65.existsSync)(path2) ? (0, import_node_fs65.readFileSync)(path2, "utf8") : null;
+    const path2 = (0, import_node_path63.join)(process.cwd(), ".gitignore");
+    const current = (0, import_node_fs66.existsSync)(path2) ? (0, import_node_fs66.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs65.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs66.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs65.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs66.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -72148,12 +72542,13 @@ function registerDeveloperCommands(program3) {
       const deps = { commandPaths, commandOptions, commandSource: source, base: o.base, runbooksOnly: o.runbooksOnly };
       const result = o.live ? await runLiveDocRefs(root, deps, createRunbookLiveDeps(process.argv[1])) : runDocRefs(root, deps);
       result.warnings.push(...resolved.warnings);
+      nameUnknownCommandSources(result.findings, source, root);
       if (o.json) {
         consoleIo.log(JSON.stringify({ ok: result.ok, docCount: result.docCount, findings: result.findings, warnings: result.warnings }, null, 2));
         if (!result.ok) process.exitCode = 1;
         return;
       }
-      for (const w of result.warnings) console.warn(`WARNING: ${w.doc}:${w.line} [${w.kind}] ${w.detail}`);
+      for (const w of result.warnings) console.warn(`WARNING: ${formatDocRefFinding(w)}`);
       if (result.ok) {
         console.log(
           `doc refs: ${result.docCount} docs, every reference resolves` + (result.warnings.length ? ` (${result.warnings.length} warning(s))` : "")
@@ -72163,7 +72558,7 @@ function registerDeveloperCommands(program3) {
       const hasStale = result.findings.some((f) => f.kind === "runbook-section-stale" || f.kind === "seed-runbook-unreviewed");
       const hasRefs = result.findings.some((f) => f.kind !== "runbook-section-stale" && f.kind !== "seed-runbook-unreviewed");
       console.error(hasStale && !hasRefs ? "doc refs: stale runbook section(s)" : hasStale && hasRefs ? "doc refs: unresolved references and stale runbook section(s)" : "doc refs: unresolved references");
-      for (const f of result.findings) console.error(`- ${f.doc}:${f.line} [${f.kind}] ${f.detail}`);
+      for (const f of result.findings) console.error(`- ${formatDocRefFinding(f)}`);
       process.exitCode = 1;
     } catch (e) {
       await failGraceful(e.message);
@@ -72269,7 +72664,7 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path63.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path64.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -72407,7 +72802,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs66.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs67.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -72442,7 +72837,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs66.existsSync)((0, import_node_path63.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs67.existsSync)((0, import_node_path64.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -72451,7 +72846,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs66.existsSync)((0, import_node_path63.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs67.existsSync)((0, import_node_path64.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -72472,8 +72867,8 @@ function mmiDoctorDeps(opts = {}) {
         });
         const raced = await Promise.race([
           work.then((r) => ({ ...r, timedOut: false })),
-          new Promise((resolve7) => {
-            ceiling = setTimeout(() => resolve7({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
+          new Promise((resolve8) => {
+            ceiling = setTimeout(() => resolve8({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
           })
         ]);
         if (raced.timedOut) return { scanned: 0, findings: 0, fixed: 0, failed: 0, timedOut: true };
@@ -72506,8 +72901,8 @@ function mmiDoctorDeps(opts = {}) {
             incomplete: nb.incomplete,
             timedOut: false
           })),
-          new Promise((resolve7) => {
-            ceiling = setTimeout(() => resolve7({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
+          new Promise((resolve8) => {
+            ceiling = setTimeout(() => resolve8({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
           })
         ]);
         if (!raced.timedOut && raced.incomplete.length === 0) writeSchedulesDriftCache(cachePath, raced.driftLines);
@@ -72991,10 +73386,10 @@ tenant.command("logs <owner/repo> <stage>").description("READ-ONLY: read a tenan
     return failGraceful(`runtime tenant logs: ${e.message}`);
   }
 });
-tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the stage branch rc/main, or `development` for dev and for a single-track repo's main, where --ref main is refused)").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
+tenant.command("redeploy <owner/repo> <stage>").description("re-dispatch the central tenant-deploy.yml for an already-promoted ref (no re-tag/merge); train-authority gated").option("--ref <ref>", "ref to deploy (defaults to the currently serving SHA; older refs require --rollback)").option("--rollback", "allow deliberately deploying an older --ref").option("--watch", "block on the dispatched run and report its outcome (gh run watch --exit-status)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime tenant redeploy: <stage> must be dev, rc, or main");
   try {
-    const raw = await runTenantRedeploy(trainApplyDeps(), { repo, stage, ref: o.ref, watch: o.watch });
+    const raw = await runTenantRedeploy(trainApplyDeps(), { repo, stage, ref: o.ref, rollback: o.rollback, watch: o.watch });
     const result = raw.workflowRuns ? { ...raw, workflowRuns: raw.workflowRuns.map(workflowRunWithEvidence) } : raw;
     return printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantRedeploy(result));
   } catch (e) {
@@ -73254,7 +73649,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs66.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs67.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -73388,7 +73783,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   const cfg = await loadConfig();
   const reg = registryClientDeps(cfg);
   const slug = slugOf(repo);
-  const [metaRead, deployFacts, authority, dev, rc, main] = await Promise.all([
+  const [metaRead, deployFacts, authority, dev, rc, main2] = await Promise.all([
     fetchProjectBySlugChecked(slug, reg),
     fetchDeployFactsBySlug(slug, reg),
     fetchTrainAuthority(repo, reg),
@@ -73403,7 +73798,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
     meta: metaRead.project,
     deployFacts,
     trainAuthority: authority.ok ? authority.authority : void 0,
-    runtime: { dev, rc, main }
+    runtime: { dev, rc, main: main2 }
   });
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
@@ -73646,16 +74041,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path63.join)(root, path2);
-      return (0, import_node_fs66.existsSync)(fullPath) ? (0, import_node_fs66.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path64.join)(root, path2);
+      return (0, import_node_fs67.existsSync)(fullPath) ? (0, import_node_fs67.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path63.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path64.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs66.existsSync)((0, import_node_path63.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs66.existsSync)((0, import_node_path63.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs67.existsSync)((0, import_node_path64.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs67.existsSync)((0, import_node_path64.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -73812,10 +74207,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs66.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs66.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs67.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs67.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs66.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs66.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs67.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs67.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -73852,16 +74247,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs66.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs67.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path63.join)(path2, entry.name);
+    const child2 = (0, import_node_path64.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs66.statSync)(child2).size;
+        total += (0, import_node_fs67.statSync)(child2).size;
       } catch {
       }
     }
@@ -73869,25 +74264,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs66.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs67.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs66.existsSync)(p)) return [];
+  if (!(0, import_node_fs67.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs66.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs67.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs66.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs66.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs67.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs67.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs66.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs67.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path63.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs66.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path64.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs67.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -73901,10 +74296,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path63.join)(stagingRoot, name);
-      if (!(0, import_node_fs66.existsSync)(p)) return null;
+      const p = (0, import_node_path64.join)(stagingRoot, name);
+      if (!(0, import_node_fs67.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs66.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs67.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -73930,7 +74325,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs66.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs67.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -73940,7 +74335,7 @@ program2.command("archive-prune").description("inventory worktree evidence archi
   let primary = o.repoRoot;
   if (!primary) {
     const common = await gitOut(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
-    primary = common ? (0, import_node_path63.dirname)(common) : "";
+    primary = common ? (0, import_node_path64.dirname)(common) : "";
   }
   if (!primary) {
     const detail = "archive-prune: not inside a git checkout (pass --repo-root <primary checkout>)";