@mutmutco/codex-plugin 4.6.47 → 4.6.49

package/cli/dist/main.cjs

@@ -80,13 +80,13 @@ var init_compat = __esm({
 // src/client-version.ts
 function resolveClientVersionManifestCandidates(distDir = __dirname) {
   return [
-    (0, import_node_path.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
-    (0, import_node_path.join)(distDir, "..", "package.json")
+    (0, import_node_path2.join)(distDir, "..", "..", ".claude-plugin", "plugin.json"),
+    (0, import_node_path2.join)(distDir, "..", "package.json")
   ];
 }
 function readVersionFromManifest(path2) {
   try {
-    const version = JSON.parse((0, import_node_fs.readFileSync)(path2, "utf8")).version;
+    const version = JSON.parse((0, import_node_fs2.readFileSync)(path2, "utf8")).version;
     return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
     return null;
@@ -106,12 +106,12 @@ function upgradeRequiredError(res, body) {
   const minVersion = body && typeof body === "object" && typeof body.minVersion === "string" ? body.minVersion : "a newer version";
   return `Hub requires mmi-cli >= ${minVersion} \u2014 run mmi-cli doctor (installed ${resolveClientVersion()})`;
 }
-var import_node_fs, import_node_path;
+var import_node_fs2, import_node_path2;
 var init_client_version = __esm({
   "src/client-version.ts"() {
     "use strict";
-    import_node_fs = require("node:fs");
-    import_node_path = require("node:path");
+    import_node_fs2 = require("node:fs");
+    import_node_path2 = require("node:path");
     init_compat();
   }
 });
@@ -470,9 +470,9 @@ function recordGhUsage(via, pool, op) {
   if (process.env.MMI_GH_USAGE === "off" || process.env.VITEST && !process.env.MMI_GH_USAGE_DIR) return;
   try {
     const dir = usageDir();
-    (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
     const row = { t: Date.now(), cmd: commandPath(), via, pool, op: shapeOp(op) };
-    (0, import_node_fs2.appendFileSync)((0, import_node_path2.join)(dir, `${new Date(row.t).toISOString().slice(0, 13)}.jsonl`), `${JSON.stringify(row)}
+    (0, import_node_fs3.appendFileSync)((0, import_node_path3.join)(dir, `${new Date(row.t).toISOString().slice(0, 13)}.jsonl`), `${JSON.stringify(row)}
 `);
   } catch {
   }
@@ -483,12 +483,12 @@ function summarizeGhUsage(hours = 1, now = Date.now(), env = process.env) {
   const rows = [];
   let files = [];
   try {
-    files = (0, import_node_fs2.readdirSync)(dir).filter((f) => f.endsWith(".jsonl") && Date.parse(`${f.slice(0, 13)}:00:00Z`) >= since - 36e5);
+    files = (0, import_node_fs3.readdirSync)(dir).filter((f) => f.endsWith(".jsonl") && Date.parse(`${f.slice(0, 13)}:00:00Z`) >= since - 36e5);
   } catch {
     files = [];
   }
   for (const file of files) {
-    for (const line of (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(dir, file), "utf8").split("\n")) {
+    for (const line of (0, import_node_fs3.readFileSync)((0, import_node_path3.join)(dir, file), "utf8").split("\n")) {
       try {
         const row = JSON.parse(line);
         if (row.t >= since) rows.push(row);
@@ -507,14 +507,14 @@ function summarizeGhUsage(hours = 1, now = Date.now(), env = process.env) {
   }
   return { hours, total: rows.length, byPool, top: [...groups.values()].sort((a, b) => b.count - a.count).slice(0, 20) };
 }
-var import_node_fs2, import_node_os, import_node_path2, usageDir, cachedCommand;
+var import_node_fs3, import_node_os, import_node_path3, usageDir, cachedCommand;
 var init_gh_usage = __esm({
   "src/gh-usage.ts"() {
     "use strict";
-    import_node_fs2 = require("node:fs");
+    import_node_fs3 = require("node:fs");
     import_node_os = require("node:os");
-    import_node_path2 = require("node:path");
-    usageDir = (env = process.env) => env.MMI_GH_USAGE_DIR || (0, import_node_path2.join)((0, import_node_os.homedir)(), ".mmi", "gh-usage");
+    import_node_path3 = require("node:path");
+    usageDir = (env = process.env) => env.MMI_GH_USAGE_DIR || (0, import_node_path3.join)((0, import_node_os.homedir)(), ".mmi", "gh-usage");
   }
 });
 
@@ -691,7 +691,7 @@ function createGitHubClient(options = {}) {
     if (!res.ok) throw await errorFromResponse(res);
     return res;
   }
-  async function parseJson(res) {
+  async function parseJson2(res) {
     if (res.status === 204) return void 0;
     const text = await res.text();
     if (!text) return void 0;
@@ -700,7 +700,7 @@ function createGitHubClient(options = {}) {
   let viewer;
   return {
     async rest(method, path2, init) {
-      const read = async () => parseJson(await request(method, joinUrl(baseUrl, path2), init));
+      const read = async () => parseJson2(await request(method, joinUrl(baseUrl, path2), init));
       if (method === "GET" && path2.replace(/^\//, "") === "user" && !init) {
         viewer ??= read().catch((e) => {
           viewer = void 0;
@@ -712,14 +712,14 @@ function createGitHubClient(options = {}) {
     },
     async restWithStatus(method, path2, init) {
       const res = await request(method, joinUrl(baseUrl, path2), init);
-      return { status: res.status, body: await parseJson(res) };
+      return { status: res.status, body: await parseJson2(res) };
     },
     async restPaginate(path2, init) {
       const items = [];
       let url = withPerPage(joinUrl(baseUrl, path2));
       while (url) {
         const res = await request("GET", url, init);
-        const page = await parseJson(res);
+        const page = await parseJson2(res);
         if (!Array.isArray(page)) {
           throw new GitHubApiError(
             `pagination page was not a JSON array (got ${page === void 0 ? "an empty body" : typeof page}) \u2014 the list read is PARTIAL and must not be treated as complete: ${url}. Retry the call.`,
@@ -736,7 +736,7 @@ function createGitHubClient(options = {}) {
         ...init,
         body: { query, ...variables ? { variables } : {} }
       });
-      const parsed = await parseJson(res);
+      const parsed = await parseJson2(res);
       if (parsed?.errors?.length) {
         const message2 = parsed.errors.map((e) => e.message ?? e.type ?? "unknown GraphQL error").join("; ");
         const rateLimited = parsed.errors.some((e) => e.type === "RATE_LIMITED" || /rate limit/i.test(e.message ?? ""));
@@ -988,11 +988,11 @@ function tokenFingerprint(token) {
 function defaultHubSessionCachePath(env = process.env) {
   if (env.MMI_HUB_SESSION_CACHE) return env.MMI_HUB_SESSION_CACHE;
   if (process.platform === "win32") {
-    const base2 = env.LOCALAPPDATA || (0, import_node_path3.join)((0, import_node_os2.homedir)(), "AppData", "Local");
-    return (0, import_node_path3.join)(base2, "MMI Future", "mmi-cli", "hub-session.json");
+    const base2 = env.LOCALAPPDATA || (0, import_node_path4.join)((0, import_node_os2.homedir)(), "AppData", "Local");
+    return (0, import_node_path4.join)(base2, "MMI Future", "mmi-cli", "hub-session.json");
   }
-  const base = env.XDG_STATE_HOME || (0, import_node_path3.join)((0, import_node_os2.homedir)(), ".local", "state");
-  return (0, import_node_path3.join)(base, "mmi-cli", "hub-session.json");
+  const base = env.XDG_STATE_HOME || (0, import_node_path4.join)((0, import_node_os2.homedir)(), ".local", "state");
+  return (0, import_node_path4.join)(base, "mmi-cli", "hub-session.json");
 }
 function roleFromToken(token) {
   const part = token?.split(".")[1];
@@ -1006,7 +1006,7 @@ function roleFromToken(token) {
 }
 function readCache(path2, apiUrl, now, githubTokenFingerprint) {
   try {
-    const session = JSON.parse((0, import_node_fs3.readFileSync)(path2, "utf8"));
+    const session = JSON.parse((0, import_node_fs4.readFileSync)(path2, "utf8"));
     if (!session.token || !session.expiresAt || session.apiUrl !== apiUrl) return { session: null, stale: false };
     if (session.githubTokenFingerprint !== githubTokenFingerprint) {
       return { session: null, stale: true, staleLogin: typeof session.login === "string" ? session.login : void 0 };
@@ -1018,16 +1018,16 @@ function readCache(path2, apiUrl, now, githubTokenFingerprint) {
   }
 }
 function writeCache(path2, session) {
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(path2), { recursive: true });
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path2), { recursive: true });
   const tmp = `${path2}.${process.pid}.${Date.now()}.tmp`;
-  (0, import_node_fs3.writeFileSync)(tmp, JSON.stringify(session, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  (0, import_node_fs4.writeFileSync)(tmp, JSON.stringify(session, null, 2) + "\n", { encoding: "utf8", mode: 384 });
   try {
-    (0, import_node_fs3.chmodSync)(tmp, 384);
+    (0, import_node_fs4.chmodSync)(tmp, 384);
   } catch {
   }
-  (0, import_node_fs3.renameSync)(tmp, path2);
+  (0, import_node_fs4.renameSync)(tmp, path2);
   try {
-    (0, import_node_fs3.chmodSync)(path2, 384);
+    (0, import_node_fs4.chmodSync)(path2, 384);
   } catch {
   }
 }
@@ -1139,13 +1139,13 @@ async function hubAuthSession(deps) {
 async function hubAuthToken(deps) {
   return (await hubAuthSession(deps))?.token;
 }
-var import_node_crypto, import_node_fs3, import_node_path3, import_node_os2, REFRESH_WINDOW_MS, EXCHANGE_TIMEOUT_MS, EXCHANGE_ATTEMPTS, EXIT_HUB_SESSION_STALE, EXIT_HUB_SESSION_REFUSED, lastFailure, MEMBERSHIP_FIX;
+var import_node_crypto, import_node_fs4, import_node_path4, import_node_os2, REFRESH_WINDOW_MS, EXCHANGE_TIMEOUT_MS, EXCHANGE_ATTEMPTS, EXIT_HUB_SESSION_STALE, EXIT_HUB_SESSION_REFUSED, lastFailure, MEMBERSHIP_FIX;
 var init_hub_auth = __esm({
   "src/hub-auth.ts"() {
     "use strict";
     import_node_crypto = require("node:crypto");
-    import_node_fs3 = require("node:fs");
-    import_node_path3 = require("node:path");
+    import_node_fs4 = require("node:fs");
+    import_node_path4 = require("node:path");
     import_node_os2 = require("node:os");
     init_fetch_retry();
     init_client_version();
@@ -1317,7 +1317,7 @@ var init_house_map = __esm({
 function setInjectedStdin(payload) {
   injectedStdin = payload;
 }
-function stdinHasPipedInput(statFd = () => (0, import_node_fs4.fstatSync)(0), getIsTTY = () => process.stdin.isTTY) {
+function stdinHasPipedInput(statFd = () => (0, import_node_fs5.fstatSync)(0), getIsTTY = () => process.stdin.isTTY) {
   try {
     const stat4 = statFd();
     if (stat4.isFIFO() || stat4.isFile()) return true;
@@ -1365,11 +1365,11 @@ async function readStdin(opts = {}) {
   }
   return Buffer.concat(chunks).toString("utf8");
 }
-var import_node_fs4, injectedStdin, STDIN_MAX_BYTES, STDIN_DRAIN_TIMEOUT_MS;
+var import_node_fs5, injectedStdin, STDIN_MAX_BYTES, STDIN_DRAIN_TIMEOUT_MS;
 var init_stdin_inject = __esm({
   "src/stdin-inject.ts"() {
     "use strict";
-    import_node_fs4 = require("node:fs");
+    import_node_fs5 = require("node:fs");
     STDIN_MAX_BYTES = 8 * 1024 * 1024;
     STDIN_DRAIN_TIMEOUT_MS = 5e3;
   }
@@ -1599,15 +1599,15 @@ function rawValue(flag, fallback) {
   return inline ? inline.slice(flag.length + 1) : fallback;
 }
 function printLine(value) {
-  (0, import_node_fs5.writeSync)(1, `${value}
+  (0, import_node_fs6.writeSync)(1, `${value}
 `);
 }
-var import_node_child_process, import_node_fs5, import_node_util, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, ghReadTokenProvider, ghWriteTokenProvider, GIT_TIMEOUT_MS, ExecDeadlineError, cachedGithubLogin, gitOut, consoleIo;
+var import_node_child_process, import_node_fs6, import_node_util, rawExecFileP, DEFAULT_EXEC_TIMEOUT_MS, execFileP, ghReadTokenProvider, ghWriteTokenProvider, GIT_TIMEOUT_MS, ExecDeadlineError, cachedGithubLogin, gitOut, consoleIo;
 var init_cli_shared = __esm({
   "src/cli-shared.ts"() {
     "use strict";
     import_node_child_process = require("node:child_process");
-    import_node_fs5 = require("node:fs");
+    import_node_fs6 = require("node:fs");
     import_node_util = require("node:util");
     init_hub_url();
     init_client_version();
@@ -9186,6 +9186,32 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/utf8-receipt.ts
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+function writeUtf8Receipt(path2, text) {
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path2), { recursive: true });
+  const body = text.endsWith("\n") ? text : `${text}
+`;
+  (0, import_node_fs.writeFileSync)(path2, body, "utf8");
+  return Buffer.byteLength(body, "utf8");
+}
+
+// src/tenant-control-output.ts
+var TENANT_CONTROL_JSON_FAILURE_HINT = " (--json: exits 1 on stderr with nothing on stdout: check the exit code before parsing, never merge stderr into stdout (2>&1); use --out <file> so a failed read leaves no file)";
+function tenantControlFailure(message2, json) {
+  return json ? `${message2}${TENANT_CONTROL_JSON_FAILURE_HINT}` : message2;
+}
+function emitTenantControlOutput(text, o, io = { print: console.log }) {
+  if (o.out === void 0) {
+    io.print(text);
+    return;
+  }
+  if (o.failed) return;
+  const bytes = (io.write ?? writeUtf8Receipt)(o.out, text);
+  io.print(`Wrote tenant control ${o.action} to ${o.out} (UTF-8, ${bytes} bytes)`);
+}
+
 // ../shared/quota-attribution.ts
 var ATTRIBUTION_MAX = 120;
 function sanitizeAttribution(value, max = ATTRIBUTION_MAX) {
@@ -9205,9 +9231,9 @@ var import_node_crypto2 = require("node:crypto");
 var import_node_os5 = require("node:os");
 
 // src/plugin-guard-io.ts
-var import_node_fs7 = require("node:fs");
+var import_node_fs8 = require("node:fs");
 var import_node_child_process2 = require("node:child_process");
-var import_node_path4 = require("node:path");
+var import_node_path5 = require("node:path");
 var import_node_os4 = require("node:os");
 
 // src/marketplace-autoupdate.ts
@@ -9439,7 +9465,7 @@ function buildPluginGuardLine(state, opts = {}) {
 }
 
 // src/host-doc-lock.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 var import_node_os3 = require("node:os");
 var SHARED_DOC_LOCK_STALE_MS = 3e4;
 var SHARED_DOC_LOCK_ATTEMPTS = 50;
@@ -9453,7 +9479,7 @@ function lockContent(options) {
 }
 function readHolder(lockPath) {
   try {
-    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(lockPath, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(lockPath, "utf8"));
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
@@ -9465,7 +9491,7 @@ function lockAgeMs(lockPath, now) {
   const declared = typeof holder?.acquiredAt === "string" ? Date.parse(holder.acquiredAt) : Number.NaN;
   if (!Number.isNaN(declared)) return Math.max(0, now - declared);
   try {
-    return Math.max(0, now - (0, import_node_fs6.statSync)(lockPath).mtimeMs);
+    return Math.max(0, now - (0, import_node_fs7.statSync)(lockPath).mtimeMs);
   } catch {
     return 0;
   }
@@ -9488,9 +9514,9 @@ function acquireSharedDocLock(documentPath, options) {
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     let fd;
     try {
-      fd = (0, import_node_fs6.openSync)(lockPath, "wx");
-      (0, import_node_fs6.writeSync)(fd, content);
-      (0, import_node_fs6.closeSync)(fd);
+      fd = (0, import_node_fs7.openSync)(lockPath, "wx");
+      (0, import_node_fs7.writeSync)(fd, content);
+      (0, import_node_fs7.closeSync)(fd);
       return {
         documentPath,
         lockPath,
@@ -9503,11 +9529,11 @@ function acquireSharedDocLock(documentPath, options) {
     } catch (error) {
       if (fd !== void 0) {
         try {
-          (0, import_node_fs6.closeSync)(fd);
+          (0, import_node_fs7.closeSync)(fd);
         } catch {
         }
         try {
-          (0, import_node_fs6.unlinkSync)(lockPath);
+          (0, import_node_fs7.unlinkSync)(lockPath);
         } catch {
         }
       }
@@ -9516,12 +9542,12 @@ function acquireSharedDocLock(documentPath, options) {
     if (lockAgeMs(lockPath, Date.now()) >= staleAfterMs) {
       const aside = `${lockPath}.stale-${Date.now()}`;
       try {
-        (0, import_node_fs6.renameSync)(lockPath, aside);
+        (0, import_node_fs7.renameSync)(lockPath, aside);
       } catch {
         continue;
       }
       try {
-        (0, import_node_fs6.rmSync)(aside, { force: true });
+        (0, import_node_fs7.rmSync)(aside, { force: true });
       } catch {
       }
       continue;
@@ -9534,7 +9560,7 @@ function releaseSharedDocLock(handle) {
   try {
     const holder = readHolder(handle.lockPath);
     if (holder && holder.owner === handle.owner && Number(holder.pid) === handle.pid) {
-      (0, import_node_fs6.unlinkSync)(handle.lockPath);
+      (0, import_node_fs7.unlinkSync)(handle.lockPath);
     }
   } catch {
   }
@@ -9560,8 +9586,8 @@ function insideOpenBotAgentWorkspace(cwd, env = process.env, home = (0, import_n
   } catch {
     return false;
   }
-  const rel = (0, import_node_path4.relative)(openbotAgentsRoot(env, home), dir);
-  return !(0, import_node_path4.isAbsolute)(rel) && (rel.split(/[\\/]/)[0] ?? "").toLowerCase().startsWith("agent-");
+  const rel = (0, import_node_path5.relative)(openbotAgentsRoot(env, home), dir);
+  return !(0, import_node_path5.isAbsolute)(rel) && (rel.split(/[\\/]/)[0] ?? "").toLowerCase().startsWith("agent-");
 }
 function detectSurface(env, cwd) {
   const has = (k) => Boolean(env[k]?.trim());
@@ -9692,30 +9718,30 @@ function runHostBin(bin, args, opts) {
   return step ? execFileHard(file, argv, { ...shared, step }) : execFileP(file, argv, shared);
 }
 function openbotAgentsRoot(env = process.env, home = (0, import_node_os4.homedir)()) {
-  return env.MMI_UPDATER_OPENBOT_AGENTS_DIR?.trim() || (0, import_node_path4.join)(home, "OpenBot", "Agents");
+  return env.MMI_UPDATER_OPENBOT_AGENTS_DIR?.trim() || (0, import_node_path5.join)(home, "OpenBot", "Agents");
 }
 function openbotAgentWorkspaces(env = process.env, home = (0, import_node_os4.homedir)()) {
   const root = openbotAgentsRoot(env, home);
   try {
-    return (0, import_node_fs7.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith("agent-")).map((entry) => (0, import_node_path4.join)(root, entry.name)).sort();
+    return (0, import_node_fs8.readdirSync)(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name.startsWith("agent-")).map((entry) => (0, import_node_path5.join)(root, entry.name)).sort();
   } catch {
     return [];
   }
 }
 function surfaceConfigRoot(surface, env = process.env, home = (0, import_node_os4.homedir)()) {
-  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path4.join)(home, ".codex");
+  if (surface === "codex") return env.CODEX_HOME?.trim() || (0, import_node_path5.join)(home, ".codex");
   if (surface === "openbot") return openbotAgentsRoot(env, home);
   if (surface === "jervcode") {
-    return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path4.join)(home, ".jerv", "agent");
+    return env.JERVCODE_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || (0, import_node_path5.join)(home, ".jerv", "agent");
   }
-  return (0, import_node_path4.join)(home, ".claude");
+  return (0, import_node_path5.join)(home, ".claude");
 }
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
-  return (0, import_node_path4.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
+  return (0, import_node_path5.join)(surfaceConfigRoot(surface), "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins(surface = detectSurface(process.env)) {
   try {
-    return JSON.parse((0, import_node_fs7.readFileSync)(installedPluginsPath(surface), "utf8"));
+    return JSON.parse((0, import_node_fs8.readFileSync)(installedPluginsPath(surface), "utf8"));
   } catch {
     return null;
   }
@@ -9724,15 +9750,15 @@ function marketplaceCloneCandidates(surface, home, env = process.env) {
   if (surface === "codex") {
     const root = surfaceConfigRoot(surface, env, home);
     return [
-      (0, import_node_path4.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
-      (0, import_node_path4.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
+      (0, import_node_path5.join)(root, ".tmp", "marketplaces", CODEX_MARKETPLACE),
+      (0, import_node_path5.join)(root, "plugins", "marketplaces", CODEX_MARKETPLACE)
     ];
   }
   if (surface === "openbot") return [];
   if (surface === "jervcode") return [];
-  return [(0, import_node_path4.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
+  return [(0, import_node_path5.join)(home, ".claude", "plugins", "marketplaces", "mutmutco")];
 }
-function marketplaceClonePresent(surface, home, exists = import_node_fs7.existsSync, env = process.env) {
+function marketplaceClonePresent(surface, home, exists = import_node_fs8.existsSync, env = process.env) {
   return marketplaceCloneCandidates(surface, home, env).some(exists);
 }
 function runHostBinSync(bin, args) {
@@ -9776,15 +9802,15 @@ async function fetchNpmReleasedVersion() {
 var JERVCODE_NPM_PACKAGE = "@mutmutco/pi-plugin";
 function jervcodeAgentDirs(env = process.env, home = (0, import_node_os4.homedir)()) {
   const primary = surfaceConfigRoot("jervcode", env, home);
-  const legacy = (0, import_node_path4.join)(home, ".pi", "agent");
+  const legacy = (0, import_node_path5.join)(home, ".pi", "agent");
   const dirs = [primary];
   if (legacy !== primary) dirs.push(legacy);
-  return dirs.filter((dir) => (0, import_node_fs7.existsSync)(dir));
+  return dirs.filter((dir) => (0, import_node_fs8.existsSync)(dir));
 }
 function readPiSettings(path2) {
-  if (!(0, import_node_fs7.existsSync)(path2)) return void 0;
+  if (!(0, import_node_fs8.existsSync)(path2)) return void 0;
   try {
-    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs8.readFileSync)(path2, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
     return parsed;
   } catch {
@@ -9793,7 +9819,7 @@ function readPiSettings(path2) {
 }
 function mmiPiPackageEntry(env = process.env, home = (0, import_node_os4.homedir)()) {
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const settings = readPiSettings((0, import_node_path4.join)(dir, "settings.json"));
+    const settings = readPiSettings((0, import_node_path5.join)(dir, "settings.json"));
     const entries = Array.isArray(settings?.packages) ? settings.packages : [];
     for (const entry of entries) {
       if (typeof entry !== "string") continue;
@@ -9806,7 +9832,7 @@ var LEGACY_MMI_PI_PATH = /[/\\]mutmutco[/\\]mmi[/\\]\d+\.\d+\.\d+[/\\]\.pi-plugi
 function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os4.homedir)()) {
   const found = [];
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const settings = readPiSettings((0, import_node_path4.join)(dir, "settings.json"));
+    const settings = readPiSettings((0, import_node_path5.join)(dir, "settings.json"));
     const entries = Array.isArray(settings?.packages) ? settings.packages : [];
     for (const entry of entries) {
       if (typeof entry === "string" && LEGACY_MMI_PI_PATH.test(entry) && !found.includes(entry)) found.push(entry);
@@ -9816,8 +9842,8 @@ function legacyMmiPiPathEntries(env = process.env, home = (0, import_node_os4.ho
 }
 function mmiPiPackageRoot(env = process.env, home = (0, import_node_os4.homedir)()) {
   for (const dir of jervcodeAgentDirs(env, home)) {
-    const root = (0, import_node_path4.join)(dir, "npm", "node_modules", ...JERVCODE_NPM_PACKAGE.split("/"));
-    if ((0, import_node_fs7.existsSync)((0, import_node_path4.join)(root, "package.json"))) return root;
+    const root = (0, import_node_path5.join)(dir, "npm", "node_modules", ...JERVCODE_NPM_PACKAGE.split("/"));
+    if ((0, import_node_fs8.existsSync)((0, import_node_path5.join)(root, "package.json"))) return root;
   }
   return null;
 }
@@ -9825,7 +9851,7 @@ function installedJervCodePackageVersion(env = process.env, home = (0, import_no
   const root = mmiPiPackageRoot(env, home);
   if (!root) return void 0;
   try {
-    const manifest = JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path4.join)(root, "package.json"), "utf8"));
+    const manifest = JSON.parse((0, import_node_fs8.readFileSync)((0, import_node_path5.join)(root, "package.json"), "utf8"));
     return typeof manifest.version === "string" ? manifest.version : void 0;
   } catch {
     return void 0;
@@ -9833,17 +9859,17 @@ function installedJervCodePackageVersion(env = process.env, home = (0, import_no
 }
 function mmiPiPackageHealthy(env = process.env, home = (0, import_node_os4.homedir)()) {
   const root = mmiPiPackageRoot(env, home);
-  return Boolean(root && (0, import_node_fs7.existsSync)((0, import_node_path4.join)(root, "skills", "bootstrap", "SKILL.md")));
+  return Boolean(root && (0, import_node_fs8.existsSync)((0, import_node_path5.join)(root, "skills", "bootstrap", "SKILL.md")));
 }
 function piDoctorEnv(agentDir) {
   return { ...process.env, PI_CODING_AGENT_DIR: agentDir };
 }
 function openbotManagedRecord(env = process.env, home = (0, import_node_os4.homedir)()) {
   for (const workspace of openbotAgentWorkspaces(env, home)) {
-    const path2 = (0, import_node_path4.join)(workspace, ".agents", "skills", ".mmi-managed.json");
-    if (!(0, import_node_fs7.existsSync)(path2)) continue;
+    const path2 = (0, import_node_path5.join)(workspace, ".agents", "skills", ".mmi-managed.json");
+    if (!(0, import_node_fs8.existsSync)(path2)) continue;
     try {
-      const record2 = JSON.parse((0, import_node_fs7.readFileSync)(path2, "utf8"));
+      const record2 = JSON.parse((0, import_node_fs8.readFileSync)(path2, "utf8"));
       return { workspace, ...typeof record2.version === "string" ? { version: record2.version } : {} };
     } catch {
       return { workspace };
@@ -9855,9 +9881,9 @@ function openbotWorkspaceSkillsHealthy(env = process.env, home = (0, import_node
   const record2 = openbotManagedRecord(env, home);
   if (!record2) return false;
   try {
-    const recordFile = JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path4.join)(record2.workspace, ".agents", "skills", ".mmi-managed.json"), "utf8"));
+    const recordFile = JSON.parse((0, import_node_fs8.readFileSync)((0, import_node_path5.join)(record2.workspace, ".agents", "skills", ".mmi-managed.json"), "utf8"));
     const owned = Array.isArray(recordFile.skills) ? recordFile.skills : [];
-    return owned.length > 0 && owned.every((name) => typeof name === "string" && (0, import_node_fs7.existsSync)((0, import_node_path4.join)(record2.workspace, ".agents", "skills", name, "SKILL.md")));
+    return owned.length > 0 && owned.every((name) => typeof name === "string" && (0, import_node_fs8.existsSync)((0, import_node_path5.join)(record2.workspace, ".agents", "skills", name, "SKILL.md")));
   } catch {
     return false;
   }
@@ -9877,8 +9903,8 @@ function snapshotPluginGuardInput(surface = detectSurface(process.env), isOrgRep
     // JervCode's settings entry and native local surfaces have no marketplace clone.
     marketplaceClonePresent: surface === "jervcode" || surface === "openbot" ? true : marketplaceClonePresent(surface, (0, import_node_os4.homedir)()),
     pluginCachePresent: surface === "jervcode" ? mmiPiPackageHealthy() : surface === "openbot" ? openbotWorkspaceSkillsHealthy() : surface === "codex" ? Boolean(
-      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs7.existsSync)((0, import_node_path4.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
-    ) : (0, import_node_fs7.existsSync)((0, import_node_path4.join)(root, "plugins", "cache", "mutmutco", "mmi"))
+      codexStatus?.installed && codexStatus.enabled && codexStatus.version && (0, import_node_fs8.existsSync)((0, import_node_path5.join)(root, "plugins", "cache", CODEX_MARKETPLACE, "mmi", codexStatus.version))
+    ) : (0, import_node_fs8.existsSync)((0, import_node_path5.join)(root, "plugins", "cache", "mutmutco", "mmi"))
   };
 }
 async function runPluginCli(bin, args, log) {
@@ -9925,7 +9951,7 @@ async function runHealSteps(host, tableSteps, deps) {
   const refSupported = needsRefProbe ? await marketplaceAddRefSupported(host) : true;
   const { steps } = adaptHealStepsForRefSupport(tableSteps, refSupported);
   if (deps.banner) log(deps.banner(refSupported));
-  const pinsPath = (0, import_node_path4.join)((0, import_node_os4.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
+  const pinsPath = (0, import_node_path5.join)((0, import_node_os4.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE);
   const pins = host === "claude" ? captureMarketplacePins(readKnownMarketplacesFile(pinsPath), [MMI_MARKETPLACE_NAME, JERV_MARKETPLACE_NAME]) : /* @__PURE__ */ new Map();
   let failure;
   try {
@@ -10036,7 +10062,7 @@ async function healActivePluginForDoctor(surface = detectSurface(process.env), o
 }
 function readKnownMarketplacesFile(path2) {
   try {
-    return (0, import_node_fs7.existsSync)(path2) ? (0, import_node_fs7.readFileSync)(path2, "utf8") : void 0;
+    return (0, import_node_fs8.existsSync)(path2) ? (0, import_node_fs8.readFileSync)(path2, "utf8") : void 0;
   } catch {
     return void 0;
   }
@@ -10070,11 +10096,11 @@ function writeMarketplacePinsOnDisk(path2, pins, succeeded, failedVerb, declineW
       if (declined) return declined;
       const tmp = `${path2}.tmp-${process.pid}`;
       try {
-        (0, import_node_fs7.writeFileSync)(tmp, next, "utf8");
-        (0, import_node_fs7.renameSync)(tmp, path2);
+        (0, import_node_fs8.writeFileSync)(tmp, next, "utf8");
+        (0, import_node_fs8.renameSync)(tmp, path2);
       } catch {
         try {
-          (0, import_node_fs7.rmSync)(tmp, { force: true });
+          (0, import_node_fs8.rmSync)(tmp, { force: true });
         } catch {
         }
         return `could NOT ${failedVerb} ${[...pins.keys()].join(", ")} \u2014 set it by hand`;
@@ -10383,8 +10409,8 @@ function humanReadableArgName(arg2) {
 // node_modules/commander/lib/command.js
 var import_node_events = require("node:events");
 var import_node_child_process3 = __toESM(require("node:child_process"), 1);
-var import_node_path5 = __toESM(require("node:path"), 1);
-var import_node_fs8 = __toESM(require("node:fs"), 1);
+var import_node_path6 = __toESM(require("node:path"), 1);
+var import_node_fs9 = __toESM(require("node:fs"), 1);
 var import_node_process = __toESM(require("node:process"), 1);
 var import_node_util3 = require("node:util");
 
@@ -12352,7 +12378,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} subcommandName
    */
   _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-    if (import_node_fs8.default.existsSync(executableFile)) return;
+    if (import_node_fs9.default.existsSync(executableFile)) return;
     const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
     const executableMissing = `'${executableFile}' does not exist
  - if '${subcommandName}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead
@@ -12369,11 +12395,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
     args = args.slice();
     const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
     function findFile(baseDir, baseName) {
-      const localBin = import_node_path5.default.resolve(baseDir, baseName);
-      if (import_node_fs8.default.existsSync(localBin)) return localBin;
-      if (sourceExt.includes(import_node_path5.default.extname(baseName))) return void 0;
+      const localBin = import_node_path6.default.resolve(baseDir, baseName);
+      if (import_node_fs9.default.existsSync(localBin)) return localBin;
+      if (sourceExt.includes(import_node_path6.default.extname(baseName))) return void 0;
       const foundExt = sourceExt.find(
-        (ext) => import_node_fs8.default.existsSync(`${localBin}${ext}`)
+        (ext) => import_node_fs9.default.existsSync(`${localBin}${ext}`)
       );
       if (foundExt) return `${localBin}${foundExt}`;
       return void 0;
@@ -12385,21 +12411,21 @@ Expecting one of '${allowedValues.join("', '")}'`);
     if (this._scriptPath) {
       let resolvedScriptPath;
       try {
-        resolvedScriptPath = import_node_fs8.default.realpathSync(this._scriptPath);
+        resolvedScriptPath = import_node_fs9.default.realpathSync(this._scriptPath);
       } catch {
         resolvedScriptPath = this._scriptPath;
       }
-      executableDir = import_node_path5.default.resolve(
-        import_node_path5.default.dirname(resolvedScriptPath),
+      executableDir = import_node_path6.default.resolve(
+        import_node_path6.default.dirname(resolvedScriptPath),
         executableDir
       );
     }
     if (executableDir) {
       let localFile = findFile(executableDir, executableFile);
       if (!localFile && !subcommand._executableFile && this._scriptPath) {
-        const legacyName = import_node_path5.default.basename(
+        const legacyName = import_node_path6.default.basename(
           this._scriptPath,
-          import_node_path5.default.extname(this._scriptPath)
+          import_node_path6.default.extname(this._scriptPath)
         );
         if (legacyName !== this._name) {
           localFile = findFile(
@@ -12410,7 +12436,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       }
       executableFile = localFile || executableFile;
     }
-    const launchWithNode = sourceExt.includes(import_node_path5.default.extname(executableFile));
+    const launchWithNode = sourceExt.includes(import_node_path6.default.extname(executableFile));
     let proc;
     if (import_node_process.default.platform !== "win32") {
       if (launchWithNode) {
@@ -13327,7 +13353,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @return {Command}
    */
   nameFromFilename(filename) {
-    this._name = import_node_path5.default.basename(filename, import_node_path5.default.extname(filename));
+    this._name = import_node_path6.default.basename(filename, import_node_path6.default.extname(filename));
     return this;
   }
   /**
@@ -13604,27 +13630,27 @@ init_clean_exit();
 init_cli_shared();
 
 // src/doctor-fleet-drift.ts
-var import_node_fs9 = require("node:fs");
+var import_node_fs10 = require("node:fs");
 var import_node_os6 = require("node:os");
-var import_node_path6 = require("node:path");
+var import_node_path7 = require("node:path");
 var ALWAYS_ARMED_SURFACES = ["cli", "updater"];
 function updaterJournalPath(env = process.env) {
-  return (0, import_node_path6.join)(env.MMI_UPDATER_HOME || (0, import_node_path6.join)((0, import_node_os6.homedir)(), ".mmi", "updater"), "journal.jsonl");
+  return (0, import_node_path7.join)(env.MMI_UPDATER_HOME || (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".mmi", "updater"), "journal.jsonl");
 }
 var JOURNAL_TAIL_BYTES = 256 * 1024;
 function readJournalTail(path2, maxBytes) {
-  const fd = (0, import_node_fs9.openSync)(path2, "r");
+  const fd = (0, import_node_fs10.openSync)(path2, "r");
   try {
-    const size = (0, import_node_fs9.fstatSync)(fd).size;
+    const size = (0, import_node_fs10.fstatSync)(fd).size;
     const length = Math.min(size, maxBytes);
     const buffer = Buffer.alloc(length);
-    if (length) (0, import_node_fs9.readSync)(fd, buffer, 0, length, size - length);
+    if (length) (0, import_node_fs10.readSync)(fd, buffer, 0, length, size - length);
     const text = buffer.toString("utf8");
     if (length === size) return { text, truncated: false };
     const firstBreak = text.indexOf("\n");
     return { text: firstBreak === -1 ? "" : text.slice(firstBreak + 1), truncated: true };
   } finally {
-    (0, import_node_fs9.closeSync)(fd);
+    (0, import_node_fs10.closeSync)(fd);
   }
 }
 function parseFleetDrift(journalPath, text, activeSurfaces, truncated = false) {
@@ -14333,14 +14359,14 @@ function classifyParseError(plain) {
 }
 
 // src/released-version-cache.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_path8 = require("node:path");
 init_client_version();
 var RELEASED_VERSION_CACHE_MS = 24 * 36e5;
 function releasedVersionCachePath(runtimeRoot) {
-  return (0, import_node_path7.join)(runtimeRoot, "head-ts", ".released-version");
+  return (0, import_node_path8.join)(runtimeRoot, "head-ts", ".released-version");
 }
-function readReleasedVersionCache(cachePath, now = Date.now(), read = import_node_fs10.readFileSync, currentVersion = resolveClientVersion()) {
+function readReleasedVersionCache(cachePath, now = Date.now(), read = import_node_fs11.readFileSync, currentVersion = resolveClientVersion()) {
   let parsed;
   try {
     parsed = JSON.parse(read(cachePath, "utf8"));
@@ -14358,8 +14384,8 @@ function readReleasedVersionCache(cachePath, now = Date.now(), read = import_nod
 }
 function writeReleasedVersionCache(cachePath, version, now = Date.now()) {
   try {
-    (0, import_node_fs10.mkdirSync)((0, import_node_path7.dirname)(cachePath), { recursive: true });
-    (0, import_node_fs10.writeFileSync)(cachePath, JSON.stringify({ version, at: now }), "utf8");
+    (0, import_node_fs11.mkdirSync)((0, import_node_path8.dirname)(cachePath), { recursive: true });
+    (0, import_node_fs11.writeFileSync)(cachePath, JSON.stringify({ version, at: now }), "utf8");
   } catch {
   }
 }
@@ -14372,47 +14398,47 @@ function cachedReadNote(cachedAt, now = Date.now()) {
 }
 
 // src/archive-prune.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_path11 = require("node:path");
 
 // src/worktree-evidence-archive.ts
-var import_node_fs12 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs13 = require("node:fs");
+var import_node_path10 = require("node:path");
 
 // src/repo-runtime-state.ts
 var import_node_crypto3 = require("node:crypto");
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_node_os7 = require("node:os");
-var import_node_path8 = require("node:path");
+var import_node_path9 = require("node:path");
 var RUNTIME_DIR = "mmi-runtime";
 function hashPath(path2) {
-  return (0, import_node_crypto3.createHash)("sha256").update((0, import_node_path8.resolve)(path2)).digest("hex").slice(0, 16);
+  return (0, import_node_crypto3.createHash)("sha256").update((0, import_node_path9.resolve)(path2)).digest("hex").slice(0, 16);
 }
 function resolveGitDir(cwd) {
-  const dotGit = (0, import_node_path8.join)(cwd, ".git");
+  const dotGit = (0, import_node_path9.join)(cwd, ".git");
   try {
-    const st = (0, import_node_fs11.statSync)(dotGit);
+    const st = (0, import_node_fs12.statSync)(dotGit);
     if (st.isDirectory()) return dotGit;
     if (!st.isFile()) return void 0;
   } catch {
     return void 0;
   }
   try {
-    const raw = (0, import_node_fs11.readFileSync)(dotGit, "utf8").trim();
+    const raw = (0, import_node_fs12.readFileSync)(dotGit, "utf8").trim();
     const match = /^gitdir:\s*(.+)$/i.exec(raw);
     if (!match) return void 0;
     const gitdir = match[1].trim();
-    return (0, import_node_path8.isAbsolute)(gitdir) ? gitdir : (0, import_node_path8.resolve)(cwd, gitdir);
+    return (0, import_node_path9.isAbsolute)(gitdir) ? gitdir : (0, import_node_path9.resolve)(cwd, gitdir);
   } catch {
     return void 0;
   }
 }
 function resolveGitDirFrom(cwd) {
-  let dir = (0, import_node_path8.resolve)(cwd);
+  let dir = (0, import_node_path9.resolve)(cwd);
   for (; ; ) {
     const found = resolveGitDir(dir);
     if (found) return found;
-    const parent = (0, import_node_path8.dirname)(dir);
+    const parent = (0, import_node_path9.dirname)(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -14426,18 +14452,18 @@ function remoteOriginUrlFromConfig(configText) {
 function originUrlFromGitConfig(cwd = process.cwd()) {
   const gitDir = resolveGitDirFrom(cwd);
   if (!gitDir) return void 0;
-  const configs = [(0, import_node_path8.join)(gitDir, "config")];
+  const configs = [(0, import_node_path9.join)(gitDir, "config")];
   try {
-    const common = (0, import_node_fs11.readFileSync)((0, import_node_path8.join)(gitDir, "commondir"), "utf8").trim();
+    const common = (0, import_node_fs12.readFileSync)((0, import_node_path9.join)(gitDir, "commondir"), "utf8").trim();
     if (common) {
-      const commonDir = (0, import_node_path8.isAbsolute)(common) ? common : (0, import_node_path8.resolve)(gitDir, common);
-      configs.push((0, import_node_path8.join)(commonDir, "config"));
+      const commonDir = (0, import_node_path9.isAbsolute)(common) ? common : (0, import_node_path9.resolve)(gitDir, common);
+      configs.push((0, import_node_path9.join)(commonDir, "config"));
     }
   } catch {
   }
   for (const path2 of configs) {
     try {
-      const url = remoteOriginUrlFromConfig((0, import_node_fs11.readFileSync)(path2, "utf8"));
+      const url = remoteOriginUrlFromConfig((0, import_node_fs12.readFileSync)(path2, "utf8"));
       if (url) return url;
     } catch {
     }
@@ -14446,8 +14472,8 @@ function originUrlFromGitConfig(cwd = process.cwd()) {
 }
 function repoRuntimeStatePath(cwd, ...parts) {
   const gitDir = resolveGitDir(cwd);
-  if (gitDir && (0, import_node_fs11.existsSync)(gitDir)) return (0, import_node_path8.join)(gitDir, RUNTIME_DIR, ...parts);
-  return (0, import_node_path8.join)((0, import_node_os7.tmpdir)(), "mmi-cli", hashPath(cwd), ...parts);
+  if (gitDir && (0, import_node_fs12.existsSync)(gitDir)) return (0, import_node_path9.join)(gitDir, RUNTIME_DIR, ...parts);
+  return (0, import_node_path9.join)((0, import_node_os7.tmpdir)(), "mmi-cli", hashPath(cwd), ...parts);
 }
 
 // src/worktree-evidence-archive.ts
@@ -14467,24 +14493,24 @@ function resolveArtifactRunScope(env = process.env) {
 }
 function defaultIsDirectory(path2) {
   try {
-    return (0, import_node_fs12.lstatSync)(path2).isDirectory();
+    return (0, import_node_fs13.lstatSync)(path2).isDirectory();
   } catch {
     return false;
   }
 }
 function archiveWorktreeJervArtifacts(args, deps = {}) {
-  const exists = deps.exists ?? import_node_fs12.existsSync;
+  const exists = deps.exists ?? import_node_fs13.existsSync;
   const isDirectory = deps.isDirectory ?? defaultIsDirectory;
-  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs12.cpSync)(from, to, { recursive: true, force: true }));
+  const copyDir = deps.copyDir ?? ((from, to) => (0, import_node_fs13.cpSync)(from, to, { recursive: true, force: true }));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs12.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs13.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const resolveRoot = deps.resolveArchiveRoot ?? repoRuntimeStatePath;
   if (!args.primaryRoot?.trim()) return { status: "skipped", reason: "missing-primary-root" };
   if (!args.worktreePath?.trim()) return { status: "skipped", reason: "missing-worktree-path" };
-  const source = (0, import_node_path9.join)(args.worktreePath, ".jerv");
+  const source = (0, import_node_path10.join)(args.worktreePath, ".jerv");
   if (!exists(source)) return { status: "absent" };
   if (!isDirectory(source)) return { status: "skipped", reason: "jerv-not-a-directory" };
   const runScope = resolveArtifactRunScope(env);
@@ -14492,7 +14518,7 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   const stamp = now().toISOString().replace(/[:.]/g, "-");
   const dest = resolveRoot(args.primaryRoot, "jerv-artifacts", runScope, branchSlug, stamp, ".jerv");
   try {
-    mkdirp((0, import_node_path9.dirname)(dest));
+    mkdirp((0, import_node_path10.dirname)(dest));
     copyDir(source, dest);
     if (!exists(dest)) return { status: "failed", error: `archive write left no directory at ${dest}` };
     return { status: "archived", path: dest, runScope };
@@ -14501,27 +14527,27 @@ function archiveWorktreeJervArtifacts(args, deps = {}) {
   }
 }
 function defaultStat(path2) {
-  const st = (0, import_node_fs12.lstatSync)(path2);
+  const st = (0, import_node_fs13.lstatSync)(path2);
   return { mtimeMs: st.mtimeMs, size: st.size, isDirectory: () => st.isDirectory(), isSymbolicLink: () => st.isSymbolicLink() };
 }
 function scanWorktreeTmpEvidenceDetailed(worktreePath, newerThanMs, deps = {}) {
-  const exists = deps.exists ?? import_node_fs12.existsSync;
+  const exists = deps.exists ?? import_node_fs13.existsSync;
   const stat4 = deps.stat ?? defaultStat;
-  const readdir2 = deps.readdir ?? import_node_fs12.readdirSync;
+  const readdir2 = deps.readdir ?? import_node_fs13.readdirSync;
   const scan = { entries: [], excluded: [], links: [], unreadable: [] };
-  const tmpRoot = (0, import_node_path9.join)(worktreePath, "tmp");
+  const tmpRoot = (0, import_node_path10.join)(worktreePath, "tmp");
   if (!exists(tmpRoot)) return scan;
   const walk2 = (dir, preserved) => {
     let names;
     try {
       names = readdir2(dir);
     } catch {
-      scan.unreadable.push((0, import_node_path9.relative)(worktreePath, dir).replace(/\\/g, "/"));
+      scan.unreadable.push((0, import_node_path10.relative)(worktreePath, dir).replace(/\\/g, "/"));
       return;
     }
     for (const name of names) {
-      const full = (0, import_node_path9.join)(dir, name);
-      const relPath = (0, import_node_path9.relative)(worktreePath, full).replace(/\\/g, "/");
+      const full = (0, import_node_path10.join)(dir, name);
+      const relPath = (0, import_node_path10.relative)(worktreePath, full).replace(/\\/g, "/");
       let st;
       try {
         st = stat4(full);
@@ -14552,11 +14578,11 @@ function scanWorktreeTmpEvidence(worktreePath, newerThanMs, deps = {}) {
   return scanWorktreeTmpEvidenceDetailed(worktreePath, newerThanMs, deps).entries;
 }
 function archiveWorktreeTmpArtifacts(args, deps = {}) {
-  const copyFile = deps.copyFile ?? import_node_fs12.copyFileSync;
-  const fileSize = deps.fileSize ?? ((path2) => (0, import_node_fs12.statSync)(path2).size);
-  const writeFile5 = deps.writeFile ?? ((path2, text) => (0, import_node_fs12.writeFileSync)(path2, text));
+  const copyFile = deps.copyFile ?? import_node_fs13.copyFileSync;
+  const fileSize = deps.fileSize ?? ((path2) => (0, import_node_fs13.statSync)(path2).size);
+  const writeFile5 = deps.writeFile ?? ((path2, text) => (0, import_node_fs13.writeFileSync)(path2, text));
   const mkdirp = deps.mkdirp ?? ((path2) => {
-    (0, import_node_fs12.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs13.mkdirSync)(path2, { recursive: true });
   });
   const env = deps.env ?? process.env;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
@@ -14573,14 +14599,14 @@ function archiveWorktreeTmpArtifacts(args, deps = {}) {
   try {
     let bytes = 0;
     for (const entry of scan.entries) {
-      const to = (0, import_node_path9.join)(dest, entry.relPath.slice("tmp/".length));
-      mkdirp((0, import_node_path9.dirname)(to));
-      copyFile((0, import_node_path9.join)(args.worktreePath, entry.relPath), to);
+      const to = (0, import_node_path10.join)(dest, entry.relPath.slice("tmp/".length));
+      mkdirp((0, import_node_path10.dirname)(to));
+      copyFile((0, import_node_path10.join)(args.worktreePath, entry.relPath), to);
       const copied = fileSize(to);
       if (copied !== entry.bytes) return { status: "failed", error: `${entry.relPath} changed during archive (${entry.bytes} -> ${copied} bytes)` };
       bytes += copied;
     }
-    const manifest = (0, import_node_path9.join)((0, import_node_path9.dirname)(dest), "tmp-manifest.json");
+    const manifest = (0, import_node_path10.join)((0, import_node_path10.dirname)(dest), "tmp-manifest.json");
     writeFile5(manifest, `${JSON.stringify({ files: scan.entries.map(({ relPath, bytes: b }) => ({ relPath, bytes: b })), bytes, excluded: scan.excluded, skippedLinks: scan.links }, null, 2)}
 `);
     return { status: "archived", path: dest, runScope, entries: scan.entries.length, bytes, manifest, excluded: scan.excluded, skippedLinks: scan.links };
@@ -14675,8 +14701,8 @@ function parseSnapshotStamp(stamp) {
 function listDirs(path2) {
   try {
     const names = [];
-    for (const name of (0, import_node_fs13.readdirSync)(path2)) {
-      const st = (0, import_node_fs13.lstatSync)((0, import_node_path10.join)(path2, name));
+    for (const name of (0, import_node_fs14.readdirSync)(path2)) {
+      const st = (0, import_node_fs14.lstatSync)((0, import_node_path11.join)(path2, name));
       if (st.isDirectory() && !st.isSymbolicLink()) names.push(name);
     }
     return { names, unreadable: false };
@@ -14689,17 +14715,17 @@ function measureSnapshot(root) {
   const walk2 = (dir, preserved, inReinstallable) => {
     let names;
     try {
-      names = (0, import_node_fs13.readdirSync)(dir);
+      names = (0, import_node_fs14.readdirSync)(dir);
     } catch {
       out.uncertain = true;
       return 0;
     }
     let sum = 0;
     for (const name of names) {
-      const full = (0, import_node_path10.join)(dir, name);
+      const full = (0, import_node_path11.join)(dir, name);
       let st;
       try {
-        st = (0, import_node_fs13.lstatSync)(full);
+        st = (0, import_node_fs14.lstatSync)(full);
       } catch {
         out.uncertain = true;
         continue;
@@ -14726,10 +14752,10 @@ function inventoryArchives(archiveRootFor, nowMs = Date.now()) {
   for (const kind of ARCHIVE_KINDS) {
     const root = archiveRootFor(kind);
     for (const runScope of listDirs(root).names) {
-      for (const branch of listDirs((0, import_node_path10.join)(root, runScope)).names) {
-        const branchDir = (0, import_node_path10.join)(root, runScope, branch);
+      for (const branch of listDirs((0, import_node_path11.join)(root, runScope)).names) {
+        const branchDir = (0, import_node_path11.join)(root, runScope, branch);
         for (const stamp of listDirs(branchDir).names) {
-          const path2 = (0, import_node_path10.join)(branchDir, stamp);
+          const path2 = (0, import_node_path11.join)(branchDir, stamp);
           const measured = measureSnapshot(path2);
           let mtimeMs = nowMs;
           let timeKnown = true;
@@ -14737,14 +14763,14 @@ function inventoryArchives(archiveRootFor, nowMs = Date.now()) {
           if (stampMs !== void 0) mtimeMs = stampMs;
           else {
             try {
-              mtimeMs = (0, import_node_fs13.lstatSync)(path2).mtimeMs;
+              mtimeMs = (0, import_node_fs14.lstatSync)(path2).mtimeMs;
             } catch {
               timeKnown = false;
             }
           }
           let hasManifest = false;
           try {
-            hasManifest = (0, import_node_fs13.lstatSync)((0, import_node_path10.join)(path2, "tmp-manifest.json")).isFile();
+            hasManifest = (0, import_node_fs14.lstatSync)((0, import_node_path11.join)(path2, "tmp-manifest.json")).isFile();
           } catch {
             hasManifest = false;
           }
@@ -14766,28 +14792,28 @@ function inventoryArchives(archiveRootFor, nowMs = Date.now()) {
   return rows;
 }
 function insideRoot(root, target) {
-  const rel = (0, import_node_path10.relative)(root, target);
-  return rel !== "" && !rel.startsWith("..") && !(0, import_node_path10.isAbsolute)(rel) && !rel.split(import_node_path10.sep).includes("..");
+  const rel = (0, import_node_path11.relative)(root, target);
+  return rel !== "" && !rel.startsWith("..") && !(0, import_node_path11.isAbsolute)(rel) && !rel.split(import_node_path11.sep).includes("..");
 }
-function applyArchivePrune(plan, archiveRootFor, remove2 = (p) => (0, import_node_fs13.rmSync)(p, { recursive: true, force: true })) {
+function applyArchivePrune(plan, archiveRootFor, remove2 = (p) => (0, import_node_fs14.rmSync)(p, { recursive: true, force: true })) {
   const result = { removed: [], skipped: [], failed: [] };
   for (const snap of plan.snapshots) {
     if (snap.proposal !== "reclaim-dependency-trees") continue;
     let realRoot;
     try {
-      realRoot = (0, import_node_fs13.realpathSync)(archiveRootFor(snap.kind));
+      realRoot = (0, import_node_fs14.realpathSync)(archiveRootFor(snap.kind));
     } catch (e) {
       for (const d of snap.reinstallableDirs) result.failed.push({ path: d, error: `archive root unresolvable: ${errMsg(e)}` });
       continue;
     }
     for (const dir of snap.reinstallableDirs) {
       try {
-        const st = (0, import_node_fs13.lstatSync)(dir);
+        const st = (0, import_node_fs14.lstatSync)(dir);
         if (st.isSymbolicLink() || !st.isDirectory()) {
           result.skipped.push({ path: dir, reason: "no longer a real directory" });
           continue;
         }
-        const real = (0, import_node_fs13.realpathSync)(dir);
+        const real = (0, import_node_fs14.realpathSync)(dir);
         if (!insideRoot(realRoot, real)) {
           result.skipped.push({ path: dir, reason: "resolves outside the archive root" });
           continue;
@@ -14830,13 +14856,13 @@ function renderArchivePrunePlan(plan, applied) {
 }
 
 // src/schedules-drift-cache.ts
-var import_node_fs14 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_fs15 = require("node:fs");
+var import_node_path12 = require("node:path");
 var SCHEDULES_DRIFT_CACHE_MS = 6 * 36e5;
 function schedulesDriftCachePath(runtimeRoot) {
-  return (0, import_node_path11.join)(runtimeRoot, "head-ts", ".schedules-drift");
+  return (0, import_node_path12.join)(runtimeRoot, "head-ts", ".schedules-drift");
 }
-function readSchedulesDriftCache(cachePath, now = Date.now(), read = import_node_fs14.readFileSync) {
+function readSchedulesDriftCache(cachePath, now = Date.now(), read = import_node_fs15.readFileSync) {
   let parsed;
   try {
     parsed = JSON.parse(read(cachePath, "utf8"));
@@ -14853,8 +14879,8 @@ function readSchedulesDriftCache(cachePath, now = Date.now(), read = import_node
 }
 function writeSchedulesDriftCache(cachePath, driftLines, now = Date.now()) {
   try {
-    (0, import_node_fs14.mkdirSync)((0, import_node_path11.dirname)(cachePath), { recursive: true });
-    (0, import_node_fs14.writeFileSync)(cachePath, JSON.stringify({ driftLines, at: now }), "utf8");
+    (0, import_node_fs15.mkdirSync)((0, import_node_path12.dirname)(cachePath), { recursive: true });
+    (0, import_node_fs15.writeFileSync)(cachePath, JSON.stringify({ driftLines, at: now }), "utf8");
   } catch {
   }
 }
@@ -14865,8 +14891,8 @@ function cachedSweepNote(cachedAt, now = Date.now()) {
 
 // src/scratch-gc.ts
 var import_node_child_process4 = require("node:child_process");
-var import_node_fs15 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path13 = require("node:path");
 var PLAN_ADVISORY_AGE_MS = 30 * 24 * 36e5;
 var ROOT_SCRATCH_STALE_MS = 24 * 36e5;
 function executeScratchGc(repoRoot2, opts, now = Date.now(), deps = {}) {
@@ -14963,7 +14989,7 @@ function planScratchGc(snap, now = Date.now()) {
 function isLinkLike(path2, symbolic = false) {
   if (symbolic) return true;
   try {
-    (0, import_node_fs15.readlinkSync)(path2);
+    (0, import_node_fs16.readlinkSync)(path2);
     return true;
   } catch {
     return false;
@@ -14973,13 +14999,13 @@ function treeOlderThan(root, now, floor) {
   const stack = [root];
   while (stack.length) {
     const current = stack.pop();
-    const lst = (0, import_node_fs15.lstatSync)(current);
+    const lst = (0, import_node_fs16.lstatSync)(current);
     if (isLinkLike(current, lst.isSymbolicLink())) return false;
-    const st = (0, import_node_fs15.statSync)(current);
+    const st = (0, import_node_fs16.statSync)(current);
     if (now - st.mtimeMs <= floor) return false;
     if (!st.isDirectory()) continue;
-    for (const ent of (0, import_node_fs15.readdirSync)(current, { withFileTypes: true })) {
-      const child2 = (0, import_node_path12.join)(current, ent.name);
+    for (const ent of (0, import_node_fs16.readdirSync)(current, { withFileTypes: true })) {
+      const child2 = (0, import_node_path13.join)(current, ent.name);
       if (isLinkLike(child2, ent.isSymbolicLink())) return false;
       stack.push(child2);
     }
@@ -14991,13 +15017,13 @@ function applyScratchGc(plan, repoRoot2, now = Date.now(), deps = {}) {
   const result = { pruned: [], skipped: 0, bytes: 0 };
   let repoAnchor;
   try {
-    repoAnchor = (0, import_node_fs15.realpathSync)(repoRoot2).replace(/\\/g, "/").replace(/\/+$/, "");
+    repoAnchor = (0, import_node_fs16.realpathSync)(repoRoot2).replace(/\\/g, "/").replace(/\/+$/, "");
   } catch {
     return result;
   }
   for (const c of plan.safeAuto) {
     try {
-      const real = (0, import_node_fs15.realpathSync)(c.path).replace(/\\/g, "/");
+      const real = (0, import_node_fs16.realpathSync)(c.path).replace(/\\/g, "/");
       if (!pathContained(real, repoAnchor) || !rootCandidateStillAllowed(c, real, repoAnchor)) {
         result.skipped += 1;
         continue;
@@ -15006,12 +15032,12 @@ function applyScratchGc(plan, repoRoot2, now = Date.now(), deps = {}) {
         result.skipped += 1;
         continue;
       }
-      const lst = (0, import_node_fs15.lstatSync)(c.path);
+      const lst = (0, import_node_fs16.lstatSync)(c.path);
       if (isLinkLike(c.path, lst.isSymbolicLink())) {
         result.skipped += 1;
         continue;
       }
-      const st = (0, import_node_fs15.statSync)(real);
+      const st = (0, import_node_fs16.statSync)(real);
       if (c.kind === "dir" && !st.isDirectory() || c.kind !== "dir" && !st.isFile()) {
         result.skipped += 1;
         continue;
@@ -15025,8 +15051,8 @@ function applyScratchGc(plan, repoRoot2, now = Date.now(), deps = {}) {
         result.skipped += 1;
         continue;
       }
-      if (c.kind === "dir") (0, import_node_fs15.rmSync)(real, { recursive: true, force: true });
-      else (0, import_node_fs15.unlinkSync)(real);
+      if (c.kind === "dir") (0, import_node_fs16.rmSync)(real, { recursive: true, force: true });
+      else (0, import_node_fs16.unlinkSync)(real);
       result.pruned.push(c.path);
       result.bytes += c.bytes;
     } catch {
@@ -15040,19 +15066,19 @@ function pathContained(real, anchor) {
 }
 function rootCandidateStillAllowed(c, realPath, repoAnchor) {
   const path2 = realPath.replace(/\\/g, "/").replace(/\/+$/, "");
-  const parent = (0, import_node_path12.dirname)(path2).replace(/\\/g, "/").replace(/\/+$/, "");
-  const name = (0, import_node_path12.basename)(path2);
+  const parent = (0, import_node_path13.dirname)(path2).replace(/\\/g, "/").replace(/\/+$/, "");
+  const name = (0, import_node_path13.basename)(path2);
   if (c.family === "scratch-dir") return c.kind === "dir" && parent === repoAnchor && ROOT_SCRATCH_DIRS.has(name);
   if (c.family === "scratch-file") return (c.kind ?? "file") === "file" && parent === repoAnchor && ROOT_SCRATCH_FILE_PREFIXES.some((prefix) => name.startsWith(prefix));
   return false;
 }
 function trackedPathStatus(c, realPath, repoAnchor) {
-  const rel = (0, import_node_path12.relative)(repoAnchor, realPath).replace(/\\/g, "/");
+  const rel = (0, import_node_path13.relative)(repoAnchor, realPath).replace(/\\/g, "/");
   if (!rel || rel.startsWith("../") || rel === "..") return null;
   const gitPath = c.kind === "dir" ? `${rel.replace(/\/+$/, "")}/` : rel;
   let hasDotGit = false;
   try {
-    (0, import_node_fs15.lstatSync)((0, import_node_path12.join)(repoAnchor, ".git"));
+    (0, import_node_fs16.lstatSync)((0, import_node_path13.join)(repoAnchor, ".git"));
     hasDotGit = true;
   } catch {
     hasDotGit = false;
@@ -15093,10 +15119,10 @@ function rootScratchDirSnapshot(root, readdir2, stat4) {
     while (stack.length) {
       const current = stack.pop();
       for (const ent of readdir2(current, { withFileTypes: true })) {
-        const child2 = (0, import_node_path12.join)(current, ent.name);
+        const child2 = (0, import_node_path13.join)(current, ent.name);
         if (ent.isSymbolicLink?.()) return null;
         try {
-          (0, import_node_fs15.readlinkSync)(child2);
+          (0, import_node_fs16.readlinkSync)(child2);
           return null;
         } catch {
         }
@@ -15119,12 +15145,12 @@ function resolveRealPathOrRaw(p, realpath) {
   }
 }
 function collectScratchSnapshot(repoRoot2, deps = {}) {
-  const readdir2 = deps.readdir ?? import_node_fs15.readdirSync;
-  const stat4 = deps.stat ?? import_node_fs15.statSync;
-  const realpath = deps.realpath ?? import_node_fs15.realpathSync;
+  const readdir2 = deps.readdir ?? import_node_fs16.readdirSync;
+  const stat4 = deps.stat ?? import_node_fs16.statSync;
+  const realpath = deps.realpath ?? import_node_fs16.realpathSync;
   const trackedStatus = deps.trackedStatus ?? trackedPathStatus;
   const repoAnchor = resolveRealPathOrRaw(repoRoot2, realpath).replace(/\\/g, "/").replace(/\/+$/, "");
-  const plansRoot = (0, import_node_path12.join)(repoRoot2, "plans");
+  const plansRoot = (0, import_node_path13.join)(repoRoot2, "plans");
   const rootScratchFiles = [];
   try {
     for (const ent of readdir2(repoRoot2, { withFileTypes: true })) {
@@ -15133,7 +15159,7 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
       if (!(isDir && ROOT_SCRATCH_DIRS.has(ent.name)) && !(isFile && ROOT_SCRATCH_FILE_PREFIXES.some((prefix) => ent.name.startsWith(prefix)))) {
         continue;
       }
-      const full = (0, import_node_path12.join)(repoRoot2, ent.name);
+      const full = (0, import_node_path13.join)(repoRoot2, ent.name);
       const kind = isDir ? "dir" : "file";
       try {
         const realFull = resolveRealPathOrRaw(full, realpath).replace(/\\/g, "/");
@@ -15156,7 +15182,7 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
   try {
     for (const ent of readdir2(plansRoot, { withFileTypes: true })) {
       if (!ent.isFile() || !ent.name.endsWith(".md")) continue;
-      const full = (0, import_node_path12.join)(plansRoot, ent.name);
+      const full = (0, import_node_path13.join)(plansRoot, ent.name);
       try {
         const st = stat4(full);
         planMdFiles.push({ path: full, dir: plansRoot, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file" });
@@ -15270,9 +15296,9 @@ var import_node_os29 = require("node:os");
 var import_node_path65 = require("node:path");
 
 // src/board-read.ts
-var import_node_fs18 = require("node:fs");
+var import_node_fs19 = require("node:fs");
 var import_node_os11 = require("node:os");
-var import_node_path15 = require("node:path");
+var import_node_path16 = require("node:path");
 init_cli_shared();
 init_github_client();
 
@@ -15496,6 +15522,9 @@ var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
   // #9587: one named run rerun (all or failed jobs) — same actions:write profile, nothing broader.
   ["run rerun", { metadata: "read", actions: "write" }],
   ["run dispatch", { metadata: "read", actions: "write" }],
+  // #10142: one focused-test dispatch plus the run/job/log reads that give it a verdict on the owned
+  // heavy lanes — the same actions:write profile, nothing broader (it reads no repo contents).
+  ["run test", { metadata: "read", actions: "write" }],
   // #9780: repository Actions variables — get/list mint only Variables:read; create/update/delete
   // Variables:write. Repository scope only; no secret store, no rename, no workflow dispatch.
   // #9790: the token key is `actions_variables` (as ci-reconcile.yml mints); `variables` was refused 422.
@@ -16170,26 +16199,26 @@ init_github_quota();
 
 // src/rest-etag-cache.ts
 var import_node_crypto6 = require("node:crypto");
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var import_node_os8 = require("node:os");
-var import_node_path13 = require("node:path");
+var import_node_path14 = require("node:path");
 var MAX_AGE_MS = 24 * 60 * 6e4;
 var MAX_ENTRIES = 256;
 var MAX_BYTES = 16 * 1024 * 1024;
 var MAX_ENTRY_BYTES = 1024 * 1024;
 function restEtagCacheDir() {
   if (process.env.MMI_REST_ETAG_CACHE_DIR) return process.env.MMI_REST_ETAG_CACHE_DIR;
-  return process.platform === "win32" ? (0, import_node_path13.join)(process.env.LOCALAPPDATA || (0, import_node_path13.join)((0, import_node_os8.homedir)(), "AppData", "Local"), "MMI Future", "mmi-cli", "rest-etags") : (0, import_node_path13.join)(process.env.XDG_CACHE_HOME || (0, import_node_path13.join)((0, import_node_os8.homedir)(), ".cache"), "mmi-cli", "rest-etags");
+  return process.platform === "win32" ? (0, import_node_path14.join)(process.env.LOCALAPPDATA || (0, import_node_path14.join)((0, import_node_os8.homedir)(), "AppData", "Local"), "MMI Future", "mmi-cli", "rest-etags") : (0, import_node_path14.join)(process.env.XDG_CACHE_HOME || (0, import_node_path14.join)((0, import_node_os8.homedir)(), ".cache"), "mmi-cli", "rest-etags");
 }
 function entryPath(dir, key) {
-  return (0, import_node_path13.join)(dir, `${(0, import_node_crypto6.createHash)("sha256").update(key).digest("hex")}.json`);
+  return (0, import_node_path14.join)(dir, `${(0, import_node_crypto6.createHash)("sha256").update(key).digest("hex")}.json`);
 }
 function readRestEtag(key, dir = restEtagCacheDir()) {
   if (dir === "off") return void 0;
   try {
     const path2 = entryPath(dir, key);
-    if ((0, import_node_fs16.statSync)(path2).size > MAX_ENTRY_BYTES) return void 0;
-    const entry = JSON.parse((0, import_node_fs16.readFileSync)(path2, "utf8"));
+    if ((0, import_node_fs17.statSync)(path2).size > MAX_ENTRY_BYTES) return void 0;
+    const entry = JSON.parse((0, import_node_fs17.readFileSync)(path2, "utf8"));
     const age = Date.now() - entry.storedAt;
     if (typeof entry.etag === "string" && entry.etag && !/[\r\n]/.test(entry.etag) && typeof entry.body === "string" && Number.isFinite(entry.storedAt) && age >= 0 && age <= MAX_AGE_MS) return entry;
   } catch {
@@ -16199,18 +16228,18 @@ function readRestEtag(key, dir = restEtagCacheDir()) {
 function deleteRestEtag(key, dir = restEtagCacheDir()) {
   if (dir === "off") return;
   try {
-    (0, import_node_fs16.rmSync)(entryPath(dir, key), { force: true });
+    (0, import_node_fs17.rmSync)(entryPath(dir, key), { force: true });
   } catch {
   }
 }
 function prune(dir) {
   const now = Date.now();
-  const files = (0, import_node_fs16.readdirSync)(dir).filter((name) => /^[a-f0-9]{64}\.json(?:\.tmp-.+)?$/.test(name)).flatMap((name) => {
+  const files = (0, import_node_fs17.readdirSync)(dir).filter((name) => /^[a-f0-9]{64}\.json(?:\.tmp-.+)?$/.test(name)).flatMap((name) => {
     try {
-      const path2 = (0, import_node_path13.join)(dir, name);
-      const stat4 = (0, import_node_fs16.statSync)(path2);
+      const path2 = (0, import_node_path14.join)(dir, name);
+      const stat4 = (0, import_node_fs17.statSync)(path2);
       if (now - stat4.mtimeMs > MAX_AGE_MS) {
-        (0, import_node_fs16.rmSync)(path2, { force: true });
+        (0, import_node_fs17.rmSync)(path2, { force: true });
         return [];
       }
       return name.endsWith(".json") ? [{ path: path2, size: stat4.size, at: stat4.mtimeMs }] : [];
@@ -16223,7 +16252,7 @@ function prune(dir) {
   for (const file of files) {
     if (count <= MAX_ENTRIES && bytes <= MAX_BYTES) break;
     try {
-      (0, import_node_fs16.rmSync)(file.path, { force: true });
+      (0, import_node_fs17.rmSync)(file.path, { force: true });
       bytes -= file.size;
       count--;
     } catch {
@@ -16240,14 +16269,14 @@ function writeRestEtag(key, entry, dir = restEtagCacheDir()) {
       deleteRestEtag(key, dir);
       return;
     }
-    (0, import_node_fs16.mkdirSync)(dir, { recursive: true, mode: 448 });
-    (0, import_node_fs16.writeFileSync)(tmp, data, { mode: 384, flag: "wx" });
-    (0, import_node_fs16.renameSync)(tmp, path2);
+    (0, import_node_fs17.mkdirSync)(dir, { recursive: true, mode: 448 });
+    (0, import_node_fs17.writeFileSync)(tmp, data, { mode: 384, flag: "wx" });
+    (0, import_node_fs17.renameSync)(tmp, path2);
     prune(dir);
   } catch {
   } finally {
     try {
-      (0, import_node_fs16.rmSync)(tmp, { force: true });
+      (0, import_node_fs17.rmSync)(tmp, { force: true });
     } catch {
     }
   }
@@ -18712,7 +18741,7 @@ var SCHEDULE_EXECUTORS = /* @__PURE__ */ new Set([
 function parseScheduleHeader(yamlText) {
   const out = {};
   for (const rawLine of yamlText.split("\n")) {
-    const m = /^#\s*(schedule|what|owner|cadence|executor|llm|output|breaks|kill|target|model):\s*(.+?)\s*$/.exec(rawLine);
+    const m = /^#\s*(schedule|what|owner|cadence|executor|llm|output|breaks|kill|target|model|fire):\s*(.+?)\s*$/.exec(rawLine);
     if (m && out[m[1]] === void 0) out[m[1]] = m[2].trim();
   }
   return out;
@@ -18793,6 +18822,10 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   if (header.model !== void 0) {
     throw new Error(`schedules register: ${expectedId} header \`model: ${header.model}\` is refused \u2014 a model role key is valid only on an LLM lane, and no scheduled-LLM executor is supported (Cursor retired #7779; Codex executor retired #7821). Remove the line.`);
   }
+  const fire = header.fire;
+  if (fire !== void 0 && (h.executor !== "github-actions" || fire !== "v1")) {
+    throw new Error(`schedules register: ${expectedId} header \`fire: ${fire}\` is invalid \u2014 the fire contract is \`fire: v1\`, github-actions rows only (#9996). An unknown revision would register a row the dispatcher cannot protect; a non-github-actions row has no workflow to claim it.`);
+  }
   return {
     id: expectedId,
     what: h.what,
@@ -18805,7 +18838,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
     kill: h.kill,
     repo,
     sourcePath: workflowPath,
-    ...target !== void 0 ? { target } : {}
+    ...target !== void 0 ? { target } : {},
+    ...fire !== void 0 ? { fire } : {}
   };
 }
 function scheduleRecordsFromWorkflows(repo, files) {
@@ -20290,9 +20324,9 @@ init_clean_exit();
 
 // src/gh-create.ts
 var import_promises = require("node:fs/promises");
-var import_node_fs17 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path14 = require("node:path");
+var import_node_path15 = require("node:path");
 var import_node_crypto7 = require("node:crypto");
 
 // src/board-priority.ts
@@ -20380,8 +20414,8 @@ async function bodyArgsViaFile(args, deps = {}) {
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os9.tmpdir)();
-  const file = (0, import_node_path14.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto7.randomBytes)(4).toString("hex")}.md`);
-  await ensureDir((0, import_node_path14.dirname)(file), { recursive: true }).catch(() => {
+  const file = (0, import_node_path15.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto7.randomBytes)(4).toString("hex")}.md`);
+  await ensureDir((0, import_node_path15.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, args[i + 1], "utf8");
   return {
@@ -20581,8 +20615,8 @@ function retryBodyFile(args) {
   if (file !== void 0) return file;
   const body = flagValue(args, "--body");
   if (body === void 0) return void 0;
-  const path2 = (0, import_node_path14.join)((0, import_node_fs17.mkdtempSync)((0, import_node_path14.join)((0, import_node_os9.tmpdir)(), "mmi-create-retry-")), "body.md");
-  (0, import_node_fs17.writeFileSync)(path2, body, "utf8");
+  const path2 = (0, import_node_path15.join)((0, import_node_fs18.mkdtempSync)((0, import_node_path15.join)((0, import_node_os9.tmpdir)(), "mmi-create-retry-")), "body.md");
+  (0, import_node_fs18.writeFileSync)(path2, body, "utf8");
   return path2;
 }
 function buildPrCreateRetryCommand(args) {
@@ -20731,7 +20765,7 @@ async function defaultRestCreatePr(exec3, input, deps = {}) {
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os9.tmpdir)();
-  const file = (0, import_node_path14.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto7.randomBytes)(4).toString("hex")}.json`);
+  const file = (0, import_node_path15.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto7.randomBytes)(4).toString("hex")}.json`);
   const payload = {
     title: input.title,
     head: input.head,
@@ -20739,7 +20773,7 @@ async function defaultRestCreatePr(exec3, input, deps = {}) {
   };
   if (input.base) payload.base = input.base;
   if (input.draft) payload.draft = true;
-  await ensureDir((0, import_node_path14.dirname)(file), { recursive: true }).catch(() => {
+  await ensureDir((0, import_node_path15.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, JSON.stringify(payload), "utf8");
   const args = [
@@ -24041,11 +24075,11 @@ function scanSessionTranscripts(root, matches, now) {
   const pending = [root];
   while (pending.length) {
     const dir = pending.pop();
-    for (const entry of (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true })) {
-      const path2 = (0, import_node_path15.join)(dir, entry.name);
+    for (const entry of (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true })) {
+      const path2 = (0, import_node_path16.join)(dir, entry.name);
       if (entry.isDirectory()) pending.push(path2);
       else if (entry.isFile() && matches(entry.name.toLowerCase())) {
-        return now - (0, import_node_fs18.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead";
+        return now - (0, import_node_fs19.statSync)(path2).mtimeMs <= CLAIM_SESSION_ACTIVITY_MS ? "live" : "dead";
       }
     }
   }
@@ -24065,7 +24099,7 @@ function probeLocalClaimSession(marker, now = Date.now(), roots = {}) {
   };
   try {
     const session = marker.session.toLowerCase();
-    const state = kind === "claude" ? scanSessionTranscripts(roots.claude ?? (0, import_node_path15.join)((0, import_node_os11.homedir)(), ".claude", "projects"), (name) => name === `${session}.jsonl`, now) : scanSessionTranscripts(roots.jerv ?? (0, import_node_path15.join)((0, import_node_os11.homedir)(), ".jerv", "agent", "sessions"), (name) => name.endsWith(`_${session}.jsonl`), now);
+    const state = kind === "claude" ? scanSessionTranscripts(roots.claude ?? (0, import_node_path16.join)((0, import_node_os11.homedir)(), ".claude", "projects"), (name) => name === `${session}.jsonl`, now) : scanSessionTranscripts(roots.jerv ?? (0, import_node_path16.join)((0, import_node_os11.homedir)(), ".jerv", "agent", "sessions"), (name) => name.endsWith(`_${session}.jsonl`), now);
     return remember(state);
   } catch {
     return remember("unverifiable");
@@ -24558,8 +24592,8 @@ async function claimOneBoardItem(ctx, selector, options) {
     });
     if (contest.contested && !ctx.landing && contest.branch) {
       const candidateBranch = contest.branch.replace(/ \(head of open PR .*\)$/, "").trim();
-      const originRepo = repoFromRemoteUrl(await ctx.git(["remote", "get-url", "origin"]).catch(() => ""));
-      if (originRepo && originRepo.toLowerCase() === item.repository.toLowerCase()) {
+      const originRepo2 = repoFromRemoteUrl(await ctx.git(["remote", "get-url", "origin"]).catch(() => ""));
+      if (originRepo2 && originRepo2.toLowerCase() === item.repository.toLowerCase()) {
         const localSha = (await ctx.git(["rev-parse", "--verify", `refs/heads/${candidateBranch}^{commit}`]).catch(() => "")).trim();
         const currentBranch2 = (await ctx.git(["symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => "")).trim();
         if (localSha && (!contest.branchSha || localSha === contest.branchSha) || currentBranch2 === candidateBranch) {
@@ -25252,6 +25286,11 @@ function loadBootstrapSeeds(manifestJson) {
     if (s.ownership !== "org" && s.ownership !== "repo") {
       throw new Error(`invalid seed ownership '${s.ownership}' for ${s.target} (must be 'org' or 'repo')`);
     }
+    if (s.repos !== void 0) {
+      if (!Array.isArray(s.repos) || s.repos.length === 0 || s.repos.some((r) => typeof r !== "string" || !r.trim() || r.includes("/"))) {
+        throw new Error(`invalid repos scope for ${s.target} (needs a non-empty list of repo slugs, no owner prefix): ${JSON.stringify(s.repos)}`);
+      }
+    }
     if (s.managedBlock) {
       const block = s.managedBlock;
       if (!block.source || !block.begin || !block.end || block.begin === block.end || /[\r\n]/.test(block.begin + block.end)) {
@@ -25277,6 +25316,11 @@ function seedMatchesReleaseTrack(seed, releaseTrack) {
   if (!seed.releaseTracks?.length) return true;
   return releaseTrack != null && seed.releaseTracks.includes(releaseTrack);
 }
+function seedMatchesRepo(seed, repo) {
+  if (!seed.repos?.length) return true;
+  const slug = (repo ?? "").split("/").pop().trim().toLowerCase();
+  return slug !== "" && seed.repos.some((s) => s.trim().toLowerCase() === slug);
+}
 var TRAIN_ONLY_BEGIN = "mmi-train-only:start";
 var TRAIN_ONLY_END = "mmi-train-only:end";
 function renderSelfSeedForTrack(content, releaseTrack) {
@@ -25534,13 +25578,13 @@ function planManagedGitignore(current) {
 }
 
 // src/docs-index-command.ts
-var import_node_fs20 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_path18 = require("node:path");
 
 // src/doc-refs-core.ts
 var import_node_child_process6 = require("node:child_process");
-var import_node_fs19 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_path17 = require("node:path");
 var PIN_RE = /<!--\s*pinned by\s+([^:]+?)\s*:\s*"([^"]+)"[^"]*-->/;
 var PIN_MENTION_RE = /<!--\s*pinned by\b/;
 var FWD_RE = /<!--\s*forward-ref:\s*(\S+?)\s*-->/;
@@ -25602,7 +25646,7 @@ function checkPins(root, readFile11, docs) {
         findings.push({ kind: "malformed-pin", doc, line: pin.line, detail: pin.text });
         continue;
       }
-      const source = readFile11((0, import_node_path16.join)(root, pin.file));
+      const source = readFile11((0, import_node_path17.join)(root, pin.file));
       if (source == null) {
         findings.push({ kind: "missing-test", doc, line: pin.line, detail: pin.file });
         continue;
@@ -25665,11 +25709,11 @@ function checkRefs(root, deps, docs) {
     for (const { ref } of extractRefs(markdown)) allFirstSegments.add(refFirstSegment(ref));
   }
   const tracked = allFirstSegments.size ? deps.trackedFirstSegments?.([...allFirstSegments]) ?? null : null;
-  const firstVerifiable = (first) => tracked ? tracked.has(first) : exists((0, import_node_path16.join)(root, first));
+  const firstVerifiable = (first) => tracked ? tracked.has(first) : exists((0, import_node_path17.join)(root, first));
   const candidates = [];
   const direct = [];
   for (const [doc, markdown] of Object.entries(docs)) {
-    const docDir = import_node_path16.posix.dirname(doc);
+    const docDir = import_node_path17.posix.dirname(doc);
     const base = docDir === "." ? "" : docDir;
     const covered = /* @__PURE__ */ new Set();
     const markers = [];
@@ -25678,21 +25722,21 @@ function checkRefs(root, deps, docs) {
         direct.push({ kind: "malformed-forward-ref", doc, line: fwd.line, detail: fwd.text });
         continue;
       }
-      const docRel = import_node_path16.posix.normalize(import_node_path16.posix.join(base, fwd.target));
-      const rootRel = import_node_path16.posix.normalize(fwd.target.replace(/^\/+/, ""));
+      const docRel = import_node_path17.posix.normalize(import_node_path17.posix.join(base, fwd.target));
+      const rootRel = import_node_path17.posix.normalize(fwd.target.replace(/^\/+/, ""));
       markers.push({ target: fwd.target, line: fwd.line, docRel, rootRel });
       covered.add(docRel);
       covered.add(rootRel);
     }
     const links = extractLinks(markdown).map(({ target, line }) => {
-      const resolved = import_node_path16.posix.normalize(import_node_path16.posix.join(base, target));
-      return { target, line, resolved, missing: !exists((0, import_node_path16.join)(root, resolved)) };
+      const resolved = import_node_path17.posix.normalize(import_node_path17.posix.join(base, target));
+      return { target, line, resolved, missing: !exists((0, import_node_path17.join)(root, resolved)) };
     });
     for (const marker of markers) {
       const coversMissing = links.some(
         (l) => l.missing && (l.resolved === marker.docRel || l.resolved === marker.rootRel)
       );
-      if (!coversMissing && (exists((0, import_node_path16.join)(root, marker.docRel)) || exists((0, import_node_path16.join)(root, marker.rootRel)))) {
+      if (!coversMissing && (exists((0, import_node_path17.join)(root, marker.docRel)) || exists((0, import_node_path17.join)(root, marker.rootRel)))) {
         direct.push({
           kind: "stale-forward-ref",
           doc,
@@ -25703,7 +25747,7 @@ function checkRefs(root, deps, docs) {
     }
     for (const { ref, line } of extractRefs(markdown)) {
       if (!firstVerifiable(refFirstSegment(ref))) continue;
-      if (!exists((0, import_node_path16.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
+      if (!exists((0, import_node_path17.join)(root, ref))) candidates.push({ kind: "missing-path", doc, line, detail: ref });
     }
     for (const { target, line, resolved, missing } of links) {
       if (resolved.startsWith("..")) {
@@ -25826,7 +25870,7 @@ function checkRunbookClaims(root, docs, deps) {
         const dir = prefix >= 0 ? args[prefix + 1] : ".";
         const script = args.slice(run + 1).find((token, i, tail) => !token.startsWith("-") && tail[i - 1] !== "--prefix");
         if (!dir || !script || placeholder(dir) || placeholder(script)) continue;
-        const manifest = deps.readFile((0, import_node_path16.join)(root, dir, "package.json"));
+        const manifest = deps.readFile((0, import_node_path17.join)(root, dir, "package.json"));
         const scripts = manifest ? JSON.parse(manifest).scripts : void 0;
         if (!scripts || !Object.hasOwn(scripts, script)) report("missing-script", `npm run ${script} (${dir}/package.json)`);
       } else if ((cmd === "python" || cmd === "python3") && args[0] === "-m") {
@@ -25836,10 +25880,10 @@ function checkRunbookClaims(root, docs, deps) {
         const first = rel.split("/")[0];
         const tracked = deps.trackedFirstSegments([first, `${first}.py`, `src/${first}`, `src/${first}.py`]);
         const roots = ["", "src/"].filter((prefix) => {
-          if (!prefix) return tracked ? tracked.has(first) || tracked.has(`${first}.py`) : deps.exists((0, import_node_path16.join)(root, first)) || deps.exists((0, import_node_path16.join)(root, `${first}.py`));
-          return tracked ? tracked.has(`src/${first}`) || tracked.has(`src/${first}.py`) : deps.exists((0, import_node_path16.join)(root, "src", first)) || deps.exists((0, import_node_path16.join)(root, "src", `${first}.py`));
+          if (!prefix) return tracked ? tracked.has(first) || tracked.has(`${first}.py`) : deps.exists((0, import_node_path17.join)(root, first)) || deps.exists((0, import_node_path17.join)(root, `${first}.py`));
+          return tracked ? tracked.has(`src/${first}`) || tracked.has(`src/${first}.py`) : deps.exists((0, import_node_path17.join)(root, "src", first)) || deps.exists((0, import_node_path17.join)(root, "src", `${first}.py`));
         });
-        if (roots.length && !roots.some((prefix) => [".py", "/__init__.py", "/__main__.py"].some((suffix) => deps.exists((0, import_node_path16.join)(root, `${prefix}${rel}${suffix}`))))) {
+        if (roots.length && !roots.some((prefix) => [".py", "/__init__.py", "/__main__.py"].some((suffix) => deps.exists((0, import_node_path17.join)(root, `${prefix}${rel}${suffix}`))))) {
           report("missing-module", module2);
         }
       } else if (["node", "bash", "sh"].includes(cmd)) {
@@ -25847,7 +25891,7 @@ function checkRunbookClaims(root, docs, deps) {
         if (!rel || rel.startsWith("-") || placeholder(rel) || /^(\/|[A-Za-z]:|\.\.\/)/.test(rel)) continue;
         const first = refFirstSegment(rel);
         const tracked = deps.trackedFirstSegments([first]);
-        if ((tracked ? tracked.has(first) : deps.exists((0, import_node_path16.join)(root, first))) && !deps.exists((0, import_node_path16.join)(root, rel)) && !deps.isIgnored([rel]).has(rel)) report("missing-path", rel);
+        if ((tracked ? tracked.has(first) : deps.exists((0, import_node_path17.join)(root, first))) && !deps.exists((0, import_node_path17.join)(root, rel)) && !deps.isIgnored([rel]).has(rel)) report("missing-path", rel);
       }
     }
   }
@@ -25899,14 +25943,14 @@ function checkRunbookCoverage(docs, base, git3) {
   return findings;
 }
 function checkSeedRunbookReview(root, base, readFile11, git3) {
-  const manifestJson = readFile11((0, import_node_path16.join)(root, "skills/bootstrap/seeds/manifest.json"));
+  const manifestJson = readFile11((0, import_node_path17.join)(root, "skills/bootstrap/seeds/manifest.json"));
   if (!manifestJson) return [];
   const changed = new Set(git3(["diff", "--name-only", `${base}...HEAD`]).split(/\r?\n/).filter(Boolean));
   const touched = loadBootstrapSeeds(manifestJson).seeds.filter((seed) => isPropagatableSeed(seed) && changed.has(seedSourcePath(seed)));
   if (!touched.length) return [];
   let declarations = null;
   try {
-    declarations = JSON.parse(readFile11((0, import_node_path16.join)(root, RUNBOOK_UNAFFECTED_PATH)) ?? "null");
+    declarations = JSON.parse(readFile11((0, import_node_path17.join)(root, RUNBOOK_UNAFFECTED_PATH)) ?? "null");
   } catch {
     declarations = null;
   }
@@ -25931,24 +25975,24 @@ function checkSeedRunbookReview(root, base, readFile11, git3) {
   return findings;
 }
 function readFileOrNull(path2) {
-  return (0, import_node_fs19.existsSync)(path2) ? (0, import_node_fs19.readFileSync)(path2, "utf8") : null;
+  return (0, import_node_fs20.existsSync)(path2) ? (0, import_node_fs20.readFileSync)(path2, "utf8") : null;
 }
 function walk(dir, root, out) {
-  for (const entry of (0, import_node_fs19.readdirSync)(dir)) {
-    const full = (0, import_node_path16.join)(dir, entry);
-    if ((0, import_node_fs19.statSync)(full).isDirectory()) walk(full, root, out);
+  for (const entry of (0, import_node_fs20.readdirSync)(dir)) {
+    const full = (0, import_node_path17.join)(dir, entry);
+    if ((0, import_node_fs20.statSync)(full).isDirectory()) walk(full, root, out);
     else if (entry.endsWith(".md")) out.push(full.slice(root.length + 1).replaceAll("\\", "/"));
   }
   return out;
 }
 function defaultListDocs(root) {
   const docs = ["docs", "skills/org-guide", "skills/mmi-help"].flatMap((path2) => {
-    const directory = (0, import_node_path16.join)(root, path2);
-    return (0, import_node_fs19.existsSync)(directory) ? walk(directory, root, []) : [];
+    const directory = (0, import_node_path17.join)(root, path2);
+    return (0, import_node_fs20.existsSync)(directory) ? walk(directory, root, []) : [];
   }).filter(
     (rel) => !SKIP_WALK.some((skip) => rel.startsWith(skip))
   );
-  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs19.existsSync)((0, import_node_path16.join)(root, rel))), ...docs];
+  return [...ROOT_DOCS.filter((rel) => (0, import_node_fs20.existsSync)((0, import_node_path17.join)(root, rel))), ...docs];
 }
 var CHECK_IGNORE_MAX_BUFFER = 32 * 1024 * 1024;
 function defaultIsIgnored(root, relPaths, exec3 = import_node_child_process6.execFileSync) {
@@ -26022,7 +26066,7 @@ function mergeGroupRunbookMessages(root, deps, readFile11, warnings) {
 }
 function runDocRefs(root, deps = {}) {
   const readFile11 = deps.readFile ?? readFileOrNull;
-  const exists = deps.exists ?? import_node_fs19.existsSync;
+  const exists = deps.exists ?? import_node_fs20.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
   let inventory;
@@ -26035,7 +26079,7 @@ function runDocRefs(root, deps = {}) {
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs = Object.fromEntries(
-    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile11((0, import_node_path16.join)(root, rel))]).filter(([rel, body]) => body != null && (!deps.runbooksOnly || isRunbook(rel, body)))
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile11((0, import_node_path17.join)(root, rel))]).filter(([rel, body]) => body != null && (!deps.runbooksOnly || isRunbook(rel, body)))
   );
   const refResult = checkRefs(root, { exists, isIgnored, trackedFirstSegments }, docs);
   const findings = [
@@ -26072,14 +26116,14 @@ ${sourceMessages}`;
   }
   for (const finding of findings) {
     if (finding.kind !== "missing-path") continue;
-    const directory = import_node_path16.posix.dirname(import_node_path16.posix.normalize(finding.detail)).split("/");
+    const directory = import_node_path17.posix.dirname(import_node_path17.posix.normalize(finding.detail)).split("/");
     const distance = (path2) => {
-      const parts = import_node_path16.posix.dirname(path2).split("/");
+      const parts = import_node_path17.posix.dirname(path2).split("/");
       let common = 0;
       while (common < directory.length && common < parts.length && directory[common] === parts[common]) common += 1;
       return directory.length + parts.length - 2 * common;
     };
-    const suggest = [...new Set(trackedFiles() ?? [])].filter((path2) => import_node_path16.posix.basename(path2) === import_node_path16.posix.basename(finding.detail) && exists((0, import_node_path16.join)(root, path2))).sort((a, b) => distance(a) - distance(b) || a.localeCompare(b)).slice(0, 3);
+    const suggest = [...new Set(trackedFiles() ?? [])].filter((path2) => import_node_path17.posix.basename(path2) === import_node_path17.posix.basename(finding.detail) && exists((0, import_node_path17.join)(root, path2))).sort((a, b) => distance(a) - distance(b) || a.localeCompare(b)).slice(0, 3);
     if (suggest.length) finding.suggest = suggest;
   }
   return {
@@ -26172,31 +26216,31 @@ function walkMarkdown(dir) {
   const stack = [dir];
   while (stack.length) {
     const current = stack.pop();
-    for (const entry of (0, import_node_fs20.readdirSync)(current, { withFileTypes: true })) {
-      const full = (0, import_node_path17.join)(current, entry.name);
+    for (const entry of (0, import_node_fs21.readdirSync)(current, { withFileTypes: true })) {
+      const full = (0, import_node_path18.join)(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        out.push((0, import_node_path17.relative)(dir, full).split(import_node_path17.sep).join("/"));
+        out.push((0, import_node_path18.relative)(dir, full).split(import_node_path18.sep).join("/"));
       }
     }
   }
   return out;
 }
 function createDocsIndexDeps(repoRoot2) {
-  const docsDir = (0, import_node_path17.join)(repoRoot2, "docs");
-  const indexPath = (0, import_node_path17.join)(repoRoot2, DOCS_INDEX_PATH);
+  const docsDir = (0, import_node_path18.join)(repoRoot2, "docs");
+  const indexPath = (0, import_node_path18.join)(repoRoot2, DOCS_INDEX_PATH);
   return {
     listDocs: () => {
-      if (!(0, import_node_fs20.existsSync)(docsDir)) return [];
+      if (!(0, import_node_fs21.existsSync)(docsDir)) return [];
       const walked = walkMarkdown(docsDir).filter(isRoutableDocsPath);
       if (!walked.length) return [];
       const ignored = defaultIsIgnored(repoRoot2, walked.map((rel) => `docs/${rel}`));
       return walked.filter((rel) => !ignored.has(`docs/${rel}`)).sort();
     },
-    readDoc: (relPath) => (0, import_node_fs20.readFileSync)((0, import_node_path17.join)(docsDir, relPath), "utf8"),
-    readIndex: () => (0, import_node_fs20.existsSync)(indexPath) ? (0, import_node_fs20.readFileSync)(indexPath, "utf8") : null,
-    writeIndex: (content) => (0, import_node_fs20.writeFileSync)(indexPath, content, "utf8")
+    readDoc: (relPath) => (0, import_node_fs21.readFileSync)((0, import_node_path18.join)(docsDir, relPath), "utf8"),
+    readIndex: () => (0, import_node_fs21.existsSync)(indexPath) ? (0, import_node_fs21.readFileSync)(indexPath, "utf8") : null,
+    writeIndex: (content) => (0, import_node_fs21.writeFileSync)(indexPath, content, "utf8")
   };
 }
 
@@ -27319,8 +27363,8 @@ async function runBankRequest(fullName, options, deps) {
 }
 
 // src/train-apply-contracts.ts
-var import_node_fs21 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_path19 = require("node:path");
 function reduceFollowUpOutcomes(outcomes) {
   if (outcomes.includes("failure")) return "failure";
   if (outcomes.includes("unresolved")) return "unresolved";
@@ -27400,7 +27444,7 @@ async function resolveFoldPaths(deps, model) {
   if (model === "vercel") return [];
   const helper = "scripts/release-distribution.mjs";
   if (model === "hub-serverless" || model === "registry-publish") {
-    if ((0, import_node_fs21.existsSync)(helper)) {
+    if ((0, import_node_fs22.existsSync)(helper)) {
       let out;
       try {
         out = await deps.run("node", [helper, "changed-files"]);
@@ -27549,7 +27593,7 @@ async function restoreMainNpmPackIdentities(deps, version) {
   if (mainBom.version !== version) return void 0;
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs21.readFileSync)(bomPath, "utf8"));
+    localBom = JSON.parse((0, import_node_fs22.readFileSync)(bomPath, "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: ${bomPath} written by this fold's prepare is unreadable (${describeReadError(e)}) \u2014 cannot restore the published ${version} npm-pack identities from origin/main (#4503/#4713).`
@@ -27567,14 +27611,14 @@ async function restoreMainNpmPackIdentities(deps, version) {
     restored += 1;
   }
   if (restored === 0) return void 0;
-  (0, import_node_fs21.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
+  (0, import_node_fs22.writeFileSync)(bomPath, `${JSON.stringify(localBom, null, 2)}
 `);
   return `restored ${restored} npm-pack BOM identit${restored === 1 ? "y" : "ies"} from origin/main (#4503)`;
 }
 function publishVisibilityFor(surfaceId) {
   let raw;
   try {
-    raw = (0, import_node_fs21.readFileSync)("surfaces.json", "utf8");
+    raw = (0, import_node_fs22.readFileSync)("surfaces.json", "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return "unknown";
     throw trainReadFailure(
@@ -27595,7 +27639,7 @@ function publishVisibilityFor(surfaceId) {
 }
 function npmPackArtifactName(packagePath) {
   try {
-    const pkg = JSON.parse((0, import_node_fs21.readFileSync)((0, import_node_path18.join)(packagePath, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs22.readFileSync)((0, import_node_path19.join)(packagePath, "package.json"), "utf8"));
     return pkg.name || void 0;
   } catch {
     return void 0;
@@ -27604,7 +27648,7 @@ function npmPackArtifactName(packagePath) {
 async function refuseDivergentPublishedNpmPack(deps, version) {
   let localBom;
   try {
-    localBom = JSON.parse((0, import_node_fs21.readFileSync)("distribution-bom.json", "utf8"));
+    localBom = JSON.parse((0, import_node_fs22.readFileSync)("distribution-bom.json", "utf8"));
   } catch (e) {
     throw new Error(
       `version fold refused: distribution-bom.json written by this fold's prepare is unreadable (${e instanceof Error ? e.message.split("\n")[0] : String(e)}) \u2014 cannot compare the same-PATCH ${version} npm-pack identities against published npm (#4503/#4662).`
@@ -28556,10 +28600,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.47",
-    tag: "v4.6.47",
-    commit: "4555234d7aa8",
-    npm: "@mutmutco/cli@4.6.47"
+    version: "4.6.49",
+    tag: "v4.6.49",
+    commit: "2de561d64225",
+    npm: "@mutmutco/cli@4.6.49"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28576,14 +28620,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.47"
+          v3Target: "v4.6.49"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.47 and redeploy the Hub Lambda from tag v4.6.47 (4555234d7aa8); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.47 (@mutmutco/cli@4.6.47, tag commit 4555234d7aa8 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.49 and redeploy the Hub Lambda from tag v4.6.49 (2de561d64225); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.49 (@mutmutco/cli@4.6.49, tag commit 2de561d64225 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -28923,17 +28967,6 @@ function resolveIssueViewGhFields(normalized) {
   return { ghFields: requested.join(","), numberIsTransport: false };
 }
 
-// src/utf8-receipt.ts
-var import_node_fs22 = require("node:fs");
-var import_node_path19 = require("node:path");
-function writeUtf8Receipt(path2, text) {
-  (0, import_node_fs22.mkdirSync)((0, import_node_path19.dirname)(path2), { recursive: true });
-  const body = text.endsWith("\n") ? text : `${text}
-`;
-  (0, import_node_fs22.writeFileSync)(path2, body, "utf8");
-  return Buffer.byteLength(body, "utf8");
-}
-
 // src/query-commands.ts
 var GH_LIST_TIMEOUT_MS = 2e4;
 var DEFAULT_LIMIT = 30;
@@ -35552,11 +35585,41 @@ function ledgerFailedRemedy(ledger) {
 function alignmentPrNumbers(note) {
   return [...new Set([...(note ?? "").matchAll(/\/pull\/(\d+)/g)].map((m) => Number.parseInt(m[1], 10)))];
 }
+function alignmentHeadBranches(tag) {
+  return [
+    { target: "development", head: `release-align/development/${tag}` },
+    { target: "rc", head: `release-align/rc/${tag}` }
+  ];
+}
+async function alignmentLegClosedByHead(deps, prior) {
+  const found = [];
+  for (const { target, head } of alignmentHeadBranches(prior.tag)) {
+    let rows;
+    try {
+      rows = JSON.parse(await deps.run("gh", ["pr", "list", "--repo", prior.repo, "--head", head, "--state", "all", "--json", "number,state"]));
+    } catch {
+      return void 0;
+    }
+    if (!Array.isArray(rows)) return void 0;
+    for (const row of rows) {
+      if (typeof row?.number !== "number" || !Number.isInteger(row.number) || typeof row.state !== "string") return void 0;
+      if (row.state !== "MERGED") return void 0;
+      found.push({ target, head, number: row.number });
+    }
+  }
+  if (!found.some((f) => f.target === "development")) return void 0;
+  const named = found.map((f) => `#${f.number} (head \`${f.head}\`)`).join(", ");
+  return {
+    state: "complete",
+    note: `alignment: already-merged \u2014 alignment PR ${named} merged on GitHub after the train returned; the leg named no PR, so the PR was found by its head branch; closed live at the next pre-flight (#10212)`,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
 async function alignmentLegClosedLive(deps, prior) {
   const leg = prior.phases.alignment;
   if (leg.state !== "pending") return void 0;
   const numbers = alignmentPrNumbers(leg.note);
-  if (numbers.length === 0) return void 0;
+  if (numbers.length === 0) return alignmentLegClosedByHead(deps, prior);
   for (const n of numbers) {
     let state = "";
     try {
@@ -42773,6 +42836,9 @@ async function readGhPrStateWithRetry(fetchState, options) {
 function isNoFailedCheckQueueEjection(run) {
   return !run || run.conclusion === null || run.conclusion === "cancelled" || run.conclusion === "neutral" || run.conclusion === "skipped";
 }
+function isUnchangedHeadFailedRunEjection(run, submittedHead, currentHead) {
+  return !!run && run.conclusion === "failure" && !!submittedHead && !!currentHead && currentHead.toLowerCase() === submittedHead.toLowerCase();
+}
 async function runPrLand(prNumber, options, deps) {
   const first = await runPrLandOnce(prNumber, options, deps);
   if (options.enqueueOnly || options.expectHead || first.status !== "failed") return first;
@@ -42964,6 +43030,7 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
   const deadline = deadlineMs ?? now() + timeoutMs;
   let attempt = 0;
   let credentialMismatched = false;
+  let submittedHead;
   const observe = (read) => {
     const seen = deps.observeQueued?.(pr, base.repo, read);
     if (seen?.mismatched) {
@@ -42983,6 +43050,7 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
         state: "queued",
         ...read.mergeQueueEntry ? { position: read.mergeQueueEntry.position, entryState: read.mergeQueueEntry.state } : {}
       };
+      submittedHead = read.headRefOid ?? submittedHead;
       const groupSha = read.mergeQueueEntry?.headCommit?.oid;
       if (!options.enqueueOnly && groupSha && deps.findQueueStartupFailure) {
         const startup = await deps.findQueueStartupFailure(base.repo, groupSha).catch(() => void 0);
@@ -43011,11 +43079,13 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
         continue;
       }
       const run = await deps.findMergeGroupRun(pr, base.repo, base.base);
+      const withheld = isUnchangedHeadFailedRunEjection(run, submittedHead, again.headRefOid);
       const result2 = {
         ...base,
         mergeQueue: { ...base.mergeQueue, state: "ejected", ...run ? { ejectedRun: run } : {} },
         ...base.pinnedHead ? { pinnedHead: { ...base.pinnedHead, refused: "ejected" } } : {},
-        error: `merge queue ejected PR #${pr} \u2014 ${run ? `merge_group run ${run.id} ${run.conclusion} ${run.url}` : "merge_group run not found"}; ${prQueueReadHint(pr, base.repo)}${isNoFailedCheckQueueEjection(run) ? `; no check failed \u2014 re-run \`mmi-cli devops pr land ${pr} --repo ${base.repo}\` once to re-enqueue, and if a land is refused again report the exact refusal verbatim (never fall back to a direct/admin merge or an \`MMI_ACTOR=personal\` landing workaround)` : ""}`
+        ...withheld && submittedHead ? { ejectedOnFailedRun: { runId: run.id, head: submittedHead, ...run.url ? { url: run.url } : {} } } : {},
+        error: withheld && run ? `merge queue ejected PR #${pr} \u2014 merge_group run ${run.id} ${run.conclusion} ${run.url}; the PR head is unchanged since that run, so re-enqueueing it would resubmit the same failing commit and is withheld \u2014 fix the failed check, push the fix commit, then rerun \`mmi-cli devops pr land ${pr} --repo ${base.repo}\` (while a queued entry blocks a fix push, take the PR out of the queue first with \`mmi-cli devops pr land ${pr} --repo ${base.repo} --dequeue\`)` : `merge queue ejected PR #${pr} \u2014 ${run ? `merge_group run ${run.id} ${run.conclusion} ${run.url}` : "merge_group run not found"}; ${prQueueReadHint(pr, base.repo)}${isNoFailedCheckQueueEjection(run) ? `; no check failed \u2014 re-run \`mmi-cli devops pr land ${pr} --repo ${base.repo}\` once to re-enqueue, and if a land is refused again report the exact refusal verbatim (never fall back to a direct/admin merge or an \`MMI_ACTOR=personal\` landing workaround)` : ""}`
       };
       deps.queueProgress?.(result2);
       return result2;
@@ -43045,7 +43115,7 @@ async function landMany(prs, landOne, cleanup, hooks) {
   const safe = async (pr) => landOne(pr).catch((e) => ({ status: "failed", repo: "", pr, base: "", error: e.message }));
   return Promise.all(prs.map(async (pr) => {
     let result = await safe(pr);
-    if (prLandOutcome(result) === "ejected" && !result.pinnedHead && !result.retriedAfterEjection) {
+    if (prLandOutcome(result) === "ejected" && !result.pinnedHead && !result.retriedAfterEjection && !result.ejectedOnFailedRun) {
       const baseRed = await hooks?.baseRedCheck?.(pr, result).catch(() => void 0);
       if (baseRed) {
         result = { ...result, baseRed: { base: result.base, baseRunId: baseRed.baseRunId }, error: `base-red: failures already on ${result.base} (${baseRed.baseRunId})` };
@@ -43325,10 +43395,17 @@ function readMessageOverride(message2, cwd) {
 }
 function readOverride(base, cwd, head = "HEAD") {
   const format = `%H${FLD}%(trailers:key=${TRAILER_KEY},valueonly,unfold)${FLD}%B${REC}`;
+  const records = git(["log", `${base}..${head}`, `--format=${format}`], cwd).split(REC).map((record2) => record2.replace(/^\s+/, "").split(FLD));
+  return readOverrideRecords(records, cwd);
+}
+function readMessageOverrides(messages, cwd) {
+  const records = messages.map((message2, index) => [`source-${index + 1}`, readMessageOverride(message2, cwd), message2]).reverse();
+  return readOverrideRecords(records, cwd);
+}
+function readOverrideRecords(records, cwd) {
   const refusals = [];
   let override = null;
-  for (const record2 of git(["log", `${base}..${head}`, `--format=${format}`], cwd).split(REC)) {
-    const [sha, trailer, body] = record2.replace(/^\s+/, "").split(FLD);
+  for (const [sha, trailer, body] of records) {
     if (!sha) continue;
     if (override) break;
     const { value, messageTransform } = readOverrideTrailer(trailer, body, cwd);
@@ -43354,6 +43431,9 @@ var GO_TEST_RE = GO_TEST_FILE_RE;
 function readMessageOverride2(message2, cwd) {
   return readMessageOverride(message2, cwd);
 }
+function readMessageOverrides2(messages, cwd) {
+  return readMessageOverrides(messages, cwd);
+}
 function translate(glob) {
   let out = "";
   for (let i = 0; i < glob.length; i++) {
@@ -44469,6 +44549,38 @@ ${message2.body}`)) || readMessageOverride2(githubQueueSquashMessage(title, pr,
     error: "queue preparation needed: the multi-commit COMMIT_MESSAGES squash would bury the Test-Policy-Override waiver mid-message, so the queue check would fail malformed-override-trailer"
   };
 }
+function queueBodyFile(pr) {
+  return `.jerv/tmp/pr-${pr}-body.md`;
+}
+function writeQueueBodyFile(pr, body, targets, cwd = process.cwd()) {
+  try {
+    const alreadyCloses = (number) => new RegExp(`^[ \\t]*(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?):?[ \\t]+\\[?#${number}(?![0-9])`, "im").test(body);
+    const closes = targets.filter((number) => !alreadyCloses(number)).map((number) => `Closes #${number}`).join("\n");
+    const base = body.trimEnd();
+    const separator = [...base.matchAll(/\n[ \t]*\n/g)].at(-1);
+    const head = separator ? base.slice(0, separator.index) : "";
+    const last = separator ? base.slice(separator.index + separator[0].length) : base;
+    const content = !closes ? `${base}
+` : parseTrailers(base, cwd).length > 0 ? `${head ? `${head}
+
+` : ""}${closes}
+
+${last.trimEnd()}
+` : `${base}${base ? "\n\n" : ""}${closes}
+`;
+    const directory = (0, import_node_path31.join)(cwd, ".jerv", "tmp");
+    (0, import_node_fs34.mkdirSync)(directory, { recursive: true });
+    (0, import_node_fs34.writeFileSync)((0, import_node_path31.join)(directory, `pr-${pr}-body.md`), content);
+    return queueBodyFile(pr);
+  } catch {
+    return void 0;
+  }
+}
+function queueMessageRemedy(pr, repo, targets, bodyFile) {
+  const named = (format, fallback) => targets.length ? targets.map(format).join(", ") : fallback;
+  const issues = named((number) => `#${number}`, "#N");
+  return `PR author: if PR #${pr} is meant to close ${issues}, add ${named((number) => `\`Closes #${number}\``, "`Closes #N`")} to the PR body (\`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file ${queueBodyFile(pr)}\`) and rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\` without pushing a new head.` + (bodyFile ? ` The body file that command reads was just written (\`${bodyFile}\`): the current PR body plus a closing line for any target it lacked, so it runs exactly as printed.` : "") + ` If ${issues} must stay open, remove the closing phrases from the source commit or PR text using ${named((number) => `\`Part of #${number}\``, "`Part of #N`")} / ${named((number) => `\`Refs #${number}\``, "`Refs #N`")}, then re-run checks and \`pr land\` with the prepared head. A queue cannot accept --squash-body-file.`;
+}
 async function inspectQueuePreparation(pr, repo, options) {
   const read = options.read ?? readApi;
   const queueRead = options.read ?? actorReadApi;
@@ -44521,7 +44633,7 @@ async function inspectQueuePreparation(pr, repo, options) {
       status: "preparation-needed",
       reason,
       issueTargets: targets.map((number) => `${repo}#${number}`),
-      nextAction: nextAction ?? (reason === "queue-message" ? `PR author: if PR #${pr} is meant to close ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"}, add ${targets.length ? targets.map((number) => `\`Closes #${number}\``).join(", ") : "`Closes #N`"} to the PR body (\`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) and rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\` without pushing a new head; if ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"} must stay open, remove the closing phrases from the source commit or PR text using ${targets.length ? targets.map((number) => `\`Part of #${number}\``).join(", ") : "`Part of #N`"} / ${targets.length ? targets.map((number) => `\`Refs #${number}\``).join(", ") : "`Refs #N`"}, then re-run checks and \`pr land\` with the prepared head. A queue cannot accept --squash-body-file.` : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged.")
+      nextAction: nextAction ?? (reason === "queue-message" ? queueMessageRemedy(pr, repo, targets) : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged.")
     },
     error: `queue preparation needed: ${detail}`
   });
@@ -44580,7 +44692,8 @@ ${pull.body}`;
       ...findNegatedClosings(input.text, closing),
       ...findCrossRepoAmbiguousClosings(input.text, closing, repo)
     ])];
-    return { kind: "refused", result: preparation("queue-message", targets, `GitHub's unchanged ${policy.body} message is unsafe for ${targets.map((number) => `${repo}#${number}`).join(", ")}. ${closingGuardDiagnostic(verdict.message)} See preparation.nextAction for the exact \`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\` remedy.`) };
+    const bodyFile = targets.length ? writeQueueBodyFile(pr, pull.body, targets, process.cwd()) : void 0;
+    return { kind: "refused", result: preparation("queue-message", targets, `GitHub's unchanged ${policy.body} message is unsafe for ${targets.map((number) => `${repo}#${number}`).join(", ")}. ${closingGuardDiagnostic(verdict.message)} See preparation.nextAction for the exact \`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file ${queueBodyFile(pr)}\` remedy.`, queueMessageRemedy(pr, repo, targets, bodyFile)) };
   }
   if (method === "SQUASH" && policy.body === "COMMIT_MESSAGES" && options.bodyText == null) {
     const refusal = checkQueueSquashOverride(pull.title, pr, messages, process.cwd());
@@ -44588,7 +44701,18 @@ ${pull.body}`;
   }
   const requiredBody = options.bodyText ?? composedBody;
   const prBodyPreservesOverrides = requiredBody != null && method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null && prBodyPreservesCommitOverrides(messages, headline, pull.body, process.cwd());
-  const queueKeepsWaiver = options.bodyText == null && method !== "SQUASH" && Boolean(readMessageOverride2(actualMessage, process.cwd()));
+  const retained = options.bodyText == null && method !== "SQUASH" ? readMessageOverrides2(messages.map((message2) => `${message2.headline}
+
+${message2.body}`), process.cwd()) : null;
+  if (retained?.refusals.length) {
+    return { kind: "refused", result: preparation(
+      "queue-message-override",
+      [],
+      `retained source commit messages fail the shared waiver reader: ${retained.refusals.map((finding) => finding.detail).join("\n")}`,
+      "PR author: the queue retains each source commit message. Put an authorized Test-Policy-Override with a known scope in a later commit's Git-recognized final trailer block, push without rewriting history, and rerun pr land. The nearest valid waiver supersedes older ones; malformed or unknown-scope waivers newer than it still refuse. The synthetic merge-message preview does not decide this requirement. Keep repository settings unchanged."
+    ) };
+  }
+  const queueKeepsWaiver = Boolean(retained?.override && !retained.refusals.length);
   if (requiredBody && !prBodyPreservesOverrides && !queueKeepsWaiver && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
     if (method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null) {
       return {
@@ -44675,7 +44799,7 @@ async function abandonQueueAdmission(pr, repo, options = {}) {
   if (!snapshot.headRefOid || snapshot.headRefOid.toLowerCase() !== receipt.head.toLowerCase()) {
     return refuse(`the PR head is ${snapshot.headRefOid ?? "unreadable"}, not the receipt's submitted head ${receipt.head}; the admission is unchanged`);
   }
-  if (snapshot.isInMergeQueue) return refuse("the PR is currently in the merge queue, so the admission is not stuck; the admission is unchanged");
+  if (snapshot.isInMergeQueue) return refuse(`the PR is currently in the merge queue, so the admission is not stuck; the admission is unchanged \u2014 take the PR out of the queue first with \`mmi-cli devops pr land ${pr} --repo ${repo} --dequeue\` if a fix commit must be pushed`);
   try {
     journal.save("abandoned");
   } catch (error) {
@@ -44683,6 +44807,75 @@ async function abandonQueueAdmission(pr, repo, options = {}) {
   }
   return { status: "abandoned", repo, pr, head: receipt.head, ...receipt.uuid ? { operation: receipt.uuid } : {} };
 }
+async function dequeuePrMergeQueue(pr, repo, options = {}) {
+  if (!/^\d+$/.test(pr)) return { status: "refused", repo, pr, reason: "a bare PR number is required" };
+  const refuse = (reason) => ({ status: "refused", repo, pr, reason });
+  const read = options.read ?? actorReadApi;
+  let entry;
+  try {
+    const result = await queueGraphql(
+      repo,
+      `pullRequest(number:${pr}) { id state isInMergeQueue headRefOid }`,
+      read
+    );
+    if (!result.pullRequest) throw new Error(`merge queue PR #${pr} not found`);
+    entry = result.pullRequest;
+  } catch (error) {
+    return refuse(`the PR and queue state could not be read (${error.message}); nothing was dequeued`);
+  }
+  if (!entry.isInMergeQueue) return refuse(`the PR is '${entry.state ?? "unreadable"}' and not in the merge queue; nothing to dequeue`);
+  if (!entry.id) return refuse("the PR node id is unreadable; nothing was dequeued");
+  let output;
+  try {
+    const mutation = await (options.write ?? writeApi)(["graphql", "-f", "query=mutation($id:ID!){dequeuePullRequest(input:{pullRequestId:$id}){clientMutationId}}", "-f", `id=${entry.id}`]);
+    output = typeof mutation === "string" ? mutation : mutation.stdout;
+  } catch (error) {
+    return refuse(`dequeuePullRequest failed (${error.message}); the queue entry is unchanged`);
+  }
+  let graphqlErrors = "";
+  try {
+    const response = JSON.parse(output);
+    if (response.errors?.length) graphqlErrors = response.errors.map((e) => e.message).join("; ");
+  } catch {
+    graphqlErrors = "the dequeue response is unreadable";
+  }
+  if (graphqlErrors) return refuse(`dequeuePullRequest reported: ${graphqlErrors}; the queue entry is unchanged \u2014 verify with \`mmi-cli devops read pr queue ${pr} --repo ${repo} --json\` before pushing`);
+  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  let verified;
+  let lastRead;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    if (attempt) await sleep2(attempt * 1e3);
+    try {
+      const observed = await readPrMergeQueue(pr, repo, read, sleep2);
+      if (!observed.isInMergeQueue) {
+        verified = observed;
+        break;
+      }
+      lastRead = `the PR still reads as in the merge queue (state '${observed.state}')`;
+    } catch (error) {
+      lastRead = error.message;
+    }
+  }
+  if (!verified) {
+    return refuse(`dequeuePullRequest was sent but the read-back could not verify the PR out of the queue (${lastRead ?? "unreadable"}); do not assume the entry is gone \u2014 verify with \`mmi-cli devops read pr queue ${pr} --repo ${repo} --json\`, and rerun --dequeue only if the PR still shows queued`);
+  }
+  let admission = "none";
+  let operation;
+  try {
+    const journal = admissionJournal(repo, pr, options.receiptDirectory);
+    const receipt = journal.receipt;
+    if (receipt && (["pending", "enqueued"].includes(receipt.state) || receipt.state === "dispatching" && !receipt.uuid)) {
+      journal.save("abandoned");
+      admission = "terminal";
+      operation = receipt.uuid;
+    } else if (receipt) {
+      admission = "left-open";
+    }
+  } catch {
+    admission = "unreadable";
+  }
+  return { status: "dequeued", repo, pr, ...entry.headRefOid ? { head: entry.headRefOid } : {}, admission, ...operation ? { operation } : {} };
+}
 function closingGuardDiagnostic(message2) {
   if (!message2) return "";
   const remedy = message2.search(/GitHub's merge queue composes|If this PR is meant to close/);
@@ -45173,8 +45366,204 @@ function registerRunDispatch(run, writeToken, projects) {
   });
 }
 
-// src/devops-vars.ts
+// src/remote-test.ts
 var import_node_crypto13 = require("node:crypto");
+init_cli_shared();
+var FOCUSED_TEST_REPO = "mutmutco/MMI-Hub";
+var FOCUSED_TEST_WORKFLOW = "focused-test.yml";
+var FOCUSED_TEST_REF = "development";
+var FOCUSED_TEST_OWNER = "mutmutco";
+var REMOTE_TEST_MAX_FILES = 20;
+var REMOTE_TEST_POLL_MS = 15e3;
+var REMOTE_TEST_CORRELATE_MS = 5 * 6e4;
+var REMOTE_TEST_WATCH_MS = 30 * 6e4;
+var REMOTE_TEST_LOG_TAIL = 60;
+var REMOTE_TEST_UNKNOWN = 3;
+var REMOTE_TEST_FILE_RE = /^[A-Za-z0-9._/@-]+$/;
+var REMOTE_TEST_NAME_RE = /^[A-Za-z0-9._-]+$/;
+var REMOTE_TEST_SHA_RE = /^[0-9a-f]{40}$/;
+function focusedTestRepoName(repo) {
+  const parts = repo.split("/");
+  if (parts.length !== 2 || !parts.every((part) => REMOTE_TEST_NAME_RE.test(part))) {
+    throw new Error(`remote test: --repo must be <owner>/<repo> (letters, digits, dot, underscore, hyphen), received '${repo}'`);
+  }
+  if (parts[0].toLowerCase() !== FOCUSED_TEST_OWNER) {
+    throw new Error(`remote test: --repo must name a ${FOCUSED_TEST_OWNER}/ repository (the central workflow checks out ${FOCUSED_TEST_OWNER}/<name> only), received '${repo}'`);
+  }
+  return parts[1];
+}
+function validateRemoteTest(request) {
+  focusedTestRepoName(request.repo);
+  if (!REMOTE_TEST_SHA_RE.test(request.sha)) {
+    throw new Error(`remote test: --sha must be a 40-character lowercase commit sha, received '${request.sha}'`);
+  }
+  if (request.tool !== "node-test" && request.tool !== "vitest") {
+    throw new Error(`remote test: --tool must be node-test or vitest, received '${String(request.tool)}'`);
+  }
+  if (!Array.isArray(request.files) || request.files.length === 0) {
+    throw new Error("remote test: name at least one test file (space-separated literals, max 20)");
+  }
+  if (request.files.length > REMOTE_TEST_MAX_FILES) {
+    throw new Error(`remote test: at most ${REMOTE_TEST_MAX_FILES} test files per run, received ${request.files.length}`);
+  }
+  for (const file of request.files) {
+    if (!REMOTE_TEST_FILE_RE.test(file)) {
+      throw new Error(`remote test: file path uses characters outside A-Za-z0-9._/@- : '${file}'`);
+    }
+    if (file.includes("..")) throw new Error(`remote test: file path must not contain '..': '${file}'`);
+    if (file.startsWith("/")) throw new Error(`remote test: file path must be repo-relative: '${file}'`);
+    if (file.startsWith("-")) throw new Error(`remote test: a file path must never read as a flag: '${file}'`);
+  }
+  if (typeof request.install !== "boolean") throw new Error("remote test: install must be a boolean");
+}
+function tailLines(text, count) {
+  return text.replace(/\r\n/g, "\n").split("\n").filter((line, index, all) => !(index === all.length - 1 && line === "")).slice(-count);
+}
+function parseJson(path2, text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`remote test: unreadable answer from ${path2}`);
+  }
+}
+async function runRemoteTest(request, deps) {
+  validateRemoteTest(request);
+  const name = focusedTestRepoName(request.repo);
+  const nonce = deps.nonce();
+  const title = `focused-test ${nonce}`;
+  const uncertain = (message2, runId = null, url = null) => ({ exitCode: REMOTE_TEST_UNKNOWN, title, runId, url, conclusion: null, tail: [], message: message2 });
+  const inputs = [
+    `repo=${name}`,
+    `sha=${request.sha}`,
+    `tool=${request.tool}`,
+    `files=${request.files.join(" ")}`,
+    `install=${request.install}`,
+    `nonce=${nonce}`
+  ];
+  try {
+    await deps.dispatch(inputs);
+  } catch (error) {
+    return uncertain(`remote test: dispatch outcome unknown \u2014 ${error.message}; inspect ${FOCUSED_TEST_REPO} Actions before any retry`);
+  }
+  const runsPath = `repos/${FOCUSED_TEST_REPO}/actions/workflows/${FOCUSED_TEST_WORKFLOW}/runs?event=workflow_dispatch&per_page=50`;
+  let run;
+  try {
+    const correlateUntil = deps.now() + REMOTE_TEST_CORRELATE_MS;
+    while (!run) {
+      const rows = parseJson(runsPath, await deps.read(runsPath)).workflow_runs ?? [];
+      run = rows.find((row) => row.display_title === title);
+      if (run) break;
+      if (deps.now() >= correlateUntil) {
+        return uncertain(`remote test: no run named "${title}" appeared within ${REMOTE_TEST_CORRELATE_MS / 6e4}m \u2014 the dispatch was refused or is queued behind a rule; nothing was retried`);
+      }
+      await deps.sleep(REMOTE_TEST_POLL_MS);
+    }
+    const runPath = `repos/${FOCUSED_TEST_REPO}/actions/runs/${run.id}`;
+    const watchUntil = deps.now() + REMOTE_TEST_WATCH_MS;
+    let final;
+    while (!final) {
+      const current = parseJson(runPath, await deps.read(runPath));
+      if (current.status === "completed") {
+        final = current;
+        break;
+      }
+      if (deps.now() >= watchUntil) {
+        return uncertain(`remote test: run ${run.id} still ${current.status} after ${REMOTE_TEST_WATCH_MS / 6e4}m \u2014 no verdict exists`, run.id, current.html_url);
+      }
+      await deps.sleep(REMOTE_TEST_POLL_MS);
+    }
+    const jobsPath = `${runPath}/jobs?per_page=100`;
+    const jobs = parseJson(jobsPath, await deps.read(jobsPath)).jobs ?? [];
+    const testJob = jobs.find((job) => job.name === "test");
+    const conclusion = testJob?.conclusion ?? final.conclusion;
+    let tail = [];
+    if (testJob) {
+      try {
+        tail = tailLines(await deps.read(`repos/${FOCUSED_TEST_REPO}/actions/jobs/${testJob.id}/logs`), REMOTE_TEST_LOG_TAIL);
+      } catch {
+        tail = [];
+      }
+    }
+    const url = final.html_url;
+    if (!testJob && !final.conclusion) return uncertain(`remote test: run ${run.id} completed with no verdict \u2014 no \`test\` job and no run conclusion`, run.id, url);
+    return {
+      exitCode: conclusion === "success" ? 0 : 1,
+      title,
+      runId: run.id,
+      url,
+      conclusion,
+      tail,
+      message: `remote test: ${title} ${conclusion ?? "completed"} on ${request.repo}@${request.sha.slice(0, 12)} \u2014 ${url}`
+    };
+  } catch (error) {
+    return uncertain(`remote test: ${error.message} \u2014 the dispatch already happened; inspect ${FOCUSED_TEST_REPO} Actions for "${title}", never re-dispatch blind`, run?.id ?? null, run?.html_url ?? null);
+  }
+}
+function appApiRead(writeToken, exec3 = execFileP) {
+  return async (path2) => {
+    const token = await writeToken();
+    const { stdout } = await exec3("gh", ["api", path2], { timeout: 6e4, env: { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" } });
+    return stdout;
+  };
+}
+var defaultGit2 = {
+  git: async (args) => {
+    try {
+      return (await execFileP("git", args, { timeout: 15e3 })).stdout.trim();
+    } catch {
+      return "";
+    }
+  }
+};
+async function originRepo(git3 = defaultGit2) {
+  const url = await git3.git(["config", "--get", "remote.origin.url"]);
+  const match = /[:/]([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+?)(?:\.git)?$/.exec(url);
+  if (!match) throw new Error(`remote test: no usable origin remote (git config --get remote.origin.url returned '${url}'); pass --repo <owner>/<repo>`);
+  return `${match[1]}/${match[2]}`;
+}
+async function pushedSha(sha, git3 = defaultGit2) {
+  const resolved = sha ?? await git3.git(["rev-parse", "HEAD"]);
+  if (!REMOTE_TEST_SHA_RE.test(resolved)) {
+    throw new Error(`remote test: --sha must be a 40-character lowercase commit sha (received '${resolved}'); in a checkout, omit --sha to use HEAD`);
+  }
+  if (sha === void 0 && !await git3.git(["branch", "-r", "--contains", resolved])) {
+    throw new Error(`remote test: ${resolved.slice(0, 12)} is not on any origin branch \u2014 push first (the workflow checks the commit out of origin, so a local-only HEAD cannot be tested)`);
+  }
+  return resolved;
+}
+function registerRemoteTest(run, deps) {
+  const git3 = deps.git ?? defaultGit2;
+  const write = deps.write ?? printLine;
+  run.command("test [files...]").description("run a focused test on the owned Hetzner heavy lanes (`.github/workflows/focused-test.yml`) instead of the local heavy slot; waits for the verdict and prints the test job log tail (exit 0 pass, 1 fail, 3 uncertain)").option("--repo <owner/repo>", "repository to test (default: this checkout `origin`)").option("--sha <sha>", "commit to test (default: HEAD); it must already be pushed to origin").addOption(new Option("--tool <tool>", "node-test | vitest").default("node-test").choices(["node-test", "vitest"])).option("--no-install", "skip `npm ci` in the checked-out repository").option("--json", "machine-readable receipt").action(async (files, options) => {
+    try {
+      const repo = options.repo ?? await originRepo(git3);
+      const sha = await pushedSha(options.sha, git3);
+      const tool = options.tool;
+      const request = { repo, sha, tool, files, install: options.install };
+      const receipt = await runRemoteTest(request, {
+        dispatch: deps.dispatch,
+        read: deps.read,
+        now: deps.now ?? Date.now,
+        sleep: deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))),
+        nonce: deps.nonce ?? (() => randomNonce())
+      });
+      if (options.json) write(JSON.stringify(receipt));
+      else {
+        write(receipt.message);
+        for (const line of receipt.tail) write(line);
+      }
+      process.exitCode = receipt.exitCode;
+    } catch (error) {
+      return fail(error.message);
+    }
+  });
+}
+function randomNonce() {
+  return (0, import_node_crypto13.randomBytes)(8).toString("hex");
+}
+
+// src/devops-vars.ts
+var import_node_crypto14 = require("node:crypto");
 init_github_client();
 init_cli_shared();
 var VARS_RECEIPT_SCHEMA = "mmi-cli.devops-vars/1";
@@ -45265,7 +45654,7 @@ function receiptBase(deps, operation, repo, ctx, now) {
     repo,
     window: { startedAt: ctx.startedAt.toISOString(), endedAt: now().toISOString(), atomicSnapshot: false },
     actor: deps.actor ?? { credential: "app_installation" },
-    correlationId: (deps.correlationId ?? import_node_crypto13.randomUUID)(),
+    correlationId: (deps.correlationId ?? import_node_crypto14.randomUUID)(),
     upstream: ctx.log
   };
 }
@@ -45676,7 +46065,7 @@ function printMutationText(receipt) {
 }
 
 // src/repo-archive-status.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 init_github_client();
 init_cli_shared();
 var ARCHIVE_STATUS_RECEIPT_SCHEMA = "mmi-cli.repo-archive-status/1";
@@ -45717,7 +46106,7 @@ async function readArchiveStatusReceipt(deps, repo) {
     sourceTime: { observedAt: "", note: ARCHIVE_SOURCE_TIME_NOTE },
     window: { startedAt: startedAt.toISOString(), endedAt: "", atomicSnapshot: false },
     actor: deps.actor ?? { credential: "app_installation" },
-    correlationId: (deps.correlationId ?? import_node_crypto14.randomUUID)(),
+    correlationId: (deps.correlationId ?? import_node_crypto15.randomUUID)(),
     upstream: log
   };
   try {
@@ -45770,7 +46159,7 @@ function registerRepoArchiveStatusCommand(program3, deps) {
 }
 
 // src/merge-queue-lifecycle.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var import_node_fs35 = require("node:fs");
 var import_node_path32 = require("node:path");
 init_github_client();
@@ -46270,7 +46659,7 @@ async function readMergeQueueLifecycle(deps, req) {
     observation: { started_at: started.toISOString(), ended_at: now().toISOString() },
     source: LIFECYCLE_SOURCE,
     actor: deps.actor ?? { credential: "app_installation" },
-    correlation_id: (deps.correlationId ?? import_node_crypto15.randomUUID)(),
+    correlation_id: (deps.correlationId ?? import_node_crypto16.randomUUID)(),
     bounds: { max_pages: req.maxPages, max_events: req.maxEvents, deadline_seconds: req.deadlineSeconds },
     counts: { pages, events: eventCount, duplicates_dropped: states.reduce((a, s) => a + s.duplicates_dropped, 0) },
     complete,
@@ -46296,7 +46685,7 @@ async function readMergeQueueLifecycle(deps, req) {
     checkpoint: { prs: states }
   };
 }
-var sha256 = (text) => (0, import_node_crypto15.createHash)("sha256").update(text).digest("hex");
+var sha256 = (text) => (0, import_node_crypto16.createHash)("sha256").update(text).digest("hex");
 function writeLifecycleReceipt(path2, receipt) {
   const text = `${JSON.stringify(receipt, null, 2)}
 `;
@@ -47375,7 +47764,7 @@ var import_node_os20 = require("node:os");
 var import_node_path36 = require("node:path");
 
 // src/box-control.ts
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 var sshdPost = (dest) => `if sshd -t; then systemctl reload ssh; else rm -f ${dest}; echo 'sshd -t rejected ${dest}: removed, not reloaded' >&2; exit 1; fi`;
@@ -47479,7 +47868,7 @@ function laneCoverageAction(files, box, op) {
   return { notice: `LANE_COVERAGE: ${mismatch}` };
 }
 function md5(content) {
-  return (0, import_node_crypto16.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto17.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -49433,6 +49822,7 @@ ${formatSshRecipe(box, remoteCommand)}
 var import_node_fs38 = require("node:fs");
 var import_node_url = require("node:url");
 var import_node_path35 = require("node:path");
+var import_node_net = require("node:net");
 var import_meta = {};
 var HZ = "https://api.hetzner.cloud/v1";
 var APPLY = process.env.FIREWALL_APPLY === "1";
@@ -49468,7 +49858,23 @@ function buildRules(cloudflare, extras = []) {
     if (!["tcp", "udp"].includes(e.protocol) || !/^\d{1,5}(-\d{1,5})?$/.test(String(e.port)) || !e.description) {
       throw new Error(`invalid firewall extra ${JSON.stringify(e)}: needs protocol tcp|udp, port N or N-M, description`);
     }
-    rules.push({ direction: "in", protocol: e.protocol, port: String(e.port), source_ips: ANY, description: e.description.slice(0, 255) });
+    if (e.source_ips !== void 0) {
+      const cidrOk = (entry) => {
+        if (typeof entry !== "string" || !entry.includes("/")) return false;
+        const parts = entry.split("/");
+        if (parts.length !== 2) return false;
+        const [ip, prefixRaw] = parts;
+        if (!/^(0|[1-9]\d{0,2})$/.test(prefixRaw)) return false;
+        const prefix = Number(prefixRaw);
+        if ((0, import_node_net.isIPv4)(ip)) return prefix >= 1 && prefix <= 32;
+        if ((0, import_node_net.isIPv6)(ip)) return prefix >= 1 && prefix <= 128;
+        return false;
+      };
+      if (!Array.isArray(e.source_ips) || !e.source_ips.length || !e.source_ips.every(cidrOk)) {
+        throw new Error(`invalid firewall extra ${JSON.stringify(e)}: source_ips, when declared, is a non-empty list of specific CIDRs (IPv4 a.b.c.d/1-32 or IPv6 x::/1-128; prefix 0 is refused \u2014 omit source_ips if the extra is meant to be world-open)`);
+      }
+    }
+    rules.push({ direction: "in", protocol: e.protocol, port: String(e.port), source_ips: e.source_ips ?? ANY, description: e.description.slice(0, 255) });
   }
   return rules;
 }
@@ -49478,7 +49884,17 @@ async function cloudflareRanges() {
   if (!res.ok || !body?.success) throw new Error(`Cloudflare IP list unreadable: ${res.status}`);
   return { ipv4: body.result.ipv4_cidrs ?? [], ipv6: body.result.ipv6_cidrs ?? [] };
 }
-var norm = (rules) => JSON.stringify(rules.map((r) => ({ ...r, source_ips: [...r.source_ips ?? []].sort() })).map(({ direction, protocol, port, source_ips }) => ({ direction, protocol, port: port ?? null, source_ips })));
+function exactRules(rules) {
+  const sortKeys = (v) => Array.isArray(v) ? v.map(sortKeys) : v && typeof v === "object" ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortKeys(v[k])])) : v;
+  const canon = (r) => {
+    const { destination_ips, port, ...rest } = r;
+    const out = { ...rest, source_ips: [...r.source_ips ?? []].sort() };
+    if (port !== null && port !== void 0) out.port = port;
+    if (Array.isArray(destination_ips) && destination_ips.length > 0) out.destination_ips = [...destination_ips].sort();
+    return JSON.stringify(sortKeys(out));
+  };
+  return JSON.stringify((rules ?? []).map(canon).sort());
+}
 function declaredExtras(box) {
   const extrasFile = JSON.parse((0, import_node_fs38.readFileSync)((0, import_node_url.fileURLToPath)(new URL("./firewall-extras.json", import_meta.url)), "utf8"));
   return Object.prototype.hasOwnProperty.call(extrasFile, box) ? extrasFile[box] : void 0;
@@ -49514,7 +49930,7 @@ async function main() {
   if (extras === void 0) throw new Error(`${box} has no entry in firewall-extras.json; declare it (an empty list is fine) before applying`);
   const rules = buildRules(await cloudflareRanges(), extras);
   for (const r of rules) console.log(`  in ${r.protocol}${r.port ? `/${r.port}` : ""} from ${r.source_ips.length > 2 ? `${r.source_ips.length} Cloudflare ranges` : r.source_ips.join(",")} \u2014 ${r.description}`);
-  const rulesChanged = !existing || norm(existing.rules) !== norm(rules);
+  const rulesChanged = !existing || exactRules(existing.rules) !== exactRules(rules);
   console.log(`cloud-firewall: rules ${rulesChanged ? "would change" : "unchanged"}; apply-to-server ${applied ? "already done" : "needed"}`);
   if (!APPLY) {
     console.log("cloud-firewall: dry-run (FIREWALL_APPLY=1 to write)");
@@ -49542,7 +49958,7 @@ if (process.argv[1] && (0, import_node_path35.basename)(process.argv[1]).toLower
 
 // ../infra/hetzner/firewall-extras.json
 var firewall_extras_default = {
-  $comment: "#7356: per-box inbound exceptions to the Cloudflare-only Hetzner Cloud Firewall (cloud-firewall.mjs). Every entry names its owner and reason. Web traffic (80/443) is always Cloudflare-only and SSH (22) is always open; list only what must reach the box directly.",
+  $comment: "#7356: per-box inbound exceptions to the Cloudflare-only Hetzner Cloud Firewall (cloud-firewall.mjs). Every entry names its owner and reason; an optional source_ips list (CIDRs) restricts the exception to those sources, absent = world-open. Web traffic (80/443) is always Cloudflare-only and SSH (22) is always open; list only what must reach the box directly.",
   "mm-work": [
     { protocol: "tcp", port: "7881", description: "MM-Chat dev huddles LiveKit RTC over TCP (MMI-Hub#7353, owner-approved 2026-09-26)" },
     { protocol: "udp", port: "7882", description: "MM-Chat dev huddles LiveKit RTC over UDP (MMI-Hub#7353, owner-approved 2026-09-26)" },
@@ -49552,7 +49968,9 @@ var firewall_extras_default = {
   "mm-central": [],
   "mm-recorder": [],
   "mmi-runner": [],
-  "mmi-runner2": []
+  "mmi-runner2": [
+    { protocol: "tcp", port: "8888", source_ips: ["92.44.216.204/32"], description: "Scout's SearXNG gate: the nginx gate on 8888 (Authorization bearer header required, 403 without) in front of the persistent /opt/searxng compose (owner GO for SearXNG-on-Hetzner #2008, 6 Nov 2026). Source is the Scout host's consumer IP - dynamic; if it changes, update the CIDR here or fall back to the ssh tunnel; never open the port to the world" }
+  ]
 };
 
 // ../shared/runner-hosts.ts
@@ -49606,17 +50024,72 @@ async function runBoxFirewall(boxName, mode, live, deps) {
     observedAt
   };
   if (mode === "detach") {
-    if (!existing || !applied) {
-      return { ...target, ok: true, note: `firewall ${firewallName} is ${existing ? "not applied to" : "absent for"} this server \u2014 nothing to detach` };
+    const saved = deps.loadSnapshot(server.id);
+    if (!saved) {
+      if (!existing || !applied) {
+        return { ...target, ok: true, note: `firewall ${firewallName} is ${existing ? "not applied to" : "absent for"} this server \u2014 nothing to restore` };
+      }
+      throw new FirewallRefusal(`box firewall: refusing to detach ${firewallName} from ${runner}: no prior-policy snapshot is saved for this server, and detaching would leave the edge box with NO firewall. Run one --apply first (it saves the rollback snapshot), or if removing the firewall entirely is really the intent, do it deliberately in the Hetzner console \u2014 never through this rollback route.`);
+    }
+    const savedRules = saved.rules ?? [];
+    target.ruleDiff = rulesDiff(existing?.rules ?? [], savedRules);
+    if (!saved.attached) {
+      if (!existing || !applied) {
+        const fresh = await listAllFirewalls(deps, token);
+        const stillAttached = fresh.some((f) => appliedToServer(f, server.id));
+        target.readback = { observedAt: deps.now(), attached: stillAttached, rulesMatch: null };
+        target.ok = !stillAttached;
+        if (target.ok) target.note = `restored the saved prior policy (saved ${saved.savedAt}): no firewall attached`;
+        if (target.ok) deps.saveSnapshot(server.id, { savedAt: deps.now(), firewall: existing ? { id: existing.id, name: existing.name } : null, rules: existing?.rules ?? [], attached: false });
+        return target;
+      }
+      const action = await actionPost(deps, token, existing.id, "remove_from_resources", { remove_from: [{ type: "server", server: { id: server.id } }] });
+      const waited = await waitForAction(deps, token, action);
+      target.actions.push(actionReceipt("remove_from_resources", waited));
+      target.ambiguous ||= waited.ambiguous;
+      const readback3 = await readbackState(deps, token, existing.id, server.id, null, deps.now());
+      target.readback = readback3;
+      target.ok = !target.ambiguous && readback3.attached === false;
+      if (target.ok) target.note = `restored the saved prior policy (saved ${saved.savedAt}): no firewall was attached`;
+      if (target.ok) deps.saveSnapshot(server.id, { savedAt: deps.now(), firewall: { id: existing.id, name: existing.name }, rules: existing.rules ?? [], attached: false });
+      return target;
     }
-    const action = await actionPost(deps, token, existing.id, "remove_from_resources", { remove_from: [{ type: "server", server: { id: server.id } }] });
-    const waited = await waitForAction(deps, token, action);
-    target.actions.push(actionReceipt("remove_from_resources", waited));
-    target.ambiguous = waited.ambiguous;
-    const readback2 = await readbackState(deps, token, existing.id, server.id, null, deps.now());
+    let firewallId2 = existing?.id;
+    if (!existing) {
+      const created = await deps.hetzner(token, "/firewalls", {
+        method: "POST",
+        body: JSON.stringify({ name: firewallName, labels: { managed_by: "mmi-hub", box: runner }, rules: savedRules })
+      });
+      firewallId2 = created.firewall.id;
+      target.actions.push({ id: firewallId2, kind: "create", status: "created" });
+    } else if (exactRules(existing.rules ?? []) !== exactRules(savedRules)) {
+      const action = await actionPost(deps, token, firewallId2, "set_rules", { rules: savedRules });
+      const waited = await waitForAction(deps, token, action);
+      target.actions.push(actionReceipt("set_rules", waited));
+      target.ambiguous ||= waited.ambiguous;
+      if (waited.ambiguous || waited.action.status === "error") {
+        target.readback = await readbackState(deps, token, firewallId2, server.id, savedRules, deps.now());
+        return target;
+      }
+    }
+    if (!applied) {
+      const action = await actionPost(deps, token, firewallId2, "apply_to_resources", { apply_to: [{ type: "server", server: { id: server.id } }] });
+      const waited = await waitForAction(deps, token, action);
+      target.actions.push(actionReceipt("apply_to_resources", waited));
+      target.ambiguous ||= waited.ambiguous;
+      if (waited.ambiguous || waited.action.status === "error") {
+        target.readback = await readbackState(deps, token, firewallId2, server.id, savedRules, deps.now());
+        return target;
+      }
+    }
+    const readback2 = await readbackState(deps, token, firewallId2, server.id, savedRules, deps.now());
     target.readback = readback2;
-    target.ok = !waited.ambiguous && readback2.attached === false;
-    if (target.ok) target.note = `detached ${firewallName} from ${runner}`;
+    target.firewall = { id: firewallId2, name: firewallName };
+    target.ok = !target.ambiguous && readback2.attached && readback2.rulesMatch === true;
+    if (target.ok) {
+      target.note = `restored the saved prior policy (saved ${saved.savedAt}), verified by independent readback`;
+      deps.saveSnapshot(server.id, { savedAt: deps.now(), firewall: { id: firewallId2, name: firewallName }, rules: savedRules, attached: true });
+    }
     return target;
   }
   const extras = deps.declaredExtras(runner);
@@ -49625,13 +50098,18 @@ async function runBoxFirewall(boxName, mode, live, deps) {
   }
   const planned = buildRules(await deps.cloudflareRanges(), extras);
   target.plannedRules = planned;
-  const rulesChanged = !existing || norm(existing.rules ?? []) !== norm(planned);
+  const rulesChanged = !existing || exactRules(existing.rules ?? []) !== exactRules(planned);
   target.rulesChanged = rulesChanged;
+  target.ruleDiff = rulesDiff(existing?.rules ?? [], planned);
   if (mode === "plan") {
     target.ok = !rulesChanged && applied;
     if (target.ok) target.note = `firewall ${firewallName}#${existing.id} matches the reviewed policy and is applied`;
     return target;
   }
+  if (!deps.loadSnapshot(server.id)) {
+    deps.saveSnapshot(server.id, { savedAt: deps.now(), firewall: existing ? { id: existing.id, name: existing.name } : null, rules: existing?.rules ?? [], attached: applied });
+    target.note = "saved the live policy as the rollback snapshot";
+  }
   let firewallId = existing?.id;
   if (!existing) {
     const created = await deps.hetzner(token, "/firewalls", {
@@ -49666,9 +50144,21 @@ async function runBoxFirewall(boxName, mode, live, deps) {
   target.firewall = { id: firewallId, name: firewallName };
   target.readback = readback;
   target.ok = !target.ambiguous && readback.attached && readback.rulesMatch === true;
-  if (target.ok) target.note = `firewall ${firewallName}#${firewallId} applied to ${runner} and read back independently`;
+  if (target.ok) target.note = `firewall ${firewallName}#${firewallId} applied to ${runner} and read back independently${target.note ? `; ${target.note}` : ""}`;
   return target;
 }
+async function listAllFirewalls(deps, token) {
+  const out = [];
+  for (let page = 1; page <= 50; page += 1) {
+    const res = await deps.hetzner(token, `/firewalls?page=${page}`);
+    out.push(...res.firewalls ?? []);
+    if (!res.meta?.pagination?.next_page) return out;
+  }
+  throw new FirewallRefusal("box firewall: the project has more firewalls than the listing bound \u2014 cannot prove that no firewall is applied to this server");
+}
+function appliedToServer(f, serverId) {
+  return Boolean(f.applied_to?.some((a) => a.server?.id === serverId || a.applied_to_resources?.some((r) => r.server?.id === serverId)));
+}
 async function actionPost(deps, token, firewallId, kind, body) {
   const res = await deps.hetzner(token, `/firewalls/${firewallId}/actions/${kind}`, { method: "POST", body: JSON.stringify(body) });
   return res.action;
@@ -49694,10 +50184,20 @@ function actionReceipt(kind, waited) {
 async function readbackState(deps, token, firewallId, serverId, planned, at) {
   const firewall = (await deps.hetzner(token, `/firewalls/${firewallId}`)).firewall;
   const server = (await deps.hetzner(token, `/servers/${serverId}`)).server;
-  const attached = server != null && server.id === serverId && Boolean(firewall?.applied_to?.some((a) => a.server?.id === serverId));
-  const rulesMatch = planned ? norm(firewall?.rules ?? []) === norm(planned) : null;
+  const attached = server != null && server.id === serverId && appliedToServer(firewall, serverId);
+  const rulesMatch = planned ? exactRules(firewall?.rules ?? []) === exactRules(planned) : null;
   return { observedAt: at, attached, rulesMatch };
 }
+function rulesDiff(current, target) {
+  const key = (r) => exactRules([r]);
+  const cur = Array.isArray(current) ? current : [];
+  const targetKeys = new Set(target.map(key));
+  const currentKeys = new Set(cur.map(key));
+  return {
+    added: target.filter((r) => !currentKeys.has(key(r))),
+    removed: cur.filter((r) => !targetKeys.has(key(r)))
+  };
+}
 
 // src/box-commands.ts
 var HETZNER_API = "https://api.hetzner.cloud/v1/servers";
@@ -49920,7 +50420,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
       process.exitCode = 2;
     }
   });
-  box.command("firewall <box>").description("the registered runner boxes' Hetzner Cloud Firewall (#9786): --plan (default, read-only) reports the exact current rules and attachment against the reviewed policy; --apply writes it; --detach --apply is the rollback").option("--plan", "read-only: current firewall, attachment and exact rules, and the diff against the reviewed policy (the default)").option("--apply", "create/update the approved firewall (policy #7359, SSH stays world-open) and attach it to exactly this server; waits for each provider action, then re-reads the firewall and attachment independently").option("--detach", "with --apply: detach this exact firewall from this exact server (rollback; a route independent of SSH)").option("--json", "machine-readable receipt").action(async (name, o) => {
+  box.command("firewall <box>").description("the registered runner boxes' Hetzner Cloud Firewall (#9786): --plan (default, read-only) reports the exact current rules and attachment against the reviewed policy; --apply writes it; --detach --apply is the rollback").option("--plan", "read-only: current firewall, attachment and exact rules, and the diff against the reviewed policy (the default)").option("--apply", "create/update the approved firewall (policy #7359, SSH stays world-open) and attach it to exactly this server; waits for each provider action, then re-reads the firewall and attachment independently").option("--detach", "with --apply: restore this server's saved prior policy (the snapshot persisted before the first managed apply) \u2014 never a blind detach; refuses when no snapshot exists, because detaching would leave the edge box with no firewall").option("--json", "machine-readable receipt").action(async (name, o) => {
     try {
       if (o.apply && o.plan) throw new UsageError("box firewall: --plan and --apply are exclusive");
       if (o.detach && !o.apply) throw new UsageError("box firewall: --detach is a mutation \u2014 it needs --apply");
@@ -49969,6 +50469,12 @@ function renderFirewallReceipt(r, json) {
       lines2.push(`    in ${rule.protocol}${rule.port ? `/${rule.port}` : ""} from ${from} \u2014 ${rule.description}`);
     }
   }
+  if (r.ruleDiff && (r.ruleDiff.added.length > 0 || r.ruleDiff.removed.length > 0)) {
+    lines2.push(`  diff vs the provider's current set: ${r.ruleDiff.added.length} added, ${r.ruleDiff.removed.length} removed`);
+    const render = (r2) => `in ${r2.protocol}${r2.port ? `/${r2.port}` : ""} from ${(r2.source_ips ?? []).join(", ")} \u2014 ${r2.description ?? ""}`;
+    for (const rule of r.ruleDiff.added) lines2.push(`    + ${render(rule)}`);
+    for (const rule of r.ruleDiff.removed) lines2.push(`    - ${render(rule)}`);
+  }
   for (const a of r.actions) lines2.push(`  action ${a.kind} #${a.id}: ${a.status}${a.error ? ` \u2014 ${a.error.code ?? ""} ${a.error.message ?? ""}` : ""}`);
   if (r.readback) {
     lines2.push(`  readback (independent, ${r.readback.observedAt}): attached=${r.readback.attached}${r.readback.rulesMatch === null ? "" : ` rulesMatch=${r.readback.rulesMatch}`}`);
@@ -49978,10 +50484,25 @@ function renderFirewallReceipt(r, json) {
   console.log(lines2.join("\n"));
 }
 function firewallDeps() {
+  const snapshotDir = (0, import_node_path36.join)((0, import_node_os20.homedir)(), ".mmi-cli", "firewall-rollback");
+  const snapshotPath = (serverId) => (0, import_node_path36.join)(snapshotDir, `${serverId}.json`);
   return {
     hetzner: (token, path2, init) => hetzner(token, path2, init),
     cloudflareRanges: () => cloudflareRanges(),
     declaredExtras: (boxName) => declaredExtrasFromBundle(boxName),
+    loadSnapshot: (serverId) => {
+      const file = snapshotPath(serverId);
+      if (!(0, import_node_fs39.existsSync)(file)) return null;
+      const parsed = JSON.parse((0, import_node_fs39.readFileSync)(file, "utf8"));
+      if (typeof parsed.savedAt !== "string" || !Array.isArray(parsed.rules) || typeof parsed.attached !== "boolean") {
+        throw new Error(`box firewall: the rollback snapshot at ${file} is not a valid snapshot \u2014 inspect it before any rollback`);
+      }
+      return parsed;
+    },
+    saveSnapshot: (serverId, snapshot) => {
+      (0, import_node_fs39.mkdirSync)(snapshotDir, { recursive: true });
+      (0, import_node_fs39.writeFileSync)(snapshotPath(serverId), JSON.stringify(snapshot, null, 2));
+    },
     fetchToken: async () => {
       let token = null;
       await withSecrets(async (secretsDeps) => {
@@ -50147,7 +50668,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -50167,7 +50688,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto17.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto18.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -51417,7 +51938,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto18 = require("node:crypto");
+var import_node_crypto19 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -51450,7 +51971,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto18.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto19.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
   const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
   return { ...scoped, baseSha, baseBranch };
@@ -51824,7 +52345,7 @@ function registerBootstrapCommands(program3) {
       const cls = classOf(repo);
       const meta = metaOf(repo);
       const track = resolveReleaseTrack(metaWithDeclaredClass(meta, cls), void 0, repo);
-      const seeds = byteComparableSeeds(manifest, cls).filter((s) => seedMatchesReleaseTrack(s, track));
+      const seeds = byteComparableSeeds(manifest, cls).filter((s) => seedMatchesReleaseTrack(s, track) && seedMatchesRepo(s, repo));
       const trackHubContents = new Map([...hubContents].map(([t, c]) => [t, c == null ? c : renderSelfSeedForTrack(c, track)]));
       seedsPerRepo = Math.max(seedsPerRepo, seeds.length);
       const baseBranch = cls === "content" ? "main" : "development";
@@ -52267,6 +52788,7 @@ function registerBootstrapCommands(program3) {
       if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
       if (!seedMatchesProjectType(seed, applyProjectType)) continue;
       if (!seedMatchesReleaseTrack(seed, vars.RELEASE_TRACK)) continue;
+      if (!seedMatchesRepo(seed, repo)) continue;
       const waiver = seed.waivers?.[slug];
       if (waiver) {
         actions.push({ action: "skip", target: seed.target, ownership: seed.ownership, reason: `waived: ${waiver}` });
@@ -52766,7 +53288,7 @@ LIVE apply to ${repo}:
       void 0,
       repo
     );
-    const repos = inClassRepos.filter((repo) => seedMatchesReleaseTrack(seed, trackOf(repo))).map((repo) => {
+    const repos = inClassRepos.filter((repo) => seedMatchesReleaseTrack(seed, trackOf(repo)) && seedMatchesRepo(seed, repo)).map((repo) => {
       const slug = repo.split("/").pop().toLowerCase();
       const waiver = seed.waivers?.[slug];
       return { repo, slug, waiver };
@@ -53271,7 +53793,7 @@ function registerDeployCommands(program3) {
 }
 
 // src/intercom-guest.ts
-var import_node_crypto19 = require("node:crypto");
+var import_node_crypto20 = require("node:crypto");
 var import_promises5 = require("node:fs/promises");
 var import_node_os22 = require("node:os");
 var import_node_path38 = require("node:path");
@@ -53522,7 +54044,7 @@ async function runIntercomGuest(request, deps = {}) {
     };
   }
   const fetchImpl = deps.fetchImpl ?? ((url, init) => fetch(url, init));
-  const newKey = deps.newIdempotencyKey ?? (() => (0, import_node_crypto19.randomUUID)());
+  const newKey = deps.newIdempotencyKey ?? (() => (0, import_node_crypto20.randomUUID)());
   const secrets = [token, credential].filter((secret) => Boolean(secret));
   const callOne = async (op, body2) => {
     const headers = {
@@ -53648,7 +54170,7 @@ init_github_client();
 init_cli_shared();
 
 // src/suite-status.ts
-var import_node_crypto20 = require("node:crypto");
+var import_node_crypto21 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -53676,7 +54198,7 @@ function parseSuiteMapping(body) {
     return void 0;
   }
 }
-var sha2562 = (b) => (0, import_node_crypto20.createHash)("sha256").update(b).digest("hex");
+var sha2562 = (b) => (0, import_node_crypto21.createHash)("sha256").update(b).digest("hex");
 async function proveBundle(url, tag, fetchUrl) {
   const get = async (u) => {
     try {
@@ -53935,7 +54457,7 @@ async function waitSuiteDev(deps, opts) {
 // src/suite-train.ts
 var import_node_fs41 = require("node:fs");
 var import_node_path39 = require("node:path");
-var import_node_crypto21 = require("node:crypto");
+var import_node_crypto22 = require("node:crypto");
 
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -54037,7 +54559,7 @@ function readSuiteCut(path2) {
 }
 function writeSuiteCut(path2, record2) {
   (0, import_node_fs41.mkdirSync)((0, import_node_path39.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto21.randomBytes)(8).toString("hex")}.tmp`;
+  const temp = `${path2}.${(0, import_node_crypto22.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs41.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
     (0, import_node_fs41.renameSync)(temp, path2);
@@ -57138,7 +57660,7 @@ async function deleteMergedRemoteBranch(options) {
 init_github_client();
 
 // src/release-custody.ts
-var import_node_crypto22 = require("node:crypto");
+var import_node_crypto23 = require("node:crypto");
 var import_node_fs43 = require("node:fs");
 var import_node_path41 = require("node:path");
 init_github_client();
@@ -57362,7 +57884,7 @@ var ReleaseCustodyError = class extends Error {
     this.name = "ReleaseCustodyError";
   }
 };
-var custodyDigest = (value) => (0, import_node_crypto22.createHash)("sha256").update(value).digest("hex");
+var custodyDigest = (value) => (0, import_node_crypto23.createHash)("sha256").update(value).digest("hex");
 function parseCustody(raw, repo) {
   const s = JSON.parse(raw);
   if (s.schema !== "mmi-release-custody/v1" || s.repo !== repo || !s.precutId || !Number.isSafeInteger(s.revision) || s.revision < 1 || !s.controller || !Number.isSafeInteger(s.controller.runId) || s.controller.runId <= 0 || !Number.isSafeInteger(s.controller.runAttempt) || s.controller.runAttempt <= 0 || !s.controller.token || !(s.ledger === null || typeof s.ledger === "string") || !s.archives || !s.effects) {
@@ -57463,7 +57985,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
       }
     }
     let state = {
-      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto22.randomUUID)(), effects: {}, ...await initialize() },
+      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto23.randomUUID)(), effects: {}, ...await initialize() },
       revision: (found.state?.revision ?? 0) + 1,
       controller
     };
@@ -57524,7 +58046,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
           proof: { kind: "ledger-lifecycle", controller: state.controller }
         };
       }
-      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto22.randomUUID)() : state.precutId };
+      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto23.randomUUID)() : state.precutId };
     });
   }
   async preserveLocal(raw) {
@@ -57758,7 +58280,7 @@ function withHubReleaseCustody(deps) {
         if (!authority.ok || !authority.train || authority.authenticatedDelegation !== true) {
           throw new ReleaseCustodyError("repository custody requires the server-verified owner-triggered train session");
         }
-        const controller = { ...runIdentity, token: (0, import_node_crypto22.randomUUID)(), ...process.env.GITHUB_JOB ? { job: process.env.GITHUB_JOB } : {} };
+        const controller = { ...runIdentity, token: (0, import_node_crypto23.randomUUID)(), ...process.env.GITHUB_JOB ? { job: process.env.GITHUB_JOB } : {} };
         const raw = localRaw(path2);
         const requiredContexts = () => discoverRequiredCheckContexts(
           deps,
@@ -58470,7 +58992,7 @@ init_github_quota();
 
 // src/issue-commands.ts
 var import_node_fs46 = require("node:fs");
-var import_node_crypto23 = require("node:crypto");
+var import_node_crypto24 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -58947,7 +59469,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto23.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto24.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -59731,7 +60253,7 @@ function typedReadHint(path2) {
   }
   if (!item) return say(`mmi-cli devops read pr list --repo ${slug} --json number,title,state,headRefName`);
   if (item.startsWith("comments/")) return say(`mmi-cli devops read pr view <pr> --repo ${slug} --json comments,reviews`);
-  return say(`mmi-cli devops read pr view ${item} --repo ${slug} --json title,state,comments,reviews,commits,statusCheckRollup,mergedAt,mergeCommit,headRefOid,mergeable,mergeStateStatus`, "; `mergedAt`, `mergeCommit` and `headRefOid` carry the merge and head evidence, `mergeable` and `mergeStateStatus` carry mergeability, and `--json` is a field list callers may narrow or extend");
+  return say(`mmi-cli devops read pr view ${item} --repo ${slug} --json title,body,state,comments,reviews,commits,statusCheckRollup,mergedAt,mergeCommit,headRefOid,mergeable,mergeStateStatus`, "; `mergedAt`, `mergeCommit` and `headRefOid` carry the merge and head evidence, `mergeable` and `mergeStateStatus` carry mergeability, `--json` is a field list callers may narrow or extend, and `--jq <expr>` filters that JSON locally (#10154)");
 }
 function runsReadHint(path2) {
   const q = path2.indexOf("?");
@@ -59875,7 +60397,8 @@ function registerApiReadCommands(program3, overrides) {
       const shapes = "api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs and repos/{owner}/{repo}/releases/assets/{id}";
       if (!zip && o.out !== void 0) {
         if (req.kind === "contents") return fail(`${shapes} \u2014 for this file's bytes, drop --out and use \`--accept raw\` with a redirect: \`mmi-cli devops api get "${req.path}" --accept raw > <file>\` (decoded bytes on stdout, no base64 or JSON.parse). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
-        return fail(`${shapes} \u2014 drop --out and let the JSON body go to stdout (pipe it into node/jq, or use --jq <expr>), or use the typed read (e.g. \`mmi-cli devops read run list --repo <owner/repo> --json databaseId,workflowName,event,status,conclusion\`). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
+        const typed = typedReadHint(req.path);
+        return fail(`${shapes} \u2014 drop --out and let the JSON body go to stdout (pipe it into node/jq, or use --jq <expr>)${typed ? `.${typed}` : ", or use the typed read (e.g. `mmi-cli devops read run list --repo <owner/repo> --json databaseId,workflowName,event,status,conclusion`)."} This refusal exits 1 on stderr with nothing written: check the exit code, never discard stderr (2>&1 / >/dev/null) before parsing, and never chain a command after it (a trailing \`; ls <file>\` replaces exit 1 with its own code and hides this reason).`);
       }
       return fail(`${shapes} \u2014 append \`--out <file>\` to this command (e.g. \`MMI_ACTOR=app mmi-cli devops api get ${req.path} --out .jerv/tmp/job.log\`), or for job logs use the typed read \`MMI_ACTOR=app mmi-cli devops read run log <runId> --repo <owner/repo> --job <name|id>\`. Shell redirection (\`>\` / \`2>&1\`) is not a substitute: this refusal exits 1 on stderr with nothing written to stdout, so \`>\` leaves a zero-byte file \u2014 delete it and check the exit code.`);
     }
@@ -59890,7 +60413,20 @@ function registerApiReadCommands(program3, overrides) {
         o.accept
       );
       if (req.workflowRuns) body = sliceWorkflowRunsPage(body, req.workflowRuns);
-      if (o.jq !== void 0) body = await jqRun(o.jq, body, localJqEnv(), ...bindings.length ? [bindings] : []);
+      if (o.jq !== void 0) {
+        const upstream = body;
+        body = await jqRun(o.jq, body, localJqEnv(), ...bindings.length ? [bindings] : []);
+        if (body.trim() === "null") {
+          let keys;
+          try {
+            const parsed = JSON.parse(upstream);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) keys = Object.keys(parsed);
+          } catch {
+          }
+          if (keys) process.stderr.write(`api get: --jq '${o.jq}' returned null. stdout is the raw upstream JSON with no body/--json wrapper; its top-level keys are: ${keys.join(", ") || "(none)"}.
+`);
+        }
+      }
       if (zip) {
         (0, import_node_fs48.writeFileSync)(o.out, body, "latin1");
         return;
@@ -60932,7 +61468,7 @@ function parseCheckJobId(details) {
 function failingCheckRows(rows) {
   return rows.filter((row) => row.status === "fail" || row.status === "failure");
 }
-function tailLines(text, max = CHECK_LOG_TAIL_LINES) {
+function tailLines2(text, max = CHECK_LOG_TAIL_LINES) {
   const lines2 = text.split(/\r?\n/).filter((line) => line.trim());
   return { tail: lines2.slice(-max).join("\n"), truncated: lines2.length > max };
 }
@@ -60941,7 +61477,7 @@ async function attachFailureLogs(rows, fetchLog) {
     const jobId = parseCheckJobId(row.details);
     if (!jobId) continue;
     try {
-      const { tail, truncated } = tailLines(await fetchLog(jobId));
+      const { tail, truncated } = tailLines2(await fetchLog(jobId));
       if (tail) row.log = { jobId, tail, truncated };
     } catch {
     }
@@ -62109,7 +62645,7 @@ init_cli_shared();
 var import_node_child_process18 = require("node:child_process");
 var import_node_fs51 = require("node:fs");
 var import_node_path48 = require("node:path");
-var import_node_net = require("node:net");
+var import_node_net2 = require("node:net");
 var import_node_util5 = require("node:util");
 
 // src/rules-sync.ts
@@ -62512,7 +63048,7 @@ function pickStagePort(range, isFree) {
 }
 function isPortFree(port) {
   return new Promise((resolve8) => {
-    const srv = (0, import_node_net.createServer)();
+    const srv = (0, import_node_net2.createServer)();
     srv.once("error", () => resolve8(false));
     srv.once("listening", () => srv.close(() => resolve8(true)));
     srv.listen(port, "127.0.0.1");
@@ -63100,6 +63636,14 @@ function isPathAtOrWithin(path2, worktreePath) {
 function isWindowsCwdLockResidueError(error) {
   return process.platform === "win32" && /\bEPERM\b|access(?: is)? denied/i.test(error);
 }
+function isNodeModulesLockError(error) {
+  return /^(?:EPERM|EACCES|EBUSY)\b/.test(error);
+}
+function deferredNodeModulesLockRemediation(wtPath, branch, prNumber, repo) {
+  const quote = (value) => value.replace(/'/g, "''");
+  const rerun = `mmi-cli devops pr merge ${prNumber ?? "<pr>"}${repo ? ` --repo ${repo}` : ""}`;
+  return `Close the handle on the locked file under '${quote((0, import_node_path49.join)(wtPath, "node_modules"))}', then from the primary checkout re-run cleanup for branch '${quote(branch)}': ${rerun}`;
+}
 function deferredCwdLockRemediation(wtPath) {
   const quote = (path2) => path2.replace(/'/g, "''");
   return `After leaving the directory and closing its handles, remove it only if empty: [System.IO.Directory]::Delete('${quote(wtPath)}', $false)`;
@@ -63416,7 +63960,7 @@ async function removeWorktreeWithReconcile(wtPath, git3, listWorktrees, pathExis
 }
 function isPrMergeWorktreePartial(cleanup) {
   const worktree = cleanup?.worktree;
-  return Boolean(worktree?.path && worktree.status !== "removed" && worktree.status !== "preserved" && worktree.status !== "retained-locked" && worktree.status !== "switched-primary");
+  return Boolean(worktree?.path && worktree.status !== "removed" && worktree.status !== "preserved" && worktree.status !== "retained-locked" && worktree.status !== "switched-primary" && worktree.status !== "deferred");
 }
 function prMergeLocalCleanupExitCode(cleanup) {
   return cleanup?.worktree?.status === "failed" || cleanup?.localBranch?.status === "failed" ? 1 : void 0;
@@ -63575,18 +64119,19 @@ async function cleanupPrMergeLocalBranch(branch, options) {
   if (pathExists((0, import_node_path49.join)(wtPath, "node_modules"))) {
     const nmRemoved = await (options.removeRealNodeModules ?? removeWorktreeNodeModules)(wtPath);
     if (!nmRemoved.ok) {
+      const deferred = isNodeModulesLockError(nmRemoved.error) && pathExists(wtPath);
       report.worktree = {
         path: wtPath,
-        status: "failed",
-        reason: "pre-clean-failed",
+        status: deferred ? "deferred" : "failed",
+        reason: deferred ? "node-modules-locked" : "pre-clean-failed",
         error: `real-node_modules cleanup failed before worktree removal: ${nmRemoved.error}`,
         artifactsArchive,
         stageTeardown,
         tmpEvidenceCount: tmpEvidence.length,
         ...unlinkedReparsePoints.length ? { unlinkedReparsePoints } : {},
-        remediation: `Close handles to '${wtPath.replace(/'/g, "''")}' and retry MMI PR landing from the primary checkout`
+        remediation: deferred ? deferredNodeModulesLockRemediation(wtPath, branch, options.prNumber, options.repo) : `Close handles to '${wtPath.replace(/'/g, "''")}' and retry MMI PR landing from the primary checkout`
       };
-      report.localBranch = { name: branch, status: "not-attempted", reason: "worktree-pre-clean-failed" };
+      report.localBranch = { name: branch, status: "not-attempted", reason: deferred ? "worktree-cleanup-deferred" : "worktree-pre-clean-failed" };
       return report;
     }
   }
@@ -63685,6 +64230,8 @@ function renderPrMergeCleanupLines(cleanup) {
     lines2.push(`pr merge: preserved worktree ${wt.path} (--preserve-worktree)`);
   } else if (wt.status === "retained-locked") {
     lines2.push(`pr merge: worktree ${wt.path} cleanup deferred \u2014 its Windows parent shell still holds the cwd; ${wt.remediation ?? "exit the shell and remove the residue from the primary checkout"}`);
+  } else if (wt.status === "deferred") {
+    lines2.push(`pr merge: worktree ${wt.path} cleanup deferred \u2014 a node_modules file is locked${wt.error ? ` (${wt.error})` : ""}; ${wt.remediation ?? "close the handle and re-run pr merge for this PR"}`);
   } else if (wt.status === "switched-primary") {
     const now = wt.switchedTo ? `to ${wt.switchedTo}` : "to the base branch";
     lines2.push(wt.error ? `pr merge: primary checkout ${wt.path} switched ${now} but deleting the merged branch failed \u2014 ${wt.error}; remediate: ${wt.remediation ?? "delete the merged branch manually"}` : `pr merge: primary checkout ${wt.path} held the merged branch \u2014 switched it back ${now} and deleted the branch`);
@@ -65044,7 +65591,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
   }
   class PrHeadBehindBaseError extends Error {
   }
-  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--abandon-admission", "one stuck-receipt recovery, one PR per call: journal the saved non-terminal (pending/enqueued, or a dispatching send that saved no operation UUID after its sender died \u2014 #9995) queue-admission receipt terminal ONLY after positively observing the PR OPEN at the receipt head and absent from the queue; any unprovable observation refuses and changes nothing (#9951). The next pr land then submits a new intent with no new head").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "silence the leftover-scratch warning (scratch never blocks, #8785) and acknowledge a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 per-repo ruleset check_response_timeout_minutes is 15 default with 30/45/60 overrides in .github/rulesets/mmi-development-merge-queue.json; agents never edit the ruleset to shorten a queue wait)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
+  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--abandon-admission", "one stuck-receipt recovery, one PR per call: journal the saved non-terminal (pending/enqueued, or a dispatching send that saved no operation UUID after its sender died \u2014 #9995) queue-admission receipt terminal ONLY after positively observing the PR OPEN at the receipt head and absent from the queue; any unprovable observation refuses and changes nothing (#9951). The next pr land then submits a new intent with no new head").option("--dequeue", "one queued-PR recovery, one PR per call: take the PR out of GitHub's merge queue (dequeuePullRequest, #10132) so a fix commit can reach a branch whose queue entry blocks pushes \u2014 refuses when the PR is not in the queue, read-back-verifies the entry is gone before reporting, and journals a saved non-terminal admission receipt terminal so the next pr land submits a new intent").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "silence the leftover-scratch warning (scratch never blocks, #8785) and acknowledge a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 per-repo ruleset check_response_timeout_minutes is 15 default with 30/45/60 overrides in .github/rulesets/mmi-development-merge-queue.json; agents never edit the ruleset to shorten a queue wait)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
     const timeoutMinutes = opts.timeout === void 0 ? void 0 : Number(opts.timeout);
     if (timeoutMinutes !== void 0 && !(timeoutMinutes > 0)) return fail("pr land: --timeout must be a positive number of minutes");
     if (opts.abandonAdmission) {
@@ -65057,6 +65604,17 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
       if (outcome.status !== "abandoned") process.exitCode = 1;
       return;
     }
+    if (opts.dequeue) {
+      if (opts.abandonAdmission) return fail("pr land: --dequeue and --abandon-admission are separate one-PR recoveries; pass one per call");
+      if (numbers.length !== 1) return fail("pr land: --dequeue dequeues one PR per call");
+      const repo = await resolveRepo(opts.repo).catch(() => void 0) ?? opts.repo;
+      if (!repo) return fail("pr land: --dequeue needs --repo <owner/repo>; the PR repo could not be resolved");
+      const outcome = await dequeuePrMergeQueue(numbers[0], repo);
+      if (opts.json) printLine(JSON.stringify(outcome));
+      else printLine(outcome.status === "dequeued" ? `pr land: dequeued PR #${outcome.pr} from the merge queue on ${repo}${outcome.head ? ` at head ${outcome.head}` : ""} \u2014 push the fix commit, then rerun \`mmi-cli devops pr land ${outcome.pr} --repo ${repo}\`` + (outcome.admission === "terminal" ? `; the saved queue admission was journaled terminal${outcome.operation ? ` (operation ${outcome.operation})` : ""}, so the next pr land submits a new intent` : "") + (outcome.admission === "left-open" ? "; a saved admission receipt was left open \u2014 `--abandon-admission` settles it once the PR is verifiably out of the queue" : "") + (outcome.admission === "unreadable" ? "; the saved queue admission could not be read and was not changed" : "") : `pr land: refused to dequeue PR #${outcome.pr} on ${repo} \u2014 ${outcome.reason}`);
+      if (outcome.status !== "dequeued") process.exitCode = 1;
+      return;
+    }
     if (opts.expectHead !== void 0) {
       if (!/^[0-9a-f]{40}$/i.test(opts.expectHead)) return fail("pr land: --expect-head needs the full 40-hex head SHA");
       if (numbers.length !== 1) return fail("pr land: --expect-head pins one PR head; land one PR per call");
@@ -65637,6 +66195,8 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
+          prNumber: number,
+          repo: repoForPostCleanup,
           pathExists: (p) => (0, import_node_fs54.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
@@ -72386,14 +72946,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto24 = require("node:crypto");
+var import_node_crypto25 = require("node:crypto");
 var import_node_fs61 = require("node:fs");
 var import_promises12 = require("node:fs/promises");
 var import_node_path57 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto24.createHash)("sha256");
+  const hash = (0, import_node_crypto25.createHash)("sha256");
   for await (const chunk of (0, import_node_fs61.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -73073,13 +73633,13 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process23 = require("node:child_process");
-var import_node_crypto26 = require("node:crypto");
+var import_node_crypto27 = require("node:crypto");
 var import_node_fs64 = require("node:fs");
 var import_node_os28 = require("node:os");
 var import_node_path60 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto25 = require("node:crypto");
+var import_node_crypto26 = require("node:crypto");
 var import_node_fs63 = require("node:fs");
 var import_node_path59 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
@@ -73092,7 +73652,7 @@ function repoPath(root, declaredPath, label) {
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto25.createHash)("sha256");
+  const hash = (0, import_node_crypto26.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs63.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs63.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -73123,7 +73683,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha2563 = (bytes) => `sha256:${(0, import_node_crypto26.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2563 = (bytes) => `sha256:${(0, import_node_crypto27.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha2563(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha2563(rebuiltBytes) : ABSENT;
@@ -74693,6 +75253,7 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
     "run cancel",
     "run rerun",
     "run dispatch",
+    "run test",
     // #9779/#9780: the vars verbs and archive-status validate --repo/name/value before the first
     // dispatch, so their scoped App mint waits for the action handler like the run writes above.
     "vars get",
@@ -74723,7 +75284,7 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--input <file>", "run-task only: upload this file as the task artifact (same as tenant artifact put), then run with its id").option("--resume <run-id>", "run-task only: re-attach to an already-dispatched run (read-only, never re-dispatches) and print its receipt").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--input <file>", "run-task only: upload this file as the task artifact (same as tenant artifact put), then run with its id").option("--resume <run-id>", "run-task only: re-attach to an already-dispatched run (read-only, never re-dispatches) and print its receipt").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--out <path>", "write the output to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802); written only after a successful result (#10127)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
     if (o.resume !== void 0 && (action !== "run-task" || !/^\d+$/.test(o.resume) || o.task || o.artifact || o.input)) return fail("runtime tenant control: --resume <run-id> is run-task-only, takes a numeric run id, and cannot be combined with --task/--artifact/--input");
     if (o.input !== void 0 && o.artifact !== void 0) return fail("runtime tenant control: pass --input <file> or --artifact <id>, not both");
@@ -74732,9 +75293,9 @@ tenant.command("control <owner/repo> <stage> <action>").description("bounded ten
       if (o.confirmDataLoss !== void 0 && o.confirmDataLoss !== `${repo}/${stage}`) return fail(`runtime tenant control: --confirm-data-loss must match ${repo}/${stage} exactly`);
       if (o.confirmDataLoss === void 0) {
         const res = await tenantControl({ repo, stage, action, plan: true }, registryClientDeps(await loadConfig()));
-        if (!res.ok) return failGraceful(`runtime tenant control plan: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`);
-        printLine(o.json ? JSON.stringify(res.body, null, 2) : `${JSON.stringify(res.body, null, 2)}
-Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
+        if (!res.ok) return failGraceful(tenantControlFailure(`runtime tenant control plan: ${res.body?.error ?? res.error ?? `HTTP ${res.status}`}`, o.json));
+        emitTenantControlOutput(o.json ? JSON.stringify(res.body, null, 2) : `${JSON.stringify(res.body, null, 2)}
+Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`, { out: o.out, action }, { print: printLine });
         return;
       }
     }
@@ -74760,22 +75321,22 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines: lines3, failure } = renderVerifySecrets(body);
-      for (const line of lines3) printLine(line);
-      if (failure) return failGraceful(`runtime tenant control ${stage} verify-secrets: ${failure}`);
+      emitTenantControlOutput(lines3.join("\n"), { out: o.out, failed: !!failure || result.conclusion === "failure", action }, { print: printLine });
+      if (failure) return failGraceful(tenantControlFailure(`runtime tenant control ${stage} verify-secrets: ${failure}`, o.json));
     } else if (!o.json && action === "logs" && result.logs) {
-      printLine(result.logs);
+      emitTenantControlOutput(result.logs, { out: o.out, failed: result.conclusion === "failure", action }, { print: printLine });
     } else if (!o.json && action === "verify-broker" && result.broker) {
       const { lines: lines3, failure } = renderVerifyBroker({ broker: result.broker, raw: result.brokerRaw });
-      for (const line of lines3) printLine(line);
-      if (failure) return failGraceful(`runtime tenant control ${stage} verify-broker: ${failure}`);
+      emitTenantControlOutput(lines3.join("\n"), { out: o.out, failed: !!failure || result.conclusion === "failure", action }, { print: printLine });
+      if (failure) return failGraceful(tenantControlFailure(`runtime tenant control ${stage} verify-broker: ${failure}`, o.json));
     } else {
-      printLine(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result));
+      emitTenantControlOutput(o.json ? JSON.stringify(result, null, 2) : renderTenantControl(result), { out: o.out, failed: result.conclusion === "failure", action }, { print: printLine });
     }
     if (result.conclusion === "failure") {
-      return failGraceful(`runtime tenant control ${stage} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`);
+      return failGraceful(tenantControlFailure(`runtime tenant control ${stage} ${action}: ${result.category ?? "failed"} \u2014 ${result.note}`, o.json));
     }
   } catch (e) {
-    return failGraceful(`runtime tenant control: ${e.message}`);
+    return failGraceful(tenantControlFailure(`runtime tenant control: ${e.message}`, o.json));
   }
 });
 tenant.command("undo <owner/repo> <stage>").description("switch a tenant stage back to its previous release (warm standby: seconds; else recreated from the retained release, no rebuild); watches by default").option("--json", "machine-readable output").action(async (repo, stage, o) => {
@@ -75588,6 +76149,17 @@ registerRunDispatch(
   async () => (await mintCommandWriteToken(appActorDeps(), "run dispatch")).token,
   async () => fetchProjectsList(registryClientDeps(await loadConfig()))
 );
+var remoteTestToken;
+var remoteTestWriteToken = () => remoteTestToken ??= mintCommandWriteToken(appActorDeps(), "run test").then((t) => t.token);
+registerRemoteTest(runRoot, {
+  dispatch: async (inputs) => {
+    await dispatchWorkflow(FOCUSED_TEST_REPO, FOCUSED_TEST_WORKFLOW, FOCUSED_TEST_REF, inputs, {
+      projects: async () => fetchProjectsList(registryClientDeps(await loadConfig())),
+      post: appDispatchPost(remoteTestWriteToken)
+    });
+  },
+  read: appApiRead(remoteTestWriteToken)
+});
 var varsAppClient = (commandPath4) => async () => (
   // The concrete client always provides restWithStatus (optional on the interface only so hand-built
   // test stubs of GitHubClient keep compiling).