@pourkit/cli 0.0.0-next-20260714073403 → 0.0.0-next-20260723092204

package/dist/cli.js

@@ -58,20 +58,20 @@ function createLogger(name, filePath) {
       );
     },
     async close() {
-      await new Promise((resolve7) => {
+      await new Promise((resolve8) => {
         if (!fileStream) {
-          resolve7();
+          resolve8();
           return;
         }
         const timer = setTimeout(() => {
           if (!fileStream.destroyed) {
             fileStream.destroy();
           }
-          resolve7();
+          resolve8();
         }, 2e3);
         fileStream.end(() => {
           clearTimeout(timer);
-          resolve7();
+          resolve8();
         });
       });
     }
@@ -266,7 +266,7 @@ async function execJson(command, args, options = {}) {
   return JSON.parse(result.stdout);
 }
 function sleep(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 async function execCaptureWithRetry(command, args, options = {}) {
   const retries = options.retries ?? 3;
@@ -370,7 +370,11 @@ function applyOutputRetriesDefaults(retries) {
 }
 function applyStageAgentDefaults(agent) {
   return {
-    ...agent,
+    agent: agent.agent,
+    model: agent.model,
+    variant: agent.variant,
+    env: agent.env,
+    promptTemplate: agent.promptTemplate,
     outputRetries: applyOutputRetriesDefaults(agent.outputRetries)
   };
 }
@@ -432,6 +436,10 @@ function validateConfigSemantics(input) {
       target.strategy.issueFinalReview,
       `targets[${targetIndex}].strategy.issueFinalReview`
     );
+    assertStageAgentPath(
+      target.strategy.postCompletionFinalReview,
+      `targets[${targetIndex}].strategy.postCompletionFinalReview`
+    );
     assertStageAgentPath(
       target.strategy.finalize.prDescriptionAgent,
       `targets[${targetIndex}].strategy.finalize.prDescriptionAgent`
@@ -506,6 +514,9 @@ function normalizePourkitConfig(input) {
           ),
           maxAttempts: t.strategy.issueFinalReview.maxAttempts
         },
+        postCompletionFinalReview: applyStageAgentDefaults(
+          t.strategy.postCompletionFinalReview
+        ),
         finalize: {
           prDescriptionAgent: applyStageAgentDefaults(
             t.strategy.finalize.prDescriptionAgent
@@ -612,6 +623,16 @@ function getValidator() {
   }
   return _validate;
 }
+function getPackagedConfigSchemaVersion() {
+  const schema = _schema ?? JSON.parse(readFileSync(SCHEMA_PATH, "utf-8"));
+  _schema = schema;
+  const props = schema.properties;
+  const schemaVersion = props?.schemaVersion?.const;
+  if (typeof schemaVersion !== "number" || !Number.isInteger(schemaVersion)) {
+    throw new Error("Packaged Pourkit config schema is missing schemaVersion");
+  }
+  return schemaVersion;
+}
 function resolveMissingOrEmptyOutputRetries(config) {
   return config?.outputRetries?.missingOrEmpty ?? DEFAULT_MISSING_OR_EMPTY_OUTPUT_RETRIES;
 }
@@ -881,11 +902,11 @@ var OBSOLETE_CONFIG_PATHS = [
 ];
 var CANONICAL_CONFIG_PATH = ".pourkit/config.json";
 async function loadRepoConfig(repoRoot2, _configFileName) {
-  const { existsSync: existsSync25 } = await import("fs");
+  const { existsSync: existsSync26 } = await import("fs");
   const { join: pjoin } = await import("path");
   for (const obPath of OBSOLETE_CONFIG_PATHS) {
     const fullPath = pjoin(repoRoot2, obPath);
-    if (existsSync25(fullPath)) {
+    if (existsSync26(fullPath)) {
       const isRootJson = obPath === "pourkit.json";
       throw new Error(
         isRootJson ? `Found root ${obPath}, but Pourkit config now lives at ${CANONICAL_CONFIG_PATH}. Move the file and update "$schema" to "./schema/pourkit.schema.json".` : `Found ${obPath}, but executable config is no longer supported. Move configuration to ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
@@ -893,13 +914,13 @@ async function loadRepoConfig(repoRoot2, _configFileName) {
     }
   }
   const configPath = pjoin(repoRoot2, CANONICAL_CONFIG_PATH);
-  if (!existsSync25(configPath)) {
+  if (!existsSync26(configPath)) {
     throw new Error(
       `No Pourkit config found at ${CANONICAL_CONFIG_PATH}. Run pourkit init or create ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
     );
   }
-  const { readFile: readFile9 } = await import("fs/promises");
-  const raw = await readFile9(configPath, "utf-8");
+  const { readFile: readFile10 } = await import("fs/promises");
+  const raw = await readFile10(configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -910,10 +931,10 @@ async function loadRepoConfig(repoRoot2, _configFileName) {
   return parseConfig(parsed);
 }
 async function loadConfig(configPath) {
-  const { readFile: readFile9 } = await import("fs/promises");
+  const { readFile: readFile10 } = await import("fs/promises");
   const ext = configPath.split(".").pop()?.toLowerCase();
   if (ext === "json") {
-    const raw = await readFile9(configPath, "utf-8");
+    const raw = await readFile10(configPath, "utf-8");
     return parseConfig(JSON.parse(raw));
   }
   if (ext === "mjs" || ext === "js" || ext === "ts") {
@@ -4257,6 +4278,13 @@ var POST_COMPLETION_FINAL_REVIEW_ARTIFACT_PATH = join9(
   "post-completion-final-review",
   "agent-output.json"
 );
+function resolvePostCompletionFinalReviewAgent(target) {
+  const configured = target.strategy.postCompletionFinalReview;
+  if (configured) return configured;
+  throw new Error(
+    "Post-Completion Final Review requires targets[].strategy.postCompletionFinalReview config."
+  );
+}
 async function runPostCompletionFinalReview(options) {
   const {
     executionProvider,
@@ -4308,9 +4336,10 @@ async function runPostCompletionFinalReview(options) {
     };
   }
   const strategy = target.strategy;
-  const agent = strategy.issueFinalReview;
+  const agent = resolvePostCompletionFinalReviewAgent(target);
   const prompt = loadPostCompletionFinalReviewPrompt({
     repoRoot: repoRoot2,
+    promptTemplate: agent.promptTemplate,
     sourceDocumentPath,
     completedBranch,
     validationCommand: `pourkit validate-artifact post-completion-final-review ${artifactPathInWorktree}`,
@@ -4452,11 +4481,14 @@ Completed branch: ${completedBranch}`,
   );
 }
 function loadPostCompletionFinalReviewPrompt(options) {
-  const { repoRoot: repoRoot2, sourceDocumentPath, completedBranch, validationCommand } = options;
-  const promptPath = resolvePromptTemplatePath(
-    repoRoot2,
-    "post-completion-final-review.prompt.md"
-  );
+  const {
+    repoRoot: repoRoot2,
+    promptTemplate,
+    sourceDocumentPath,
+    completedBranch,
+    validationCommand
+  } = options;
+  const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
   const promptBody = existsSync9(promptPath) ? readFileSync8(promptPath, "utf-8") : `Review the completed branch against the source document.
 
 ## Source Document
@@ -6576,7 +6608,7 @@ async function canReachMcp(url) {
       return true;
     } catch {
       if (attempt < 9) {
-        await new Promise((resolve7) => setTimeout(resolve7, 100));
+        await new Promise((resolve8) => setTimeout(resolve8, 100));
       }
     }
   }
@@ -8617,7 +8649,10 @@ async function runIssueLifecycle(options) {
       startResult,
       reviewArtifactPath
     });
-    if (result.publicationStatus === "merged" && !startResult.parentPrdIssue) {
+    const isPrdChildIssue = Boolean(
+      startResult.parentPrdIssue || options.runOptions.beadsIssueRunContext
+    );
+    if (result.publicationStatus === "merged" && !isPrdChildIssue) {
       await options.deps.runOneshotPostCompletionFinalReview({
         issueNumber: options.issueNumber,
         repoRoot: options.repoRoot,
@@ -10556,7 +10591,7 @@ async function resolveGithubProjectionState(options) {
     expectedKind: "parent",
     prdRef: options.workspace.prdRef,
     githubIssueNumber: parentGithubIssueNumber,
-    allowMissingCanonicalMatch: parentGithubIssueNumber === void 0 && options.currentState.parent === null,
+    allowMissingCanonicalMatch: parentGithubIssueNumber === void 0,
     affected: [
       {
         kind: "prd",
@@ -10578,7 +10613,7 @@ async function resolveGithubProjectionState(options) {
       expectedKind: "child",
       prdRef: options.workspace.prdRef,
       githubIssueNumber,
-      allowMissingCanonicalMatch: action?.type === "create_child" && githubIssueNumber === void 0,
+      allowMissingCanonicalMatch: (action?.type === "create_child" || action?.type === "update_child") && githubIssueNumber === void 0,
       affected: [
         {
           kind: "child",
@@ -10803,7 +10838,7 @@ async function executeGithubProjectionActions(options) {
         child.childRef
       ),
       githubIssueNumber: action?.type === "update_child" ? action.githubIssueNumber : void 0,
-      allowMissingCanonicalMatch: action?.type !== "update_child"
+      allowMissingCanonicalMatch: action?.type !== "update_child" || action.githubIssueNumber === void 0
     });
     children.push({ childRef: child.childRef, githubIssue });
   }
@@ -11090,10 +11125,11 @@ async function runPrdPlanWorkspacePublishCommand(options) {
 
 // commands/prd-run.ts
 import { lstatSync, realpathSync } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 
 // prd-run/coordinator.ts
 import { spawnSync as spawnSync2 } from "child_process";
+import { join as join23 } from "path";
 import { Match, pipe } from "effect";
 init_common();
 
@@ -11810,7 +11846,8 @@ function validatePrdRunTerminalEvidence(record, context) {
         humanReadableReason: `PRD Run ${context.prdRef} is missing proof that all child Issues finalized into ${context.prdBranch}.`,
         repairability: "operator-action",
         nextAction: "inspect-and-retry",
-        nextRecommendedCommand: "pourkit prd-run launch"
+        nextRecommendedCommand: "pourkit prd-run launch",
+        diagnostics: [...context.childFinalizationDiagnostics ?? []]
       })
     };
   }
@@ -12352,15 +12389,19 @@ function inspectRemotePrdBranch(repoRoot2, prdRef) {
   return { ok: true, exists: true, headSha };
 }
 function fetchPrdBranch(repoRoot2, prdRef) {
-  const result = spawnSync2("git", ["fetch", "origin", prdRef], {
-    cwd: repoRoot2,
-    encoding: "utf8"
-  });
+  const result = spawnSync2(
+    "git",
+    ["fetch", "origin", `${prdRef}:refs/remotes/origin/${prdRef}`],
+    {
+      cwd: repoRoot2,
+      encoding: "utf8"
+    }
+  );
   if (result.status !== 0) {
     return {
       ok: false,
       gate: "git",
-      reason: `PRD Run start failed while fetching origin/${prdRef}.`,
+      reason: `PRD Run failed while fetching origin/${prdRef}.`,
       diagnostics: [
         result.error instanceof Error ? result.error.message : void 0,
         result.stderr?.toString?.() ?? String(result.stderr ?? ""),
@@ -12371,6 +12412,65 @@ function fetchPrdBranch(repoRoot2, prdRef) {
   }
   return { ok: true };
 }
+function postCompletionRetouchBranch(prdRef) {
+  return `pourkit/post-completion/${prdRef}`;
+}
+function postCompletionRetouchWorktreePath(repoRoot2, retouchBranch) {
+  return join23(
+    repoRoot2,
+    ".sandcastle",
+    "worktrees",
+    retouchBranch.replace(/\//g, "-")
+  );
+}
+async function ensurePostCompletionRetouchWorktree(options) {
+  const { repoRoot: repoRoot2, retouchBranch, baseRef, logger } = options;
+  const gitLogger = typeof logger.step === "function" ? logger : void 0;
+  const worktreeList = await execCapture(
+    "git",
+    ["worktree", "list", "--porcelain"],
+    {
+      cwd: repoRoot2,
+      logger: gitLogger,
+      label: "git worktree list"
+    }
+  );
+  const registeredWorktreePath = parseWorktreeListPorcelain(
+    worktreeList.stdout,
+    retouchBranch
+  );
+  if (registeredWorktreePath) {
+    return { worktreePath: registeredWorktreePath };
+  }
+  const worktreePath = postCompletionRetouchWorktreePath(
+    repoRoot2,
+    retouchBranch
+  );
+  let branchExists = false;
+  try {
+    await execCapture(
+      "git",
+      ["show-ref", "--verify", "--quiet", `refs/heads/${retouchBranch}`],
+      {
+        cwd: repoRoot2,
+        logger: gitLogger,
+        label: "git branch exists"
+      }
+    );
+    branchExists = true;
+  } catch {
+  }
+  await execCapture(
+    "git",
+    branchExists ? ["worktree", "add", worktreePath, retouchBranch] : ["worktree", "add", "-b", retouchBranch, worktreePath, baseRef],
+    {
+      cwd: repoRoot2,
+      logger: gitLogger,
+      label: "git worktree add post-completion retouch"
+    }
+  );
+  return { worktreePath };
+}
 async function ensurePrdBranchPublished(repoRoot2, prdRef, startBaseCommit) {
   const pushResult = spawnSync2(
     "git",
@@ -13005,7 +13105,27 @@ async function prdParentIssueIsClosed(options) {
   }
 }
 async function reconcileBlockedBeadsIssueProjection(options) {
-  const { issue, issueProvider, config, prdRef, logger } = options;
+  const { issue, issueProvider, config, prdRef, logger, retryRepair } = options;
+  if (shouldRestoreRetryableBeadsProjection({ issue, config, retryRepair })) {
+    logCoordinatorStep(
+      logger,
+      "info",
+      `Restoring retryable GitHub projection for Beads Issue #${issue.number}.`
+    );
+    for (const label of [
+      config.labels.blocked,
+      config.labels.agentInProgress,
+      config.labels.readyForHuman
+    ]) {
+      if (!issue.labels.includes(label)) continue;
+      try {
+        await issueProvider.removeLabel(issue.number, label);
+      } catch {
+      }
+    }
+    await issueProvider.addLabels(issue.number, [config.labels.readyForAgent]);
+    return await issueProvider.fetchIssue(issue.number);
+  }
   if (!issue.labels.includes(config.labels.blocked)) {
     return issue;
   }
@@ -13065,6 +13185,16 @@ async function reconcileBlockedBeadsIssueProjection(options) {
   }
   return refreshed;
 }
+function shouldRestoreRetryableBeadsProjection(options) {
+  const { issue, config, retryRepair } = options;
+  if (!retryRepair) return false;
+  if (issue.state !== "open") return false;
+  const guidance = retryRepair.guidance;
+  if (guidance.repairability !== "automatic-retry-safe") return false;
+  if (guidance.blockedGate !== "queue") return false;
+  if (issue.labels.includes(config.labels.blocked)) return false;
+  return !issue.labels.includes(config.labels.readyForAgent) || issue.labels.includes(config.labels.agentInProgress) || issue.labels.includes(config.labels.readyForHuman);
+}
 async function releaseSkippedBlockedBeadsChildren(options) {
   for (const child of options.children) {
     let result;
@@ -13091,6 +13221,19 @@ async function releaseSkippedBlockedBeadsChildren(options) {
     }
   }
 }
+async function closeBeadsChildForClosedIssueProjection(options) {
+  logCoordinatorStep(
+    options.logger,
+    "info",
+    `Closing Beads child ${options.beadsChildId} because GitHub Issue #${options.issue.number} is already closed.`
+  );
+  await closeBeadsPrdChild({
+    repoRoot: options.repoRoot,
+    childId: options.beadsChildId,
+    reason: `Issue #${options.issue.number} already closed`,
+    logger: options.logger
+  });
+}
 function extractIssueFromQueueError(error) {
   if (!error || typeof error !== "object" || !("issue" in error)) {
     return void 0;
@@ -13239,6 +13382,105 @@ async function selectPrdRunCoordinatorMode(options) {
     })
   };
 }
+function escapeRegExp3(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function normalizeChildRef2(value) {
+  const match = value.match(/^I-0*(\d+)$/i);
+  if (!match) return null;
+  return `I-${match[1].padStart(2, "0")}`;
+}
+function issueChildRef(prdRef, issue) {
+  const match = issue.title.match(
+    new RegExp(`^${escapeRegExp3(prdRef)}\\s*/\\s*(I-0*\\d+)\\s*:`, "i")
+  );
+  return match ? normalizeChildRef2(match[1]) : null;
+}
+function issueSummary(issue) {
+  return `#${issue.number} ${issue.title}`;
+}
+async function readPlannedChildRefs(options) {
+  const sourceDocument = await resolvePrdPostCompletionSourceDocument(options);
+  if (!sourceDocument || sourceDocument.status !== "resolved") {
+    return {
+      ok: false,
+      diagnostics: sourceDocument && sourceDocument.status === "blocked" ? [...sourceDocument.diagnostics] : [
+        sourceDocument?.reason ?? `Unable to resolve source document for ${options.prdRef}.`
+      ]
+    };
+  }
+  const parsed = await parsePrdPlanWorkspace({
+    workspacePath: join23(options.repoRoot, sourceDocument.workspacePath),
+    prdRef: options.prdRef
+  });
+  if (!parsed.ok) {
+    return {
+      ok: false,
+      diagnostics: parsed.diagnostics.map((diagnostic) => diagnostic.message)
+    };
+  }
+  return {
+    ok: true,
+    childRefs: parsed.workspace.children.map((child) => child.childRef)
+  };
+}
+async function verifyPrdChildFinalizationEvidence(options) {
+  const diagnostics = [];
+  const unfinalizedProcessed = options.processedResults.filter(
+    (result) => !result.noOp && result.publicationStatus !== "merged"
+  );
+  if (unfinalizedProcessed.length > 0) {
+    diagnostics.push(
+      `Processed child Issues missing PRD Branch merge/no-op evidence: ${unfinalizedProcessed.map((result) => `#${result.issueNumber}`).join(", ")}.`
+    );
+  }
+  let relatedIssues;
+  try {
+    relatedIssues = await options.issueProvider.listRelatedIssues(
+      options.prdRef
+    );
+  } catch (error) {
+    return {
+      ok: false,
+      diagnostics: [
+        `Failed to list child Issues for ${options.prdRef}: ${error instanceof Error ? error.message : String(error)}`
+      ]
+    };
+  }
+  if (relatedIssues.length === 0) {
+    diagnostics.push(`No child Issue projections found for ${options.prdRef}.`);
+  }
+  const planned = await readPlannedChildRefs({
+    repoRoot: options.repoRoot,
+    prdRef: options.prdRef
+  });
+  if (!planned.ok) {
+    diagnostics.push(...planned.diagnostics);
+  } else if (planned.childRefs.length === 0) {
+    diagnostics.push(`No planned child Issues found for ${options.prdRef}.`);
+  } else {
+    const relatedRefs = new Set(
+      relatedIssues.map((issue) => issueChildRef(options.prdRef, issue)).filter((ref) => ref !== null)
+    );
+    const missingRefs = planned.childRefs.filter(
+      (ref) => !relatedRefs.has(ref)
+    );
+    if (missingRefs.length > 0) {
+      diagnostics.push(
+        `Planned child Issues without published Issue projections: ${missingRefs.join(", ")}.`
+      );
+    }
+  }
+  const openRelatedIssues = relatedIssues.filter(
+    (issue) => issue.state !== "closed"
+  );
+  if (openRelatedIssues.length > 0) {
+    diagnostics.push(
+      `Child Issues still open: ${openRelatedIssues.map(issueSummary).join(", ")}.`
+    );
+  }
+  return { ok: diagnostics.length === 0, diagnostics };
+}
 async function runPostCompletionAfterTerminal(options, prdRef, record, resumeFacts, startOutcome) {
   const receipt = record.postCompletionFinalReview;
   if (receipt?.status === "passed" || receipt?.status === "overridden") {
@@ -13309,6 +13551,70 @@ async function runPostCompletionAfterTerminal(options, prdRef, record, resumeFac
     options.config,
     record.targetName ?? options.targetName
   );
+  const remotePrdBranch = inspectRemotePrdBranch(options.repoRoot, prdBranch);
+  if (!remotePrdBranch.ok) {
+    return buildLaunchBlockedOutcome(
+      options.repoRoot,
+      prdRef,
+      buildPrdRunRepairGuidance({
+        blockedGate: remotePrdBranch.gate,
+        blockedStage: "post-completion-final-review",
+        failureCode: "post-completion-branch-fetch-failed",
+        humanReadableReason: remotePrdBranch.reason,
+        repairability: "operator-action",
+        nextAction: "inspect-and-retry",
+        nextRecommendedCommand: `pourkit prd-run status ${prdRef}`,
+        diagnostics: [...remotePrdBranch.diagnostics],
+        offendingPaths: [...remotePrdBranch.offendingPaths]
+      }),
+      resumeFacts,
+      startOutcome,
+      record.targetName,
+      record.start
+    );
+  }
+  if (!remotePrdBranch.exists) {
+    return buildLaunchBlockedOutcome(
+      options.repoRoot,
+      prdRef,
+      buildPrdRunRepairGuidance({
+        blockedGate: "git",
+        blockedStage: "post-completion-final-review",
+        failureCode: "post-completion-branch-missing",
+        humanReadableReason: `Post-Completion Final Review for ${prdRef} requires origin/${prdBranch}, but the remote PRD branch does not exist.`,
+        repairability: "operator-action",
+        nextAction: "inspect-and-retry",
+        nextRecommendedCommand: `pourkit prd-run status ${prdRef}`,
+        diagnostics: [`Missing remote PRD branch: origin/${prdBranch}`]
+      }),
+      resumeFacts,
+      startOutcome,
+      record.targetName,
+      record.start
+    );
+  }
+  const fetchPrdResult = fetchPrdBranch(options.repoRoot, prdBranch);
+  if (!fetchPrdResult.ok) {
+    return buildLaunchBlockedOutcome(
+      options.repoRoot,
+      prdRef,
+      buildPrdRunRepairGuidance({
+        blockedGate: fetchPrdResult.gate,
+        blockedStage: "post-completion-final-review",
+        failureCode: "post-completion-branch-fetch-failed",
+        humanReadableReason: fetchPrdResult.reason,
+        repairability: "operator-action",
+        nextAction: "inspect-and-retry",
+        nextRecommendedCommand: `pourkit prd-run status ${prdRef}`,
+        diagnostics: [...fetchPrdResult.diagnostics],
+        offendingPaths: [...fetchPrdResult.offendingPaths]
+      }),
+      resumeFacts,
+      startOutcome,
+      record.targetName,
+      record.start
+    );
+  }
   const sourceDocResult = await resolvePrdPostCompletionSourceDocument({
     repoRoot: options.repoRoot,
     prdRef
@@ -13356,7 +13662,36 @@ async function runPostCompletionAfterTerminal(options, prdRef, record, resumeFac
       record.start
     );
   }
-  const worktreePath = options.repoRoot;
+  const retouchBranch = postCompletionRetouchBranch(prdRef);
+  let worktreePath;
+  try {
+    worktreePath = (await ensurePostCompletionRetouchWorktree({
+      repoRoot: options.repoRoot,
+      retouchBranch,
+      baseRef: `origin/${prdBranch}`,
+      logger: options.logger
+    })).worktreePath;
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    return buildLaunchBlockedOutcome(
+      options.repoRoot,
+      prdRef,
+      buildPrdRunRepairGuidance({
+        blockedGate: "git",
+        blockedStage: "post-completion-final-review",
+        failureCode: "post-completion-worktree-failed",
+        humanReadableReason: `Post-Completion Final Review for ${prdRef} could not prepare a retouch worktree: ${msg}`,
+        repairability: "operator-action",
+        nextAction: "inspect-and-retry",
+        nextRecommendedCommand: `pourkit prd-run status ${prdRef}`,
+        diagnostics: [msg]
+      }),
+      resumeFacts,
+      startOutcome,
+      record.targetName,
+      record.start
+    );
+  }
   const sourceDocumentPath = sourceDocResult.relativePath;
   stateAdapter.write({
     status: "in_progress",
@@ -13452,7 +13787,6 @@ async function runPostCompletionAfterTerminal(options, prdRef, record, resumeFac
       resume: resumeFacts
     };
   }
-  const retouchBranch = `pourkit/post-completion/${prdRef}`;
   stateAdapter.write({ retouchBranch });
   const prDescriptionResult = await runEffectAndMapExit(
     runPostCompletionPrDescriptionAgent({
@@ -13798,17 +14132,25 @@ async function launchPrdRun(options) {
       logger: options.logger
     });
   }
-  if (currentRecord && startReceipt && activeRepairGuidance?.failureCode === "missing-child-finalization-evidence" && await prdParentIssueIsClosed({
-    issueProvider: options.issueProvider,
+  const parentClosureIssueProvider = options.issueProvider;
+  if (currentRecord && startReceipt && parentClosureIssueProvider && activeRepairGuidance?.failureCode === "missing-child-finalization-evidence" && await prdParentIssueIsClosed({
+    issueProvider: parentClosureIssueProvider,
     prdRef,
     logger: options.logger
   })) {
     const prdBranch = startReceipt.prdBranch ?? prdRef;
+    const childFinalizationEvidence = await verifyPrdChildFinalizationEvidence({
+      repoRoot: options.repoRoot,
+      prdRef,
+      issueProvider: parentClosureIssueProvider,
+      processedResults: []
+    });
     const terminalEvidence = validatePrdRunTerminalEvidence(currentRecord, {
       prdRef,
       baseBranch: startReceipt.startBaseBranch,
       prdBranch,
-      allChildIssuesFinalizedIntoPrdBranch: true
+      allChildIssuesFinalizedIntoPrdBranch: childFinalizationEvidence.ok,
+      childFinalizationDiagnostics: childFinalizationEvidence.diagnostics
     });
     if (!terminalEvidence.ok) {
       return buildLaunchBlockedOutcome(
@@ -14042,11 +14384,22 @@ async function launchGithubQueueDrain(options, prdRef, startReceipt, targetName,
       writeDrainedRecord(options.repoRoot, prdRef, startReceipt, targetName);
       const drainRecord = readPrdRun(options.repoRoot, prdRef).record;
       if (drainRecord) {
+        const childFinalizationEvidence = await verifyPrdChildFinalizationEvidence({
+          repoRoot: options.repoRoot,
+          prdRef,
+          issueProvider,
+          processedResults: outcome.results.map((result2) => ({
+            issueNumber: result2.selected.number,
+            noOp: result2.runResult.noOp,
+            publicationStatus: result2.runResult.publicationStatus
+          }))
+        });
         const drainContext = {
           prdRef,
           baseBranch: startReceipt.startBaseBranch,
           prdBranch,
-          allChildIssuesFinalizedIntoPrdBranch: outcome.allProcessedIssuesFinalizedIntoPrdBranch === true
+          allChildIssuesFinalizedIntoPrdBranch: childFinalizationEvidence.ok,
+          childFinalizationDiagnostics: childFinalizationEvidence.diagnostics
         };
         const terminalEvidence = validatePrdRunTerminalEvidence(
           drainRecord,
@@ -14517,7 +14870,13 @@ async function launchBeadsQueueDrain(options, prdRef, startReceipt, targetName,
         issueProvider,
         config: options.config,
         prdRef,
-        logger
+        logger,
+        ...resumeBeadsContext ? {
+          retryRepair: {
+            guidance: originalGuidance,
+            beadsChildId: resumeBeadsContext.childId
+          }
+        } : {}
       });
       if (fetchedIssue.labels.includes(options.config.labels.blocked)) {
         logCoordinatorStep(
@@ -14667,8 +15026,24 @@ async function launchBeadsQueueDrain(options, prdRef, startReceipt, targetName,
         );
       }
       try {
-        const issue = await reconcileBlockedBeadsIssueProjection({
-          issue: contextResult.issue,
+        let issue = contextResult.issue;
+        if (issue.state === "closed") {
+          beadsClaimAttempted = true;
+          await closeBeadsChildForClosedIssueProjection({
+            repoRoot: options.repoRoot,
+            issue,
+            beadsChildId: contextResult.beads.childId,
+            logger
+          });
+          processedResults.push({
+            beadsChildId: contextResult.beads.childId,
+            issueNumber: issue.number,
+            publicationStatus: "merged"
+          });
+          continue;
+        }
+        issue = await reconcileBlockedBeadsIssueProjection({
+          issue,
           issueProvider,
           config: options.config,
           prdRef,
@@ -14801,13 +15176,18 @@ async function launchBeadsQueueDrain(options, prdRef, startReceipt, targetName,
   writeDrainedRecord(options.repoRoot, prdRef, startReceipt, targetName);
   const drainRecord = readPrdRun(options.repoRoot, prdRef).record;
   if (drainRecord) {
+    const childFinalizationEvidence = await verifyPrdChildFinalizationEvidence({
+      repoRoot: options.repoRoot,
+      prdRef,
+      issueProvider,
+      processedResults
+    });
     const drainContext = {
       prdRef,
       baseBranch: startReceipt.startBaseBranch,
       prdBranch,
-      allChildIssuesFinalizedIntoPrdBranch: processedResults.length > 0 && processedResults.every(
-        (r) => r.noOp || r.publicationStatus === "merged"
-      )
+      allChildIssuesFinalizedIntoPrdBranch: childFinalizationEvidence.ok,
+      childFinalizationDiagnostics: childFinalizationEvidence.diagnostics
     };
     const terminalEvidence = validatePrdRunTerminalEvidence(
       drainRecord,
@@ -15764,12 +16144,12 @@ icm --db .pourkit/icm/memories.db topics                                # list a
 var MANAGED_BLOCK_BEGIN = "<!-- BEGIN POURKIT MANAGED BLOCK -->";
 var MANAGED_BLOCK_END = "<!-- END POURKIT MANAGED BLOCK -->";
 var MANAGED_BLOCK_PATTERN = new RegExp(
-  `${escapeRegExp3(MANAGED_BLOCK_BEGIN)}\\r?\\n[\\s\\S]*?${escapeRegExp3(
+  `${escapeRegExp4(MANAGED_BLOCK_BEGIN)}\\r?\\n[\\s\\S]*?${escapeRegExp4(
     MANAGED_BLOCK_END
   )}[ \\t]*(?:\\r?\\n)?`,
   "g"
 );
-function escapeRegExp3(value) {
+function escapeRegExp4(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function buildManagedBlock(content) {
@@ -15984,6 +16364,12 @@ function generateConfigTemplate(options) {
         promptTemplate: ".pourkit/managed/prompts/issue-final-review.prompt.md",
         maxAttempts: 3
       },
+      postCompletionFinalReview: {
+        agent: "pourkit-reviewer",
+        model: "openai/gpt-5.5",
+        variant: "max",
+        promptTemplate: ".pourkit/managed/prompts/post-completion-final-review.prompt.md"
+      },
       finalize: {
         prDescriptionAgent: {
           agent: "pourkit-pr-description",
@@ -16004,7 +16390,7 @@ function generateConfigTemplate(options) {
   };
   const config = {
     $schema: "./schema/pourkit.schema.json",
-    schemaVersion: 3,
+    schemaVersion: getPackagedConfigSchemaVersion(),
     targets: [target],
     workflowPack: {
       version: "1.0.0",
@@ -17947,13 +18333,13 @@ Init applied: ${result.applied} operations applied, ${result.skipped} skipped.`
 // commands/memory-init.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync8, readFileSync as readFileSync19, writeFileSync as writeFileSync5 } from "fs";
 import { execFile as execFile3 } from "child_process";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 import { promisify as promisify3 } from "util";
 var execFileAsync3 = promisify3(execFile3);
 async function runMemoryInitCommand(options) {
   const cwd = options.cwd ?? process.cwd();
   const execCommand = options.execCommand ?? execFileAsync3;
-  const configPath = join24(cwd, ".pourkit", "config.json");
+  const configPath = join25(cwd, ".pourkit", "config.json");
   if (!existsSync20(configPath)) {
     return {
       ok: false,
@@ -17985,8 +18371,8 @@ async function runMemoryInitCommand(options) {
     const next = { ...raw, memory };
     writeFileSync5(configPath, JSON.stringify(next, null, 2) + "\n");
   }
-  const memoryDir = join24(cwd, ".pourkit", "icm");
-  const memoryDbPath = join24(memoryDir, "memories.db");
+  const memoryDir = join25(cwd, ".pourkit", "icm");
+  const memoryDbPath = join25(memoryDir, "memories.db");
   mkdirSync8(memoryDir, { recursive: true });
   let dbInitialized = false;
   let warning;
@@ -18000,7 +18386,7 @@ async function runMemoryInitCommand(options) {
   } catch {
     warning = "ICM is not available or could not initialize .pourkit/icm/memories.db. Install ICM and run `pourkit doctor` to verify repo-scoped memory setup.";
   }
-  const gitignorePath = join24(cwd, ".gitignore");
+  const gitignorePath = join25(cwd, ".gitignore");
   updateManagedBlockSync(gitignorePath, generateGitignoreBlock());
   const managed = await generateManagedAgentInstructions({
     sourceRoot: cwd,
@@ -18008,14 +18394,14 @@ async function runMemoryInitCommand(options) {
   });
   let updatedAgentFile = false;
   for (const fileName of ["AGENTS.md", "CLAUDE.md"]) {
-    const agentPath = join24(cwd, fileName);
+    const agentPath = join25(cwd, fileName);
     if (existsSync20(agentPath)) {
       updateManagedBlockSync(agentPath, managed);
       updatedAgentFile = true;
     }
   }
   if (!updatedAgentFile) {
-    updateManagedBlockSync(join24(cwd, "AGENTS.md"), managed);
+    updateManagedBlockSync(join25(cwd, "AGENTS.md"), managed);
   }
   return {
     ok: true,
@@ -18150,12 +18536,20 @@ async function runSerenaStatusCommand(options) {
 }
 
 // commands/config-schema.ts
-import { readFileSync as readFileSync20, existsSync as existsSync21, readdirSync as readdirSync5 } from "fs";
-import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile3, readdir as readdir4 } from "fs/promises";
-import { resolve as resolve5, dirname as dirname6, relative as relative4, basename } from "path";
+import { readFileSync as readFileSync21, existsSync as existsSync22, readdirSync as readdirSync5 } from "fs";
+import { mkdir as mkdir6, readFile as readFile8, writeFile as writeFile4, readdir as readdir4 } from "fs/promises";
+import { resolve as resolve6, dirname as dirname7, relative as relative4, basename } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+import Ajv3 from "ajv";
+init_common();
+
+// commands/config-migration.ts
+import { existsSync as existsSync21, readFileSync as readFileSync20 } from "fs";
+import { writeFile as writeFile3, rename as rename2 } from "fs/promises";
+import { resolve as resolve5, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+import { randomUUID as randomUUID2 } from "crypto";
 import Ajv2 from "ajv";
-init_common();
 var __filename3 = fileURLToPath3(import.meta.url);
 var __dirname3 = dirname6(__filename3);
 function resolvePackagedAssetPath2(fileName) {
@@ -18163,16 +18557,454 @@ function resolvePackagedAssetPath2(fileName) {
     resolve5(__dirname3, "schema", fileName),
     resolve5(__dirname3, "../schema", fileName)
   ];
-  return candidates.find((candidate) => existsSync21(candidate)) ?? candidates[0];
+  return candidates.find((c) => existsSync21(c)) ?? candidates[0];
 }
 var PACKAGED_SCHEMA_PATH = resolvePackagedAssetPath2("pourkit.schema.json");
-var PACKAGED_HASH_PATH = resolvePackagedAssetPath2("pourkit.schema.hash");
+var SAFE_DEFAULTS = {
+  "#$schema": "./schema/pourkit.schema.json",
+  "/targets/*/strategy#postCompletionFinalReview": {
+    agent: "pourkit-reviewer",
+    model: "openai/gpt-5.5",
+    variant: "max",
+    promptTemplate: ".pourkit/managed/prompts/post-completion-final-review.prompt.md"
+  }
+};
+function normalizePathForLookup(instancePath) {
+  return instancePath.replace(/\/\d+/g, "/*");
+}
+function getCurrentSchemaVersion(schema) {
+  const props = schema.properties;
+  const svProp = props?.schemaVersion;
+  return svProp?.const ?? 0;
+}
+function getSchema() {
+  return JSON.parse(readFileSync20(PACKAGED_SCHEMA_PATH, "utf-8"));
+}
+function setNestedValue(obj, instancePath, property, value) {
+  let target = obj;
+  if (instancePath) {
+    const segments = instancePath.split("/").filter(Boolean);
+    for (const seg of segments) {
+      if (!target || typeof target !== "object") return;
+      if (Array.isArray(target)) {
+        const idx = Number(seg);
+        if (isNaN(idx) || idx < 0) return;
+        target = target[idx];
+      } else {
+        const t2 = target;
+        const next = t2[seg];
+        if (next !== void 0 && typeof next === "object") {
+          target = next;
+        } else {
+          return;
+        }
+      }
+    }
+  }
+  if (!target || typeof target !== "object") return;
+  const t = target;
+  if (!(property in t)) {
+    t[property] = structuredClone(value);
+  }
+}
+function planConfigMigration(rawConfig, options = {}) {
+  const schema = options.schema ?? getSchema();
+  const currentSchemaVersion = getCurrentSchemaVersion(schema);
+  let existingSchemaVersion;
+  if (rawConfig && typeof rawConfig === "object") {
+    const sv = rawConfig.schemaVersion;
+    if (typeof sv === "number") {
+      existingSchemaVersion = sv;
+    }
+  }
+  const ajv = new Ajv2({ strict: true, allErrors: true });
+  ajv.addKeyword("x-pourkit-schema-version");
+  const validate = ajv.compile(schema);
+  let workingConfig = structuredClone(rawConfig);
+  const plannedChanges = [];
+  const blockers = [];
+  let schemaVersionPlanned = false;
+  for (let iteration = 0; iteration < 100; iteration++) {
+    const valid2 = validate(workingConfig);
+    if (valid2) {
+      if (plannedChanges.length === 0 && !schemaVersionPlanned) {
+        return {
+          status: "current",
+          safe: true,
+          available: false,
+          command: null,
+          plannedChanges: [],
+          blockers: [],
+          existingSchemaVersion,
+          currentSchemaVersion,
+          schemaSyncPlanned: false
+        };
+      }
+      const migrated = structuredClone(workingConfig);
+      if (existingSchemaVersion !== void 0 && existingSchemaVersion !== currentSchemaVersion) {
+        migrated.schemaVersion = currentSchemaVersion;
+      }
+      return {
+        status: "migratable",
+        safe: true,
+        available: true,
+        command: "pourkit config migrate",
+        plannedChanges,
+        blockers: [],
+        existingSchemaVersion,
+        currentSchemaVersion,
+        migratedConfig: migrated,
+        schemaSyncPlanned: true
+      };
+    }
+    const errors = validate.errors ?? [];
+    const appliedSafeDefaults = applySafeDefaults(
+      errors,
+      workingConfig,
+      plannedChanges
+    );
+    if (appliedSafeDefaults) {
+      continue;
+    }
+    if (!schemaVersionPlanned) {
+      for (const err of errors) {
+        if (err.keyword === "const" && err.instancePath === "/schemaVersion") {
+          if (existingSchemaVersion === void 0 || !Number.isInteger(existingSchemaVersion)) {
+            blockers.push(
+              `/schemaVersion: invalid value; migration only updates older integer schema versions to supported schema version ${currentSchemaVersion}`
+            );
+            continue;
+          }
+          if (existingSchemaVersion > currentSchemaVersion) {
+            blockers.push(
+              `/schemaVersion: ${existingSchemaVersion} is newer than supported schema version ${currentSchemaVersion}`
+            );
+            continue;
+          }
+          schemaVersionPlanned = true;
+          plannedChanges.push(
+            `Update schemaVersion from ${existingSchemaVersion ?? "?"} to ${currentSchemaVersion}`
+          );
+          workingConfig.schemaVersion = currentSchemaVersion;
+        }
+      }
+      if (schemaVersionPlanned) {
+        continue;
+      }
+      if (blockers.length > 0) {
+        return {
+          status: "blocked",
+          safe: false,
+          available: false,
+          command: null,
+          plannedChanges,
+          blockers,
+          existingSchemaVersion,
+          currentSchemaVersion,
+          schemaSyncPlanned: false
+        };
+      }
+    }
+    for (const err of errors) {
+      if (err.keyword === "required") {
+        const missingProperty = err.params.missingProperty;
+        const concretePath = err.instancePath ? `${err.instancePath}/${missingProperty}` : missingProperty;
+        const lookupKey = `${normalizePathForLookup(err.instancePath)}#${missingProperty}`;
+        if (!(lookupKey in SAFE_DEFAULTS)) {
+          blockers.push(
+            `${concretePath}: required property missing, no registered safe default`
+          );
+        }
+      } else if (err.keyword === "additionalProperties") {
+        const additionalProp = err.params.additionalProperty;
+        const path9 = err.instancePath || "";
+        blockers.push(
+          `${path9 ? `${path9}.${additionalProp}` : additionalProp}: unknown property, removal not supported`
+        );
+      } else if (err.keyword === "const" && err.instancePath === "/schemaVersion") {
+        continue;
+      } else if (err.keyword === "type") {
+        const expected = err.params.type;
+        const path9 = err.instancePath || "";
+        blockers.push(
+          `${path9 || "Config"} must be ${expected === "integer" ? "an integer" : `a ${expected}`}`
+        );
+      } else {
+        const path9 = err.instancePath || "";
+        blockers.push(`${path9 || "Config"} ${err.message || "is invalid"}`);
+      }
+    }
+    if (blockers.length > 0) {
+      return {
+        status: "blocked",
+        safe: false,
+        available: false,
+        command: null,
+        plannedChanges,
+        blockers,
+        existingSchemaVersion,
+        currentSchemaVersion,
+        schemaSyncPlanned: false
+      };
+    }
+    return {
+      status: "blocked",
+      safe: false,
+      available: false,
+      command: null,
+      plannedChanges,
+      blockers: ["Unexpected validation state"],
+      existingSchemaVersion,
+      currentSchemaVersion,
+      schemaSyncPlanned: false
+    };
+  }
+  return {
+    status: "blocked",
+    safe: false,
+    available: false,
+    command: null,
+    plannedChanges,
+    blockers: ["Too many validation iterations"],
+    existingSchemaVersion,
+    currentSchemaVersion,
+    schemaSyncPlanned: false
+  };
+}
+function applySafeDefaults(errors, workingConfig, plannedChanges) {
+  let applied = false;
+  for (const err of errors) {
+    if (err.keyword !== "required") continue;
+    const instancePath = err.instancePath;
+    const missingProperty = err.params.missingProperty;
+    const lookupKey = `${normalizePathForLookup(instancePath)}#${missingProperty}`;
+    const concretePath = instancePath ? `${instancePath}/${missingProperty}` : missingProperty;
+    if (lookupKey in SAFE_DEFAULTS) {
+      const defaultValue = SAFE_DEFAULTS[lookupKey];
+      const targetExists = checkPropertyExists(
+        workingConfig,
+        instancePath,
+        missingProperty
+      );
+      if (!targetExists) {
+        setNestedValue(
+          workingConfig,
+          instancePath,
+          missingProperty,
+          defaultValue
+        );
+        plannedChanges.push(`Add ${concretePath}`);
+        applied = true;
+      }
+    }
+  }
+  return applied;
+}
+function checkPropertyExists(obj, instancePath, property) {
+  let target = obj;
+  if (instancePath) {
+    const segments = instancePath.split("/").filter(Boolean);
+    for (const seg of segments) {
+      if (!target || typeof target !== "object") return true;
+      if (Array.isArray(target)) {
+        const idx = Number(seg);
+        if (isNaN(idx) || idx < 0) return true;
+        target = target[idx];
+      } else {
+        const t = target;
+        const next = t[seg];
+        if (next !== void 0 && typeof next === "object") {
+          target = next;
+        } else {
+          return true;
+        }
+      }
+    }
+  }
+  if (!target || typeof target !== "object") return true;
+  return property in target;
+}
+async function writeFileAtomic2(filePath, content) {
+  const tmpPath = `${filePath}.tmp.${randomUUID2()}`;
+  await writeFile3(tmpPath, content, "utf-8");
+  await rename2(tmpPath, filePath);
+}
+async function runConfigMigrateCommand(options) {
+  const repoRootPath = options.cwd ?? process.cwd();
+  const configPath = resolve5(repoRootPath, ".pourkit/config.json");
+  if (!existsSync21(configPath)) {
+    return {
+      status: "blocked",
+      safe: false,
+      plannedChanges: [],
+      blockers: [".pourkit/config.json not found"],
+      configPath,
+      schemaSync: null,
+      currentSchemaVersion: getCurrentSchemaVersion(getSchema())
+    };
+  }
+  let rawConfig;
+  try {
+    const content = readFileSync20(configPath, "utf-8");
+    rawConfig = JSON.parse(content);
+  } catch (err) {
+    const msg = err instanceof SyntaxError ? err.message : String(err);
+    return {
+      status: "blocked",
+      safe: false,
+      plannedChanges: [],
+      blockers: [`.pourkit/config.json: ${msg}`],
+      configPath,
+      schemaSync: null,
+      currentSchemaVersion: getCurrentSchemaVersion(getSchema())
+    };
+  }
+  const plan = planConfigMigration(rawConfig);
+  if (plan.status === "current") {
+    return {
+      status: "current",
+      safe: true,
+      plannedChanges: [],
+      blockers: [],
+      configPath,
+      schemaSync: null,
+      existingSchemaVersion: plan.existingSchemaVersion,
+      currentSchemaVersion: plan.currentSchemaVersion
+    };
+  }
+  if (plan.status === "blocked") {
+    return {
+      status: "blocked",
+      safe: false,
+      plannedChanges: plan.plannedChanges,
+      blockers: plan.blockers,
+      configPath,
+      schemaSync: null,
+      existingSchemaVersion: plan.existingSchemaVersion,
+      currentSchemaVersion: plan.currentSchemaVersion
+    };
+  }
+  if (options.dryRun) {
+    return {
+      status: "dry-run",
+      safe: plan.safe,
+      plannedChanges: plan.plannedChanges,
+      blockers: plan.blockers,
+      configPath,
+      schemaSync: null,
+      existingSchemaVersion: plan.existingSchemaVersion,
+      currentSchemaVersion: plan.currentSchemaVersion
+    };
+  }
+  const migratedConfig = plan.migratedConfig;
+  if (!migratedConfig) {
+    return {
+      status: "blocked",
+      safe: false,
+      plannedChanges: plan.plannedChanges,
+      blockers: ["Migration plan did not produce migrated config"],
+      configPath,
+      schemaSync: null,
+      existingSchemaVersion: plan.existingSchemaVersion,
+      currentSchemaVersion: plan.currentSchemaVersion
+    };
+  }
+  const configContent = JSON.stringify(migratedConfig, null, 2) + "\n";
+  await writeFileAtomic2(configPath, configContent);
+  const schemaSync = await runConfigSyncSchemaCommand({ cwd: repoRootPath });
+  return {
+    status: "migrated",
+    safe: true,
+    plannedChanges: plan.plannedChanges,
+    blockers: [],
+    configPath,
+    schemaSync,
+    existingSchemaVersion: plan.existingSchemaVersion,
+    currentSchemaVersion: plan.currentSchemaVersion
+  };
+}
+function renderConfigMigrateResult(result) {
+  const lines = [];
+  switch (result.status) {
+    case "current":
+      lines.push(
+        `Config is already current for schema version ${result.currentSchemaVersion}.`
+      );
+      lines.push("No changes needed.");
+      break;
+    case "dry-run":
+      lines.push(
+        "Dry-run: config migration would apply the following changes:"
+      );
+      if (result.plannedChanges.length > 0) {
+        lines.push("");
+        for (const change of result.plannedChanges) {
+          lines.push(`  ${change}`);
+        }
+      }
+      if (result.blockers.length > 0) {
+        lines.push("");
+        lines.push("Blockers:");
+        for (const blocker of result.blockers) {
+          lines.push(`  ${blocker}`);
+        }
+      }
+      lines.push("");
+      lines.push("No files were written.");
+      break;
+    case "migrated":
+      lines.push("Config migration completed successfully.");
+      if (result.plannedChanges.length > 0) {
+        lines.push("");
+        for (const change of result.plannedChanges) {
+          lines.push(`  ${change}`);
+        }
+      }
+      if (result.schemaSync) {
+        if (result.schemaSync.schemaWritten) {
+          lines.push("Schema file updated.");
+        }
+        if (result.schemaSync.hashWritten) {
+          lines.push("Schema hash updated.");
+        }
+      }
+      break;
+    case "blocked":
+      lines.push("Config migration is blocked.");
+      if (result.blockers.length > 0) {
+        lines.push("");
+        for (const blocker of result.blockers) {
+          lines.push(`  ${blocker}`);
+        }
+      }
+      lines.push("");
+      lines.push("No files were written.");
+      break;
+  }
+  return lines.join("\n") + "\n";
+}
+function renderConfigMigrateResultJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+
+// commands/config-schema.ts
+var __filename4 = fileURLToPath4(import.meta.url);
+var __dirname4 = dirname7(__filename4);
+function resolvePackagedAssetPath3(fileName) {
+  const candidates = [
+    resolve6(__dirname4, "schema", fileName),
+    resolve6(__dirname4, "../schema", fileName)
+  ];
+  return candidates.find((candidate) => existsSync22(candidate)) ?? candidates[0];
+}
+var PACKAGED_SCHEMA_PATH2 = resolvePackagedAssetPath3("pourkit.schema.json");
+var PACKAGED_HASH_PATH = resolvePackagedAssetPath3("pourkit.schema.hash");
 var _schemaValidator = null;
 var _schemaErrors = null;
 function getSchemaValidator() {
   if (!_schemaValidator) {
-    const schema = JSON.parse(readFileSync20(PACKAGED_SCHEMA_PATH, "utf-8"));
-    const ajv = new Ajv2({ strict: true });
+    const schema = JSON.parse(readFileSync21(PACKAGED_SCHEMA_PATH2, "utf-8"));
+    const ajv = new Ajv3({ strict: true });
     ajv.addKeyword("x-pourkit-schema-version");
     const validate = ajv.compile(schema);
     _schemaValidator = (data) => {
@@ -18185,41 +19017,41 @@ function getSchemaValidator() {
   return _schemaValidator;
 }
 function readPackagedHash() {
-  return readFileSync20(PACKAGED_HASH_PATH, "utf-8");
+  return readFileSync21(PACKAGED_HASH_PATH, "utf-8");
 }
 function localSchemaDir(repoRoot2) {
-  return resolve5(repoRoot2, ".pourkit/schema");
+  return resolve6(repoRoot2, ".pourkit/schema");
 }
 var MANAGED_BLOCK_BEGIN2 = "<!-- BEGIN POURKIT MANAGED BLOCK -->\n";
 var MANAGED_BLOCK_BEGIN_MARKER = MANAGED_BLOCK_BEGIN2.trim();
 var MANAGED_BLOCK_END_MARKER = "<!-- END POURKIT MANAGED BLOCK -->";
 var OLD_DOCS_PATH_PATTERN = ".pourkit/docs/agents/";
 function resolvePackagedManagedPath(...segments) {
-  const bundledPath = resolve5(__dirname3, "managed", ...segments);
-  const sourcePath = resolve5(__dirname3, "..", "managed", ...segments);
+  const bundledPath = resolve6(__dirname4, "managed", ...segments);
+  const sourcePath = resolve6(__dirname4, "..", "managed", ...segments);
   const candidates = [bundledPath, sourcePath];
-  return candidates.find((candidate) => existsSync21(candidate)) ?? bundledPath;
+  return candidates.find((candidate) => existsSync22(candidate)) ?? bundledPath;
 }
 function resolvePackagedOpenCodeAgentsDir() {
   const candidates = [
-    resolve5(__dirname3, ".opencode", "agents"),
-    resolve5(__dirname3, "..", ".opencode", "agents"),
-    resolve5(__dirname3, "..", "..", ".opencode", "agents")
+    resolve6(__dirname4, ".opencode", "agents"),
+    resolve6(__dirname4, "..", ".opencode", "agents"),
+    resolve6(__dirname4, "..", "..", ".opencode", "agents")
   ];
-  return candidates.find((candidate) => existsSync21(candidate)) ?? candidates[0];
+  return candidates.find((candidate) => existsSync22(candidate)) ?? candidates[0];
 }
 function listPackagedOpenCodeAgentFiles() {
   const agentsDir = resolvePackagedOpenCodeAgentsDir();
   try {
-    return readdirSync5(agentsDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => resolve5(agentsDir, entry.name));
+    return readdirSync5(agentsDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => resolve6(agentsDir, entry.name));
   } catch {
     return [];
   }
 }
 async function readManifestAssets(cwd) {
-  const manifestPath = resolve5(cwd, ".pourkit/manifest.json");
+  const manifestPath = resolve6(cwd, ".pourkit/manifest.json");
   try {
-    const content = await readFile7(manifestPath, "utf-8");
+    const content = await readFile8(manifestPath, "utf-8");
     const manifest = JSON.parse(content);
     if (typeof manifest.assets !== "object" || manifest.assets === null || Array.isArray(manifest.assets)) {
       return {};
@@ -18243,7 +19075,7 @@ function resolvePackagedReleaseAddonDocPath(docName) {
 }
 async function readPackagedTextFile(filePath) {
   try {
-    return await readFile7(filePath, "utf-8");
+    return await readFile8(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -18257,7 +19089,7 @@ async function walkDir2(dir) {
   try {
     const entries = await readdir4(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = resolve5(dir, entry.name);
+      const full = resolve6(dir, entry.name);
       if (entry.isDirectory()) {
         files.push(...await walkDir2(full));
       } else {
@@ -18340,8 +19172,8 @@ async function validateWorkflowPack(cwd) {
   const baselineSkills = getBaselineManagedSkillNames();
   const manifestAssets = await readManifestAssets(cwd);
   for (const docName of catalog.docs) {
-    const localPath = resolve5(cwd, `.pourkit/managed/docs/agents/${docName}`);
-    if (!existsSync21(localPath)) {
+    const localPath = resolve6(cwd, `.pourkit/managed/docs/agents/${docName}`);
+    if (!existsSync22(localPath)) {
       failures.push({
         severity: "failure",
         kind: "missing_managed_asset",
@@ -18353,13 +19185,13 @@ async function validateWorkflowPack(cwd) {
       const packagedContent = await readPackagedTextFile(packagedPath);
       if (packagedContent !== null) {
         try {
-          const localContent = await readFile7(localPath, "utf-8");
+          const localContent = await readFile8(localPath, "utf-8");
           if (localContent !== packagedContent) {
-            const overridePath = resolve5(
+            const overridePath = resolve6(
               cwd,
               `.pourkit/overrides/docs/agents/${docName}`
             );
-            if (existsSync21(overridePath)) {
+            if (existsSync22(overridePath)) {
               warnings.push({
                 severity: "warning",
                 kind: "overridden",
@@ -18381,16 +19213,16 @@ async function validateWorkflowPack(cwd) {
     }
   }
   for (const skillName of baselineSkills) {
-    const skillDir = resolve5(cwd, `.pourkit/managed/skills/${skillName}`);
-    const skillSourcePath = resolve5(skillDir, "SKILL.md");
-    if (!existsSync21(skillDir)) {
+    const skillDir = resolve6(cwd, `.pourkit/managed/skills/${skillName}`);
+    const skillSourcePath = resolve6(skillDir, "SKILL.md");
+    if (!existsSync22(skillDir)) {
       failures.push({
         severity: "failure",
         kind: "missing_managed_asset",
         path: `.pourkit/managed/skills/${skillName}/SKILL.md`,
         message: `Missing managed skill: ${skillName}`
       });
-    } else if (!existsSync21(skillSourcePath)) {
+    } else if (!existsSync22(skillSourcePath)) {
       failures.push({
         severity: "failure",
         kind: "missing_managed_asset",
@@ -18406,13 +19238,13 @@ async function validateWorkflowPack(cwd) {
       const packagedContent = await readPackagedTextFile(packagedSkillPath);
       if (packagedContent !== null) {
         try {
-          const localContent = await readFile7(skillSourcePath, "utf-8");
+          const localContent = await readFile8(skillSourcePath, "utf-8");
           if (localContent !== packagedContent) {
-            const overridePath = resolve5(
+            const overridePath = resolve6(
               cwd,
               `.pourkit/overrides/skills/${skillName}/SKILL.md`
             );
-            if (existsSync21(overridePath)) {
+            if (existsSync22(overridePath)) {
               warnings.push({
                 severity: "warning",
                 kind: "overridden",
@@ -18434,8 +19266,8 @@ async function validateWorkflowPack(cwd) {
     }
   }
   for (const promptName of catalog.prompts) {
-    const promptPath = resolve5(cwd, `.pourkit/managed/prompts/${promptName}`);
-    if (!existsSync21(promptPath)) {
+    const promptPath = resolve6(cwd, `.pourkit/managed/prompts/${promptName}`);
+    if (!existsSync22(promptPath)) {
       failures.push({
         severity: "failure",
         kind: "missing_managed_asset",
@@ -18445,16 +19277,16 @@ async function validateWorkflowPack(cwd) {
     }
   }
   for (const skillName of baselineSkills) {
-    const projectionDir = resolve5(cwd, `.agents/skills/${skillName}`);
-    const projectionPath = resolve5(projectionDir, "SKILL.md");
-    if (!existsSync21(projectionDir)) {
+    const projectionDir = resolve6(cwd, `.agents/skills/${skillName}`);
+    const projectionPath = resolve6(projectionDir, "SKILL.md");
+    if (!existsSync22(projectionDir)) {
       warnings.push({
         severity: "warning",
         kind: "projection_stale",
         path: `.agents/skills/${skillName}/SKILL.md`,
         message: `Missing skill projection for ${skillName}. Run 'pourkit sync workflow-pack' to regenerate.`
       });
-    } else if (!existsSync21(projectionPath)) {
+    } else if (!existsSync22(projectionPath)) {
       warnings.push({
         severity: "warning",
         kind: "projection_stale",
@@ -18470,7 +19302,7 @@ async function validateWorkflowPack(cwd) {
       const packagedContent = await readPackagedTextFile(managedSourcePath);
       if (packagedContent !== null) {
         try {
-          const projectionContent = await readFile7(projectionPath, "utf-8");
+          const projectionContent = await readFile8(projectionPath, "utf-8");
           const managedSourceRelativePath = `.pourkit/managed/skills/${skillName}/SKILL.md`;
           if (projectionContent !== buildOpenCodeSkillProjectionContent(
             managedSourceRelativePath,
@@ -18491,8 +19323,8 @@ async function validateWorkflowPack(cwd) {
   for (const agentFile of listPackagedOpenCodeAgentFiles()) {
     const fileName = basename(agentFile);
     const relativePath = `.opencode/agents/${fileName}`;
-    const localPath = resolve5(cwd, relativePath);
-    if (!existsSync21(localPath)) {
+    const localPath = resolve6(cwd, relativePath);
+    if (!existsSync22(localPath)) {
       failures.push({
         severity: "failure",
         kind: "missing_managed_asset",
@@ -18507,7 +19339,7 @@ async function validateWorkflowPack(cwd) {
     const packagedContent = await readPackagedTextFile(agentFile);
     if (packagedContent === null) continue;
     try {
-      const localContent = await readFile7(localPath, "utf-8");
+      const localContent = await readFile8(localPath, "utf-8");
       if (localContent !== packagedContent) {
         failures.push({
           severity: "failure",
@@ -18519,10 +19351,10 @@ async function validateWorkflowPack(cwd) {
     } catch {
     }
   }
-  const agentsPath = resolve5(cwd, "AGENTS.md");
-  if (existsSync21(agentsPath)) {
+  const agentsPath = resolve6(cwd, "AGENTS.md");
+  if (existsSync22(agentsPath)) {
     try {
-      const agentsContent = await readFile7(agentsPath, "utf-8");
+      const agentsContent = await readFile8(agentsPath, "utf-8");
       if (agentsContent.includes(OLD_DOCS_PATH_PATTERN)) {
         failures.push({
           severity: "failure",
@@ -18542,8 +19374,8 @@ async function validateWorkflowPack(cwd) {
     } catch {
     }
   }
-  const overridesDir = resolve5(cwd, ".pourkit/overrides");
-  if (existsSync21(overridesDir)) {
+  const overridesDir = resolve6(cwd, ".pourkit/overrides");
+  if (existsSync22(overridesDir)) {
     const overrideFiles = await walkDir2(overridesDir);
     for (const file of overrideFiles) {
       const relPath = relative4(cwd, file);
@@ -18557,19 +19389,19 @@ async function validateWorkflowPack(cwd) {
       }
     }
   }
-  const configPath = resolve5(cwd, ".pourkit/config.json");
-  if (existsSync21(configPath)) {
+  const configPath = resolve6(cwd, ".pourkit/config.json");
+  if (existsSync22(configPath)) {
     try {
-      const configContent = await readFile7(configPath, "utf-8");
+      const configContent = await readFile8(configPath, "utf-8");
       const parsed = JSON.parse(configContent);
       const releaseEnabled = parsed.releaseWorkflow?.enabled === true;
       if (releaseEnabled) {
         for (const skillName of catalog.releaseAddonSkills) {
-          const addonDir = resolve5(
+          const addonDir = resolve6(
             cwd,
             `.pourkit/managed/addons/release/skills/${skillName}`
           );
-          if (!existsSync21(addonDir)) {
+          if (!existsSync22(addonDir)) {
             failures.push({
               severity: "failure",
               kind: "release_config_conflict",
@@ -18579,11 +19411,11 @@ async function validateWorkflowPack(cwd) {
           }
         }
         for (const docName of catalog.releaseAddonDocs) {
-          const addonDocPath = resolve5(
+          const addonDocPath = resolve6(
             cwd,
             `.pourkit/managed/addons/release/docs/agents/${docName}`
           );
-          if (!existsSync21(addonDocPath)) {
+          if (!existsSync22(addonDocPath)) {
             failures.push({
               severity: "failure",
               kind: "release_config_conflict",
@@ -18595,7 +19427,7 @@ async function validateWorkflowPack(cwd) {
               resolvePackagedReleaseAddonDocPath(docName)
             );
             if (packagedContent !== null) {
-              const localContent = await readFile7(addonDocPath, "utf-8");
+              const localContent = await readFile8(addonDocPath, "utf-8");
               if (localContent !== packagedContent) {
                 failures.push({
                   severity: "failure",
@@ -18624,11 +19456,11 @@ async function validateWorkflowPack(cwd) {
         }
       } else {
         for (const skillName of catalog.releaseAddonSkills) {
-          const addonDir = resolve5(
+          const addonDir = resolve6(
             cwd,
             `.pourkit/managed/addons/release/skills/${skillName}`
           );
-          if (existsSync21(addonDir)) {
+          if (existsSync22(addonDir)) {
             failures.push({
               severity: "failure",
               kind: "release_config_conflict",
@@ -18638,11 +19470,11 @@ async function validateWorkflowPack(cwd) {
           }
         }
         for (const docName of catalog.releaseAddonDocs) {
-          const addonDocPath = resolve5(
+          const addonDocPath = resolve6(
             cwd,
             `.pourkit/managed/addons/release/docs/agents/${docName}`
           );
-          if (existsSync21(addonDocPath)) {
+          if (existsSync22(addonDocPath)) {
             failures.push({
               severity: "failure",
               kind: "release_config_conflict",
@@ -18655,16 +19487,16 @@ async function validateWorkflowPack(cwd) {
     } catch {
     }
   }
-  const manifestPath = resolve5(cwd, ".pourkit/manifest.json");
-  if (existsSync21(manifestPath)) {
+  const manifestPath = resolve6(cwd, ".pourkit/manifest.json");
+  if (existsSync22(manifestPath)) {
     try {
-      const manifestContent = await readFile7(manifestPath, "utf-8");
+      const manifestContent = await readFile8(manifestPath, "utf-8");
       const manifest = JSON.parse(manifestContent);
       const wp = manifest.workflowPack;
       if (wp?.projections) {
         for (const proj of wp.projections) {
           if (proj.path) {
-            const resolved = resolve5(cwd, proj.path);
+            const resolved = resolve6(cwd, proj.path);
             if (!isPathContained(cwd, resolved)) {
               failures.push({
                 severity: "failure",
@@ -18678,8 +19510,8 @@ async function validateWorkflowPack(cwd) {
     } catch {
     }
   }
-  const pathEscapeOverrideDir = resolve5(cwd, ".pourkit/overrides");
-  if (existsSync21(pathEscapeOverrideDir)) {
+  const pathEscapeOverrideDir = resolve6(cwd, ".pourkit/overrides");
+  if (existsSync22(pathEscapeOverrideDir)) {
     const overrideFiles = await walkDir2(pathEscapeOverrideDir);
     for (const file of overrideFiles) {
       if (!isPathContained(cwd, file)) {
@@ -18692,13 +19524,13 @@ async function validateWorkflowPack(cwd) {
       }
     }
   }
-  const managedDocsDir = resolve5(cwd, ".pourkit/managed/docs/agents");
-  if (existsSync21(managedDocsDir)) {
+  const managedDocsDir = resolve6(cwd, ".pourkit/managed/docs/agents");
+  if (existsSync22(managedDocsDir)) {
     const docFiles = await walkDir2(managedDocsDir);
     for (const file of docFiles) {
       if (!file.endsWith(".md")) continue;
       try {
-        const content = await readFile7(file, "utf-8");
+        const content = await readFile8(file, "utf-8");
         const relPath = relative4(cwd, file);
         const violations = scanManagedPolicyText(content, relPath);
         for (const v of violations) {
@@ -18713,15 +19545,15 @@ async function validateWorkflowPack(cwd) {
       }
     }
   }
-  const managedSkillsDir = resolve5(cwd, ".pourkit/managed/skills");
-  if (existsSync21(managedSkillsDir)) {
+  const managedSkillsDir = resolve6(cwd, ".pourkit/managed/skills");
+  if (existsSync22(managedSkillsDir)) {
     const skillDirs = await readdir4(managedSkillsDir, { withFileTypes: true });
     for (const entry of skillDirs) {
       if (!entry.isDirectory()) continue;
-      const skillFile = resolve5(managedSkillsDir, entry.name, "SKILL.md");
-      if (!existsSync21(skillFile)) continue;
+      const skillFile = resolve6(managedSkillsDir, entry.name, "SKILL.md");
+      if (!existsSync22(skillFile)) continue;
       try {
-        const content = await readFile7(skillFile, "utf-8");
+        const content = await readFile8(skillFile, "utf-8");
         const relPath = relative4(cwd, skillFile);
         const violations = scanManagedPolicyText(content, relPath);
         for (const v of violations) {
@@ -18736,13 +19568,13 @@ async function validateWorkflowPack(cwd) {
       }
     }
   }
-  const managedPromptsDir = resolve5(cwd, ".pourkit/managed/prompts");
-  if (existsSync21(managedPromptsDir)) {
+  const managedPromptsDir = resolve6(cwd, ".pourkit/managed/prompts");
+  if (existsSync22(managedPromptsDir)) {
     for (const promptName of catalog.prompts) {
-      const promptFile = resolve5(managedPromptsDir, promptName);
-      if (!existsSync21(promptFile)) continue;
+      const promptFile = resolve6(managedPromptsDir, promptName);
+      if (!existsSync22(promptFile)) continue;
       try {
-        const content = await readFile7(promptFile, "utf-8");
+        const content = await readFile8(promptFile, "utf-8");
         const relPath = relative4(cwd, promptFile);
         const violations = scanManagedPolicyText(content, relPath);
         for (const v of violations) {
@@ -18758,13 +19590,13 @@ async function validateWorkflowPack(cwd) {
     }
   }
   for (const skillName of catalog.releaseAddonSkills) {
-    const addonSkillFile = resolve5(
+    const addonSkillFile = resolve6(
       cwd,
       `.pourkit/managed/addons/release/skills/${skillName}/SKILL.md`
     );
-    if (!existsSync21(addonSkillFile)) continue;
+    if (!existsSync22(addonSkillFile)) continue;
     try {
-      const content = await readFile7(addonSkillFile, "utf-8");
+      const content = await readFile8(addonSkillFile, "utf-8");
       const relPath = relative4(cwd, addonSkillFile);
       const violations = scanManagedPolicyText(content, relPath);
       for (const v of violations) {
@@ -18779,13 +19611,13 @@ async function validateWorkflowPack(cwd) {
     }
   }
   for (const docName of catalog.releaseAddonDocs) {
-    const addonDocFile = resolve5(
+    const addonDocFile = resolve6(
       cwd,
       `.pourkit/managed/addons/release/docs/agents/${docName}`
     );
-    if (!existsSync21(addonDocFile)) continue;
+    if (!existsSync22(addonDocFile)) continue;
     try {
-      const content = await readFile7(addonDocFile, "utf-8");
+      const content = await readFile8(addonDocFile, "utf-8");
       const relPath = relative4(cwd, addonDocFile);
       const violations = scanManagedPolicyText(content, relPath);
       for (const v of violations) {
@@ -18816,16 +19648,16 @@ async function validateMemoryHealth(cwd, memoryConfig) {
     ok: icmPath !== null,
     detail: icmPath !== null ? icmPath : "icm not found on PATH"
   });
-  const gitignorePath = resolve5(cwd, ".gitignore");
-  const gitignoreContent = existsSync21(gitignorePath) ? readFileSync20(gitignorePath, "utf-8") : "";
+  const gitignorePath = resolve6(cwd, ".gitignore");
+  const gitignoreContent = existsSync22(gitignorePath) ? readFileSync21(gitignorePath, "utf-8") : "";
   const hasGitignoreEntry = gitignoreContent.includes(".pourkit/icm/");
   checks.push({
     name: "icm-gitignore",
     ok: hasGitignoreEntry,
     detail: hasGitignoreEntry ? ".gitignore covers .pourkit/icm/" : ".gitignore does not cover .pourkit/icm/"
   });
-  const memoryDbPath = resolve5(cwd, ".pourkit", "icm", "memories.db");
-  const hasMemoryDb = existsSync21(memoryDbPath);
+  const memoryDbPath = resolve6(cwd, ".pourkit", "icm", "memories.db");
+  const hasMemoryDb = existsSync22(memoryDbPath);
   checks.push({
     name: "icm-db-exists",
     ok: hasMemoryDb,
@@ -18838,9 +19670,9 @@ async function validateMemoryHealth(cwd, memoryConfig) {
     detail: shapeValid ? "memory: { enabled: true, provider: icm }" : `invalid memory config: enabled=${memoryConfig.enabled}, provider=${memoryConfig.provider}`
   });
   const staleAgentFiles = ["AGENTS.md", "CLAUDE.md"].filter((fileName) => {
-    const filePath = resolve5(cwd, fileName);
-    if (!existsSync21(filePath)) return false;
-    const content = readFileSync20(filePath, "utf-8");
+    const filePath = resolve6(cwd, fileName);
+    if (!existsSync22(filePath)) return false;
+    const content = readFileSync21(filePath, "utf-8");
     const managedBlock = extractManagedBlockContent(content);
     return managedBlock !== null && hasBareIcmMemoryCommand(managedBlock);
   });
@@ -18874,10 +19706,10 @@ function extractManagedBlockContent(content) {
 async function runDoctorCommand(options) {
   const repoRootPath = options.cwd ?? process.cwd();
   const schemaDir = localSchemaDir(repoRootPath);
-  const localSchemaPath = resolve5(schemaDir, "pourkit.schema.json");
-  const localHashPath = resolve5(schemaDir, "pourkit.schema.hash");
-  const localSchemaExists = existsSync21(localSchemaPath);
-  const localHashExists = existsSync21(localHashPath);
+  const localSchemaPath = resolve6(schemaDir, "pourkit.schema.json");
+  const localHashPath = resolve6(schemaDir, "pourkit.schema.hash");
+  const localSchemaExists = existsSync22(localSchemaPath);
+  const localHashExists = existsSync22(localHashPath);
   let packagedHash = null;
   try {
     packagedHash = readPackagedHash();
@@ -18886,19 +19718,20 @@ async function runDoctorCommand(options) {
   let localHashContent = null;
   if (localHashExists) {
     try {
-      localHashContent = await readFile7(localHashPath, "utf-8");
+      localHashContent = await readFile8(localHashPath, "utf-8");
     } catch {
     }
   }
   const schema = !localSchemaExists ? "missing" : !packagedHash || !localHashContent ? "missing" : localHashContent.trim() === packagedHash.trim() ? "fresh" : "stale";
   const hash = !localHashExists ? "missing" : !packagedHash ? "missing" : localHashContent && localHashContent.trim() === packagedHash.trim() ? "fresh" : "stale";
   const overall = schema === "fresh" && hash === "fresh" ? "fresh" : schema === "missing" || hash === "missing" ? "missing" : "stale";
-  const configPath = resolve5(repoRootPath, ".pourkit/config.json");
+  const configPath = resolve6(repoRootPath, ".pourkit/config.json");
   let configValidation;
   let rawMemoryConfig;
-  if (existsSync21(configPath)) {
+  let configMigration;
+  if (existsSync22(configPath)) {
     try {
-      const raw = JSON.parse(readFileSync20(configPath, "utf-8"));
+      const raw = JSON.parse(readFileSync21(configPath, "utf-8"));
       rawMemoryConfig = raw.memory;
       const validate = getSchemaValidator();
       const valid2 = validate(raw);
@@ -18913,25 +19746,47 @@ async function runDoctorCommand(options) {
           )
         };
       }
+      const plan = planConfigMigration(raw);
+      configMigration = {
+        available: plan.available,
+        safe: plan.safe,
+        command: plan.command,
+        plannedChanges: plan.plannedChanges,
+        blockers: plan.blockers
+      };
     } catch (err) {
       const msg = err instanceof SyntaxError ? err.message : String(err);
       configValidation = {
         ok: false,
         errors: [`.pourkit/config.json: ${msg}`]
       };
+      configMigration = {
+        available: false,
+        safe: false,
+        command: null,
+        plannedChanges: [],
+        blockers: [`.pourkit/config.json: ${msg}`]
+      };
     }
   } else {
     configValidation = {
       ok: false,
       errors: [".pourkit/config.json not found"]
     };
+    configMigration = {
+      available: false,
+      safe: false,
+      command: null,
+      plannedChanges: [],
+      blockers: [".pourkit/config.json not found"]
+    };
   }
   const obsoleteConfigs = [
     "pourkit.config.ts",
     "pourkit.config.mjs",
     "pourkit.config.js",
     "pourkit.json"
-  ].filter((p) => existsSync21(resolve5(repoRootPath, p)));
+  ].filter((p) => existsSync22(resolve6(repoRootPath, p)));
   const workflowPack = await validateWorkflowPack(repoRootPath);
   const memory = await validateMemoryHealth(repoRootPath, rawMemoryConfig);
   let recommendation = null;
@@ -18941,7 +19796,15 @@ async function runDoctorCommand(options) {
       `Found obsolete config files: ${obsoleteConfigs.join(", ")}. Move configuration to .pourkit/config.json with "$schema": "./schema/pourkit.schema.json".`
     );
   }
-  if (!configValidation.ok) {
+  if (configMigration.available && configMigration.safe) {
+    recParts.push(
+      'A safe config migration is available. Run "pourkit config migrate" to apply it.'
+    );
+  } else if (!configMigration.available && configMigration.blockers.length > 0) {
+    recParts.push(
+      "Config migration is blocked; fix errors in .pourkit/config.json."
+    );
+  } else if (!configValidation.ok) {
     recParts.push(
       "Config validation failed; fix errors in .pourkit/config.json."
     );
@@ -18966,6 +19829,7 @@ async function runDoctorCommand(options) {
     configValidation,
     obsoleteConfigs,
     schemaAssets: { schema, hash, overall },
+    configMigration,
     workflowPack,
     memory,
     recommendation
@@ -18975,30 +19839,30 @@ async function runConfigSyncSchemaCommand(options) {
   const repoRootPath = options.cwd ?? process.cwd();
   const schemaDir = localSchemaDir(repoRootPath);
   await mkdir6(schemaDir, { recursive: true });
-  const packagedSchema = await readFile7(PACKAGED_SCHEMA_PATH, "utf-8");
-  const packagedHash = await readFile7(PACKAGED_HASH_PATH, "utf-8");
-  const localSchemaPath = resolve5(schemaDir, "pourkit.schema.json");
-  const localHashPath = resolve5(schemaDir, "pourkit.schema.hash");
+  const packagedSchema = await readFile8(PACKAGED_SCHEMA_PATH2, "utf-8");
+  const packagedHash = await readFile8(PACKAGED_HASH_PATH, "utf-8");
+  const localSchemaPath = resolve6(schemaDir, "pourkit.schema.json");
+  const localHashPath = resolve6(schemaDir, "pourkit.schema.hash");
   let schemaWritten = false;
   let hashWritten = false;
-  if (existsSync21(localSchemaPath)) {
-    const existing = await readFile7(localSchemaPath, "utf-8");
+  if (existsSync22(localSchemaPath)) {
+    const existing = await readFile8(localSchemaPath, "utf-8");
     if (existing !== packagedSchema) {
-      await writeFile3(localSchemaPath, packagedSchema, "utf-8");
+      await writeFile4(localSchemaPath, packagedSchema, "utf-8");
       schemaWritten = true;
     }
   } else {
-    await writeFile3(localSchemaPath, packagedSchema, "utf-8");
+    await writeFile4(localSchemaPath, packagedSchema, "utf-8");
     schemaWritten = true;
   }
-  if (existsSync21(localHashPath)) {
-    const existing = await readFile7(localHashPath, "utf-8");
+  if (existsSync22(localHashPath)) {
+    const existing = await readFile8(localHashPath, "utf-8");
     if (existing !== packagedHash) {
-      await writeFile3(localHashPath, packagedHash, "utf-8");
+      await writeFile4(localHashPath, packagedHash, "utf-8");
       hashWritten = true;
     }
   } else {
-    await writeFile3(localHashPath, packagedHash, "utf-8");
+    await writeFile4(localHashPath, packagedHash, "utf-8");
     hashWritten = true;
   }
   return {
@@ -19009,13 +19873,13 @@ async function runConfigSyncSchemaCommand(options) {
 }
 
 // commands/workflow-pack-sync.ts
-import { existsSync as existsSync22, readdirSync as readdirSync6 } from "fs";
-import { mkdir as mkdir7, readFile as readFile8, writeFile as writeFile4, readdir as readdir5 } from "fs/promises";
+import { existsSync as existsSync23, readdirSync as readdirSync6 } from "fs";
+import { mkdir as mkdir7, readFile as readFile9, writeFile as writeFile5, readdir as readdir5 } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
-import { resolve as resolve6, dirname as dirname7, relative as relative5, normalize as normalize2, basename as basename2 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-var __filename4 = fileURLToPath4(import.meta.url);
-var __dirname4 = dirname7(__filename4);
+import { resolve as resolve7, dirname as dirname8, relative as relative5, normalize as normalize2, basename as basename2 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+var __filename5 = fileURLToPath5(import.meta.url);
+var __dirname5 = dirname8(__filename5);
 var PROJECT_OWNED_PATHS = [".pourkit/CONTEXT.md", ".pourkit/CONTEXT-MAP.md"];
 var PROJECT_OWNED_DIRECTORIES = [
   ".pourkit/docs/adr",
@@ -19024,23 +19888,23 @@ var PROJECT_OWNED_DIRECTORIES = [
 ];
 var OVERRIDES_DIR = ".pourkit/overrides";
 function resolvePackagedManagedPath2(...segments) {
-  const bundledPath = resolve6(__dirname4, "managed", ...segments);
-  const sourcePath = resolve6(__dirname4, "..", "managed", ...segments);
+  const bundledPath = resolve7(__dirname5, "managed", ...segments);
+  const sourcePath = resolve7(__dirname5, "..", "managed", ...segments);
   const candidates = [bundledPath, sourcePath];
-  return candidates.find((candidate) => existsSync22(candidate)) ?? bundledPath;
+  return candidates.find((candidate) => existsSync23(candidate)) ?? bundledPath;
 }
 function resolvePackagedOpenCodeAgentsDir2() {
   const candidates = [
-    resolve6(__dirname4, ".opencode", "agents"),
-    resolve6(__dirname4, "..", ".opencode", "agents"),
-    resolve6(__dirname4, "..", "..", ".opencode", "agents")
+    resolve7(__dirname5, ".opencode", "agents"),
+    resolve7(__dirname5, "..", ".opencode", "agents"),
+    resolve7(__dirname5, "..", "..", ".opencode", "agents")
   ];
-  return candidates.find((candidate) => existsSync22(candidate)) ?? candidates[0];
+  return candidates.find((candidate) => existsSync23(candidate)) ?? candidates[0];
 }
 function listPackagedOpenCodeAgentFiles2() {
   const agentsDir = resolvePackagedOpenCodeAgentsDir2();
   try {
-    return readdirSync6(agentsDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => resolve6(agentsDir, entry.name));
+    return readdirSync6(agentsDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => resolve7(agentsDir, entry.name));
   } catch {
     return [];
   }
@@ -19074,7 +19938,7 @@ function resolvePackagedManagedPromptPath(promptName) {
 }
 async function readPackagedTextFile2(filePath) {
   try {
-    return await readFile8(filePath, "utf-8");
+    return await readFile9(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -19133,7 +19997,7 @@ async function walkDir3(dir) {
   try {
     const entries = await readdir5(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = resolve6(dir, entry.name);
+      const full = resolve7(dir, entry.name);
       if (entry.isDirectory()) {
         files.push(...await walkDir3(full));
       } else {
@@ -19151,20 +20015,20 @@ async function syncFile(cwd, targetRelativePath, sourceContent, errors) {
   if (sourceContent === null) {
     return false;
   }
-  const targetPath = resolve6(cwd, targetRelativePath);
+  const targetPath = resolve7(cwd, targetRelativePath);
   const escapeError = checkForPathEscape(cwd, targetPath);
   if (escapeError) {
     errors.push(escapeError);
     return false;
   }
-  await mkdir7(resolve6(targetPath, ".."), { recursive: true });
-  if (existsSync22(targetPath)) {
-    const existing = await readFile8(targetPath, "utf-8");
+  await mkdir7(resolve7(targetPath, ".."), { recursive: true });
+  if (existsSync23(targetPath)) {
+    const existing = await readFile9(targetPath, "utf-8");
     if (existing === sourceContent) {
       return false;
     }
   }
-  await writeFile4(targetPath, sourceContent, "utf-8");
+  await writeFile5(targetPath, sourceContent, "utf-8");
   return true;
 }
 function walkDirSync(dir) {
@@ -19172,7 +20036,7 @@ function walkDirSync(dir) {
   try {
     const entries = readdirSync6(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = resolve6(dir, entry.name);
+      const full = resolve7(dir, entry.name);
       if (entry.isDirectory()) {
         result.push(...walkDirSync(full));
       } else {
@@ -19184,8 +20048,8 @@ function walkDirSync(dir) {
   return result;
 }
 async function detectOverrides(cwd) {
-  const overridesDir = resolve6(cwd, OVERRIDES_DIR);
-  if (!existsSync22(overridesDir)) {
+  const overridesDir = resolve7(cwd, OVERRIDES_DIR);
+  if (!existsSync23(overridesDir)) {
     return [];
   }
   const files = await walkDir3(overridesDir);
@@ -19194,14 +20058,14 @@ async function detectOverrides(cwd) {
 async function detectProjectOwnedFiles(cwd) {
   const found = [];
   for (const ownedPath of PROJECT_OWNED_PATHS) {
-    const fullPath = resolve6(cwd, ownedPath);
-    if (existsSync22(fullPath)) {
+    const fullPath = resolve7(cwd, ownedPath);
+    if (existsSync23(fullPath)) {
       found.push(ownedPath);
     }
   }
   for (const ownedDir of PROJECT_OWNED_DIRECTORIES) {
-    const fullDir = resolve6(cwd, ownedDir);
-    if (existsSync22(fullDir)) {
+    const fullDir = resolve7(cwd, ownedDir);
+    if (existsSync23(fullDir)) {
       const files = await walkDir3(fullDir);
       for (const file of files) {
         found.push(relative5(cwd, file));
@@ -19212,14 +20076,35 @@ async function detectProjectOwnedFiles(cwd) {
 }
 async function isReleaseWorkflowEnabled(cwd) {
   try {
-    const configPath = resolve6(cwd, ".pourkit", "config.json");
-    const content = await readFile8(configPath, "utf-8");
+    const configPath = resolve7(cwd, ".pourkit", "config.json");
+    const content = await readFile9(configPath, "utf-8");
     const parsed = JSON.parse(content);
     return parsed.releaseWorkflow?.enabled === true;
   } catch {
     return false;
   }
 }
+async function readConfiguredMemory(cwd) {
+  const configPath = resolve7(cwd, ".pourkit", "config.json");
+  try {
+    const config = await loadConfig(configPath);
+    if (config.memory?.enabled === true && config.memory?.provider === "icm") {
+      return config.memory;
+    }
+  } catch {
+  }
+  try {
+    const content = await readFile9(configPath, "utf-8");
+    const parsed = JSON.parse(content);
+    const memory = parsed.memory;
+    if (typeof memory === "object" && memory !== null && !Array.isArray(memory) && memory.enabled === true && memory.provider === "icm") {
+      return { enabled: true, provider: "icm" };
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
 async function runWorkflowPackSyncCommand(options) {
   const cwd = options.cwd ?? process.cwd();
   const catalog = getWorkflowPackCatalog();
@@ -19228,10 +20113,10 @@ async function runWorkflowPackSyncCommand(options) {
   const skippedProjectOwned = [];
   const overrides = [];
   const errors = [];
-  const manifestPath = resolve6(cwd, ".pourkit", "manifest.json");
+  const manifestPath = resolve7(cwd, ".pourkit", "manifest.json");
   let manifestReadFailed = false;
   let manifest = {};
-  const existingRawManifest = await readFile8(manifestPath, "utf-8").catch(
+  const existingRawManifest = await readFile9(manifestPath, "utf-8").catch(
     () => null
   );
   if (existingRawManifest) {
@@ -19361,28 +20246,20 @@ async function runWorkflowPackSyncCommand(options) {
     });
   }
   const schemaResult = await runConfigSyncSchemaCommand({ cwd });
-  let configMemory;
-  try {
-    const configPath = resolve6(cwd, ".pourkit", "config.json");
-    const config = await loadConfig(configPath);
-    if (config.memory?.enabled === true && config.memory?.provider === "icm") {
-      configMemory = config.memory;
-    }
-  } catch {
-  }
+  const configMemory = await readConfiguredMemory(cwd);
   const managedBlockContent = generateManagedBlockContent(configMemory);
   const fullManagedBlock = buildManagedBlock(managedBlockContent);
   async function syncManagedAgentFile(fileName, options2) {
-    const filePath = resolve6(cwd, fileName);
-    if (!existsSync22(filePath)) {
+    const filePath = resolve7(cwd, fileName);
+    if (!existsSync23(filePath)) {
       if (!options2.createIfMissing) return false;
-      await writeFile4(filePath, fullManagedBlock, "utf-8");
+      await writeFile5(filePath, fullManagedBlock, "utf-8");
       return true;
     }
-    const existing = await readFile8(filePath, "utf-8");
+    const existing = await readFile9(filePath, "utf-8");
     const newContent = upsertManagedBlock(existing, managedBlockContent);
     if (newContent !== existing) {
-      await writeFile4(filePath, newContent, "utf-8");
+      await writeFile5(filePath, newContent, "utf-8");
       return true;
     }
     return false;
@@ -19417,8 +20294,8 @@ async function runWorkflowPackSyncCommand(options) {
       errors.push("Failed to write manifest metadata");
     } else {
       try {
-        await mkdir7(resolve6(manifestPath, ".."), { recursive: true });
-        await writeFile4(
+        await mkdir7(resolve7(manifestPath, ".."), { recursive: true });
+        await writeFile5(
           manifestPath,
           JSON.stringify(manifest, null, 2) + "\n",
           "utf-8"
@@ -19458,7 +20335,7 @@ async function syncOpenCodeAgentFile(sourceFile, acc, ctx, manifestState) {
   const sourceContent = await readPackagedTextFile2(sourceFile);
   const fileName = basename2(sourceFile);
   const targetRelativePath = `.opencode/agents/${fileName}`;
-  const targetPath = resolve6(cwd, targetRelativePath);
+  const targetPath = resolve7(cwd, targetRelativePath);
   const escapeError = checkForPathEscape(cwd, targetPath);
   if (escapeError) {
     errors.push(escapeError);
@@ -19472,14 +20349,14 @@ async function syncOpenCodeAgentFile(sourceFile, acc, ctx, manifestState) {
     ownership: "managed",
     sha256: sha256Text(sourceContent)
   };
-  if (!existsSync22(targetPath)) {
-    await mkdir7(resolve6(targetPath, ".."), { recursive: true });
-    await writeFile4(targetPath, sourceContent, "utf-8");
+  if (!existsSync23(targetPath)) {
+    await mkdir7(resolve7(targetPath, ".."), { recursive: true });
+    await writeFile5(targetPath, sourceContent, "utf-8");
     updated.push(targetRelativePath);
     manifestState.manifestAssetUpdates[targetRelativePath] = nextAsset;
     return;
   }
-  const existingContent = await readFile8(targetPath, "utf-8");
+  const existingContent = await readFile9(targetPath, "utf-8");
   const existingAsset = manifestState.existingManifestAssets[targetRelativePath];
   const isManifestManaged = existingAsset?.ownership === "managed";
   if (existingContent === sourceContent) {
@@ -19492,7 +20369,7 @@ async function syncOpenCodeAgentFile(sourceFile, acc, ctx, manifestState) {
     }
     return;
   }
-  await writeFile4(targetPath, sourceContent, "utf-8");
+  await writeFile5(targetPath, sourceContent, "utf-8");
   updated.push(targetRelativePath);
   manifestState.manifestAssetUpdates[targetRelativePath] = nextAsset;
 }
@@ -20286,22 +21163,22 @@ function formatChecks2(checks) {
 init_common();
 
 // execution/sandcastle-execution.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync9, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync9, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join28 } from "path";
 import { createWorktree, opencode } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
 
 // execution/execution-provider.ts
 init_common();
 import { mkdtempSync } from "fs";
-import { writeFile as writeFile5 } from "fs/promises";
+import { writeFile as writeFile6 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname8, join as join25 } from "path";
+import { dirname as dirname9, join as join26 } from "path";
 async function writeExecutionArtifacts(worktreePath, artifacts) {
   for (const artifact of artifacts) {
-    const filePath = join25(worktreePath, artifact.path);
-    await ensureDir(dirname8(filePath));
-    await writeFile5(filePath, artifact.content, "utf-8");
+    const filePath = join26(worktreePath, artifact.path);
+    await ensureDir(dirname9(filePath));
+    await writeFile6(filePath, artifact.content, "utf-8");
   }
 }
 
@@ -20314,18 +21191,18 @@ import path7 from "path";
 
 // execution/sandbox-image.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync23, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync22 } from "fs";
 import path6 from "path";
 function sandboxImageName(repoRoot2, installIcm) {
   const dirName = path6.basename(repoRoot2.replace(/[\\/]+$/, "")) || "local";
   const sanitized = dirName.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
   const baseName = sanitized || "local";
   const dockerfilePath = path6.join(repoRoot2, ".sandcastle", "Dockerfile");
-  if (!existsSync23(dockerfilePath)) {
+  if (!existsSync24(dockerfilePath)) {
     const base2 = `sandcastle:${baseName}`;
     return installIcm ? `${base2}-icm` : base2;
   }
-  const fingerprint = createHash3("sha256").update(readFileSync21(dockerfilePath)).digest("hex").slice(0, 8);
+  const fingerprint = createHash3("sha256").update(readFileSync22(dockerfilePath)).digest("hex").slice(0, 8);
   const base = `sandcastle:${baseName}-${fingerprint}`;
   return installIcm ? `${base}-icm` : base;
 }
@@ -20361,7 +21238,7 @@ async function createSandboxFromExistingWorktree(options) {
 }
 
 // execution/sandbox-options.ts
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var POURKIT_ICM_CONTAINER_DIR = "/home/agent/.pourkit/icm";
 function buildSandboxOptions(repoRoot2, sandbox, memory) {
   const mounts = [];
@@ -20370,12 +21247,12 @@ function buildSandboxOptions(repoRoot2, sandbox, memory) {
   }
   if (memory?.available) {
     mounts.push({
-      hostPath: join26(repoRoot2, ".pourkit", "icm"),
+      hostPath: join27(repoRoot2, ".pourkit", "icm"),
       sandboxPath: POURKIT_ICM_CONTAINER_DIR,
       readonly: false
     });
     mounts.push({
-      hostPath: join26(repoRoot2, ".pourkit", "icm", "cache"),
+      hostPath: join27(repoRoot2, ".pourkit", "icm", "cache"),
       sandboxPath: "/home/agent/.cache/icm",
       readonly: false
     });
@@ -20509,13 +21386,13 @@ var SandcastleExecutionSession = class {
             "Memory enabled but memory context is invalid. Run `pourkit memory init` or install ICM for host planning use."
           );
         }
-        const hostMemoryDir = join27(repoRoot2, ".pourkit", "icm");
-        if (!existsSync24(hostMemoryDir) || !statSync2(hostMemoryDir).isDirectory()) {
+        const hostMemoryDir = join28(repoRoot2, ".pourkit", "icm");
+        if (!existsSync25(hostMemoryDir) || !statSync2(hostMemoryDir).isDirectory()) {
           throw new MissingHostMemoryDirError(
             "Memory enabled but host .pourkit/icm/ directory is missing. Run `pourkit memory init` to create the repo-scoped memory store."
           );
         }
-        mkdirSync9(join27(hostMemoryDir, "cache"), { recursive: true });
+        mkdirSync9(join28(hostMemoryDir, "cache"), { recursive: true });
       }
       const sandboxOptions = buildSandboxOptions(
         repoRoot2,
@@ -20674,8 +21551,8 @@ function sanitizeBranch(branchName) {
 }
 function safeCopyToWorktreePaths(paths, repoRoot2, worktreePath) {
   return paths.filter((relativePath) => {
-    const source = join27(repoRoot2, relativePath);
-    if (!existsSync24(source)) {
+    const source = join28(repoRoot2, relativePath);
+    if (!existsSync25(source)) {
       return true;
     }
     try {
@@ -20685,8 +21562,8 @@ function safeCopyToWorktreePaths(paths, repoRoot2, worktreePath) {
     } catch {
       return true;
     }
-    const destination = join27(worktreePath, relativePath);
-    return !existsSync24(destination);
+    const destination = join28(worktreePath, relativePath);
+    return !existsSync25(destination);
   });
 }
 function formatAgentStreamEvent(event) {
@@ -20750,12 +21627,12 @@ function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function savePromptToFile(repoRoot2, stage, iteration, prompt) {
-  const promptsDir = join27(repoRoot2, ".pourkit", ".tmp", "prompts");
+  const promptsDir = join28(repoRoot2, ".pourkit", ".tmp", "prompts");
   mkdirSync9(promptsDir, { recursive: true });
   const timestamp2 = Date.now();
   const iterationSuffix = iteration !== void 0 ? `-iteration-${iteration}` : "";
   const filename = `${stage}${iterationSuffix}-${timestamp2}.md`;
-  const filePath = join27(promptsDir, filename);
+  const filePath = join28(promptsDir, filename);
   writeFileSync6(filePath, prompt, "utf-8");
 }
 
@@ -21382,6 +22259,24 @@ function createCliProgram(version) {
       console.log("Schema assets are up to date.");
     }
   });
+  configCommand.command("migrate").description("Migrate config to the current schema version").option("--cwd <path>", "target repository directory").option("--dry-run", "show planned changes without writing").option("--json", "output machine-readable JSON").action(
+    async (options) => {
+      const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
+      const result = await runConfigMigrateCommand({
+        cwd: targetRepoRoot,
+        dryRun: options.dryRun ?? false,
+        json: options.json ?? false
+      });
+      if (options.json) {
+        console.log(renderConfigMigrateResultJson(result));
+      } else {
+        console.log(renderConfigMigrateResult(result));
+      }
+      if (result.status === "blocked") {
+        process.exitCode = 1;
+      }
+    }
+  );
   const syncCommand = program.command("sync").description("Sync commands for refreshing managed assets");
   syncCommand.command("workflow-pack").description("Refresh managed workflow pack assets from packaged sources").option("--cwd <path>", "target repository directory").action(async (options) => {
     const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
@@ -21539,11 +22434,11 @@ function createCliProgram(version) {
   return program;
 }
 async function resolveCliVersion() {
-  if (isPackageVersion("0.0.0-next-20260714073403")) {
-    return "0.0.0-next-20260714073403";
+  if (isPackageVersion("0.0.0-next-20260723092204")) {
+    return "0.0.0-next-20260723092204";
   }
-  if (isReleaseVersion("0.0.0-next-20260714073403")) {
-    return "0.0.0-next-20260714073403";
+  if (isReleaseVersion("0.0.0-next-20260723092204")) {
+    return "0.0.0-next-20260723092204";
   }
   try {
     const root = repoRoot();