@mutmutco/cli 4.4.16 → 4.5.0

package/dist/main.cjs

@@ -5436,7 +5436,7 @@ function resolveVerbAliasShim(argv) {
 }
 
 // src/command-composition.ts
-var import_node_os21 = require("node:os");
+var import_node_os22 = require("node:os");
 var import_node_path47 = require("node:path");
 
 // src/board-read.ts
@@ -6245,6 +6245,44 @@ function collectPullRequestWorkflowContexts(workflows) {
   }
   return [...contexts].sort((a, b) => a.localeCompare(b));
 }
+function jobNeeds(job) {
+  const lines2 = job.body.split(/\r?\n/).slice(1);
+  const at = lines2.findIndex((line) => /^\s+needs:/.test(line));
+  if (at < 0) return [];
+  const indent = lines2[at].match(/^(\s*)/)?.[1].length ?? 0;
+  const inline = lines2[at].replace(/^\s*needs:\s*/, "").replace(/#.*$/, "").trim();
+  if (inline) return inline.replace(/^\[|\]$/g, "").split(",").map(unquote).filter(Boolean);
+  const items = [];
+  for (const line of lines2.slice(at + 1)) {
+    if (!line.trim()) continue;
+    if ((line.match(/^(\s*)/)?.[1].length ?? 0) <= indent) break;
+    items.push(unquote(line.replace(/^\s*-\s*/, "")));
+  }
+  return items.filter(Boolean);
+}
+function unquote(s) {
+  return s.replace(/#.*$/, "").trim().replace(/^['"]|['"]$/g, "");
+}
+function unblockingGateJobs(workflows, required) {
+  const unblocking = /* @__PURE__ */ new Set();
+  for (const wf of workflows) {
+    if (!workflowTriggersPullRequest(wf.body)) continue;
+    const jobs = parseWorkflowJobs(wf.body);
+    const needs = new Map(jobs.map((job) => [job.id, jobNeeds(job)]));
+    const covered = /* @__PURE__ */ new Set();
+    const stack = jobs.map((job) => job.id).filter((id) => required.has(id));
+    while (stack.length) {
+      const id = stack.pop();
+      if (covered.has(id)) continue;
+      covered.add(id);
+      stack.push(...needs.get(id) ?? []);
+    }
+    for (const job of jobs) {
+      if (!covered.has(job.id) && jobReportsPullRequestCheck(job)) unblocking.add(job.id);
+    }
+  }
+  return [...unblocking].sort((a, b) => a.localeCompare(b));
+}
 function pathFilteredPullRequestWorkflows(workflows) {
   const filtered = [];
   for (const wf of workflows) {
@@ -15938,10 +15976,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.4.16",
-    tag: "v4.4.16",
-    commit: "1a7eeee13010",
-    npm: "@mutmutco/cli@4.4.16"
+    version: "4.5.0",
+    tag: "v4.5.0",
+    commit: "e9c83872b853",
+    npm: "@mutmutco/cli@4.5.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15958,14 +15996,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.4.16"
+          v3Target: "v4.5.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.4.16 and redeploy the Hub Lambda from tag v4.4.16 (1a7eeee13010); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.4.16 (@mutmutco/cli@4.4.16, tag commit 1a7eeee13010 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.0 and redeploy the Hub Lambda from tag v4.5.0 (e9c83872b853); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.0 (@mutmutco/cli@4.5.0, tag commit e9c83872b853 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18487,6 +18525,13 @@ async function awaitAlignmentLanded(deps, ctx, leg, base, opts = {}) {
     await sleep2(ALIGNMENT_LAND_POLL_MS);
   }
 }
+async function awaitAlignmentsLanded(deps, ctx, legs) {
+  const [dev, rc] = await Promise.all([
+    awaitAlignmentLanded(deps, ctx, legs.dev, "development"),
+    legs.rc ? awaitAlignmentLanded(deps, ctx, legs.rc, "rc") : void 0
+  ]);
+  return { dev, ...rc ? { rc } : {} };
+}
 async function alignRcForward(deps, ctx, tag) {
   deps.warn?.("Release: Bringing the release candidate up to date");
   await runGitRemoteRead(deps, ["fetch", "origin", "main", "rc"]);
@@ -18803,6 +18848,7 @@ function isReleaseShaDeployEnumerationCandidate(row, nonDeployEvents) {
 
 // src/train-apply-deploy.ts
 var import_node_fs19 = require("node:fs");
+var import_node_os10 = require("node:os");
 var import_node_path17 = require("node:path");
 
 // src/vercel-deployments.ts
@@ -18888,6 +18934,12 @@ async function observePublishIfRequired(deps, ctx, meta, model, stage, releaseSh
     deployStatus: aggregateWorkflowRuns(workflowRuns)
   };
 }
+async function joinDeployAndPublish(deploy, publish) {
+  const [d, p] = await Promise.all([deploy, publish]);
+  if (!p) return [d, p];
+  const mark = (x) => x.workflowRuns ? { ...x, workflowRuns: x.workflowRuns.map((r) => ({ ...r, parallel: true })) } : x;
+  return [mark(d), mark(p)];
+}
 function appendPublishDispatch(deploy, publish) {
   if (!publish) return deploy;
   return {
@@ -19052,19 +19104,29 @@ async function appendServedChannelPublish(deps, input, dispatch) {
     };
   }
   const probe = await (deps.readServedChannelVersion ?? fetchServedChannelVersion)(channelUrl);
+  const evidence = (conclusion, text) => [...runs, servedChannelRow(HUB_SERVED_PRODUCT, conclusion, text)];
+  if (!probe.ok && staleServedProcess(probe)) {
+    const redeploy = mmiGetRedeployCommand(input.repo);
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; get-publish.yml succeeded but ${channelUrl} answered HTTP ${probe.status} \u2014 STALE SERVED PROCESS: the files may be current, but the process serving them predates GET /release/version; recover with \`${redeploy}\``,
+      workflowRuns: evidence("failure", `${channelUrl} answered HTTP ${probe.status} (stale served process)`),
+      deployStatus: "failure"
+    };
+  }
   if (!probe.ok) {
     const why = probe.error ?? `HTTP ${probe.status ?? "unknown"}`;
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded but the served channel version could NOT be read at ${channelUrl} (${why}) \u2014 the move is unverified`,
-      workflowRuns: runs
+      workflowRuns: evidence("pending", `${channelUrl} unreadable (${why})`)
     };
   }
   if (expected && probe.version !== expected) {
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded but the served channel still reports ${probe.version} (expected launcher ${expected}) \u2014 THE CHANNEL DID NOT MOVE; recover with \`${remedy}\``,
-      workflowRuns: runs,
+      workflowRuns: evidence("failure", `${channelUrl} reports ${probe.version}, expected ${expected}`),
       deployStatus: "failure"
     };
   }
@@ -19072,16 +19134,107 @@ async function appendServedChannelPublish(deps, input, dispatch) {
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded and ${channelUrl} reports ${probe.version}, but the local launcher version could not be read \u2014 nothing was compared, so the move is unverified`,
-      workflowRuns: runs
+      workflowRuns: evidence("pending", `${channelUrl} reports ${probe.version}; nothing to compare against`)
     };
   }
   return {
     ...dispatch,
     note: `${dispatch.note}; served channel moved \u2014 ${channelUrl} now reports ${probe.version}`,
-    workflowRuns: runs
+    workflowRuns: evidence("success", `${channelUrl} reports ${probe.version}`)
   };
 }
+function staleServedProcess(probe) {
+  return probe.status === 401 || probe.status === 403 || probe.status === 404;
+}
+function servedChannelRow(product, conclusion, evidence) {
+  return { workflow: `served-channel(${product})`, runUrlNote: evidence, conclusion };
+}
+var JERV_GATEWAY_REMEDY = "from the Jerv-Hub checkout, re-run the Gateway deploy on its current release tag: `bash scripts/jerv-gateway-release-deploy.sh --tag <jerv-hub tag>`";
+var SERVED_CHANNELS = {
+  "mutmutco/mm-strategy": {
+    product: "mm-strategy",
+    url: "https://strategy.mutmut.work/release/version",
+    mover: "the MM-Strategy container deploy (the running server's own version is the pointer)",
+    remedy: "`mmi-cli devops runtime tenant redeploy mutmutco/MM-Strategy main`"
+  },
+  "mutmutco/jerv-hub": {
+    product: "jerv",
+    url: "https://get.jerv.ai/jerv/release/version",
+    mover: "the Jerv Gateway deploy (`jerv-gate fetch-release --product jerv`)",
+    remedy: JERV_GATEWAY_REMEDY
+  },
+  "mutmutco/jerv-jervcode": {
+    product: "jervcode",
+    url: "https://get.jerv.ai/jervcode/release/version",
+    mover: "the Jerv Gateway deploy, which fetches JervCode's latest release \u2014 a JervCode release alone does not move it",
+    remedy: JERV_GATEWAY_REMEDY
+  }
+};
+function servedChannelFor(repo) {
+  return SERVED_CHANNELS[repo.toLowerCase()];
+}
+var SERVED_CHANNEL_PROBE_ATTEMPTS = 3;
+var SERVED_CHANNEL_PROBE_BACKOFF_MS = 1e4;
+async function appendServedChannelProof(deps, input, dispatch) {
+  const channel = servedChannelFor(input.repo);
+  if (!channel) return dispatch;
+  const expected = input.tag.replace(/^v/, "");
+  const withProof = (conclusion, evidence, note, failed = false) => ({
+    ...dispatch,
+    note: `${dispatch.note}; ${note}`,
+    workflowRuns: [...dispatch.workflowRuns ?? [], servedChannelRow(channel.product, conclusion, evidence)],
+    ...failed ? { deployStatus: "failure" } : {}
+  });
+  if (!input.shipped) {
+    return withProof("pending", `${channel.url} not probed`, `served channel ${channel.url} not probed \u2014 deploy/publish are not proven green, so it is not expected to have moved`);
+  }
+  const read = deps.readServedChannelVersion ?? fetchServedChannelVersion;
+  let probe = await read(channel.url);
+  for (let attempt = 1; attempt < SERVED_CHANNEL_PROBE_ATTEMPTS && probe.ok && probe.version !== expected; attempt++) {
+    await (deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(SERVED_CHANNEL_PROBE_BACKOFF_MS * attempt);
+    probe = await read(channel.url);
+  }
+  if (!probe.ok && staleServedProcess(probe)) {
+    return withProof(
+      "failure",
+      `${channel.url} answered HTTP ${probe.status} (stale served process)`,
+      `${channel.url} answered HTTP ${probe.status} \u2014 STALE SERVED PROCESS: the process serving ${channel.product} predates GET /release/version; it moves with ${channel.mover}; recover with ${channel.remedy}`,
+      true
+    );
+  }
+  if (!probe.ok) {
+    const why = probe.error ?? `HTTP ${probe.status ?? "unknown"}`;
+    return withProof("pending", `${channel.url} unreadable (${why})`, `served channel ${channel.url} could NOT be read (${why}) \u2014 the move is unverified`);
+  }
+  if (probe.version !== expected) {
+    return withProof(
+      "failure",
+      `${channel.url} reports ${probe.version}, expected ${expected}`,
+      `served channel ${channel.url} still reports ${probe.version} (expected ${expected}) \u2014 THE CHANNEL DID NOT MOVE: new installs get ${probe.version}; it moves with ${channel.mover}; recover with ${channel.remedy}`,
+      true
+    );
+  }
+  return withProof("success", `${channel.url} reports ${probe.version}`, `served channel moved \u2014 ${channel.url} reports ${probe.version}`);
+}
 var JERV_GATEWAY_RUN_URL_NOTE = "no run URL emitted \u2014 host health leg runs outside GitHub Actions";
+var JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT = "scripts/jerv-gateway-release-deploy.sh";
+async function runTaggedJervGatewayLocalWrapper(deps, tag, tagSha) {
+  let script;
+  try {
+    script = await deps.run("git", ["show", `${tagSha}:${JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT}`]);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`could not extract ${JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT} from tagged commit ${tagSha.slice(0, 12)}: ${reason}`);
+  }
+  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path17.join)((0, import_node_os10.tmpdir)(), "jerv-gateway-release-deploy-"));
+  const extracted = (0, import_node_path17.join)(dir, "jerv-gateway-release-deploy.sh");
+  try {
+    (0, import_node_fs19.writeFileSync)(extracted, script, "utf8");
+    return await deps.run("bash", [extracted, "--tag", tag]);
+  } finally {
+    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
+  }
+}
 async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch) {
   if (!isJervHubRepo(repo)) return dispatch;
   if (dispatch.deployStatus !== "success") {
@@ -19092,7 +19245,7 @@ async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch)
     };
   }
   try {
-    const output = await deps.run("bash", ["scripts/jerv-gateway-release-deploy.sh", "--tag", tag]);
+    const output = await runTaggedJervGatewayLocalWrapper(deps, tag, tagSha);
     const receipt = output.trim().split(/\r?\n/).reverse().map((line) => {
       try {
         return JSON.parse(line);
@@ -19110,26 +19263,27 @@ async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch)
       deployStatus: "success"
     };
   } catch (error) {
-    const detail = (error instanceof Error ? error.message : String(error)).split(/\r?\n/, 1)[0].slice(0, 240);
+    const full = error instanceof Error ? error.message : String(error);
     return {
       ...dispatch,
       // #6095: the helper's receipt, health or rollback failed after a proven publish — the release resumes, never re-tags.
-      note: `${dispatch.note}; Jerv Gateway deploy FAILED (${detail}) \u2014 see docs/Guides/train-troubleshooting.md#jerv-gateway-deploy`,
+      // #6985: keep the FULL failing output in the note so the ledger can persist its tail (the first-line 240-char clip hid the real cause).
+      note: `${dispatch.note}; Jerv Gateway deploy FAILED (${full}) \u2014 see docs/Guides/train-troubleshooting.md#jerv-gateway-deploy`,
       workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "jerv-gateway", runUrlNote: JERV_GATEWAY_RUN_URL_NOTE, conclusion: "failure" }],
       deployStatus: "failure"
     };
   }
 }
 async function watchOwnWorkflowRuns(deps, repo, targets, since, headSha, enumerateSha = false) {
-  const workflowRuns = [];
-  for (const target of targets) {
+  const parallel = targets.length > 1 ? { parallel: true } : {};
+  const workflowRuns = await Promise.all(targets.map(async (target) => {
     try {
       const run = await correlateWorkflowRun(deps, { ...target, since, headSha, repo });
-      workflowRuns.push(await watchWorkflowRun(deps, target.workflow, run, repo));
+      return { ...await watchWorkflowRun(deps, target.workflow, run, repo), ...parallel };
     } catch {
-      workflowRuns.push({ workflow: target.workflow, conclusion: "failure" });
+      return { workflow: target.workflow, conclusion: "failure", ...parallel };
     }
-  }
+  }));
   if (!enumerateSha) return workflowRuns;
   const seen = new Set(workflowRuns.map((r) => r.runId).filter((id) => typeof id === "number"));
   workflowRuns.push(...await discoverShaWorkflowRuns(deps, repo, headSha, seen));
@@ -19184,8 +19338,8 @@ async function vercelDeployDispatch(deps, ctx, ref, watch, headSha) {
   return { note: `${note}; ${detail}`, ...read?.logUrl ? { runUrl: read.logUrl } : {}, workflowRuns: [row(read, deployStatus)], deployStatus };
 }
 function shipLegsGreen(deploy, publish) {
-  const green = (s) => s === "complete" || s === "skipped";
-  return green(deploy?.state) && green(publish?.state);
+  const green = (leg) => leg?.superseded !== true && (leg?.state === "complete" || leg?.state === "skipped");
+  return green(deploy) && green(publish);
 }
 async function announceShippedRelease(deps, args, model, legs, deferred) {
   if (!deps.announce) return void 0;
@@ -19851,12 +20005,12 @@ Resume it:  ${resumeCommand}
 // src/train-doctor.ts
 var import_node_child_process9 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
-var import_node_os13 = require("node:os");
+var import_node_os14 = require("node:os");
 var import_node_path23 = require("node:path");
 
 // src/doctor-io.ts
 var import_node_fs20 = require("node:fs");
-var import_node_os10 = require("node:os");
+var import_node_os11 = require("node:os");
 var import_node_path18 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
 var import_node_util4 = require("node:util");
@@ -19886,7 +20040,7 @@ function execFileCapture(file, args, opts = {}) {
 var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function stagedClaudePluginVersion() {
   try {
-    const stagingRoot = (0, import_node_path18.join)((0, import_node_os10.homedir)(), ".claude", "plugins", "staging");
+    const stagingRoot = (0, import_node_path18.join)((0, import_node_os11.homedir)(), ".claude", "plugins", "staging");
     const record = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path18.join)(stagingRoot, "launch-target.json"), "utf8"));
     if (typeof record.target !== "string" || typeof record.incoming !== "string") return void 0;
     const manifest = JSON.parse((0, import_node_fs20.readFileSync)((0, import_node_path18.join)(record.incoming, ".claude-plugin", "plugin.json"), "utf8"));
@@ -19899,7 +20053,7 @@ function stagedClaudePluginVersion() {
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs20.readFileSync)((0, import_node_path18.join)((0, import_node_os10.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs20.readFileSync)((0, import_node_path18.join)((0, import_node_os11.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -20071,11 +20225,11 @@ function compatHolds(range, version) {
 
 // src/claude-binary-doctor.ts
 var import_node_fs21 = require("node:fs");
-var import_node_os12 = require("node:os");
+var import_node_os13 = require("node:os");
 var import_node_path20 = require("node:path");
 
 // src/jerv-cli-spawn.ts
-var import_node_os11 = require("node:os");
+var import_node_os12 = require("node:os");
 var import_node_path19 = require("node:path");
 init_cli_shared();
 var JERV_CLI_ENTRY = (0, import_node_path19.join)("node_modules", "@jervaise", "jerv-cli", "dist", "index.cjs");
@@ -20100,7 +20254,7 @@ function normalizeSpawnPathEntry(entry, platform2 = process.platform) {
   if (msys) return `${msys[1].toUpperCase()}:\\${msys[2].replace(/\//g, "\\")}`;
   return trimmed;
 }
-function jervCliCandidateDirs(env = process.env, home = (0, import_node_os11.homedir)(), platform2 = process.platform) {
+function jervCliCandidateDirs(env = process.env, home = (0, import_node_os12.homedir)(), platform2 = process.platform) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   const push = (dir) => {
@@ -20171,7 +20325,7 @@ function globalNodeModulesRoots(host) {
   };
   const prefix = env.npm_config_prefix?.trim();
   if (prefix) push(platform2 === "win32" ? (0, import_node_path20.join)(prefix, "node_modules") : (0, import_node_path20.join)(prefix, "lib", "node_modules"));
-  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os12.homedir)(), platform2)) {
+  for (const dir of jervCliCandidateDirs(env, host.home ?? (0, import_node_os13.homedir)(), platform2)) {
     push((0, import_node_path20.join)(dir, "node_modules"));
     push((0, import_node_path20.join)((0, import_node_path20.dirname)(dir), "lib", "node_modules"));
   }
@@ -20818,6 +20972,53 @@ var MAX_TEXT = 500;
 function truncate(text, max) {
   return text.length <= max ? text : `${text.slice(0, max - 1)}\u2026`;
 }
+var FAILING_OUTPUT_LEGS = /* @__PURE__ */ new Set(["publish", "deploy", "alignment"]);
+var LEDGER_OUTPUT_FILE_LINES = 50;
+var LEDGER_OUTPUT_NOTE_LINES = 5;
+function lastNonEmptyLines(text, n) {
+  const lines2 = text.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
+  while (lines2.length > 0 && lines2[lines2.length - 1] === "") lines2.pop();
+  return lines2.slice(-n);
+}
+function attachOutputNote(note, suffix) {
+  const room = Math.max(0, MAX_TEXT - suffix.length - 3);
+  const head = note && room > 20 ? truncate(note, room) : "";
+  return truncate(head ? `${head} \u2014 ${suffix}` : suffix, MAX_TEXT);
+}
+function writeFailingLegOutput(artifactPath, output) {
+  const fileLines = lastNonEmptyLines(output, LEDGER_OUTPUT_FILE_LINES);
+  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(artifactPath), { recursive: true });
+  (0, import_node_fs22.writeFileSync)(artifactPath, `${fileLines.join("\n")}
+`, "utf8");
+  const tail = fileLines.slice(-LEDGER_OUTPUT_NOTE_LINES).join("\n");
+  const noteSuffix = truncate(`failing-leg output: ${artifactPath}
+${tail}`, MAX_TEXT);
+  return { artifactPath, noteSuffix };
+}
+function stampPhaseRecord(ledgerPath, tag, phase, entry, previousRetries, now) {
+  const { output: failingOutput, ...fields } = entry;
+  let note = fields.note;
+  if (fields.state === "failed" && FAILING_OUTPUT_LEGS.has(phase)) {
+    const raw = failingOutput ?? fields.error ?? fields.note;
+    if (raw) {
+      try {
+        const persisted = writeFailingLegOutput(
+          (0, import_node_path22.join)((0, import_node_path22.dirname)((0, import_node_path22.dirname)(ledgerPath)), "ledger-output", `${tag}-${phase}.txt`),
+          raw
+        );
+        note = attachOutputNote(note, persisted.noteSuffix);
+      } catch {
+      }
+    }
+  }
+  return {
+    ...fields,
+    note: note !== void 0 ? truncate(note, MAX_TEXT) : void 0,
+    error: fields.error !== void 0 ? truncate(fields.error, MAX_TEXT * 2) : void 0,
+    retries: fields.retries ?? previousRetries,
+    updatedAt: now().toISOString()
+  };
+}
 function normalizeLedgerAnchors(anchors) {
   const repo = anchors.repo?.trim();
   const tag = anchors.tag?.trim();
@@ -21029,13 +21230,7 @@ function openReleaseLedgerWriter(cwd, opts = {}) {
               updatedAt: now().toISOString()
             };
             const previousRetries = base.phases[phase].retries ?? 0;
-            const record = {
-              ...entry,
-              note: entry.note !== void 0 ? truncate(entry.note, MAX_TEXT) : void 0,
-              error: entry.error !== void 0 ? truncate(entry.error, MAX_TEXT * 2) : void 0,
-              retries: entry.retries ?? previousRetries,
-              updatedAt: now().toISOString()
-            };
+            const record = stampPhaseRecord(path2, normalized.tag, phase, entry, previousRetries, now);
             const updated = {
               ...base,
               phases: { ...base.phases, [phase]: record },
@@ -21123,7 +21318,9 @@ var TRANSIENT_TRANSPORT_MARKERS = [
   /socket hang ?up/i,
   /remote end hung ?up unexpectedly/i,
   /early EOF/i,
-  /tls handshake timeout/i
+  /tls handshake timeout/i,
+  /kex_exchange_identification: connection closed by remote host/i,
+  /connection closed by remote host/i
 ];
 function classifyTransientTransportFailure(evidence) {
   if (!evidence) return false;
@@ -21707,6 +21904,48 @@ function ledgerLaneResumeCommand(prior) {
   if (prior.lane === "hotfix") return `mmi-cli devops hotfix release ${prior.tag}`;
   return "mmi-cli devops release --resume (or, only when proven unpublished, mmi-cli devops release --abort --apply)";
 }
+var RETRY_DEPLOY_LEGS = /* @__PURE__ */ new Set(["deploy", "alignment"]);
+function joinLegNames(legs) {
+  if (legs.length <= 1) return legs[0] ?? "";
+  if (legs.length === 2) return `${legs[0]} and ${legs[1]}`;
+  return `${legs.slice(0, -1).join(", ")} and ${legs[legs.length - 1]}`;
+}
+function formatFailedLegTails(ledger) {
+  const chunks = [];
+  for (const phase of ["publish", "deploy", "alignment"]) {
+    const rec = ledger.phases[phase];
+    if (rec.state !== "failed") continue;
+    const text = rec.note ?? rec.error ?? "";
+    const marker = "failing-leg output: ";
+    const idx = text.indexOf(marker);
+    if (idx < 0) continue;
+    chunks.push(`${phase} ${text.slice(idx)}`);
+  }
+  return chunks.length ? `; ${chunks.join("; ")}` : "";
+}
+function hotfixRetryDeployShape(ledger) {
+  if (ledger.lane !== "hotfix") return false;
+  if (ledger.phases.githubRelease.state !== "complete") return false;
+  const open2 = RELEASE_LEDGER_PHASES.filter((phase) => {
+    const state = ledger.phases[phase].state;
+    return state === "pending" || state === "failed";
+  });
+  if (open2.length === 0) return false;
+  if (!open2.every((phase) => RETRY_DEPLOY_LEGS.has(phase))) return false;
+  return open2.some((phase) => ledger.phases[phase].state === "failed");
+}
+function ledgerFailedRemedy(ledger) {
+  const derived = deriveReleasePhaseStatus(ledger);
+  const openLegs = derived.legs.filter((l) => l.state === "pending" || l.state === "failed");
+  const tails = formatFailedLegTails(ledger);
+  if (hotfixRetryDeployShape(ledger)) {
+    const failed = openLegs.filter((l) => l.state === "failed").map((l) => l.phase);
+    return `the published ${ledger.tag} hotfix can retry the failed ${joinLegNames(failed)} of the same tag: \`mmi-cli devops hotfix release ${ledger.tag} --retry-deploy\` (the deploy helper is idempotent; alignment re-attempts the fold-port PR) (#6985)${tails}`;
+  }
+  const deployOnlyDeadlock = openLegs.length > 0 && openLegs.every((l) => l.phase === "deploy" && supersedeableDeployLegShape(l));
+  const supersession = deployOnlyDeadlock ? `; when the deploy failure is content-caused on the already-published ${ledger.tag} (the immutable tag can never deploy green), the sanctioned exit is \`mmi-cli devops release --supersede-deploy --apply\` after explicit master approval \u2014 the next patch train carries the cause fix (#6553)` : "";
+  return `diagnose the failed leg, then ${ledgerLaneResumeCommand(ledger)} once its cause is fixed (an abort only with fresh approval)${supersession}${tails}`;
+}
 function alignmentPrNumbers(note) {
   return [...new Set([...(note ?? "").matchAll(/\/pull\/(\d+)/g)].map((m) => Number.parseInt(m[1], 10)))];
 }
@@ -21752,6 +21991,70 @@ async function healStaleAlignmentLeg(deps, cwd, expected) {
     return prior.tag;
   });
 }
+async function healUnfoldedRunLegs(deps, cwd, model) {
+  const path2 = releaseLedgerPath(cwd);
+  let prior;
+  try {
+    prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const legs = ["deploy", "publish"];
+  const openLeg = (rec) => rec.state === "pending" && rec.superseded !== true;
+  if (!legs.some((phase) => openLeg(prior.phases[phase]))) return void 0;
+  const anchors = { repo: prior.repo, tag: prior.tag, tagSha: prior.tagSha };
+  const folded = [];
+  let current = prior;
+  if (legs.some((phase) => openLeg(prior.phases[phase]) && prior.phases[phase].runId != null)) {
+    let reverified;
+    try {
+      reverified = await reverifyPersistedRunPhases(deps, path2, anchors, { sha: prior.tagSha, repo: prior.repo });
+    } catch {
+      return void 0;
+    }
+    if (!reverified.ledger) return void 0;
+    current = reverified.ledger;
+    for (const phase of legs) {
+      const before = prior.phases[phase];
+      const after = current.phases[phase];
+      if (openLeg(before) && before.runId != null && after.state !== "pending") folded.push({ phase, state: after.state, runId: after.runId });
+    }
+  }
+  const targets = prodReleaseTargets(model);
+  const runless = legs.filter((phase) => openLeg(current.phases[phase]) && current.phases[phase].runId == null);
+  if (runless.length > 0 && targets.length > 0) {
+    let rows;
+    try {
+      rows = await listOwnWorkflowRuns(deps, releaseRunRepoFor(model, prior.repo), targets, prior.tagSha);
+    } catch {
+      rows = [];
+    }
+    const inputs = phaseInputsFromRunRows(model, rows, prior.tagSha, { repo: prior.repo });
+    const foldable = runless.filter((phase) => inputs[phase].runId != null && inputs[phase].state !== "pending");
+    if (foldable.length > 0) {
+      const written = await withReleaseLedger(path2, anchors, (ledger) => {
+        if (!ledger) return { value: [] };
+        const phases = { ...ledger.phases };
+        const done = [];
+        for (const phase of foldable) {
+          const live = phases[phase];
+          if (!openLeg(live) || live.runId != null) continue;
+          const entry = compactEntry(inputs[phase]);
+          phases[phase] = {
+            ...entry,
+            note: `${entry.note ?? `${phase} run on the release SHA`} \u2014 folded by train doctor --heal from the concluded run (#7003)`,
+            retries: live.retries,
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          done.push({ phase, state: entry.state, runId: entry.runId });
+        }
+        return done.length ? { ledger: { ...ledger, phases, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, value: done } : { value: done };
+      }).catch(() => []);
+      folded.push(...written);
+    }
+  }
+  return folded.length ? { tag: prior.tag, folded } : void 0;
+}
 function supersedeableDeployLegShape(rec) {
   return rec.state === "failed" || rec.state === "pending" && rec.runId == null;
 }
@@ -22098,9 +22401,10 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     }
     if (derived.phaseStatus !== "phases-green") {
       const open2 = derived.legs.filter((l) => l.state === "pending" || l.state === "failed");
+      const next = derived.phaseStatus === "phases-failed" ? ledgerFailedRemedy(prior) : `Finish it first: ${ledgerLaneResumeCommand(prior)} (#5987/#6068)`;
       return {
         ok: false,
-        error: `a prior ${prior.lane ?? "release"} ledger for ${prior.tag} is ${derived.phaseStatus} (${open2.map((l) => `${l.phase}=${l.state}`).join(", ")}) \u2014 a new train run must not stack on an unresolved one. Finish it first: ${ledgerLaneResumeCommand(prior)} (#5987/#6068)`
+        error: `a prior ${prior.lane ?? "release"} ledger for ${prior.tag} is ${derived.phaseStatus} (${open2.map((l) => `${l.phase}=${l.state}`).join(", ")}) \u2014 a new train run must not stack on an unresolved one. ${next}`
       };
     }
     let liveSha = "";
@@ -22124,6 +22428,124 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     return { ok: true, note: `archived the completed release ledger ${prior.tag} to ${archivePath} (live-proven at ${prior.tagSha.slice(0, 12)})` };
   });
 }
+async function defaultRetryDeploy(deps, prior) {
+  const input = {
+    note: `hotfix --retry-deploy ${prior.tag}`,
+    deployStatus: "success",
+    workflowRuns: []
+  };
+  const dispatch = await appendJervGatewayReleaseDeploy(deps, prior.repo, prior.tag, prior.tagSha, input);
+  const host = (dispatch.workflowRuns ?? []).find((r) => r.workflow === "jerv-gateway");
+  if (!host) {
+    throw new Error(
+      `hotfix --retry-deploy: the ${prior.tag} deploy helper was not invoked (not the operator-host Gateway) \u2014 nothing was written (#6985)`
+    );
+  }
+  const entry = deployPhaseInput("registry-publish", dispatch, { releaseSha: prior.tagSha });
+  if (entry.state === "failed") {
+    return { ...entry, error: entry.note ?? dispatch.note, output: dispatch.note };
+  }
+  return entry;
+}
+async function retryHotfixDeployLegs(deps, cwd, opts = {}) {
+  const path2 = releaseLedgerPath(cwd);
+  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+    let prior;
+    try {
+      prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+    } catch (e) {
+      throw new ReleaseLedgerError(
+        "unreadable",
+        `hotfix --retry-deploy: the active release ledger at ${path2} could not be read (${e instanceof Error ? e.message : String(e)}) \u2014 resolve it by hand; nothing was written (#6985)`
+      );
+    }
+    if (prior.lane !== "hotfix") {
+      throw new Error(
+        `hotfix --retry-deploy: the active ledger is a ${prior.lane ?? "release"} lane ledger for ${prior.tag} \u2014 --retry-deploy is the hotfix lane's recovery for a published hotfix; nothing was written (#6985)`
+      );
+    }
+    if (prior.phases.githubRelease.state !== "complete") {
+      throw new Error(
+        `hotfix --retry-deploy: ${prior.tag} is not a published hotfix (githubRelease=${prior.phases.githubRelease.state}) \u2014 --retry-deploy re-runs deploy/alignment of a PUBLISHED tag; nothing was written (#6985)`
+      );
+    }
+    if (!hotfixRetryDeployShape(prior)) {
+      const derived = deriveReleasePhaseStatus(prior);
+      const open2 = derived.legs.filter((l) => l.state === "pending" || l.state === "failed");
+      const extra = open2.filter((l) => l.phase !== "deploy" && l.phase !== "alignment");
+      if (extra.length > 0) {
+        throw new Error(
+          `hotfix --retry-deploy: ${prior.tag} has unresolved legs besides deploy/alignment (${extra.map((l) => `${l.phase}=${l.state}`).join(", ")}) \u2014 it re-runs only the failed deploy and/or fold-port alignment of a published hotfix of the same tag; nothing was written (#6985)`
+        );
+      }
+      throw new Error(
+        `hotfix --retry-deploy: ${prior.tag} has no failed deploy or alignment leg to retry (${open2.map((l) => `${l.phase}=${l.state}`).join(", ") || "phases-green"}) \u2014 nothing was written (#6985)`
+      );
+    }
+    if (prior.phases.alignment.state === "failed" && !opts.retryAlignment) {
+      throw new Error(
+        `hotfix --retry-deploy: the ${prior.tag} alignment (fold-port) leg is failed \u2014 nothing was written (#6985)`
+      );
+    }
+    if (prior.phases.deploy.state === "failed" && !isJervHubRepo(prior.repo) && prior.phases.deploy.workflow !== "jerv-gateway") {
+      throw new Error(
+        `hotfix --retry-deploy: the ${prior.tag} deploy leg is ${prior.phases.deploy.workflow ?? "not the operator-host helper"} \u2014 diagnose that run; nothing was written (#6985)`
+      );
+    }
+    let liveSha = "";
+    try {
+      liveSha = (await deps.run("git", ["ls-remote", "origin", `refs/tags/${prior.tag}`])).trim().split(/\s+/)[0] ?? "";
+    } catch (e) {
+      throw new Error(
+        `hotfix --retry-deploy: could not prove ${prior.tag} live on origin (${e instanceof Error ? e.message : String(e)}) \u2014 refusing to retry on an unproven state; retry when origin answers (#6985)`
+      );
+    }
+    if (liveSha.toLowerCase() !== prior.tagSha.toLowerCase()) {
+      throw new Error(
+        `hotfix --retry-deploy: origin reports ${prior.tag} at ${liveSha.slice(0, 12) || "no tag"} but the ledger anchors ${prior.tagSha.slice(0, 12)} \u2014 an absent or divergent tag is not retryable; nothing was written (#6985)`
+      );
+    }
+    const retried = [];
+    const phases = { ...prior.phases };
+    const now = () => /* @__PURE__ */ new Date();
+    if (phases.deploy.state === "failed") {
+      retried.push("deploy");
+      const entry = opts.retryDeploy ? await opts.retryDeploy(prior) : await defaultRetryDeploy(deps, prior);
+      phases.deploy = stampPhaseRecord(path2, prior.tag, "deploy", entry, phases.deploy.retries ?? 0, now);
+    }
+    if (phases.alignment.state === "failed") {
+      retried.push("alignment");
+      try {
+        const entry = await opts.retryAlignment(prior);
+        phases.alignment = stampPhaseRecord(path2, prior.tag, "alignment", entry, phases.alignment.retries ?? 0, now);
+      } catch (e) {
+        const message2 = e instanceof Error ? e.message : String(e);
+        phases.alignment = stampPhaseRecord(
+          path2,
+          prior.tag,
+          "alignment",
+          { state: "failed", sha: prior.tagSha, error: message2, output: message2 },
+          phases.alignment.retries ?? 0,
+          now
+        );
+      }
+    }
+    atomicWriteJson(path2, { ...prior, phases, updatedAt: now().toISOString() });
+    const stillFailed = retried.filter((phase) => phases[phase].state === "failed");
+    const status = stillFailed.length === 0 ? "success" : "failed";
+    return {
+      command: "hotfix-retry-deploy",
+      repo: prior.repo,
+      tag: prior.tag,
+      tagSha: prior.tagSha,
+      retried,
+      status,
+      note: status === "success" ? `retried the failed ${joinLegNames(retried)} of published ${prior.tag} \u2014 the ledger is phases-green (#6985)` : `retried the failed ${joinLegNames(retried)} of published ${prior.tag} \u2014 ${joinLegNames(stillFailed)} still failed (#6985)`,
+      ...retried.includes("deploy") ? { deploy: phases.deploy } : {},
+      ...retried.includes("alignment") ? { alignment: phases.alignment } : {}
+    };
+  });
+}
 
 // src/train-doctor.ts
 init_client_version();
@@ -22221,7 +22643,7 @@ function readOriginWorkflowsDefault(root, ref) {
 }
 var NPM_REGISTRY = "https://registry.npmjs.org";
 async function probeRegistryWhoami(train) {
-  const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path23.join)((0, import_node_os13.tmpdir)(), "mmi-npmrc-"));
+  const dir = (0, import_node_fs23.mkdtempSync)((0, import_node_path23.join)((0, import_node_os14.tmpdir)(), "mmi-npmrc-"));
   const rc = (0, import_node_path23.join)(dir, "npmrc");
   try {
     (0, import_node_fs23.writeFileSync)(rc, "//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n");
@@ -22260,6 +22682,7 @@ var defaultDeps2 = {
     }
   },
   healAlignmentLeg: healStaleAlignmentLeg,
+  healRunLegs: healUnfoldedRunLegs,
   readSurfacesRaw: (cwd) => {
     try {
       return (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(cwd, "surfaces.json"), "utf8");
@@ -22606,6 +23029,21 @@ async function runTrainDoctor(input) {
     try {
       let ledger = parseReleaseLedger(ledgerRaw);
       let derived = deriveReleasePhaseStatus(ledger);
+      const deployModel = typeof meta?.deployModel === "string" && isDeployModel(meta.deployModel) ? meta.deployModel : void 0;
+      if (heal && deployModel && derived.legs.some((l) => (l.phase === "deploy" || l.phase === "publish") && l.state === "pending")) {
+        const run = await deps.healRunLegs(train, cwd, deployModel);
+        if (run) {
+          add({
+            code: "ledger-unfolded",
+            severity: "healed",
+            source: "origin",
+            title: `folded ${run.folded.map((f) => `${f.phase}=${f.state}${f.runId ? ` (run ${f.runId})` : ""}`).join(", ")} into the ${run.tag} ledger from the concluded run(s) on the tag SHA (#7003)`,
+            remedy: "nothing \u2014 the leg now records what GitHub already concluded"
+          });
+          ledger = parseReleaseLedger(deps.readLedgerRaw(ledgerPath) ?? ledgerRaw);
+          derived = deriveReleasePhaseStatus(ledger);
+        }
+      }
       if (heal && derived.phaseStatus === "phases-pending" && derived.legs.every((l) => l.state !== "pending" || l.phase === "alignment")) {
         const closedTag = await deps.healAlignmentLeg(train, cwd);
         if (closedTag) {
@@ -22644,7 +23082,7 @@ async function runTrainDoctor(input) {
           // #6429: each lane finishes its own run (#6068) — an rcand-lane ledger named as a release
           // ledger, with `release --resume` as its remedy, sends the operator to a verb that refuses it.
           title: `a prior ${ledger.lane ?? "release"} ledger for ${ledger.tag} is ${derived.phaseStatus} (${open2}) \u2014 a new train must not stack on it (#5987)`,
-          remedy: failed ? `diagnose the failed leg, then ${ledgerLaneResumeCommand(ledger)} once its cause is fixed (an abort only with fresh approval)${supersession}` : `finish it first: ${ledgerLaneResumeCommand(ledger)} (alignment-only pending legs close themselves with \`train doctor --heal\` once the PR merges)${supersession}`
+          remedy: failed ? ledgerFailedRemedy(ledger) : `finish it first: ${ledgerLaneResumeCommand(ledger)} (alignment-only pending legs close themselves with \`train doctor --heal\` once the PR merges, and a deploy/publish leg whose run already concluded folds under the same heal)${supersession}`
         });
       } else if (newestRemoteReleaseTag && newestRemoteReleaseTag !== ledger.tag) {
         add({
@@ -23400,6 +23838,8 @@ async function recoverPhaseWithMaybeTransientRerun(deps, ledger, anchors, phase,
 }
 async function recoverFailedDispatchPhase(deps, ledger, anchors, phase, dispatch, input, recover = recoverPhaseWithMaybeTransientRerun) {
   if (dispatch.deployStatus !== "failure") return dispatch;
+  const persisted = await ledger?.load(anchors).catch(() => void 0);
+  if (persisted?.phases[phase]?.superseded === true) return dispatch;
   let workflowRuns = dispatch.workflowRuns?.length ? [...dispatch.workflowRuns] : void 0;
   const notes = [];
   let fallbackRecovered = false;
@@ -23407,6 +23847,7 @@ async function recoverFailedDispatchPhase(deps, ledger, anchors, phase, dispatch
   if (failedRows.length > 0) {
     for (const failed of failedRows) {
       const rowPhase = failed.workflow.includes("publish") ? "publish" : phase;
+      if (persisted?.phases[rowPhase]?.superseded === true) continue;
       const recovery = await recover(deps, ledger, anchors, rowPhase, {
         repo: input.repo,
         sha: input.sha,
@@ -23581,7 +24022,10 @@ ${recovery.note}`), recoveryInput);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
   let alignment = alignEarly ? await alignEarly() : void 0;
-  const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
+  const [deployDispatch0, publishDispatch0] = await joinDeployAndPublish(
+    dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir),
+    observePublishIfRequired(deps, ctx, meta, deployModel, "main", releaseSha, watch)
+  );
   const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
   const failedReleaseRun = deployDispatch0.workflowRuns?.find((run) => run.conclusion === "failure");
   const dispatchFailurePhase = failedReleaseRun?.workflow === "publish.yml" || deployModel === "registry-publish" ? "publish" : "deploy";
@@ -23603,7 +24047,6 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", deployLeg, {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
-  const publishDispatch0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", releaseSha, watch);
   const publishDispatch = publishDispatch0 ? await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -23619,6 +24062,14 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "publish", publishLeg, {
     landed: "the immutable tag, the green required-check wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
+  const announcing = announceShippedRelease(
+    deps,
+    { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
+    deployModel,
+    { deploy: deployLeg, publish: publishLeg },
+    releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
+  );
+  const aligning = watch && alignment ? awaitAlignmentsLanded(deps, ctx, alignment) : Promise.resolve(alignment);
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   dispatch = await appendMmiGetRedeploy(
     deps,
@@ -23630,19 +24081,8 @@ ${recovery.note}`), recoveryInput);
     { repo: ctx.repo, publishStatus: publishLeg.state === "complete" ? "success" : "failure", watch },
     dispatch
   );
-  const announcing = announceShippedRelease(
-    deps,
-    { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
-    deployModel,
-    { deploy: deployLeg, publish: publishLeg },
-    releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
-  );
-  if (watch && alignment) {
-    alignment = {
-      dev: await awaitAlignmentLanded(deps, ctx, alignment.dev, "development"),
-      ...alignment.rc ? { rc: await awaitAlignmentLanded(deps, ctx, alignment.rc, "rc") } : {}
-    };
-  }
+  dispatch = await appendServedChannelProof(deps, { repo: ctx.repo, tag, shipped: shipLegsGreen(deployLeg, publishLeg) }, dispatch);
+  alignment = await aligning;
   const announceNote = await announcing;
   return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors, ...alignment ? { alignment } : {} };
 }
@@ -23958,6 +24398,8 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       dispatch2.deployStatus = historicalDeploy;
       dispatch2.note = `historical ${deployModel} deploy/publish status: ${historicalDeploy}; ${companion.note}`;
     }
+    if (persisted?.phases.deploy.superseded === true) phaseInputs.deploy = persisted.phases.deploy;
+    if (persisted?.phases.publish.superseded === true) phaseInputs.publish = persisted.phases.publish;
     if (persisted) {
       if (persisted.phases.deploy.superseded !== true) {
         await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(phaseInputs.deploy), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
@@ -23969,7 +24411,8 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
     }
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
-    const announceNote2 = persisted && !shippedBefore && persisted.phases.deploy.superseded !== true && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
+    const settledBySupersede = persisted?.phases.deploy.superseded === true || persisted?.phases.publish.superseded === true;
+    const announceNote2 = persisted && !shippedBefore && !settledBySupersede && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
       deps,
       { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
       deployModel,
@@ -24059,7 +24502,10 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, runUrl: releaseUrl, note: "verified the Release published against the tagged commit" }), { strict: ledgerMode === "strict", landed: "the immutable tag, the re-proven wall, and the origin/main push" });
   let devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   let rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
-  const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
+  const [deployDispatch0, publishDispatch0] = await joinDeployAndPublish(
+    dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir),
+    observePublishIfRequired(deps, ctx, meta, deployModel, "main", tagSha, watch)
+  );
   const recoveredDeployDispatch = await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -24075,12 +24521,13 @@ ${recovery.note}`), recoveryInput);
   );
   const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch);
   steps.push(`dispatched the ${deployModel} deploy path`);
-  const deployLeg = phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
-  await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
-    strict: ledgerMode === "strict",
-    landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
-  });
-  const publishDispatch0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", tagSha, watch);
+  const deployLeg = persisted?.phases.deploy.superseded === true ? persisted.phases.deploy : phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
+  if (persisted?.phases.deploy.superseded !== true) {
+    await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
+      strict: ledgerMode === "strict",
+      landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
+    });
+  }
   const publishDispatch = publishDispatch0 ? await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -24089,11 +24536,13 @@ ${recovery.note}`), recoveryInput);
     publishDispatch0,
     { repo: ctx.repo, sha: tagSha, watched: false, workflow: "publish.yml" }
   ) : null;
-  const publishLeg = phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo }));
-  await recordPhase(ledger, deps, anchors, "publish", publishLeg, {
-    strict: ledgerMode === "strict",
-    landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
-  });
+  const publishLeg = persisted?.phases.publish.superseded === true ? persisted.phases.publish : phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo }));
+  if (persisted?.phases.publish.superseded !== true) {
+    await recordPhase(ledger, deps, anchors, "publish", publishLeg, {
+      strict: ledgerMode === "strict",
+      landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
+    });
+  }
   const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   const announcing = announceShippedRelease(
     deps,
@@ -24103,8 +24552,9 @@ ${recovery.note}`), recoveryInput);
     releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
   );
   if (watch) {
-    devRollForward = await awaitAlignmentLanded(deps, ctx, devRollForward, "development");
-    if (rcAlignment) rcAlignment = await awaitAlignmentLanded(deps, ctx, rcAlignment, "rc");
+    const landed = await awaitAlignmentsLanded(deps, ctx, { dev: devRollForward, rc: rcAlignment });
+    devRollForward = landed.dev;
+    rcAlignment = landed.rc;
   }
   const announceNote = await announcing;
   steps.push(`development roll-forward: ${devRollForward.status}`);
@@ -24759,6 +25209,7 @@ var RULESET_TEMPLATE_SEED = "seed:mmi-product-required-checks.template.json";
 var RULESET_REFERENCE_MATCH_LABEL = "committed ruleset reference matches the live ruleset (#3816)";
 var GATE_GREEN_ON_BASE_LABEL = "gate is green on the default branch (#3819)";
 var REQUIRED_CONTEXTS_EMITTED_LABEL = "required check contexts match PR workflows";
+var UNBLOCKING_GATE_JOBS_LABEL = "every gate job can block a merge (#7012)";
 var TAG_ADDRESSABLE_CONTEXTS_LABEL = "rc/main required contexts are tag-addressable (#3880)";
 var RELEASE_BRANCH_REACHABLE_LABEL = "rc/main required contexts are reachable from a release-base head (#5193)";
 var RULESET_TRACK_SCOPE_LABEL = "product ruleset branch scope covers the release track (#6327)";
@@ -25191,6 +25642,17 @@ async function auditRepoCi(repo, deps) {
           remediation: missingEmitters.length ? `Fix the pull_request workflows or ${contextAuthority.source} before reconciling` : void 0
         });
       }
+      if (hasRequiredChecks) {
+        const gateFiles = new Set(gateWorkflowFiles(prWorkflowPaths));
+        const gateWorkflows = (await getBranchWorkflows() ?? []).filter((wf) => gateFiles.has(wf.path.slice(wf.path.lastIndexOf("/") + 1)));
+        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job));
+        checks.push({
+          ok: unblocking.length === 0,
+          label: UNBLOCKING_GATE_JOBS_LABEL,
+          detail: unblocking.length ? `gate job(s) [${unblocking.join(", ")}] run on every PR but are neither required nor needed by a required job (required: [${liveContexts.join(", ")}]) \u2014 a red one still merges and turns ${baseBranch} red for every later PR` : void 0,
+          remediation: unblocking.length ? `mmi-cli oracle org project set ${repo} --var requiredChecks=${JSON.stringify(sortedUnique([...liveContexts, ...unblocking]))} then mmi-cli devops ci reconcile --repo ${repo} --apply \u2014 or make a required job \`needs:\` them` : void 0
+        });
+      }
       const prOnly = contextAuthority.coversReleaseBranches ? contextAuthority.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context)) : [];
       const tagBlind = contextAuthority.coversReleaseBranches ? contextsUnreachableOnTagPush(contextAuthority.contexts, await getBranchWorkflows() ?? [], TRAIN_PR_ONLY_CONTEXTS) : [];
       checks.push({
@@ -27122,7 +27584,7 @@ function registerBoardCommands(program3) {
 
 // src/bootstrap-commands.ts
 var import_node_fs26 = require("node:fs");
-var import_node_os14 = require("node:os");
+var import_node_os15 = require("node:os");
 var import_node_path26 = require("node:path");
 init_cli_shared();
 init_clean_exit();
@@ -29130,7 +29592,7 @@ function registerBootstrapCommands(program3) {
     const readFile9 = (p) => (0, import_node_fs26.existsSync)(p) ? (0, import_node_fs26.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path26.join)((0, import_node_os14.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const tmp = (0, import_node_path26.join)((0, import_node_os15.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
       (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
@@ -29771,7 +30233,7 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path26.join)((0, import_node_os14.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        const tmp = (0, import_node_path26.join)((0, import_node_os15.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
         const desiredContent = desiredByRepo.get(rec.repo);
         if (desiredContent == null) return fail(`bootstrap propagate: no resolved content for ${rec.repo} ${seed.target} \u2014 refusing to write`);
         (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, desiredContent, branch, existingSha)), "utf8");
@@ -29946,7 +30408,7 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path26.join)((0, import_node_os14.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      const tmp = (0, import_node_path26.join)((0, import_node_os15.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
       (0, import_node_fs26.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, seed.target, tmp));
@@ -31897,7 +32359,7 @@ async function collectWaveStatus(deps) {
 init_github_client();
 init_cli_shared();
 var import_node_fs30 = require("node:fs");
-var import_node_os15 = require("node:os");
+var import_node_os16 = require("node:os");
 var import_node_path29 = require("node:path");
 var GC_GH_TIMEOUT_MS = 2e4;
 async function collectStatus() {
@@ -32086,7 +32548,7 @@ async function collectOnboardStatus(opts = {}) {
     else if (top) nextCommand = `mmi-cli oracle board claim ${top.number}  # ${top.title}`;
     else nextCommand = "mmi-cli oracle board read \u2014 no claimable items found";
   }
-  const home = (0, import_node_os15.homedir)();
+  const home = (0, import_node_os16.homedir)();
   const plugin = onboardPluginGate({
     readKnown: () => readFileSyncSafe((0, import_node_path29.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs30.readFileSync),
     readSettings: () => readFileSyncSafe((0, import_node_path29.join)(home, ".claude", "settings.json"), import_node_fs30.readFileSync)
@@ -34114,7 +34576,7 @@ init_error_codes();
 init_github_client();
 
 // src/issue-body.ts
-var import_node_os16 = require("node:os");
+var import_node_os17 = require("node:os");
 init_error_codes();
 var TextArgError = class extends Error {
   constructor(message2, code, offendingFlag) {
@@ -34127,7 +34589,7 @@ var TextArgError = class extends Error {
   offendingFlag;
 };
 function emptyStdinMessage(fileFlag) {
-  if ((0, import_node_os16.platform)() === "win32") {
+  if ((0, import_node_os17.platform)() === "win32") {
     return `${fileFlag} - read empty stdin (on Windows, ${fileFlag} - is unreliable through the npm .cmd shim \u2014 use ${fileFlag} <path>, or pipe to \`node cli/dist/index.cjs\` directly)`;
   }
   return `${fileFlag} - read empty stdin (nothing piped \u2014 pass a heredoc/pipe, or ${fileFlag} <path>)`;
@@ -36642,7 +37104,7 @@ function registerSchedulesCommands(program3) {
 // src/secrets-commands.ts
 var import_node_fs33 = require("node:fs");
 var import_node_path31 = require("node:path");
-var import_node_os17 = require("node:os");
+var import_node_os18 = require("node:os");
 init_cli_shared();
 init_hub_auth();
 init_github_client();
@@ -36768,7 +37230,7 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs33.mkdtempSync)((0, import_node_path31.join)((0, import_node_os17.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptDir = (0, import_node_fs33.mkdtempSync)((0, import_node_path31.join)((0, import_node_os18.tmpdir)(), "mmi-rails-decrypt-"));
   const scriptPath = (0, import_node_path31.join)(scriptDir, "decrypt.rb");
   (0, import_node_fs33.writeFileSync)(scriptPath, script, "utf8");
   try {
@@ -38164,7 +38626,7 @@ init_github_client();
 // src/merge-cleanup.ts
 var import_node_fs37 = require("node:fs");
 var import_node_path35 = require("node:path");
-var import_node_os18 = require("node:os");
+var import_node_os19 = require("node:os");
 init_cli_shared();
 init_github_client();
 
@@ -39234,7 +39696,7 @@ function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   return rewritten === base ? null : rewritten;
 }
 function writeSquashBodyFile(body) {
-  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path35.join)((0, import_node_os18.tmpdir)(), "mmi-squash-body-"));
+  const dir = (0, import_node_fs37.mkdtempSync)((0, import_node_path35.join)((0, import_node_os19.tmpdir)(), "mmi-squash-body-"));
   const path2 = (0, import_node_path35.join)(dir, "body.txt");
   (0, import_node_fs37.writeFileSync)(path2, body.endsWith("\n") ? body : `${body}
 `, "utf8");
@@ -39657,7 +40119,7 @@ function postMergeReconWarnings(input) {
 // src/review-verdict.ts
 var import_node_child_process13 = require("node:child_process");
 var import_node_fs39 = require("node:fs");
-var import_node_os19 = require("node:os");
+var import_node_os20 = require("node:os");
 var import_node_path37 = require("node:path");
 init_cli_shared();
 var REVIEW_VERDICT_MARKER = "<!-- zeroci-review v1 -->";
@@ -39823,7 +40285,7 @@ async function readPrIssueComments(number, repo) {
   return comments;
 }
 async function postPrCommentFromFile(number, repo, body) {
-  const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path37.join)((0, import_node_os19.tmpdir)(), "mmi-review-verdict-"));
+  const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path37.join)((0, import_node_os20.tmpdir)(), "mmi-review-verdict-"));
   const path2 = (0, import_node_path37.join)(dir, "body.md");
   try {
     (0, import_node_fs39.writeFileSync)(path2, body, "utf8");
@@ -42808,7 +43270,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 var import_node_child_process16 = require("node:child_process");
 var import_node_crypto13 = require("node:crypto");
 var import_node_fs45 = require("node:fs");
-var import_node_os20 = require("node:os");
+var import_node_os21 = require("node:os");
 var import_node_path42 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
@@ -42959,7 +43421,7 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs45.mkdtempSync)((0, import_node_path42.join)((0, import_node_os20.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs45.mkdtempSync)((0, import_node_path42.join)((0, import_node_os21.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
     const cliOut = (0, import_node_path42.join)(stage, "cli-dist");
@@ -43776,6 +44238,32 @@ function formatHotfixBatchPreflightRefusal(failures, fromSpecs) {
 ${lines2.join("\n")}
 Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
 }
+var CHERRY_PICKED_FROM = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
+async function findHotfixPickGaps(deps, sources, tolerated) {
+  if (sources.length === 0) return [];
+  const namedShas = new Set(sources.map((s) => s.sha.toLowerCase()));
+  const carried = /* @__PURE__ */ new Set();
+  const mainOnly = await deps.run("git", ["log", "--no-merges", "--format=%B", "origin/development..origin/main"]);
+  for (const m of mainOnly.matchAll(CHERRY_PICKED_FROM)) carried.add(m[1].toLowerCase());
+  const gaps = [];
+  const devOnly = (await deps.run("git", ["log", "--no-merges", "--reverse", "--format=%H%x09%s", "origin/main..origin/development"])).split("\n").map((s) => s.trim()).filter(Boolean);
+  for (const line of devOnly) {
+    const [sha, ...subjectParts] = line.split("	");
+    if (!sha) continue;
+    const lower = sha.toLowerCase();
+    if (namedShas.has(lower) || carried.has(lower)) continue;
+    const paths = (await deps.run("git", ["show", "--no-color", "--name-only", "--pretty=format:", sha])).split("\n").map((s) => s.trim()).filter(Boolean);
+    if (paths.length === 0 || paths.every((p) => pathIsTolerated(p, tolerated))) continue;
+    gaps.push({ sha, subject: subjectParts.join("	") });
+  }
+  return gaps;
+}
+function formatHotfixPickGapRefusal(gaps, tag, fromSpecs) {
+  const lines2 = gaps.map((g) => `  - ${g.sha.slice(0, 7)} ${g.subject}`);
+  return `hotfix start refused: ${tag} would omit ${gaps.length} merged development fix(es) not on origin/main:
+${lines2.join("\n")}
+A hotfix branch is cut from origin/main and carries ONLY the fixes --from names, in order (#4411) \u2014 every other merged development fix stays unshipped while the channel reports healthy (#6994). Add each omitted fix to the pick list and rerun \`mmi-cli devops hotfix start --from ${[...fromSpecs, ...gaps.map((g) => g.sha.slice(0, 7))].join(",")}\`, or, when a listed fix is provably not needed on main (a development-only change, already superseded), rerun with \`--ack ${gaps.map((g) => g.sha.slice(0, 7)).join(",")}\` naming exactly the sha(s) a human excluded \u2014 the ack is recorded in the PR body, never silent.`;
+}
 async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return [];
   const startBranch = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
@@ -43962,6 +44450,18 @@ async function runHotfixStart(deps, options, doctor = runTrainDoctor) {
   }
   const label = sources.map((s) => s.label).join(", ");
   const { foldPaths, pickTolerated } = await resolveHotfixPickTolerated(deps, deployModel);
+  const ackedShas = (options.ack ?? []).map((a) => a.trim().toLowerCase()).filter(Boolean);
+  const pickGaps = await findHotfixPickGaps(deps, sources, pickTolerated);
+  const unacked = pickGaps.filter((g) => {
+    const sha = g.sha.toLowerCase();
+    return !ackedShas.some((a) => sha.startsWith(a) || a.startsWith(sha));
+  });
+  if (unacked.length > 0) {
+    throw new Error(formatHotfixPickGapRefusal(unacked, tag, specs));
+  }
+  if (pickGaps.length > 0) {
+    notes.push(`pick-completeness ack: excluded ${pickGaps.map((g) => `${g.sha.slice(0, 7)} ${g.subject}`).join("; ")} by --ack (#6994)`);
+  }
   const remoteBranch = clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   if (remoteBranch) {
     await deps.run("git", ["checkout", branch]);
@@ -44026,7 +44526,9 @@ async function runHotfixStart(deps, options, doctor = runTrainDoctor) {
     "--body",
     `Hotfix ${tag}: cherry-pick of ${label} onto origin/main${bumpNote}.
 
-<!-- mmi-hotfix-carries: ${sources.map((s) => s.sha).join(",")} -->
+<!-- mmi-hotfix-carries: ${sources.map((s) => s.sha).join(",")} -->${pickGaps.length > 0 ? `
+
+<!-- mmi-hotfix-acked-excluded: ${pickGaps.map((g) => g.sha).join(",")} (#6994 pick-completeness) -->` : ""}
 
 Merge this PR (human-initiated), then run \`mmi-cli devops hotfix release ${tag}\`.`
   ]));
@@ -44416,9 +44918,9 @@ ${decision.note}`);
   let deployNote;
   let tenantPublishDispatch = null;
   if (deployModel === "hub-serverless") {
-    for (const workflow of HOTFIX_RELEASE_WORKFLOWS) {
-      const watched = await watchReleaseRun(deps, ctx, workflow, mergedSha);
-      runs.push(await recoverHotfixReleaseRun(deps, ledger, anchors, ctx, deployModel, workflow === "publish.yml" ? "publish" : "deploy", watched));
+    const watchedRuns = await Promise.all(HOTFIX_RELEASE_WORKFLOWS.map((workflow) => watchReleaseRun(deps, ctx, workflow, mergedSha)));
+    for (const watched of watchedRuns) {
+      runs.push(await recoverHotfixReleaseRun(deps, ledger, anchors, ctx, deployModel, watched.workflow === "publish.yml" ? "publish" : "deploy", watched));
     }
     deployNote = "watched release-triggered deploy.yml + publish.yml";
   } else if (deployModel === "registry-publish") {
@@ -44427,17 +44929,9 @@ ${decision.note}`);
     runs.push(run);
     deployNote = "watched this repo's own release-triggered publish.yml (#2428 \u2014 no central dispatch)";
   } else if (deployModel === "tenant-container" || deployModel === "solo-container") {
-    const deploy0 = await dispatchDeploy(
-      deps,
-      ctx,
-      "main",
-      "main",
-      deployModel,
-      true,
-      (deps.now ?? Date.now)(),
-      mergedSha,
-      "report",
-      meta.publishDir
+    const [deploy0, publish0] = await joinDeployAndPublish(
+      dispatchDeploy(deps, ctx, "main", "main", deployModel, true, (deps.now ?? Date.now)(), mergedSha, "report", meta.publishDir),
+      observePublishIfRequired(deps, ctx, meta, deployModel, "main", mergedSha, true)
     );
     const deploy = await recoverFailedDispatchPhase(
       deps,
@@ -44447,7 +44941,6 @@ ${decision.note}`);
       deploy0,
       { repo: releaseRunRepoFor(deployModel, ctx.repo), sha: mergedSha, watched: true, workflow: "tenant-deploy.yml" }
     );
-    const publish0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", mergedSha, true);
     const publish = publish0 ? await recoverFailedDispatchPhase(
       deps,
       ledger,
@@ -44542,6 +45035,48 @@ ${decision.note}`);
   const localSync = await syncLocalTrainBranches(deps.run, { fetch: false, warn: deps.warn }).catch(() => void 0);
   return { ...result, ...localSync ? { localSync } : {} };
 }
+async function runHotfixRetryDeploy(deps, versionInput) {
+  const ctx = await buildTrainApplyContext(deps);
+  const { tag } = normalizeHotfixVersion(versionInput);
+  const status = await deps.run("git", ["status", "--porcelain"]);
+  if (porcelainHasBlockingChanges(status)) {
+    throw new Error(`working tree must be clean before hotfix --retry-deploy${describeBlockingPaths(status)}`);
+  }
+  const root = await hotfixCheckoutRoot(deps);
+  await deps.run("git", ["fetch", "origin", "--tags"]);
+  const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+  const deployModel = requireDeployModel(meta, ctx.repo);
+  const result = await retryHotfixDeployLegs(deps, root, {
+    retryAlignment: async (prior) => {
+      let foldNote2;
+      let foldStatus2 = "ok";
+      try {
+        foldNote2 = await portFoldToDevelopment(deps, ctx, deployModel, prior.tag);
+      } catch (e) {
+        foldStatus2 = "failure";
+        foldNote2 = `development fold port FAILED: ${e.message ?? e} \u2014 the release stands; port it by hand on a fresh branch: git checkout -B ${devFoldBranch(prior.tag)}-manual origin/development && ${foldPortManualCommand(deployModel, prior.tag.replace(/^v/, ""))}, then push it as the canonical head (git push origin ${devFoldBranch(prior.tag)}-manual:refs/heads/${devFoldBranch(prior.tag)}) and open a development-base PR \u2014 see docs/Guides/train-troubleshooting.md#hotfix-fold-port`;
+      }
+      return hotfixFoldAlignmentEntry(foldStatus2, foldNote2, prior.tagSha);
+    }
+  });
+  const ledger = openReleaseLedgerWriter(root);
+  const report = releaseLedgerReport(
+    await ledger.load({ repo: result.repo, tag: result.tag, tagSha: result.tagSha }).catch(() => void 0),
+    ledger.path
+  );
+  const deployNote = result.deploy?.note ?? result.deploy?.error;
+  const foldNote = result.alignment?.note ?? result.alignment?.error;
+  const foldStatus = result.alignment ? result.alignment.state === "failed" ? "failure" : result.alignment.state === "pending" ? "unresolved" : "ok" : void 0;
+  const runs = result.deploy ? [{ workflow: result.deploy.workflow ?? "jerv-gateway", conclusion: result.deploy.state === "complete" ? "success" : result.deploy.state === "failed" ? "failure" : "pending" }] : void 0;
+  return {
+    ...result,
+    ...deployNote ? { deployNote } : {},
+    ...foldNote ? { foldNote } : {},
+    ...foldStatus ? { foldStatus } : {},
+    ...runs ? { runs } : {},
+    ...report ? { ledger: report } : {}
+  };
+}
 function deriveHotfixState(f) {
   if (!f.branchExists && !f.pr && !f.tagPushed && !f.releaseExists) {
     return { state: "not-started", next: `mmi-cli devops hotfix start --from <pr#|sha> (would mint ${f.tag})` };
@@ -45117,7 +45652,7 @@ async function announceSummaryRefusal(path2) {
 function trainApplyDeps() {
   return {
     run: async (file, args) => {
-      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && args[0] === "scripts/jerv-gateway-release-deploy.sh" ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
+      const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
       try {
         return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, args, { timeout })).stdout;
       } catch (e) {
@@ -45227,7 +45762,7 @@ function trainApplyDeps() {
 }
 function formatWorkflowRun(r) {
   const evidenced = workflowRunWithEvidence(r);
-  return `${evidenced.workflow} ${evidenced.runUrl ?? evidenced.runUrlNote} ${evidenced.conclusion.toUpperCase()}`;
+  return `${evidenced.workflow} ${evidenced.runUrl ?? evidenced.runUrlNote} ${evidenced.conclusion.toUpperCase()}${r.parallel ? " (parallel)" : ""}`;
 }
 function renderDeployLine(d) {
   const parts = [d.dispatch];
@@ -45792,6 +46327,14 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const evidenced = hotfixRunWithEvidence(run);
     return `  - ${evidenced.workflow}: ${evidenced.conclusion}${evidenced.conclusion === "failure" ? " \u2014 error: workflow reported failure" : ""} (${evidenced.url ?? evidenced.runUrlNote})`;
   }
+  function renderHotfixRetryDeploy(r) {
+    return [
+      `mmi-cli devops hotfix release --retry-deploy: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}`,
+      ...r.deployNote ? [`  - deploy: ${r.deployNote}`] : [],
+      ...r.foldNote ? [`  - fold: ${r.foldNote}`] : [],
+      ...r.ledger ? formatReleaseLedgerReport(r.ledger).map((line) => `  ${line}`) : []
+    ].join("\n");
+  }
   function renderHotfixRelease(r) {
     return [
       `mmi-cli devops hotfix release: ${r.tag} at ${r.mergedSha.slice(0, 7)} on ${r.repo} (deployModel=${r.deployModel})`,
@@ -45864,12 +46407,20 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const steps = trainPlan("hotfix");
     console.log(o.json ? JSON.stringify({ command: "hotfix", steps }, null, 2) : renderSteps("mmi-cli devops hotfix: dry-run plan", steps));
   });
-  hotfixCmd.command("start").description("cherry-pick one or more merged development PRs (or SHAs) onto hotfix/vX.Y.Z from origin/main, bump the distribution, open the main-base PR").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR number(s) or commit SHA(s) to cherry-pick, in pick order \u2014 one hotfix cycle carries as many fixes as you name (#4411)").option("--json", "machine-readable output").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (o) => runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from }), o, renderHotfixStart));
-  hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => runHotfixSub("release", async () => {
-    const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [] });
-    const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
-    return { ...result, projectInfoSync };
-  }, o, renderHotfixRelease));
+  hotfixCmd.command("start").description("cherry-pick one or more merged development PRs (or SHAs) onto hotfix/vX.Y.Z from origin/main, bump the distribution, open the main-base PR").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR number(s) or commit SHA(s) to cherry-pick, in pick order \u2014 one hotfix cycle carries as many fixes as you name (#4411)").option("--ack <shas>", "comma-separated dev shas a human verified are NOT needed on main, overriding the pick-completeness guard for exactly those fixes \u2014 recorded in the PR body, never silent (#6994)").option("--json", "machine-readable output").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (o) => runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from, ack: o.ack ? o.ack.split(",").map((s) => s.trim()).filter(Boolean) : void 0 }), o, renderHotfixStart));
+  hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--retry-deploy", "re-run only the failed deploy and/or fold-port alignment legs of a published hotfix of this same tag (#6985)").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => {
+    if (o.retryDeploy) {
+      if (o.announceSummaryFile || o.carries) {
+        return fail("hotfix release: --retry-deploy accepts only --json and --out; it re-runs failed deploy/alignment legs of the published tag and does not recut");
+      }
+      return runHotfixSub("retry-deploy", () => runHotfixRetryDeploy(trainApplyDeps(), version), o, renderHotfixRetryDeploy);
+    }
+    return runHotfixSub("release", async () => {
+      const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [] });
+      const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
+      return { ...result, projectInfoSync };
+    }, o, renderHotfixRelease);
+  });
   function hotfixStatusDeps() {
     const STATUS_GH_MS = 8e3;
     const STATUS_GIT_MS = 1e4;
@@ -45911,7 +46462,7 @@ function envHealLockPath(home) {
 async function withEnvHealLock(what, run) {
   try {
     return await withFileLock(
-      envHealLockPath((0, import_node_os21.homedir)()),
+      envHealLockPath((0, import_node_os22.homedir)()),
       { staleMs: ENV_HEAL_LOCK_STALE_MS, maxWaitMs: ENV_HEAL_LOCK_MAX_WAIT_MS, label: "mmi env-heal lock" },
       run
     );
@@ -46008,7 +46559,7 @@ function mmiDoctorDeps(opts = {}) {
       const configRoot = surfaceConfigRoot(surface);
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const plan = buildPluginCachePlan(
-        (0, import_node_os21.homedir)(),
+        (0, import_node_os22.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex" }
@@ -46036,7 +46587,7 @@ function mmiDoctorDeps(opts = {}) {
       const running = surface === "codex" ? installedActivePluginVersion(surface) : runningPluginVersion(process.env, resolveClientVersion());
       const installed = installedActivePluginVersion(surface);
       const plan = buildPluginCachePlan(
-        (0, import_node_os21.homedir)(),
+        (0, import_node_os22.homedir)(),
         running,
         pluginCacheFsDeps(configRoot, () => 0),
         { configRoot, includeStaging: surface !== "codex", installedVersion: installed }
@@ -47261,7 +47812,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     return;
   }
   const plan = buildPluginCachePlan(
-    (0, import_node_os21.homedir)(),
+    (0, import_node_os22.homedir)(),
     running,
     pluginCacheFsDeps(configRoot, directoryBytes),
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }