@mutmutco/cli 4.4.17 → 4.5.0

package/dist/main.cjs

@@ -6245,6 +6245,44 @@ function collectPullRequestWorkflowContexts(workflows) {
   }
   return [...contexts].sort((a, b) => a.localeCompare(b));
 }
+function jobNeeds(job) {
+  const lines2 = job.body.split(/\r?\n/).slice(1);
+  const at = lines2.findIndex((line) => /^\s+needs:/.test(line));
+  if (at < 0) return [];
+  const indent = lines2[at].match(/^(\s*)/)?.[1].length ?? 0;
+  const inline = lines2[at].replace(/^\s*needs:\s*/, "").replace(/#.*$/, "").trim();
+  if (inline) return inline.replace(/^\[|\]$/g, "").split(",").map(unquote).filter(Boolean);
+  const items = [];
+  for (const line of lines2.slice(at + 1)) {
+    if (!line.trim()) continue;
+    if ((line.match(/^(\s*)/)?.[1].length ?? 0) <= indent) break;
+    items.push(unquote(line.replace(/^\s*-\s*/, "")));
+  }
+  return items.filter(Boolean);
+}
+function unquote(s) {
+  return s.replace(/#.*$/, "").trim().replace(/^['"]|['"]$/g, "");
+}
+function unblockingGateJobs(workflows, required) {
+  const unblocking = /* @__PURE__ */ new Set();
+  for (const wf of workflows) {
+    if (!workflowTriggersPullRequest(wf.body)) continue;
+    const jobs = parseWorkflowJobs(wf.body);
+    const needs = new Map(jobs.map((job) => [job.id, jobNeeds(job)]));
+    const covered = /* @__PURE__ */ new Set();
+    const stack = jobs.map((job) => job.id).filter((id) => required.has(id));
+    while (stack.length) {
+      const id = stack.pop();
+      if (covered.has(id)) continue;
+      covered.add(id);
+      stack.push(...needs.get(id) ?? []);
+    }
+    for (const job of jobs) {
+      if (!covered.has(job.id) && jobReportsPullRequestCheck(job)) unblocking.add(job.id);
+    }
+  }
+  return [...unblocking].sort((a, b) => a.localeCompare(b));
+}
 function pathFilteredPullRequestWorkflows(workflows) {
   const filtered = [];
   for (const wf of workflows) {
@@ -15938,10 +15976,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.4.17",
-    tag: "v4.4.17",
-    commit: "748489250635",
-    npm: "@mutmutco/cli@4.4.17"
+    version: "4.5.0",
+    tag: "v4.5.0",
+    commit: "e9c83872b853",
+    npm: "@mutmutco/cli@4.5.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15958,14 +15996,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.4.17"
+          v3Target: "v4.5.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.4.17 and redeploy the Hub Lambda from tag v4.4.17 (748489250635); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.4.17 (@mutmutco/cli@4.4.17, tag commit 748489250635 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.0 and redeploy the Hub Lambda from tag v4.5.0 (e9c83872b853); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.0 (@mutmutco/cli@4.5.0, tag commit e9c83872b853 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18487,6 +18525,13 @@ async function awaitAlignmentLanded(deps, ctx, leg, base, opts = {}) {
     await sleep2(ALIGNMENT_LAND_POLL_MS);
   }
 }
+async function awaitAlignmentsLanded(deps, ctx, legs) {
+  const [dev, rc] = await Promise.all([
+    awaitAlignmentLanded(deps, ctx, legs.dev, "development"),
+    legs.rc ? awaitAlignmentLanded(deps, ctx, legs.rc, "rc") : void 0
+  ]);
+  return { dev, ...rc ? { rc } : {} };
+}
 async function alignRcForward(deps, ctx, tag) {
   deps.warn?.("Release: Bringing the release candidate up to date");
   await runGitRemoteRead(deps, ["fetch", "origin", "main", "rc"]);
@@ -18889,6 +18934,12 @@ async function observePublishIfRequired(deps, ctx, meta, model, stage, releaseSh
     deployStatus: aggregateWorkflowRuns(workflowRuns)
   };
 }
+async function joinDeployAndPublish(deploy, publish) {
+  const [d, p] = await Promise.all([deploy, publish]);
+  if (!p) return [d, p];
+  const mark = (x) => x.workflowRuns ? { ...x, workflowRuns: x.workflowRuns.map((r) => ({ ...r, parallel: true })) } : x;
+  return [mark(d), mark(p)];
+}
 function appendPublishDispatch(deploy, publish) {
   if (!publish) return deploy;
   return {
@@ -19053,19 +19104,29 @@ async function appendServedChannelPublish(deps, input, dispatch) {
     };
   }
   const probe = await (deps.readServedChannelVersion ?? fetchServedChannelVersion)(channelUrl);
+  const evidence = (conclusion, text) => [...runs, servedChannelRow(HUB_SERVED_PRODUCT, conclusion, text)];
+  if (!probe.ok && staleServedProcess(probe)) {
+    const redeploy = mmiGetRedeployCommand(input.repo);
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; get-publish.yml succeeded but ${channelUrl} answered HTTP ${probe.status} \u2014 STALE SERVED PROCESS: the files may be current, but the process serving them predates GET /release/version; recover with \`${redeploy}\``,
+      workflowRuns: evidence("failure", `${channelUrl} answered HTTP ${probe.status} (stale served process)`),
+      deployStatus: "failure"
+    };
+  }
   if (!probe.ok) {
     const why = probe.error ?? `HTTP ${probe.status ?? "unknown"}`;
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded but the served channel version could NOT be read at ${channelUrl} (${why}) \u2014 the move is unverified`,
-      workflowRuns: runs
+      workflowRuns: evidence("pending", `${channelUrl} unreadable (${why})`)
     };
   }
   if (expected && probe.version !== expected) {
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded but the served channel still reports ${probe.version} (expected launcher ${expected}) \u2014 THE CHANNEL DID NOT MOVE; recover with \`${remedy}\``,
-      workflowRuns: runs,
+      workflowRuns: evidence("failure", `${channelUrl} reports ${probe.version}, expected ${expected}`),
       deployStatus: "failure"
     };
   }
@@ -19073,15 +19134,88 @@ async function appendServedChannelPublish(deps, input, dispatch) {
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded and ${channelUrl} reports ${probe.version}, but the local launcher version could not be read \u2014 nothing was compared, so the move is unverified`,
-      workflowRuns: runs
+      workflowRuns: evidence("pending", `${channelUrl} reports ${probe.version}; nothing to compare against`)
     };
   }
   return {
     ...dispatch,
     note: `${dispatch.note}; served channel moved \u2014 ${channelUrl} now reports ${probe.version}`,
-    workflowRuns: runs
+    workflowRuns: evidence("success", `${channelUrl} reports ${probe.version}`)
   };
 }
+function staleServedProcess(probe) {
+  return probe.status === 401 || probe.status === 403 || probe.status === 404;
+}
+function servedChannelRow(product, conclusion, evidence) {
+  return { workflow: `served-channel(${product})`, runUrlNote: evidence, conclusion };
+}
+var JERV_GATEWAY_REMEDY = "from the Jerv-Hub checkout, re-run the Gateway deploy on its current release tag: `bash scripts/jerv-gateway-release-deploy.sh --tag <jerv-hub tag>`";
+var SERVED_CHANNELS = {
+  "mutmutco/mm-strategy": {
+    product: "mm-strategy",
+    url: "https://strategy.mutmut.work/release/version",
+    mover: "the MM-Strategy container deploy (the running server's own version is the pointer)",
+    remedy: "`mmi-cli devops runtime tenant redeploy mutmutco/MM-Strategy main`"
+  },
+  "mutmutco/jerv-hub": {
+    product: "jerv",
+    url: "https://get.jerv.ai/jerv/release/version",
+    mover: "the Jerv Gateway deploy (`jerv-gate fetch-release --product jerv`)",
+    remedy: JERV_GATEWAY_REMEDY
+  },
+  "mutmutco/jerv-jervcode": {
+    product: "jervcode",
+    url: "https://get.jerv.ai/jervcode/release/version",
+    mover: "the Jerv Gateway deploy, which fetches JervCode's latest release \u2014 a JervCode release alone does not move it",
+    remedy: JERV_GATEWAY_REMEDY
+  }
+};
+function servedChannelFor(repo) {
+  return SERVED_CHANNELS[repo.toLowerCase()];
+}
+var SERVED_CHANNEL_PROBE_ATTEMPTS = 3;
+var SERVED_CHANNEL_PROBE_BACKOFF_MS = 1e4;
+async function appendServedChannelProof(deps, input, dispatch) {
+  const channel = servedChannelFor(input.repo);
+  if (!channel) return dispatch;
+  const expected = input.tag.replace(/^v/, "");
+  const withProof = (conclusion, evidence, note, failed = false) => ({
+    ...dispatch,
+    note: `${dispatch.note}; ${note}`,
+    workflowRuns: [...dispatch.workflowRuns ?? [], servedChannelRow(channel.product, conclusion, evidence)],
+    ...failed ? { deployStatus: "failure" } : {}
+  });
+  if (!input.shipped) {
+    return withProof("pending", `${channel.url} not probed`, `served channel ${channel.url} not probed \u2014 deploy/publish are not proven green, so it is not expected to have moved`);
+  }
+  const read = deps.readServedChannelVersion ?? fetchServedChannelVersion;
+  let probe = await read(channel.url);
+  for (let attempt = 1; attempt < SERVED_CHANNEL_PROBE_ATTEMPTS && probe.ok && probe.version !== expected; attempt++) {
+    await (deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(SERVED_CHANNEL_PROBE_BACKOFF_MS * attempt);
+    probe = await read(channel.url);
+  }
+  if (!probe.ok && staleServedProcess(probe)) {
+    return withProof(
+      "failure",
+      `${channel.url} answered HTTP ${probe.status} (stale served process)`,
+      `${channel.url} answered HTTP ${probe.status} \u2014 STALE SERVED PROCESS: the process serving ${channel.product} predates GET /release/version; it moves with ${channel.mover}; recover with ${channel.remedy}`,
+      true
+    );
+  }
+  if (!probe.ok) {
+    const why = probe.error ?? `HTTP ${probe.status ?? "unknown"}`;
+    return withProof("pending", `${channel.url} unreadable (${why})`, `served channel ${channel.url} could NOT be read (${why}) \u2014 the move is unverified`);
+  }
+  if (probe.version !== expected) {
+    return withProof(
+      "failure",
+      `${channel.url} reports ${probe.version}, expected ${expected}`,
+      `served channel ${channel.url} still reports ${probe.version} (expected ${expected}) \u2014 THE CHANNEL DID NOT MOVE: new installs get ${probe.version}; it moves with ${channel.mover}; recover with ${channel.remedy}`,
+      true
+    );
+  }
+  return withProof("success", `${channel.url} reports ${probe.version}`, `served channel moved \u2014 ${channel.url} reports ${probe.version}`);
+}
 var JERV_GATEWAY_RUN_URL_NOTE = "no run URL emitted \u2014 host health leg runs outside GitHub Actions";
 var JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT = "scripts/jerv-gateway-release-deploy.sh";
 async function runTaggedJervGatewayLocalWrapper(deps, tag, tagSha) {
@@ -19141,15 +19275,15 @@ async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch)
   }
 }
 async function watchOwnWorkflowRuns(deps, repo, targets, since, headSha, enumerateSha = false) {
-  const workflowRuns = [];
-  for (const target of targets) {
+  const parallel = targets.length > 1 ? { parallel: true } : {};
+  const workflowRuns = await Promise.all(targets.map(async (target) => {
     try {
       const run = await correlateWorkflowRun(deps, { ...target, since, headSha, repo });
-      workflowRuns.push(await watchWorkflowRun(deps, target.workflow, run, repo));
+      return { ...await watchWorkflowRun(deps, target.workflow, run, repo), ...parallel };
     } catch {
-      workflowRuns.push({ workflow: target.workflow, conclusion: "failure" });
+      return { workflow: target.workflow, conclusion: "failure", ...parallel };
     }
-  }
+  }));
   if (!enumerateSha) return workflowRuns;
   const seen = new Set(workflowRuns.map((r) => r.runId).filter((id) => typeof id === "number"));
   workflowRuns.push(...await discoverShaWorkflowRuns(deps, repo, headSha, seen));
@@ -19204,8 +19338,8 @@ async function vercelDeployDispatch(deps, ctx, ref, watch, headSha) {
   return { note: `${note}; ${detail}`, ...read?.logUrl ? { runUrl: read.logUrl } : {}, workflowRuns: [row(read, deployStatus)], deployStatus };
 }
 function shipLegsGreen(deploy, publish) {
-  const green = (s) => s === "complete" || s === "skipped";
-  return green(deploy?.state) && green(publish?.state);
+  const green = (leg) => leg?.superseded !== true && (leg?.state === "complete" || leg?.state === "skipped");
+  return green(deploy) && green(publish);
 }
 async function announceShippedRelease(deps, args, model, legs, deferred) {
   if (!deps.announce) return void 0;
@@ -21184,7 +21318,9 @@ var TRANSIENT_TRANSPORT_MARKERS = [
   /socket hang ?up/i,
   /remote end hung ?up unexpectedly/i,
   /early EOF/i,
-  /tls handshake timeout/i
+  /tls handshake timeout/i,
+  /kex_exchange_identification: connection closed by remote host/i,
+  /connection closed by remote host/i
 ];
 function classifyTransientTransportFailure(evidence) {
   if (!evidence) return false;
@@ -21855,6 +21991,70 @@ async function healStaleAlignmentLeg(deps, cwd, expected) {
     return prior.tag;
   });
 }
+async function healUnfoldedRunLegs(deps, cwd, model) {
+  const path2 = releaseLedgerPath(cwd);
+  let prior;
+  try {
+    prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const legs = ["deploy", "publish"];
+  const openLeg = (rec) => rec.state === "pending" && rec.superseded !== true;
+  if (!legs.some((phase) => openLeg(prior.phases[phase]))) return void 0;
+  const anchors = { repo: prior.repo, tag: prior.tag, tagSha: prior.tagSha };
+  const folded = [];
+  let current = prior;
+  if (legs.some((phase) => openLeg(prior.phases[phase]) && prior.phases[phase].runId != null)) {
+    let reverified;
+    try {
+      reverified = await reverifyPersistedRunPhases(deps, path2, anchors, { sha: prior.tagSha, repo: prior.repo });
+    } catch {
+      return void 0;
+    }
+    if (!reverified.ledger) return void 0;
+    current = reverified.ledger;
+    for (const phase of legs) {
+      const before = prior.phases[phase];
+      const after = current.phases[phase];
+      if (openLeg(before) && before.runId != null && after.state !== "pending") folded.push({ phase, state: after.state, runId: after.runId });
+    }
+  }
+  const targets = prodReleaseTargets(model);
+  const runless = legs.filter((phase) => openLeg(current.phases[phase]) && current.phases[phase].runId == null);
+  if (runless.length > 0 && targets.length > 0) {
+    let rows;
+    try {
+      rows = await listOwnWorkflowRuns(deps, releaseRunRepoFor(model, prior.repo), targets, prior.tagSha);
+    } catch {
+      rows = [];
+    }
+    const inputs = phaseInputsFromRunRows(model, rows, prior.tagSha, { repo: prior.repo });
+    const foldable = runless.filter((phase) => inputs[phase].runId != null && inputs[phase].state !== "pending");
+    if (foldable.length > 0) {
+      const written = await withReleaseLedger(path2, anchors, (ledger) => {
+        if (!ledger) return { value: [] };
+        const phases = { ...ledger.phases };
+        const done = [];
+        for (const phase of foldable) {
+          const live = phases[phase];
+          if (!openLeg(live) || live.runId != null) continue;
+          const entry = compactEntry(inputs[phase]);
+          phases[phase] = {
+            ...entry,
+            note: `${entry.note ?? `${phase} run on the release SHA`} \u2014 folded by train doctor --heal from the concluded run (#7003)`,
+            retries: live.retries,
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          done.push({ phase, state: entry.state, runId: entry.runId });
+        }
+        return done.length ? { ledger: { ...ledger, phases, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, value: done } : { value: done };
+      }).catch(() => []);
+      folded.push(...written);
+    }
+  }
+  return folded.length ? { tag: prior.tag, folded } : void 0;
+}
 function supersedeableDeployLegShape(rec) {
   return rec.state === "failed" || rec.state === "pending" && rec.runId == null;
 }
@@ -22482,6 +22682,7 @@ var defaultDeps2 = {
     }
   },
   healAlignmentLeg: healStaleAlignmentLeg,
+  healRunLegs: healUnfoldedRunLegs,
   readSurfacesRaw: (cwd) => {
     try {
       return (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(cwd, "surfaces.json"), "utf8");
@@ -22828,6 +23029,21 @@ async function runTrainDoctor(input) {
     try {
       let ledger = parseReleaseLedger(ledgerRaw);
       let derived = deriveReleasePhaseStatus(ledger);
+      const deployModel = typeof meta?.deployModel === "string" && isDeployModel(meta.deployModel) ? meta.deployModel : void 0;
+      if (heal && deployModel && derived.legs.some((l) => (l.phase === "deploy" || l.phase === "publish") && l.state === "pending")) {
+        const run = await deps.healRunLegs(train, cwd, deployModel);
+        if (run) {
+          add({
+            code: "ledger-unfolded",
+            severity: "healed",
+            source: "origin",
+            title: `folded ${run.folded.map((f) => `${f.phase}=${f.state}${f.runId ? ` (run ${f.runId})` : ""}`).join(", ")} into the ${run.tag} ledger from the concluded run(s) on the tag SHA (#7003)`,
+            remedy: "nothing \u2014 the leg now records what GitHub already concluded"
+          });
+          ledger = parseReleaseLedger(deps.readLedgerRaw(ledgerPath) ?? ledgerRaw);
+          derived = deriveReleasePhaseStatus(ledger);
+        }
+      }
       if (heal && derived.phaseStatus === "phases-pending" && derived.legs.every((l) => l.state !== "pending" || l.phase === "alignment")) {
         const closedTag = await deps.healAlignmentLeg(train, cwd);
         if (closedTag) {
@@ -22866,7 +23082,7 @@ async function runTrainDoctor(input) {
           // #6429: each lane finishes its own run (#6068) — an rcand-lane ledger named as a release
           // ledger, with `release --resume` as its remedy, sends the operator to a verb that refuses it.
           title: `a prior ${ledger.lane ?? "release"} ledger for ${ledger.tag} is ${derived.phaseStatus} (${open2}) \u2014 a new train must not stack on it (#5987)`,
-          remedy: failed ? ledgerFailedRemedy(ledger) : `finish it first: ${ledgerLaneResumeCommand(ledger)} (alignment-only pending legs close themselves with \`train doctor --heal\` once the PR merges)${supersession}`
+          remedy: failed ? ledgerFailedRemedy(ledger) : `finish it first: ${ledgerLaneResumeCommand(ledger)} (alignment-only pending legs close themselves with \`train doctor --heal\` once the PR merges, and a deploy/publish leg whose run already concluded folds under the same heal)${supersession}`
         });
       } else if (newestRemoteReleaseTag && newestRemoteReleaseTag !== ledger.tag) {
         add({
@@ -23622,6 +23838,8 @@ async function recoverPhaseWithMaybeTransientRerun(deps, ledger, anchors, phase,
 }
 async function recoverFailedDispatchPhase(deps, ledger, anchors, phase, dispatch, input, recover = recoverPhaseWithMaybeTransientRerun) {
   if (dispatch.deployStatus !== "failure") return dispatch;
+  const persisted = await ledger?.load(anchors).catch(() => void 0);
+  if (persisted?.phases[phase]?.superseded === true) return dispatch;
   let workflowRuns = dispatch.workflowRuns?.length ? [...dispatch.workflowRuns] : void 0;
   const notes = [];
   let fallbackRecovered = false;
@@ -23629,6 +23847,7 @@ async function recoverFailedDispatchPhase(deps, ledger, anchors, phase, dispatch
   if (failedRows.length > 0) {
     for (const failed of failedRows) {
       const rowPhase = failed.workflow.includes("publish") ? "publish" : phase;
+      if (persisted?.phases[rowPhase]?.superseded === true) continue;
       const recovery = await recover(deps, ledger, anchors, rowPhase, {
         repo: input.repo,
         sha: input.sha,
@@ -23803,7 +24022,10 @@ ${recovery.note}`), recoveryInput);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
   let alignment = alignEarly ? await alignEarly() : void 0;
-  const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
+  const [deployDispatch0, publishDispatch0] = await joinDeployAndPublish(
+    dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir),
+    observePublishIfRequired(deps, ctx, meta, deployModel, "main", releaseSha, watch)
+  );
   const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
   const failedReleaseRun = deployDispatch0.workflowRuns?.find((run) => run.conclusion === "failure");
   const dispatchFailurePhase = failedReleaseRun?.workflow === "publish.yml" || deployModel === "registry-publish" ? "publish" : "deploy";
@@ -23825,7 +24047,6 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", deployLeg, {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
-  const publishDispatch0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", releaseSha, watch);
   const publishDispatch = publishDispatch0 ? await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -23841,6 +24062,14 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "publish", publishLeg, {
     landed: "the immutable tag, the green required-check wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
+  const announcing = announceShippedRelease(
+    deps,
+    { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
+    deployModel,
+    { deploy: deployLeg, publish: publishLeg },
+    releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
+  );
+  const aligning = watch && alignment ? awaitAlignmentsLanded(deps, ctx, alignment) : Promise.resolve(alignment);
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   dispatch = await appendMmiGetRedeploy(
     deps,
@@ -23852,19 +24081,8 @@ ${recovery.note}`), recoveryInput);
     { repo: ctx.repo, publishStatus: publishLeg.state === "complete" ? "success" : "failure", watch },
     dispatch
   );
-  const announcing = announceShippedRelease(
-    deps,
-    { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
-    deployModel,
-    { deploy: deployLeg, publish: publishLeg },
-    releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
-  );
-  if (watch && alignment) {
-    alignment = {
-      dev: await awaitAlignmentLanded(deps, ctx, alignment.dev, "development"),
-      ...alignment.rc ? { rc: await awaitAlignmentLanded(deps, ctx, alignment.rc, "rc") } : {}
-    };
-  }
+  dispatch = await appendServedChannelProof(deps, { repo: ctx.repo, tag, shipped: shipLegsGreen(deployLeg, publishLeg) }, dispatch);
+  alignment = await aligning;
   const announceNote = await announcing;
   return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors, ...alignment ? { alignment } : {} };
 }
@@ -24180,6 +24398,8 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       dispatch2.deployStatus = historicalDeploy;
       dispatch2.note = `historical ${deployModel} deploy/publish status: ${historicalDeploy}; ${companion.note}`;
     }
+    if (persisted?.phases.deploy.superseded === true) phaseInputs.deploy = persisted.phases.deploy;
+    if (persisted?.phases.publish.superseded === true) phaseInputs.publish = persisted.phases.publish;
     if (persisted) {
       if (persisted.phases.deploy.superseded !== true) {
         await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(phaseInputs.deploy), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
@@ -24191,7 +24411,8 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
     }
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
-    const announceNote2 = persisted && !shippedBefore && persisted.phases.deploy.superseded !== true && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
+    const settledBySupersede = persisted?.phases.deploy.superseded === true || persisted?.phases.publish.superseded === true;
+    const announceNote2 = persisted && !shippedBefore && !settledBySupersede && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
       deps,
       { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
       deployModel,
@@ -24281,7 +24502,10 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, runUrl: releaseUrl, note: "verified the Release published against the tagged commit" }), { strict: ledgerMode === "strict", landed: "the immutable tag, the re-proven wall, and the origin/main push" });
   let devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   let rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
-  const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
+  const [deployDispatch0, publishDispatch0] = await joinDeployAndPublish(
+    dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir),
+    observePublishIfRequired(deps, ctx, meta, deployModel, "main", tagSha, watch)
+  );
   const recoveredDeployDispatch = await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -24297,12 +24521,13 @@ ${recovery.note}`), recoveryInput);
   );
   const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch);
   steps.push(`dispatched the ${deployModel} deploy path`);
-  const deployLeg = phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
-  await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
-    strict: ledgerMode === "strict",
-    landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
-  });
-  const publishDispatch0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", tagSha, watch);
+  const deployLeg = persisted?.phases.deploy.superseded === true ? persisted.phases.deploy : phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
+  if (persisted?.phases.deploy.superseded !== true) {
+    await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
+      strict: ledgerMode === "strict",
+      landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
+    });
+  }
   const publishDispatch = publishDispatch0 ? await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -24311,11 +24536,13 @@ ${recovery.note}`), recoveryInput);
     publishDispatch0,
     { repo: ctx.repo, sha: tagSha, watched: false, workflow: "publish.yml" }
   ) : null;
-  const publishLeg = phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo }));
-  await recordPhase(ledger, deps, anchors, "publish", publishLeg, {
-    strict: ledgerMode === "strict",
-    landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
-  });
+  const publishLeg = persisted?.phases.publish.superseded === true ? persisted.phases.publish : phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo }));
+  if (persisted?.phases.publish.superseded !== true) {
+    await recordPhase(ledger, deps, anchors, "publish", publishLeg, {
+      strict: ledgerMode === "strict",
+      landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
+    });
+  }
   const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   const announcing = announceShippedRelease(
     deps,
@@ -24325,8 +24552,9 @@ ${recovery.note}`), recoveryInput);
     releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
   );
   if (watch) {
-    devRollForward = await awaitAlignmentLanded(deps, ctx, devRollForward, "development");
-    if (rcAlignment) rcAlignment = await awaitAlignmentLanded(deps, ctx, rcAlignment, "rc");
+    const landed = await awaitAlignmentsLanded(deps, ctx, { dev: devRollForward, rc: rcAlignment });
+    devRollForward = landed.dev;
+    rcAlignment = landed.rc;
   }
   const announceNote = await announcing;
   steps.push(`development roll-forward: ${devRollForward.status}`);
@@ -24981,6 +25209,7 @@ var RULESET_TEMPLATE_SEED = "seed:mmi-product-required-checks.template.json";
 var RULESET_REFERENCE_MATCH_LABEL = "committed ruleset reference matches the live ruleset (#3816)";
 var GATE_GREEN_ON_BASE_LABEL = "gate is green on the default branch (#3819)";
 var REQUIRED_CONTEXTS_EMITTED_LABEL = "required check contexts match PR workflows";
+var UNBLOCKING_GATE_JOBS_LABEL = "every gate job can block a merge (#7012)";
 var TAG_ADDRESSABLE_CONTEXTS_LABEL = "rc/main required contexts are tag-addressable (#3880)";
 var RELEASE_BRANCH_REACHABLE_LABEL = "rc/main required contexts are reachable from a release-base head (#5193)";
 var RULESET_TRACK_SCOPE_LABEL = "product ruleset branch scope covers the release track (#6327)";
@@ -25413,6 +25642,17 @@ async function auditRepoCi(repo, deps) {
           remediation: missingEmitters.length ? `Fix the pull_request workflows or ${contextAuthority.source} before reconciling` : void 0
         });
       }
+      if (hasRequiredChecks) {
+        const gateFiles = new Set(gateWorkflowFiles(prWorkflowPaths));
+        const gateWorkflows = (await getBranchWorkflows() ?? []).filter((wf) => gateFiles.has(wf.path.slice(wf.path.lastIndexOf("/") + 1)));
+        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job));
+        checks.push({
+          ok: unblocking.length === 0,
+          label: UNBLOCKING_GATE_JOBS_LABEL,
+          detail: unblocking.length ? `gate job(s) [${unblocking.join(", ")}] run on every PR but are neither required nor needed by a required job (required: [${liveContexts.join(", ")}]) \u2014 a red one still merges and turns ${baseBranch} red for every later PR` : void 0,
+          remediation: unblocking.length ? `mmi-cli oracle org project set ${repo} --var requiredChecks=${JSON.stringify(sortedUnique([...liveContexts, ...unblocking]))} then mmi-cli devops ci reconcile --repo ${repo} --apply \u2014 or make a required job \`needs:\` them` : void 0
+        });
+      }
       const prOnly = contextAuthority.coversReleaseBranches ? contextAuthority.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context)) : [];
       const tagBlind = contextAuthority.coversReleaseBranches ? contextsUnreachableOnTagPush(contextAuthority.contexts, await getBranchWorkflows() ?? [], TRAIN_PR_ONLY_CONTEXTS) : [];
       checks.push({
@@ -43998,6 +44238,32 @@ function formatHotfixBatchPreflightRefusal(failures, fromSpecs) {
 ${lines2.join("\n")}
 Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
 }
+var CHERRY_PICKED_FROM = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
+async function findHotfixPickGaps(deps, sources, tolerated) {
+  if (sources.length === 0) return [];
+  const namedShas = new Set(sources.map((s) => s.sha.toLowerCase()));
+  const carried = /* @__PURE__ */ new Set();
+  const mainOnly = await deps.run("git", ["log", "--no-merges", "--format=%B", "origin/development..origin/main"]);
+  for (const m of mainOnly.matchAll(CHERRY_PICKED_FROM)) carried.add(m[1].toLowerCase());
+  const gaps = [];
+  const devOnly = (await deps.run("git", ["log", "--no-merges", "--reverse", "--format=%H%x09%s", "origin/main..origin/development"])).split("\n").map((s) => s.trim()).filter(Boolean);
+  for (const line of devOnly) {
+    const [sha, ...subjectParts] = line.split("	");
+    if (!sha) continue;
+    const lower = sha.toLowerCase();
+    if (namedShas.has(lower) || carried.has(lower)) continue;
+    const paths = (await deps.run("git", ["show", "--no-color", "--name-only", "--pretty=format:", sha])).split("\n").map((s) => s.trim()).filter(Boolean);
+    if (paths.length === 0 || paths.every((p) => pathIsTolerated(p, tolerated))) continue;
+    gaps.push({ sha, subject: subjectParts.join("	") });
+  }
+  return gaps;
+}
+function formatHotfixPickGapRefusal(gaps, tag, fromSpecs) {
+  const lines2 = gaps.map((g) => `  - ${g.sha.slice(0, 7)} ${g.subject}`);
+  return `hotfix start refused: ${tag} would omit ${gaps.length} merged development fix(es) not on origin/main:
+${lines2.join("\n")}
+A hotfix branch is cut from origin/main and carries ONLY the fixes --from names, in order (#4411) \u2014 every other merged development fix stays unshipped while the channel reports healthy (#6994). Add each omitted fix to the pick list and rerun \`mmi-cli devops hotfix start --from ${[...fromSpecs, ...gaps.map((g) => g.sha.slice(0, 7))].join(",")}\`, or, when a listed fix is provably not needed on main (a development-only change, already superseded), rerun with \`--ack ${gaps.map((g) => g.sha.slice(0, 7)).join(",")}\` naming exactly the sha(s) a human excluded \u2014 the ack is recorded in the PR body, never silent.`;
+}
 async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return [];
   const startBranch = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
@@ -44184,6 +44450,18 @@ async function runHotfixStart(deps, options, doctor = runTrainDoctor) {
   }
   const label = sources.map((s) => s.label).join(", ");
   const { foldPaths, pickTolerated } = await resolveHotfixPickTolerated(deps, deployModel);
+  const ackedShas = (options.ack ?? []).map((a) => a.trim().toLowerCase()).filter(Boolean);
+  const pickGaps = await findHotfixPickGaps(deps, sources, pickTolerated);
+  const unacked = pickGaps.filter((g) => {
+    const sha = g.sha.toLowerCase();
+    return !ackedShas.some((a) => sha.startsWith(a) || a.startsWith(sha));
+  });
+  if (unacked.length > 0) {
+    throw new Error(formatHotfixPickGapRefusal(unacked, tag, specs));
+  }
+  if (pickGaps.length > 0) {
+    notes.push(`pick-completeness ack: excluded ${pickGaps.map((g) => `${g.sha.slice(0, 7)} ${g.subject}`).join("; ")} by --ack (#6994)`);
+  }
   const remoteBranch = clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   if (remoteBranch) {
     await deps.run("git", ["checkout", branch]);
@@ -44248,7 +44526,9 @@ async function runHotfixStart(deps, options, doctor = runTrainDoctor) {
     "--body",
     `Hotfix ${tag}: cherry-pick of ${label} onto origin/main${bumpNote}.
 
-<!-- mmi-hotfix-carries: ${sources.map((s) => s.sha).join(",")} -->
+<!-- mmi-hotfix-carries: ${sources.map((s) => s.sha).join(",")} -->${pickGaps.length > 0 ? `
+
+<!-- mmi-hotfix-acked-excluded: ${pickGaps.map((g) => g.sha).join(",")} (#6994 pick-completeness) -->` : ""}
 
 Merge this PR (human-initiated), then run \`mmi-cli devops hotfix release ${tag}\`.`
   ]));
@@ -44638,9 +44918,9 @@ ${decision.note}`);
   let deployNote;
   let tenantPublishDispatch = null;
   if (deployModel === "hub-serverless") {
-    for (const workflow of HOTFIX_RELEASE_WORKFLOWS) {
-      const watched = await watchReleaseRun(deps, ctx, workflow, mergedSha);
-      runs.push(await recoverHotfixReleaseRun(deps, ledger, anchors, ctx, deployModel, workflow === "publish.yml" ? "publish" : "deploy", watched));
+    const watchedRuns = await Promise.all(HOTFIX_RELEASE_WORKFLOWS.map((workflow) => watchReleaseRun(deps, ctx, workflow, mergedSha)));
+    for (const watched of watchedRuns) {
+      runs.push(await recoverHotfixReleaseRun(deps, ledger, anchors, ctx, deployModel, watched.workflow === "publish.yml" ? "publish" : "deploy", watched));
     }
     deployNote = "watched release-triggered deploy.yml + publish.yml";
   } else if (deployModel === "registry-publish") {
@@ -44649,17 +44929,9 @@ ${decision.note}`);
     runs.push(run);
     deployNote = "watched this repo's own release-triggered publish.yml (#2428 \u2014 no central dispatch)";
   } else if (deployModel === "tenant-container" || deployModel === "solo-container") {
-    const deploy0 = await dispatchDeploy(
-      deps,
-      ctx,
-      "main",
-      "main",
-      deployModel,
-      true,
-      (deps.now ?? Date.now)(),
-      mergedSha,
-      "report",
-      meta.publishDir
+    const [deploy0, publish0] = await joinDeployAndPublish(
+      dispatchDeploy(deps, ctx, "main", "main", deployModel, true, (deps.now ?? Date.now)(), mergedSha, "report", meta.publishDir),
+      observePublishIfRequired(deps, ctx, meta, deployModel, "main", mergedSha, true)
     );
     const deploy = await recoverFailedDispatchPhase(
       deps,
@@ -44669,7 +44941,6 @@ ${decision.note}`);
       deploy0,
       { repo: releaseRunRepoFor(deployModel, ctx.repo), sha: mergedSha, watched: true, workflow: "tenant-deploy.yml" }
     );
-    const publish0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", mergedSha, true);
     const publish = publish0 ? await recoverFailedDispatchPhase(
       deps,
       ledger,
@@ -45491,7 +45762,7 @@ function trainApplyDeps() {
 }
 function formatWorkflowRun(r) {
   const evidenced = workflowRunWithEvidence(r);
-  return `${evidenced.workflow} ${evidenced.runUrl ?? evidenced.runUrlNote} ${evidenced.conclusion.toUpperCase()}`;
+  return `${evidenced.workflow} ${evidenced.runUrl ?? evidenced.runUrlNote} ${evidenced.conclusion.toUpperCase()}${r.parallel ? " (parallel)" : ""}`;
 }
 function renderDeployLine(d) {
   const parts = [d.dispatch];
@@ -46136,7 +46407,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const steps = trainPlan("hotfix");
     console.log(o.json ? JSON.stringify({ command: "hotfix", steps }, null, 2) : renderSteps("mmi-cli devops hotfix: dry-run plan", steps));
   });
-  hotfixCmd.command("start").description("cherry-pick one or more merged development PRs (or SHAs) onto hotfix/vX.Y.Z from origin/main, bump the distribution, open the main-base PR").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR number(s) or commit SHA(s) to cherry-pick, in pick order \u2014 one hotfix cycle carries as many fixes as you name (#4411)").option("--json", "machine-readable output").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (o) => runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from }), o, renderHotfixStart));
+  hotfixCmd.command("start").description("cherry-pick one or more merged development PRs (or SHAs) onto hotfix/vX.Y.Z from origin/main, bump the distribution, open the main-base PR").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR number(s) or commit SHA(s) to cherry-pick, in pick order \u2014 one hotfix cycle carries as many fixes as you name (#4411)").option("--ack <shas>", "comma-separated dev shas a human verified are NOT needed on main, overriding the pick-completeness guard for exactly those fixes \u2014 recorded in the PR body, never silent (#6994)").option("--json", "machine-readable output").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (o) => runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from, ack: o.ack ? o.ack.split(",").map((s) => s.trim()).filter(Boolean) : void 0 }), o, renderHotfixStart));
   hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--retry-deploy", "re-run only the failed deploy and/or fold-port alignment legs of a published hotfix of this same tag (#6985)").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => {
     if (o.retryDeploy) {
       if (o.announceSummaryFile || o.carries) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.4.17",
+  "version": "4.5.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",