@mutmutco/cli 4.4.17 → 4.5.1

package/dist/main.cjs

@@ -757,7 +757,7 @@ var init_house_map = __esm({
     "use strict";
     HOUSE_ROOTS = ["oracle", "harbour", "devops", "vault", "learning"];
     COMPAT_SHIM_DEATH_WAVE = "Wave 3";
-    FLAT_ALIAS_CUT_NOTE = `flat Wave 0 alias \u2014 removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); only the canonical house-prefixed path parses`;
+    FLAT_ALIAS_CUT_NOTE = `flat Wave 0 alias \u2014 no longer advertised since ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); it still runs with a notice naming the canonical house-prefixed path (#7034)`;
     HOUSE_QUESTIONS = {
       oracle: "Is it live?",
       harbour: "Is it bounded?",
@@ -6245,6 +6245,44 @@ function collectPullRequestWorkflowContexts(workflows) {
   }
   return [...contexts].sort((a, b) => a.localeCompare(b));
 }
+function jobNeeds(job) {
+  const lines2 = job.body.split(/\r?\n/).slice(1);
+  const at = lines2.findIndex((line) => /^\s+needs:/.test(line));
+  if (at < 0) return [];
+  const indent = lines2[at].match(/^(\s*)/)?.[1].length ?? 0;
+  const inline = lines2[at].replace(/^\s*needs:\s*/, "").replace(/#.*$/, "").trim();
+  if (inline) return inline.replace(/^\[|\]$/g, "").split(",").map(unquote).filter(Boolean);
+  const items = [];
+  for (const line of lines2.slice(at + 1)) {
+    if (!line.trim()) continue;
+    if ((line.match(/^(\s*)/)?.[1].length ?? 0) <= indent) break;
+    items.push(unquote(line.replace(/^\s*-\s*/, "")));
+  }
+  return items.filter(Boolean);
+}
+function unquote(s) {
+  return s.replace(/#.*$/, "").trim().replace(/^['"]|['"]$/g, "");
+}
+function unblockingGateJobs(workflows, required) {
+  const unblocking = /* @__PURE__ */ new Set();
+  for (const wf of workflows) {
+    if (!workflowTriggersPullRequest(wf.body)) continue;
+    const jobs = parseWorkflowJobs(wf.body);
+    const needs = new Map(jobs.map((job) => [job.id, jobNeeds(job)]));
+    const covered = /* @__PURE__ */ new Set();
+    const stack = jobs.map((job) => job.id).filter((id) => required.has(id));
+    while (stack.length) {
+      const id = stack.pop();
+      if (covered.has(id)) continue;
+      covered.add(id);
+      stack.push(...needs.get(id) ?? []);
+    }
+    for (const job of jobs) {
+      if (!covered.has(job.id) && jobReportsPullRequestCheck(job)) unblocking.add(job.id);
+    }
+  }
+  return [...unblocking].sort((a, b) => a.localeCompare(b));
+}
 function pathFilteredPullRequestWorkflows(workflows) {
   const filtered = [];
   for (const wf of workflows) {
@@ -14979,6 +15017,26 @@ async function installAppFoldDeps(deps) {
   }
   await deps.run("npm", lockListing.trim() ? ["ci"] : ["install"]);
 }
+var SHARED_INSTALLER_PACKAGES = ["@mutmutco/installer-face", "@mutmutco/installer-launcher", "@mutmutco/installer-gate"];
+async function refreshSharedInstallerDeps(deps) {
+  let declared;
+  try {
+    const lock = JSON.parse(await deps.run("git", ["show", "HEAD:package-lock.json"]));
+    const present = Object.keys(lock.packages ?? {});
+    declared = SHARED_INSTALLER_PACKAGES.filter((name) => present.some((key) => key === `node_modules/${name}` || key.endsWith(`/node_modules/${name}`)));
+  } catch {
+    return null;
+  }
+  if (declared.length === 0) return null;
+  try {
+    await deps.run("npm", ["update", ...declared, "--package-lock-only", "--no-audit", "--no-fund"]);
+  } catch (e) {
+    const why = e instanceof Error ? e.message.split("\n")[0] : String(e);
+    deps.warn?.(`shared installer refresh skipped (${why}) \u2014 shipping the locked versions`);
+    return `shared installer refresh skipped (${why}); the locked ${declared.join(", ")} still satisfy their ranges`;
+  }
+  return `shared installer deps refreshed to the newest their ranges allow (${declared.join(", ")})`;
+}
 async function restoreMainNpmPackIdentities(deps, version) {
   const bomPath = "distribution-bom.json";
   let mainListing;
@@ -15133,6 +15191,8 @@ async function foldReleaseVersion(deps, model, tag, foldPaths, sourceCommit = "H
     }
   } else {
     await installAppFoldDeps(deps);
+    const refresh = await refreshSharedInstallerDeps(deps);
+    if (refresh) foldNoteExtra = `; ${refresh}`;
     await deps.run("npm", ["version", version, "--no-git-tag-version", "--allow-same-version"]);
     const patch = Number(version.split(".")[2] ?? "0");
     if (model === "registry-publish" && Number.isFinite(patch) && patch > 0) {
@@ -15938,10 +15998,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.4.17",
-    tag: "v4.4.17",
-    commit: "748489250635",
-    npm: "@mutmutco/cli@4.4.17"
+    version: "4.5.1",
+    tag: "v4.5.1",
+    commit: "489af0245908",
+    npm: "@mutmutco/cli@4.5.1"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15958,14 +16018,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.4.17"
+          v3Target: "v4.5.1"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.4.17 and redeploy the Hub Lambda from tag v4.4.17 (748489250635); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.4.17 (@mutmutco/cli@4.4.17, tag commit 748489250635 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.1 and redeploy the Hub Lambda from tag v4.5.1 (489af0245908); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.1 (@mutmutco/cli@4.5.1, tag commit 489af0245908 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18487,6 +18547,13 @@ async function awaitAlignmentLanded(deps, ctx, leg, base, opts = {}) {
     await sleep2(ALIGNMENT_LAND_POLL_MS);
   }
 }
+async function awaitAlignmentsLanded(deps, ctx, legs) {
+  const [dev, rc] = await Promise.all([
+    awaitAlignmentLanded(deps, ctx, legs.dev, "development"),
+    legs.rc ? awaitAlignmentLanded(deps, ctx, legs.rc, "rc") : void 0
+  ]);
+  return { dev, ...rc ? { rc } : {} };
+}
 async function alignRcForward(deps, ctx, tag) {
   deps.warn?.("Release: Bringing the release candidate up to date");
   await runGitRemoteRead(deps, ["fetch", "origin", "main", "rc"]);
@@ -18734,6 +18801,60 @@ async function resolveRcResumeTag(deps, base, sha, probed) {
   return { tag: newest, note };
 }
 
+// ../infra/installer-families.mjs
+var INSTALLER_FAMILIES = ["jerv", "mmi"];
+var INSTALLER_FAMILY_HOSTS = {
+  jerv: "get.jerv.ai",
+  mmi: "get.mutmut.work"
+};
+var INSTALLER_LOGINS = ["github", "google"];
+var PRODUCT_RE = /^[a-z][a-z0-9-]{0,39}$/;
+function expectedInstallerLogin(family, division) {
+  if (family === "jerv") return "github";
+  return String(division ?? "").trim().toLowerCase() === "mmi" ? "github" : "google";
+}
+function installerVersionUrl(installer) {
+  return `https://${INSTALLER_FAMILY_HOSTS[installer.family]}/${installer.product}/release/version`;
+}
+function installerDeclarationError(value, division) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    return "installer must be an object {product, family, login?}";
+  }
+  const record = (
+    /** @type {Record<string, unknown>} */
+    value
+  );
+  for (const key of Object.keys(record)) {
+    if (!["product", "family", "login"].includes(key)) return `installer.${key} is not a field \u2014 expected product, family and optionally login`;
+  }
+  if (typeof record.product !== "string" || !PRODUCT_RE.test(record.product)) {
+    return "installer.product must be a lowercase kebab name (e.g. mm-strategy) \u2014 it is the /<product> path on the family host";
+  }
+  if (!INSTALLER_FAMILIES.includes(
+    /** @type {string} */
+    record.family
+  )) {
+    return `installer.family must be one of: ${INSTALLER_FAMILIES.join(", ")} (jerv \u2192 ${INSTALLER_FAMILY_HOSTS.jerv}, mmi \u2192 ${INSTALLER_FAMILY_HOSTS.mmi})`;
+  }
+  if (record.login !== void 0 && !INSTALLER_LOGINS.includes(
+    /** @type {string} */
+    record.login
+  )) {
+    return `installer.login must be one of: ${INSTALLER_LOGINS.join(", ")}`;
+  }
+  const expected = expectedInstallerLogin(
+    /** @type {'jerv' | 'mmi'} */
+    record.family,
+    division
+  );
+  if (record.login !== void 0 && record.login !== expected) {
+    const who = record.family === "jerv" ? "Jerv products sign in with GitHub" : String(division ?? "").trim().toLowerCase() === "mmi" ? "MMI products sign in with GitHub" : "MM and other Mutatis Mutandis products sign in with Google";
+    return `installer.login ${record.login} breaks the sign-in rule: ${who} (owner ruling 2026-09-23)`;
+  }
+  return null;
+}
+
 // src/tenant-control-parse.ts
 var OUTPUT_BEGIN = "mmi-control-output-begin";
 var OUTPUT_END = "mmi-control-output-end";
@@ -18889,6 +19010,12 @@ async function observePublishIfRequired(deps, ctx, meta, model, stage, releaseSh
     deployStatus: aggregateWorkflowRuns(workflowRuns)
   };
 }
+async function joinDeployAndPublish(deploy, publish) {
+  const [d, p] = await Promise.all([deploy, publish]);
+  if (!p) return [d, p];
+  const mark = (x) => x.workflowRuns ? { ...x, workflowRuns: x.workflowRuns.map((r) => ({ ...r, parallel: true })) } : x;
+  return [mark(d), mark(p)];
+}
 function appendPublishDispatch(deploy, publish) {
   if (!publish) return deploy;
   return {
@@ -18910,7 +19037,7 @@ function mmiGetRedeployCommand(repo) {
 }
 function readLocalLauncherVersion(root = process.cwd()) {
   try {
-    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "installer", "launcher", "package.json"), "utf8");
+    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "cli", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
@@ -18939,17 +19066,54 @@ async function fetchServedChannelVersion(url, fetchImpl = fetch) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
 }
+async function findPriorGreenDispatch(deps, repo, workflow, sha, titleTokens) {
+  if (!/^[0-9a-f]{40}$/i.test(sha)) return void 0;
+  try {
+    const rows = JSON.parse(await deps.run("gh", [
+      "run",
+      "list",
+      "--repo",
+      repo,
+      "--workflow",
+      workflow,
+      "--commit",
+      sha,
+      "--event",
+      "workflow_dispatch",
+      "--limit",
+      "20",
+      "--json",
+      "databaseId,url,status,conclusion,displayTitle,headSha"
+    ]));
+    const hit = rows.find((r) => typeof r.databaseId === "number" && r.headSha?.toLowerCase() === sha.toLowerCase() && r.status === "completed" && r.conclusion === "success" && titleTokens.every((t) => (r.displayTitle ?? "").split(/[^\w.-]+/).includes(t)));
+    return hit ? { runId: hit.databaseId, ...hit.url ? { runUrl: hit.url } : {} } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function planeFailureRow(workflow, evidence) {
+  return { workflow, runUrlNote: evidence, conclusion: "failure" };
+}
 async function appendMmiGetRedeploy(deps, input, dispatch) {
   if (!isHubControlRepo(input.repo)) return dispatch;
   const remedy = mmiGetRedeployCommand(input.repo);
-  const withNote = (note, deployStatus) => ({
+  const withNote = (note, deployStatus, row) => ({
     ...dispatch,
     note: `${dispatch.note}; ${note}`,
-    ...deployStatus ? { deployStatus } : {}
+    ...deployStatus ? { deployStatus } : {},
+    ...row ? { workflowRuns: [...dispatch.workflowRuns ?? [], row] } : {}
   });
   if (input.publishStatus !== "success") {
     return withNote(`mmi-get box NOT redeployed (publish did not succeed) \u2014 after the publish is green, run \`${remedy}\``);
   }
+  const prior = input.releaseSha ? await findPriorGreenDispatch(deps, input.repo, "tenant-deploy.yml", input.releaseSha, [HUB_GET_SLUG, HUB_GET_STAGE]) : void 0;
+  if (prior) {
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; mmi-get box already redeployed for this release (tenant-deploy.yml run ${prior.runId} at ${input.releaseSha.slice(0, 12)}) \u2014 not dispatched again`,
+      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "tenant-deploy.yml", runId: prior.runId, ...prior.runUrl ? { runUrl: prior.runUrl } : {}, conclusion: "success" }]
+    };
+  }
   const since = (deps.now ?? Date.now)();
   try {
     await deps.run("gh", [
@@ -18971,12 +19135,12 @@ async function appendMmiGetRedeploy(deps, input, dispatch) {
     ]);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    return withNote(`tenant-deploy dispatch FAILED: ${msg}. The release itself landed, but the MMI-GET BOX WAS NOT REDEPLOYED \u2014 recover with \`${remedy}\``, "failure");
+    return withNote(`tenant-deploy dispatch FAILED: ${msg}. The release itself landed, but the MMI-GET BOX WAS NOT REDEPLOYED \u2014 recover with \`${remedy}\``, "failure", planeFailureRow("tenant-deploy.yml", `dispatch refused: ${msg}`));
   }
   const correlated = await correlateTenantRun(deps, since, [HUB_GET_SLUG, HUB_GET_STAGE]);
   if (correlated.read === "failed" || correlated.read === "absent") {
     const why = correlated.read === "failed" ? `its run could not be READ: ${correlated.error}` : "no matching run appeared";
-    return withNote(`tenant-deploy dispatched (slug=${HUB_GET_SLUG}, stage=${HUB_GET_STAGE}) but ${why}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure");
+    return withNote(`tenant-deploy dispatched (slug=${HUB_GET_SLUG}, stage=${HUB_GET_STAGE}) but ${why}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure", planeFailureRow("tenant-deploy.yml", `dispatched, but ${why}`));
   }
   const { runId, runUrl } = correlated;
   const runRow = { workflow: "tenant-deploy.yml", ...runId ? { runId } : {}, ...runUrl ? { runUrl } : {} };
@@ -19006,35 +19170,44 @@ async function appendServedChannelPublish(deps, input, dispatch) {
   if (!isHubControlRepo(input.repo)) return dispatch;
   const channelUrl = input.channelUrl ?? readServedChannelUrl();
   const remedy = getPublishDispatchCommand(input.repo);
-  const withNote = (note, deployStatus) => ({
+  const withNote = (note, deployStatus, row) => ({
     ...dispatch,
     note: `${dispatch.note}; ${note}`,
-    ...deployStatus ? { deployStatus } : {}
+    ...deployStatus ? { deployStatus } : {},
+    ...row ? { workflowRuns: [...dispatch.workflowRuns ?? [], row] } : {}
   });
   if (input.publishStatus !== "success") {
     return withNote(`served channel NOT moved (publish did not succeed) \u2014 after the publish is green, run \`${remedy}\``);
   }
-  const since = (deps.now ?? Date.now)();
-  try {
-    await deps.run("gh", ["workflow", "run", "get-publish.yml", "--repo", input.repo, "--ref", "main", "-f", `product=${HUB_SERVED_PRODUCT}`]);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    return withNote(`get-publish dispatch FAILED: ${msg}. The release itself landed, but the SERVED CHANNEL IS UNCHANGED \u2014 recover with \`${remedy}\``, "failure");
-  }
-  const correlated = await correlateGetPublishRun(deps, since, HUB_SERVED_PRODUCT);
-  if (correlated.read === "failed") {
-    return withNote(`get-publish dispatched but its run could not be READ: ${correlated.error}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure");
-  }
-  const { runId, runUrl } = correlated;
-  const runRow = { workflow: "get-publish.yml", ...runId ? { runId } : {}, ...runUrl ? { runUrl } : {} };
-  if (!input.watch) {
-    return {
-      ...dispatch,
-      note: `${dispatch.note}; dispatched get-publish.yml (product=${HUB_SERVED_PRODUCT}) \u2014 NOT watched, so the served channel is not yet proven moved`,
-      workflowRuns: [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: "pending" }]
-    };
+  const prior = input.releaseSha ? await findPriorGreenDispatch(deps, input.repo, "get-publish.yml", input.releaseSha, [HUB_SERVED_PRODUCT]) : void 0;
+  let runRow;
+  let runStatus;
+  if (prior) {
+    runRow = { workflow: "get-publish.yml", runId: prior.runId, ...prior.runUrl ? { runUrl: prior.runUrl } : {} };
+    runStatus = "success";
+  } else {
+    const since = (deps.now ?? Date.now)();
+    try {
+      await deps.run("gh", ["workflow", "run", "get-publish.yml", "--repo", input.repo, "--ref", "main", "-f", `product=${HUB_SERVED_PRODUCT}`]);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return withNote(`get-publish dispatch FAILED: ${msg}. The release itself landed, but the SERVED CHANNEL IS UNCHANGED \u2014 recover with \`${remedy}\``, "failure", planeFailureRow("get-publish.yml", `dispatch refused: ${msg}`));
+    }
+    const correlated = await correlateGetPublishRun(deps, since, HUB_SERVED_PRODUCT);
+    if (correlated.read === "failed") {
+      return withNote(`get-publish dispatched but its run could not be READ: ${correlated.error}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure", planeFailureRow("get-publish.yml", `dispatched, but its run could not be read`));
+    }
+    const { runId, runUrl } = correlated;
+    runRow = { workflow: "get-publish.yml", ...runId ? { runId } : {}, ...runUrl ? { runUrl } : {} };
+    if (!input.watch) {
+      return {
+        ...dispatch,
+        note: `${dispatch.note}; dispatched get-publish.yml (product=${HUB_SERVED_PRODUCT}) \u2014 NOT watched, so the served channel is not yet proven moved`,
+        workflowRuns: [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: "pending" }]
+      };
+    }
+    runStatus = await watchTenantRun(deps, runId, input.repo);
   }
-  const runStatus = await watchTenantRun(deps, runId, input.repo);
   if (runStatus !== "success") {
     return {
       ...dispatch,
@@ -19053,19 +19226,29 @@ async function appendServedChannelPublish(deps, input, dispatch) {
     };
   }
   const probe = await (deps.readServedChannelVersion ?? fetchServedChannelVersion)(channelUrl);
+  const evidence = (conclusion, text) => [...runs, servedChannelRow(HUB_SERVED_PRODUCT, conclusion, text)];
+  if (!probe.ok && staleServedProcess(probe)) {
+    const redeploy = mmiGetRedeployCommand(input.repo);
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; get-publish.yml succeeded but ${channelUrl} answered HTTP ${probe.status} \u2014 STALE SERVED PROCESS: the files may be current, but the process serving them predates GET /release/version; recover with \`${redeploy}\``,
+      workflowRuns: evidence("failure", `${channelUrl} answered HTTP ${probe.status} (stale served process)`),
+      deployStatus: "failure"
+    };
+  }
   if (!probe.ok) {
     const why = probe.error ?? `HTTP ${probe.status ?? "unknown"}`;
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded but the served channel version could NOT be read at ${channelUrl} (${why}) \u2014 the move is unverified`,
-      workflowRuns: runs
+      workflowRuns: evidence("pending", `${channelUrl} unreadable (${why})`)
     };
   }
   if (expected && probe.version !== expected) {
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded but the served channel still reports ${probe.version} (expected launcher ${expected}) \u2014 THE CHANNEL DID NOT MOVE; recover with \`${remedy}\``,
-      workflowRuns: runs,
+      workflowRuns: evidence("failure", `${channelUrl} reports ${probe.version}, expected ${expected}`),
       deployStatus: "failure"
     };
   }
@@ -19073,15 +19256,106 @@ async function appendServedChannelPublish(deps, input, dispatch) {
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml succeeded and ${channelUrl} reports ${probe.version}, but the local launcher version could not be read \u2014 nothing was compared, so the move is unverified`,
-      workflowRuns: runs
+      workflowRuns: evidence("pending", `${channelUrl} reports ${probe.version}; nothing to compare against`)
     };
   }
   return {
     ...dispatch,
     note: `${dispatch.note}; served channel moved \u2014 ${channelUrl} now reports ${probe.version}`,
-    workflowRuns: runs
+    workflowRuns: evidence("success", `${channelUrl} reports ${probe.version}`)
+  };
+}
+function staleServedProcess(probe) {
+  return probe.status === 401 || probe.status === 403 || probe.status === 404;
+}
+function servedChannelRow(product, conclusion, evidence) {
+  return { workflow: `served-channel(${product})`, runUrlNote: evidence, conclusion };
+}
+var JERV_GATEWAY_REMEDY = "from the Jerv-Hub checkout, re-run the Gateway deploy on its current release tag: `bash scripts/jerv-gateway-release-deploy.sh --tag <jerv-hub tag>`";
+var SERVED_CHANNELS = {
+  "mutmutco/mm-strategy": {
+    product: "mm-strategy",
+    url: "https://strategy.mutmut.work/release/version",
+    mover: "the MM-Strategy container deploy (the running server's own version is the pointer)",
+    remedy: "`mmi-cli devops runtime tenant redeploy mutmutco/MM-Strategy main`"
+  },
+  "mutmutco/jerv-hub": {
+    product: "jerv",
+    url: "https://get.jerv.ai/jerv/release/version",
+    mover: "the Jerv Gateway deploy (`jerv-gate fetch-release --product jerv`)",
+    remedy: JERV_GATEWAY_REMEDY
+  },
+  "mutmutco/jerv-jervcode": {
+    product: "jervcode",
+    url: "https://get.jerv.ai/jervcode/release/version",
+    mover: "the Jerv Gateway deploy, which fetches JervCode's latest release \u2014 a JervCode release alone does not move it",
+    remedy: JERV_GATEWAY_REMEDY
+  }
+};
+function servedChannelFor(repo, installer) {
+  const known = SERVED_CHANNELS[repo.toLowerCase()];
+  if (!installer) return known;
+  if (isHubControlRepo(repo)) return void 0;
+  const url = installerVersionUrl(installer);
+  return {
+    product: installer.product,
+    url,
+    mover: known?.mover ?? `this repo's release (${installer.family === "jerv" ? "get.jerv.ai" : "get.mutmut.work"} serves /${installer.product})`,
+    remedy: known?.remedy ?? `re-run the release's served-channel publish for ${installer.product} (\`mmi-cli devops release --resume\`)`
   };
 }
+var SERVED_CHANNEL_PROBE_ATTEMPTS = 3;
+var SERVED_CHANNEL_PROBE_BACKOFF_MS = 1e4;
+async function appendServedChannelProof(deps, input, dispatch) {
+  const channel = servedChannelFor(input.repo, input.installer);
+  if (!channel) return dispatch;
+  const expected = input.tag.replace(/^v/, "");
+  const withProof = (conclusion, evidence, note, failed = false) => ({
+    ...dispatch,
+    note: `${dispatch.note}; ${note}`,
+    workflowRuns: [...dispatch.workflowRuns ?? [], servedChannelRow(channel.product, conclusion, evidence)],
+    ...failed ? { deployStatus: "failure" } : {}
+  });
+  if (!input.shipped) {
+    return withProof("pending", `${channel.url} not probed`, `served channel ${channel.url} not probed \u2014 deploy/publish are not proven green, so it is not expected to have moved`);
+  }
+  const read = deps.readServedChannelVersion ?? fetchServedChannelVersion;
+  let probe = await read(channel.url);
+  for (let attempt = 1; attempt < SERVED_CHANNEL_PROBE_ATTEMPTS && probe.ok && probe.version !== expected; attempt++) {
+    await (deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(SERVED_CHANNEL_PROBE_BACKOFF_MS * attempt);
+    probe = await read(channel.url);
+  }
+  if (!probe.ok && staleServedProcess(probe)) {
+    return withProof(
+      "failure",
+      `${channel.url} answered HTTP ${probe.status} (stale served process)`,
+      `${channel.url} answered HTTP ${probe.status} \u2014 STALE SERVED PROCESS: the process serving ${channel.product} predates GET /release/version; it moves with ${channel.mover}; recover with ${channel.remedy}`,
+      true
+    );
+  }
+  if (!probe.ok) {
+    const why = probe.error ?? `HTTP ${probe.status ?? "unknown"}`;
+    return withProof("pending", `${channel.url} unreadable (${why})`, `served channel ${channel.url} could NOT be read (${why}) \u2014 the move is unverified`);
+  }
+  if (probe.version !== expected) {
+    return withProof(
+      "failure",
+      `${channel.url} reports ${probe.version}, expected ${expected}`,
+      `served channel ${channel.url} still reports ${probe.version} (expected ${expected}) \u2014 THE CHANNEL DID NOT MOVE: new installs get ${probe.version}; it moves with ${channel.mover}; recover with ${channel.remedy}`,
+      true
+    );
+  }
+  return withProof("success", `${channel.url} reports ${probe.version}`, `served channel moved \u2014 ${channel.url} reports ${probe.version}`);
+}
+async function appendServedChannelLegs(deps, input, dispatch) {
+  const publishStatus = input.publish?.state === "complete" ? "success" : "failure";
+  let out = await appendMmiGetRedeploy(deps, { repo: input.repo, publishStatus, watch: input.watch, releaseSha: input.releaseSha }, dispatch);
+  out = await appendServedChannelPublish(deps, { repo: input.repo, publishStatus, watch: input.watch, releaseSha: input.releaseSha }, out);
+  return appendServedChannelProof(deps, { repo: input.repo, tag: input.tag, shipped: shipLegsGreen(input.deploy, input.publish), installer: input.installer }, out);
+}
+function servedChannelRowsAfter(before, after) {
+  return (after.workflowRuns ?? []).slice((before.workflowRuns ?? []).length);
+}
 var JERV_GATEWAY_RUN_URL_NOTE = "no run URL emitted \u2014 host health leg runs outside GitHub Actions";
 var JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT = "scripts/jerv-gateway-release-deploy.sh";
 async function runTaggedJervGatewayLocalWrapper(deps, tag, tagSha) {
@@ -19141,15 +19415,15 @@ async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch)
   }
 }
 async function watchOwnWorkflowRuns(deps, repo, targets, since, headSha, enumerateSha = false) {
-  const workflowRuns = [];
-  for (const target of targets) {
+  const parallel = targets.length > 1 ? { parallel: true } : {};
+  const workflowRuns = await Promise.all(targets.map(async (target) => {
     try {
       const run = await correlateWorkflowRun(deps, { ...target, since, headSha, repo });
-      workflowRuns.push(await watchWorkflowRun(deps, target.workflow, run, repo));
+      return { ...await watchWorkflowRun(deps, target.workflow, run, repo), ...parallel };
     } catch {
-      workflowRuns.push({ workflow: target.workflow, conclusion: "failure" });
+      return { workflow: target.workflow, conclusion: "failure", ...parallel };
     }
-  }
+  }));
   if (!enumerateSha) return workflowRuns;
   const seen = new Set(workflowRuns.map((r) => r.runId).filter((id) => typeof id === "number"));
   workflowRuns.push(...await discoverShaWorkflowRuns(deps, repo, headSha, seen));
@@ -19204,8 +19478,8 @@ async function vercelDeployDispatch(deps, ctx, ref, watch, headSha) {
   return { note: `${note}; ${detail}`, ...read?.logUrl ? { runUrl: read.logUrl } : {}, workflowRuns: [row(read, deployStatus)], deployStatus };
 }
 function shipLegsGreen(deploy, publish) {
-  const green = (s) => s === "complete" || s === "skipped";
-  return green(deploy?.state) && green(publish?.state);
+  const green = (leg) => leg?.superseded !== true && (leg?.state === "complete" || leg?.state === "skipped");
+  return green(deploy) && green(publish);
 }
 async function announceShippedRelease(deps, args, model, legs, deferred) {
   if (!deps.announce) return void 0;
@@ -20718,6 +20992,20 @@ var import_node_crypto5 = require("node:crypto");
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
 var import_node_path21 = require("node:path");
+function pidIsDead(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  if (pid === process.pid) return false;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (e) {
+    return e.code === "ESRCH";
+  }
+}
+function lockTokenPid(token) {
+  const m = /^(\d+)-/.exec(token);
+  return m ? Number(m[1]) : void 0;
+}
 var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
@@ -20733,9 +21021,24 @@ function resolveFileLockOpts(opts = {}) {
     staleMs: opts.staleMs ?? 3e4,
     retryMs: opts.retryMs ?? 50,
     maxWaitMs: opts.maxWaitMs ?? 5e3,
-    label: opts.label ?? "file lock"
+    label: opts.label ?? "file lock",
+    deadHolderSteal: opts.deadHolderSteal ?? false,
+    holder: opts.holder ?? ""
   };
 }
+async function lockIsStealable(lockPath, opts) {
+  const age = Date.now() - (await (0, import_promises2.stat)(lockPath)).mtimeMs;
+  if (age > opts.staleMs) return true;
+  if (!opts.deadHolderSteal) return false;
+  let token;
+  try {
+    token = await (0, import_promises2.readFile)(lockPath, "utf8");
+  } catch {
+    return false;
+  }
+  const pid = lockTokenPid(token);
+  return pid !== void 0 && pidIsDead(pid);
+}
 async function acquireFileLock(lockPath, opts, deadline) {
   let immediateRetries = 0;
   for (; ; ) {
@@ -20746,12 +21049,12 @@ async function acquireFileLock(lockPath, opts, deadline) {
       const code = e.code;
       if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw e;
       const retryNow = async () => {
+        if (++immediateRetries <= IMMEDIATE_RETRY_BUDGET) return;
         if (Date.now() >= deadline) throw new FileLockBusyError(opts.label, lockPath, opts.maxWaitMs);
-        if (++immediateRetries > IMMEDIATE_RETRY_BUDGET) await sleep(opts.retryMs);
+        await sleep(opts.retryMs);
       };
       try {
-        const age = Date.now() - (await (0, import_promises2.stat)(lockPath)).mtimeMs;
-        if (age > opts.staleMs) {
+        if (await lockIsStealable(lockPath, opts)) {
           try {
             await (0, import_promises2.unlink)(lockPath);
             await retryNow();
@@ -20777,7 +21080,8 @@ async function acquireFileLock(lockPath, opts, deadline) {
       await sleep(opts.retryMs);
       continue;
     }
-    const token = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const stamp = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const token = opts.holder ? `${stamp} ${opts.holder.replace(/\s+/g, " ").trim()}` : stamp;
     try {
       await handle.writeFile(token);
     } catch (e) {
@@ -20801,11 +21105,14 @@ async function releaseFileLock(lockPath, guard) {
   }
 }
 async function withFileLock(lockPath, opts, fn) {
+  return withFencedFileLock(lockPath, opts, () => fn());
+}
+async function withFencedFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
   await (0, import_promises2.mkdir)((0, import_node_path21.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
-    return await fn();
+    return await fn(() => fileLockHeldBy(lockPath, guard.token));
   } finally {
     await releaseFileLock(lockPath, guard);
   }
@@ -21043,8 +21350,114 @@ function atomicWriteJson(path2, ledger) {
 `, "utf8");
   (0, import_node_fs22.renameSync)(tmp, path2);
 }
+var LEDGER_LOCK_OPTS = { label: "release ledger", staleMs: 18e4, deadHolderSteal: true };
+async function withLedgerLock(path2, fn, opts = {}) {
+  return withFencedFileLock(`${path2}.lock`, { ...LEDGER_LOCK_OPTS, ...opts.maxWaitMs != null ? { maxWaitMs: opts.maxWaitMs } : {} }, (stillHeld) => fn(async (write) => {
+    if (!await stillHeld()) {
+      throw new ReleaseLedgerError("lock-lost", `release ledger at ${path2}: this writer's lock was stolen while it worked \u2014 nothing was written over the successor (#7027)`);
+    }
+    return write();
+  }));
+}
+function checkoutRootFrom(cwd) {
+  let dir = (0, import_node_path22.resolve)(cwd);
+  for (; ; ) {
+    if (resolveGitDir(dir)) return dir;
+    const parent = (0, import_node_path22.dirname)(dir);
+    if (parent === dir) throw new ReleaseLedgerError("no-checkout", `train writer lock: no git checkout found above ${cwd}`);
+    dir = parent;
+  }
+}
+function trainWriterLockPath(cwd) {
+  return (0, import_node_path22.join)((0, import_node_path22.dirname)(releaseLedgerPath(checkoutRootFrom(cwd))), "train.lock");
+}
+var TrainWriterBusyError = class extends Error {
+  lockPath;
+  holder;
+  constructor(lockPath, holder, verb) {
+    super(
+      `${verb} refused before any mutation: another train is running on this checkout (${holder}). One train at a time writes the release ledger \u2014 wait for it to finish, or, if that process is gone, rerun: a dead holder's lock is reclaimed automatically (lock: ${lockPath}) (#7027)`
+    );
+    this.name = "TrainWriterBusyError";
+    this.lockPath = lockPath;
+    this.holder = holder;
+  }
+};
+var TRAIN_WRITER_STALE_MS = 12 * 60 * 6e4;
+function describeTrainWriterToken(token) {
+  const pid = lockTokenPid(token);
+  const [stamp, ...rest] = token.trim().split(" ");
+  const since = Number((stamp ?? "").split("-")[1]);
+  const when = Number.isFinite(since) && since > 0 ? `, since ${new Date(since).toISOString()}` : "";
+  const what = rest.join(" ").trim();
+  return `${what || "a train command"}${pid ? `, pid ${pid}` : ""}${when}`;
+}
+function liveTrainWriterHolder(cwd) {
+  let token;
+  try {
+    token = (0, import_node_fs22.readFileSync)(trainWriterLockPath(cwd), "utf8");
+  } catch {
+    return void 0;
+  }
+  const pid = lockTokenPid(token);
+  if (pid === void 0 || pid === process.pid || pidIsDead(pid)) return void 0;
+  return describeTrainWriterToken(token);
+}
+var heldTrainWriter;
+async function acquireTrainWriterLock(cwd, verb) {
+  let lockPath;
+  try {
+    lockPath = trainWriterLockPath(cwd);
+  } catch {
+    return async () => void 0;
+  }
+  if (heldTrainWriter && heldTrainWriter.lockPath === lockPath) {
+    heldTrainWriter.depth += 1;
+    return async () => {
+      if (heldTrainWriter) heldTrainWriter.depth -= 1;
+    };
+  }
+  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(lockPath), { recursive: true });
+  const opts = resolveFileLockOpts({ label: "train writer", staleMs: TRAIN_WRITER_STALE_MS, deadHolderSteal: true, maxWaitMs: 0, holder: verb });
+  let guard;
+  try {
+    guard = await acquireFileLock(lockPath, opts, Date.now());
+  } catch (e) {
+    if (!(e instanceof FileLockBusyError)) throw e;
+    let token = "";
+    try {
+      token = (0, import_node_fs22.readFileSync)(lockPath, "utf8");
+    } catch {
+      token = "";
+    }
+    throw new TrainWriterBusyError(lockPath, token ? describeTrainWriterToken(token) : "holder unreadable", verb);
+  }
+  const held = {
+    lockPath,
+    depth: 1,
+    release: async () => {
+      heldTrainWriter = void 0;
+      await releaseFileLock(lockPath, guard);
+    }
+  };
+  heldTrainWriter = held;
+  return async () => {
+    held.depth -= 1;
+    if (held.depth <= 0 && heldTrainWriter === held) await held.release();
+  };
+}
+async function withTrainWriter(deps, verb, fn) {
+  const seam = "trainWriter" in deps ? deps.trainWriter : void 0;
+  if (!seam) return fn();
+  const release = await seam(verb, process.cwd());
+  try {
+    return await fn();
+  } finally {
+    await release();
+  }
+}
 async function withReleaseLedger(path2, expected, fn, opts = {}) {
-  return withFileLock(`${path2}.lock`, { label: "release ledger", maxWaitMs: opts.maxWaitMs ?? 5e3 }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let current;
     let raw;
     try {
@@ -21059,9 +21472,9 @@ async function withReleaseLedger(path2, expected, fn, opts = {}) {
       if (expected) validateLedgerAnchors(current, expected);
     }
     const { ledger, value } = await fn(current);
-    if (ledger) atomicWriteJson(path2, ledger);
+    if (ledger) await fence(() => atomicWriteJson(path2, ledger));
     return value;
-  });
+  }, { maxWaitMs: opts.maxWaitMs ?? 5e3 });
 }
 function openReleaseLedgerWriter(cwd, opts = {}) {
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
@@ -21184,7 +21597,9 @@ var TRANSIENT_TRANSPORT_MARKERS = [
   /socket hang ?up/i,
   /remote end hung ?up unexpectedly/i,
   /early EOF/i,
-  /tls handshake timeout/i
+  /tls handshake timeout/i,
+  /kex_exchange_identification: connection closed by remote host/i,
+  /connection closed by remote host/i
 ];
 function classifyTransientTransportFailure(evidence) {
   if (!evidence) return false;
@@ -21674,7 +22089,7 @@ async function reverifyPersistedRunPhases(deps, path2, anchors, input) {
   return result;
 }
 async function clearLedgerFile(path2, anchors, maxWaitMs) {
-  return withFileLock(`${path2}.lock`, { label: "release ledger", maxWaitMs }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
       raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
@@ -21693,9 +22108,9 @@ async function clearLedgerFile(path2, anchors, maxWaitMs) {
     } catch (e) {
       return { cleared: false, note: `release ledger at ${path2} belongs to ${ledger.tag} @ ${ledger.tagSha.slice(0, 12)} \u2014 not this release; left in place (${e instanceof Error ? e.message : String(e)})` };
     }
-    (0, import_node_fs22.unlinkSync)(path2);
+    await fence(() => (0, import_node_fs22.unlinkSync)(path2));
     return { cleared: true, note: `cleared the release ledger at ${path2} for the live-proven aborted ${anchors.tag}` };
-  });
+  }, { maxWaitMs });
 }
 async function clearReleaseLedger(cwd, anchors, opts = {}) {
   let path2;
@@ -21835,7 +22250,7 @@ async function alignmentLegClosedLive(deps, prior) {
 }
 async function healStaleAlignmentLeg(deps, cwd, expected) {
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -21851,16 +22266,80 @@ async function healStaleAlignmentLeg(deps, cwd, expected) {
     }
     const closed = await alignmentLegClosedLive(deps, prior);
     if (!closed) return void 0;
-    atomicWriteJson(path2, { ...prior, phases: { ...prior.phases, alignment: closed }, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    await fence(() => atomicWriteJson(path2, { ...prior, phases: { ...prior.phases, alignment: closed }, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }));
     return prior.tag;
   });
 }
+async function healUnfoldedRunLegs(deps, cwd, model) {
+  const path2 = releaseLedgerPath(cwd);
+  let prior;
+  try {
+    prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const legs = ["deploy", "publish"];
+  const openLeg = (rec) => rec.state === "pending" && rec.superseded !== true;
+  if (!legs.some((phase) => openLeg(prior.phases[phase]))) return void 0;
+  const anchors = { repo: prior.repo, tag: prior.tag, tagSha: prior.tagSha };
+  const folded = [];
+  let current = prior;
+  if (legs.some((phase) => openLeg(prior.phases[phase]) && prior.phases[phase].runId != null)) {
+    let reverified;
+    try {
+      reverified = await reverifyPersistedRunPhases(deps, path2, anchors, { sha: prior.tagSha, repo: prior.repo });
+    } catch {
+      return void 0;
+    }
+    if (!reverified.ledger) return void 0;
+    current = reverified.ledger;
+    for (const phase of legs) {
+      const before = prior.phases[phase];
+      const after = current.phases[phase];
+      if (openLeg(before) && before.runId != null && after.state !== "pending") folded.push({ phase, state: after.state, runId: after.runId });
+    }
+  }
+  const targets = prodReleaseTargets(model);
+  const runless = legs.filter((phase) => openLeg(current.phases[phase]) && current.phases[phase].runId == null);
+  if (runless.length > 0 && targets.length > 0) {
+    let rows;
+    try {
+      rows = await listOwnWorkflowRuns(deps, releaseRunRepoFor(model, prior.repo), targets, prior.tagSha);
+    } catch {
+      rows = [];
+    }
+    const inputs = phaseInputsFromRunRows(model, rows, prior.tagSha, { repo: prior.repo });
+    const foldable = runless.filter((phase) => inputs[phase].runId != null && inputs[phase].state !== "pending");
+    if (foldable.length > 0) {
+      const written = await withReleaseLedger(path2, anchors, (ledger) => {
+        if (!ledger) return { value: [] };
+        const phases = { ...ledger.phases };
+        const done = [];
+        for (const phase of foldable) {
+          const live = phases[phase];
+          if (!openLeg(live) || live.runId != null) continue;
+          const entry = compactEntry(inputs[phase]);
+          phases[phase] = {
+            ...entry,
+            note: `${entry.note ?? `${phase} run on the release SHA`} \u2014 folded by train doctor --heal from the concluded run (#7003)`,
+            retries: live.retries,
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          done.push({ phase, state: entry.state, runId: entry.runId });
+        }
+        return done.length ? { ledger: { ...ledger, phases, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, value: done } : { value: done };
+      }).catch(() => []);
+      folded.push(...written);
+    }
+  }
+  return folded.length ? { tag: prior.tag, folded } : void 0;
+}
 function supersedeableDeployLegShape(rec) {
   return rec.state === "failed" || rec.state === "pending" && rec.runId == null;
 }
 async function supersedeContentCausedDeployLeg(deps, cwd) {
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -21901,14 +22380,14 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
       );
     }
     const note = `superseded: content-caused deploy failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, #6553)`;
-    atomicWriteJson(path2, {
+    await fence(() => atomicWriteJson(path2, {
       ...prior,
       phases: {
         ...phases,
         deploy: { state: "skipped", sha: prior.tagSha, superseded: true, note, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
       },
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
+    }));
     return {
       command: "release-supersede-deploy",
       repo: prior.repo,
@@ -21924,7 +22403,7 @@ function supersedeablePublishLegShape(rec) {
 function deferredGatewayDeployLegShape(rec) {
   return rec.state === "pending" && rec.runId == null && rec.workflow === "jerv-gateway";
 }
-async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref) {
+async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref, fence) {
   let liveSha = "";
   try {
     liveSha = (await deps.run("git", ["ls-remote", "origin", `refs/tags/${prior.tag}`])).trim().split(/\s+/)[0] ?? "";
@@ -21963,12 +22442,12 @@ async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref) {
   if ((0, import_node_fs22.existsSync)(archivePath)) {
     throw new Error(`${label}: archive already exists at ${archivePath} \u2014 preserving both ledger records; resolve the collision by hand; nothing was written (${ref})`);
   }
-  (0, import_node_fs22.renameSync)(path2, archivePath);
+  await fence(() => (0, import_node_fs22.renameSync)(path2, archivePath));
   return "deleted";
 }
 async function supersedeContentCausedPublishLeg(deps, cwd) {
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -21999,7 +22478,7 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
         `release --supersede-publish: ${prior.tag} has unresolved legs besides publish (${unresolved.map((p) => `${p}=${phases[p].state}`).join(", ")}) \u2014 the supersession closes only the publish leg of an otherwise-complete release; resolve those first, nothing was written (#6638)`
       );
     }
-    if (await proveOriginPromotionOrArchived(deps, prior, path2, "release --supersede-publish", "#6638") === "deleted") {
+    if (await proveOriginPromotionOrArchived(deps, prior, path2, "release --supersede-publish", "#6638", fence) === "deleted") {
       return {
         command: "release-supersede-publish",
         repo: prior.repo,
@@ -22028,14 +22507,14 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
       gatewayDeploy = { workflow: "jerv-gateway", state: "complete", note: dispatch.note };
     }
     const note = `superseded: content-caused publish failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, #6638)`;
-    atomicWriteJson(path2, {
+    await fence(() => atomicWriteJson(path2, {
       ...prior,
       phases: {
         ...phases,
         publish: { state: "skipped", sha: prior.tagSha, superseded: true, note, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
       },
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
+    }));
     return {
       command: "release-supersede-publish",
       repo: prior.repo,
@@ -22050,7 +22529,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
   const label = "release --supersede-deploy --supersede-publish";
   const ref = "#6752";
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -22098,7 +22577,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
         `${label}: ${prior.tag} has unresolved legs besides deploy and publish (${unresolved.map((p) => `${p}=${phases[p].state}`).join(", ")}) \u2014 the combined closure closes only the two content-caused legs of an otherwise-complete release; resolve those first, nothing was written (${ref})`
       );
     }
-    if (await proveOriginPromotionOrArchived(deps, prior, path2, label, ref) === "deleted") {
+    if (await proveOriginPromotionOrArchived(deps, prior, path2, label, ref, fence) === "deleted") {
       return {
         command: "release-supersede-deploy-and-publish",
         repo: prior.repo,
@@ -22144,7 +22623,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
       note: `superseded: content-caused publish failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, ${ref})`,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    atomicWriteJson(path2, { ...prior, phases, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    await fence(() => atomicWriteJson(path2, { ...prior, phases, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }));
     return {
       command: "release-supersede-deploy-and-publish",
       repo: prior.repo,
@@ -22175,7 +22654,7 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     return { ok: true };
   }
   await reverifyPriorRunLegs(deps, path2, targetTag);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
       raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
@@ -22195,7 +22674,7 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
       const closed = await alignmentLegClosedLive(deps, prior);
       if (closed) {
         prior = { ...prior, phases: { ...prior.phases, alignment: closed }, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-        atomicWriteJson(path2, prior);
+        await fence(() => atomicWriteJson(path2, prior));
         derived = deriveReleasePhaseStatus(prior);
       }
     }
@@ -22218,13 +22697,13 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     }
     const archivePath = (0, import_node_path22.join)((0, import_node_path22.dirname)(path2), `phases.archive-${prior.tag}.json`);
     try {
-      (0, import_node_fs22.unlinkSync)(archivePath);
+      await fence(() => (0, import_node_fs22.unlinkSync)(archivePath));
     } catch (e) {
       if (e.code !== "ENOENT") {
         return { ok: false, error: `could not clear the stale archive at ${archivePath} (${e instanceof Error ? e.message : String(e)}) \u2014 the ledger for ${prior.tag} stays active (#5987)` };
       }
     }
-    (0, import_node_fs22.renameSync)(path2, archivePath);
+    await fence(() => (0, import_node_fs22.renameSync)(path2, archivePath));
     return { ok: true, note: `archived the completed release ledger ${prior.tag} to ${archivePath} (live-proven at ${prior.tagSha.slice(0, 12)})` };
   });
 }
@@ -22249,7 +22728,7 @@ async function defaultRetryDeploy(deps, prior) {
 }
 async function retryHotfixDeployLegs(deps, cwd, opts = {}) {
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -22330,7 +22809,7 @@ async function retryHotfixDeployLegs(deps, cwd, opts = {}) {
         );
       }
     }
-    atomicWriteJson(path2, { ...prior, phases, updatedAt: now().toISOString() });
+    await fence(() => atomicWriteJson(path2, { ...prior, phases, updatedAt: now().toISOString() }));
     const stillFailed = retried.filter((phase) => phases[phase].state === "failed");
     const status = stillFailed.length === 0 ? "success" : "failed";
     return {
@@ -22482,6 +22961,8 @@ var defaultDeps2 = {
     }
   },
   healAlignmentLeg: healStaleAlignmentLeg,
+  healRunLegs: healUnfoldedRunLegs,
+  trainWriterHolder: liveTrainWriterHolder,
   readSurfacesRaw: (cwd) => {
     try {
       return (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(cwd, "surfaces.json"), "utf8");
@@ -22824,11 +23305,31 @@ async function runTrainDoctor(input) {
       break;
     }
   }
+  const runningTrain = deps.trainWriterHolder(cwd);
+  if (runningTrain) {
+    add({ code: "train-running", severity: "blocker", source: "local", title: `another train is running on this checkout: ${runningTrain}`, remedy: "wait for it to finish, then rerun; if that process is gone, just rerun \u2014 a dead holder's lock is reclaimed automatically (#7027)" });
+  }
+  const healLedger = heal && !runningTrain;
   if (ledgerRaw !== void 0 && ledgerPath) {
     try {
       let ledger = parseReleaseLedger(ledgerRaw);
       let derived = deriveReleasePhaseStatus(ledger);
-      if (heal && derived.phaseStatus === "phases-pending" && derived.legs.every((l) => l.state !== "pending" || l.phase === "alignment")) {
+      const deployModel = typeof meta?.deployModel === "string" && isDeployModel(meta.deployModel) ? meta.deployModel : void 0;
+      if (healLedger && deployModel && derived.legs.some((l) => (l.phase === "deploy" || l.phase === "publish") && l.state === "pending")) {
+        const run = await deps.healRunLegs(train, cwd, deployModel);
+        if (run) {
+          add({
+            code: "ledger-unfolded",
+            severity: "healed",
+            source: "origin",
+            title: `folded ${run.folded.map((f) => `${f.phase}=${f.state}${f.runId ? ` (run ${f.runId})` : ""}`).join(", ")} into the ${run.tag} ledger from the concluded run(s) on the tag SHA (#7003)`,
+            remedy: "nothing \u2014 the leg now records what GitHub already concluded"
+          });
+          ledger = parseReleaseLedger(deps.readLedgerRaw(ledgerPath) ?? ledgerRaw);
+          derived = deriveReleasePhaseStatus(ledger);
+        }
+      }
+      if (healLedger && derived.phaseStatus === "phases-pending" && derived.legs.every((l) => l.state !== "pending" || l.phase === "alignment")) {
         const closedTag = await deps.healAlignmentLeg(train, cwd);
         if (closedTag) {
           add({ code: "ledger-alignment-stale", severity: "healed", source: "origin", title: `closed the alignment-pending leg of ${closedTag}: its alignment PR(s) read MERGED on a fresh origin read (#6061)`, remedy: "nothing \u2014 the ledger is phases-green" });
@@ -22866,7 +23367,7 @@ async function runTrainDoctor(input) {
           // #6429: each lane finishes its own run (#6068) — an rcand-lane ledger named as a release
           // ledger, with `release --resume` as its remedy, sends the operator to a verb that refuses it.
           title: `a prior ${ledger.lane ?? "release"} ledger for ${ledger.tag} is ${derived.phaseStatus} (${open2}) \u2014 a new train must not stack on it (#5987)`,
-          remedy: failed ? ledgerFailedRemedy(ledger) : `finish it first: ${ledgerLaneResumeCommand(ledger)} (alignment-only pending legs close themselves with \`train doctor --heal\` once the PR merges)${supersession}`
+          remedy: failed ? ledgerFailedRemedy(ledger) : `finish it first: ${ledgerLaneResumeCommand(ledger)} (alignment-only pending legs close themselves with \`train doctor --heal\` once the PR merges, and a deploy/publish leg whose run already concluded folds under the same heal)${supersession}`
         });
       } else if (newestRemoteReleaseTag && newestRemoteReleaseTag !== ledger.tag) {
         add({
@@ -23622,6 +24123,8 @@ async function recoverPhaseWithMaybeTransientRerun(deps, ledger, anchors, phase,
 }
 async function recoverFailedDispatchPhase(deps, ledger, anchors, phase, dispatch, input, recover = recoverPhaseWithMaybeTransientRerun) {
   if (dispatch.deployStatus !== "failure") return dispatch;
+  const persisted = await ledger?.load(anchors).catch(() => void 0);
+  if (persisted?.phases[phase]?.superseded === true) return dispatch;
   let workflowRuns = dispatch.workflowRuns?.length ? [...dispatch.workflowRuns] : void 0;
   const notes = [];
   let fallbackRecovered = false;
@@ -23629,6 +24132,7 @@ async function recoverFailedDispatchPhase(deps, ledger, anchors, phase, dispatch
   if (failedRows.length > 0) {
     for (const failed of failedRows) {
       const rowPhase = failed.workflow.includes("publish") ? "publish" : phase;
+      if (persisted?.phases[rowPhase]?.superseded === true) continue;
       const recovery = await recover(deps, ledger, anchors, rowPhase, {
         repo: input.repo,
         sha: input.sha,
@@ -23803,7 +24307,10 @@ ${recovery.note}`), recoveryInput);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
   let alignment = alignEarly ? await alignEarly() : void 0;
-  const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
+  const [deployDispatch0, publishDispatch0] = await joinDeployAndPublish(
+    dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir),
+    observePublishIfRequired(deps, ctx, meta, deployModel, "main", releaseSha, watch)
+  );
   const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
   const failedReleaseRun = deployDispatch0.workflowRuns?.find((run) => run.conclusion === "failure");
   const dispatchFailurePhase = failedReleaseRun?.workflow === "publish.yml" || deployModel === "registry-publish" ? "publish" : "deploy";
@@ -23825,7 +24332,6 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", deployLeg, {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
-  const publishDispatch0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", releaseSha, watch);
   const publishDispatch = publishDispatch0 ? await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -23841,17 +24347,6 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "publish", publishLeg, {
     landed: "the immutable tag, the green required-check wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
-  let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  dispatch = await appendMmiGetRedeploy(
-    deps,
-    { repo: ctx.repo, publishStatus: publishLeg.state === "complete" ? "success" : "failure", watch },
-    dispatch
-  );
-  dispatch = await appendServedChannelPublish(
-    deps,
-    { repo: ctx.repo, publishStatus: publishLeg.state === "complete" ? "success" : "failure", watch },
-    dispatch
-  );
   const announcing = announceShippedRelease(
     deps,
     { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
@@ -23859,12 +24354,13 @@ ${recovery.note}`), recoveryInput);
     { deploy: deployLeg, publish: publishLeg },
     releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
   );
-  if (watch && alignment) {
-    alignment = {
-      dev: await awaitAlignmentLanded(deps, ctx, alignment.dev, "development"),
-      ...alignment.rc ? { rc: await awaitAlignmentLanded(deps, ctx, alignment.rc, "rc") } : {}
-    };
-  }
+  const aligning = watch && alignment ? awaitAlignmentsLanded(deps, ctx, alignment) : Promise.resolve(alignment);
+  const dispatch = await appendServedChannelLegs(
+    deps,
+    { repo: ctx.repo, tag, releaseSha, watch, deploy: deployLeg, publish: publishLeg, installer: meta.installer },
+    appendPublishDispatch(deployDispatch, publishDispatch)
+  );
+  alignment = await aligning;
   const announceNote = await announcing;
   return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors, ...alignment ? { alignment } : {} };
 }
@@ -23932,6 +24428,9 @@ async function probeAncestor(deps, ancestor, descendant, label) {
   }
 }
 async function runRcandResume(deps, options = {}) {
+  return withTrainWriter(deps, "rcand --resume", () => runRcandResumeLocked(deps, options));
+}
+async function runRcandResumeLocked(deps, options) {
   const watch = options.watch ?? false;
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
@@ -24180,6 +24679,8 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       dispatch2.deployStatus = historicalDeploy;
       dispatch2.note = `historical ${deployModel} deploy/publish status: ${historicalDeploy}; ${companion.note}`;
     }
+    if (persisted?.phases.deploy.superseded === true) phaseInputs.deploy = persisted.phases.deploy;
+    if (persisted?.phases.publish.superseded === true) phaseInputs.publish = persisted.phases.publish;
     if (persisted) {
       if (persisted.phases.deploy.superseded !== true) {
         await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(phaseInputs.deploy), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
@@ -24190,8 +24691,15 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: the GitHub Release exists at the immutable tag SHA" }), { strict: true, landed: "the promotion (verified live)" });
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
     }
+    const shippedDispatch = await appendServedChannelLegs(
+      deps,
+      { repo: ctx.repo, tag, releaseSha: tagSha, watch, deploy: phaseInputs.deploy, publish: phaseInputs.publish, installer: meta.installer },
+      dispatch2
+    );
+    Object.assign(dispatch2, shippedDispatch);
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
-    const announceNote2 = persisted && !shippedBefore && persisted.phases.deploy.superseded !== true && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
+    const settledBySupersede = persisted?.phases.deploy.superseded === true || persisted?.phases.publish.superseded === true;
+    const announceNote2 = persisted && !shippedBefore && !settledBySupersede && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
       deps,
       { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
       deployModel,
@@ -24281,7 +24789,10 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, runUrl: releaseUrl, note: "verified the Release published against the tagged commit" }), { strict: ledgerMode === "strict", landed: "the immutable tag, the re-proven wall, and the origin/main push" });
   let devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   let rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
-  const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
+  const [deployDispatch0, publishDispatch0] = await joinDeployAndPublish(
+    dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir),
+    observePublishIfRequired(deps, ctx, meta, deployModel, "main", tagSha, watch)
+  );
   const recoveredDeployDispatch = await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -24297,12 +24808,13 @@ ${recovery.note}`), recoveryInput);
   );
   const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch);
   steps.push(`dispatched the ${deployModel} deploy path`);
-  const deployLeg = phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
-  await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
-    strict: ledgerMode === "strict",
-    landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
-  });
-  const publishDispatch0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", tagSha, watch);
+  const deployLeg = persisted?.phases.deploy.superseded === true ? persisted.phases.deploy : phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
+  if (persisted?.phases.deploy.superseded !== true) {
+    await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
+      strict: ledgerMode === "strict",
+      landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
+    });
+  }
   const publishDispatch = publishDispatch0 ? await recoverFailedDispatchPhase(
     deps,
     ledger,
@@ -24311,12 +24823,18 @@ ${recovery.note}`), recoveryInput);
     publishDispatch0,
     { repo: ctx.repo, sha: tagSha, watched: false, workflow: "publish.yml" }
   ) : null;
-  const publishLeg = phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo }));
-  await recordPhase(ledger, deps, anchors, "publish", publishLeg, {
-    strict: ledgerMode === "strict",
-    landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
-  });
-  const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
+  const publishLeg = persisted?.phases.publish.superseded === true ? persisted.phases.publish : phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo }));
+  if (persisted?.phases.publish.superseded !== true) {
+    await recordPhase(ledger, deps, anchors, "publish", publishLeg, {
+      strict: ledgerMode === "strict",
+      landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
+    });
+  }
+  const dispatch = await appendServedChannelLegs(
+    deps,
+    { repo: ctx.repo, tag, releaseSha: tagSha, watch, deploy: deployLeg, publish: publishLeg, installer: meta.installer },
+    appendPublishDispatch(deployDispatch, publishDispatch)
+  );
   const announcing = announceShippedRelease(
     deps,
     { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
@@ -24325,8 +24843,9 @@ ${recovery.note}`), recoveryInput);
     releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
   );
   if (watch) {
-    devRollForward = await awaitAlignmentLanded(deps, ctx, devRollForward, "development");
-    if (rcAlignment) rcAlignment = await awaitAlignmentLanded(deps, ctx, rcAlignment, "rc");
+    const landed = await awaitAlignmentsLanded(deps, ctx, { dev: devRollForward, rc: rcAlignment });
+    devRollForward = landed.dev;
+    rcAlignment = landed.rc;
   }
   const announceNote = await announcing;
   steps.push(`development roll-forward: ${devRollForward.status}`);
@@ -24372,6 +24891,9 @@ async function withCheckoutRestoredAfterReleaseResume(deps, startBranch, operati
   return withCheckoutRestoredAfterRelease(deps, result, startBranch);
 }
 async function runReleaseResume(deps, options = {}) {
+  return withTrainWriter(deps, "release --resume", () => runReleaseResumeLocked(deps, options));
+}
+async function runReleaseResumeLocked(deps, options) {
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
   await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
@@ -24387,6 +24909,10 @@ async function runReleaseResume(deps, options = {}) {
   );
 }
 async function runReleaseAbort(deps, options = {}) {
+  if (!options.approved) return runReleaseAbortLocked(deps, options);
+  return withTrainWriter(deps, "release --abort", () => runReleaseAbortLocked(deps, options));
+}
+async function runReleaseAbortLocked(deps, options) {
   if (!options.approved) {
     throw new Error("release --abort requires --apply after explicit approval; nothing was written");
   }
@@ -24461,7 +24987,7 @@ async function runReleaseSupersedeDeploy(deps, options = {}) {
     throw new Error("release --supersede-deploy requires --apply after explicit master approval; nothing was written");
   }
   try {
-    return await supersedeContentCausedDeployLeg(deps, process.cwd());
+    return await withTrainWriter(deps, "release --supersede-deploy", () => supersedeContentCausedDeployLeg(deps, process.cwd()));
   } catch (e) {
     const message2 = e instanceof Error ? e.message : String(e);
     throw new Error(message2.includes("nothing was written") || message2.includes("nothing to do") ? message2 : `${message2}; nothing was written`);
@@ -24472,7 +24998,7 @@ async function runReleaseSupersedePublish(deps, options = {}) {
     throw new Error("release --supersede-publish requires --apply after explicit master approval; nothing was written");
   }
   try {
-    return await supersedeContentCausedPublishLeg(deps, process.cwd());
+    return await withTrainWriter(deps, "release --supersede-publish", () => supersedeContentCausedPublishLeg(deps, process.cwd()));
   } catch (e) {
     const message2 = e instanceof Error ? e.message : String(e);
     throw new Error(message2.includes("nothing was written") || message2.includes("nothing to do") ? message2 : `${message2}; nothing was written`);
@@ -24483,13 +25009,17 @@ async function runReleaseSupersedeDeployAndPublish(deps, options = {}) {
     throw new Error("release --supersede-deploy --supersede-publish requires --apply after explicit master approval; nothing was written");
   }
   try {
-    return await supersedeContentCausedDeployAndPublishLegs(deps, process.cwd());
+    return await withTrainWriter(deps, "release --supersede-deploy --supersede-publish", () => supersedeContentCausedDeployAndPublishLegs(deps, process.cwd()));
   } catch (e) {
     const message2 = e instanceof Error ? e.message : String(e);
     throw new Error(message2.includes("nothing was written") || message2.includes("nothing to do") ? message2 : `${message2}; nothing was written`);
   }
 }
 async function runReleasePublishRetry(deps, runId, options = {}) {
+  if (!options.approved) return runReleasePublishRetryLocked(deps, runId, options);
+  return withTrainWriter(deps, "release --retry-publish", () => runReleasePublishRetryLocked(deps, runId, options));
+}
+async function runReleasePublishRetryLocked(deps, runId, options) {
   if (!options.approved) {
     throw new Error("release --retry-publish requires --apply after explicit approval; nothing was written");
   }
@@ -24934,6 +25464,9 @@ async function resolveHotfixVersion(deps, env = process.env) {
   return { tag: `v${version}`, version, baseTag };
 }
 async function runTrainApply(command, deps, options = {}) {
+  return withTrainWriter(deps, `${command} --apply`, () => runTrainApplyLocked(command, deps, options));
+}
+async function runTrainApplyLocked(command, deps, options = {}) {
   const watch = options.watch ?? false;
   await runTrainDoctor({ lane: command === "rcand" ? "rcand" : "release", dev: command === "release" && options.dev === true, heal: true, train: deps, refuse: true });
   const ctx = await buildTrainApplyContext(deps);
@@ -24981,6 +25514,7 @@ var RULESET_TEMPLATE_SEED = "seed:mmi-product-required-checks.template.json";
 var RULESET_REFERENCE_MATCH_LABEL = "committed ruleset reference matches the live ruleset (#3816)";
 var GATE_GREEN_ON_BASE_LABEL = "gate is green on the default branch (#3819)";
 var REQUIRED_CONTEXTS_EMITTED_LABEL = "required check contexts match PR workflows";
+var UNBLOCKING_GATE_JOBS_LABEL = "every gate job can block a merge (#7012)";
 var TAG_ADDRESSABLE_CONTEXTS_LABEL = "rc/main required contexts are tag-addressable (#3880)";
 var RELEASE_BRANCH_REACHABLE_LABEL = "rc/main required contexts are reachable from a release-base head (#5193)";
 var RULESET_TRACK_SCOPE_LABEL = "product ruleset branch scope covers the release track (#6327)";
@@ -25413,6 +25947,17 @@ async function auditRepoCi(repo, deps) {
           remediation: missingEmitters.length ? `Fix the pull_request workflows or ${contextAuthority.source} before reconciling` : void 0
         });
       }
+      if (hasRequiredChecks) {
+        const gateFiles = new Set(gateWorkflowFiles(prWorkflowPaths));
+        const gateWorkflows = (await getBranchWorkflows() ?? []).filter((wf) => gateFiles.has(wf.path.slice(wf.path.lastIndexOf("/") + 1)));
+        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job));
+        checks.push({
+          ok: unblocking.length === 0,
+          label: UNBLOCKING_GATE_JOBS_LABEL,
+          detail: unblocking.length ? `gate job(s) [${unblocking.join(", ")}] run on every PR but are neither required nor needed by a required job (required: [${liveContexts.join(", ")}]) \u2014 a red one still merges and turns ${baseBranch} red for every later PR` : void 0,
+          remediation: unblocking.length ? `mmi-cli oracle org project set ${repo} --var requiredChecks=${JSON.stringify(sortedUnique([...liveContexts, ...unblocking]))} then mmi-cli devops ci reconcile --repo ${repo} --apply \u2014 or make a required job \`needs:\` them` : void 0
+        });
+      }
       const prOnly = contextAuthority.coversReleaseBranches ? contextAuthority.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context)) : [];
       const tagBlind = contextAuthority.coversReleaseBranches ? contextsUnreachableOnTagPush(contextAuthority.contexts, await getBranchWorkflows() ?? [], TRAIN_PR_ONLY_CONTEXTS) : [];
       checks.push({
@@ -30348,7 +30893,7 @@ function registerDeployCommands(program3) {
 init_cli_shared();
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
+var UNSET_KEYS = ["installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -30606,6 +31151,17 @@ function parseRuntimeVaultOnlyVar(raw) {
   if (raw === "false") return false;
   throw new Error("org project set: runtimeVaultOnly must be true or false");
 }
+function parseInstallerVar(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: installer must be JSON, e.g. {"product":"mm-strategy","family":"mmi"}');
+  }
+  const error = installerDeclarationError(value, "mmi");
+  if (error && !error.includes("breaks the sign-in rule")) throw new Error(`org project set: ${error}`);
+  return value;
+}
 function parseSeedCanaryVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
@@ -30776,7 +31332,8 @@ var SETTABLE_VAR_KEYS = [
   "ciExemptReason",
   "gate",
   "secrets",
-  "seedCanary"
+  "seedCanary",
+  "installer"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -30789,6 +31346,7 @@ var SETTABLE_VAR_HINTS = {
   consumesDesignSystem: '"fofu"',
   runtimeVaultOnly: "true|false",
   seedCanary: "true|false",
+  installer: "JSON {product,family:jerv|mmi,login?:github|google} \u2014 the repo ships a one-line installer on get.jerv.ai or get.mutmut.work",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
   oauth: "JSON {subdomains,domains,callbackPath,extraCallbackPaths}",
   requiredGcpApis: "comma-string",
@@ -30924,6 +31482,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseRuntimeVaultOnlyVar(raw);
     } else if (key === "seedCanary") {
       patch[key] = parseSeedCanaryVar(raw);
+    } else if (key === "installer") {
+      patch[key] = parseInstallerVar(raw);
     } else if (key === "consumesDesignSystem") {
       patch[key] = parseConsumesDesignSystemVar(raw);
     } else if (key === "publishDir") {
@@ -43998,6 +44558,32 @@ function formatHotfixBatchPreflightRefusal(failures, fromSpecs) {
 ${lines2.join("\n")}
 Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
 }
+var CHERRY_PICKED_FROM = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
+async function findHotfixPickGaps(deps, sources, tolerated) {
+  if (sources.length === 0) return [];
+  const namedShas = new Set(sources.map((s) => s.sha.toLowerCase()));
+  const carried = /* @__PURE__ */ new Set();
+  const mainOnly = await deps.run("git", ["log", "--no-merges", "--format=%B", "origin/development..origin/main"]);
+  for (const m of mainOnly.matchAll(CHERRY_PICKED_FROM)) carried.add(m[1].toLowerCase());
+  const gaps = [];
+  const devOnly = (await deps.run("git", ["log", "--no-merges", "--reverse", "--format=%H%x09%s", "origin/main..origin/development"])).split("\n").map((s) => s.trim()).filter(Boolean);
+  for (const line of devOnly) {
+    const [sha, ...subjectParts] = line.split("	");
+    if (!sha) continue;
+    const lower = sha.toLowerCase();
+    if (namedShas.has(lower) || carried.has(lower)) continue;
+    const paths = (await deps.run("git", ["show", "--no-color", "--name-only", "--pretty=format:", sha])).split("\n").map((s) => s.trim()).filter(Boolean);
+    if (paths.length === 0 || paths.every((p) => pathIsTolerated(p, tolerated))) continue;
+    gaps.push({ sha, subject: subjectParts.join("	") });
+  }
+  return gaps;
+}
+function formatHotfixPickGapRefusal(gaps, tag, fromSpecs) {
+  const lines2 = gaps.map((g) => `  - ${g.sha.slice(0, 7)} ${g.subject}`);
+  return `hotfix start refused: ${tag} would omit ${gaps.length} merged development fix(es) not on origin/main:
+${lines2.join("\n")}
+A hotfix branch is cut from origin/main and carries ONLY the fixes --from names, in order (#4411) \u2014 every other merged development fix stays unshipped while the channel reports healthy (#6994). Add each omitted fix to the pick list and rerun \`mmi-cli devops hotfix start --from ${[...fromSpecs, ...gaps.map((g) => g.sha.slice(0, 7))].join(",")}\`, or, when a listed fix is provably not needed on main (a development-only change, already superseded), rerun with \`--ack ${gaps.map((g) => g.sha.slice(0, 7)).join(",")}\` naming exactly the sha(s) a human excluded \u2014 the ack is recorded in the PR body, never silent.`;
+}
 async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return [];
   const startBranch = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
@@ -44137,6 +44723,9 @@ async function hotfixReleaseExists(deps, ctx, tag) {
   }
 }
 async function runHotfixStart(deps, options, doctor = runTrainDoctor) {
+  return withTrainWriter(deps, "hotfix start", () => runHotfixStartLocked(deps, options, doctor));
+}
+async function runHotfixStartLocked(deps, options, doctor) {
   await doctor({ lane: "hotfix", heal: true, train: deps, refuse: true });
   const ctx = await buildTrainApplyContext(deps);
   const status = await deps.run("git", ["status", "--porcelain"]);
@@ -44184,6 +44773,18 @@ async function runHotfixStart(deps, options, doctor = runTrainDoctor) {
   }
   const label = sources.map((s) => s.label).join(", ");
   const { foldPaths, pickTolerated } = await resolveHotfixPickTolerated(deps, deployModel);
+  const ackedShas = (options.ack ?? []).map((a) => a.trim().toLowerCase()).filter(Boolean);
+  const pickGaps = await findHotfixPickGaps(deps, sources, pickTolerated);
+  const unacked = pickGaps.filter((g) => {
+    const sha = g.sha.toLowerCase();
+    return !ackedShas.some((a) => sha.startsWith(a) || a.startsWith(sha));
+  });
+  if (unacked.length > 0) {
+    throw new Error(formatHotfixPickGapRefusal(unacked, tag, specs));
+  }
+  if (pickGaps.length > 0) {
+    notes.push(`pick-completeness ack: excluded ${pickGaps.map((g) => `${g.sha.slice(0, 7)} ${g.subject}`).join("; ")} by --ack (#6994)`);
+  }
   const remoteBranch = clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   if (remoteBranch) {
     await deps.run("git", ["checkout", branch]);
@@ -44248,7 +44849,9 @@ async function runHotfixStart(deps, options, doctor = runTrainDoctor) {
     "--body",
     `Hotfix ${tag}: cherry-pick of ${label} onto origin/main${bumpNote}.
 
-<!-- mmi-hotfix-carries: ${sources.map((s) => s.sha).join(",")} -->
+<!-- mmi-hotfix-carries: ${sources.map((s) => s.sha).join(",")} -->${pickGaps.length > 0 ? `
+
+<!-- mmi-hotfix-acked-excluded: ${pickGaps.map((g) => g.sha).join(",")} (#6994 pick-completeness) -->` : ""}
 
 Merge this PR (human-initiated), then run \`mmi-cli devops hotfix release ${tag}\`.`
   ]));
@@ -44420,6 +45023,24 @@ async function appendHotfixGatewayRun(deps, repo, tag, sha, runs, note) {
   }
   return gateway.note;
 }
+async function appendHotfixServedChannel(deps, input, runs, note) {
+  const before = hotfixDispatchFromRuns(runs, note);
+  const after = await appendServedChannelLegs(
+    deps,
+    { repo: input.repo, tag: input.tag, releaseSha: input.sha, watch: true, deploy: input.deploy, publish: input.publish, installer: input.installer },
+    before
+  );
+  for (const row of servedChannelRowsAfter(before, after)) {
+    runs.push({
+      workflow: row.workflow,
+      ...row.runId != null ? { runId: row.runId } : {},
+      ...row.runUrl ? { url: row.runUrl } : {},
+      ...row.runUrlNote ? { runUrlNote: row.runUrlNote } : {},
+      conclusion: row.conclusion
+    });
+  }
+  return after.note;
+}
 function hotfixPhaseInputsFromRuns(deployModel, runs, note, publishDispatch, publishRequired, opts) {
   const dispatch = hotfixDispatchFromRuns(runs, note);
   return {
@@ -44542,6 +45163,9 @@ async function assertConsumerBomLineage(deps, mergedSha, tag) {
   }
 }
 async function runHotfixRelease(deps, versionInput, options = {}, doctor = runTrainDoctor) {
+  return withTrainWriter(deps, `hotfix release ${versionInput}`, () => runHotfixReleaseLocked(deps, versionInput, options, doctor));
+}
+async function runHotfixReleaseLocked(deps, versionInput, options, doctor) {
   await doctor({ lane: "hotfix", heal: true, train: deps, refuse: true });
   const ctx = await buildTrainApplyContext(deps);
   const { tag, version } = normalizeHotfixVersion(versionInput);
@@ -44638,9 +45262,9 @@ ${decision.note}`);
   let deployNote;
   let tenantPublishDispatch = null;
   if (deployModel === "hub-serverless") {
-    for (const workflow of HOTFIX_RELEASE_WORKFLOWS) {
-      const watched = await watchReleaseRun(deps, ctx, workflow, mergedSha);
-      runs.push(await recoverHotfixReleaseRun(deps, ledger, anchors, ctx, deployModel, workflow === "publish.yml" ? "publish" : "deploy", watched));
+    const watchedRuns = await Promise.all(HOTFIX_RELEASE_WORKFLOWS.map((workflow) => watchReleaseRun(deps, ctx, workflow, mergedSha)));
+    for (const watched of watchedRuns) {
+      runs.push(await recoverHotfixReleaseRun(deps, ledger, anchors, ctx, deployModel, watched.workflow === "publish.yml" ? "publish" : "deploy", watched));
     }
     deployNote = "watched release-triggered deploy.yml + publish.yml";
   } else if (deployModel === "registry-publish") {
@@ -44649,17 +45273,9 @@ ${decision.note}`);
     runs.push(run);
     deployNote = "watched this repo's own release-triggered publish.yml (#2428 \u2014 no central dispatch)";
   } else if (deployModel === "tenant-container" || deployModel === "solo-container") {
-    const deploy0 = await dispatchDeploy(
-      deps,
-      ctx,
-      "main",
-      "main",
-      deployModel,
-      true,
-      (deps.now ?? Date.now)(),
-      mergedSha,
-      "report",
-      meta.publishDir
+    const [deploy0, publish0] = await joinDeployAndPublish(
+      dispatchDeploy(deps, ctx, "main", "main", deployModel, true, (deps.now ?? Date.now)(), mergedSha, "report", meta.publishDir),
+      observePublishIfRequired(deps, ctx, meta, deployModel, "main", mergedSha, true)
     );
     const deploy = await recoverFailedDispatchPhase(
       deps,
@@ -44669,7 +45285,6 @@ ${decision.note}`);
       deploy0,
       { repo: releaseRunRepoFor(deployModel, ctx.repo), sha: mergedSha, watched: true, workflow: "tenant-deploy.yml" }
     );
-    const publish0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", mergedSha, true);
     const publish = publish0 ? await recoverFailedDispatchPhase(
       deps,
       ledger,
@@ -44697,6 +45312,7 @@ ${decision.note}`);
   );
   await recordHotfixPhase(ledger, anchors, "deploy", ledgerInputs.deploy, "the immutable tag, the green wall, origin/main, and the GitHub Release");
   await recordHotfixPhase(ledger, anchors, "publish", ledgerInputs.publish, "the immutable tag, the green wall, origin/main, the GitHub Release, and the deploy path");
+  deployNote = await appendHotfixServedChannel(deps, { repo: ctx.repo, tag, sha: mergedSha, deploy: ledgerInputs.deploy, publish: ledgerInputs.publish, installer: meta.installer }, runs, deployNote);
   const announceNote = releaseExists ? void 0 : await announceShippedRelease(
     deps,
     { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
@@ -44765,6 +45381,9 @@ ${decision.note}`);
   return { ...result, ...localSync ? { localSync } : {} };
 }
 async function runHotfixRetryDeploy(deps, versionInput) {
+  return withTrainWriter(deps, `hotfix release ${versionInput} --retry-deploy`, () => runHotfixRetryDeployLocked(deps, versionInput));
+}
+async function runHotfixRetryDeployLocked(deps, versionInput) {
   const ctx = await buildTrainApplyContext(deps);
   const { tag } = normalizeHotfixVersion(versionInput);
   const status = await deps.run("git", ["status", "--porcelain"]);
@@ -45380,6 +45999,8 @@ async function announceSummaryRefusal(path2) {
 }
 function trainApplyDeps() {
   return {
+    // #7027: every mutating train verb holds this checkout's train writer lock for its whole run.
+    trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
       try {
@@ -45491,7 +46112,7 @@ function trainApplyDeps() {
 }
 function formatWorkflowRun(r) {
   const evidenced = workflowRunWithEvidence(r);
-  return `${evidenced.workflow} ${evidenced.runUrl ?? evidenced.runUrlNote} ${evidenced.conclusion.toUpperCase()}`;
+  return `${evidenced.workflow} ${evidenced.runUrl ?? evidenced.runUrlNote} ${evidenced.conclusion.toUpperCase()}${r.parallel ? " (parallel)" : ""}`;
 }
 function renderDeployLine(d) {
   const parts = [d.dispatch];
@@ -46136,7 +46757,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const steps = trainPlan("hotfix");
     console.log(o.json ? JSON.stringify({ command: "hotfix", steps }, null, 2) : renderSteps("mmi-cli devops hotfix: dry-run plan", steps));
   });
-  hotfixCmd.command("start").description("cherry-pick one or more merged development PRs (or SHAs) onto hotfix/vX.Y.Z from origin/main, bump the distribution, open the main-base PR").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR number(s) or commit SHA(s) to cherry-pick, in pick order \u2014 one hotfix cycle carries as many fixes as you name (#4411)").option("--json", "machine-readable output").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (o) => runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from }), o, renderHotfixStart));
+  hotfixCmd.command("start").description("cherry-pick one or more merged development PRs (or SHAs) onto hotfix/vX.Y.Z from origin/main, bump the distribution, open the main-base PR").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR number(s) or commit SHA(s) to cherry-pick, in pick order \u2014 one hotfix cycle carries as many fixes as you name (#4411)").option("--ack <shas>", "comma-separated dev shas a human verified are NOT needed on main, overriding the pick-completeness guard for exactly those fixes \u2014 recorded in the PR body, never silent (#6994)").option("--json", "machine-readable output").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (o) => runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from, ack: o.ack ? o.ack.split(",").map((s) => s.trim()).filter(Boolean) : void 0 }), o, renderHotfixStart));
   hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--retry-deploy", "re-run only the failed deploy and/or fold-port alignment legs of a published hotfix of this same tag (#6985)").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => {
     if (o.retryDeploy) {
       if (o.announceSummaryFile || o.carries) {
@@ -47595,10 +48216,9 @@ function resolveHouseShim(argv) {
     const flatPath = flatTokens.join(" ");
     const flatHouse = houseForPath(flatPath);
     if (!flatHouse || flatHouse === "core") return;
-    refuseHouseShim(
-      flatPath,
-      `mmi-cli: the flat '${flatPath}' alias was removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316) \u2014 ${recoveryPointerFor(flatPath)}`
-    );
+    process.stderr.write(`mmi-cli: '${flatPath}' is the old flat form \u2014 ran it as \`mmi-cli ${canonicalPathFor(registeredPathPrefix(flatPath))}\` (use that spelling)
+`);
+    return;
   }
   const remainder = argv.slice(3);
   const first = remainder[0];
@@ -47620,6 +48240,14 @@ function resolveHouseShim(argv) {
   if (actual && isDeclaredHouseAlias(houseToken, lookupPath)) {
     process.stderr.write(
       `mmi-cli: '${lookupPath}' lives in house '${actual}', not '${houseToken}' \u2014 routed to \`mmi-cli ${canonicalPathFor(lookupPath)}\`
+`
+    );
+    argv.splice(2, 1);
+    return;
+  }
+  if (actual && actual !== "core" && registeredPathPrefix(lookupPath) === lookupPath) {
+    process.stderr.write(
+      `mmi-cli: '${lookupPath}' lives in house '${actual}', not '${houseToken}' \u2014 ran it as \`mmi-cli ${canonicalPathFor(lookupPath)}\`
 `
     );
     argv.splice(2, 1);
@@ -47648,8 +48276,8 @@ function printHouseRootHelp(house) {
   }
   lines2.push(
     "",
-    `Canonical: \`mmi-cli ${house} <command> \u2026\`. The flat \`mmi-cli <command> \u2026\` compatibility shims`,
-    `were removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438) \u2014 only the canonical house-prefixed form parses.`
+    `Canonical: \`mmi-cli ${house} <command> \u2026\`. The old flat \`mmi-cli <command> \u2026\` form still runs`,
+    "with a notice naming the canonical spelling (#7034), so an out-of-date plugin keeps working."
   );
   consoleIo.log(lines2.join("\n"));
 }