@mutmutco/cli 4.4.9 → 4.4.11

package/dist/main.cjs

@@ -15938,10 +15938,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.4.9",
-    tag: "v4.4.9",
-    commit: "da79ce082e9b",
-    npm: "@mutmutco/cli@4.4.9"
+    version: "4.4.11",
+    tag: "v4.4.11",
+    commit: "47113a5df32d",
+    npm: "@mutmutco/cli@4.4.11"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15958,14 +15958,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.4.9"
+          v3Target: "v4.4.11"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.4.9 and redeploy the Hub Lambda from tag v4.4.9 (da79ce082e9b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.4.9 (@mutmutco/cli@4.4.9, tag commit da79ce082e9b \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.4.11 and redeploy the Hub Lambda from tag v4.4.11 (47113a5df32d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.4.11 (@mutmutco/cli@4.4.11, tag commit 47113a5df32d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18235,7 +18235,7 @@ async function correlateRun(deps, args) {
     });
     const tokens2 = args.mode === "dispatch" ? args.titleIncludes : void 0;
     const titleMatch = tokens2 && tokens2.length ? candidates.find((c) => tokens2.every((t) => (c.row.displayTitle ?? "").includes(t))) : void 0;
-    const match = titleMatch ?? (windowProvenWhole ? candidates[0] : void 0);
+    const match = titleMatch ?? (args.mode === "workflow" || windowProvenWhole ? candidates[0] : void 0);
     if (match) return { runId: match.row.databaseId, runUrl: match.row.url, read: "found" };
     if (!windowProvenWhole) truncatedWindow = true;
   }
@@ -18256,9 +18256,6 @@ async function correlateRun(deps, args) {
 function correlateTenantRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-deploy.yml", since, mode: "dispatch", titleIncludes });
 }
-function correlatePublishRun(deps, since, titleIncludes) {
-  return correlateRun(deps, { workflow: "tenant-publish.yml", since, mode: "dispatch", titleIncludes });
-}
 function correlateGetPublishRun(deps, since, product) {
   return correlateRun(deps, { workflow: "get-publish.yml", since, mode: "dispatch", titleIncludes: [product] });
 }
@@ -18877,134 +18874,19 @@ async function dispatchTenantDeployWithRetry(deps, input) {
     }
   }
 }
-function tenantPublishRecoveryCommand(slug, repo, ref, stage, publishDir) {
-  const parts = [
-    `gh workflow run tenant-publish.yml --repo ${HUB_REPO2}`,
-    `-f slug=${slug}`,
-    `-f repo=${repo}`,
-    `-f ref=${ref}`,
-    `-f stage=${stage}`
-  ];
-  if (publishDir && publishDir !== ".") parts.push(`-f publishDir=${publishDir}`);
-  return parts.join(" ");
-}
-var PUBLISH_CONFLICT_SIGNAL = /E409|cannot publish over|previously published|\b(?:HTTP|status|code)\s*[:=]?\s*409\b|\b409\s+Conflict\b/i;
-var PUBLISH_LOG_RETRY_ATTEMPTS = 4;
-var PUBLISH_LOG_RETRY_DELAY_MS = 6e3;
-function publishRegistryTarget(meta, repo, publishRef) {
-  const version = publishRef.replace(/^v/, "");
-  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) return void 0;
-  try {
-    return { name: resolveReleaseAbortNpmPackage(meta, repo), version };
-  } catch {
-    return void 0;
-  }
-}
-async function provePublishedVersion(deps, target) {
-  try {
-    return clean2(await deps.run("npm", ["view", `${target.name}@${target.version}`, "version"])) === target.version;
-  } catch {
-    return false;
-  }
-}
-function publishReconcileFailureNote(input) {
-  if (input.signal && input.target) {
-    return `run FAILED and its log shows a publish conflict (${input.signal}) but the registry does not report ${input.target.name}@${input.target.version} live \u2014 the failure stands (verify with an authenticated registry read, never a bare npm view \u2014 see docs/Guides/train-troubleshooting.md#publish-private-package)`;
-  }
-  if (input.signal) {
-    return `run FAILED and its log shows a publish conflict (${input.signal}) but no npm package name could be resolved to prove the exact version live \u2014 the failure stands`;
-  }
-  if (input.readError) {
-    return `run FAILED and its log could not be read (${input.readError}) \u2014 the failure stands`;
-  }
-  return 'run FAILED and its log shows no publish-conflict signal (E409, "cannot publish over", "previously published", or a 409 status) \u2014 the failure stands';
-}
-async function reconcilePublishFailure(deps, runId, target) {
-  if (runId == null) {
-    return { status: "failure", note: "the failed publish run had no run id to re-read \u2014 the failure stands" };
-  }
-  const sleep2 = resolveSleep(deps);
-  let signal;
-  let readError;
-  for (let attempt = 0; attempt < PUBLISH_LOG_RETRY_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep2(PUBLISH_LOG_RETRY_DELAY_MS);
-    const log = await fetchControlRunLog(deps, runId);
-    if (!log.ok) {
-      readError = log.error;
-      continue;
-    }
-    const match = log.log.match(PUBLISH_CONFLICT_SIGNAL);
-    if (!match) continue;
-    signal = match[0];
-    if (target && await provePublishedVersion(deps, target)) {
-      return {
-        status: "success",
-        note: `registry reports ${target.name}@${target.version} live; run failed with a publish conflict (${signal}) \u2014 #2428/#6777`
-      };
-    }
-  }
-  return { status: "failure", note: publishReconcileFailureNote({ signal, readError, target }) };
-}
-async function dispatchTenantPublish(deps, ctx, stage, ref, watch, dispatchFailure = "throw", publishDir, publishTarget) {
-  deps.warn?.("Release: Starting package publishing");
-  const since = (deps.now ?? Date.now)();
-  const dispatchArgs = [
-    "workflow",
-    "run",
-    "tenant-publish.yml",
-    "--repo",
-    HUB_REPO2,
-    "-f",
-    `slug=${ctx.slug}`,
-    "-f",
-    `repo=${ctx.repo}`,
-    "-f",
-    `ref=${ref}`,
-    "-f",
-    `stage=${stage}`
-  ];
-  if (publishDir && publishDir !== ".") dispatchArgs.push("-f", `publishDir=${publishDir}`);
-  try {
-    await deps.run("gh", dispatchArgs);
-  } catch (e) {
-    if (dispatchFailure === "throw") throw e;
-    const msg = e instanceof Error ? e.message : String(e);
-    const recovery = tenantPublishRecoveryCommand(ctx.slug, ctx.repo, ref, stage, publishDir);
-    return {
-      note: `tenant-publish dispatch FAILED: ${msg}. The promotion itself landed \u2014 recover with \`${recovery}\``,
-      deployStatus: "failure"
-    };
-  }
-  const correlated = await correlatePublishRun(deps, since, [ctx.slug, stage]);
-  if (correlated.read === "failed") {
-    return {
-      note: `tenant-publish dispatched (slug=${ctx.slug}, ref=${ref}, stage=${stage}) but its run could not be READ: ${correlated.error}. The promotion itself landed \u2014 check the Actions tab, and if the publish never ran, recover with \`${tenantPublishRecoveryCommand(ctx.slug, ctx.repo, ref, stage, publishDir)}\``,
-      deployStatus: "failure"
-    };
-  }
-  const { runId, runUrl } = correlated;
-  let deployStatus = watch ? await watchTenantRun(deps, runId) : "pending";
-  let note = `dispatched tenant-publish.yml (slug=${ctx.slug}, ref=${ref}, stage=${stage})`;
-  if (deployStatus === "failure") {
-    const reconciled = await reconcilePublishFailure(deps, runId, publishTarget);
-    deployStatus = reconciled.status;
-    note = `${note}; ${reconciled.note}`;
-  }
-  return { note, runId, runUrl, deployStatus };
-}
-async function dispatchPublishIfRequired(deps, ctx, meta, model, stage, publishRef, watch, dispatchFailure) {
+async function observePublishIfRequired(deps, ctx, meta, model, stage, releaseSha, watch) {
   if (!meta.publishRequired || stage !== "main") return null;
   if (model !== "tenant-container" && model !== "solo-container") return null;
-  return dispatchTenantPublish(
-    deps,
-    ctx,
-    stage,
-    publishRef,
-    watch,
-    dispatchFailure,
-    meta.publishDir,
-    publishRegistryTarget(meta, ctx.repo, publishRef)
-  );
+  const target = { workflow: "publish.yml", event: "release" };
+  const workflowRuns = watch ? await watchOwnWorkflowRuns(deps, ctx.repo, [target], 0, releaseSha) : [await listTargetRun(deps, ctx.repo, target, releaseSha)];
+  const primary = workflowRuns[0];
+  return {
+    note: `observed ${ctx.repo} release-triggered publish.yml for ${releaseSha}`,
+    runId: primary?.runId,
+    runUrl: primary?.runUrl,
+    workflowRuns,
+    deployStatus: aggregateWorkflowRuns(workflowRuns)
+  };
 }
 function appendPublishDispatch(deploy, publish) {
   if (!publish) return deploy;
@@ -19012,7 +18894,7 @@ function appendPublishDispatch(deploy, publish) {
     note: `${deploy.note}; ${publish.note}`,
     runId: deploy.runId,
     runUrl: deploy.runUrl,
-    workflowRuns: [...deploy.workflowRuns ?? [], ...publish.workflowRuns ?? [{ workflow: "tenant-publish.yml", runId: publish.runId, runUrl: publish.runUrl, conclusion: publish.deployStatus }]],
+    workflowRuns: [...deploy.workflowRuns ?? [], ...publish.workflowRuns ?? [{ workflow: "publish.yml", runId: publish.runId, runUrl: publish.runUrl, conclusion: publish.deployStatus }]],
     deployStatus: deploy.deployStatus === "failure" || publish.deployStatus === "failure" ? "failure" : deploy.deployStatus === "pending" || publish.deployStatus === "pending" ? "pending" : "success"
   };
 }
@@ -19020,6 +18902,11 @@ var HUB_SERVED_PRODUCT = "mmi";
 function getPublishDispatchCommand(repo, product = HUB_SERVED_PRODUCT) {
   return `gh workflow run get-publish.yml --repo ${repo} --ref main -f product=${product}`;
 }
+var HUB_GET_SLUG = "mmi-get";
+var HUB_GET_STAGE = "main";
+function mmiGetRedeployCommand(repo) {
+  return `gh workflow run tenant-deploy.yml --repo ${repo} --ref main -f slug=${HUB_GET_SLUG} -f repo=${repo} -f ref=${HUB_GET_STAGE} -f stage=${HUB_GET_STAGE}`;
+}
 function readLocalLauncherVersion(root = process.cwd()) {
   try {
     const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "installer", "launcher", "package.json"), "utf8");
@@ -19051,6 +18938,69 @@ async function fetchServedChannelVersion(url, fetchImpl = fetch) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
 }
+async function appendMmiGetRedeploy(deps, input, dispatch) {
+  if (!isHubControlRepo(input.repo)) return dispatch;
+  const remedy = mmiGetRedeployCommand(input.repo);
+  const withNote = (note, deployStatus) => ({
+    ...dispatch,
+    note: `${dispatch.note}; ${note}`,
+    ...deployStatus ? { deployStatus } : {}
+  });
+  if (input.publishStatus !== "success") {
+    return withNote(`mmi-get box NOT redeployed (publish did not succeed) \u2014 after the publish is green, run \`${remedy}\``);
+  }
+  const since = (deps.now ?? Date.now)();
+  try {
+    await deps.run("gh", [
+      "workflow",
+      "run",
+      "tenant-deploy.yml",
+      "--repo",
+      input.repo,
+      "--ref",
+      "main",
+      "-f",
+      `slug=${HUB_GET_SLUG}`,
+      "-f",
+      `repo=${input.repo}`,
+      "-f",
+      `ref=${HUB_GET_STAGE}`,
+      "-f",
+      `stage=${HUB_GET_STAGE}`
+    ]);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return withNote(`tenant-deploy dispatch FAILED: ${msg}. The release itself landed, but the MMI-GET BOX WAS NOT REDEPLOYED \u2014 recover with \`${remedy}\``, "failure");
+  }
+  const correlated = await correlateTenantRun(deps, since, [HUB_GET_SLUG, HUB_GET_STAGE]);
+  if (correlated.read === "failed" || correlated.read === "absent") {
+    const why = correlated.read === "failed" ? `its run could not be READ: ${correlated.error}` : "no matching run appeared";
+    return withNote(`tenant-deploy dispatched (slug=${HUB_GET_SLUG}, stage=${HUB_GET_STAGE}) but ${why}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure");
+  }
+  const { runId, runUrl } = correlated;
+  const runRow = { workflow: "tenant-deploy.yml", ...runId ? { runId } : {}, ...runUrl ? { runUrl } : {} };
+  if (!input.watch) {
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; dispatched tenant-deploy.yml (slug=${HUB_GET_SLUG}, ref=${HUB_GET_STAGE}, stage=${HUB_GET_STAGE}) \u2014 NOT watched, so the mmi-get box is not yet proven redeployed`,
+      workflowRuns: [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: "pending" }]
+    };
+  }
+  const runStatus = await watchTenantRun(deps, runId, input.repo);
+  if (runStatus !== "success") {
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; tenant-deploy.yml ${runStatus} \u2014 the MMI-GET BOX WAS NOT REDEPLOYED; recover with \`${remedy}\``,
+      workflowRuns: [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: runStatus }],
+      deployStatus: "failure"
+    };
+  }
+  return {
+    ...dispatch,
+    note: `${dispatch.note}; mmi-get box redeployed (tenant-deploy.yml slug=${HUB_GET_SLUG} stage=${HUB_GET_STAGE})`,
+    workflowRuns: [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: "success" }]
+  };
+}
 async function appendServedChannelPublish(deps, input, dispatch) {
   if (!isHubControlRepo(input.repo)) return dispatch;
   const channelUrl = input.channelUrl ?? readServedChannelUrl();
@@ -19118,9 +19068,16 @@ async function appendServedChannelPublish(deps, input, dispatch) {
       deployStatus: "failure"
     };
   }
+  if (!expected) {
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; get-publish.yml succeeded and ${channelUrl} reports ${probe.version}, but the local launcher version could not be read \u2014 nothing was compared, so the move is unverified`,
+      workflowRuns: runs
+    };
+  }
   return {
     ...dispatch,
-    note: `${dispatch.note}; served channel moved \u2014 ${channelUrl} now reports ${probe.version}${expected ? "" : " (no local launcher version to compare against)"}`,
+    note: `${dispatch.note}; served channel moved \u2014 ${channelUrl} now reports ${probe.version}`,
     workflowRuns: runs
   };
 }
@@ -21505,7 +21462,8 @@ function publishPhaseInput(model, dispatch, publishDispatch, publishRequired, op
   const sha = opts.releaseSha;
   const publishRow = publishDispatch ? {
     state: publishDispatch.deployStatus === "success" ? "complete" : publishDispatch.deployStatus === "failure" ? "failed" : "pending",
-    ...runMetadata({ runId: publishDispatch.runId, runUrl: publishDispatch.runUrl, workflow: "tenant-publish.yml", event: "workflow_dispatch" }, HUB_REPO2, "dispatch"),
+    ...sha ? { sha } : {},
+    ...runMetadata({ runId: publishDispatch.runId, runUrl: publishDispatch.runUrl, workflow: "publish.yml", event: "release" }, opts.repo ?? "", "sha"),
     note: publishDispatch.note
   } : void 0;
   switch (model) {
@@ -23645,29 +23603,28 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", deployLeg, {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
-  const publishDispatch0 = deployDispatch.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report") : null;
+  const publishDispatch0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", releaseSha, watch);
   const publishDispatch = publishDispatch0 ? await recoverFailedDispatchPhase(
     deps,
     ledger,
     ledgerAnchors,
     "publish",
     publishDispatch0,
-    { repo: releaseRunRepoFor(deployModel, ctx.repo), sha: releaseSha, watched: isCentralDispatchModel(deployModel), workflow: isCentralDispatchModel(deployModel) ? "tenant-publish.yml" : "publish.yml" }
+    { repo: ctx.repo, sha: releaseSha, watched: false, workflow: "publish.yml" }
   ) : null;
-  let publishSkipNote;
-  if (!publishDispatch && deployDispatch.deployStatus !== "success" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
-    publishSkipNote = deployDispatch.deployStatus === "failure" ? "box deploy failed - redeploy the box before publishing" : "box deploy not confirmed (run with --watch) - publish after the box deploy lands";
-  }
   const publishLeg = phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, {
     releaseSha,
-    repo: ctx.repo,
-    ...publishSkipNote !== void 0 ? { skipPublishNote: publishSkipNote } : {}
+    repo: ctx.repo
   }));
   await recordPhase(ledger, deps, ledgerAnchors, "publish", publishLeg, {
     landed: "the immutable tag, the green required-check wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  if (publishSkipNote) dispatch = { ...dispatch, note: `${dispatch.note}; tenant-publish.yml skipped (${publishSkipNote})` };
+  dispatch = await appendMmiGetRedeploy(
+    deps,
+    { repo: ctx.repo, publishStatus: publishLeg.state === "complete" ? "success" : "failure", watch },
+    dispatch
+  );
   dispatch = await appendServedChannelPublish(
     deps,
     { repo: ctx.repo, publishStatus: publishLeg.state === "complete" ? "success" : "failure", watch },
@@ -23992,6 +23949,15 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       workflowRuns: historicalRows
     });
     const phaseInputs = phaseInputsFromRunRows(deployModel, dispatch2.workflowRuns ?? historicalRows, tagSha, { repo: ctx.repo });
+    const companion = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", tagSha, watch);
+    if (companion) {
+      if (persisted) phaseInputs.deploy = persisted.phases.deploy;
+      phaseInputs.publish = publishPhaseInput(deployModel, dispatch2, companion, true, { releaseSha: tagSha, repo: ctx.repo });
+      historicalRows.push(...companion.workflowRuns ?? []);
+      historicalDeploy = phaseInputs.deploy.state === "failed" || companion.deployStatus === "failure" ? "failure" : phaseInputs.deploy.state === "complete" && companion.deployStatus === "success" ? "success" : "pending";
+      dispatch2.deployStatus = historicalDeploy;
+      dispatch2.note = `historical ${deployModel} deploy/publish status: ${historicalDeploy}; ${companion.note}`;
+    }
     if (persisted) {
       if (persisted.phases.deploy.superseded !== true) {
         await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(phaseInputs.deploy), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
@@ -24003,7 +23969,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
     }
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
-    const announceNote2 = persisted && !shippedBefore && persisted.phases.deploy.superseded !== true && prodReleaseTargets(deployModel).length > 0 ? await announceShippedRelease(
+    const announceNote2 = persisted && !shippedBefore && persisted.phases.deploy.superseded !== true && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
       deps,
       { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
       deployModel,
@@ -24114,14 +24080,14 @@ ${recovery.note}`), recoveryInput);
     strict: ledgerMode === "strict",
     landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
   });
-  const publishDispatch0 = deployDispatch.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report") : null;
+  const publishDispatch0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", tagSha, watch);
   const publishDispatch = publishDispatch0 ? await recoverFailedDispatchPhase(
     deps,
     ledger,
     anchors,
     "publish",
     publishDispatch0,
-    { repo: releaseRunRepoFor(deployModel, ctx.repo), sha: tagSha, watched: isCentralDispatchModel(deployModel), workflow: isCentralDispatchModel(deployModel) ? "tenant-publish.yml" : "publish.yml" }
+    { repo: ctx.repo, sha: tagSha, watched: false, workflow: "publish.yml" }
   ) : null;
   const publishLeg = phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo }));
   await recordPhase(ledger, deps, anchors, "publish", publishLeg, {
@@ -44481,27 +44447,20 @@ ${decision.note}`);
       deploy0,
       { repo: releaseRunRepoFor(deployModel, ctx.repo), sha: mergedSha, watched: true, workflow: "tenant-deploy.yml" }
     );
-    const publish0 = deploy.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, true, "report") : null;
+    const publish0 = await observePublishIfRequired(deps, ctx, meta, deployModel, "main", mergedSha, true);
     const publish = publish0 ? await recoverFailedDispatchPhase(
       deps,
       ledger,
       anchors,
       "publish",
       publish0,
-      { repo: releaseRunRepoFor(deployModel, ctx.repo), sha: mergedSha, watched: true, workflow: "tenant-publish.yml" }
+      { repo: ctx.repo, sha: mergedSha, watched: false, workflow: "publish.yml" }
     ) : null;
     tenantPublishDispatch = publish;
-    let dispatch = appendPublishDispatch(deploy, publish);
-    if (!publish && deploy.deployStatus !== "success" && meta.publishRequired) {
-      const reason = deploy.deployStatus === "failure" ? "box deploy failed \u2014 redeploy the box before publishing" : "box deploy not confirmed (run with --watch) \u2014 publish after the box deploy lands";
-      dispatch = {
-        ...dispatch,
-        note: `${dispatch.note}; tenant-publish.yml skipped (${reason})`
-      };
-    }
+    const dispatch = appendPublishDispatch(deploy, publish);
     deployNote = dispatch.note;
     runs.push(hotfixWorkflowRunFromDispatch("tenant-deploy.yml", deploy));
-    if (publish) runs.push(hotfixWorkflowRunFromDispatch("tenant-publish.yml", publish));
+    if (publish) runs.push(hotfixWorkflowRunFromDispatch("publish.yml", publish));
   } else {
     deployNote = `no hotfix deploy dispatch for deployModel=${deployModel} \u2014 prod deploy is repo-specific`;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.4.9",
+  "version": "4.4.11",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",