@mutmutco/cli 4.5.0 → 4.5.2

package/dist/main.cjs

@@ -757,7 +757,7 @@ var init_house_map = __esm({
     "use strict";
     HOUSE_ROOTS = ["oracle", "harbour", "devops", "vault", "learning"];
     COMPAT_SHIM_DEATH_WAVE = "Wave 3";
-    FLAT_ALIAS_CUT_NOTE = `flat Wave 0 alias \u2014 removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); only the canonical house-prefixed path parses`;
+    FLAT_ALIAS_CUT_NOTE = `flat Wave 0 alias \u2014 no longer advertised since ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438); it still runs with a notice naming the canonical house-prefixed path (#7034)`;
     HOUSE_QUESTIONS = {
       oracle: "Is it live?",
       harbour: "Is it bounded?",
@@ -15017,6 +15017,26 @@ async function installAppFoldDeps(deps) {
   }
   await deps.run("npm", lockListing.trim() ? ["ci"] : ["install"]);
 }
+var SHARED_INSTALLER_PACKAGES = ["@mutmutco/installer-face", "@mutmutco/installer-launcher", "@mutmutco/installer-gate"];
+async function refreshSharedInstallerDeps(deps) {
+  let declared;
+  try {
+    const lock = JSON.parse(await deps.run("git", ["show", "HEAD:package-lock.json"]));
+    const present = Object.keys(lock.packages ?? {});
+    declared = SHARED_INSTALLER_PACKAGES.filter((name) => present.some((key) => key === `node_modules/${name}` || key.endsWith(`/node_modules/${name}`)));
+  } catch {
+    return null;
+  }
+  if (declared.length === 0) return null;
+  try {
+    await deps.run("npm", ["update", ...declared, "--package-lock-only", "--no-audit", "--no-fund"]);
+  } catch (e) {
+    const why = e instanceof Error ? e.message.split("\n")[0] : String(e);
+    deps.warn?.(`shared installer refresh skipped (${why}) \u2014 shipping the locked versions`);
+    return `shared installer refresh skipped (${why}); the locked ${declared.join(", ")} still satisfy their ranges`;
+  }
+  return `shared installer deps refreshed to the newest their ranges allow (${declared.join(", ")})`;
+}
 async function restoreMainNpmPackIdentities(deps, version) {
   const bomPath = "distribution-bom.json";
   let mainListing;
@@ -15171,6 +15191,8 @@ async function foldReleaseVersion(deps, model, tag, foldPaths, sourceCommit = "H
     }
   } else {
     await installAppFoldDeps(deps);
+    const refresh = await refreshSharedInstallerDeps(deps);
+    if (refresh) foldNoteExtra = `; ${refresh}`;
     await deps.run("npm", ["version", version, "--no-git-tag-version", "--allow-same-version"]);
     const patch = Number(version.split(".")[2] ?? "0");
     if (model === "registry-publish" && Number.isFinite(patch) && patch > 0) {
@@ -15976,10 +15998,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.0",
-    tag: "v4.5.0",
-    commit: "e9c83872b853",
-    npm: "@mutmutco/cli@4.5.0"
+    version: "4.5.2",
+    tag: "v4.5.2",
+    commit: "32bfbb00fcb9",
+    npm: "@mutmutco/cli@4.5.2"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15996,14 +16018,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.0"
+          v3Target: "v4.5.2"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.0 and redeploy the Hub Lambda from tag v4.5.0 (e9c83872b853); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.0 (@mutmutco/cli@4.5.0, tag commit e9c83872b853 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.2 and redeploy the Hub Lambda from tag v4.5.2 (32bfbb00fcb9); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.2 (@mutmutco/cli@4.5.2, tag commit 32bfbb00fcb9 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18779,6 +18801,64 @@ async function resolveRcResumeTag(deps, base, sha, probed) {
   return { tag: newest, note };
 }
 
+// ../infra/installer-families.mjs
+var INSTALLER_FAMILIES = ["jerv", "mmi"];
+var INSTALLER_FAMILY_HOSTS = {
+  jerv: "get.jerv.ai",
+  mmi: "get.mutmut.work"
+};
+var INSTALLER_LOGINS = ["github", "google"];
+var PRODUCT_RE = /^[a-z][a-z0-9-]{0,39}$/;
+function expectedInstallerLogin(family, division) {
+  if (family === "jerv") return "github";
+  return String(division ?? "").trim().toLowerCase() === "mmi" ? "github" : "google";
+}
+function installerVersionUrl(installer) {
+  if (typeof installer.gate === "string" && installer.gate) return `${installer.gate.replace(/\/+$/, "")}/release/version`;
+  return `https://${INSTALLER_FAMILY_HOSTS[installer.family]}/${installer.product}/release/version`;
+}
+function installerDeclarationError(value, division) {
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    return "installer must be an object {product, family, login?, gate?}";
+  }
+  const record = (
+    /** @type {Record<string, unknown>} */
+    value
+  );
+  for (const key of Object.keys(record)) {
+    if (!["product", "family", "login", "gate"].includes(key)) return `installer.${key} is not a field \u2014 expected product, family and optionally login and gate`;
+  }
+  if (typeof record.product !== "string" || !PRODUCT_RE.test(record.product)) {
+    return "installer.product must be a lowercase kebab name (e.g. mm-strategy) \u2014 it is the /<product> path on the family host";
+  }
+  if (!INSTALLER_FAMILIES.includes(
+    /** @type {string} */
+    record.family
+  )) {
+    return `installer.family must be one of: ${INSTALLER_FAMILIES.join(", ")} (jerv \u2192 ${INSTALLER_FAMILY_HOSTS.jerv}, mmi \u2192 ${INSTALLER_FAMILY_HOSTS.mmi})`;
+  }
+  if (record.gate !== void 0 && (typeof record.gate !== "string" || !/^https:\/\/[a-z0-9.-]+\.[a-z]{2,}(\/[A-Za-z0-9._\/-]*)?$/.test(record.gate))) {
+    return "installer.gate must be the https origin of the product's own sign-in server (e.g. https://strategy.mutmut.work)";
+  }
+  if (record.login !== void 0 && !INSTALLER_LOGINS.includes(
+    /** @type {string} */
+    record.login
+  )) {
+    return `installer.login must be one of: ${INSTALLER_LOGINS.join(", ")}`;
+  }
+  const expected = expectedInstallerLogin(
+    /** @type {'jerv' | 'mmi'} */
+    record.family,
+    division
+  );
+  if (record.login !== void 0 && record.login !== expected) {
+    const who = record.family === "jerv" ? "Jerv products sign in with GitHub" : String(division ?? "").trim().toLowerCase() === "mmi" ? "MMI products sign in with GitHub" : "MM and other Mutatis Mutandis products sign in with Google";
+    return `installer.login ${record.login} breaks the sign-in rule: ${who} (owner ruling 2026-09-23)`;
+  }
+  return null;
+}
+
 // src/tenant-control-parse.ts
 var OUTPUT_BEGIN = "mmi-control-output-begin";
 var OUTPUT_END = "mmi-control-output-end";
@@ -18961,7 +19041,7 @@ function mmiGetRedeployCommand(repo) {
 }
 function readLocalLauncherVersion(root = process.cwd()) {
   try {
-    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "installer", "launcher", "package.json"), "utf8");
+    const raw = (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(root, "cli", "package.json"), "utf8");
     const version = JSON.parse(raw).version;
     return typeof version === "string" && version.trim() ? version.trim() : null;
   } catch {
@@ -18990,17 +19070,54 @@ async function fetchServedChannelVersion(url, fetchImpl = fetch) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
 }
+async function findPriorGreenDispatch(deps, repo, workflow, sha, titleTokens) {
+  if (!/^[0-9a-f]{40}$/i.test(sha)) return void 0;
+  try {
+    const rows = JSON.parse(await deps.run("gh", [
+      "run",
+      "list",
+      "--repo",
+      repo,
+      "--workflow",
+      workflow,
+      "--commit",
+      sha,
+      "--event",
+      "workflow_dispatch",
+      "--limit",
+      "20",
+      "--json",
+      "databaseId,url,status,conclusion,displayTitle,headSha"
+    ]));
+    const hit = rows.find((r) => typeof r.databaseId === "number" && r.headSha?.toLowerCase() === sha.toLowerCase() && r.status === "completed" && r.conclusion === "success" && titleTokens.every((t) => (r.displayTitle ?? "").split(/[^\w.-]+/).includes(t)));
+    return hit ? { runId: hit.databaseId, ...hit.url ? { runUrl: hit.url } : {} } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function planeFailureRow(workflow, evidence) {
+  return { workflow, runUrlNote: evidence, conclusion: "failure" };
+}
 async function appendMmiGetRedeploy(deps, input, dispatch) {
   if (!isHubControlRepo(input.repo)) return dispatch;
   const remedy = mmiGetRedeployCommand(input.repo);
-  const withNote = (note, deployStatus) => ({
+  const withNote = (note, deployStatus, row) => ({
     ...dispatch,
     note: `${dispatch.note}; ${note}`,
-    ...deployStatus ? { deployStatus } : {}
+    ...deployStatus ? { deployStatus } : {},
+    ...row ? { workflowRuns: [...dispatch.workflowRuns ?? [], row] } : {}
   });
   if (input.publishStatus !== "success") {
     return withNote(`mmi-get box NOT redeployed (publish did not succeed) \u2014 after the publish is green, run \`${remedy}\``);
   }
+  const prior = input.releaseSha ? await findPriorGreenDispatch(deps, input.repo, "tenant-deploy.yml", input.releaseSha, [HUB_GET_SLUG, HUB_GET_STAGE]) : void 0;
+  if (prior) {
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; mmi-get box already redeployed for this release (tenant-deploy.yml run ${prior.runId} at ${input.releaseSha.slice(0, 12)}) \u2014 not dispatched again`,
+      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "tenant-deploy.yml", runId: prior.runId, ...prior.runUrl ? { runUrl: prior.runUrl } : {}, conclusion: "success" }]
+    };
+  }
   const since = (deps.now ?? Date.now)();
   try {
     await deps.run("gh", [
@@ -19022,12 +19139,12 @@ async function appendMmiGetRedeploy(deps, input, dispatch) {
     ]);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    return withNote(`tenant-deploy dispatch FAILED: ${msg}. The release itself landed, but the MMI-GET BOX WAS NOT REDEPLOYED \u2014 recover with \`${remedy}\``, "failure");
+    return withNote(`tenant-deploy dispatch FAILED: ${msg}. The release itself landed, but the MMI-GET BOX WAS NOT REDEPLOYED \u2014 recover with \`${remedy}\``, "failure", planeFailureRow("tenant-deploy.yml", `dispatch refused: ${msg}`));
   }
   const correlated = await correlateTenantRun(deps, since, [HUB_GET_SLUG, HUB_GET_STAGE]);
   if (correlated.read === "failed" || correlated.read === "absent") {
     const why = correlated.read === "failed" ? `its run could not be READ: ${correlated.error}` : "no matching run appeared";
-    return withNote(`tenant-deploy dispatched (slug=${HUB_GET_SLUG}, stage=${HUB_GET_STAGE}) but ${why}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure");
+    return withNote(`tenant-deploy dispatched (slug=${HUB_GET_SLUG}, stage=${HUB_GET_STAGE}) but ${why}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure", planeFailureRow("tenant-deploy.yml", `dispatched, but ${why}`));
   }
   const { runId, runUrl } = correlated;
   const runRow = { workflow: "tenant-deploy.yml", ...runId ? { runId } : {}, ...runUrl ? { runUrl } : {} };
@@ -19057,35 +19174,44 @@ async function appendServedChannelPublish(deps, input, dispatch) {
   if (!isHubControlRepo(input.repo)) return dispatch;
   const channelUrl = input.channelUrl ?? readServedChannelUrl();
   const remedy = getPublishDispatchCommand(input.repo);
-  const withNote = (note, deployStatus) => ({
+  const withNote = (note, deployStatus, row) => ({
     ...dispatch,
     note: `${dispatch.note}; ${note}`,
-    ...deployStatus ? { deployStatus } : {}
+    ...deployStatus ? { deployStatus } : {},
+    ...row ? { workflowRuns: [...dispatch.workflowRuns ?? [], row] } : {}
   });
   if (input.publishStatus !== "success") {
     return withNote(`served channel NOT moved (publish did not succeed) \u2014 after the publish is green, run \`${remedy}\``);
   }
-  const since = (deps.now ?? Date.now)();
-  try {
-    await deps.run("gh", ["workflow", "run", "get-publish.yml", "--repo", input.repo, "--ref", "main", "-f", `product=${HUB_SERVED_PRODUCT}`]);
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    return withNote(`get-publish dispatch FAILED: ${msg}. The release itself landed, but the SERVED CHANNEL IS UNCHANGED \u2014 recover with \`${remedy}\``, "failure");
-  }
-  const correlated = await correlateGetPublishRun(deps, since, HUB_SERVED_PRODUCT);
-  if (correlated.read === "failed") {
-    return withNote(`get-publish dispatched but its run could not be READ: ${correlated.error}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure");
-  }
-  const { runId, runUrl } = correlated;
-  const runRow = { workflow: "get-publish.yml", ...runId ? { runId } : {}, ...runUrl ? { runUrl } : {} };
-  if (!input.watch) {
-    return {
-      ...dispatch,
-      note: `${dispatch.note}; dispatched get-publish.yml (product=${HUB_SERVED_PRODUCT}) \u2014 NOT watched, so the served channel is not yet proven moved`,
-      workflowRuns: [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: "pending" }]
-    };
+  const prior = input.releaseSha ? await findPriorGreenDispatch(deps, input.repo, "get-publish.yml", input.releaseSha, [HUB_SERVED_PRODUCT]) : void 0;
+  let runRow;
+  let runStatus;
+  if (prior) {
+    runRow = { workflow: "get-publish.yml", runId: prior.runId, ...prior.runUrl ? { runUrl: prior.runUrl } : {} };
+    runStatus = "success";
+  } else {
+    const since = (deps.now ?? Date.now)();
+    try {
+      await deps.run("gh", ["workflow", "run", "get-publish.yml", "--repo", input.repo, "--ref", "main", "-f", `product=${HUB_SERVED_PRODUCT}`]);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return withNote(`get-publish dispatch FAILED: ${msg}. The release itself landed, but the SERVED CHANNEL IS UNCHANGED \u2014 recover with \`${remedy}\``, "failure", planeFailureRow("get-publish.yml", `dispatch refused: ${msg}`));
+    }
+    const correlated = await correlateGetPublishRun(deps, since, HUB_SERVED_PRODUCT);
+    if (correlated.read === "failed") {
+      return withNote(`get-publish dispatched but its run could not be READ: ${correlated.error}. Check the Actions tab; if it never ran, recover with \`${remedy}\``, "failure", planeFailureRow("get-publish.yml", `dispatched, but its run could not be read`));
+    }
+    const { runId, runUrl } = correlated;
+    runRow = { workflow: "get-publish.yml", ...runId ? { runId } : {}, ...runUrl ? { runUrl } : {} };
+    if (!input.watch) {
+      return {
+        ...dispatch,
+        note: `${dispatch.note}; dispatched get-publish.yml (product=${HUB_SERVED_PRODUCT}) \u2014 NOT watched, so the served channel is not yet proven moved`,
+        workflowRuns: [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: "pending" }]
+      };
+    }
+    runStatus = await watchTenantRun(deps, runId, input.repo);
   }
-  const runStatus = await watchTenantRun(deps, runId, input.repo);
   if (runStatus !== "success") {
     return {
       ...dispatch,
@@ -19170,13 +19296,22 @@ var SERVED_CHANNELS = {
     remedy: JERV_GATEWAY_REMEDY
   }
 };
-function servedChannelFor(repo) {
-  return SERVED_CHANNELS[repo.toLowerCase()];
+function servedChannelFor(repo, installer) {
+  const known = SERVED_CHANNELS[repo.toLowerCase()];
+  if (!installer) return known;
+  if (isHubControlRepo(repo)) return void 0;
+  const url = installerVersionUrl(installer);
+  return {
+    product: installer.product,
+    url,
+    mover: known?.mover ?? `this repo's release (${installer.family === "jerv" ? "get.jerv.ai" : "get.mutmut.work"} serves /${installer.product})`,
+    remedy: known?.remedy ?? `re-run the release's served-channel publish for ${installer.product} (\`mmi-cli devops release --resume\`)`
+  };
 }
 var SERVED_CHANNEL_PROBE_ATTEMPTS = 3;
 var SERVED_CHANNEL_PROBE_BACKOFF_MS = 1e4;
 async function appendServedChannelProof(deps, input, dispatch) {
-  const channel = servedChannelFor(input.repo);
+  const channel = servedChannelFor(input.repo, input.installer);
   if (!channel) return dispatch;
   const expected = input.tag.replace(/^v/, "");
   const withProof = (conclusion, evidence, note, failed = false) => ({
@@ -19216,6 +19351,15 @@ async function appendServedChannelProof(deps, input, dispatch) {
   }
   return withProof("success", `${channel.url} reports ${probe.version}`, `served channel moved \u2014 ${channel.url} reports ${probe.version}`);
 }
+async function appendServedChannelLegs(deps, input, dispatch) {
+  const publishStatus = input.publish?.state === "complete" ? "success" : "failure";
+  let out = await appendMmiGetRedeploy(deps, { repo: input.repo, publishStatus, watch: input.watch, releaseSha: input.releaseSha }, dispatch);
+  out = await appendServedChannelPublish(deps, { repo: input.repo, publishStatus, watch: input.watch, releaseSha: input.releaseSha }, out);
+  return appendServedChannelProof(deps, { repo: input.repo, tag: input.tag, shipped: shipLegsGreen(input.deploy, input.publish), installer: input.installer }, out);
+}
+function servedChannelRowsAfter(before, after) {
+  return (after.workflowRuns ?? []).slice((before.workflowRuns ?? []).length);
+}
 var JERV_GATEWAY_RUN_URL_NOTE = "no run URL emitted \u2014 host health leg runs outside GitHub Actions";
 var JERV_GATEWAY_RELEASE_DEPLOY_SCRIPT = "scripts/jerv-gateway-release-deploy.sh";
 async function runTaggedJervGatewayLocalWrapper(deps, tag, tagSha) {
@@ -20852,6 +20996,20 @@ var import_node_crypto5 = require("node:crypto");
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
 var import_node_path21 = require("node:path");
+function pidIsDead(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  if (pid === process.pid) return false;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (e) {
+    return e.code === "ESRCH";
+  }
+}
+function lockTokenPid(token) {
+  const m = /^(\d+)-/.exec(token);
+  return m ? Number(m[1]) : void 0;
+}
 var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
@@ -20867,9 +21025,24 @@ function resolveFileLockOpts(opts = {}) {
     staleMs: opts.staleMs ?? 3e4,
     retryMs: opts.retryMs ?? 50,
     maxWaitMs: opts.maxWaitMs ?? 5e3,
-    label: opts.label ?? "file lock"
+    label: opts.label ?? "file lock",
+    deadHolderSteal: opts.deadHolderSteal ?? false,
+    holder: opts.holder ?? ""
   };
 }
+async function lockIsStealable(lockPath, opts) {
+  const age = Date.now() - (await (0, import_promises2.stat)(lockPath)).mtimeMs;
+  if (age > opts.staleMs) return true;
+  if (!opts.deadHolderSteal) return false;
+  let token;
+  try {
+    token = await (0, import_promises2.readFile)(lockPath, "utf8");
+  } catch {
+    return false;
+  }
+  const pid = lockTokenPid(token);
+  return pid !== void 0 && pidIsDead(pid);
+}
 async function acquireFileLock(lockPath, opts, deadline) {
   let immediateRetries = 0;
   for (; ; ) {
@@ -20880,12 +21053,12 @@ async function acquireFileLock(lockPath, opts, deadline) {
       const code = e.code;
       if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw e;
       const retryNow = async () => {
+        if (++immediateRetries <= IMMEDIATE_RETRY_BUDGET) return;
         if (Date.now() >= deadline) throw new FileLockBusyError(opts.label, lockPath, opts.maxWaitMs);
-        if (++immediateRetries > IMMEDIATE_RETRY_BUDGET) await sleep(opts.retryMs);
+        await sleep(opts.retryMs);
       };
       try {
-        const age = Date.now() - (await (0, import_promises2.stat)(lockPath)).mtimeMs;
-        if (age > opts.staleMs) {
+        if (await lockIsStealable(lockPath, opts)) {
           try {
             await (0, import_promises2.unlink)(lockPath);
             await retryNow();
@@ -20911,7 +21084,8 @@ async function acquireFileLock(lockPath, opts, deadline) {
       await sleep(opts.retryMs);
       continue;
     }
-    const token = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const stamp = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const token = opts.holder ? `${stamp} ${opts.holder.replace(/\s+/g, " ").trim()}` : stamp;
     try {
       await handle.writeFile(token);
     } catch (e) {
@@ -20935,11 +21109,14 @@ async function releaseFileLock(lockPath, guard) {
   }
 }
 async function withFileLock(lockPath, opts, fn) {
+  return withFencedFileLock(lockPath, opts, () => fn());
+}
+async function withFencedFileLock(lockPath, opts, fn) {
   const resolved = resolveFileLockOpts(opts);
   await (0, import_promises2.mkdir)((0, import_node_path21.dirname)(lockPath), { recursive: true }).catch(() => void 0);
   const guard = await acquireFileLock(lockPath, resolved, Date.now() + resolved.maxWaitMs);
   try {
-    return await fn();
+    return await fn(() => fileLockHeldBy(lockPath, guard.token));
   } finally {
     await releaseFileLock(lockPath, guard);
   }
@@ -21177,8 +21354,114 @@ function atomicWriteJson(path2, ledger) {
 `, "utf8");
   (0, import_node_fs22.renameSync)(tmp, path2);
 }
+var LEDGER_LOCK_OPTS = { label: "release ledger", staleMs: 18e4, deadHolderSteal: true };
+async function withLedgerLock(path2, fn, opts = {}) {
+  return withFencedFileLock(`${path2}.lock`, { ...LEDGER_LOCK_OPTS, ...opts.maxWaitMs != null ? { maxWaitMs: opts.maxWaitMs } : {} }, (stillHeld) => fn(async (write) => {
+    if (!await stillHeld()) {
+      throw new ReleaseLedgerError("lock-lost", `release ledger at ${path2}: this writer's lock was stolen while it worked \u2014 nothing was written over the successor (#7027)`);
+    }
+    return write();
+  }));
+}
+function checkoutRootFrom(cwd) {
+  let dir = (0, import_node_path22.resolve)(cwd);
+  for (; ; ) {
+    if (resolveGitDir(dir)) return dir;
+    const parent = (0, import_node_path22.dirname)(dir);
+    if (parent === dir) throw new ReleaseLedgerError("no-checkout", `train writer lock: no git checkout found above ${cwd}`);
+    dir = parent;
+  }
+}
+function trainWriterLockPath(cwd) {
+  return (0, import_node_path22.join)((0, import_node_path22.dirname)(releaseLedgerPath(checkoutRootFrom(cwd))), "train.lock");
+}
+var TrainWriterBusyError = class extends Error {
+  lockPath;
+  holder;
+  constructor(lockPath, holder, verb) {
+    super(
+      `${verb} refused before any mutation: another train is running on this checkout (${holder}). One train at a time writes the release ledger \u2014 wait for it to finish, or, if that process is gone, rerun: a dead holder's lock is reclaimed automatically (lock: ${lockPath}) (#7027)`
+    );
+    this.name = "TrainWriterBusyError";
+    this.lockPath = lockPath;
+    this.holder = holder;
+  }
+};
+var TRAIN_WRITER_STALE_MS = 12 * 60 * 6e4;
+function describeTrainWriterToken(token) {
+  const pid = lockTokenPid(token);
+  const [stamp, ...rest] = token.trim().split(" ");
+  const since = Number((stamp ?? "").split("-")[1]);
+  const when = Number.isFinite(since) && since > 0 ? `, since ${new Date(since).toISOString()}` : "";
+  const what = rest.join(" ").trim();
+  return `${what || "a train command"}${pid ? `, pid ${pid}` : ""}${when}`;
+}
+function liveTrainWriterHolder(cwd) {
+  let token;
+  try {
+    token = (0, import_node_fs22.readFileSync)(trainWriterLockPath(cwd), "utf8");
+  } catch {
+    return void 0;
+  }
+  const pid = lockTokenPid(token);
+  if (pid === void 0 || pid === process.pid || pidIsDead(pid)) return void 0;
+  return describeTrainWriterToken(token);
+}
+var heldTrainWriter;
+async function acquireTrainWriterLock(cwd, verb) {
+  let lockPath;
+  try {
+    lockPath = trainWriterLockPath(cwd);
+  } catch {
+    return async () => void 0;
+  }
+  if (heldTrainWriter && heldTrainWriter.lockPath === lockPath) {
+    heldTrainWriter.depth += 1;
+    return async () => {
+      if (heldTrainWriter) heldTrainWriter.depth -= 1;
+    };
+  }
+  (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(lockPath), { recursive: true });
+  const opts = resolveFileLockOpts({ label: "train writer", staleMs: TRAIN_WRITER_STALE_MS, deadHolderSteal: true, maxWaitMs: 0, holder: verb });
+  let guard;
+  try {
+    guard = await acquireFileLock(lockPath, opts, Date.now());
+  } catch (e) {
+    if (!(e instanceof FileLockBusyError)) throw e;
+    let token = "";
+    try {
+      token = (0, import_node_fs22.readFileSync)(lockPath, "utf8");
+    } catch {
+      token = "";
+    }
+    throw new TrainWriterBusyError(lockPath, token ? describeTrainWriterToken(token) : "holder unreadable", verb);
+  }
+  const held = {
+    lockPath,
+    depth: 1,
+    release: async () => {
+      heldTrainWriter = void 0;
+      await releaseFileLock(lockPath, guard);
+    }
+  };
+  heldTrainWriter = held;
+  return async () => {
+    held.depth -= 1;
+    if (held.depth <= 0 && heldTrainWriter === held) await held.release();
+  };
+}
+async function withTrainWriter(deps, verb, fn) {
+  const seam = "trainWriter" in deps ? deps.trainWriter : void 0;
+  if (!seam) return fn();
+  const release = await seam(verb, process.cwd());
+  try {
+    return await fn();
+  } finally {
+    await release();
+  }
+}
 async function withReleaseLedger(path2, expected, fn, opts = {}) {
-  return withFileLock(`${path2}.lock`, { label: "release ledger", maxWaitMs: opts.maxWaitMs ?? 5e3 }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let current;
     let raw;
     try {
@@ -21193,9 +21476,9 @@ async function withReleaseLedger(path2, expected, fn, opts = {}) {
       if (expected) validateLedgerAnchors(current, expected);
     }
     const { ledger, value } = await fn(current);
-    if (ledger) atomicWriteJson(path2, ledger);
+    if (ledger) await fence(() => atomicWriteJson(path2, ledger));
     return value;
-  });
+  }, { maxWaitMs: opts.maxWaitMs ?? 5e3 });
 }
 function openReleaseLedgerWriter(cwd, opts = {}) {
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
@@ -21810,7 +22093,7 @@ async function reverifyPersistedRunPhases(deps, path2, anchors, input) {
   return result;
 }
 async function clearLedgerFile(path2, anchors, maxWaitMs) {
-  return withFileLock(`${path2}.lock`, { label: "release ledger", maxWaitMs }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
       raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
@@ -21829,9 +22112,9 @@ async function clearLedgerFile(path2, anchors, maxWaitMs) {
     } catch (e) {
       return { cleared: false, note: `release ledger at ${path2} belongs to ${ledger.tag} @ ${ledger.tagSha.slice(0, 12)} \u2014 not this release; left in place (${e instanceof Error ? e.message : String(e)})` };
     }
-    (0, import_node_fs22.unlinkSync)(path2);
+    await fence(() => (0, import_node_fs22.unlinkSync)(path2));
     return { cleared: true, note: `cleared the release ledger at ${path2} for the live-proven aborted ${anchors.tag}` };
-  });
+  }, { maxWaitMs });
 }
 async function clearReleaseLedger(cwd, anchors, opts = {}) {
   let path2;
@@ -21971,7 +22254,7 @@ async function alignmentLegClosedLive(deps, prior) {
 }
 async function healStaleAlignmentLeg(deps, cwd, expected) {
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -21987,7 +22270,7 @@ async function healStaleAlignmentLeg(deps, cwd, expected) {
     }
     const closed = await alignmentLegClosedLive(deps, prior);
     if (!closed) return void 0;
-    atomicWriteJson(path2, { ...prior, phases: { ...prior.phases, alignment: closed }, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    await fence(() => atomicWriteJson(path2, { ...prior, phases: { ...prior.phases, alignment: closed }, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }));
     return prior.tag;
   });
 }
@@ -22060,7 +22343,7 @@ function supersedeableDeployLegShape(rec) {
 }
 async function supersedeContentCausedDeployLeg(deps, cwd) {
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -22101,14 +22384,14 @@ async function supersedeContentCausedDeployLeg(deps, cwd) {
       );
     }
     const note = `superseded: content-caused deploy failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, #6553)`;
-    atomicWriteJson(path2, {
+    await fence(() => atomicWriteJson(path2, {
       ...prior,
       phases: {
         ...phases,
         deploy: { state: "skipped", sha: prior.tagSha, superseded: true, note, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
       },
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
+    }));
     return {
       command: "release-supersede-deploy",
       repo: prior.repo,
@@ -22124,7 +22407,7 @@ function supersedeablePublishLegShape(rec) {
 function deferredGatewayDeployLegShape(rec) {
   return rec.state === "pending" && rec.runId == null && rec.workflow === "jerv-gateway";
 }
-async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref) {
+async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref, fence) {
   let liveSha = "";
   try {
     liveSha = (await deps.run("git", ["ls-remote", "origin", `refs/tags/${prior.tag}`])).trim().split(/\s+/)[0] ?? "";
@@ -22163,12 +22446,12 @@ async function proveOriginPromotionOrArchived(deps, prior, path2, label, ref) {
   if ((0, import_node_fs22.existsSync)(archivePath)) {
     throw new Error(`${label}: archive already exists at ${archivePath} \u2014 preserving both ledger records; resolve the collision by hand; nothing was written (${ref})`);
   }
-  (0, import_node_fs22.renameSync)(path2, archivePath);
+  await fence(() => (0, import_node_fs22.renameSync)(path2, archivePath));
   return "deleted";
 }
 async function supersedeContentCausedPublishLeg(deps, cwd) {
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -22199,7 +22482,7 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
         `release --supersede-publish: ${prior.tag} has unresolved legs besides publish (${unresolved.map((p) => `${p}=${phases[p].state}`).join(", ")}) \u2014 the supersession closes only the publish leg of an otherwise-complete release; resolve those first, nothing was written (#6638)`
       );
     }
-    if (await proveOriginPromotionOrArchived(deps, prior, path2, "release --supersede-publish", "#6638") === "deleted") {
+    if (await proveOriginPromotionOrArchived(deps, prior, path2, "release --supersede-publish", "#6638", fence) === "deleted") {
       return {
         command: "release-supersede-publish",
         repo: prior.repo,
@@ -22228,14 +22511,14 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
       gatewayDeploy = { workflow: "jerv-gateway", state: "complete", note: dispatch.note };
     }
     const note = `superseded: content-caused publish failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, #6638)`;
-    atomicWriteJson(path2, {
+    await fence(() => atomicWriteJson(path2, {
       ...prior,
       phases: {
         ...phases,
         publish: { state: "skipped", sha: prior.tagSha, superseded: true, note, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
       },
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
+    }));
     return {
       command: "release-supersede-publish",
       repo: prior.repo,
@@ -22250,7 +22533,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
   const label = "release --supersede-deploy --supersede-publish";
   const ref = "#6752";
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -22298,7 +22581,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
         `${label}: ${prior.tag} has unresolved legs besides deploy and publish (${unresolved.map((p) => `${p}=${phases[p].state}`).join(", ")}) \u2014 the combined closure closes only the two content-caused legs of an otherwise-complete release; resolve those first, nothing was written (${ref})`
       );
     }
-    if (await proveOriginPromotionOrArchived(deps, prior, path2, label, ref) === "deleted") {
+    if (await proveOriginPromotionOrArchived(deps, prior, path2, label, ref, fence) === "deleted") {
       return {
         command: "release-supersede-deploy-and-publish",
         repo: prior.repo,
@@ -22344,7 +22627,7 @@ async function supersedeContentCausedDeployAndPublishLegs(deps, cwd) {
       note: `superseded: content-caused publish failure on the immutable promoted ${prior.tag} \u2014 the cause fix rides the next patch train (master-approved closure, ${ref})`,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    atomicWriteJson(path2, { ...prior, phases, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    await fence(() => atomicWriteJson(path2, { ...prior, phases, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }));
     return {
       command: "release-supersede-deploy-and-publish",
       repo: prior.repo,
@@ -22375,7 +22658,7 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     return { ok: true };
   }
   await reverifyPriorRunLegs(deps, path2, targetTag);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let raw;
     try {
       raw = (0, import_node_fs22.readFileSync)(path2, "utf8");
@@ -22395,7 +22678,7 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
       const closed = await alignmentLegClosedLive(deps, prior);
       if (closed) {
         prior = { ...prior, phases: { ...prior.phases, alignment: closed }, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-        atomicWriteJson(path2, prior);
+        await fence(() => atomicWriteJson(path2, prior));
         derived = deriveReleasePhaseStatus(prior);
       }
     }
@@ -22418,13 +22701,13 @@ async function beginReleaseLedger(deps, cwd, targetTag) {
     }
     const archivePath = (0, import_node_path22.join)((0, import_node_path22.dirname)(path2), `phases.archive-${prior.tag}.json`);
     try {
-      (0, import_node_fs22.unlinkSync)(archivePath);
+      await fence(() => (0, import_node_fs22.unlinkSync)(archivePath));
     } catch (e) {
       if (e.code !== "ENOENT") {
         return { ok: false, error: `could not clear the stale archive at ${archivePath} (${e instanceof Error ? e.message : String(e)}) \u2014 the ledger for ${prior.tag} stays active (#5987)` };
       }
     }
-    (0, import_node_fs22.renameSync)(path2, archivePath);
+    await fence(() => (0, import_node_fs22.renameSync)(path2, archivePath));
     return { ok: true, note: `archived the completed release ledger ${prior.tag} to ${archivePath} (live-proven at ${prior.tagSha.slice(0, 12)})` };
   });
 }
@@ -22449,7 +22732,7 @@ async function defaultRetryDeploy(deps, prior) {
 }
 async function retryHotfixDeployLegs(deps, cwd, opts = {}) {
   const path2 = releaseLedgerPath(cwd);
-  return withFileLock(`${path2}.lock`, { label: "release ledger" }, async () => {
+  return withLedgerLock(path2, async (fence) => {
     let prior;
     try {
       prior = parseReleaseLedger((0, import_node_fs22.readFileSync)(path2, "utf8"));
@@ -22530,7 +22813,7 @@ async function retryHotfixDeployLegs(deps, cwd, opts = {}) {
         );
       }
     }
-    atomicWriteJson(path2, { ...prior, phases, updatedAt: now().toISOString() });
+    await fence(() => atomicWriteJson(path2, { ...prior, phases, updatedAt: now().toISOString() }));
     const stillFailed = retried.filter((phase) => phases[phase].state === "failed");
     const status = stillFailed.length === 0 ? "success" : "failed";
     return {
@@ -22683,6 +22966,7 @@ var defaultDeps2 = {
   },
   healAlignmentLeg: healStaleAlignmentLeg,
   healRunLegs: healUnfoldedRunLegs,
+  trainWriterHolder: liveTrainWriterHolder,
   readSurfacesRaw: (cwd) => {
     try {
       return (0, import_node_fs23.readFileSync)((0, import_node_path23.join)(cwd, "surfaces.json"), "utf8");
@@ -23025,12 +23309,17 @@ async function runTrainDoctor(input) {
       break;
     }
   }
+  const runningTrain = deps.trainWriterHolder(cwd);
+  if (runningTrain) {
+    add({ code: "train-running", severity: "blocker", source: "local", title: `another train is running on this checkout: ${runningTrain}`, remedy: "wait for it to finish, then rerun; if that process is gone, just rerun \u2014 a dead holder's lock is reclaimed automatically (#7027)" });
+  }
+  const healLedger = heal && !runningTrain;
   if (ledgerRaw !== void 0 && ledgerPath) {
     try {
       let ledger = parseReleaseLedger(ledgerRaw);
       let derived = deriveReleasePhaseStatus(ledger);
       const deployModel = typeof meta?.deployModel === "string" && isDeployModel(meta.deployModel) ? meta.deployModel : void 0;
-      if (heal && deployModel && derived.legs.some((l) => (l.phase === "deploy" || l.phase === "publish") && l.state === "pending")) {
+      if (healLedger && deployModel && derived.legs.some((l) => (l.phase === "deploy" || l.phase === "publish") && l.state === "pending")) {
         const run = await deps.healRunLegs(train, cwd, deployModel);
         if (run) {
           add({
@@ -23044,7 +23333,7 @@ async function runTrainDoctor(input) {
           derived = deriveReleasePhaseStatus(ledger);
         }
       }
-      if (heal && derived.phaseStatus === "phases-pending" && derived.legs.every((l) => l.state !== "pending" || l.phase === "alignment")) {
+      if (healLedger && derived.phaseStatus === "phases-pending" && derived.legs.every((l) => l.state !== "pending" || l.phase === "alignment")) {
         const closedTag = await deps.healAlignmentLeg(train, cwd);
         if (closedTag) {
           add({ code: "ledger-alignment-stale", severity: "healed", source: "origin", title: `closed the alignment-pending leg of ${closedTag}: its alignment PR(s) read MERGED on a fresh origin read (#6061)`, remedy: "nothing \u2014 the ledger is phases-green" });
@@ -24070,18 +24359,11 @@ ${recovery.note}`), recoveryInput);
     releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
   );
   const aligning = watch && alignment ? awaitAlignmentsLanded(deps, ctx, alignment) : Promise.resolve(alignment);
-  let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
-  dispatch = await appendMmiGetRedeploy(
-    deps,
-    { repo: ctx.repo, publishStatus: publishLeg.state === "complete" ? "success" : "failure", watch },
-    dispatch
-  );
-  dispatch = await appendServedChannelPublish(
+  const dispatch = await appendServedChannelLegs(
     deps,
-    { repo: ctx.repo, publishStatus: publishLeg.state === "complete" ? "success" : "failure", watch },
-    dispatch
+    { repo: ctx.repo, tag, releaseSha, watch, deploy: deployLeg, publish: publishLeg, installer: meta.installer },
+    appendPublishDispatch(deployDispatch, publishDispatch)
   );
-  dispatch = await appendServedChannelProof(deps, { repo: ctx.repo, tag, shipped: shipLegsGreen(deployLeg, publishLeg) }, dispatch);
   alignment = await aligning;
   const announceNote = await announcing;
   return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors, ...alignment ? { alignment } : {} };
@@ -24150,6 +24432,9 @@ async function probeAncestor(deps, ancestor, descendant, label) {
   }
 }
 async function runRcandResume(deps, options = {}) {
+  return withTrainWriter(deps, "rcand --resume", () => runRcandResumeLocked(deps, options));
+}
+async function runRcandResumeLocked(deps, options) {
   const watch = options.watch ?? false;
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
@@ -24410,6 +24695,12 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: the GitHub Release exists at the immutable tag SHA" }), { strict: true, landed: "the promotion (verified live)" });
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
     }
+    const shippedDispatch = await appendServedChannelLegs(
+      deps,
+      { repo: ctx.repo, tag, releaseSha: tagSha, watch, deploy: phaseInputs.deploy, publish: phaseInputs.publish, installer: meta.installer },
+      dispatch2
+    );
+    Object.assign(dispatch2, shippedDispatch);
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
     const settledBySupersede = persisted?.phases.deploy.superseded === true || persisted?.phases.publish.superseded === true;
     const announceNote2 = persisted && !shippedBefore && !settledBySupersede && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
@@ -24543,7 +24834,11 @@ ${recovery.note}`), recoveryInput);
       landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
     });
   }
-  const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
+  const dispatch = await appendServedChannelLegs(
+    deps,
+    { repo: ctx.repo, tag, releaseSha: tagSha, watch, deploy: deployLeg, publish: publishLeg, installer: meta.installer },
+    appendPublishDispatch(deployDispatch, publishDispatch)
+  );
   const announcing = announceShippedRelease(
     deps,
     { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
@@ -24600,6 +24895,9 @@ async function withCheckoutRestoredAfterReleaseResume(deps, startBranch, operati
   return withCheckoutRestoredAfterRelease(deps, result, startBranch);
 }
 async function runReleaseResume(deps, options = {}) {
+  return withTrainWriter(deps, "release --resume", () => runReleaseResumeLocked(deps, options));
+}
+async function runReleaseResumeLocked(deps, options) {
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
   await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
@@ -24615,6 +24913,10 @@ async function runReleaseResume(deps, options = {}) {
   );
 }
 async function runReleaseAbort(deps, options = {}) {
+  if (!options.approved) return runReleaseAbortLocked(deps, options);
+  return withTrainWriter(deps, "release --abort", () => runReleaseAbortLocked(deps, options));
+}
+async function runReleaseAbortLocked(deps, options) {
   if (!options.approved) {
     throw new Error("release --abort requires --apply after explicit approval; nothing was written");
   }
@@ -24689,7 +24991,7 @@ async function runReleaseSupersedeDeploy(deps, options = {}) {
     throw new Error("release --supersede-deploy requires --apply after explicit master approval; nothing was written");
   }
   try {
-    return await supersedeContentCausedDeployLeg(deps, process.cwd());
+    return await withTrainWriter(deps, "release --supersede-deploy", () => supersedeContentCausedDeployLeg(deps, process.cwd()));
   } catch (e) {
     const message2 = e instanceof Error ? e.message : String(e);
     throw new Error(message2.includes("nothing was written") || message2.includes("nothing to do") ? message2 : `${message2}; nothing was written`);
@@ -24700,7 +25002,7 @@ async function runReleaseSupersedePublish(deps, options = {}) {
     throw new Error("release --supersede-publish requires --apply after explicit master approval; nothing was written");
   }
   try {
-    return await supersedeContentCausedPublishLeg(deps, process.cwd());
+    return await withTrainWriter(deps, "release --supersede-publish", () => supersedeContentCausedPublishLeg(deps, process.cwd()));
   } catch (e) {
     const message2 = e instanceof Error ? e.message : String(e);
     throw new Error(message2.includes("nothing was written") || message2.includes("nothing to do") ? message2 : `${message2}; nothing was written`);
@@ -24711,13 +25013,17 @@ async function runReleaseSupersedeDeployAndPublish(deps, options = {}) {
     throw new Error("release --supersede-deploy --supersede-publish requires --apply after explicit master approval; nothing was written");
   }
   try {
-    return await supersedeContentCausedDeployAndPublishLegs(deps, process.cwd());
+    return await withTrainWriter(deps, "release --supersede-deploy --supersede-publish", () => supersedeContentCausedDeployAndPublishLegs(deps, process.cwd()));
   } catch (e) {
     const message2 = e instanceof Error ? e.message : String(e);
     throw new Error(message2.includes("nothing was written") || message2.includes("nothing to do") ? message2 : `${message2}; nothing was written`);
   }
 }
 async function runReleasePublishRetry(deps, runId, options = {}) {
+  if (!options.approved) return runReleasePublishRetryLocked(deps, runId, options);
+  return withTrainWriter(deps, "release --retry-publish", () => runReleasePublishRetryLocked(deps, runId, options));
+}
+async function runReleasePublishRetryLocked(deps, runId, options) {
   if (!options.approved) {
     throw new Error("release --retry-publish requires --apply after explicit approval; nothing was written");
   }
@@ -25162,6 +25468,9 @@ async function resolveHotfixVersion(deps, env = process.env) {
   return { tag: `v${version}`, version, baseTag };
 }
 async function runTrainApply(command, deps, options = {}) {
+  return withTrainWriter(deps, `${command} --apply`, () => runTrainApplyLocked(command, deps, options));
+}
+async function runTrainApplyLocked(command, deps, options = {}) {
   const watch = options.watch ?? false;
   await runTrainDoctor({ lane: command === "rcand" ? "rcand" : "release", dev: command === "release" && options.dev === true, heal: true, train: deps, refuse: true });
   const ctx = await buildTrainApplyContext(deps);
@@ -30588,7 +30897,7 @@ function registerDeployCommands(program3) {
 init_cli_shared();
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
+var UNSET_KEYS = ["installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -30846,6 +31155,17 @@ function parseRuntimeVaultOnlyVar(raw) {
   if (raw === "false") return false;
   throw new Error("org project set: runtimeVaultOnly must be true or false");
 }
+function parseInstallerVar(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: installer must be JSON, e.g. {"product":"mm-strategy","family":"mmi"}');
+  }
+  const error = installerDeclarationError(value, "mmi");
+  if (error && !error.includes("breaks the sign-in rule")) throw new Error(`org project set: ${error}`);
+  return value;
+}
 function parseSeedCanaryVar(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
@@ -31016,7 +31336,8 @@ var SETTABLE_VAR_KEYS = [
   "ciExemptReason",
   "gate",
   "secrets",
-  "seedCanary"
+  "seedCanary",
+  "installer"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -31029,6 +31350,7 @@ var SETTABLE_VAR_HINTS = {
   consumesDesignSystem: '"fofu"',
   runtimeVaultOnly: "true|false",
   seedCanary: "true|false",
+  installer: "JSON {product,family:jerv|mmi,login?:github|google,gate?:https origin of its own sign-in server} \u2014 the repo ships a one-line installer on get.jerv.ai or get.mutmut.work",
   repos: 'JSON array, e.g. ["mutmutco/mm-foo"]',
   oauth: "JSON {subdomains,domains,callbackPath,extraCallbackPaths}",
   requiredGcpApis: "comma-string",
@@ -31164,6 +31486,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseRuntimeVaultOnlyVar(raw);
     } else if (key === "seedCanary") {
       patch[key] = parseSeedCanaryVar(raw);
+    } else if (key === "installer") {
+      patch[key] = parseInstallerVar(raw);
     } else if (key === "consumesDesignSystem") {
       patch[key] = parseConsumesDesignSystemVar(raw);
     } else if (key === "publishDir") {
@@ -44403,6 +44727,9 @@ async function hotfixReleaseExists(deps, ctx, tag) {
   }
 }
 async function runHotfixStart(deps, options, doctor = runTrainDoctor) {
+  return withTrainWriter(deps, "hotfix start", () => runHotfixStartLocked(deps, options, doctor));
+}
+async function runHotfixStartLocked(deps, options, doctor) {
   await doctor({ lane: "hotfix", heal: true, train: deps, refuse: true });
   const ctx = await buildTrainApplyContext(deps);
   const status = await deps.run("git", ["status", "--porcelain"]);
@@ -44700,6 +45027,24 @@ async function appendHotfixGatewayRun(deps, repo, tag, sha, runs, note) {
   }
   return gateway.note;
 }
+async function appendHotfixServedChannel(deps, input, runs, note) {
+  const before = hotfixDispatchFromRuns(runs, note);
+  const after = await appendServedChannelLegs(
+    deps,
+    { repo: input.repo, tag: input.tag, releaseSha: input.sha, watch: true, deploy: input.deploy, publish: input.publish, installer: input.installer },
+    before
+  );
+  for (const row of servedChannelRowsAfter(before, after)) {
+    runs.push({
+      workflow: row.workflow,
+      ...row.runId != null ? { runId: row.runId } : {},
+      ...row.runUrl ? { url: row.runUrl } : {},
+      ...row.runUrlNote ? { runUrlNote: row.runUrlNote } : {},
+      conclusion: row.conclusion
+    });
+  }
+  return after.note;
+}
 function hotfixPhaseInputsFromRuns(deployModel, runs, note, publishDispatch, publishRequired, opts) {
   const dispatch = hotfixDispatchFromRuns(runs, note);
   return {
@@ -44822,6 +45167,9 @@ async function assertConsumerBomLineage(deps, mergedSha, tag) {
   }
 }
 async function runHotfixRelease(deps, versionInput, options = {}, doctor = runTrainDoctor) {
+  return withTrainWriter(deps, `hotfix release ${versionInput}`, () => runHotfixReleaseLocked(deps, versionInput, options, doctor));
+}
+async function runHotfixReleaseLocked(deps, versionInput, options, doctor) {
   await doctor({ lane: "hotfix", heal: true, train: deps, refuse: true });
   const ctx = await buildTrainApplyContext(deps);
   const { tag, version } = normalizeHotfixVersion(versionInput);
@@ -44968,6 +45316,7 @@ ${decision.note}`);
   );
   await recordHotfixPhase(ledger, anchors, "deploy", ledgerInputs.deploy, "the immutable tag, the green wall, origin/main, and the GitHub Release");
   await recordHotfixPhase(ledger, anchors, "publish", ledgerInputs.publish, "the immutable tag, the green wall, origin/main, the GitHub Release, and the deploy path");
+  deployNote = await appendHotfixServedChannel(deps, { repo: ctx.repo, tag, sha: mergedSha, deploy: ledgerInputs.deploy, publish: ledgerInputs.publish, installer: meta.installer }, runs, deployNote);
   const announceNote = releaseExists ? void 0 : await announceShippedRelease(
     deps,
     { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
@@ -45036,6 +45385,9 @@ ${decision.note}`);
   return { ...result, ...localSync ? { localSync } : {} };
 }
 async function runHotfixRetryDeploy(deps, versionInput) {
+  return withTrainWriter(deps, `hotfix release ${versionInput} --retry-deploy`, () => runHotfixRetryDeployLocked(deps, versionInput));
+}
+async function runHotfixRetryDeployLocked(deps, versionInput) {
   const ctx = await buildTrainApplyContext(deps);
   const { tag } = normalizeHotfixVersion(versionInput);
   const status = await deps.run("git", ["status", "--porcelain"]);
@@ -45651,6 +46003,8 @@ async function announceSummaryRefusal(path2) {
 }
 function trainApplyDeps() {
   return {
+    // #7027: every mutating train verb holds this checkout's train writer lock for its whole run.
+    trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
       try {
@@ -47866,10 +48220,9 @@ function resolveHouseShim(argv) {
     const flatPath = flatTokens.join(" ");
     const flatHouse = houseForPath(flatPath);
     if (!flatHouse || flatHouse === "core") return;
-    refuseHouseShim(
-      flatPath,
-      `mmi-cli: the flat '${flatPath}' alias was removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316) \u2014 ${recoveryPointerFor(flatPath)}`
-    );
+    process.stderr.write(`mmi-cli: '${flatPath}' is the old flat form \u2014 ran it as \`mmi-cli ${canonicalPathFor(registeredPathPrefix(flatPath))}\` (use that spelling)
+`);
+    return;
   }
   const remainder = argv.slice(3);
   const first = remainder[0];
@@ -47891,6 +48244,14 @@ function resolveHouseShim(argv) {
   if (actual && isDeclaredHouseAlias(houseToken, lookupPath)) {
     process.stderr.write(
       `mmi-cli: '${lookupPath}' lives in house '${actual}', not '${houseToken}' \u2014 routed to \`mmi-cli ${canonicalPathFor(lookupPath)}\`
+`
+    );
+    argv.splice(2, 1);
+    return;
+  }
+  if (actual && actual !== "core" && registeredPathPrefix(lookupPath) === lookupPath) {
+    process.stderr.write(
+      `mmi-cli: '${lookupPath}' lives in house '${actual}', not '${houseToken}' \u2014 ran it as \`mmi-cli ${canonicalPathFor(lookupPath)}\`
 `
     );
     argv.splice(2, 1);
@@ -47919,8 +48280,8 @@ function printHouseRootHelp(house) {
   }
   lines2.push(
     "",
-    `Canonical: \`mmi-cli ${house} <command> \u2026\`. The flat \`mmi-cli <command> \u2026\` compatibility shims`,
-    `were removed in ${COMPAT_SHIM_DEATH_WAVE} (#4316, #4438) \u2014 only the canonical house-prefixed form parses.`
+    `Canonical: \`mmi-cli ${house} <command> \u2026\`. The old flat \`mmi-cli <command> \u2026\` form still runs`,
+    "with a notice naming the canonical spelling (#7034), so an out-of-date plugin keeps working."
   );
   consoleIo.log(lines2.join("\n"));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",