@mutmutco/cli 4.5.124 → 4.5.126

package/dist/main.cjs

@@ -76,19 +76,19 @@ function hardExit(code) {
   process.exit(code);
 }
 function flushStream(stream) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     try {
-      stream.write("", () => resolve7());
+      stream.write("", () => resolve8());
     } catch {
-      resolve7();
+      resolve8();
     }
   });
 }
 async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
   await Promise.race([
     Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
-    new Promise((resolve7) => {
-      setTimeout(resolve7, timeoutMs).unref?.();
+    new Promise((resolve8) => {
+      setTimeout(resolve8, timeoutMs).unref?.();
     })
   ]);
 }
@@ -96,7 +96,7 @@ async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
   await flushStdio();
-  await new Promise((resolve7) => setImmediate(resolve7));
+  await new Promise((resolve8) => setImmediate(resolve8));
   return void 0;
 }
 async function finishCliRun(watchdogMs = CLI_EXIT_WATCHDOG_MS) {
@@ -644,7 +644,7 @@ function rateLimitedReceipt(opts) {
   };
 }
 async function runWithRateLimitBackoff(operation, opts) {
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = opts.now ?? Date.now;
   const log = opts.log ?? ((message2) => console.warn(message2));
   const capMs = opts.capMs ?? RATE_LIMIT_WAIT_CAP_MS;
@@ -734,7 +734,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -1057,8 +1057,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve7) => {
-    timer = setTimeout(resolve7, timeoutMs);
+  const timeout = new Promise((resolve8) => {
+    timer = setTimeout(resolve8, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -1125,12 +1125,12 @@ function killProcessTree(pid) {
 function execFileHard(file, args, options) {
   const { timeout, step, ...rest } = options;
   const started = Date.now();
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const child2 = (0, import_node_child_process2.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
       clearTimeout(timer);
       if (expired) return;
       if (error) reject(error);
-      else resolve7({ stdout: String(stdout), stderr: String(stderr) });
+      else resolve8({ stdout: String(stdout), stderr: String(stderr) });
     });
     let expired = false;
     const timer = setTimeout(() => {
@@ -5656,7 +5656,7 @@ function resolveVerbAliasShim(argv) {
 
 // src/command-composition.ts
 var import_node_os25 = require("node:os");
-var import_node_path55 = require("node:path");
+var import_node_path56 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs14 = require("node:fs");
@@ -6735,7 +6735,7 @@ async function readRestPrSnapshotWithRetry(prNumber, repo, gh2 = defaultGhApi, o
   const retries = options?.retries ?? PR_SNAPSHOT_READ_RETRIES;
   const untilMs = options?.retryTransientUntilMs;
   const delayMs = options?.delayMs ?? (untilMs !== void 0 ? PR_CHECKS_POLL_MS : PR_SNAPSHOT_READ_DELAY_MS);
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = options?.now ?? (() => Date.now());
   let lastError = "no attempt completed";
   let attempt = 0;
@@ -8766,8 +8766,9 @@ async function retireProject(slug, deps) {
 async function setDeployCoords(slug, payload, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}/deploy`, payload, deps);
 }
-async function retireDeployCoords(slug, stage, deps) {
-  return postJson(`/projects/${encodeURIComponent(slug)}/deploy/${encodeURIComponent(stage)}`, {}, deps, "DELETE", { noRetry: true });
+async function retireDeployCoords(slug, stage, deps, decommissioned = false) {
+  const q = decommissioned ? "?decommissioned=1" : "";
+  return postJson(`/projects/${encodeURIComponent(slug)}/deploy/${encodeURIComponent(stage)}${q}`, {}, deps, "DELETE", { noRetry: true });
 }
 async function postSchedulesLift(repo, schedules, deps) {
   const res = await postJson("/schedules/lift", { repo, schedules }, deps);
@@ -10588,7 +10589,7 @@ async function createPrViaRestFallback(args, swappedArgs, deps, knownPools) {
 }
 async function ghCreate(args, deps = {}) {
   const exec3 = deps.exec ?? execFileP;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   const now = deps.now ?? Date.now;
   const read = deps.readFile ?? import_promises.readFile;
   const restCreatePr = deps.restCreatePr ?? ((input) => defaultRestCreatePr(exec3, input));
@@ -11416,8 +11417,8 @@ var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
     closeHttpPool().then(() => true),
-    new Promise((resolve7) => {
-      setTimeout(() => resolve7(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
+    new Promise((resolve8) => {
+      setTimeout(() => resolve8(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
     })
   ]);
   if (!drained) destroyHttpPool();
@@ -15004,7 +15005,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -18243,10 +18244,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.124",
-    tag: "v4.5.124",
-    commit: "255e8e974e8e",
-    npm: "@mutmutco/cli@4.5.124"
+    version: "4.5.126",
+    tag: "v4.5.126",
+    commit: "bf7736630f4c",
+    npm: "@mutmutco/cli@4.5.126"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18263,14 +18264,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.124"
+          v3Target: "v4.5.126"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.124 and redeploy the Hub Lambda from tag v4.5.124 (255e8e974e8e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.124 (@mutmutco/cli@4.5.124, tag commit 255e8e974e8e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.126 and redeploy the Hub Lambda from tag v4.5.126 (bf7736630f4c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.126 (@mutmutco/cli@4.5.126, tag commit bf7736630f4c \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20353,7 +20354,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve7, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve8, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -20367,7 +20368,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve7, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve7}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve8}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -20547,7 +20548,7 @@ var CORRELATE_SKEW_SLACK_MS = 1e4;
 var CORRELATE_PAGE_LIMIT = 50;
 var RUN_CONFIRM_ATTEMPTS = 3;
 var RUN_CONFIRM_DELAY_MS = 1e3;
-var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var defaultSleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep;
 }
@@ -23726,7 +23727,7 @@ function lockTokenPid(token) {
   const m = /^(\d+)-/.exec(token);
   return m ? Number(m[1]) : void 0;
 }
-var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
   lockPath;
@@ -24602,7 +24603,7 @@ async function defaultWatchRun(deps, runId, repo) {
   }
   let confirmError;
   for (let attempt = 0; attempt < RUN_CONFIRM_ATTEMPTS2; attempt++) {
-    if (attempt > 0) await new Promise((resolve7) => setTimeout(resolve7, RUN_CONFIRM_DELAY_MS2));
+    if (attempt > 0) await new Promise((resolve8) => setTimeout(resolve8, RUN_CONFIRM_DELAY_MS2));
     try {
       const parsed = JSON.parse(await deps.run("gh", ["run", "view", String(runId), "--repo", repo, "--json", "status,conclusion"]));
       if (parsed.status === "completed") return parsed.conclusion === "success" ? "success" : "failure";
@@ -25644,11 +25645,11 @@ var defaultDeps = {
   // #5813: the caller supplies that command line. `process.argv` is NOT it — the house shim splices
   // the house root out in place, so re-reading it here re-ran the removed flat alias (`release …`
   // instead of `devops release …`) and the converged child refused with exit 2.
-  reexec: (argv) => new Promise((resolve7) => {
+  reexec: (argv) => new Promise((resolve8) => {
     const args = [...argv];
     const child2 = isWin2 ? (0, import_node_child_process8.spawn)("cmd.exe", ["/c", "mmi-cli", ...args], { stdio: "inherit", windowsHide: true }) : (0, import_node_child_process8.spawn)("mmi-cli", args, { stdio: "inherit", windowsHide: true });
-    child2.on("exit", (code) => resolve7(code ?? 1));
-    child2.on("error", () => resolve7(1));
+    child2.on("exit", (code) => resolve8(code ?? 1));
+    child2.on("error", () => resolve8(1));
   }),
   // stderr only — stdout may be carrying --json output.
   warn: (line) => console.error(line)
@@ -25754,7 +25755,7 @@ var defaultDeps2 = {
     }
   },
   registryWhoami: probeRegistryWhoami,
-  sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+  sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
   env: process.env
 };
 function message(e) {
@@ -37162,7 +37163,7 @@ function readSuiteCut(path2) {
   } catch {
     throw new Error(`suite cut record unreadable at ${path2}; repair it, never recut`);
   }
-  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinsUnchanged !== void 0 && (record.pinsUnchanged !== true || record.pinPr !== void 0) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr && !record.pinsUnchanged) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0) || m.ruleset !== void 0 && (!["rc", "main"].includes(m.ruleset.after) || typeof m.ruleset.ok !== "boolean" || !Array.isArray(m.ruleset.lines))))
+  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinsUnchanged !== void 0 && (record.pinsUnchanged !== true || record.pinPr !== void 0) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr && !record.pinsUnchanged) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.carriedPublished !== void 0 && (m.carriedPublished !== true || !m.carried) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0) || m.ruleset !== void 0 && (!["rc", "main"].includes(m.ruleset.after) || typeof m.ruleset.ok !== "boolean" || !Array.isArray(m.ruleset.lines))))
     throw new Error(`suite cut record has unknown or invalid state at ${path2}; repair it, never recut`);
   return record;
 }
@@ -37274,7 +37275,22 @@ async function pendingBackend(deps, m, dev) {
   const files = (await deps.changedPaths(m.repo, live, dev)).filter((f) => !NOT_BACKEND.test(f));
   return files.length ? `${files.length} backend file(s) changed since live ${version}, e.g. ${files[0]}` : "";
 }
+function existingCutDescription(record) {
+  const tags = [...record.members.flatMap((m) => m.tag ? [m.tag] : []), ...record.leadRcTag ? [record.leadRcTag] : []];
+  return `from ${record.leadDevelopment.slice(0, 12)}; tags: ${tags.join(", ") || "none"}; pin PR: ${record.pinPr ?? "none"}`;
+}
 async function suiteRcand(deps, opts) {
+  const existing = readSuiteCut(deps.recordPath);
+  try {
+    return await suiteRcandRun(deps, opts);
+  } catch (e) {
+    if (existing && !opts.dryRun && opts.ownerGo && readSuiteCut(deps.recordPath))
+      throw new Error(`${e.message}
+An existing cut record ${existingCutDescription(existing)} was resumed. mmi-cli devops suite abandon --owner-go retires it (subject to abandon safety checks).`);
+    throw e;
+  }
+}
+async function suiteRcandRun(deps, opts) {
   if (!opts.ownerGo && !opts.dryRun) throw new Error("suite rcand requires --owner-go (rc uses live data); nothing was written");
   const members = suiteMembers(await deps.registry());
   const modules = trainModules(members);
@@ -37288,6 +37304,8 @@ async function suiteRcand(deps, opts) {
   const lead = await deps.head(SUITE_REPO, "development");
   plan.push(await kitCheck(deps, lead, active.map((m) => ({ id: m.id, url: m.bundles.dev })), "dev bundles"));
   if (opts.dryRun) {
+    const existing = readSuiteCut(deps.recordPath);
+    if (existing) plan.push(`existing cut record: ${deps.recordPath} (${existingCutDescription(existing)})`);
     plan.push(...await Promise.all(modules.map(async (m) => `${m.repo}: ${heldById.has(m.id) ? "HELD" : await dryRunStatus(deps, m)}`)));
     return { plan };
   }
@@ -37372,7 +37390,7 @@ async function suiteRcand(deps, opts) {
   }
   const refusals = [];
   for (const member of record.members) {
-    if (member.published) continue;
+    if (member.published || member.carriedPublished) continue;
     try {
       await deps.preflight(member.repo);
     } catch (e) {
@@ -37386,28 +37404,60 @@ async function suiteRcand(deps, opts) {
 ${refusals.join("\n")}
 Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
   }
-  for (const member of record.members) {
-    if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
-      throw new Error(`${member.repo}: development moved after the cut snapshot; refuse to add untested code`);
-    if (member.carried) {
-      await deps.publish(member.repo, pinVersion(member.rcPin));
-      continue;
-    }
-    if (!member.tag) {
-      const cut = await deps.rcand(member.repo, member.previousRc, member.rcWasAbsent);
-      if (!RC_TAG.test(cut.tag) || !SHA2.test(cut.sha) || cut.sha.toLowerCase() === member.previousRc.toLowerCase()) throw new Error(`${member.repo}: rcand did not return a new immutable rc tag/SHA`);
-      if (!await deps.contains(member.repo, member.development, cut.sha)) throw new Error(`${member.repo}: rc tag does not carry the snapshotted development SHA; refuse`);
-      member.tag = cut.tag;
-      member.sha = cut.sha;
-      writeSuiteCut(deps.recordPath, record);
-    }
-    if ((await deps.tagSha(member.repo, member.tag))?.toLowerCase() !== member.sha.toLowerCase()) throw new Error(`${member.repo}: rc tag ${member.tag} moved or is unreadable; stop`);
-    if (!member.published) {
-      await deps.publish(member.repo, member.tag);
-      member.published = true;
-      writeSuiteCut(deps.recordPath, record);
+  const cutRecord = record;
+  let writes = Promise.resolve();
+  const persist = (mutate) => {
+    const next = writes.then(() => {
+      mutate();
+      writeSuiteCut(deps.recordPath, cutRecord);
+    });
+    writes = next.catch(() => {
+    });
+    return next;
+  };
+  let running = 0;
+  const waiting = [];
+  const results = await Promise.allSettled(record.members.map(async (member) => {
+    if (running >= 4) await new Promise((resolve8) => waiting.push(resolve8));
+    else running++;
+    try {
+      if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
+        throw new Error(`${member.repo}: development moved after the cut snapshot; refuse to add untested code`);
+      if (member.carried) {
+        if (!member.carriedPublished) {
+          await deps.publish(member.repo, pinVersion(member.rcPin));
+          await persist(() => {
+            member.carriedPublished = true;
+          });
+        }
+        return;
+      }
+      if (!member.tag) {
+        const cut = await deps.rcand(member.repo, member.previousRc, member.rcWasAbsent);
+        if (!RC_TAG.test(cut.tag) || !SHA2.test(cut.sha) || cut.sha.toLowerCase() === member.previousRc.toLowerCase()) throw new Error(`${member.repo}: rcand did not return a new immutable rc tag/SHA`);
+        if (!await deps.contains(member.repo, member.development, cut.sha)) throw new Error(`${member.repo}: rc tag does not carry the snapshotted development SHA; refuse`);
+        await persist(() => {
+          member.tag = cut.tag;
+          member.sha = cut.sha;
+        });
+      }
+      const tag = member.tag;
+      if ((await deps.tagSha(member.repo, tag))?.toLowerCase() !== member.sha.toLowerCase()) throw new Error(`${member.repo}: rc tag ${member.tag} moved or is unreadable; stop`);
+      if (!member.published) {
+        await deps.publish(member.repo, tag);
+        await persist(() => {
+          member.published = true;
+        });
+      }
+    } finally {
+      const next = waiting.shift();
+      if (next) next();
+      else running--;
     }
-  }
+  }));
+  const failures = results.flatMap((result, i) => result.status === "rejected" ? [`${record.members[i].repo}: ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`] : []);
+  if (failures.length) throw new Error(`suite member cuts failed:
+${failures.join("\n")}`);
   for (const member of record.members) {
     const [live, devHead] = await Promise.all([
       deps.backend({ repo: member.repo, id: member.id, bundles: {} }),
@@ -37852,8 +37902,10 @@ async function runRcDataSwitch(deps, opts) {
 }
 
 // src/suite-train-io.ts
-var import_node_fs45 = require("node:fs");
+var import_node_child_process18 = require("node:child_process");
 var import_node_path44 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path45 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
@@ -38035,7 +38087,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -39707,7 +39759,7 @@ async function updatePrHeadFromBase(input) {
   } catch (e) {
     throw new Error(`GitHub could not update ${input.head} from ${input.base} (${e.message.trim()}) \u2014 ${remedy}`);
   }
-  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   for (let attempt = 0; attempt < PR_HEAD_UPDATE_API_READ_RETRIES; attempt++) {
     const to = await readHead2();
     if (to && to !== from) return { from, to, base: input.base, via: "update-branch-api" };
@@ -39725,7 +39777,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   await sleep2(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
@@ -39736,7 +39788,7 @@ var AUTO_MERGE_CONFIRM_DELAY_MS = 15e3;
 async function confirmAutoMergeEnqueued(deps, options) {
   const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
   const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   for (let attempt = 0; attempt < retries; attempt++) {
     if (await deps.readMerged().catch(() => false)) return "merged";
     const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
@@ -39753,7 +39805,7 @@ async function confirmAutoMergeEnqueued(deps, options) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -43381,7 +43433,7 @@ async function checkPrReview(number, repo, head, deps = {
   }
 }
 function computePrPatchId(number, repo) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const gh2 = (0, import_node_child_process14.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
     const git3 = (0, import_node_child_process14.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
     let out = "";
@@ -43419,7 +43471,7 @@ function computePrPatchId(number, repo) {
       if (gitCode !== 0) return reject(new Error(`git patch-id --stable exited ${gitCode}: ${gitErr.trim()}`));
       const id = out.trim().split(/\s+/)[0];
       if (!/^[0-9a-f]{40}$/.test(id ?? "")) return reject(new Error(`patch-id: PR #${number} diff is empty or unreadable (gh: ${ghErr.trim() || "no stderr"})`));
-      resolve7(id);
+      resolve8(id);
     };
     gh2.on("close", (code) => {
       ghCode = code;
@@ -43470,7 +43522,7 @@ init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
   if (paths.length === 0) return Promise.resolve([]);
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const chunks = [];
     let settled = false;
     const child2 = (0, import_node_child_process15.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
@@ -43478,7 +43530,7 @@ function catFileBatch(root, ref, paths) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve7(parseCatFileBatch(Buffer.concat(chunks), paths.length));
+      resolve8(parseCatFileBatch(Buffer.concat(chunks), paths.length));
     };
     const timer = setTimeout(() => {
       child2.kill("SIGKILL");
@@ -43903,7 +43955,7 @@ function healthPollIntervalMs() {
   return HEALTH_POLL_INTERVAL_MS;
 }
 function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -43913,7 +43965,7 @@ function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
       child2.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve7), graceMs);
+    const timer = setTimeout(() => finish(resolve8), graceMs);
     child2.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -44106,10 +44158,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve7(false));
-    srv.once("listening", () => srv.close(() => resolve7(true)));
+    srv.once("error", () => resolve8(false));
+    srv.once("listening", () => srv.close(() => resolve8(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -44387,7 +44439,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve7) => setTimeout(resolve7, 500));
+  await new Promise((resolve8) => setTimeout(resolve8, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -44460,7 +44512,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve7) => setTimeout(resolve7, healthPollIntervalMs()));
+    await new Promise((resolve8) => setTimeout(resolve8, healthPollIntervalMs()));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -44820,7 +44872,7 @@ function unlinkNodeModulesJunction(wtPath) {
   }
 }
 function defaultSleep2(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 async function removeResidueDirectory(wtPath, options = {}) {
   const { sleep: sleep2 = defaultSleep2, removeEmptyDir = import_node_fs42.rmdirSync, exists = import_node_fs42.existsSync } = options;
@@ -46570,7 +46622,7 @@ ${list}`);
       // #5400: after grace, name "GitHub delivered zero runs" instead of burning the full budget as pending.
       pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr checks-wait", number, repo),
       baseBranch,
-      sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+      sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
       log: (message2) => console.warn(message2),
       timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
       // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
@@ -46725,7 +46777,7 @@ ${list}`);
           // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
           pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
           baseBranch: "development",
-          sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+          sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
           log: (message2) => console.warn(message2),
           // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
           // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
@@ -46776,7 +46828,7 @@ ${list}`);
           } else {
             lastFailure = void 0;
           }
-          await new Promise((resolve7) => setTimeout(resolve7, PR_LAND_POLL_MS));
+          await new Promise((resolve8) => setTimeout(resolve8, PR_LAND_POLL_MS));
         }
         if (lastFailure) {
           throw new Error(
@@ -46934,7 +46986,7 @@ ${list}`);
         checksDiagnosticCommand: `gh pr checks ${number} --repo ${repo}`,
         pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr merge --wait", number, repo),
         baseBranch,
-        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+        sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
         progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -47003,7 +47055,7 @@ ${list}`);
       }
       if (!o.auto && mergeRejectedBaseBranchModified(message2)) {
         console.warn(`pr merge: the base branch was modified by a concurrent merge \u2014 waiting ${PR_MERGE_BASE_RACE_RETRY_DELAY_MS / 1e3}s and retrying PR #${number}'s merge once (#6052).`);
-        await new Promise((resolve7) => setTimeout(resolve7, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
+        await new Promise((resolve8) => setTimeout(resolve8, PR_MERGE_BASE_RACE_RETRY_DELAY_MS));
         await execFileP("gh", buildPrMergeArgs({ number, repoArgs, method, auto: false, deleteBranch: false, bodyFile }), { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e2) => {
           const m2 = String(e2.message || "");
           if (/already been merged/i.test(m2)) {
@@ -47264,7 +47316,7 @@ ${list}`);
           console.warn(`ci checks-wait: zero-runs probe FAILED (${read.error}) \u2014 not treating as delivery failure this cycle`);
           return null;
         },
-        sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
+        sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: timeoutMs ?? PR_CHECKS_TIMEOUT_MS,
         progress: ({ state, elapsedMs, remainingMs }) => console.warn(`ci checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
@@ -47629,7 +47681,7 @@ function hotfixFollowUpLegs(runs, foldPort, alignment, foldNote, deployNote) {
   }
   return legs;
 }
-async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))) {
+async function runProjectInfoSyncLeg(cb, repo, sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))) {
   for (let attempt = 0; ; attempt++) {
     try {
       return await cb(repo, true);
@@ -48358,18 +48410,63 @@ function rcRunCauseFromLog(log) {
 function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
-var suiteStateDir = (root) => (0, import_node_path44.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+var suiteStateDir = (root) => (0, import_node_path45.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
+async function runSuiteMemberRcand(repo, previousRc, rcWasAbsent) {
+  const deps = trainApplyDeps();
+  deps.suiteCut = suiteCutContext(repo, SUITE_REPO);
+  deps.announce = async () => ({ status: "skipped", note: "suite announcement belongs to MM-Work" });
+  return rcandInCheckout(repo, deps, previousRc, rcWasAbsent);
+}
+async function rcandInCheckout(repo, deps, previousRc, rcWasAbsent) {
+  if (repo !== SUITE_REPO) await prepareDevelopmentCheckout((args) => deps.run("git", args), repo);
+  await deps.run("git", ["fetch", "origin", "--tags"]);
+  let rcNow;
+  try {
+    rcNow = (await deps.run("git", ["rev-parse", "--verify", "origin/rc"])).trim();
+  } catch (e) {
+    if (!rcWasAbsent || !previousRc || repo === SUITE_REPO) throw e;
+    const slug = repo.split("/")[1].toLowerCase();
+    const meta = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
+    if (!meta.ok || meta.project?.releaseTrack !== "full" || meta.project.suite !== "mm-work")
+      throw new Error(`${repo}: first rc branch requires releaseTrack full and suite=mm-work in META; no branch created`);
+    const main = (await deps.run("git", ["rev-parse", "origin/main"])).trim();
+    if (main.toLowerCase() !== previousRc.toLowerCase()) throw new Error(`${repo}: main moved since the cut snapshot; no rc branch created`);
+    await deps.run("git", ["push", "origin", `${previousRc}:refs/heads/rc`]);
+    await deps.run("git", ["fetch", "origin", "rc"]);
+    rcNow = (await deps.run("git", ["rev-parse", "origin/rc"])).trim();
+  }
+  if (!(await deps.run("git", ["branch", "--list", "rc"])).trim()) {
+    await deps.run("git", ["switch", "-c", "rc", "--track", "origin/rc"]);
+    await deps.run("git", ["switch", "development"]);
+  }
+  if (previousRc && rcNow.toLowerCase() !== previousRc.toLowerCase()) {
+    const tags = (await deps.run("git", ["tag", "--points-at", rcNow, "--list", "v*-rc.*"])).trim().split("\n").filter(Boolean);
+    if (tags.length !== 1) throw new Error(`${repo}: rc moved since cut start without exactly one candidate tag; stop`);
+    return { tag: tags[0], sha: rcNow };
+  }
+  try {
+    const result = await runTrainApply("rcand", deps, { watch: true });
+    if (result.deployStatus !== "success") throw new Error(`${repo}: rcand deploy not green (${result.deployStatus})`);
+    return { tag: result.tag, sha: (await deps.run("git", ["rev-parse", result.tag])).trim() };
+  } catch (e) {
+    const existing = (await deps.run("git", ["tag", "--list", "v*-rc.*"])).trim();
+    if (!existing || !/resume|partial|ledger|tag.*pushed/i.test(e.message)) throw e;
+    const result = await runRcandResume(deps, { watch: true });
+    if (result.deployStatus !== "success") throw new Error(`${repo}: resumed rcand deploy not green (${result.deployStatus})`);
+    return { tag: result.tag, sha: result.tagSha };
+  }
+}
 function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
-  const recordPath = (0, import_node_path44.join)(suiteStateDir(root), "cut.json");
-  const base = (0, import_node_path44.join)(suiteStateDir(root), "checkouts");
+  const recordPath = (0, import_node_path45.join)(suiteStateDir(root), "cut.json");
+  const base = (0, import_node_path45.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
     if (repo === SUITE_REPO) return root;
-    const target = (0, import_node_path44.join)(base, repo.split("/")[1]);
+    const target = (0, import_node_path45.join)(base, repo.split("/")[1]);
     if (!(0, import_node_fs45.existsSync)(target)) {
       (0, import_node_fs45.mkdirSync)(base, { recursive: true });
       await exec("git", ["clone", "--quiet", "--branch", "development", `https://github.com/${repo}.git`, target], root, WATCH_TIMEOUT);
     }
-    if (!(0, import_node_fs45.existsSync)((0, import_node_path44.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
+    if (!(0, import_node_fs45.existsSync)((0, import_node_path45.join)(target, ".git"))) throw new Error(`${repo}: suite checkout has no .git at ${target}; stop`);
     const origin = await exec("git", ["remote", "get-url", "origin"], target);
     if (!origin.toLowerCase().endsWith(`/${repo.toLowerCase()}.git`) && !origin.toLowerCase().endsWith(`/${repo.toLowerCase()}`))
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
@@ -48429,45 +48526,28 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       throw e;
     }
   };
-  const runRcand = async (repo, previousRc, rcWasAbsent) => inTrain(repo, async (deps) => {
-    if (repo !== SUITE_REPO) await prepareDevelopmentCheckout((args) => deps.run("git", args), repo);
-    await deps.run("git", ["fetch", "origin", "--tags"]);
-    let rcNow;
-    try {
-      rcNow = (await deps.run("git", ["rev-parse", "--verify", "origin/rc"])).trim();
-    } catch (e) {
-      if (!rcWasAbsent || !previousRc || repo === SUITE_REPO) throw e;
-      const slug = repo.split("/")[1].toLowerCase();
-      const meta = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
-      if (!meta.ok || meta.project?.releaseTrack !== "full" || meta.project.suite !== "mm-work")
-        throw new Error(`${repo}: first rc branch requires releaseTrack full and suite=mm-work in META; no branch created`);
-      const main = (await deps.run("git", ["rev-parse", "origin/main"])).trim();
-      if (main.toLowerCase() !== previousRc.toLowerCase()) throw new Error(`${repo}: main moved since the cut snapshot; no rc branch created`);
-      await deps.run("git", ["push", "origin", `${previousRc}:refs/heads/rc`]);
-      await deps.run("git", ["fetch", "origin", "rc"]);
-      rcNow = (await deps.run("git", ["rev-parse", "origin/rc"])).trim();
-    }
-    if (!(await deps.run("git", ["branch", "--list", "rc"])).trim()) {
-      await deps.run("git", ["switch", "-c", "rc", "--track", "origin/rc"]);
-      await deps.run("git", ["switch", "development"]);
-    }
-    if (previousRc && rcNow.toLowerCase() !== previousRc.toLowerCase()) {
-      const tags = (await deps.run("git", ["tag", "--points-at", rcNow, "--list", "v*-rc.*"])).trim().split("\n").filter(Boolean);
-      if (tags.length !== 1) throw new Error(`${repo}: rc moved since cut start without exactly one candidate tag; stop`);
-      return { tag: tags[0], sha: rcNow };
-    }
-    try {
-      const result = await runTrainApply("rcand", deps, { watch: true });
-      if (result.deployStatus !== "success") throw new Error(`${repo}: rcand deploy not green (${result.deployStatus})`);
-      return { tag: result.tag, sha: (await deps.run("git", ["rev-parse", result.tag])).trim() };
-    } catch (e) {
-      const existing = (await deps.run("git", ["tag", "--list", "v*-rc.*"])).trim();
-      if (!existing || !/resume|partial|ledger|tag.*pushed/i.test(e.message)) throw e;
-      const result = await runRcandResume(deps, { watch: true });
-      if (result.deployStatus !== "success") throw new Error(`${repo}: resumed rcand deploy not green (${result.deployStatus})`);
-      return { tag: result.tag, sha: result.tagSha };
-    }
-  });
+  const runRcand = async (repo, previousRc, rcWasAbsent) => {
+    if (repo === SUITE_REPO) return inTrain(repo, (deps) => rcandInCheckout(repo, deps, previousRc, rcWasAbsent));
+    const target = await checkout(repo);
+    return new Promise((resolveResult, reject) => {
+      const child2 = (0, import_node_child_process18.fork)((0, import_node_path44.resolve)(process.argv[1]), ["devops", "suite", "member-rcand-internal", repo, previousRc ?? "", ...rcWasAbsent ? ["--rc-was-absent"] : []], {
+        cwd: target,
+        stdio: ["ignore", "inherit", "inherit", "ipc"],
+        execArgv: []
+      });
+      let result;
+      let failure;
+      child2.on("message", (message2) => {
+        result = message2.result;
+        failure = message2.error;
+      });
+      child2.on("error", reject);
+      child2.on("exit", (code) => {
+        if (code === 0 && result) resolveResult(result);
+        else reject(new Error(failure ?? `${repo}: member rcand process exited ${code} without a result`));
+      });
+    });
+  };
   const release = async (repo, expected, rcSha, opts) => inTrain(repo, async (deps) => {
     await prepareRcCheckout((args) => deps.run("git", args), repo);
     const plainWords = {
@@ -48522,7 +48602,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     if (!reuse) await gh(["workflow", "run", "module-rc-publish.yml", "--repo", "mutmutco/MMI-Hub", ...fields.flatMap((f) => ["--field", f])]);
     let candidate = reuse;
     for (let i = 0; !candidate && i < 25; i++) {
-      await new Promise((resolve7) => setTimeout(resolve7, 1e3));
+      await new Promise((resolve8) => setTimeout(resolve8, 1e3));
       candidate = (await rcRuns()).find((r) => r.displayTitle === title && Date.parse(r.createdAt) >= since);
     }
     if (!candidate) throw new Error(`workflow dispatch outcome ambiguous for "${title}"; inspect Actions before retrying`);
@@ -48677,7 +48757,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       for (let i = 0; ; i++) {
         const pin = await openSuitePinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, { repo, tag, stage: "main" });
         if (pin.status !== "pending" || i >= 40) return pin;
-        await new Promise((resolve7) => setTimeout(resolve7, 3e4));
+        await new Promise((resolve8) => setTimeout(resolve8, 3e4));
       }
     },
     suiteMapping: async (leadTag) => {
@@ -48693,7 +48773,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
       if (parseSuiteMapping(body)) return;
       const dir = suiteStateDir(root);
       (0, import_node_fs45.mkdirSync)(dir, { recursive: true });
-      const file = (0, import_node_path44.join)(dir, `notes-${leadTag}.md`);
+      const file = (0, import_node_path45.join)(dir, `notes-${leadTag}.md`);
       (0, import_node_fs45.writeFileSync)(file, `${body}
 
 ${suiteMappingBlock(leadTag, mapping)}`);
@@ -48759,11 +48839,23 @@ function suiteRcDataProdDeps() {
       const rc = facts.stages.rc;
       return rc?.present ? rc.substrate ?? "an unnamed substrate" : null;
     },
-    sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
+    sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))
   };
 }
 function registerSuiteCommands(program3) {
   const suite = program3.command("suite").description("MM-Work suite status, candidate cut and release (#7262/#7263)");
+  suite.command("member-rcand-internal", { hidden: true }).argument("<repo>").argument("<previous-rc>").option("--rc-was-absent").action(async (repo, previousRc, o) => {
+    if (!process.send) return fail("member rcand is an internal suite child operation");
+    try {
+      if (repo === SUITE_REPO || (await resolveRepo())?.toLowerCase() !== repo.toLowerCase())
+        throw new Error(`${repo}: member rcand checkout mismatch; stop`);
+      const result = await runSuiteMemberRcand(repo, previousRc || void 0, o.rcWasAbsent);
+      process.send({ result }, () => process.disconnect());
+    } catch (e) {
+      process.exitCode = 1;
+      process.send({ error: e.message }, () => process.disconnect());
+    }
+  });
   const leadRoot = async () => {
     const repo = await resolveRepo();
     if (repo?.toLowerCase() !== SUITE_REPO.toLowerCase()) throw new Error(`suite commands run only from ${SUITE_REPO} (got ${repo ?? "unknown"})`);
@@ -49005,10 +49097,10 @@ function suiteStatusDeps(github, registry2) {
 }
 
 // src/packages-adopt-export.ts
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process19 = require("node:child_process");
 var import_node_fs47 = require("node:fs");
 var import_node_os22 = require("node:os");
-var import_node_path45 = require("node:path");
+var import_node_path46 = require("node:path");
 var import_node_util6 = require("node:util");
 init_cli_shared();
 
@@ -49628,25 +49720,25 @@ function expectedFromRun(run, opts) {
 }
 async function adoptExport(opts, deps) {
   if (!/^sha256:[0-9a-f]{64}$/.test(opts.digest)) throw new Error("--digest must be sha256:<64 hex>, from the export run summary");
-  const packagePath = (0, import_node_path45.join)(opts.dir, "package.json");
-  const lockPath = (0, import_node_path45.join)(opts.dir, "package-lock.json");
+  const packagePath = (0, import_node_path46.join)(opts.dir, "package.json");
+  const lockPath = (0, import_node_path46.join)(opts.dir, "package-lock.json");
   const packageText = (0, import_node_fs47.readFileSync)(packagePath, "utf8");
   const lockText = (0, import_node_fs47.readFileSync)(lockPath, "utf8");
-  const work = (0, import_node_fs47.mkdtempSync)((0, import_node_path45.join)((0, import_node_os22.tmpdir)(), "mmi-adopt-export-"));
+  const work = (0, import_node_fs47.mkdtempSync)((0, import_node_path46.join)((0, import_node_os22.tmpdir)(), "mmi-adopt-export-"));
   try {
     const run = JSON.parse((await deps.ghApi(`repos/${EXPORT_REPO}/actions/runs/${opts.run}`)).toString("utf8"));
-    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
-    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
-    (0, import_node_fs47.writeFileSync)((0, import_node_path45.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
-    const script = (0, import_node_path45.join)(work, "package_export.py");
+    (0, import_node_fs47.writeFileSync)((0, import_node_path46.join)(work, "expected.json"), JSON.stringify(expectedFromRun(run, opts)));
+    (0, import_node_fs47.writeFileSync)((0, import_node_path46.join)(work, "provider.json"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}`));
+    (0, import_node_fs47.writeFileSync)((0, import_node_path46.join)(work, "artifact.zip"), await deps.ghApi(`repos/${EXPORT_REPO}/actions/artifacts/${opts.artifact}/zip`));
+    const script = (0, import_node_path46.join)(work, "package_export.py");
     (0, import_node_fs47.writeFileSync)(script, package_export_default);
     await deps.python(script, ["verify", work, opts.ds, opts.screens]);
-    const verified = (0, import_node_path45.join)(work, "verified");
-    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs47.readFileSync)((0, import_node_path45.join)(verified, `${short3}.metadata.json`), "utf8"))]));
+    const verified = (0, import_node_path46.join)(work, "verified");
+    const metadata = Object.fromEntries(PACKAGES.map(({ name, short: short3 }) => [name, JSON.parse((0, import_node_fs47.readFileSync)((0, import_node_path46.join)(verified, `${short3}.metadata.json`), "utf8"))]));
     const plan = planAdoption(packageText, lockText, metadata);
     for (const { name } of plan.result.adopted) {
       const short3 = PACKAGES.find((p) => p.name === name).short;
-      await deps.npm(["cache", "add", (0, import_node_path45.join)(verified, `${short3}.tgz`)], opts.dir);
+      await deps.npm(["cache", "add", (0, import_node_path46.join)(verified, `${short3}.tgz`)], opts.dir);
     }
     (0, import_node_fs47.writeFileSync)(packagePath, plan.packageText);
     (0, import_node_fs47.writeFileSync)(lockPath, plan.lockText);
@@ -49662,7 +49754,7 @@ async function adoptExport(opts, deps) {
     (0, import_node_fs47.rmSync)(work, { recursive: true, force: true });
   }
 }
-var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process18.execFile);
+var execFileBuffer = (0, import_node_util6.promisify)(import_node_child_process19.execFile);
 var MAX_OUTPUT = 200 * 1024 * 1024;
 async function findPython() {
   for (const bin of ["python3", "python"]) {
@@ -49788,7 +49880,7 @@ init_github_client();
 init_cli_shared();
 var import_node_fs49 = require("node:fs");
 var import_node_os23 = require("node:os");
-var import_node_path46 = require("node:path");
+var import_node_path47 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -49979,8 +50071,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os23.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path46.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs49.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path46.join)(home, ".claude", "settings.json"), import_node_fs49.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path47.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs49.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path47.join)(home, ".claude", "settings.json"), import_node_fs49.readFileSync)
   });
   return {
     guide: "Read the MMI org-guide skill before project work; load only the relevant topic. Use mmi-help for a short introduction.",
@@ -52779,7 +52871,10 @@ function buildDeployRetirePlan(input) {
   if (!["dev", "rc", "main"].includes(input.stage)) {
     throw new Error("org project deploy retire: --stage must be dev, rc, or main");
   }
-  return { slug, stage: input.stage, apply: Boolean(input.apply) };
+  if (input.decommissioned && input.stage !== "main") {
+    throw new Error("org project deploy retire: --decommissioned applies to --stage main only (dev/rc always retire)");
+  }
+  return { slug, stage: input.stage, apply: Boolean(input.apply), decommissioned: Boolean(input.decommissioned) };
 }
 async function runDeployRetire(input, deps) {
   const plan = buildDeployRetirePlan(input);
@@ -52788,7 +52883,20 @@ async function runDeployRetire(input, deps) {
   if (!plan.apply) {
     return { slug: plan.slug, stage: plan.stage, applied: false, ok: facts !== null, existing };
   }
-  const res = await retireDeployCoords(plan.slug, plan.stage, deps.registry);
+  if (plan.decommissioned) {
+    const state = deps.boxServiceState ? await deps.boxServiceState(plan.stage) : "unknown";
+    if (state !== "missing") {
+      return {
+        slug: plan.slug,
+        stage: plan.stage,
+        applied: false,
+        ok: false,
+        existing,
+        error: `--decommissioned needs the box to show ${plan.stage} gone (tenant-control status serviceState=missing), got ${state} \u2014 run tenant control <repo> ${plan.stage} retire first`
+      };
+    }
+  }
+  const res = await retireDeployCoords(plan.slug, plan.stage, deps.registry, plan.decommissioned);
   if (!res.ok) {
     return { slug: plan.slug, stage: plan.stage, applied: true, ok: false, existing, error: writeError2(res) };
   }
@@ -53537,7 +53645,7 @@ function registerSessionReport(program3) {
 
 // src/stage-commands.ts
 var import_node_fs51 = require("node:fs");
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 
@@ -53785,8 +53893,8 @@ function registerStageCommands(program3) {
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
     const resolution = decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs51.existsSync)((0, import_node_path47.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs51.existsSync)((0, import_node_path47.join)(process.cwd(), ".env.example")),
+      hasCompose: (0, import_node_fs51.existsSync)((0, import_node_path48.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs51.existsSync)((0, import_node_path48.join)(process.cwd(), ".env.example")),
       repo
     });
     if (resolution.source === "derived" && resolution.derived) {
@@ -54081,7 +54189,7 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 var import_node_crypto17 = require("node:crypto");
 var import_node_fs52 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
-var import_node_path48 = require("node:path");
+var import_node_path49 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
@@ -54091,7 +54199,7 @@ async function sha256File(path2) {
 }
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
-  const path2 = (0, import_node_path48.resolve)(inputPath);
+  const path2 = (0, import_node_path49.resolve)(inputPath);
   const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES2) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES2} bytes`);
@@ -54281,7 +54389,7 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path54 = require("node:path");
+var import_node_path55 = require("node:path");
 init_house_map();
 init_hub_url();
 
@@ -54314,21 +54422,21 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/dist-drift.ts
-var import_node_child_process19 = require("node:child_process");
+var import_node_child_process20 = require("node:child_process");
 var import_node_crypto19 = require("node:crypto");
 var import_node_fs54 = require("node:fs");
 var import_node_os24 = require("node:os");
-var import_node_path50 = require("node:path");
+var import_node_path51 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
 var import_node_crypto18 = require("node:crypto");
 var import_node_fs53 = require("node:fs");
-var import_node_path49 = require("node:path");
+var import_node_path50 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path49.resolve)(root);
-  const target = (0, import_node_path49.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path49.sep}`)) {
+  const absoluteRoot = (0, import_node_path50.resolve)(root);
+  const target = (0, import_node_path50.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path50.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
@@ -54443,7 +54551,7 @@ function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
     for (const entry of (0, import_node_fs54.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path50.join)(directory, entry.name);
+      const child2 = (0, import_node_path51.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -54453,14 +54561,14 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs54.readFileSync)((0, import_node_path50.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path50.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs54.readFileSync)((0, import_node_path51.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path51.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path50.join)(root, "distribution-bom.json");
+    return (0, import_node_path51.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process19.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process20.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -54469,28 +54577,28 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs54.mkdtempSync)((0, import_node_path50.join)((0, import_node_os24.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs54.mkdtempSync)((0, import_node_path51.join)((0, import_node_os24.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path50.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path50.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path50.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path50.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path51.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path51.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path51.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path51.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path50.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path51.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path50.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path50.join)(root, path2));
-    const distRoot = (0, import_node_path50.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path50.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const committed = (path2) => readOrNull((0, import_node_path51.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path51.join)(root, path2));
+    const distRoot = (0, import_node_path51.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path51.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
     const bom = JSON.parse((0, import_node_fs54.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path50.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path51.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path50.join)(overlay, entry.path);
-        (0, import_node_fs54.mkdirSync)((0, import_node_path50.dirname)(target), { recursive: true });
+        const target = (0, import_node_path51.join)(overlay, entry.path);
+        (0, import_node_fs54.mkdirSync)((0, import_node_path51.dirname)(target), { recursive: true });
         (0, import_node_fs54.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
@@ -54502,7 +54610,7 @@ function runDistStatus(root) {
 }
 
 // src/doc-refs-live.ts
-var import_node_path51 = require("node:path");
+var import_node_path52 = require("node:path");
 var concrete = (value) => !!value && !/[<>{}$]/.test(value);
 var liveOption = (tokens2, flag) => {
   const index = tokens2.indexOf(flag);
@@ -54575,7 +54683,7 @@ async function runLiveDocRefs(root, deps, live) {
   const offline = runDocRefs(root, { ...deps, runbooksOnly: true });
   const read = deps.readFile ?? readFileOrNull;
   const docs = Object.fromEntries((deps.listDocs ?? defaultListDocs)(root).flatMap((doc) => {
-    const body = read((0, import_node_path51.join)(root, doc));
+    const body = read((0, import_node_path52.join)(root, doc));
     return body !== null && isRunbook(doc, body) && !deps.isIgnored?.([doc]).has(doc) ? [[doc, body]] : [];
   }));
   const remote = await checkRunbookLive(docs, live);
@@ -54584,9 +54692,9 @@ async function runLiveDocRefs(root, deps, live) {
 }
 
 // src/doc-refs-live-io.ts
-var import_node_child_process20 = require("node:child_process");
+var import_node_child_process21 = require("node:child_process");
 var import_node_util7 = require("node:util");
-var exec2 = (0, import_node_util7.promisify)(import_node_child_process20.execFile);
+var exec2 = (0, import_node_util7.promisify)(import_node_child_process21.execFile);
 function createRunbookLiveDeps(cliBin) {
   const json = async (args) => {
     const { stdout } = await exec2(process.execPath, [cliBin, ...args, "--json"], { windowsHide: true, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 });
@@ -54612,7 +54720,7 @@ function createRunbookLiveDeps(cliBin) {
       };
       const first = await probe().catch(() => 599);
       if (first < 500) return first;
-      await new Promise((resolve7) => setTimeout(resolve7, 2e4));
+      await new Promise((resolve8) => setTimeout(resolve8, 2e4));
       return probe();
     }
   };
@@ -54715,7 +54823,7 @@ init_hub_auth();
 
 // src/schedules-lift-command.ts
 var import_promises12 = require("node:fs/promises");
-var import_node_path52 = require("node:path");
+var import_node_path53 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -54744,7 +54852,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path52.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path53.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -54826,9 +54934,9 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process21 = require("node:child_process");
+var import_node_child_process22 = require("node:child_process");
 var import_node_fs55 = require("node:fs");
-var import_node_path53 = require("node:path");
+var import_node_path54 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -54897,7 +55005,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process21.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process22.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,
@@ -54914,7 +55022,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs55.readFileSync)((0, import_node_path53.join)(root, file), "utf8");
+      raw = (0, import_node_fs55.readFileSync)((0, import_node_path54.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -54934,7 +55042,7 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path54.join)(process.cwd(), ".gitignore");
+    const path2 = (0, import_node_path55.join)(process.cwd(), ".gitignore");
     const current = (0, import_node_fs56.existsSync)(path2) ? (0, import_node_fs56.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
@@ -55215,7 +55323,7 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path55.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path56.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -55387,7 +55495,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs57.existsSync)((0, import_node_path55.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path56.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -55396,7 +55504,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs57.existsSync)((0, import_node_path55.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs57.existsSync)((0, import_node_path56.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -55417,8 +55525,8 @@ function mmiDoctorDeps(opts = {}) {
         });
         const raced = await Promise.race([
           work.then((r) => ({ ...r, timedOut: false })),
-          new Promise((resolve7) => {
-            ceiling = setTimeout(() => resolve7({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
+          new Promise((resolve8) => {
+            ceiling = setTimeout(() => resolve8({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
           })
         ]);
         if (raced.timedOut) return { scanned: 0, findings: 0, fixed: 0, failed: 0, timedOut: true };
@@ -55451,8 +55559,8 @@ function mmiDoctorDeps(opts = {}) {
             incomplete: nb.incomplete,
             timedOut: false
           })),
-          new Promise((resolve7) => {
-            ceiling = setTimeout(() => resolve7({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
+          new Promise((resolve8) => {
+            ceiling = setTimeout(() => resolve8({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
           })
         ]);
         if (!raced.timedOut && raced.incomplete.length === 0) writeSchedulesDriftCache(cachePath, raced.driftLines);
@@ -56064,7 +56172,7 @@ projectDeploy.command("doctor").description("read-only estate port scan; --box l
   if (report.error && report.status !== 403) return failGraceful(`org project deploy doctor: ${report.error}`);
   if (!report.ok && !report.error) process.exitCode = 1;
 });
-projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one stage's DEPLOY# row for a project that no longer deploys through it (#7095, master-only). --stage is required. DRY-RUN by default \u2014 pass --apply to actually write; defaults to the current repo. Refuses a tenant-container project's live main row.").addOption(new Option("--stage <stage>", "dev | rc | main (required)").choices(["dev", "rc", "main"])).option("--apply", "actually retire (default is a dry-run preview of the row that would be retired)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one stage's DEPLOY# row for a project that no longer deploys through it (#7095, master-only). --stage is required. DRY-RUN by default \u2014 pass --apply to actually write; defaults to the current repo. Refuses a tenant-container project's live main row.").addOption(new Option("--stage <stage>", "dev | rc | main (required)").choices(["dev", "rc", "main"])).option("--apply", "actually retire (default is a dry-run preview of the row that would be retired)").option("--decommissioned", "main only (#8148): retire a tenant-container main row after `runtime tenant control <repo> main retire`; the box must show main gone").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const stage = projectDeploy.opts().stage;
   if (!stage) return fail("org project deploy retire: --stage is required (dev | rc | main)");
   const cfg = await loadConfig();
@@ -56077,8 +56185,14 @@ projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one
   let result;
   try {
     result = await runDeployRetire(
-      { target, stage, apply: Boolean(o.apply) },
-      { registry: registryClientDeps(cfg) }
+      { target, stage, apply: Boolean(o.apply), decommissioned: Boolean(o.decommissioned) },
+      {
+        registry: registryClientDeps(cfg),
+        boxServiceState: async (s) => {
+          const r = await runTenantControl(trainApplyDeps(), { repo: target, stage: s, action: "status", watch: true });
+          return r.conclusion === "success" ? r.serviceState ?? "unknown" : "error";
+        }
+      }
     );
   } catch (e) {
     return fail(e.message);
@@ -56504,16 +56618,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path55.join)(root, path2);
+      const fullPath = (0, import_node_path56.join)(root, path2);
       return (0, import_node_fs57.existsSync)(fullPath) ? (0, import_node_fs57.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path55.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path56.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs57.existsSync)((0, import_node_path55.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs57.existsSync)((0, import_node_path55.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs57.existsSync)((0, import_node_path56.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs57.existsSync)((0, import_node_path56.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -56682,7 +56796,7 @@ function directoryBytes(path2) {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path55.join)(path2, entry.name);
+    const child2 = (0, import_node_path56.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
@@ -56712,7 +56826,7 @@ function pluginCacheFsDeps(configRoot, dirBytes) {
     dirBytes,
     listStagingDirs: (root) => (0, import_node_fs57.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path55.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs57.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path56.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs57.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -56726,7 +56840,7 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path55.join)(stagingRoot, name);
+      const p = (0, import_node_path56.join)(stagingRoot, name);
       if (!(0, import_node_fs57.existsSync)(p)) return null;
       try {
         return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs57.statSync)(q).mtimeMs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.124",
+  "version": "4.5.126",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",