@mutmutco/cli 4.5.34 → 4.5.36

package/dist/main.cjs

@@ -7295,11 +7295,11 @@ function decorateAwsModel(entries, registry2, verdicts) {
   });
 }
 var DECLARED_ENTRIES = [
-  { name: "mmi-backup (mm-central, mm-work, mmi-oguz; zuber unverified)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh; every Docker volume is tarred and every running Postgres container is pg_dumpall'd beside it (#7147; source scripts/nightly-backup.sh); zuber (46.225.58.31) absent from box inventory and its SSH host key changed on 2026-09-24 \u2014 unverified, not dropped (verify: mmi-cli devops runtime box get <box> --ssh)" },
+  { name: "mmi-backup (mm-central, mm-work, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh; every Docker volume is tarred and every running Postgres container is pg_dumpall'd beside it (#7147; source scripts/nightly-backup.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
   // #7148: a backup nobody restored is a hope. Monthly, restore the latest artifact of every
   // archived stage (including a stage whose containers are down) into scratch Postgres and compare
   // row counts, and read-verify every storage archive against its listing; per-stage PASS/FAIL.
-  { name: "mmi-backup-restore-check (mm-central, mm-work, mmi-oguz; zuber unverified)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); zuber (46.225.58.31) absent from box inventory and its SSH host key changed on 2026-09-24 \u2014 unverified, not dropped (verify: mmi-cli devops runtime box get <box> --ssh)" },
+  { name: "mmi-backup-restore-check (mm-central, mm-work, mmi-oguz)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
   // #3370/#6270: the one runner hygiene layer (runner-hygiene.yml was folded in and deleted). A workflow ran ON the runner and needed checkout +
   // setup-node before it can prune, so at 100% it dies at checkout and never prunes — the cleanup is
   // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
@@ -15715,9 +15715,9 @@ function trainFollowUpExitCode(status) {
 }
 function trainFollowUpNote(status) {
   if (status === "complete") return void 0;
-  return `follow-up ${status}: the exit code is never the verdict, read workflowRuns \u2014 see docs/Guides/train-troubleshooting.md#follow-up-pending`;
+  return `follow-up ${status}: the exit code is never the verdict, read workflowRuns \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#follow-up-pending`;
 }
-var TRAIN_DEPLOY_FAILED_NOTE = "promotion stands; retry the deploy, do not re-tag \u2014 see docs/Guides/train-troubleshooting.md#deploy-failed";
+var TRAIN_DEPLOY_FAILED_NOTE = "promotion stands; retry the deploy, do not re-tag \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#deploy-failed";
 function missingRunUrlNote(runId) {
   return runId != null ? `no run URL emitted \u2014 GitHub Actions returned run ${runId} without its URL` : "no run URL emitted \u2014 run absent or unreadable";
 }
@@ -16840,10 +16840,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.34",
-    tag: "v4.5.34",
-    commit: "fe244fb48abc",
-    npm: "@mutmutco/cli@4.5.34"
+    version: "4.5.36",
+    tag: "v4.5.36",
+    commit: "dfc9e43e72eb",
+    npm: "@mutmutco/cli@4.5.36"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -16860,14 +16860,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.34"
+          v3Target: "v4.5.36"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.34 and redeploy the Hub Lambda from tag v4.5.34 (fe244fb48abc); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.34 (@mutmutco/cli@4.5.34, tag commit fe244fb48abc \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.36 and redeploy the Hub Lambda from tag v4.5.36 (dfc9e43e72eb); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.36 (@mutmutco/cli@4.5.36, tag commit dfc9e43e72eb \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19826,7 +19826,7 @@ function installerDeclarationError(value, division) {
 
 // src/train-suite.ts
 var SUITE_GUARD_CODE = "suite-member-solo";
-var SUITE_GUARD_ANCHOR = `docs/Guides/train-troubleshooting.md#${SUITE_GUARD_CODE}`;
+var SUITE_GUARD_ANCHOR = `https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#${SUITE_GUARD_CODE}`;
 function suiteLeadRepo(repo, suite) {
   const owner = repo.split("/")[0];
   return `${owner}/${suite === "mm-work" ? "MM-Work" : suite}`;
@@ -20521,7 +20521,7 @@ async function appendJervGatewayReleaseDeploy(deps, repo, tag, tagSha, dispatch)
       ...dispatch,
       // #6095: the helper's receipt, health or rollback failed after a proven publish — the release resumes, never re-tags.
       // #6985: keep the FULL failing output in the note so the ledger can persist its tail (the first-line 240-char clip hid the real cause).
-      note: `${dispatch.note}; Jerv Gateway deploy FAILED (${full}) \u2014 see docs/Guides/train-troubleshooting.md#jerv-gateway-deploy`,
+      note: `${dispatch.note}; Jerv Gateway deploy FAILED (${full}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#jerv-gateway-deploy`,
       workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "jerv-gateway", runUrlNote: JERV_GATEWAY_RUN_URL_NOTE, conclusion: "failure" }],
       deployStatus: "failure"
     };
@@ -20742,7 +20742,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
     const deployStatus = watch ? await watchTenantRun(deps, runId) : "pending";
     let note = `dispatched tenant-deploy.yml (slug=${ctx.slug}, ref=${ref}, stage=${stage})`;
     if (deployStatus === "failure") {
-      note = `${note}; run FAILED \u2014 if its log shows exit 78 \`compose is fileless but DEPLOY#${stage}.noEnvFile is not true\`, set-deploy + reconcile before the redeploy \u2014 see docs/Guides/train-troubleshooting.md#deploy-exit-78-fileless`;
+      note = `${note}; run FAILED \u2014 if its log shows exit 78 \`compose is fileless but DEPLOY#${stage}.noEnvFile is not true\`, set-deploy + reconcile before the redeploy \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#deploy-exit-78-fileless`;
     }
     return { note, runId, runUrl, deployStatus };
   }
@@ -21057,7 +21057,7 @@ function isCanaryAccessBlockText(text) {
 }
 function actionsCanaryUndispatchedRefusal(detail) {
   return new Error(
-    `release refused: the hosted-job canary (#5604) was not dispatched, so a hosted job start is UNPROVEN \u2014 this is NOT a billing verdict. ${detail} The Hub dispatches ${CANARY_WORKFLOW} with its App token for a train-authorized caller (#6319): refresh the Hub session (\`gh auth login\`) and retry, and confirm \`mmi-cli oracle org access role <owner/repo>\` reports train authority. Nothing was tagged or pushed \u2014 see docs/Guides/train-troubleshooting.md#actions-job-start-canary`
+    `release refused: the hosted-job canary (#5604) was not dispatched, so a hosted job start is UNPROVEN \u2014 this is NOT a billing verdict. ${detail} The Hub dispatches ${CANARY_WORKFLOW} with its App token for a train-authorized caller (#6319): refresh the Hub session (\`gh auth login\`) and retry, and confirm \`mmi-cli oracle org access role <owner/repo>\` reports train authority. Nothing was tagged or pushed \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#actions-job-start-canary`
   );
 }
 function actionsBillingRefusal(detail) {
@@ -21221,11 +21221,11 @@ async function assertActionsJobsCanStart(deps, targetRepo2) {
       return;
     }
     if (last === "billing-blocked" || last === "never-started") {
-      throw actionsBillingRefusal(`${url}: hosted canary ${last} \u2014 see docs/Guides/train-troubleshooting.md#actions-job-start-canary`);
+      throw actionsBillingRefusal(`${url}: hosted canary ${last} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#actions-job-start-canary`);
     }
   }
   throw actionsBillingRefusal(
-    `${url}: hosted canary stayed ${last} after ${CANARY_POLLS} polls \u2014 cannot prove a hosted job can start \u2014 see docs/Guides/train-troubleshooting.md#actions-job-start-canary`
+    `${url}: hosted canary stayed ${last} after ${CANARY_POLLS} polls \u2014 cannot prove a hosted job can start \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#actions-job-start-canary`
   );
 }
 
@@ -23641,7 +23641,7 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
     }
     let gatewayDeploy;
     const deferredGateway = isJervHubRepo(prior.repo) && deferredGatewayDeployLegShape(phases.deploy);
-    const unresolved = ["promotion", "ordinaryCi", "githubRelease", "deploy", "alignment"].filter((phase) => !(phase === "deploy" && deferredGateway)).filter((phase) => phases[phase].state === "pending" || phases[phase].state === "failed");
+    const unresolved = ["promotion", "ordinaryCi", "githubRelease", "deploy", "alignment"].filter((phase) => !(phase === "deploy" && deferredGateway)).filter((phase) => !(phase === "alignment" && phases.alignment.state === "pending")).filter((phase) => phases[phase].state === "pending" || phases[phase].state === "failed");
     if (unresolved.length > 0) {
       throw new Error(
         `release --supersede-publish: ${prior.tag} has unresolved legs besides publish (${unresolved.map((p) => `${p}=${phases[p].state}`).join(", ")}) \u2014 the supersession closes only the publish leg of an otherwise-complete release; resolve those first, nothing was written (#6638)`
@@ -23689,7 +23689,7 @@ async function supersedeContentCausedPublishLeg(deps, cwd) {
       repo: prior.repo,
       tag: prior.tag,
       tagSha: prior.tagSha,
-      note: `closed the ${prior.tag} publish leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix`,
+      note: `closed the ${prior.tag} publish leg as superseded (skipped) \u2014 the ledger is phases-green; rerun the train doctor to confirm, then run the next patch train (hotfix or release) to carry the cause fix${phases.alignment.state === "pending" ? "; alignment still pending (fold-port PR open \u2014 closes live at the next pre-flight, #6061)" : ""}`,
       ...gatewayDeploy ? { gatewayDeploy } : {}
     };
   });
@@ -24793,7 +24793,7 @@ async function preflightMergeToMain(deps, deployModel, remoteRef, blockingPrefix
   const predicted = await predictMergeConflicts(deps, ours, remoteRef);
   const predictedBlocking = predicted.filter((f) => !pathIsTolerated(f, tolerated));
   if (predictedBlocking.length > 0) {
-    throw new Error(`${blockingPrefix}: ${predictedBlocking.join(", ")} \u2014 no merge was started. ${realignMessage} \u2014 see docs/Guides/train-troubleshooting.md#merge-conflict`);
+    throw new Error(`${blockingPrefix}: ${predictedBlocking.join(", ")} \u2014 no merge was started. ${realignMessage} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#merge-conflict`);
   }
   return { foldPaths, tolerated, predicted };
 }
@@ -25022,7 +25022,7 @@ async function recoverFailedFold(deps, cause, startBranch, preFoldMainSha, resum
   const causeMessage = anchor ? `${rawCause} \u2014 see ${anchor}` : rawCause;
   const probe = await probeFoldFailureState(deps);
   if (probe.mergeInProgress) {
-    const conflictCause = `${rawCause} \u2014 see docs/Guides/train-troubleshooting.md#merge-conflict`;
+    const conflictCause = `${rawCause} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#merge-conflict`;
     try {
       await deps.run("git", ["merge", "--abort"]);
     } catch (e) {
@@ -26593,7 +26593,7 @@ ${spent.note}`), rcandRecovery(tag2));
   if (!coverage.ok) {
     const list = coverage.uncovered.map((c) => `${c.sha.slice(0, 8)} ${c.subject}`).join("; ");
     throw new Error(
-      `hotfix-coverage: ${coverage.uncovered.length} main-only commit(s) not proven in origin/rc \u2014 the candidate would revert a prod hotfix: ${list}. Re-cut /rcand from development, or have the authorized human verify the content is in the candidate and rerun release with --ack <sha>[,<sha>\u2026] \u2014 see docs/Guides/train-troubleshooting.md#hotfix-coverage`
+      `hotfix-coverage: ${coverage.uncovered.length} main-only commit(s) not proven in origin/rc \u2014 the candidate would revert a prod hotfix: ${list}. Re-cut /rcand from development, or have the authorized human verify the content is in the candidate and rerun release with --ack <sha>[,<sha>\u2026] \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-coverage`
       // #6095: the guard names its lesson
     );
   }
@@ -26673,7 +26673,7 @@ async function resolveTrainBumpIntent(deps, env = process.env, latestRelease) {
   const explicitIntent = (env.MMI_BUMP_INTENT ?? "").trim();
   if (explicitIntent) {
     if (!TRAIN_BUMP_INTENTS.includes(explicitIntent)) {
-      throw new Error("MMI_BUMP_INTENT must be one of major|minor|patch \u2014 see docs/Guides/train-troubleshooting.md#bump-intent-invalid");
+      throw new Error("MMI_BUMP_INTENT must be one of major|minor|patch \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#bump-intent-invalid");
     }
     return explicitIntent;
   }
@@ -26718,12 +26718,12 @@ async function resolveHotfixVersion(deps, env = process.env) {
   }
   const nonPatch = declared.find((d) => d.intent !== "patch");
   if (nonPatch) {
-    throw new Error(`hotfix is PATCH-only \u2014 ${nonPatch.name}=${nonPatch.value} declares a ${nonPatch.intent} bump over ${baseTag}; unset it (or run the release train for a ${nonPatch.intent} release) \u2014 see docs/Guides/train-troubleshooting.md#bump-intent-invalid`);
+    throw new Error(`hotfix is PATCH-only \u2014 ${nonPatch.name}=${nonPatch.value} declares a ${nonPatch.intent} bump over ${baseTag}; unset it (or run the release train for a ${nonPatch.intent} release) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#bump-intent-invalid`);
   }
   const explicit = explicitVersion.replace(/^v/, "");
   const nextPatch = `${latest.major}.${latest.minor}.${latest.patch + 1}`;
   if (explicitIntent && explicit && explicit !== nextPatch) {
-    throw new Error(`hotfix version declarations conflict \u2014 MMI_BUMP_INTENT=patch targets ${nextPatch} from ${baseTag}, but MMI_RELEASE_VERSION=${explicitVersion} targets ${explicit}; set one declaration or make both target ${nextPatch} \u2014 see docs/Guides/train-troubleshooting.md#bump-intent-invalid`);
+    throw new Error(`hotfix version declarations conflict \u2014 MMI_BUMP_INTENT=patch targets ${nextPatch} from ${baseTag}, but MMI_RELEASE_VERSION=${explicitVersion} targets ${explicit}; set one declaration or make both target ${nextPatch} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#bump-intent-invalid`);
   }
   const version = explicit || nextPatch;
   return { tag: `v${version}`, version, baseTag };
@@ -29694,7 +29694,7 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary"];
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -30033,6 +30033,21 @@ function parseRequiredCheckBranchesVar(raw) {
   }
   return REQUIRED_CHECK_BRANCHES.filter((branch) => parsed.includes(branch));
 }
+function parseNotifyOnDeployVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: notifyOnDeploy must be a JSON array, e.g. ["dev"]');
+  }
+  if (!Array.isArray(parsed) || parsed.some((s) => s !== "dev" && s !== "rc" && s !== "main")) {
+    throw new Error('org project set: notifyOnDeploy must be a JSON array of stages: dev, rc, main (e.g. ["dev"])');
+  }
+  if (new Set(parsed).size !== parsed.length) {
+    throw new Error("org project set: notifyOnDeploy must not contain duplicate stages");
+  }
+  return parsed;
+}
 function parseCiExemptReasonVar(raw) {
   const trimmed = raw.trim();
   if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
@@ -30173,7 +30188,8 @@ var SETTABLE_VAR_KEYS = [
   "gate",
   "secrets",
   "seedCanary",
-  "installer"
+  "installer",
+  "notifyOnDeploy"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -30202,6 +30218,7 @@ var SETTABLE_VAR_HINTS = {
   ci: "none \u2014 declare intentional no-ci",
   requiredChecks: 'JSON array, e.g. ["gate"] or [] for no-ci',
   requiredCheckBranches: "non-empty JSON branch-name array; exact product-ruleset scope (#5210)",
+  notifyOnDeploy: 'JSON stage array, e.g. ["dev"] \u2014 successful tenant-deploy sends <stage>-deployed to the project repo (#7358)',
   ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,affectedCmd,workdir,cacheDepPath,pyVersion}"
 };
@@ -30345,6 +30362,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseRequiredChecksVar(raw);
     } else if (key === "requiredCheckBranches") {
       patch[key] = parseRequiredCheckBranchesVar(raw);
+    } else if (key === "notifyOnDeploy") {
+      patch[key] = parseNotifyOnDeployVar(raw);
     } else if (key === "ciExemptReason") {
       patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
@@ -30389,6 +30408,8 @@ var DEPLOY_SHELL_SAFE_RE = /^[A-Za-z0-9./:_?&=%-]*$/;
 var DEPLOY_ROLE_ARN_RE = /^arn:aws:iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,128}$/;
 var DEPLOY_BUCKET_RE = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
 var DEPLOY_DISTRIBUTION_ID_RE = /^[A-Z0-9]{5,32}$/;
+var COMPOSE_PROFILE_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;
+var MAX_COMPOSE_PROFILES = 8;
 function buildSetDeployPatch(_slug, input) {
   const clean4 = (v) => typeof v === "string" && v.trim() !== "" ? v.trim() : void 0;
   const stage = clean4(input.stage);
@@ -30432,6 +30453,23 @@ function buildSetDeployPatch(_slug, input) {
   if (input.noEnvFile !== void 0 && typeof input.noEnvFile !== "boolean") {
     throw new Error("org project set-deploy: --no-env-file must be true or false");
   }
+  if (input.clearComposeProfiles && (input.composeProfiles?.length ?? 0) > 0) {
+    throw new Error("org project set-deploy: --clear-compose-profiles cannot be combined with --compose-profiles (they contradict)");
+  }
+  let composeProfiles;
+  if (input.clearComposeProfiles) {
+    composeProfiles = [];
+  } else if (input.composeProfiles !== void 0) {
+    const names = input.composeProfiles.map((p) => typeof p === "string" ? p.trim() : "");
+    if (names.length > MAX_COMPOSE_PROFILES) throw new Error(`org project set-deploy: --compose-profiles carries at most ${MAX_COMPOSE_PROFILES} profiles`);
+    const seen = /* @__PURE__ */ new Set();
+    for (const name of names) {
+      if (!COMPOSE_PROFILE_RE.test(name)) throw new Error(`org project set-deploy: --compose-profiles must be comma-separated profile names ([a-z0-9_-], up to 63 chars), got ${JSON.stringify(name)}`);
+      if (seen.has(name)) throw new Error(`org project set-deploy: --compose-profiles carries a duplicate profile ${JSON.stringify(name)}`);
+      seen.add(name);
+    }
+    composeProfiles = [...seen];
+  }
   return {
     stage,
     ...substrate !== void 0 ? { substrate } : {},
@@ -30448,7 +30486,10 @@ function buildSetDeployPatch(_slug, input) {
     // #2986: an explicit `[]` is what the route reads as "clear them"; omitting the key is what it reads as
     // "keep them". Those are different instructions and they now have different flags.
     ...input.clearAliases ? { aliases: [] } : uniqueAliases.length ? { aliases: uniqueAliases } : {},
-    ...input.noEnvFile !== void 0 ? { noEnvFile: input.noEnvFile } : {}
+    ...input.noEnvFile !== void 0 ? { noEnvFile: input.noEnvFile } : {},
+    // #7353: an explicit `[]` is what the route reads as "clear them"; omitting the key is what it reads as
+    // "keep them" — same patch contract as aliases (#2986/#2984).
+    ...composeProfiles !== void 0 ? { composeProfiles } : {}
   };
 }
 var DEPLOY_STAGE_BRANCH = { dev: "development", rc: "rc", main: "main" };
@@ -34313,12 +34354,13 @@ var import_node_crypto11 = require("node:crypto");
 var SCHEMA = "mmi-suite-cut/v1";
 var SHA2 = /^[a-f0-9]{40}$/i;
 var RC_TAG = /^v\d+\.\d+\.\d+-rc\.\d+$/;
+var RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
 function suitePins(record) {
-  return record.members.map((m) => ({
+  return record.members.map((m) => m.carried ? { module: m.id, rc: m.rcPin, main: m.mainPin } : {
     module: m.id,
     rc: `https://${m.id === "katip" ? m.rcHost ?? m.host : m.host}/${m.id === "katip" ? "" : "rc/"}module.js?v=${m.tag}`,
     main: `https://${m.host}/module.js?v=${suiteReleaseTag(m.tag)}`
-  }));
+  });
 }
 function suiteReleaseTag(rc) {
   if (!RC_TAG.test(rc)) throw new Error(`invalid rc tag ${rc}`);
@@ -34338,7 +34380,7 @@ function readSuiteCut(path2) {
   } catch {
     throw new Error(`suite cut record unreadable at ${path2}; repair it, never recut`);
   }
-  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent"].includes(record.announcement) || !record.leadReleased) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string")))
+  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent"].includes(record.announcement) || !record.leadReleased) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
     throw new Error(`suite cut record has unknown or invalid state at ${path2}; repair it, never recut`);
   return record;
 }
@@ -34352,6 +34394,27 @@ function writeSuiteCut(path2, record) {
     throw new Error(`suite cut record write failed at ${path2}: ${e.message}; stop, verify the file before retrying`);
   }
 }
+function isPin(url) {
+  return typeof url === "string" && url.startsWith("https://");
+}
+function pinVersion(url) {
+  try {
+    return url ? new URL(url).searchParams.get("v") ?? "" : "";
+  } catch {
+    return "";
+  }
+}
+async function carriedPins(deps, member, bundles) {
+  const main = bundles.main;
+  if (!main || !RELEASE_TAG.test(pinVersion(main))) throw new Error(`${member.repo}: nothing new since rc, but its MM-Work main pin ${main ?? "(none)"} has no ?v=vX.Y.Z release; pin it before the suite cut`);
+  for (const url of [bundles.rc, main]) {
+    const tag = pinVersion(url);
+    if (!RC_TAG.test(tag) && !RELEASE_TAG.test(tag)) continue;
+    const sha = await deps.tagSha(member.repo, tag);
+    if (sha && await deps.contains(member.repo, member.development, sha)) return { rcPin: url, mainPin: main };
+  }
+  throw new Error(`${member.repo}: nothing new since rc, but no pinned MM-Work bundle carries development ${member.development.slice(0, 12)}; pin it before the suite cut`);
+}
 async function suiteRcand(deps, opts) {
   if (!opts.ownerGo) throw new Error("suite rcand requires --owner-go (rc uses live data); nothing was written");
   const members = suiteMembers(await deps.registry());
@@ -34364,8 +34427,6 @@ async function suiteRcand(deps, opts) {
   if (opts.dryRun) return { plan };
   let record = readSuiteCut(deps.recordPath);
   if (record?.announcement === "sent" && record.leadReleased) {
-    const heads = await Promise.all(modules.map(async (m) => [await deps.head(m.repo, "development"), await deps.head(m.repo, "rc")]));
-    if (heads.some(([dev, rc]) => dev === rc)) throw new Error("a member has no new development commits since rc; no new suite cut started");
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
     if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
     (0, import_node_fs29.renameSync)(deps.recordPath, archive);
@@ -34390,9 +34451,38 @@ async function suiteRcand(deps, opts) {
   if (!record) throw new Error("suite cut record unavailable after initialization");
   if (record.members.length !== modules.length || modules.some((m) => !record.members.some((r) => r.repo === m.repo && r.id === m.id)))
     throw new Error("suite roster changed since cut began; refuse to omit or add a member");
+  const quiet = [];
+  for (const member of record.members) {
+    if (!member.tag && !member.carried && await deps.contains(member.repo, member.development, member.previousRc)) quiet.push(member);
+  }
+  if (record.members.every((m) => m.carried || quiet.includes(m))) {
+    (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
+    throw new Error("nothing to promote: no MM-Work module has new development commits since its rc; no suite cut started");
+  }
+  for (const member of quiet) {
+    Object.assign(member, { carried: true }, await carriedPins(deps, member, modules.find((m) => m.repo === member.repo).bundles));
+    writeSuiteCut(deps.recordPath, record);
+  }
+  const refusals = [];
+  for (const member of record.members) {
+    if (member.carried || member.published || member.id === "katip") continue;
+    try {
+      await deps.preflight(member.repo);
+    } catch (e) {
+      refusals.push(`${member.repo}: ${e.message}`);
+    }
+  }
+  if (refusals.length) {
+    const untouched = record.members.every((m) => !m.tag) && !record.pinPr;
+    if (untouched) (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
+    throw new Error(`module rc serving is not ready; ${untouched ? "no suite cut started" : "no new tag was cut"}:
+${refusals.join("\n")}
+Each module must ship a live release that bind-mounts <deployPath>/data read-only and serves <data>/rc/module.js at /rc/module.js (docs/Guides/suite-trains.md).`);
+  }
   for (const member of record.members) {
     if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
       throw new Error(`${member.repo}: development moved after the cut snapshot; refuse to add untested code`);
+    if (member.carried) continue;
     if (!member.tag) {
       const cut = await deps.rcand(member.repo, member.previousRc, member.rcWasAbsent);
       if (!RC_TAG.test(cut.tag) || !SHA2.test(cut.sha) || cut.sha.toLowerCase() === member.previousRc.toLowerCase()) throw new Error(`${member.repo}: rcand did not return a new immutable rc tag/SHA`);
@@ -34443,6 +34533,11 @@ async function suiteRelease(deps, ownerGo) {
   if (members.length !== record.members.length || members.some((m) => !record.members.some((r) => r.repo === m.repo && r.id === m.id))) throw new Error("suite roster changed after the cut; release refused");
   await deps.verifyPins(suitePins(record));
   for (const member of record.members) {
+    if (member.carried) {
+      const live2 = await deps.backend({ repo: member.repo, id: member.id, bundles: {} });
+      if (live2.version !== member.backend) throw new Error(`${member.repo}: live backend changed after the cut (${member.backend} \u2192 ${live2.version}); release refused`);
+      continue;
+    }
     const [sha, live, rcHead] = await Promise.all([deps.tagSha(member.repo, member.tag), deps.backend({ repo: member.repo, id: member.id, bundles: {} }), deps.head(member.repo, "rc")]);
     if (!sha || sha.toLowerCase() !== member.sha?.toLowerCase() || !member.released && rcHead?.toLowerCase() !== member.sha?.toLowerCase()) throw new Error(`${member.repo}: rc tag/branch ${member.tag} changed after the cut; release refused`);
     const katipReleaseSha = member.id === "katip" ? await deps.tagSha(member.repo, suiteReleaseTag(member.tag)) : void 0;
@@ -34452,7 +34547,7 @@ async function suiteRelease(deps, ownerGo) {
   }
   if ((await deps.tagSha(SUITE_REPO, record.leadRcTag))?.toLowerCase() !== record.leadRcSha?.toLowerCase()) throw new Error("MM-Work rc tag changed after the cut; release refused");
   for (const member of record.members) {
-    if (member.released) continue;
+    if (member.released || member.carried) continue;
     await deps.release(member.repo, suiteReleaseTag(member.tag), member.sha);
     if (member.id === "katip") {
       const expected = await deps.tagSha(member.repo, suiteReleaseTag(member.tag));
@@ -34593,7 +34688,7 @@ function announceSummaryFidelity(lines2, rangeLog) {
   if (shipped.size === 0) return null;
   const invented = [...new Set(lines2.flatMap((l) => l.match(/#\d+/g) ?? []))].filter((ref) => !shipped.has(ref));
   if (invented.length === 0) return null;
-  return `--announce-summary-file cites ${invented.join(", ")}, which ship in no commit of this release range \u2014 a summary line must describe work that actually shipped. Rebuild the summary from \`git log origin/main..HEAD\` (read commit BODIES too: a bundled PR closes issues its subject never names), then rerun the same release command \u2014 see docs/Guides/train-troubleshooting.md#announce-summary-missing`;
+  return `--announce-summary-file cites ${invented.join(", ")}, which ship in no commit of this release range \u2014 a summary line must describe work that actually shipped. Rebuild the summary from \`git log origin/main..HEAD\` (read commit BODIES too: a bundled PR closes issues its subject never names), then rerun the same release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
 }
 async function resolveAnnounceTarget(deps, repo) {
   if (repo.toLowerCase() === ANNOUNCE_REPO.toLowerCase()) return { kind: "alerts" };
@@ -34671,6 +34766,12 @@ function normalizeHotfixVersion(input) {
   return { tag: `v${m[1]}`, version: m[1] };
 }
 var deriveHotfixVersion = resolveHotfixVersion;
+function bumpHotfixPatchVersion(version) {
+  const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(version.trim());
+  if (!m) throw new Error(`cannot bump non-X.Y.Z hotfix version "${version}"`);
+  const next = `${m[1]}.${m[2]}.${Number(m[3]) + 1}`;
+  return { tag: `v${next}`, version: next };
+}
 function hotfixBranch(tag) {
   return `hotfix/${tag}`;
 }
@@ -34724,7 +34825,7 @@ function formatHotfixBatchPreflightRefusal(failures, fromSpecs) {
   const batchFrom = fromSpecs.join(",");
   return `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
 ${lines2.join("\n")}
-Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
+Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
 }
 var CHERRY_PICKED_FROM = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 async function findHotfixPickGaps(deps, sources, tolerated) {
@@ -34753,32 +34854,44 @@ ${lines2.join("\n")}
 A hotfix branch is cut from origin/main and carries ONLY the fixes --from names, in order (#4411) \u2014 every other merged development fix stays unshipped while the channel reports healthy (#6994). Add each omitted fix to the pick list and rerun \`mmi-cli devops hotfix start --from ${[...fromSpecs, ...gaps.map((g) => g.sha.slice(0, 7))].join(",")}\`, or, when a listed fix is provably not needed on main (a development-only change, already superseded), rerun with \`--ack ${gaps.map((g) => g.sha.slice(0, 7)).join(",")}\` naming exactly the sha(s) a human excluded \u2014 the ack is recorded in the PR body, never silent.`;
 }
 async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
-  if (sources.length === 0) return [];
-  const startBranch = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
-  const preflightBranch = `__mmi_hotfix_preflight_${Date.now()}`;
+  if (sources.length === 0) return { failures: [], skipped: [] };
+  const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
+  const { tmpdir: tmpdir10 } = await import("node:os");
+  const { join: join44 } = await import("node:path");
+  const dir = await mkdtemp2(join44(tmpdir10(), "mmi-hotfix-preflight-"));
+  const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
+  const skipped = [];
   try {
-    await deps.run("git", ["checkout", "-B", preflightBranch, "origin/main"]);
-    for (const source of sources) {
-      try {
-        await cherryPickWithToleratedPaths(deps, source.sha, pickTolerated);
-      } catch (e) {
-        const message2 = e.message ?? String(e);
-        const blocking = parseCherryPickBlockingPaths(message2);
-        failures.push({
-          label: source.label,
-          sha: source.sha,
-          blocking: blocking.length > 0 ? blocking : [message2.split("\n")[0] ?? message2]
-        });
+    await deps.run("git", ["worktree", "add", "--detach", dir, "origin/main"]);
+    try {
+      for (const source of sources) {
+        const before = await wt.run("git", ["status", "--porcelain"]);
+        try {
+          await cherryPickWithToleratedPaths(wt, source.sha, pickTolerated);
+        } catch (e) {
+          const message2 = e.message ?? String(e);
+          const after = await wt.run("git", ["status", "--porcelain"]).catch(() => null);
+          if (after !== null && after === before && /empty|nothing to commit/i.test(message2)) {
+            await wt.run("git", ["cherry-pick", "--quit"]).catch(() => void 0);
+            skipped.push({ sha: source.sha, label: source.label });
+            continue;
+          }
+          const blocking = parseCherryPickBlockingPaths(message2);
+          failures.push({
+            label: source.label,
+            sha: source.sha,
+            blocking: blocking.length > 0 ? blocking : [message2.split("\n")[0] ?? message2]
+          });
+        }
       }
+    } finally {
+      await deps.run("git", ["worktree", "remove", "--force", dir]).catch(() => void 0);
     }
   } finally {
-    if (startBranch && startBranch !== "HEAD") {
-      await deps.run("git", ["checkout", startBranch]).catch(() => void 0);
-    }
-    await deps.run("git", ["branch", "-D", preflightBranch]).catch(() => void 0);
+    await rm2(dir, { recursive: true, force: true }).catch(() => void 0);
   }
-  return failures;
+  return { failures, skipped };
 }
 async function restoreAfterFailedPort(deps, opts) {
   const { startBranch, branch, created } = opts;
@@ -34902,9 +35015,19 @@ async function runHotfixStartLocked(deps, options, doctor) {
   }
   await deps.run("git", ["fetch", "origin", "--tags"]);
   const { deployModel } = await hotfixPreflight(deps, ctx, "start");
-  const { tag, version } = await resolveHotfixVersion(deps);
+  const bumpNotes = [];
+  let resolved = await resolveHotfixVersion(deps);
+  for (; ; ) {
+    const priorPr = await findHotfixPr(deps, ctx, resolved.tag);
+    if ((priorPr?.state ?? "").toUpperCase() !== "MERGED") break;
+    const priorReleased = await hotfixReleaseExists(deps, ctx, resolved.tag);
+    const next = bumpHotfixPatchVersion(resolved.version);
+    bumpNotes.push(`hotfix ${resolved.tag} is already merged on origin/main (PR #${priorPr?.number}, ${priorReleased ? "released" : "unreleased"}) \u2014 origin/main already carries its fold, so this cycle mints ${next.tag} instead of reusing an already-bumped version (#7338)`);
+    resolved = next;
+  }
+  const { tag, version } = resolved;
   const branch = hotfixBranch(tag);
-  const notes = [];
+  const notes = [...bumpNotes];
   const existingPr = await findHotfixPr(deps, ctx, tag);
   const existingState = (existingPr?.state ?? "").toUpperCase();
   const releaseExists = existingState === "MERGED" ? await hotfixReleaseExists(deps, ctx, tag) : false;
@@ -34936,8 +35059,8 @@ async function runHotfixStartLocked(deps, options, doctor) {
   if (specs.length === 0) throw new Error("hotfix start: --from named no PR or SHA");
   const sources = [];
   for (const spec of specs) {
-    const resolved = await resolveHotfixSource(deps, ctx, spec);
-    if (!sources.some((s) => s.sha === resolved.sha)) sources.push(resolved);
+    const resolved2 = await resolveHotfixSource(deps, ctx, spec);
+    if (!sources.some((s) => s.sha === resolved2.sha)) sources.push(resolved2);
   }
   const label = sources.map((s) => s.label).join(", ");
   const { foldPaths, pickTolerated } = await resolveHotfixPickTolerated(deps, deployModel);
@@ -34953,21 +35076,33 @@ async function runHotfixStartLocked(deps, options, doctor) {
   if (pickGaps.length > 0) {
     notes.push(`pick-completeness ack: excluded ${pickGaps.map((g) => `${g.sha.slice(0, 7)} ${g.subject}`).join("; ")} by --ack (#6994)`);
   }
+  let activeSources = sources;
+  let activeLabel = label;
   const remoteBranch = clean3(await deps.run("git", ["ls-remote", "origin", `refs/heads/${branch}`]));
   if (remoteBranch) {
     await deps.run("git", ["checkout", branch]);
     await deps.run("git", ["pull", "--ff-only", "origin", branch]);
     notes.push(`branch ${branch} already on origin \u2014 reused (cherry-pick/bump assumed present; PR step resumes)`);
   } else {
-    const preflightFailures = await preflightHotfixBatchPicks(deps, sources, pickTolerated);
-    if (preflightFailures.length > 0) {
-      throw new Error(formatHotfixBatchPreflightRefusal(preflightFailures, specs));
+    const preflight2 = await preflightHotfixBatchPicks(deps, sources, pickTolerated);
+    if (preflight2.failures.length > 0) {
+      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs));
+    }
+    if (preflight2.skipped.length > 0) {
+      const skippedShas = new Set(preflight2.skipped.map((s) => s.sha));
+      const remaining = sources.filter((s) => !skippedShas.has(s.sha));
+      notes.push(`auto-skipped ${preflight2.skipped.length} pick(s) already present on origin/main (empty cherry-pick \u2014 content already shipped there, #7338): ${preflight2.skipped.map((s) => s.label).join(", ")}`);
+      if (remaining.length === 0) {
+        throw new Error(`hotfix start: every named pick is already present on origin/main (${preflight2.skipped.map((s) => s.label).join(", ")}) \u2014 nothing to carry, so no ${branch} branch was cut`);
+      }
+      activeSources = remaining;
+      activeLabel = remaining.map((s) => s.label).join(", ");
     }
     const startBranch = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
     const preexistingLocal = clean3(await deps.run("git", ["branch", "--list", branch]));
     await deps.run("git", ["checkout", "-B", branch, "origin/main"]);
     try {
-      for (const source of sources) {
+      for (const source of activeSources) {
         const autoResolved = await cherryPickWithToleratedPaths(deps, source.sha, pickTolerated);
         if (autoResolved.length > 0) {
           notes.push(`auto-resolved regenerable cherry-pick conflict(s) for ${source.label}: ${autoResolved.join(", ")} (regenerated in bump step)`);
@@ -34976,12 +35111,12 @@ async function runHotfixStartLocked(deps, options, doctor) {
     } catch (e) {
       const recovery = await restoreAfterFailedPort(deps, { startBranch, branch, created: !preexistingLocal });
       throw new Error(
-        `cherry-pick of ${label} onto ${branch} conflicted \u2014 aborted; nothing was pushed. Land the conflict resolution on development through a normal PR, then rerun \`mmi-cli devops hotfix start --from <that PR's merge sha>\` \u2014 never hand-resolve the port onto main. ${recovery} (${e.message ?? e})`
+        `cherry-pick of ${activeLabel} onto ${branch} conflicted \u2014 aborted; nothing was pushed. Land the conflict resolution on development through a normal PR, then rerun \`mmi-cli devops hotfix start --from <that PR's merge sha>\` \u2014 never hand-resolve the port onto main. ${recovery} (${e.message ?? e})`
       );
     }
-    notes.push(`cherry-picked ${label} onto ${branch} (from origin/main, -x trailer recorded)`);
+    notes.push(`cherry-picked ${activeLabel} onto ${branch} (from origin/main, -x trailer recorded)`);
+    const durableSource = clean3(await deps.run("git", ["merge-base", "HEAD", "origin/main"]));
     if (deployModel === "hub-serverless") {
-      const durableSource = clean3(await deps.run("git", ["merge-base", "HEAD", "origin/main"]));
       await deps.run("node", ["scripts/release-distribution.mjs", "prepare", version, "--source-commit", durableSource]);
       const changedFiles = (await deps.run("node", ["scripts/release-distribution.mjs", "changed-files"])).split("\n").map((s) => s.trim()).filter(Boolean);
       await deps.run("git", ["add", "-f", "--", ...changedFiles]);
@@ -34993,11 +35128,12 @@ async function runHotfixStartLocked(deps, options, doctor) {
         notes.push("distribution prepare produced no changes \u2014 nothing extra committed");
       }
     } else if (foldPaths.length > 0) {
-      const foldNote = await foldReleaseVersion(deps, deployModel, tag, foldPaths);
+      const foldNote = await withFoldSourceCommit(durableSource, () => foldReleaseVersion(deps, deployModel, tag, foldPaths));
       notes.push(foldNote);
     } else {
       notes.push(`version fold skipped (deployModel=${deployModel} carries no version manifest \u2014 the tag is the version)`);
     }
+    await assertHotfixFoldBomStamp(deps, tag);
     await deps.run("git", ["push", "-u", "origin", branch]);
   }
   const bumpNote = deployModel === "hub-serverless" ? " with the locked distribution bump" : foldPaths.length > 0 ? " with the package version bump" : "";
@@ -35015,16 +35151,16 @@ async function runHotfixStartLocked(deps, options, doctor) {
     // Every picked sha goes in the marker (#4411) — `hotfix release` reads it when --carries is omitted,
     // so a multi-fix cycle proves ALL of its targets present before tagging, not just the first.
     "--body",
-    `Hotfix ${tag}: cherry-pick of ${label} onto origin/main${bumpNote}.
+    `Hotfix ${tag}: cherry-pick of ${activeLabel} onto origin/main${bumpNote}.
 
-<!-- mmi-hotfix-carries: ${sources.map((s) => s.sha).join(",")} -->${pickGaps.length > 0 ? `
+<!-- mmi-hotfix-carries: ${activeSources.map((s) => s.sha).join(",")} -->${pickGaps.length > 0 ? `
 
 <!-- mmi-hotfix-acked-excluded: ${pickGaps.map((g) => g.sha).join(",")} (#6994 pick-completeness) -->` : ""}
 
 Merge this PR (human-initiated), then run \`mmi-cli devops hotfix release ${tag}\`.`
   ]));
   notes.push(`opened hotfix PR ${prUrl} \u2014 merge it (human-initiated), then: mmi-cli devops hotfix release ${tag}`);
-  return { ...ctx, command: "hotfix-start", tag, version, branch, source: label, prUrl, reused: Boolean(remoteBranch), notes };
+  return { ...ctx, command: "hotfix-start", tag, version, branch, source: activeLabel, prUrl, reused: Boolean(remoteBranch), notes };
 }
 function hotfixWorkflowRunFromDispatch(workflow, dispatch) {
   return {
@@ -35061,6 +35197,13 @@ async function watchReleaseRun(deps, ctx, workflow, sha) {
     const run = rows.find((r) => r.headSha === sha && typeof r.databaseId === "number");
     if (!run) continue;
     if (run.status === "completed") return { workflow, runId: run.databaseId, url: run.url, conclusion: run.conclusion ?? "unknown" };
+    try {
+      const viewed = JSON.parse(await deps.run("gh", ["run", "view", String(run.databaseId), "--repo", ctx.repo, "--json", "status,conclusion"]));
+      if (viewed.status === "completed") {
+        return { workflow, runId: run.databaseId, url: run.url, conclusion: typeof viewed.conclusion === "string" ? viewed.conclusion : "unknown" };
+      }
+    } catch {
+    }
     try {
       await deps.run("gh", ghRunWatchArgs(run.databaseId, ctx.repo));
       return { workflow, runId: run.databaseId, url: run.url, conclusion: "success" };
@@ -35088,9 +35231,9 @@ async function portFoldToDevelopment(deps, ctx, deployModel, tag) {
   const branch = devFoldBranch(tag);
   const existing = await findFoldPr(deps, ctx, tag);
   if (existing?.state === "OPEN") {
-    return (await enqueueAlignmentAutoMerge(deps, ctx, existing.number, existing.url, `development fold PR #${existing.number} for ${tag} is OPEN \u2014 reused${existing.url ? ` (${existing.url})` : ""} \u2014 see docs/Guides/train-troubleshooting.md#hotfix-fold-port`)).note;
+    return (await enqueueAlignmentAutoMerge(deps, ctx, existing.number, existing.url, `development fold PR #${existing.number} for ${tag} is OPEN \u2014 reused${existing.url ? ` (${existing.url})` : ""} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-fold-port`)).note;
   }
-  if (existing) return `development fold PR #${existing.number} for ${tag} is ${existing.state} \u2014 reused${existing.url ? ` (${existing.url})` : ""} \u2014 see docs/Guides/train-troubleshooting.md#hotfix-fold-port`;
+  if (existing) return `development fold PR #${existing.number} for ${tag} is ${existing.state} \u2014 reused${existing.url ? ` (${existing.url})` : ""} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-fold-port`;
   const previousRef = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
   await reapFoldScratchBranches(deps);
   const scratch = devFoldScratchBranch(tag, deps);
@@ -35118,7 +35261,7 @@ async function portFoldToDevelopment(deps, ctx, deployModel, tag) {
 
 Generated by \`mmi-cli devops hotfix release\` \u2014 no main-parented commit is merged in, so the squash parents stay clean (#4365/#4371). Auto-merge is enqueued through the same path as the release alignment PR (#6068); it lands once the checks it triggers pass.`
     ]));
-    return (await enqueueAlignmentAutoMerge(deps, ctx, parsePrNumber(prUrl), prUrl || void 0, `opened development fold PR ${prUrl} (${foldNote}) \u2014 see docs/Guides/train-troubleshooting.md#hotfix-fold-port`)).note;
+    return (await enqueueAlignmentAutoMerge(deps, ctx, parsePrNumber(prUrl), prUrl || void 0, `opened development fold PR ${prUrl} (${foldNote}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-fold-port`)).note;
   } finally {
     if (previousRef && previousRef !== "HEAD") await deps.run("git", ["checkout", previousRef]).catch(() => void 0);
     await deps.run("git", ["branch", "-D", scratch]).catch(() => void 0);
@@ -35306,6 +35449,41 @@ ${recovery.note}; the full required-check wall did not revalidate`);
   }, `the immutable ${anchors.tag} pushed at ${mergedSha.slice(0, 12)}`);
   return checks;
 }
+var FOLD_SOURCE_COMMIT_ENV = "MMI_FOLD_SOURCE_COMMIT";
+async function withFoldSourceCommit(durableSource, fn) {
+  const prev = process.env[FOLD_SOURCE_COMMIT_ENV];
+  process.env[FOLD_SOURCE_COMMIT_ENV] = durableSource;
+  try {
+    return await fn();
+  } finally {
+    if (prev === void 0) delete process.env[FOLD_SOURCE_COMMIT_ENV];
+    else process.env[FOLD_SOURCE_COMMIT_ENV] = prev;
+  }
+}
+async function assertHotfixFoldBomStamp(deps, tag) {
+  let bomText;
+  try {
+    bomText = await deps.run("git", ["show", "HEAD:distribution-bom.json"]);
+  } catch {
+    return;
+  }
+  let stamp;
+  try {
+    stamp = JSON.parse(bomText).sourceCommit;
+  } catch (e) {
+    throw new Error(`hotfix ${tag}: distribution-bom.json at the fold commit is unparseable (${e.message}) \u2014 fix the BOM before the hotfix PR is opened, then rerun hotfix start`);
+  }
+  if (typeof stamp !== "string" || !/^[0-9a-f]{40}$/.test(stamp)) {
+    throw new Error(`hotfix ${tag}: distribution-bom.json at the fold commit carries no 40-hex sourceCommit \u2014 the updater would refuse this release; fix the BOM before the hotfix PR is opened, then rerun hotfix start`);
+  }
+  try {
+    await deps.run("git", ["merge-base", "--is-ancestor", stamp, "origin/main"]);
+  } catch {
+    throw new Error(
+      `hotfix ${tag}: distribution-bom.json at the fold commit stamps sourceCommit ${stamp.slice(0, 12)}, which is NOT on origin/main \u2014 the squash merge of the hotfix PR would orphan it and hotfix release would refuse (hotfix-bom-lineage). Make the consumer stamp ${FOLD_SOURCE_COMMIT_ENV} when set (the train exports the durable merge-base during the fold, Jerv-Hub#1084), land that on development, and rerun hotfix start \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-bom-lineage`
+    );
+  }
+}
 async function assertConsumerBomLineage(deps, mergedSha, tag) {
   let bomText;
   try {
@@ -35326,7 +35504,7 @@ async function assertConsumerBomLineage(deps, mergedSha, tag) {
     await deps.run("git", ["merge-base", "--is-ancestor", stamp, mergedSha]);
   } catch {
     throw new Error(
-      `hotfix ${tag}: distribution-bom.json at ${mergedSha.slice(0, 12)} stamps sourceCommit ${stamp.slice(0, 12)}, which the merged main commit does not contain \u2014 every updater would reject ${tag} (gateCandidate ancestry). The fold was stamped on the hotfix branch and squash-merged away: make the consumer stamp a durable merge-base (Jerv-Hub#1084), land that on development, and port it with the fix \u2014 see docs/Guides/train-troubleshooting.md#hotfix-bom-lineage`
+      `hotfix ${tag}: distribution-bom.json at ${mergedSha.slice(0, 12)} stamps sourceCommit ${stamp.slice(0, 12)}, which the merged main commit does not contain \u2014 every updater would reject ${tag} (gateCandidate ancestry). The fold was stamped on the hotfix branch and squash-merged away: make the consumer stamp a durable merge-base (Jerv-Hub#1084), land that on development, and port it with the fix \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-bom-lineage`
     );
   }
 }
@@ -35372,16 +35550,16 @@ async function runHotfixReleaseLocked(deps, versionInput, options, doctor) {
   const releaseExists = await hotfixReleaseExists(deps, ctx, tag);
   if (!releaseExists && isHubControlRepo(ctx.repo)) {
     if (!options.announceSummaryFile) {
-      throw new Error("a new MMI-Hub hotfix Release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same hotfix release command \u2014 see docs/Guides/train-troubleshooting.md#announce-summary-missing");
+      throw new Error("a new MMI-Hub hotfix Release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same hotfix release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing");
     }
     let lines2;
     try {
       lines2 = summaryFileLines(await (deps.readFile ?? ((p) => (0, import_promises4.readFile)(p, "utf8")))(options.announceSummaryFile));
     } catch (e) {
-      throw new Error(`could not read --announce-summary-file ${options.announceSummaryFile}: ${e.message} \u2014 see docs/Guides/train-troubleshooting.md#announce-summary-missing`);
+      throw new Error(`could not read --announce-summary-file ${options.announceSummaryFile}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`);
     }
     if (lines2.length < 3 || lines2.length > 6) {
-      throw new Error(`--announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see docs/Guides/train-troubleshooting.md#announce-summary-missing`);
+      throw new Error(`--announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`);
     }
     const jerv = hubSummaryJervRefusal(lines2);
     if (jerv) throw new Error(jerv);
@@ -35528,7 +35706,7 @@ ${decision.note}`);
     foldNote = await portFoldToDevelopment(deps, ctx, deployModel, tag);
   } catch (e) {
     foldStatus = "failure";
-    foldNote = `development fold port FAILED: ${e.message ?? e} \u2014 the release stands; port it by hand on a fresh branch: git checkout -B ${devFoldBranch(tag)}-manual origin/development && ${foldPortManualCommand(deployModel, version)}, then push it as the canonical head (git push origin ${devFoldBranch(tag)}-manual:refs/heads/${devFoldBranch(tag)}) and open a development-base PR \u2014 see docs/Guides/train-troubleshooting.md#hotfix-fold-port`;
+    foldNote = `development fold port FAILED: ${e.message ?? e} \u2014 the release stands; port it by hand on a fresh branch: git checkout -B ${devFoldBranch(tag)}-manual origin/development && ${foldPortManualCommand(deployModel, version)}, then push it as the canonical head (git push origin ${devFoldBranch(tag)}-manual:refs/heads/${devFoldBranch(tag)}) and open a development-base PR \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-fold-port`;
   }
   await recordHotfixPhase(ledger, anchors, "alignment", hotfixFoldAlignmentEntry(foldStatus, foldNote, mergedSha), "the tagged, released, deployed hotfix");
   const ledgerReport = releaseLedgerReport(await ledger.load(anchors).catch(() => void 0), ledger.path);
@@ -35577,7 +35755,7 @@ async function runHotfixRetryDeployLocked(deps, versionInput) {
         foldNote2 = await portFoldToDevelopment(deps, ctx, deployModel, prior.tag);
       } catch (e) {
         foldStatus2 = "failure";
-        foldNote2 = `development fold port FAILED: ${e.message ?? e} \u2014 the release stands; port it by hand on a fresh branch: git checkout -B ${devFoldBranch(prior.tag)}-manual origin/development && ${foldPortManualCommand(deployModel, prior.tag.replace(/^v/, ""))}, then push it as the canonical head (git push origin ${devFoldBranch(prior.tag)}-manual:refs/heads/${devFoldBranch(prior.tag)}) and open a development-base PR \u2014 see docs/Guides/train-troubleshooting.md#hotfix-fold-port`;
+        foldNote2 = `development fold port FAILED: ${e.message ?? e} \u2014 the release stands; port it by hand on a fresh branch: git checkout -B ${devFoldBranch(prior.tag)}-manual origin/development && ${foldPortManualCommand(deployModel, prior.tag.replace(/^v/, ""))}, then push it as the canonical head (git push origin ${devFoldBranch(prior.tag)}-manual:refs/heads/${devFoldBranch(prior.tag)}) and open a development-base PR \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-fold-port`;
       }
       return hotfixFoldAlignmentEntry(foldStatus2, foldNote2, prior.tagSha);
     }
@@ -36097,17 +36275,17 @@ function prHeadBehindBase(input) {
   return /out[- ]of[- ]date|not up to date|up to date with the base|update (?:the|your) branch/i.test(input.message ?? "");
 }
 function prHeadUpdateRemedy(head, base) {
-  return `git fetch origin ${base} && git merge origin/${base} (on ${head}), resolve the conflicts, push, then rerun \u2014 docs/Guides/train-troubleshooting.md#head-behind-base`;
+  return `git fetch origin ${base} && git merge origin/${base} (on ${head}), resolve the conflicts, push, then rerun \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#head-behind-base`;
 }
 function prLandedBranchFinality(prNumber, base) {
-  return `PR #${prNumber} is merged, and that is final \u2014 stopping a local waiter or monitor does not unmerge it. The head branch is now landed; further commits pushed to it reach nothing. If more work is needed, run \`git fetch origin ${base} && git switch -c <new-branch> origin/${base}\`, then cherry-pick anything already committed \u2014 docs/Guides/train-troubleshooting.md#merged-pr-head-reuse`;
+  return `PR #${prNumber} is merged, and that is final \u2014 stopping a local waiter or monitor does not unmerge it. The head branch is now landed; further commits pushed to it reach nothing. If more work is needed, run \`git fetch origin ${base} && git switch -c <new-branch> origin/${base}\`, then cherry-pick anything already committed \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#merged-pr-head-reuse`;
 }
 var PROTECTED_PR_HEAD_BRANCHES = ["main", "master", "development", "rc"];
 function isProtectedPrHead(head) {
   return PROTECTED_PR_HEAD_BRANCHES.includes(head);
 }
 function protectedPrHeadRemedy(head, base) {
-  return `PR head \`${head}\` is a train branch \u2014 updating it from \`${base}\` would merge \`${base}\` into \`${head}\`, promoting every unreleased commit. Never do that and never hand-merge on \`${head}\`. This is the pre-#6288 alignment shape: close this PR and let the train rebuild the alignment on a \`${base}\`-based branch that merges \`${head}\` into it (\`mmi-cli devops release --resume\`), then land THAT with a true merge \u2014 docs/Guides/train-troubleshooting.md#head-behind-base`;
+  return `PR head \`${head}\` is a train branch \u2014 updating it from \`${base}\` would merge \`${base}\` into \`${head}\`, promoting every unreleased commit. Never do that and never hand-merge on \`${head}\`. This is the pre-#6288 alignment shape: close this PR and let the train rebuild the alignment on a \`${base}\`-based branch that merges \`${head}\` into it (\`mmi-cli devops release --resume\`), then land THAT with a true merge \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#head-behind-base`;
 }
 var PR_HEAD_UPDATE_API_READ_RETRIES = 5;
 var PR_HEAD_UPDATE_API_READ_DELAY_MS = 2e3;
@@ -37597,7 +37775,7 @@ function readRepoVersion() {
 }
 function registerTrainCommands(program3, trainDeps) {
   const train = program3.command("train").description("release-train observability \u2014 track position, version lag, and the shared preflight-and-heal doctor (#2688, #6067)");
-  train.command("doctor").description("one shared preflight-and-heal verdict for the release, rcand and hotfix lanes; read-only unless --heal (#6067)").addOption(new Option("--lane <lane>", "train lane to check (defaults from the release track: direct \u2192 release)").choices([...TRAIN_LANES])).option("--dev", "judge the `release --dev` lane (development -> main, skipping rc): the lane starts from development and is read on development's workflows (#6318)").option("--heal", "repair safe local reconstructible state (scratch gitignore, churn, stray local tags, ff-only branch lag, finished scratch branches, stale alignment ledger leg); it never clears a ledger-pending, ledger-failed or branch-mismatch blocker (#6404, #6401, #6399) \u2014 those need `mmi-cli devops release --resume` (or, with fresh approval, `--abort --apply`) and `git checkout <start branch>`, so exit 1 after --heal is the gate working, not a failed heal").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").option("--suite-solo", "judge an owner-approved solo release of one suite module, as `release --suite-solo --owner-go` does (requires --owner-go; never on rcand, #7327)").option("--owner-go", "explicit owner approval for the suite-solo lane (requires --suite-solo)").option("--json", "machine-readable output").option("--out <path>", "write the verdict to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802/#6563); pair with --json for a machine-readable file (e.g. `--json --out .jerv/tmp/train-doctor.json`); the file is written even when the verdict is NOT READY").addHelpText("after", "\nExit codes:\n  0  ready \u2014 no blocker and origin verified\n  1  a blocker remains, or origin could not be verified (never green on an unread origin)\n\nEvery finding carries code, severity (blocker|warning|healed|info), source (local|origin), remedy and a\ndocs/Guides/train-troubleshooting.md#<code> anchor. `release --apply` and `rcand --apply` run this at step 0 with --heal.\n").action(async (o) => {
+  train.command("doctor").description("one shared preflight-and-heal verdict for the release, rcand and hotfix lanes; read-only unless --heal (#6067)").addOption(new Option("--lane <lane>", "train lane to check (defaults from the release track: direct \u2192 release)").choices([...TRAIN_LANES])).option("--dev", "judge the `release --dev` lane (development -> main, skipping rc): the lane starts from development and is read on development's workflows (#6318)").option("--heal", "repair safe local reconstructible state (scratch gitignore, churn, stray local tags, ff-only branch lag, finished scratch branches, stale alignment ledger leg); it never clears a ledger-pending, ledger-failed or branch-mismatch blocker (#6404, #6401, #6399) \u2014 those need `mmi-cli devops release --resume` (or, with fresh approval, `--abort --apply`) and `git checkout <start branch>`, so exit 1 after --heal is the gate working, not a failed heal").option("--repo <owner/repo>", "target repo (defaults to the current checkout)").option("--suite-solo", "judge an owner-approved solo release of one suite module, as `release --suite-solo --owner-go` does (requires --owner-go; never on rcand, #7327)").option("--owner-go", "explicit owner approval for the suite-solo lane (requires --suite-solo)").option("--json", "machine-readable output").option("--out <path>", "write the verdict to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5802/#6563); pair with --json for a machine-readable file (e.g. `--json --out .jerv/tmp/train-doctor.json`); the file is written even when the verdict is NOT READY").addHelpText("after", "\nExit codes:\n  0  ready \u2014 no blocker and origin verified\n  1  a blocker remains, or origin could not be verified (never green on an unread origin)\n\nEvery finding carries code, severity (blocker|warning|healed|info), source (local|origin), remedy and a\nhttps://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#<code> anchor. `release --apply` and `rcand --apply` run this at step 0 with --heal.\n").action(async (o) => {
     try {
       if (o.suiteSolo !== o.ownerGo || o.lane === "rcand" && o.suiteSolo) {
         return failGraceful("train doctor: a suite-solo verdict needs BOTH --suite-solo --owner-go, and never on the rcand lane");
@@ -37777,7 +37955,7 @@ async function openSuiteCutPinPr(deps, input) {
 }
 async function openSuitePinPr(deps, input) {
   const { repo, tag, stage } = input;
-  const remedy = `open/merge the ${SUITE_REPO} development pin PR for ${repo} ${tag}, then rerun the same train command; do not recut the tag \u2014 see docs/Guides/train-troubleshooting.md#suite-pin-pr`;
+  const remedy = `open/merge the ${SUITE_REPO} development pin PR for ${repo} ${tag}, then rerun the same train command; do not recut the tag \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#suite-pin-pr`;
   let scratch = "";
   try {
     const get = JSON.parse(await deps.run("gh", ["api", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=development`]));
@@ -39836,7 +40014,7 @@ function withRateLimitRetry(client, seams = {}) {
   };
 }
 async function prCreateMergedHeadWarning(input, deps = {}) {
-  const guide = "docs/Guides/train-troubleshooting.md#merged-pr-head-reuse";
+  const guide = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#merged-pr-head-reuse";
   if (!input.head) {
     return `pr create: WARNING \u2014 could not check whether the current head branch already landed (the current branch could not be resolved); continuing with PR creation \u2014 ${guide}`;
   }
@@ -39861,6 +40039,11 @@ async function prCreateMergedHeadWarning(input, deps = {}) {
     return `pr create: WARNING \u2014 could not check whether head branch '${input.head}' already landed (${detail}); continuing with PR creation \u2014 ${guide}`;
   }
 }
+function isIssueMissingError(e) {
+  if (typeof e.status === "number") return e.status === 404;
+  const msg = e instanceof Error ? e.message : String(e);
+  return /HTTP 404|Not Found|\(404\)/i.test(msg);
+}
 async function prCreateClaimRefusal(body, repoOption, deps = {}) {
   const issues = [...new Set(findClosingMentions(body).map((mention) => mention.issue))];
   if (!issues.length) return void 0;
@@ -39871,7 +40054,14 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
   const requester = `requesting lane: ${actor.surface}/${actor.session}@${actor.host} (session id from ${source})`;
   const checkContest = deps.checkContest ?? checkLaneContest;
   for (const number of issues) {
-    const state = await client.rest("GET", `repos/${repo}/issues/${number}`).then((issue) => issue?.state, () => void 0);
+    let state;
+    try {
+      state = (await client.rest("GET", `repos/${repo}/issues/${number}`))?.state;
+    } catch (e) {
+      if (isIssueMissingError(e)) {
+        return `pr create: REFUSED \u2014 ${repo}#${number} does not exist \u2014 the PR body closes an issue that was never filed; file the issue first, or drop the closing line before creating this PR. There is no lane to claim, so claiming cannot create it; ${requester}`;
+      }
+    }
     if (state?.toLowerCase() === "closed") continue;
     const contest = await checkContest(client, { repository: repo, number }, actor);
     if (!contest.contested) continue;
@@ -43364,10 +43554,10 @@ async function announceSummaryRefusal(path2, isHub = false) {
   try {
     lines2 = summaryFileLines(await (0, import_promises8.readFile)(path2, "utf8"));
   } catch (e) {
-    return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see docs/Guides/train-troubleshooting.md#announce-summary-missing`;
+    return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
   }
   if (lines2.length < 3 || lines2.length > 6) {
-    return `release: --announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see docs/Guides/train-troubleshooting.md#announce-summary-missing`;
+    return `release: --announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
   }
   if (isHub) {
     const jerv = hubSummaryJervRefusal(lines2);
@@ -43786,7 +43976,7 @@ function registerTrainCommandsAndInventory(program3) {
 function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   async function pinSoloMember(repo, tag) {
     const read = await fetchProjectBySlugChecked(slugOf(repo), registryClientDeps(await loadConfig()));
-    if (!read.ok || !read.project) throw new Error(`suite pin PR FAILED: registry META unreadable for ${repo} (${read.ok ? "missing" : read.error}); rerun the same train command after restoring registry access \u2014 see docs/Guides/train-troubleshooting.md#suite-pin-pr`);
+    if (!read.ok || !read.project) throw new Error(`suite pin PR FAILED: registry META unreadable for ${repo} (${read.ok ? "missing" : read.error}); rerun the same train command after restoring registry access \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#suite-pin-pr`);
     if (!suiteMemberRefusal(repo, read.project, "release")) return void 0;
     const root = (await execFileP("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
     return openSuitePinPr({ root, run: async (file, args, cwd) => (await execFileP(file, args, { cwd, timeout: GIT_TIMEOUT_MS })).stdout }, { repo, tag, stage: "main" });
@@ -44031,7 +44221,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         if (announcesToChannel) {
           if (!o.announceSummaryFile) {
             return fail(
-              isHub ? "release: a new MMI-Hub release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same release command \u2014 see docs/Guides/train-troubleshooting.md#announce-summary-missing" : `release: ${slug} announces to its project release channel, so a new release requires --announce-summary-file <path> with 3-6 short plain-language lines in the project's releaseLanguage (${releaseLanguage2}); create the summary file, then rerun the same release command \u2014 see docs/Guides/train-troubleshooting.md#announce-summary-missing`
+              isHub ? "release: a new MMI-Hub release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing" : `release: ${slug} announces to its project release channel, so a new release requires --announce-summary-file <path> with 3-6 short plain-language lines in the project's releaseLanguage (${releaseLanguage2}); create the summary file, then rerun the same release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`
             );
           }
           const refusal = await announceSummaryRefusal(o.announceSummaryFile, isHub);
@@ -44214,7 +44404,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     if (o.suiteSolo !== o.ownerGo) return fail("hotfix start: solo suite hotfix requires BOTH --suite-solo --owner-go");
     return runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from, suiteSolo: o.suiteSolo, ack: o.ack ? o.ack.split(",").map((s) => s.trim()).filter(Boolean) : void 0 }), o, renderHotfixStart);
   });
-  hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--retry-deploy", "re-run only the failed deploy and/or fold-port alignment legs of a published hotfix of this same tag (#6985)").option("--suite-solo", "release one suite module alone (requires --owner-go)").option("--owner-go", "explicit owner approval for a solo backend hotfix").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => {
+  hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--ack <shas>", "accepted for flag symmetry with hotfix start; hotfix release proves every carry by ancestry, so it is ignored here, never an error (#7338)").option("--retry-deploy", "re-run only the failed deploy and/or fold-port alignment legs of a published hotfix of this same tag (#6985)").option("--suite-solo", "release one suite module alone (requires --owner-go)").option("--owner-go", "explicit owner approval for a solo backend hotfix").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => {
     if (o.suiteSolo !== o.ownerGo) return fail("hotfix release: solo suite release requires BOTH --suite-solo --owner-go");
     if (o.retryDeploy) {
       if (o.announceSummaryFile || o.carries) {
@@ -44223,7 +44413,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       return runHotfixSub("retry-deploy", () => runHotfixRetryDeploy(trainApplyDeps(), version), o, renderHotfixRetryDeploy);
     }
     return runHotfixSub("release", async () => {
-      const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [], suiteSolo: o.suiteSolo });
+      const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [], suiteSolo: o.suiteSolo, ...o.ack ? { ack: o.ack.split(",").map((s) => s.trim()).filter(Boolean) } : {} });
       const suitePin = o.suiteSolo ? await pinSoloMember(result.repo, result.tag) : void 0;
       const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
       return { ...result, projectInfoSync, ...o.suiteSolo ? { suiteSolo: true, suitePin } : {} };
@@ -44259,6 +44449,10 @@ async function exec(file, args, cwd, timeout = GH_TIMEOUT) {
 async function gh(args) {
   return exec("gh", args);
 }
+function rcRunCauseFromLog(log) {
+  const causes = [...new Set([...log.matchAll(/##\[error\](?!Process completed with exit code)([^\r\n]+)/g)].map((m) => m[1].trim()).filter(Boolean))];
+  return causes.length ? `: ${causes.join("; ")}` : "";
+}
 function suiteTrainIo(root, summaryFile) {
   const recordPath = repoRuntimeStatePath(root, "suite", "cut.json");
   const base = (0, import_node_path42.join)(repoRuntimeStatePath(root, "suite"), "checkouts");
@@ -44372,23 +44566,41 @@ function suiteTrainIo(root, summaryFile) {
       if (result.tag !== expected || result.deployStatus !== "success") throw new Error(`${repo}: release is not green at expected ${expected} (${result.tag}/${result.deployStatus})`);
     }
   });
-  const publish = async (repo, tag) => {
-    const title = `module-rc-publish ${repo} @ ${tag}`;
-    const rows = async () => JSON.parse(await gh(["run", "list", "--repo", "mutmutco/MMI-Hub", "--workflow", "module-rc-publish.yml", "--event", "workflow_dispatch", "--limit", "100", "--json", "databaseId,displayTitle,conclusion,status,createdAt"]));
-    const existing = (await rows()).filter((r) => r.displayTitle === title).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
-    if (existing[0]?.conclusion === "success") return;
-    if (existing[0]?.conclusion === "failure") throw new Error(`${repo}: prior module-rc-publish ${tag} failed; inspect the run and retry it explicitly before continuing`);
+  const rcRuns = async () => JSON.parse(await gh(["run", "list", "--repo", "mutmutco/MMI-Hub", "--workflow", "module-rc-publish.yml", "--event", "workflow_dispatch", "--limit", "100", "--json", "databaseId,displayTitle,conclusion,status,createdAt"]));
+  const watchRcRun = async (title, fields, reuse) => {
     const since = Date.now() - 1e4;
-    if (!existing.length) await gh(["workflow", "run", "module-rc-publish.yml", "--repo", "mutmutco/MMI-Hub", "--field", `repo=${repo}`, "--field", `tag=${tag}`]);
-    let candidate = existing[0];
+    if (!reuse) await gh(["workflow", "run", "module-rc-publish.yml", "--repo", "mutmutco/MMI-Hub", ...fields.flatMap((f) => ["--field", f])]);
+    let candidate = reuse;
     for (let i = 0; !candidate && i < 25; i++) {
       await new Promise((resolve7) => setTimeout(resolve7, 1e3));
-      candidate = (await rows()).find((r) => r.displayTitle === title && Date.parse(r.createdAt) >= since);
+      candidate = (await rcRuns()).find((r) => r.displayTitle === title && Date.parse(r.createdAt) >= since);
+    }
+    if (!candidate) throw new Error(`workflow dispatch outcome ambiguous for "${title}"; inspect Actions before retrying`);
+    try {
+      await exec("gh", ["run", "watch", String(candidate.databaseId), "--repo", "mutmutco/MMI-Hub", "--exit-status"], void 0, WATCH_TIMEOUT);
+    } catch {
     }
-    if (!candidate) throw new Error(`${repo}: workflow dispatch outcome ambiguous for ${tag}; inspect Actions before retrying`);
-    await exec("gh", ["run", "watch", String(candidate.databaseId), "--repo", "mutmutco/MMI-Hub", "--exit-status"], void 0, WATCH_TIMEOUT);
     const verdict = JSON.parse(await gh(["run", "view", String(candidate.databaseId), "--repo", "mutmutco/MMI-Hub", "--json", "conclusion"]));
-    if (verdict.conclusion !== "success") throw new Error(`${repo}: module rc publish run ${candidate.databaseId} not green`);
+    return { id: candidate.databaseId, conclusion: verdict.conclusion };
+  };
+  const publish = async (repo, tag) => {
+    const title = `module-rc-publish ${repo} @ ${tag}`;
+    const existing = (await rcRuns()).filter((r) => r.displayTitle === title).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+    if (existing[0]?.conclusion === "success") return;
+    if (existing[0]?.conclusion === "failure") throw new Error(`${repo}: prior module-rc-publish ${tag} failed; inspect the run and retry it explicitly before continuing`);
+    const run = await watchRcRun(title, [`repo=${repo}`, `tag=${tag}`], existing[0]);
+    if (run.conclusion !== "success") throw new Error(`${repo}: module rc publish run ${run.id} not green${await rcRunCause(run.id)}`);
+  };
+  const preflight2 = async (repo) => {
+    const run = await watchRcRun(`module-rc-preflight ${repo}`, [`repo=${repo}`, "preflight=true"], void 0);
+    if (run.conclusion !== "success") throw new Error(`rc serving preflight run ${run.id} failed${await rcRunCause(run.id)}`);
+  };
+  const rcRunCause = async (id) => {
+    try {
+      return rcRunCauseFromLog(await exec("gh", ["run", "view", String(id), "--repo", "mutmutco/MMI-Hub", "--log-failed"]));
+    } catch {
+      return "";
+    }
   };
   const registry2 = async () => {
     const file = await defaultGitHubClient().rest("GET", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=development`);
@@ -44422,6 +44634,7 @@ function suiteTrainIo(root, summaryFile) {
     },
     rcand: runRcand,
     publish,
+    preflight: preflight2,
     pin: (input) => openSuiteCutPinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, input),
     verifyLeadCut: async (sha) => {
       const current = await gh(["api", `repos/${SUITE_REPO}/git/ref/heads/development`, "--jq", ".object.sha"]);
@@ -44471,7 +44684,7 @@ function registerSuiteCommands(program3) {
       console.log(o.json ? JSON.stringify(result, null, 2) : [
         `suite rcand ${o.dryRun ? "dry-run" : "receipt"}:`,
         ...result.plan.map((line) => `  - ${line}`),
-        ...result.record?.members.map((m) => `  - ${m.repo}: ${m.tag} (${m.sha?.slice(0, 12)}) ${m.published ? "served" : "pending"}`) ?? [],
+        ...result.record?.members.map((m) => m.carried ? `  - ${m.repo}: carried (nothing new) at ${m.mainPin}` : `  - ${m.repo}: ${m.tag} (${m.sha?.slice(0, 12)}) ${m.published ? "served" : "pending"}`) ?? [],
         ...result.record ? [`  - pin PR ${result.record.pinPr}: merged; MM-Work ${result.record.leadRcTag}`] : []
       ].join("\n"));
     } catch (e) {
@@ -44494,7 +44707,7 @@ function registerSuiteCommands(program3) {
       }
       console.log(o.json ? JSON.stringify(result, null, 2) : [
         `suite release: ${result.leadRcTag} \u2192 main`,
-        ...result.members.map((m) => `  - ${m.repo}: ${m.tag} \u2192 main ${m.released ? "released" : "pending"}`),
+        ...result.members.map((m) => m.carried ? `  - ${m.repo}: carried, untouched` : `  - ${m.repo}: ${m.tag} \u2192 main ${m.released ? "released" : "pending"}`),
         `  - MM-Work: ${result.leadReleased ? "released" : "pending"}; announcement: ${result.announcement}`
       ].join("\n"));
     } catch (e) {
@@ -50484,7 +50697,7 @@ fullTrack.command("readiness <owner/repo>").description("aggregate branch topolo
   console.log(JSON.stringify(report, null, 2));
   if (!report.rcand.canApply) process.exitCode = 1;
 });
-project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli devops runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY row \u2014 project-admin may set only --no-env-file/--compose-profiles on their own existing dev/rc row; master may seed/change all coords and main; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").makeOptionMandatory().choices(["dev", "rc", "main"])).option("--ssh-host <host>", "the box address the deploy ssh-es into; omit to keep the stored value (required only for a NEW hetzner-ssh row \u2014 `mmi-cli devops runtime box list` finds it)").option("--ssh-user <user>", "ssh user; omit to leave the row unchanged (default root on a new row)").option("--port <port>", "loopback port the container binds / Caddy upstream (1..65535); omit to leave the row unchanged").addOption(new Option("--substrate <substrate>", "hetzner-ssh | s3-cloudfront; omit to leave the row unchanged").choices([...DEPLOY_SUBSTRATES])).option("--deploy-role-arn <arn>", "s3-cloudfront: the scoped OIDC deployer role tenant-deploy.yml assumes for this stage").option("--app-bucket <bucket>", "s3-cloudfront: the S3 bucket the built dist/ is synced into").option("--distribution-id <id>", "s3-cloudfront: the CloudFront distribution invalidated after the sync").option("--distribution-domain <domain>", "s3-cloudfront: the host the post-deploy security-header proof is measured against").option("--deploy-path <path>", "on-box per-stage release root; omit to leave the row unchanged (default /opt/mmi/<slug>/<stage> on a new row)").option("--service <name>", "systemd/compose service name; omit to leave the row unchanged (default the slug on a new row)").option("--domain <domain>", "canonical serving host; omit to leave the row unchanged").option("--alias <domain...>", "extra serving hostname the box Caddy answers (repeatable); omit to leave the stored aliases unchanged").option("--clear-aliases", "remove EVERY serving alias from the row (#2986) \u2014 omitting --alias preserves them, so clearing needs saying out loud").option("--no-env-file <bool>", "set the DEPLOY# fileless flag (true|false) \u2014 own-repo project-admin dev/rc; master main; true = env passthrough with no .env symlink").option("--compose-profiles <profiles>", "comma-separated compose profiles to enable for this stage (e.g. huddles,slack-bridge); omit to leave unchanged").option("--clear-compose-profiles", "remove EVERY compose profile from the row \u2014 omitting --compose-profiles preserves them, so clearing needs saying out loud").option("--force", "explicit recovery override: skip fileless-compose verification only after independent proof").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -50498,6 +50711,10 @@ project.command("set-deploy [owner/repo]").description("patch a tenant DEPLOY ro
     if (v !== "true" && v !== "false") return fail("org project set-deploy: --no-env-file must be true or false");
     noEnvFile = v === "true";
   }
+  let composeProfiles;
+  if (typeof o.composeProfiles === "string") {
+    composeProfiles = o.composeProfiles.split(",").map((p) => p.trim()).filter((p) => p.length > 0);
+  }
   if (noEnvFile !== void 0) {
     const branch = DEPLOY_STAGE_BRANCH[o.stage.trim().toLowerCase()];
     if (branch) {
@@ -50536,7 +50753,9 @@ ${filelessTransitionGuide(target, o.stage)}`
       distributionDomain: o.distributionDomain,
       aliases: o.alias,
       clearAliases: o.clearAliases,
-      noEnvFile
+      noEnvFile,
+      composeProfiles,
+      clearComposeProfiles: o.clearComposeProfiles
     });
     if (target.includes("/")) body.repo = target;
   } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.34",
+  "version": "4.5.36",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",