@mutmutco/cli 4.5.4 → 4.5.5

package/dist/main.cjs

@@ -4534,7 +4534,7 @@ function useColor() {
 var program = new Command();
 
 // src/command-composition.ts
-var import_node_fs49 = require("node:fs");
+var import_node_fs50 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 
@@ -5437,7 +5437,7 @@ function resolveVerbAliasShim(argv) {
 
 // src/command-composition.ts
 var import_node_os22 = require("node:os");
-var import_node_path47 = require("node:path");
+var import_node_path48 = require("node:path");
 
 // src/board-read.ts
 var import_node_fs13 = require("node:fs");
@@ -15998,10 +15998,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.4",
-    tag: "v4.5.4",
-    commit: "0993d5d2fa7b",
-    npm: "@mutmutco/cli@4.5.4"
+    version: "4.5.5",
+    tag: "v4.5.5",
+    commit: "696fa43d4d49",
+    npm: "@mutmutco/cli@4.5.5"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -16018,14 +16018,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.4"
+          v3Target: "v4.5.5"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.4 and redeploy the Hub Lambda from tag v4.5.4 (0993d5d2fa7b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.4 (@mutmutco/cli@4.5.4, tag commit 0993d5d2fa7b \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.5 and redeploy the Hub Lambda from tag v4.5.5 (696fa43d4d49); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.5 (@mutmutco/cli@4.5.5, tag commit 696fa43d4d49 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18939,37 +18939,65 @@ function isTerminalVercelState(state) {
 function str(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-async function readVercelDeployment(api, repo, target, environment) {
-  const query = target.sha ? `sha=${encodeURIComponent(target.sha)}` : `ref=${encodeURIComponent(target.ref ?? "")}`;
-  const listed = await api(`repos/${repo}/deployments?${query}&per_page=30`);
-  const rows = Array.isArray(listed) ? listed : [];
-  const prefix = environment.toLowerCase();
-  const hit = rows.find((d) => typeof d.id === "number" && (str(d.environment) ?? "").toLowerCase().startsWith(prefix));
-  if (!hit) return void 0;
-  const statuses = await api(`repos/${repo}/deployments/${hit.id}/statuses?per_page=1`);
-  const latest = Array.isArray(statuses) ? statuses[0] : void 0;
-  const state = str(latest?.state) ?? "none";
+function matchesTarget(environment, target) {
+  const production = environment.toLowerCase().startsWith("production");
+  return target === "production" ? production : !production;
+}
+async function readOne(api, repo, id) {
+  const statuses = await api(`repos/${repo}/deployments/${id}/statuses?per_page=10`);
+  const rows = Array.isArray(statuses) ? statuses : [];
+  const latest = rows.find((s) => str(s.state) !== "inactive") ?? rows[0];
+  const raw = str(latest?.state);
+  const state = raw === void 0 ? "none" : raw === "inactive" ? "success" : raw;
   const url = str(latest?.environment_url) ?? str(latest?.target_url);
+  const logUrl = str(latest?.log_url);
+  return { state, ...url ? { url } : {}, ...logUrl ? { logUrl } : {} };
+}
+var FAILED = /* @__PURE__ */ new Set(["failure", "error"]);
+async function readVercelDeployment(api, repo, sha, target, since) {
+  const listed = await api(`repos/${repo}/deployments?sha=${encodeURIComponent(sha)}&per_page=30`);
+  const rows = Array.isArray(listed) ? listed : [];
+  const newest = /* @__PURE__ */ new Map();
+  for (const d of rows) {
+    const env = str(d.environment) ?? "";
+    if (typeof d.id !== "number" || !matchesTarget(env, target) || newest.has(env)) continue;
+    const created = Date.parse(str(d.created_at) ?? "");
+    if (since !== void 0 && Number.isFinite(created) && created < since) continue;
+    newest.set(env, d.id);
+  }
+  if (newest.size === 0) return void 0;
+  const reads = await Promise.all([...newest].map(async ([env, id]) => ({ env, id, ...await readOne(api, repo, id) })));
+  const failed = reads.find((r) => FAILED.has(r.state));
+  const unfinished = reads.find((r) => !isTerminalVercelState(r.state));
+  const pick = failed ?? unfinished ?? reads[0];
   return {
-    id: hit.id,
-    environment: str(hit.environment) ?? environment,
-    sha: str(hit.sha) ?? target.sha ?? "",
-    ref: str(hit.ref) ?? target.ref ?? "",
-    state,
-    ...url ? { url } : {},
-    ...str(latest?.log_url) ? { logUrl: str(latest?.log_url) } : {}
+    id: pick.id,
+    environment: reads.map((r) => r.env).join(", "),
+    sha,
+    state: pick.state,
+    ...reads[0].url ? { url: reads[0].url } : {},
+    ...pick.logUrl ? { logUrl: pick.logUrl } : {}
   };
 }
 var VERCEL_WATCH_ATTEMPTS = 120;
 var VERCEL_WATCH_DELAY_MS = 1e4;
-async function watchVercelProduction(api, repo, sha, sleep2, onTick) {
+async function watchVercelDeployment(api, repo, sha, target, sleep2, onTick, since) {
   let last;
+  let readOnce = false;
+  let lastError;
   for (let attempt = 0; attempt < VERCEL_WATCH_ATTEMPTS; attempt++) {
     if (attempt > 0) await sleep2(VERCEL_WATCH_DELAY_MS);
-    last = await readVercelDeployment(api, repo, { sha }, "Production");
+    try {
+      last = await readVercelDeployment(api, repo, sha, target, since);
+      readOnce = true;
+    } catch (e) {
+      lastError = e;
+      continue;
+    }
     onTick?.(attempt, last);
     if (last && isTerminalVercelState(last.state)) return last;
   }
+  if (!readOnce) throw lastError;
   return last;
 }
 async function probeVercelUrl(url, fetchImpl = fetch) {
@@ -19420,34 +19448,28 @@ function prodReleaseTargets(model) {
 function trainObservesShipment(model) {
   return isCentralDispatchModel(model) || prodReleaseTargets(model).length > 0 || model === "vercel";
 }
-async function vercelDeployDispatch(deps, ctx, ref, watch, headSha) {
-  const note = "no dispatch: Vercel deploys main on push (Production) \u2014 observed via the Vercel GitHub app Deployment";
-  if (ref !== "main") return { note: "no dispatch on rc: a vercel repo is direct-track and has no rc stage", deployStatus: "pending" };
+async function vercelDeployDispatch(deps, ctx, ref, watch, headSha, since) {
+  const target = ref === "main" ? "production" : "preview";
+  const plane = target === "production" ? "Production" : `${ref} (non-Production)`;
+  const note = `no dispatch: Vercel deploys ${ref} on push (${plane}) \u2014 observed via the Vercel GitHub app Deployment`;
   if (!headSha) return { note, deployStatus: "pending" };
-  const api = async (path2) => JSON.parse(await deps.run("gh", ["api", path2]));
-  const row = (d, conclusion) => ({
-    workflow: "vercel",
-    conclusion,
-    ...d?.logUrl ? { runUrl: d.logUrl } : { runUrlNote: "no Vercel Deployment posted for this SHA yet" },
-    event: "push"
-  });
-  const verdict = (d) => d?.state === "success" ? "success" : d && isTerminalVercelState(d.state) ? "failure" : "pending";
+  const after = target === "preview" ? rcWindow(since) : void 0;
   let read;
   try {
     if (!watch) {
       deps.warn?.("Release: Checking Vercel deployment status");
-      read = await readVercelDeployment(api, ctx.repo, { sha: headSha }, "Production");
+      read = await readVercelDeployment(vercelApi(deps), ctx.repo, headSha, target, after);
     } else {
-      deps.warn?.("Release: Waiting for Vercel to deploy production");
-      read = await watchVercelProduction(api, ctx.repo, headSha, resolveSleep(deps), (attempt, d) => {
+      deps.warn?.(`Release: Waiting for Vercel to deploy ${ref}`);
+      read = await watchVercelDeployment(vercelApi(deps), ctx.repo, headSha, target, resolveSleep(deps), (attempt, d) => {
         if (attempt > 0 && attempt % 6 === 0) deps.warn?.(`Vercel deployment ${d ? d.state : "not posted yet"} \u2014 ${attempt / 6}m elapsed`);
-      });
+      }, after);
     }
   } catch (e) {
-    return { note: `${note}; the Deployment read FAILED (${describeReadError(e)}) \u2014 verify on Vercel; never re-tag`, workflowRuns: [row(void 0, "failure")], deployStatus: "failure" };
+    return { note: `${note}; the Deployment read FAILED (${describeReadError(e)}) \u2014 verify on Vercel; never re-tag`, workflowRuns: [vercelRow(void 0, "failure")], deployStatus: "failure" };
   }
-  let deployStatus = verdict(read);
-  let detail = read ? `Vercel Production deployment ${read.state}${read.url ? ` at ${read.url}` : ""}` : "no Vercel Deployment posted for this SHA (is the Vercel GitHub app connected?)";
+  let deployStatus = vercelVerdict(read);
+  let detail = read ? `Vercel ${plane} deployment ${read.state}${read.url ? ` at ${read.url}` : ""}` : "no Vercel Deployment posted for this SHA (is the Vercel GitHub app connected?)";
   if (watch && deployStatus === "success" && read?.url) {
     const probe = await (deps.probeUrl ?? probeVercelUrl)(read.url);
     if (probe.ok) detail = `${detail}; URL answered HTTP ${probe.status}`;
@@ -19456,7 +19478,27 @@ async function vercelDeployDispatch(deps, ctx, ref, watch, headSha) {
       detail = `${detail}; URL probe FAILED (${probe.error ?? `HTTP ${probe.status}`})`;
     }
   }
-  return { note: `${note}; ${detail}`, ...read?.logUrl ? { runUrl: read.logUrl } : {}, workflowRuns: [row(read, deployStatus)], deployStatus };
+  return { note: `${note}; ${detail}`, ...read?.logUrl ? { runUrl: read.logUrl } : {}, workflowRuns: [vercelRow(read, deployStatus)], deployStatus };
+}
+function vercelApi(deps) {
+  return async (path2) => JSON.parse(await deps.run("gh", ["api", path2]));
+}
+function vercelVerdict(d) {
+  return d?.state === "success" ? "success" : d && isTerminalVercelState(d.state) ? "failure" : "pending";
+}
+function vercelRow(d, conclusion) {
+  return { workflow: "vercel", conclusion, ...d?.logUrl ? { runUrl: d.logUrl } : { runUrlNote: "no Vercel Deployment posted for this SHA yet" }, event: "push" };
+}
+async function listVercelDeployRows(deps, repo, sha, ref = "main", since) {
+  const target = ref === "main" ? "production" : "preview";
+  const read = await readVercelDeployment(vercelApi(deps), repo, sha, target, target === "preview" ? rcWindow(since) : void 0);
+  if (!read) return [];
+  const verdict = vercelVerdict(read);
+  const probe = verdict === "success" && read.url ? await (deps.probeUrl ?? probeVercelUrl)(read.url) : void 0;
+  return [vercelRow(read, probe && !probe.ok ? "failure" : verdict)];
+}
+function rcWindow(since) {
+  return since === void 0 ? void 0 : since - 6e4;
 }
 function shipLegsGreen(deploy, publish) {
   const green = (leg) => leg?.superseded !== true && (leg?.state === "complete" || leg?.state === "skipped");
@@ -19638,7 +19680,7 @@ async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince,
       deployStatus: aggregateWorkflowRuns(workflowRuns)
     };
   }
-  if (model === "vercel") return vercelDeployDispatch(deps, ctx, ref, watch, autoRunHeadSha);
+  if (model === "vercel") return vercelDeployDispatch(deps, ctx, ref, watch, autoRunHeadSha, autoRunSince);
   return { note: `no manual dispatch: ${model} repo deploys via its own push-triggered workflow`, deployStatus: "pending" };
 }
 async function readEdgeDomains(deps, slug) {
@@ -21907,6 +21949,16 @@ function deployPhaseInput(model, dispatch, opts = {}) {
         ...runMetadata({ runId: dispatch.runId, runUrl: dispatch.runUrl, workflow: "tenant-deploy.yml", event: "workflow_dispatch" }, runRepo, "dispatch"),
         note: dispatch.note
       };
+    case "vercel": {
+      const row = (dispatch.workflowRuns ?? []).find((r) => r.workflow === "vercel");
+      return {
+        state: runRowState(row, dispatch.deployStatus),
+        ...sha ? { sha } : {},
+        workflow: "vercel",
+        ...row?.runUrl ? { runUrl: row.runUrl } : {},
+        note: dispatch.note
+      };
+    }
     default:
       return {
         state: dispatch.deployStatus === "success" ? "complete" : dispatch.deployStatus === "failure" ? "failed" : "pending",
@@ -21988,6 +22040,13 @@ function phaseInputsFromRunRows(model, rows, tagSha, opts = {}) {
           note: `${publishRun.workflow} run on the release SHA`
         } : { state: "pending", sha: tagSha, note: "publish.yml release run not yet correlated" }
       };
+    case "vercel": {
+      const vercelRow2 = rows.find((r) => r.workflow === "vercel");
+      return {
+        deploy: vercelRow2 ? { state: runRowState(vercelRow2, "pending"), sha: tagSha, workflow: "vercel", ...vercelRow2.runUrl ? { runUrl: vercelRow2.runUrl } : {}, note: "Vercel GitHub app Deployment on the release SHA" } : { state: "pending", sha: tagSha, note: "no Vercel Deployment posted for the release SHA yet (is the Vercel GitHub app connected?)" },
+        publish: { state: "skipped", sha: tagSha, note: "vercel has no publish leg" }
+      };
+    }
     default:
       return {
         deploy: { state: "pending", sha: tagSha, note: `${model} deploys outside the release SHA's run set \u2014 historical outcome uncorrelatable` },
@@ -22194,6 +22253,17 @@ function hotfixRetryDeployShape(ledger) {
   if (!open2.every((phase) => RETRY_DEPLOY_LEGS.has(phase))) return false;
   return open2.some((phase) => ledger.phases[phase].state === "failed");
 }
+function rcandRetryDeployShape(ledger) {
+  if (ledger.lane !== "rcand") return false;
+  if (ledger.phases.promotion.state !== "complete") return false;
+  const deploy = ledger.phases.deploy;
+  if (deploy.state !== "failed" || deploy.superseded === true || deploy.workflow !== "tenant-deploy.yml") return false;
+  return RELEASE_LEDGER_PHASES.every((phase) => {
+    if (phase === "deploy") return true;
+    const state = ledger.phases[phase].state;
+    return state === "complete" || state === "skipped";
+  });
+}
 function ledgerFailedRemedy(ledger) {
   const derived = deriveReleasePhaseStatus(ledger);
   const openLegs = derived.legs.filter((l) => l.state === "pending" || l.state === "failed");
@@ -22202,6 +22272,9 @@ function ledgerFailedRemedy(ledger) {
     const failed = openLegs.filter((l) => l.state === "failed").map((l) => l.phase);
     return `the published ${ledger.tag} hotfix can retry the failed ${joinLegNames(failed)} of the same tag: \`mmi-cli devops hotfix release ${ledger.tag} --retry-deploy\` (the deploy helper is idempotent; alignment re-attempts the fold-port PR) (#6985)${tails}`;
   }
+  if (rcandRetryDeployShape(ledger)) {
+    return `fix the rc deploy failure, then retry the failed deploy of the promoted ${ledger.tag} candidate (same tag and SHA, never re-cut): \`mmi-cli devops rcand --retry-deploy --watch\` (#7053)${tails}`;
+  }
   const deployOnlyDeadlock = openLegs.length > 0 && openLegs.every((l) => l.phase === "deploy" && supersedeableDeployLegShape(l));
   const supersession = deployOnlyDeadlock ? `; when the deploy failure is content-caused on the already-published ${ledger.tag} (the immutable tag can never deploy green), the sanctioned exit is \`mmi-cli devops release --supersede-deploy --apply\` after explicit master approval \u2014 the next patch train carries the cause fix (#6553)` : "";
   return `diagnose the failed leg, then ${ledgerLaneResumeCommand(ledger)} once its cause is fixed (an abort only with fresh approval)${supersession}${tails}`;
@@ -22251,6 +22324,10 @@ async function healStaleAlignmentLeg(deps, cwd, expected) {
     return prior.tag;
   });
 }
+function rcPromotedAt(ledger) {
+  const at = Date.parse(ledger.phases.promotion.updatedAt);
+  return Number.isFinite(at) ? at : void 0;
+}
 async function healUnfoldedRunLegs(deps, cwd, model) {
   const path2 = releaseLedgerPath(cwd);
   let prior;
@@ -22282,15 +22359,16 @@ async function healUnfoldedRunLegs(deps, cwd, model) {
   }
   const targets = prodReleaseTargets(model);
   const runless = legs.filter((phase) => openLeg(current.phases[phase]) && current.phases[phase].runId == null);
-  if (runless.length > 0 && targets.length > 0) {
+  if (runless.length > 0 && (targets.length > 0 || model === "vercel")) {
     let rows;
     try {
-      rows = await listOwnWorkflowRuns(deps, releaseRunRepoFor(model, prior.repo), targets, prior.tagSha);
+      rows = model === "vercel" ? await listVercelDeployRows(deps, prior.repo, prior.tagSha, prior.lane === "rcand" ? "rc" : "main", rcPromotedAt(prior)) : await listOwnWorkflowRuns(deps, releaseRunRepoFor(model, prior.repo), targets, prior.tagSha);
     } catch {
       rows = [];
     }
     const inputs = phaseInputsFromRunRows(model, rows, prior.tagSha, { repo: prior.repo });
-    const foldable = runless.filter((phase) => inputs[phase].runId != null && inputs[phase].state !== "pending");
+    const correlated = (entry) => entry.runId != null || entry.workflow === "vercel";
+    const foldable = runless.filter((phase) => correlated(inputs[phase]) && inputs[phase].state !== "pending");
     if (foldable.length > 0) {
       const written = await withReleaseLedger(path2, anchors, (ledger) => {
         if (!ledger) return { value: [] };
@@ -23188,6 +23266,13 @@ async function runTrainDoctor(input) {
       unverified(`required status checks on ${stage}`, e);
     }
   }
+  if (meta?.deployModel === "vercel") {
+    const tip = await git3(["rev-parse", "--verify", "--quiet", "refs/remotes/origin/main"]).catch(() => "");
+    const rows = tip ? await listVercelDeployRows(train, repo, tip).catch(() => void 0) : void 0;
+    if (rows && !rows.length) {
+      add({ code: "vercel-unobserved", severity: "warning", source: "origin", title: `no Vercel Production Deployment on origin/main@${tip.slice(0, 12)} \u2014 the Vercel GitHub app or the git-connected Vercel project may be missing`, remedy: `connect ${repo} to its Vercel project (production branch main) and enable the Vercel GitHub app for the repo; the train reads the app's Deployments, never a Vercel token` });
+    }
+  }
   let ledgerTag;
   let ledgerPath;
   try {
@@ -24152,10 +24237,15 @@ async function recoverFailedDispatchPhase(deps, ledger, anchors, phase, dispatch
     note: notes.length > 0 ? `${dispatch.note}; ${notes.join("; ")}` : dispatch.note
   };
 }
+var RCAND_RETRY_DEPLOY_COMMAND = "mmi-cli devops rcand --retry-deploy --watch";
+function rcPushedAt(ledger) {
+  const at = Date.parse(ledger?.phases.promotion.updatedAt ?? "");
+  return Number.isFinite(at) ? at : void 0;
+}
 async function recordRcandDeployLegs(ledger, deps, anchors, deployModel, d, opts = {}) {
   const sha = anchors.tagSha;
   const landed = "the immutable rc tag, the green wall, origin/rc, and the rc deploy dispatch";
-  const dispatch = await recoverFailedDispatchPhase(
+  const recovered = await recoverFailedDispatchPhase(
     deps,
     ledger,
     anchors,
@@ -24168,6 +24258,7 @@ async function recordRcandDeployLegs(ledger, deps, anchors, deployModel, d, opts
       workflow: isCentralDispatchModel(deployModel) ? "tenant-deploy.yml" : "rc deploy workflow"
     }
   );
+  const dispatch = recovered.deployStatus === "failure" && !recovered.note.includes(RCAND_RETRY_DEPLOY_COMMAND) ? { ...recovered, note: `once the cause is fixed, retry this rc deploy with \`${RCAND_RETRY_DEPLOY_COMMAND}\` (same tag and SHA, never re-cut): ${recovered.note}` } : recovered;
   const unverifiable = !isCentralDispatchModel(deployModel) && dispatch.deployStatus === "pending" && dispatch.runId == null && !dispatch.workflowRuns?.length;
   const deployEntry = unverifiable ? { state: "skipped", sha, note: `${dispatch.note} \u2014 no run to verify on rc; recorded skipped, never pending (#6068)` } : deployPhaseInput(deployModel, dispatch, { releaseSha: sha });
   await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(deployEntry), { ...opts, landed: "the immutable rc tag, the green wall, and origin/rc" });
@@ -24176,7 +24267,7 @@ async function recordRcandDeployLegs(ledger, deps, anchors, deployModel, d, opts
   return dispatch;
 }
 function releaseAnnounceDeferral(model, summaryFile) {
-  return prodReleaseTargets(model).length > 0 ? `\`mmi-cli devops release --resume --watch${summaryFile ? ` --announce-summary-file ${summaryFile}` : ""}\` announces it once they are green` : "a central deploy is proven only under --watch, so this release stays unannounced";
+  return prodReleaseTargets(model).length > 0 || model === "vercel" ? `\`mmi-cli devops release --resume --watch${summaryFile ? ` --announce-summary-file ${summaryFile}` : ""}\` announces it once they are green` : "a central deploy is proven only under --watch, so this release stays unannounced";
 }
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe, branchHints, ledger, alignEarly) {
   const resumeCommand = options.dev ? "mmi-cli devops release --dev --apply" : "mmi-cli devops release --apply";
@@ -24463,7 +24554,8 @@ Nothing was written. Inspect ${ledger.path} before retrying.`);
       const terminal = deployLeg.state === "complete" || deployLeg.state === "skipped";
       const legStatus = deployLeg.state === "failed" ? "failure" : terminal ? "success" : "pending";
       const hasDispatchEvidence = deployLeg.runId != null || deployLeg.workflow != null || deployLeg.updatedAt !== "never";
-      const dispatch02 = terminal || hasDispatchEvidence ? {
+      const vercelReread = deployModel === "vercel" && !terminal;
+      const dispatch02 = (terminal || hasDispatchEvidence) && !vercelReread ? {
         note: deployLeg.note ?? deployLeg.error ?? `persisted rc deploy leg is ${deployLeg.state}`,
         deployStatus: legStatus,
         ...deployLeg.runId != null ? { runId: deployLeg.runId } : {},
@@ -24475,7 +24567,7 @@ Nothing was written. Inspect ${ledger.path} before retrying.`);
           ...deployLeg.event ? { event: deployLeg.event } : {},
           conclusion: legStatus
         }] } : {}
-      } : await dispatchDeploy(deps, ctx, "rc", "rc", deployModel, watch, (deps.now ?? Date.now)(), tagSha);
+      } : await dispatchDeploy(deps, ctx, "rc", "rc", deployModel, watch, vercelReread ? rcPushedAt(persisted) : (deps.now ?? Date.now)(), tagSha, "report");
       const dispatch2 = terminal ? dispatch02 : await recordRcandDeployLegs(ledger, deps, anchors, deployModel, dispatch02, { strict: true });
       const ledgerReport2 = releaseLedgerReport(await ledger.load(anchors).catch(() => void 0), ledger.path);
       return {
@@ -24541,10 +24633,11 @@ ${spent.note}`);
   }
   await recordPhase(ledger, deps, anchors, "ordinaryCi", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified the required-check wall live on this resume" }), { strict, landed: "the immutable rc tag on origin at the resumed SHA" });
   const autoRunSince = (deps.now ?? Date.now)();
+  deps.warn?.("Release: Promoting the verified release candidate");
   await runGitPush(deps, ["push", "origin", `${tagSha}:refs/heads/rc`]);
   await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/rc (tag preserved, never re-cut)` }), { strict, landed: "the immutable rc tag and the re-proven required-check wall" });
   await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "skipped", sha: tagSha, note: "rcand mints no GitHub Release \u2014 the rc tag is the candidate" }), { strict, landed: "the immutable rc tag, the green wall, and origin/rc" });
-  const dispatch0 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel, watch, autoRunSince, tagSha);
+  const dispatch0 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel, watch, autoRunSince, tagSha, "report");
   const dispatch = await recordRcandDeployLegs(ledger, deps, anchors, deployModel, dispatch0, { strict });
   const ledgerReport = releaseLedgerReport(await ledger.load(anchors).catch(() => void 0), ledger.path);
   return {
@@ -24566,6 +24659,64 @@ ${spent.note}`);
     note: `reused immutable ${tag}; pushed its exact SHA to rc and dispatched the rc deploy`
   };
 }
+async function runRcandRetryDeploy(deps, options = {}) {
+  return withTrainWriter(deps, "rcand --retry-deploy", () => runRcandRetryDeployLocked(deps, options));
+}
+async function runRcandRetryDeployLocked(deps, options) {
+  const label = "rcand --retry-deploy";
+  const ctx = await buildTrainApplyContext(deps);
+  await requireCleanTree(deps);
+  await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
+  const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+  const deployModel = await preflight(deps, ctx, "rc", meta);
+  if (!isCentralDispatchModel(deployModel)) {
+    throw new Error(`${label}: the ${deployModel} rc deploy is the repo's own push-triggered workflow, not a dispatch \u2014 rerun that failed run (gh run rerun <run-id> --failed), then mmi-cli devops rcand --resume re-verifies it; nothing was written`);
+  }
+  const candidate = await activeRcandLedgerCandidate(deps, process.cwd());
+  if (!candidate) {
+    throw new Error(`${label}: no active rcand ledger whose rc tag is live on origin at its recorded SHA \u2014 there is no promoted candidate deploy to retry; nothing was written`);
+  }
+  const { tag, sha: tagSha } = candidate;
+  const ledger = openReleaseLedgerWriter(process.cwd());
+  const anchors = { repo: ctx.repo, tag, tagSha };
+  let persisted;
+  try {
+    persisted = (await reverifyPersistedRunPhases(deps, ledger.path, anchors, { sha: tagSha, repo: ctx.repo })).ledger;
+  } catch (e) {
+    throw new Error(`${label}: ${e instanceof Error ? e.message : String(e)}
+Nothing was written. Inspect ${ledger.path} before retrying.`);
+  }
+  if (!persisted || !rcandRetryDeployShape(persisted)) {
+    const open2 = persisted ? deriveReleasePhaseStatus(persisted).legs.filter((l) => l.state === "pending" || l.state === "failed") : [];
+    throw new Error(
+      `${label}: the ${tag} ledger has no failed rc deploy to retry on a promoted candidate (${open2.map((l) => `${l.phase}=${l.state}`).join(", ") || "phases-green"}) \u2014 finish an incomplete candidate with mmi-cli devops rcand --resume; nothing was written`
+    );
+  }
+  if (!await probeAncestor(deps, tagSha, "origin/rc", `${label}: origin/rc ancestry`)) {
+    throw new Error(`${label}: origin/rc does not contain ${tag} (${tagSha.slice(0, 12)}) \u2014 the candidate is not promoted; nothing was written`);
+  }
+  const d0 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel, options.watch ?? false, (deps.now ?? Date.now)(), tagSha, "report");
+  const dispatch = await recordRcandDeployLegs(ledger, deps, anchors, deployModel, d0, { strict: true });
+  const ledgerReport = releaseLedgerReport(await ledger.load(anchors).catch(() => void 0), ledger.path);
+  return {
+    ...ctx,
+    command: "rcand-retry-deploy",
+    stage: "rc",
+    ref: "rc",
+    tag,
+    tagSha,
+    deployModel,
+    promoted: true,
+    checks: persisted.phases.ordinaryCi.note ?? "required-check wall was completed before origin/rc promotion",
+    dispatch: dispatch.note,
+    runId: dispatch.runId,
+    runUrl: dispatch.runUrl,
+    workflowRuns: dispatch.workflowRuns,
+    deployStatus: dispatch.deployStatus,
+    ...ledgerReport ? { ledger: ledgerReport } : {},
+    note: `re-dispatched the failed rc deploy of immutable ${tag} at ${tagSha.slice(0, 12)}; nothing re-cut, re-tagged or re-pushed`
+  };
+}
 async function runReleaseResumePipeline(deps, options, prepared) {
   const watch = options.watch ?? false;
   const { ctx, meta, branchHints, directTrack, deployModel } = prepared;
@@ -24629,8 +24780,9 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
     deps.warn?.("Release: Checking deployment and publishing progress");
     const historicalTargets = prodReleaseTargets(deployModel);
     const historicalRepo = releaseRunRepoFor(deployModel, ctx.repo);
-    let historicalRows = historicalTargets.length ? await listOwnWorkflowRuns(deps, historicalRepo, historicalTargets, tagSha) : [];
-    let historicalDeploy = historicalTargets.length ? aggregateWorkflowRuns(historicalRows) : "pending";
+    const vercel = deployModel === "vercel";
+    let historicalRows = vercel ? await listVercelDeployRows(deps, ctx.repo, tagSha).catch(() => []) : historicalTargets.length ? await listOwnWorkflowRuns(deps, historicalRepo, historicalTargets, tagSha) : [];
+    let historicalDeploy = historicalTargets.length || vercel && historicalRows.length ? aggregateWorkflowRuns(historicalRows) : "pending";
     let historicalNote = `historical ${deployModel} deploy/publish status: ${historicalDeploy}`;
     if (historicalDeploy === "failure") {
       const recovered = await recoverFailedDispatchPhase(
@@ -24642,7 +24794,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
         { repo: historicalRepo, sha: tagSha, watched: false, workflow: "historical release workflow" }
       );
       historicalRows = recovered.workflowRuns ?? historicalRows;
-      historicalDeploy = historicalTargets.length ? aggregateWorkflowRuns(historicalRows) : recovered.deployStatus;
+      historicalDeploy = historicalTargets.length || vercel && historicalRows.length ? aggregateWorkflowRuns(historicalRows) : recovered.deployStatus;
       historicalNote = recovered.note;
     }
     const dispatch2 = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, {
@@ -24680,7 +24832,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
     Object.assign(dispatch2, shippedDispatch);
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
     const settledBySupersede = persisted?.phases.deploy.superseded === true || persisted?.phases.publish.superseded === true;
-    const announceNote2 = persisted && !shippedBefore && !settledBySupersede && (prodReleaseTargets(deployModel).length > 0 || companion !== null) ? await announceShippedRelease(
+    const announceNote2 = persisted && !shippedBefore && !settledBySupersede && (prodReleaseTargets(deployModel).length > 0 || deployModel === "vercel" || companion !== null) ? await announceShippedRelease(
       deps,
       { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
       deployModel,
@@ -25128,6 +25280,7 @@ async function runTrainApplyPipeline(mode, input) {
         if (!start.ok) throw new Error(`rcand refused before the rc tag was pushed: the durable phase ledger could not be started at ${ledger.path} (${start.error}) - nothing was tagged or pushed (#5987/#6068)`);
         ledgerAnchors2 = anchors2;
       }
+      deps.warn?.("Release: Publishing the release candidate tag");
       tagPush = await ensureTagPushed(deps, tag2, rcSha);
     } catch (e) {
       if (ledger && ledgerAnchors2) {
@@ -25164,6 +25317,7 @@ ${spent.note}`), rcandRecovery(tag2));
     }
     await recordPhase(ledger, deps, anchors, "ordinaryCi", phaseEntry({ state: "complete", sha: rcSha, note: checks2 }), { landed: "the immutable rc tag pushed at " + rcSha.slice(0, 12) });
     const autoRunSince = (deps.now ?? Date.now)();
+    deps.warn?.("Release: Promoting the verified release candidate");
     try {
       await runGitPush(deps, ["push", "origin", "rc"]);
     } catch (e) {
@@ -25172,7 +25326,7 @@ ${spent.note}`), rcandRecovery(tag2));
     }
     await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: rcSha, note: `immutable ${tag2} pushed at ${rcSha.slice(0, 12)}; origin/rc fast-forwarded to it` }), { landed: "the immutable rc tag and the green required-check wall" });
     await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "skipped", sha: rcSha, note: "rcand mints no GitHub Release \u2014 the rc tag is the candidate" }), { landed: "the immutable rc tag, the green wall, and origin/rc" });
-    const d0 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha);
+    const d0 = await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha, "report");
     const d2 = await recordRcandDeployLegs(ledger, deps, anchors, deployModel2, d0);
     const rcLedgerReport = releaseLedgerReport(await ledger?.load(anchors).catch(() => void 0), ledger?.path ?? "(no ledger)");
     return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, bumpIntent, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus, ...rcLedgerReport ? { ledger: rcLedgerReport } : {} };
@@ -25462,7 +25616,7 @@ async function runTrainApplyLocked(command, deps, options = {}) {
     if (directTrack) {
       throw new Error("direct-track repos release straight to main (no rc); run `mmi-cli devops release --apply` from development instead of rcand");
     }
-    return runTrainApplyPipeline("rcand", pipelineInput);
+    return withCheckoutRestoredAfterRelease(deps, await runTrainApplyPipeline("rcand", pipelineInput), "development");
   }
   if (directTrack) {
     return withCheckoutRestoredAfterRelease(
@@ -38194,8 +38348,9 @@ function registerStageCommands(program3) {
     const branch = await gitOut(["rev-parse", "--abbrev-ref", "HEAD"]);
     const repo = Array.isArray(project2.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : await repoSlug();
     try {
+      const sha = await gitOut(["rev-parse", `origin/${branch}`]).catch(() => gitOut(["rev-parse", "HEAD"]));
       const gh = defaultGitHubClient();
-      const deployment = await readVercelDeployment((path2) => gh.rest("GET", path2), repo, { ref: branch }, "Preview");
+      const deployment = await readVercelDeployment((path2) => gh.rest("GET", path2), repo, sha, "preview");
       return { branch, ...deployment ? { deployment } : {} };
     } catch (e) {
       return { branch, error: e.message };
@@ -38636,7 +38791,7 @@ function renderVerifySecrets(body) {
 
 // src/command-register-collaboration.ts
 var import_node_child_process15 = require("node:child_process");
-var import_node_fs42 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
@@ -38660,7 +38815,7 @@ function spawnDetachedSelf(args, deps, opts = {}) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_path40 = require("node:path");
+var import_node_path41 = require("node:path");
 
 // src/attach-to-project.ts
 async function attachViaHubApp(cfg, contentNodeId) {
@@ -39744,9 +39899,9 @@ function changedFilesSince(base, cwd) {
   const raw = git2(["diff", "--name-status", "-M", base, "--"], cwd).trim();
   const changed = raw ? raw.split("\n").map((line) => {
     const parts = line.split("	");
-    const norm = (p) => p.replace(/\\/g, "/");
-    const row = { status: parts[0][0], path: norm(parts[parts.length - 1]) };
-    if (parts.length > 2) row.from = norm(parts[1]);
+    const norm2 = (p) => p.replace(/\\/g, "/");
+    const row = { status: parts[0][0], path: norm2(parts[parts.length - 1]) };
+    if (parts.length > 2) row.from = norm2(parts[1]);
     return row;
   }) : [];
   const untracked = git2(["ls-files", "--others", "--exclude-standard", "-z"], cwd).split("\0").filter(Boolean).map((path2) => ({ status: "A", path: path2.replace(/\\/g, "/") }));
@@ -40809,6 +40964,10 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
   return void 0;
 }
 
+// src/worktree-residue-sweep.ts
+var import_node_fs42 = require("node:fs");
+var import_node_path40 = require("node:path");
+
 // src/worktree-merge-cleanup.ts
 var import_node_fs41 = require("node:fs");
 var import_node_path39 = require("node:path");
@@ -41654,6 +41813,122 @@ function renderPrMergeCleanupLines(cleanup) {
   return lines2;
 }
 
+// src/worktree-residue-sweep.ts
+var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
+function norm(p) {
+  const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
+  return process.platform === "win32" ? s.toLowerCase() : s;
+}
+function residueLedgerPath(gitCommonDir) {
+  return (0, import_node_path40.join)(gitCommonDir, RESIDUE_LEDGER_FILE);
+}
+function readPaths(file, deps) {
+  try {
+    const parsed = JSON.parse((deps.readLedger ?? ((f) => (0, import_node_fs42.readFileSync)(f, "utf8")))(file));
+    return Array.isArray(parsed) ? parsed.filter((p) => typeof p === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function writePaths(file, paths, deps) {
+  try {
+    const write = deps.writeLedger ?? ((f, t) => {
+      (0, import_node_fs42.mkdirSync)((0, import_node_path40.dirname)(f), { recursive: true });
+      (0, import_node_fs42.writeFileSync)(f, t, "utf8");
+    });
+    write(file, `${JSON.stringify([...new Set(paths)], null, 1)}
+`);
+  } catch {
+  }
+}
+function recordResidue(gitCommonDir, path2, deps = {}) {
+  const file = residueLedgerPath(gitCommonDir);
+  const paths = readPaths(file, deps);
+  if (!paths.some((p) => norm(p) === norm(path2))) paths.push(path2);
+  writePaths(file, paths, deps);
+}
+async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
+  const exists = deps.exists ?? import_node_fs42.existsSync;
+  const readDir = deps.readDir ?? ((p) => (0, import_node_fs42.readdirSync)(p));
+  const isDir = deps.isDir ?? ((p) => {
+    try {
+      return (0, import_node_fs42.statSync)(p).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+  const removeRecorded = deps.removeRecorded ?? ((p) => removeResidueDirectory(p));
+  const removeEmpty = deps.removeEmpty ?? ((p) => (0, import_node_fs42.rmdirSync)(p));
+  const report = { swept: [], kept: [], dropped: [], emptyRemoved: [], unrecorded: [] };
+  const live = new Set(registered.map(norm));
+  const primary = registered[0] ? norm(registered[0]) : void 0;
+  const file = residueLedgerPath(gitCommonDir);
+  const recorded = readPaths(file, deps);
+  const remaining = [];
+  for (const path2 of recorded) {
+    const key = norm(path2);
+    if (live.has(key) || key === primary) {
+      report.dropped.push(path2);
+      continue;
+    }
+    if (!exists(path2)) {
+      report.dropped.push(path2);
+      continue;
+    }
+    const removed = await removeRecorded(path2);
+    if (removed.ok && !exists(path2)) report.swept.push(path2);
+    else {
+      report.kept.push({ path: path2, error: removed.ok ? "directory remains" : removed.error });
+      remaining.push(path2);
+    }
+  }
+  if (recorded.length) writePaths(file, remaining, deps);
+  const roots = /* @__PURE__ */ new Set();
+  for (const p of [...registered.slice(1), ...recorded]) roots.add((0, import_node_path40.dirname)(p));
+  const keptKeys = new Set(remaining.map(norm));
+  for (const root of roots) {
+    if (!isDir(root) || live.has(norm(root)) || norm(root) === primary) continue;
+    let children;
+    try {
+      children = readDir(root);
+    } catch {
+      continue;
+    }
+    for (const name of children) {
+      const child2 = (0, import_node_path40.join)(root, name);
+      const key = norm(child2);
+      if (live.has(key) || key === primary || keptKeys.has(key) || !isDir(child2)) continue;
+      let entries;
+      try {
+        entries = readDir(child2);
+      } catch {
+        continue;
+      }
+      if (entries.length === 0) {
+        try {
+          removeEmpty(child2);
+          report.emptyRemoved.push(child2);
+        } catch {
+        }
+      } else {
+        report.unrecorded.push(child2);
+      }
+    }
+  }
+  return report;
+}
+function renderResidueSweepLines(report) {
+  if (!report) return [];
+  const lines2 = [];
+  const cleaned = report.swept.length + report.emptyRemoved.length;
+  if (cleaned) lines2.push(`pr merge: removed ${cleaned} leftover worktree folder(s) from earlier merges`);
+  for (const k of report.kept) lines2.push(`pr merge: leftover folder still locked, retried on the next merge \u2014 ${k.path}`);
+  if (report.unrecorded.length) {
+    lines2.push(`pr merge: ${report.unrecorded.length} unregistered folder(s) with content under the worktree root were left untouched (not recorded by a merge): ${report.unrecorded.join(", ")}`);
+  }
+  return lines2;
+}
+
 // src/pr-deploy-dev.ts
 function slugOfRepo(repo) {
   return repo.split("/")[1]?.toLowerCase() ?? "";
@@ -41688,10 +41963,10 @@ function argvWantsJson2() {
   return process.argv.some((a) => a === "--json" || a.startsWith("--json="));
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path40.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path41.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs42.existsSync)((0, import_node_path40.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs42.existsSync)((0, import_node_path40.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs43.existsSync)((0, import_node_path41.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs43.existsSync)((0, import_node_path41.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 function ciAuditDeps() {
@@ -41703,8 +41978,8 @@ function ciAuditDeps() {
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path40.join)(root, path2);
-      return (0, import_node_fs42.existsSync)(fullPath) ? (0, import_node_fs42.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path41.join)(root, path2);
+      return (0, import_node_fs43.existsSync)(fullPath) ? (0, import_node_fs43.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
@@ -42429,11 +42704,11 @@ ${list}`);
     }
   });
   async function listCiWorkflowPaths(cwd = process.cwd()) {
-    const wfDir = (0, import_node_path40.join)(cwd, ".github", "workflows");
-    if (!(0, import_node_fs42.existsSync)(wfDir)) return [];
-    return (0, import_node_fs42.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+    const wfDir = (0, import_node_path41.join)(cwd, ".github", "workflows");
+    if (!(0, import_node_fs43.existsSync)(wfDir)) return [];
+    return (0, import_node_fs43.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
       try {
-        return workflowReportsPrChecks((0, import_node_fs42.readFileSync)((0, import_node_path40.join)(wfDir, name), "utf8"));
+        return workflowReportsPrChecks((0, import_node_fs43.readFileSync)((0, import_node_path41.join)(wfDir, name), "utf8"));
       } catch {
         return true;
       }
@@ -42629,7 +42904,7 @@ ${list}`);
   jsonParity(pr.command("review-verdict <number>").description("post an explicit review verdict comment: computes the PR diff patch-id and head sha, renders the v1 contract body, and posts it as a PR comment").requiredOption("--repo <owner/repo>", "target repo").requiredOption("--verdict <verdict>", `one of ${REVIEW_VERDICTS.join("|")}`).requiredOption("--scope <text>", "one line: what was reviewed").requiredOption("--risk <text>", "one line: the residual risk").option("--unverified <text>", "a claim the reviewer could not verify (repeatable)", (v, acc) => [...acc, v], []).requiredOption("--reviewer <id>", "reviewer seat or model id").option("--findings-file <path>", "Markdown findings appended after the JSON block")).action(async (number, o) => {
     if (!isReviewVerdict(o.verdict)) return fail(`pr review-verdict: --verdict must be one of ${REVIEW_VERDICTS.join("|")} (got ${o.verdict})`);
     const verdict = o.verdict;
-    const findings = o.findingsFile ? (0, import_node_fs42.readFileSync)(o.findingsFile, "utf8") : void 0;
+    const findings = o.findingsFile ? (0, import_node_fs43.readFileSync)(o.findingsFile, "utf8") : void 0;
     let patch;
     let head;
     try {
@@ -42903,7 +43178,7 @@ ${list}`);
     const mergeSquashBody = squashBodyTextForMerge(
       closingGuardInput,
       method === "--squash",
-      o.squashBodyFile ? (0, import_node_fs42.readFileSync)(o.squashBodyFile, "utf8") : void 0
+      o.squashBodyFile ? (0, import_node_fs43.readFileSync)(o.squashBodyFile, "utf8") : void 0
     );
     if (!o.squashBodyFile) warnSquashBodyClosingStrip("pr merge", closingGuardInput, mergeSquashBody);
     const closingGuardVerdict = evaluateClosingGuard(closingGuardInput, {
@@ -42935,7 +43210,7 @@ ${list}`);
     const remote = foreignCwd ? `https://github.com/${targetRepo2}.git` : "origin";
     let foreignCheckout;
     if (foreignCwd) {
-      const sibling = (0, import_node_path40.join)((0, import_node_path40.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
+      const sibling = (0, import_node_path41.join)((0, import_node_path41.dirname)(beforeWorktrees[0]?.path || startingPath || process.cwd()), targetRepo2.split("/")[1]);
       const siblingRepo = repoFromRemoteUrl(await gitOut(["-C", sibling, "remote", "get-url", "origin"]).catch(() => ""));
       if (siblingRepo?.toLowerCase() === targetRepo2.toLowerCase()) {
         const siblingWorktrees = await execFileP("git", ["-C", sibling, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseGitWorktreePorcelain(r.stdout)).catch(() => void 0);
@@ -43033,7 +43308,7 @@ ${list}`);
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs42.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs43.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -43140,6 +43415,15 @@ ${list}`);
       return;
     }
     const primaryRoot = beforeWorktrees[0]?.path ?? (startingPath || process.cwd());
+    let gitCommonDir;
+    let residueSweep;
+    if (!(foreignCwd && !foreignCheckout)) {
+      try {
+        gitCommonDir = (0, import_node_path41.resolve)(primaryRoot, (await execFileP("git", ["-C", primaryRoot, "rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS })).stdout.trim());
+        residueSweep = await sweepWorktreeResidue(gitCommonDir, beforeWorktrees.map((w) => w.path));
+      } catch {
+      }
+    }
     let localCleanup;
     if (foreignCwd && !foreignCheckout) {
       localCleanup = { branch: headRef, localBranch: { name: headRef, status: "not-attempted", reason: "skipped-foreign-cwd" } };
@@ -43153,7 +43437,7 @@ ${list}`);
           preserveWorktree: o.preserveWorktree,
           gcAcknowledged: o.gc,
           expectedHeadOid: headRefOid,
-          pathExists: (p) => (0, import_node_fs42.existsSync)(p),
+          pathExists: (p) => (0, import_node_fs43.existsSync)(p),
           // #5899: pin cleanup git calls to the main checkout — the task worktree this process may be
           // standing in is removed mid-cleanup, so a cwd-relative invocation fails with
           // 'fatal: not a git repository' and leaves a spurious partial-cleanup exit.
@@ -43184,6 +43468,7 @@ ${list}`);
       remote
     });
     const worktree = localCleanup?.worktree;
+    if (gitCommonDir && worktree?.path && worktree.residue === "left") recordResidue(gitCommonDir, worktree.path);
     const worktreePartial = isPrMergeWorktreePartial(localCleanup) && worktree?.path ? {
       kind: "worktree-directory",
       path: worktree.path,
@@ -43248,6 +43533,7 @@ ${list}`);
       ...partialCleanup.length ? { cleanupStatus: "partial", partialCleanup } : {},
       ...localCleanup?.worktree ? { worktree: localCleanup.worktree } : {},
       ...localCleanup?.localBranch ? { localBranch: localCleanup.localBranch } : {},
+      ...residueSweep && (residueSweep.swept.length || residueSweep.emptyRemoved.length || residueSweep.kept.length || residueSweep.unrecorded.length) ? { residueSweep } : {},
       // `boardAdvance` keeps its published array shape; `boardAdvanceStatus` is the field a caller reads to
       // tell "merged clean" from "merged, but the board did not follow" without guessing from the exit code.
       ...boardAdvance.entries.length ? { boardAdvance: boardAdvance.entries } : {},
@@ -43257,6 +43543,7 @@ ${list}`);
       ...devDeploy ? { devDeploy: devDeploy.ok ? { dispatched: true } : { dispatched: false, manual: devDeployManual } } : {}
     }));
     for (const line of renderPrMergeCleanupLines(localCleanup)) console.warn(line);
+    for (const line of renderResidueSweepLines(residueSweep)) console.warn(line);
     if (devDeploy && !devDeploy.ok) {
       console.error(`pr merge: ${devDeployManual} (${devDeploy.detail})`);
     }
@@ -43274,7 +43561,7 @@ ${list}`);
 }
 
 // src/command-register-developer.ts
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -43307,7 +43594,7 @@ async function resolveWhoami(deps) {
 }
 
 // src/command-register-developer.ts
-var import_node_path45 = require("node:path");
+var import_node_path46 = require("node:path");
 init_house_map();
 init_hub_url();
 
@@ -43340,7 +43627,7 @@ async function executeWaveLand(plan, deps) {
 }
 
 // src/box-commands.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 init_clean_exit();
 
 // src/box.ts
@@ -43552,7 +43839,7 @@ function registerBoxCommands(program3) {
       }
       const remote = command && command.length ? command.join(" ") : void 0;
       const wroteScript = o.ssh && o.script ? o.script : null;
-      if (wroteScript) (0, import_node_fs43.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
+      if (wroteScript) (0, import_node_fs44.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
@@ -43574,19 +43861,19 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 // src/dist-drift.ts
 var import_node_child_process16 = require("node:child_process");
 var import_node_crypto13 = require("node:crypto");
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 var import_node_os21 = require("node:os");
-var import_node_path42 = require("node:path");
+var import_node_path43 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
 var import_node_crypto12 = require("node:crypto");
-var import_node_fs44 = require("node:fs");
-var import_node_path41 = require("node:path");
+var import_node_fs45 = require("node:fs");
+var import_node_path42 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
 function repoPath(root, declaredPath, label) {
-  const absoluteRoot = (0, import_node_path41.resolve)(root);
-  const target = (0, import_node_path41.resolve)(root, declaredPath);
-  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path41.sep}`)) {
+  const absoluteRoot = (0, import_node_path42.resolve)(root);
+  const target = (0, import_node_path42.resolve)(root, declaredPath);
+  if (target !== absoluteRoot && !target.startsWith(`${absoluteRoot}${import_node_path42.sep}`)) {
     throw new Error(`${label} ${declaredPath} escapes the repository root`);
   }
   return target;
@@ -43594,7 +43881,7 @@ function repoPath(root, declaredPath, label) {
 function digestFiles(files) {
   const hash = (0, import_node_crypto12.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
-    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs44.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs44.readFileSync)(file.absolute);
+    const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs45.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs45.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
     hash.update("\0");
     hash.update(file.stat.isSymbolicLink() ? "symlink" : "file", "utf8");
@@ -43609,8 +43896,8 @@ function digestFiles(files) {
 function digestPackedFiles(packageRoot, packedFiles) {
   return digestFiles(packedFiles.map((path2) => {
     const absolute = repoPath(packageRoot, path2, "packed artifact identity path");
-    if (!(0, import_node_fs44.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
-    return { absolute, relative: slash(path2), stat: (0, import_node_fs44.lstatSync)(absolute) };
+    if (!(0, import_node_fs45.existsSync)(absolute)) throw new Error(`packed artifact identity path ${path2} does not exist`);
+    return { absolute, relative: slash(path2), stat: (0, import_node_fs45.lstatSync)(absolute) };
   }));
 }
 
@@ -43694,13 +43981,13 @@ function renderDistDriftReceipt(receipt) {
   return lines2;
 }
 function readOrNull(path2) {
-  return (0, import_node_fs45.existsSync)(path2) ? (0, import_node_fs45.readFileSync)(path2) : null;
+  return (0, import_node_fs46.existsSync)(path2) ? (0, import_node_fs46.readFileSync)(path2) : null;
 }
 function walkFiles(root) {
   const files = [];
   const walk2 = (directory) => {
-    for (const entry of (0, import_node_fs45.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      const child2 = (0, import_node_path42.join)(directory, entry.name);
+    for (const entry of (0, import_node_fs46.readdirSync)(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const child2 = (0, import_node_path43.join)(directory, entry.name);
       if (entry.isDirectory()) walk2(child2);
       else files.push(child2);
     }
@@ -43710,10 +43997,10 @@ function walkFiles(root) {
 }
 function bomPathFor(root) {
   try {
-    const registry2 = JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(root, "surfaces.json"), "utf8"));
-    return (0, import_node_path42.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
+    const registry2 = JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path43.join)(root, "surfaces.json"), "utf8"));
+    return (0, import_node_path43.join)(root, registry2?.sharedAgentCore?.releaseMetadata?.bomPath ?? "distribution-bom.json");
   } catch {
-    return (0, import_node_path42.join)(root, "distribution-bom.json");
+    return (0, import_node_path43.join)(root, "distribution-bom.json");
   }
 }
 function rebuildTo(packageRoot, outDir) {
@@ -43726,35 +44013,35 @@ function rebuildTo(packageRoot, outDir) {
   });
 }
 function runDistStatus(root) {
-  const stage = (0, import_node_fs45.mkdtempSync)((0, import_node_path42.join)((0, import_node_os21.tmpdir)(), "mmi-dist-drift-"));
+  const stage = (0, import_node_fs46.mkdtempSync)((0, import_node_path43.join)((0, import_node_os21.tmpdir)(), "mmi-dist-drift-"));
   let overlayCount = 0;
   try {
-    const cliOut = (0, import_node_path42.join)(stage, "cli-dist");
-    const hubOut = (0, import_node_path42.join)(stage, "hub-dist");
-    rebuildTo((0, import_node_path42.join)(root, "cli"), cliOut);
-    rebuildTo((0, import_node_path42.join)(root, "updater"), hubOut);
+    const cliOut = (0, import_node_path43.join)(stage, "cli-dist");
+    const hubOut = (0, import_node_path43.join)(stage, "hub-dist");
+    rebuildTo((0, import_node_path43.join)(root, "cli"), cliOut);
+    rebuildTo((0, import_node_path43.join)(root, "updater"), hubOut);
     const outDirFor = (packageDir) => packageDir === "cli" ? cliOut : hubOut;
     const rebuilt = (path2) => {
       const spec = DIST_ARTIFACTS.find((entry) => entry.path === path2);
-      return spec ? readOrNull((0, import_node_path42.join)(outDirFor(spec.packageDir), spec.output)) : null;
+      return spec ? readOrNull((0, import_node_path43.join)(outDirFor(spec.packageDir), spec.output)) : null;
     };
-    const committed = (path2) => readOrNull((0, import_node_path42.join)(root, path2));
-    const tree = (path2) => readOrNull((0, import_node_path42.join)(root, path2));
-    const distRoot = (0, import_node_path42.join)(root, "cli", "dist");
-    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path42.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
-    const bom = JSON.parse((0, import_node_fs45.readFileSync)(bomPathFor(root), "utf8"));
+    const committed = (path2) => readOrNull((0, import_node_path43.join)(root, path2));
+    const tree = (path2) => readOrNull((0, import_node_path43.join)(root, path2));
+    const distRoot = (0, import_node_path43.join)(root, "cli", "dist");
+    const distTree = () => walkFiles(distRoot).map((absolute) => `cli/dist/${(0, import_node_path43.relative)(distRoot, absolute).replaceAll("\\", "/")}`);
+    const bom = JSON.parse((0, import_node_fs46.readFileSync)(bomPathFor(root), "utf8"));
     const digest = (entries) => {
-      const overlay = (0, import_node_path42.join)(stage, `overlay-${overlayCount++}`);
+      const overlay = (0, import_node_path43.join)(stage, `overlay-${overlayCount++}`);
       for (const entry of entries) {
-        const target = (0, import_node_path42.join)(overlay, entry.path);
-        (0, import_node_fs45.mkdirSync)((0, import_node_path42.dirname)(target), { recursive: true });
-        (0, import_node_fs45.writeFileSync)(target, entry.bytes);
+        const target = (0, import_node_path43.join)(overlay, entry.path);
+        (0, import_node_fs46.mkdirSync)((0, import_node_path43.dirname)(target), { recursive: true });
+        (0, import_node_fs46.writeFileSync)(target, entry.bytes);
       }
       return digestPackedFiles(overlay, entries.map((entry) => entry.path));
     };
     return computeDistDriftReceipt({ committed, tree, rebuilt, distTree, bom, digest });
   } finally {
-    (0, import_node_fs45.rmSync)(stage, { recursive: true, force: true });
+    (0, import_node_fs46.rmSync)(stage, { recursive: true, force: true });
   }
 }
 
@@ -43833,7 +44120,7 @@ init_hub_auth();
 
 // src/schedules-lift-command.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_path43 = require("node:path");
+var import_node_path44 = require("node:path");
 init_clean_exit();
 init_cli_shared();
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
@@ -43862,7 +44149,7 @@ async function readWorkflowFiles(dir) {
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises8.readFile)((0, import_node_path43.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises8.readFile)((0, import_node_path44.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -43945,8 +44232,8 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process17 = require("node:child_process");
-var import_node_fs46 = require("node:fs");
-var import_node_path44 = require("node:path");
+var import_node_fs47 = require("node:fs");
+var import_node_path45 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -44032,7 +44319,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs46.readFileSync)((0, import_node_path44.join)(root, file), "utf8");
+      raw = (0, import_node_fs47.readFileSync)((0, import_node_path45.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -44052,19 +44339,19 @@ function runSpawnPolicy(root) {
 function registerDeveloperCommands(program3) {
   const rules = program3.command("rules").description("org-managed .gitignore delivery");
   rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-    const path2 = (0, import_node_path45.join)(process.cwd(), ".gitignore");
-    const current = (0, import_node_fs47.existsSync)(path2) ? (0, import_node_fs47.readFileSync)(path2, "utf8") : null;
+    const path2 = (0, import_node_path46.join)(process.cwd(), ".gitignore");
+    const current = (0, import_node_fs48.existsSync)(path2) ? (0, import_node_fs48.readFileSync)(path2, "utf8") : null;
     const plan = planManagedGitignore(current);
     const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
     if (opts.json) {
-      if (opts.write && plan.changed) (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
+      if (opts.write && plan.changed) (0, import_node_fs48.writeFileSync)(path2, plan.content, "utf8");
       console.log(JSON.stringify(plan, null, 2));
       if (!opts.write && plan.changed) process.exitCode = 1;
       return;
     }
     if (opts.write) {
       if (plan.changed) {
-        (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
+        (0, import_node_fs48.writeFileSync)(path2, plan.content, "utf8");
         console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
       } else {
         console.log("mmi-cli devops org rules gitignore: up to date");
@@ -45295,6 +45582,10 @@ ${decision.note}`);
     deployNote = dispatch.note;
     runs.push(hotfixWorkflowRunFromDispatch("tenant-deploy.yml", deploy));
     if (publish) runs.push(hotfixWorkflowRunFromDispatch("publish.yml", publish));
+  } else if (deployModel === "vercel") {
+    const vercel = await dispatchDeploy(deps, ctx, "main", "main", deployModel, true, (deps.now ?? Date.now)(), mergedSha, "report");
+    runs.push(hotfixWorkflowRunFromDispatch("vercel", vercel));
+    deployNote = vercel.note;
   } else {
     deployNote = `no hotfix deploy dispatch for deployModel=${deployModel} \u2014 prod deploy is repo-specific`;
   }
@@ -45804,8 +46095,8 @@ function checkHotfixCarries(options) {
 }
 
 // src/train-commands.ts
-var import_node_fs48 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_fs49 = require("node:fs");
+var import_node_path47 = require("node:path");
 init_cli_shared();
 init_clean_exit();
 init_client_version();
@@ -45820,7 +46111,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs48.readFileSync)((0, import_node_path46.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs49.readFileSync)((0, import_node_path47.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -45922,8 +46213,8 @@ async function withReleaseProgress(deps, initial, action) {
     clearInterval(heartbeat);
   }
 }
-function releaseProgressVerdict(status) {
-  return status === "complete" ? "Release complete" : status === "failed" ? "Release failed \u2014 a follow-up needs attention" : "Release pending \u2014 waiting for unfinished follow-ups";
+function releaseProgressVerdict(status, subject = "Release") {
+  return status === "complete" ? `${subject} complete` : status === "failed" ? `${subject} failed \u2014 a follow-up needs attention` : `${subject} pending \u2014 waiting for unfinished follow-ups`;
 }
 
 // src/command-register-train-operations.ts
@@ -46160,8 +46451,31 @@ function renderReleasePublishRetry(r) {
   return `mmi-cli devops release --retry-publish: ${r.repo} ${r.tag} (${r.tagSha.slice(0, 12)}) \u2014 ${r.note}; ${r.runUrl}`;
 }
 function renderRcandResume(r) {
-  const base = `mmi-cli devops rcand --resume: promoted ${r.repo} \u2014 rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
-  return r.ledger ? [base, ...formatReleaseLedgerReport(r.ledger).map((line) => `  ${line}`)].join("\n") : base;
+  const verb = r.command === "rcand-retry-deploy" ? "retry-deploy" : "resume";
+  const base = `mmi-cli devops rcand --${verb}: promoted ${r.repo} \u2014 rc at ${r.tag} (${r.tagSha.slice(0, 12)}) [${r.deployModel}]; ${renderDeployLine(r)}; ${r.note}`;
+  return appendVerdictAndLedger(base, r.releaseVerdict, r.ledger);
+}
+function progressSubject(commandName) {
+  return commandName === "rcand" ? "Release candidate" : "Release";
+}
+function emitRcandContinuation(label, raw, o) {
+  const result = raw.workflowRuns ? { ...raw, workflowRuns: raw.workflowRuns.map(workflowRunWithEvidence) } : raw;
+  const { followUpStatus, releaseVerdict } = buildReleaseVerdict("rcand", result, void 0);
+  const reported = { ...result, releaseVerdict };
+  emitTrainResult(label, o.json ? JSON.stringify(reported, null, 2) : renderRcandResume(reported), o.out);
+  consoleIo.err(`mmi-cli: Release: ${releaseProgressVerdict(followUpStatus, progressSubject("rcand"))}`);
+  applyTrainFollowUpExit(followUpStatus);
+}
+function appendVerdictAndLedger(base, v, ledger) {
+  const lines2 = [base];
+  if (v) {
+    const verdict = v.followUpStatus === "failed" ? "PROMOTED, FOLLOW-UP FAILED" : v.followUpStatus === "pending" ? "PROMOTED, FOLLOW-UP PENDING" : "SUCCEEDED";
+    const followUpNote = trainFollowUpNote(v.followUpStatus);
+    lines2[0] = `${base}; release verdict: ${verdict}; promoted=${v.promoted}; tag=${v.tag}; release=${v.releaseUrl ?? "unreported"}; follow-up: ${v.followUpStatus.toUpperCase()}${followUpNote ? ` (${followUpNote})` : ""}`;
+    lines2.push(...v.legs.filter((leg) => leg.status === "failed").map((leg) => `  - follow-up leg ${leg.leg}: FAILED \u2014 ${leg.error ?? "no diagnostic recorded"}`));
+  }
+  if (ledger) lines2.push(...formatReleaseLedgerReport(ledger).map((line) => `  ${line}`));
+  return lines2.join("\n");
 }
 function renderAlignment(label, alignment) {
   if (alignment.status !== "pr-pending") return `${label}: ${alignment.note}`;
@@ -46269,16 +46583,17 @@ function buildReleaseVerdict(commandName, result, projectInfoSync) {
     alignment: alignmentPending ? "unresolved" : "ok",
     foldPort: "ok"
   });
+  const legs = releaseFollowUpLegs(result, projectInfoSync);
   return {
     followUpStatus,
-    releaseVerdict: commandName === "release" ? {
+    releaseVerdict: {
       releaseStatus: "succeeded",
       followUpStatus,
       promoted: result.promoted,
       tag: result.tag,
       releaseUrl: result.release?.url ?? null,
-      legs: releaseFollowUpLegs(result, projectInfoSync)
-    } : void 0
+      legs: commandName === "rcand" ? legs.filter((leg) => leg.leg !== "project-info") : legs
+    }
   };
 }
 function buildResumeReleaseVerdict(result, projectInfoSync) {
@@ -46331,22 +46646,7 @@ function renderTrainApply(commandName, r) {
     base = `${base}; project info: ${r.projectInfoSync.note}`;
   }
   if (r.announceNote) base = `${base}; announce: ${r.announceNote}`;
-  if (r.releaseVerdict) {
-    const v = r.releaseVerdict;
-    const verdict = v.followUpStatus === "failed" ? "PROMOTED, FOLLOW-UP FAILED" : v.followUpStatus === "pending" ? "PROMOTED, FOLLOW-UP PENDING" : "SUCCEEDED";
-    const failedLegs = v.legs.filter((leg) => leg.status === "failed");
-    const followUpNote = trainFollowUpNote(v.followUpStatus);
-    return [
-      `${base}; release verdict: ${verdict}; promoted=${v.promoted}; tag=${v.tag}; release=${v.releaseUrl ?? "unreported"}; follow-up: ${v.followUpStatus.toUpperCase()}${followUpNote ? ` (${followUpNote})` : ""}`,
-      ...failedLegs.map((leg) => `  - follow-up leg ${leg.leg}: FAILED \u2014 ${leg.error ?? "no diagnostic recorded"}`),
-      // #5987: the durable ledger's phase legs + derived typed verdict ride the same receipt.
-      ...r.ledger ? formatReleaseLedgerReport(r.ledger).map((line) => `  ${line}`) : []
-    ].join("\n");
-  }
-  if (r.ledger) {
-    return [base, ...formatReleaseLedgerReport(r.ledger).map((line) => `  ${line}`)].join("\n");
-  }
-  return base;
+  return appendVerdictAndLedger(base, r.releaseVerdict, r.ledger);
 }
 function applyTrainFollowUpExit(status) {
   const code = trainFollowUpExitCode(status);
@@ -46396,6 +46696,8 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         trainCmd.addOption(new Option(f.flags, f.description).hideHelp());
       }
     }
+    const retryDeploy = new Option("--retry-deploy", "re-dispatch the FAILED rc deploy of the promoted candidate in the active rcand ledger \u2014 same tag and SHA, never re-cut or re-pushed (#7053)");
+    trainCmd.addOption(commandName === "rcand" ? retryDeploy : retryDeploy.hideHelp());
     trainCmd.option("--repo <owner/repo>", "dry-run plan for a target repo without relying on the current checkout; --apply still uses the current checkout").action(async (o) => {
       try {
         await requireFreshTrainCli(commandName);
@@ -46423,8 +46725,30 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.retryPublish && commandName !== "release") {
         return fail(`${commandName}: --retry-publish applies only to release. Run: mmi-cli devops release --retry-publish <run-id> --apply --watch`);
       }
-      if (o.out && !o.apply && !o.resume) {
-        return fail(`${commandName}: --out writes a terminal result receipt (--apply, --resume, --abort, --retry-publish) \u2014 the dry-run plan keeps its stdout/JSON output. Drop --out or rerun with --apply`);
+      if (o.retryDeploy && commandName !== "rcand") {
+        return fail(`${commandName}: --retry-deploy applies only to rcand \u2014 it re-dispatches a failed rc deploy of the promoted candidate. Run: mmi-cli devops rcand --retry-deploy --watch (a failed hotfix deploy: mmi-cli devops hotfix release <tag> --retry-deploy)`);
+      }
+      if (o.out && !o.apply && !o.resume && !o.retryDeploy) {
+        return fail(`${commandName}: --out writes a terminal result receipt (--apply, --resume, --retry-deploy, --abort, --retry-publish) \u2014 the dry-run plan keeps its stdout/JSON output. Drop --out or rerun with --apply`);
+      }
+      if (o.retryDeploy) {
+        if (o.apply || o.resume) return fail("rcand: --retry-deploy cannot be combined with --apply or --resume \u2014 it re-dispatches only the failed rc deploy of the already-promoted candidate");
+        if (o.repo) {
+          const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli devops rcand --retry-deploy${o.watch ? " --watch" : ""}`);
+          if (!guard.ok) return fail(`rcand: ${guard.message}`);
+        }
+        try {
+          const raw = await withReleaseProgress(
+            trainApplyDeps(),
+            "Checking the failed release candidate deploy",
+            (deps) => runRcandRetryDeploy(deps, { watch: o.watch })
+          );
+          return emitRcandContinuation("rcand --retry-deploy", raw, o);
+        } catch (e) {
+          applyTrainFollowUpExit("failed");
+          consoleIo.err("mmi-cli: Release: Release candidate blocked \u2014 see the error below");
+          return failGraceful(`rcand --retry-deploy: ${e.message}`);
+        }
       }
       if (o.supersedeDeploy && o.supersedePublish) {
         if (o.resume) return fail("release: --supersede-deploy --supersede-publish and --resume are mutually exclusive \u2014 the closure settles the ledger so a NEW train can run, resume re-derives the very legs it closes");
@@ -46528,17 +46852,12 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         if (o.apply) return fail(`${commandName}: --resume and --apply are mutually exclusive \u2014 --apply cuts the NEXT version, --resume finishes the immutable tag already on origin`);
         try {
           if (commandName === "rcand") {
-            const raw2 = await runRcandResume(trainApplyDeps(), { watch: o.watch });
-            const result2 = raw2.workflowRuns ? { ...raw2, workflowRuns: raw2.workflowRuns.map(workflowRunWithEvidence) } : raw2;
-            emitTrainResult("rcand --resume", o.json ? JSON.stringify(result2, null, 2) : renderRcandResume(result2), o.out);
-            applyTrainFollowUpExit(deriveTrainFollowUpStatus({
-              projectInfo: "ok",
-              deploy: deployFollowUpOutcome(result2.deployStatus),
-              rcRetirement: "ok",
-              alignment: "ok",
-              foldPort: "ok"
-            }));
-            return;
+            const raw2 = await withReleaseProgress(
+              trainApplyDeps(),
+              "Checking the existing release candidate",
+              (deps) => runRcandResume(deps, { watch: o.watch })
+            );
+            return emitRcandContinuation("rcand --resume", raw2, o);
           }
           const raw = await withReleaseProgress(
             trainApplyDeps(),
@@ -46559,7 +46878,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
           return;
         } catch (e) {
           applyTrainFollowUpExit("failed");
-          if (commandName === "release") consoleIo.err("mmi-cli: Release: Release blocked \u2014 see the error below");
+          consoleIo.err(`mmi-cli: Release: ${progressSubject(commandName)} blocked \u2014 see the error below`);
           return failGraceful(`${commandName} --resume: ${e.message}`);
         }
       }
@@ -46603,7 +46922,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         try {
           const ack = (o.ack ?? "").split(",").map((s) => s.trim()).filter(Boolean);
           const apply = (deps) => runTrainApply(commandName, deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, ack, dev: o.dev });
-          const raw = commandName === "release" ? await withReleaseProgress(trainApplyDeps(), "Preparing release", apply) : await apply(trainApplyDeps());
+          const raw = await withReleaseProgress(trainApplyDeps(), commandName === "release" ? "Preparing release" : "Preparing release candidate", apply);
           const result = raw.workflowRuns ? { ...raw, workflowRuns: raw.workflowRuns.map(workflowRunWithEvidence) } : raw;
           let projectInfoSync;
           if (commandName === "release") {
@@ -46621,14 +46940,14 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
           };
           const output = o.json ? JSON.stringify(reported, null, 2) : renderTrainApply(commandName, reported);
           emitTrainResult(`${commandName} apply`, output, o.out);
-          if (commandName === "release") consoleIo.err(`mmi-cli: Release: ${releaseProgressVerdict(followUpStatus)}`);
+          consoleIo.err(`mmi-cli: Release: ${releaseProgressVerdict(followUpStatus, progressSubject(commandName))}`);
           applyTrainFollowUpExit(followUpStatus);
           return;
         } catch (e) {
           const error = e;
           writeTrainFailureReceipt(commandName, o.json === true, o.out, error);
           process.exitCode = 1;
-          if (commandName === "release") consoleIo.err("mmi-cli: Release: Release blocked \u2014 see the error below");
+          consoleIo.err(`mmi-cli: Release: ${progressSubject(commandName)} blocked \u2014 see the error below`);
           return await failGraceful(`${commandName}: ${error.message}`);
         }
       }
@@ -46808,7 +47127,7 @@ ${r.stderr ?? ""}`).catch(() => "");
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path47.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path48.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -46945,7 +47264,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs49.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs50.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -46980,7 +47299,7 @@ function mmiDoctorDeps(opts = {}) {
     // has no generated routing index would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs49.existsSync)((0, import_node_path47.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs50.existsSync)((0, import_node_path48.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -46989,7 +47308,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs49.existsSync)((0, import_node_path47.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs50.existsSync)((0, import_node_path48.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs;
       const listDocs = () => docs ??= real.listDocs();
@@ -47615,7 +47934,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs49.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs50.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -47948,16 +48267,16 @@ function ciAuditDeps2() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path47.join)(root, path2);
-      return (0, import_node_fs49.existsSync)(fullPath) ? (0, import_node_fs49.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path48.join)(root, path2);
+      return (0, import_node_fs50.existsSync)(fullPath) ? (0, import_node_fs50.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot2() {
-  const fromPkg = (0, import_node_path47.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path48.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs49.existsSync)((0, import_node_path47.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs49.existsSync)((0, import_node_path47.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs50.existsSync)((0, import_node_path48.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs50.existsSync)((0, import_node_path48.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 registerQueryCommands(program2);
@@ -48057,10 +48376,10 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs49.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs49.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs50.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs50.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const dataAccess = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const sanctioned = (0, import_node_fs49.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs49.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs50.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs50.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -48091,16 +48410,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs49.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs50.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path47.join)(path2, entry.name);
+    const child2 = (0, import_node_path48.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs49.statSync)(child2).size;
+        total += (0, import_node_fs50.statSync)(child2).size;
       } catch {
       }
     }
@@ -48108,25 +48427,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs49.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs50.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs49.existsSync)(p)) return [];
+  if (!(0, import_node_fs50.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs49.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs50.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs49.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs49.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs50.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs50.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs49.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs50.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path47.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs49.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path48.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs50.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -48140,10 +48459,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path47.join)(stagingRoot, name);
-      if (!(0, import_node_fs49.existsSync)(p)) return null;
+      const p = (0, import_node_path48.join)(stagingRoot, name);
+      if (!(0, import_node_fs50.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs49.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs50.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -48169,7 +48488,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs49.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs50.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));