@mutmutco/cli 4.5.58 → 4.5.60

package/dist/main.cjs

@@ -5825,11 +5825,14 @@ function waitReadFailureMessage(e) {
   return (stderr || err?.message || String(e)).replace(/\s+/g, " ").slice(0, 300);
 }
 var PR_CHECKS_POLL_MS = 3e4;
+function pollIntervalMs(elapsedMs) {
+  return Math.min(4 * PR_CHECKS_POLL_MS, PR_CHECKS_POLL_MS * 2 ** Math.floor(Math.max(0, elapsedMs) / 3e5));
+}
 var PR_CHECKS_TIMEOUT_MS = 30 * 6e4;
 var PR_CHECKS_SUCCESS_CONFIRMATIONS = 2;
 var PR_CHECKS_CONFIRM_MS = 5e3;
 var PR_CHECKS_FAILURE_CONFIRMATIONS = 2;
-var PR_CHECKS_RATELIMIT_FLOOR = 50;
+var PR_CHECKS_RATELIMIT_FLOOR = 1e3;
 var PR_CHECKS_RATELIMIT_JITTER_MAX_MS = 5e3;
 var NO_CI_LIVE_CHECKS_CONTRADICTION_REASON = "ci:none contradicted by live check runs on PR head";
 var PR_CHECKS_ZERO_RUNS_GRACE_MS = 2 * 6e4;
@@ -5965,7 +5968,7 @@ async function waitForPrChecks(deps) {
     }
     if (state === "failing") {
       lastDetail = "failing (a check failed; others still running)";
-      await deps.sleep(PR_CHECKS_POLL_MS);
+      await deps.sleep(pollIntervalMs(now() - started));
       continue;
     }
     if (state === "success") {
@@ -6003,11 +6006,11 @@ async function waitForPrChecks(deps) {
       } else {
         zeroRunsStreak = 0;
       }
-      await deps.sleep(PR_CHECKS_POLL_MS);
+      await deps.sleep(pollIntervalMs(now() - started));
       continue;
     }
     lastDetail = state;
-    await deps.sleep(PR_CHECKS_POLL_MS);
+    await deps.sleep(pollIntervalMs(now() - started));
   }
   return { policy, status: "timeout", reason, detail: lastDetail, waitedMs: now() - started };
 }
@@ -6044,15 +6047,38 @@ async function pollToken() {
   pollTokenOnce ??= pollTokenProvider().catch(() => void 0);
   return pollTokenOnce;
 }
-async function defaultGhApi(args) {
-  const token = await pollToken();
-  const { stdout } = await execFileP("gh", ["api", ...args], {
-    timeout: REST_GH_TIMEOUT_MS,
-    // Only when a token was actually minted: passing `env` at all would otherwise replace the
-    // inherited environment wholesale, and `gh` needs the rest of it (PATH, GH_HOST, config home).
-    ...token ? { env: { ...process.env, GH_TOKEN: token } } : {}
+var INCLUDED_HEADER_BLOCK = /^(?:\r?\n)?HTTP\/\d(?:\.\d)? (\d{3})[^\n]*\n(?:[^\n]+\n)*?\r?\n/gm;
+function parseIncludedOutput(out) {
+  let status;
+  let etag;
+  let pages = 0;
+  const body = out.replace(INCLUDED_HEADER_BLOCK, (block, code) => {
+    if (pages++ === 0) {
+      status = Number(code);
+      etag = /^etag:\s*(.+?)\s*$/im.exec(block)?.[1];
+    }
+    return "";
   });
-  return stdout;
+  return { body, status, etag, pages };
+}
+var etagCache = /* @__PURE__ */ new Map();
+async function defaultGhApi(args) {
+  const key = args.join("\0");
+  const cached = etagCache.get(key);
+  let stdout;
+  try {
+    ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
+      timeout: REST_GH_TIMEOUT_MS
+    }));
+  } catch (e) {
+    const out = e.stdout;
+    if (cached && typeof out === "string" && parseIncludedOutput(out).status === 304) return cached.body;
+    throw e;
+  }
+  const { body, etag, pages } = parseIncludedOutput(stdout);
+  if (etag && pages === 1) etagCache.set(key, { etag, body });
+  else etagCache.delete(key);
+  return body;
 }
 function classifyCheckRun(run) {
   if (run.status !== "completed") return "pending";
@@ -8475,6 +8501,9 @@ function isValidSecretKey(key) {
   if (key.includes("..") || key.startsWith("/") || key.includes("*")) return false;
   return KEY_RE.test(key);
 }
+function stripTrailingCRLF(value) {
+  return value.replace(/\r\n$|\r$|\n$/, "");
+}
 function classifyTier(_slug, key) {
   const slash2 = key.indexOf("/");
   if (slash2 === -1) return "project";
@@ -8624,6 +8653,9 @@ async function upgradeMessage(res, body) {
   if (res.status !== 426) return null;
   return upgradeRequiredError(res, body ?? await readJsonBody(res));
 }
+function safeServerReason(error) {
+  return typeof error === "string" && error.length > 0 && error.length <= 200 && /^[\x20-\x7e]+$/.test(error) && error.includes(" ") && !/[A-Za-z0-9+/=_-]{32,}/.test(error);
+}
 async function fetchSecretValue(deps, key, opts, diagnose = false) {
   if (!isValidSecretKey(key)) return null;
   const repo = await targetRepo(deps, opts);
@@ -8637,8 +8669,8 @@ async function fetchSecretValue(deps, key, opts, diagnose = false) {
     if (!res.ok) {
       if (diagnose) {
         const body = await readJsonBody(res);
-        const reason = res.status === 403 ? "authority refused" : res.status === 429 ? "rate limited" : "Hub route refused";
-        throw new Error(`${reason} (HTTP ${res.status}${typeof body.error === "string" && /^(forbidden|unauthorized|rate limit|too many requests|master-admin only)$/i.test(body.error) ? `: ${body.error}` : ""})`);
+        const reason = res.status === 403 ? "authority refused" : res.status === 429 ? "rate limited" : body.code === "github-rate-limited" ? "Hub GitHub App allowance used up, not a denial" : "Hub route refused";
+        throw new Error(`${reason} (HTTP ${res.status}${safeServerReason(body.error) ? `: ${body.error}` : ""})`);
       }
       return null;
     }
@@ -9918,6 +9950,10 @@ async function secretsVerify(deps, key, opts) {
   }
   const hasProviderVerifier = Boolean(providerForSecretKey(key));
   const value = await fetchSecretValue(deps, key, opts);
+  if (value && value !== stripTrailingCRLF(value)) {
+    deps.err(`${key}: stored value ends in a CR or LF character \u2014 likely corrupted by a piped write; re-set it with \`mmi-cli vault secrets set ${key}\``);
+    return false;
+  }
   if (!hasProviderVerifier) {
     if (!value) {
       deps.err(`${key}: ABSENT or unreachable at this coordinate \u2014 no value could be read`);
@@ -10105,6 +10141,40 @@ async function secretsDeclare(deps, key, opts) {
   deps.log(`declared ${key} (project tier, ${slug}) \u2014 catalog metadata only; ask master (secrets request) to wire it into requiredRuntimeSecrets`);
   return true;
 }
+async function secretsUndeclare(deps, key, opts) {
+  if (!DECLARE_KEY_RE.test(key.split("@")[0] ?? "")) {
+    deps.err(`secrets undeclare: invalid key ${JSON.stringify(key)} \u2014 must be an env-style name (UPPER_SNAKE convention), optionally @dev|rc|main`);
+    return false;
+  }
+  const repo = await targetRepo(deps, opts);
+  const slug = await vaultSlug(deps, opts);
+  let res;
+  try {
+    res = await deps.fetch(`${deps.apiUrl}/projects/${slug}/secrets/undeclare`, {
+      method: "POST",
+      headers: await deps.headers({ "content-type": "application/json" }),
+      body: JSON.stringify({ repo, key }),
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+  } catch (e) {
+    deps.err(`secrets undeclare: ${e.message}`);
+    return false;
+  }
+  const body = await readJsonBody(res);
+  if (!res.ok) {
+    deps.err(await upgradeMessage(res, body) ?? `secrets undeclare failed: HTTP ${res.status}${errorDetail(body)}`);
+    return false;
+  }
+  const undeclared = body?.undeclared !== false;
+  if (opts.json) {
+    deps.log(JSON.stringify({ ok: true, key, undeclared }));
+    return true;
+  }
+  deps.log(
+    undeclared ? `undeclared ${key} (project tier, ${slug}) \u2014 catalog entry removed; the vault value was already absent` : `${key} was not declared in ${slug}'s catalog \u2014 nothing to undeclare`
+  );
+  return true;
+}
 function parseRailsCredentialMapping(raw, stage) {
   const eq = raw.indexOf("=");
   if (eq <= 0 || eq === raw.length - 1) return null;
@@ -14688,7 +14758,7 @@ function extractForwardRefs(markdown) {
   });
   return refs;
 }
-function checkPins(root, readFile9, docs) {
+function checkPins(root, readFile10, docs) {
   const findings = [];
   for (const [doc, markdown] of Object.entries(docs)) {
     for (const pin of extractPins(markdown)) {
@@ -14696,7 +14766,7 @@ function checkPins(root, readFile9, docs) {
         findings.push({ kind: "malformed-pin", doc, line: pin.line, detail: pin.text });
         continue;
       }
-      const source = readFile9((0, import_node_path12.join)(root, pin.file));
+      const source = readFile10((0, import_node_path12.join)(root, pin.file));
       if (source == null) {
         findings.push({ kind: "missing-test", doc, line: pin.line, detail: pin.file });
         continue;
@@ -14913,7 +14983,7 @@ function defaultTrackedFirstSegments(root, firstSegments, exec2 = import_node_ch
   }
 }
 function runDocRefs(root, deps = {}) {
-  const readFile9 = deps.readFile ?? readFileOrNull;
+  const readFile10 = deps.readFile ?? readFileOrNull;
   const exists = deps.exists ?? import_node_fs14.existsSync;
   const listDocs = deps.listDocs ?? defaultListDocs;
   const isIgnored = deps.isIgnored ?? ((paths) => defaultIsIgnored(root, paths));
@@ -14922,11 +14992,11 @@ function runDocRefs(root, deps = {}) {
   const walked = listDocs(root);
   const ignoredDocs = walked.length ? isIgnored(walked) : /* @__PURE__ */ new Set();
   const docs = Object.fromEntries(
-    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile9((0, import_node_path12.join)(root, rel))]).filter(([, body]) => body != null)
+    walked.filter((rel) => !ignoredDocs.has(rel)).map((rel) => [rel, readFile10((0, import_node_path12.join)(root, rel))]).filter(([, body]) => body != null)
   );
   const refResult = checkRefs(root, { exists, isIgnored, trackedFirstSegments }, docs);
   const findings = [
-    ...checkPins(root, readFile9, docs).findings,
+    ...checkPins(root, readFile10, docs).findings,
     ...refResult.findings
   ];
   if (commandPaths == null) {
@@ -15705,22 +15775,22 @@ function renderBootstrapAncillaryPlan(labels, environments, exceptions = []) {
     ...exceptions.map(({ name, detail }) => `  OK environment ${name} (${detail})`)
   ].join("\n");
 }
-function resolveSeedContent(seed, vars, readFile9) {
-  if (seed.source === "self") return readFile9(seed.target);
+function resolveSeedContent(seed, vars, readFile10) {
+  if (seed.source === "self") return readFile10(seed.target);
   if (seed.source.startsWith("seed:")) {
-    const tmpl = readFile9(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
+    const tmpl = readFile10(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
     return tmpl == null ? null : renderSeed(tmpl, vars);
   }
   return null;
 }
-function resolveSeedWriteContent(seed, vars, readFile9, remoteContent) {
+function resolveSeedWriteContent(seed, vars, readFile10, remoteContent) {
   if (!seed.managedBlock) {
-    return { ok: true, content: resolveSeedContent(seed, vars, readFile9), managed: seed.source === "managed-block" };
+    return { ok: true, content: resolveSeedContent(seed, vars, readFile10), managed: seed.source === "managed-block" };
   }
-  const base = remoteContent ?? resolveSeedContent(seed, vars, readFile9);
+  const base = remoteContent ?? resolveSeedContent(seed, vars, readFile10);
   if (base == null) return { ok: true, content: null, managed: true };
   const blockSeed = { ...seed, source: seed.managedBlock.source, managedBlock: void 0 };
-  const desired = resolveSeedContent(blockSeed, vars, readFile9);
+  const desired = resolveSeedContent(blockSeed, vars, readFile10);
   if (desired == null) return { ok: true, content: null, managed: true };
   const result = upsertManagedSeedBlock(base, desired, seed.managedBlock.begin, seed.managedBlock.end);
   return result.ok ? { ok: true, content: result.content, managed: true } : { ok: false, reason: result.reason, managed: true };
@@ -16302,6 +16372,17 @@ function isHubControlRepo(repo) {
 function isJervHubRepo(repo) {
   return repo.toLowerCase() === JERV_HUB_REPO.toLowerCase();
 }
+var WINDOWS_GIT_BASH_MSYSTEM = /^(?:MINGW(?:32|64)|UCRT64|CLANG(?:64|ARM64))$/u;
+function isWindowsGitBash(msystem) {
+  return WINDOWS_GIT_BASH_MSYSTEM.test(msystem ?? "");
+}
+function assertGitBashOnWindowsForJervHubRelease(repo, platform2 = process.platform, env = process.env) {
+  if (platform2 !== "win32" || !isJervHubRepo(repo)) return;
+  if (isWindowsGitBash(env.MSYSTEM)) return;
+  throw new Error(
+    `${repo}: Windows Git Bash required \u2014 the release train's Jerv Gateway deploy leg refuses outside it, and the current shell is not Git Bash (MSYSTEM=${env.MSYSTEM ?? "(unset)"}). Run the release from Git Bash instead, e.g.: "C:/Program Files/Git/bin/bash.exe" -lc "mmi-cli devops release --apply"`
+  );
+}
 
 // src/train-apply-correlation.ts
 var import_node_fs18 = require("node:fs");
@@ -17070,10 +17151,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.58",
-    tag: "v4.5.58",
-    commit: "05d087d1fcb7",
-    npm: "@mutmutco/cli@4.5.58"
+    version: "4.5.60",
+    tag: "v4.5.60",
+    commit: "18fb882893af",
+    npm: "@mutmutco/cli@4.5.60"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17090,14 +17171,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.58"
+          v3Target: "v4.5.60"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.58 and redeploy the Hub Lambda from tag v4.5.58 (05d087d1fcb7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.58 (@mutmutco/cli@4.5.58, tag commit 05d087d1fcb7 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.60 and redeploy the Hub Lambda from tag v4.5.60 (18fb882893af); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.60 (@mutmutco/cli@4.5.60, tag commit 18fb882893af \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21284,7 +21365,7 @@ function renderTenantControl(r) {
 
 // src/train-apply-phases.ts
 var import_node_fs24 = require("node:fs");
-var import_promises3 = require("node:fs/promises");
+var import_promises4 = require("node:fs/promises");
 var import_node_path24 = require("node:path");
 
 // src/actions-billing-preflight.ts
@@ -24971,6 +25052,59 @@ function formatTrainDoctor(v) {
   return lines2.join("\n");
 }
 
+// src/release-plain-words.ts
+var import_promises3 = require("node:fs/promises");
+var PLAIN_WORDS_HEADING = "## In plain words";
+var PLAIN_WORDS_MARKER = "<!-- mmi:big -->";
+function buildPlainWordsSection(lines2, big) {
+  const [title, ...notes] = lines2;
+  const body = [PLAIN_WORDS_HEADING, title ?? "", ...notes.slice(0, 5).map((n) => `- ${n}`)];
+  if (big) body.push(PLAIN_WORDS_MARKER);
+  return body.join("\n");
+}
+function noChangePlainWordsLine(suiteTag) {
+  return `No changes to this module in this release; ships with the MM-Work suite ${suiteTag}.`;
+}
+function upsertPlainWordsSection(body, section) {
+  const lines2 = body.split(/\r?\n/);
+  const at = lines2.findIndex((l) => l.trim() === PLAIN_WORDS_HEADING);
+  let rest = body;
+  if (at >= 0) {
+    let end = lines2.length;
+    for (let i = at + 1; i < lines2.length; i++) {
+      if (lines2[i].trim().startsWith("## ")) {
+        end = i;
+        break;
+      }
+    }
+    rest = [...lines2.slice(0, at), ...lines2.slice(end)].join("\n");
+  }
+  const trimmedRest = rest.trim();
+  return trimmedRest ? `${section}
+
+${trimmedRest}` : section;
+}
+function plainWordsSummaryLines(content) {
+  return content.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).slice(0, 6);
+}
+async function writePlainWordsIfSuiteMember(deps, args) {
+  if (args.meta?.suite !== "mm-work") return;
+  try {
+    const lines2 = args.summaryLines && args.summaryLines.length > 0 ? args.summaryLines : [noChangePlainWordsLine(args.suiteTag ?? args.tag)];
+    const section = buildPlainWordsSection(lines2, args.big === true);
+    const body = clean2(await deps.run("gh", ["release", "view", args.tag, "--repo", args.repo, "--json", "body", "-q", ".body"]));
+    await deps.run("gh", ["release", "edit", args.tag, "--repo", args.repo, "--notes", upsertPlainWordsSection(body, section)]);
+  } catch {
+  }
+}
+async function writePlainWordsSection(deps, options, repo, meta, tag) {
+  try {
+    const summaryLines = options.announceSummaryFile ? plainWordsSummaryLines(await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(options.announceSummaryFile)) : void 0;
+    await writePlainWordsIfSuiteMember(deps, { repo, tag, meta, summaryLines, big: options.big, suiteTag: options.suiteTag });
+  } catch {
+  }
+}
+
 // src/vercel-version-env.ts
 var SKIPPED = { status: "skipped", note: "" };
 function vercelVersionEnvAheadNote(key) {
@@ -25157,6 +25291,7 @@ function enforceGateBudget(deps, repo) {
   }
 }
 async function preflight(deps, ctx, stage, meta, lane) {
+  assertGitBashOnWindowsForJervHubRelease(ctx.repo);
   deps.warn?.("Release: Checking release prerequisites");
   if (deps.suiteCut && !authorisedSuiteCut(ctx.repo, meta, deps.suiteCut))
     throw new Error(`${ctx.repo}: suite cut context does not match registry META; no deployment or tag was changed`);
@@ -25270,7 +25405,7 @@ async function waitForFoldIndexLock(deps, startBranch, resumeCommand) {
   const deadline = now() + GIT_INDEX_LOCK_WAIT_MS;
   for (; ; ) {
     try {
-      await (0, import_promises3.stat)(lockPath);
+      await (0, import_promises4.stat)(lockPath);
     } catch (e) {
       if (e.code === "ENOENT") return;
       throw foldFailureGuidance(
@@ -25306,7 +25441,7 @@ async function clearFoldChildIndexLock(deps) {
     "git index lock path"
   );
   try {
-    await (0, import_promises3.unlink)(lockPath);
+    await (0, import_promises4.unlink)(lockPath);
   } catch (e) {
     if (e.code === "ENOENT") return void 0;
     throw e;
@@ -25905,6 +26040,7 @@ ${recovery.note}`), recoveryInput);
   const autoRunSince = (deps.now ?? Date.now)();
   const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
+  await writePlainWordsSection(deps, options, ctx.repo, meta, tag);
   await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
   let alignment = alignEarly ? await alignEarly() : void 0;
   const prepared = prepareServedChannel(deps, { repo: ctx.repo, releaseSha, watch });
@@ -26464,6 +26600,7 @@ ${recovery.note}`), recoveryInput);
   steps.push(`created the GitHub Release for ${tag}`);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
   steps.push("verified the Release published against the tagged commit");
+  await writePlainWordsSection(deps, options, ctx.repo, meta, tag);
   await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, runUrl: releaseUrl, note: "verified the Release published against the tagged commit" }), { strict: ledgerMode === "strict", landed: "the immutable tag, the re-proven wall, and the origin/main push" });
   let devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   let rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
@@ -27201,6 +27338,45 @@ var REQUIRED_CONTEXTS_EMITTED_LABEL = "required check contexts match PR workflow
 var UNBLOCKING_GATE_JOBS_LABEL = "every gate job can block a merge (#7012)";
 var TAG_ADDRESSABLE_CONTEXTS_LABEL = "rc/main required contexts are tag-addressable (#3880)";
 var RELEASE_BRANCH_REACHABLE_LABEL = "rc/main required contexts are reachable from a release-base head (#5193)";
+var DEV_STAGE_FRESH_LABEL = "tenant dev stage runs the development tip (#7536)";
+var DEV_STAGE_STALE_TOLERANCE_MS = 30 * 60 * 1e3;
+function devStageFreshnessCheck(input) {
+  const { repo, deployedTag, tipSha, tipCommittedAt, nowMs } = input;
+  const label = DEV_STAGE_FRESH_LABEL;
+  const cannotAudit = (why) => ({ ok: true, label, detail: `cannot audit: ${why}` });
+  if (!tipSha) return cannotAudit("development tip unreadable");
+  if (!deployedTag) return cannotAudit("deployed dev SHA unreadable or never stamped");
+  if (deployedTag.toLowerCase() === tipSha.toLowerCase()) return { ok: true, label };
+  const ageMs = nowMs - Date.parse(tipCommittedAt ?? "");
+  if (!Number.isFinite(ageMs)) return cannotAudit("development tip commit time unreadable");
+  const minutes = Math.max(0, Math.round(ageMs / 6e4));
+  const behind = `dev runs ${deployedTag.slice(0, 7)}, development is at ${tipSha.slice(0, 7)} (${minutes} min old)`;
+  if (ageMs <= DEV_STAGE_STALE_TOLERANCE_MS) return { ok: true, label, detail: `deploy pending: ${behind}` };
+  return {
+    ok: false,
+    label,
+    detail: behind,
+    remediation: `mmi-cli devops runtime tenant redeploy ${repo} dev --watch \u2014 then read the Hub's "dev-auto-deploy ${repo}" log lines for why the merge did not deploy`
+  };
+}
+async function auditDevStageFreshness(repo, deps) {
+  const facts = await deps.getDeployFacts(slugFromRepo(repo)).catch(() => null);
+  const dev = facts?.stages.dev;
+  if (facts && !dev?.present) return void 0;
+  let tip;
+  try {
+    tip = await deps.client.rest("GET", `repos/${repo}/commits/development`);
+  } catch {
+    tip = void 0;
+  }
+  return devStageFreshnessCheck({
+    repo,
+    deployedTag: dev?.deployedTag,
+    tipSha: tip?.sha,
+    tipCommittedAt: tip?.commit?.committer?.date,
+    nowMs: Date.now()
+  });
+}
 var RULESET_TRACK_SCOPE_LABEL = "product ruleset branch scope covers the release track (#6327)";
 var RECONCILE_SEED_BRANCH_PREFIX = "bootstrap-seed-ruleset-ref";
 var NPM_PUBLISH_SAFE_FLOOR_SHA = "b5632c8b940d8025fdb5630e576502e1397c4552";
@@ -27467,15 +27643,16 @@ async function branchPresence(deps, repo, branch) {
   }
 }
 function collectRegistryRepos(projects) {
-  const seen = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Map();
   for (const project2 of projects) {
     for (const raw of project2.repos ?? []) {
       const repo = raw.includes("/") ? raw : `mutmutco/${raw}`;
-      seen.add(repo);
+      const key = repo.toLowerCase();
+      if (!seen.has(key)) seen.set(key, repo);
     }
   }
-  if (![...seen].some((r) => r.toLowerCase() === HUB_REPO4.toLowerCase())) seen.add(HUB_REPO4);
-  return [...seen].sort((a, b) => a.localeCompare(b));
+  if (!seen.has(HUB_REPO4.toLowerCase())) seen.set(HUB_REPO4.toLowerCase(), HUB_REPO4);
+  return [...seen.values()].sort((a, b) => a.localeCompare(b));
 }
 async function prTriggeredWorkflowsOnRef(deps, repo, branch, repoClass) {
   const hasGate = repoClass === "hub" ? true : await contentExists(deps, repo, branch, PRODUCT_GATE_PATH);
@@ -27522,7 +27699,29 @@ async function filterPullRequestTriggered(deps, repo, branch, paths) {
   }
   return kept;
 }
-async function auditRepoCi(repo, deps) {
+function trackUnauditableReads(deps) {
+  let reason;
+  const record = (e) => {
+    if (reason) return;
+    const err = e;
+    if (err?.rateLimited) reason = `GitHub App rate-limited: ${err.message ?? "rate limit exceeded"}`;
+    else if (err?.status === 403 || err?.status === 429) reason = `HTTP ${err.status}${err.message ? `: ${err.message}` : ""}`;
+  };
+  const client = {
+    ...deps.client,
+    rest: async (method, path2, init) => {
+      try {
+        return await deps.client.rest(method, path2, init);
+      } catch (e) {
+        record(e);
+        throw e;
+      }
+    }
+  };
+  return { deps: { ...deps, client }, reason: () => reason };
+}
+async function auditRepoCi(repo, callerDeps) {
+  const { deps, reason: unauditedReason } = trackUnauditableReads(callerDeps);
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
   const repoClass = classifyRepo(repo, meta);
   const checks = [];
@@ -27817,6 +28016,14 @@ async function auditRepoCi(repo, deps) {
     const workflows = await getBranchWorkflows();
     if (workflows) checks.push(...await auditSharedActionPins(workflows, deps));
   }
+  if (meta?.deployModel === "tenant-container" && deps.getDeployFacts) {
+    const fresh = await auditDevStageFreshness(repo, deps);
+    if (fresh) checks.push(fresh);
+  }
+  const failure = unauditedReason();
+  if (failure) {
+    return { repo, class: repoClass, mergePolicy: policy, ok: false, checks: [], explicitNoCi, unauditedReason: failure };
+  }
   const ok = checks.every((c) => c.ok);
   return { repo, class: repoClass, mergePolicy: policy, ok, checks, explicitNoCi };
 }
@@ -27858,8 +28065,8 @@ function renderCiAuditMarkdown(report) {
     "|------|-------|--------|----|---------|"
   ];
   for (const r of report.repos) {
-    const gap = r.checks.find((c) => !c.ok);
-    lines2.push(`| ${r.repo} | ${r.class} | ${r.mergePolicy} | ${r.ok ? "yes" : "no"} | ${gap?.label ?? "\u2014"} |`);
+    const gap = r.unauditedReason ? `CANNOT AUDIT \u2014 ${r.unauditedReason}` : r.checks.find((c) => !c.ok)?.label ?? "\u2014";
+    lines2.push(`| ${r.repo} | ${r.class} | ${r.mergePolicy} | ${r.ok ? "yes" : "no"} | ${gap} |`);
   }
   return lines2.join("\n");
 }
@@ -27869,8 +28076,13 @@ function renderCiAuditText(report) {
     renderCiAuditScopeLine(report)
   ];
   for (const r of report.repos) {
+    const verdict = r.unauditedReason ? "CANNOT AUDIT" : r.ok ? "OK" : "GAP";
     lines2.push(`
-${r.repo} (${r.class}, policy=${r.mergePolicy}) ${r.ok ? "OK" : "GAP"}`);
+${r.repo} (${r.class}, policy=${r.mergePolicy}) ${verdict}`);
+    if (r.unauditedReason) {
+      lines2.push(`  UNAUDITED \u2014 ${r.unauditedReason}`);
+      continue;
+    }
     for (const c of r.checks) {
       lines2.push(`  ${c.ok ? "OK" : "FAIL"} ${c.label}${c.detail ? ` \u2014 ${c.detail}` : ""}`);
     }
@@ -30258,7 +30470,7 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv"];
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "suiteHold"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -30758,6 +30970,7 @@ var SETTABLE_VAR_KEYS = [
   "branch",
   "vaultPath",
   "suite",
+  "suiteHold",
   "repos",
   "oauth",
   "publishRequired",
@@ -30792,6 +31005,7 @@ var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
   projectNumber: "numeric",
   suite: "lowercase kebab slug, e.g. mm-work",
+  suiteHold: 'JSON {reason, since?} \u2014 cuts the member out of the MM-Work suite train (e.g. {"reason":"frozen pending go-live proof"}); clear with --unset suiteHold (#7547)',
   publishRequired: "true|false",
   publishDir: "relative subpath, e.g. packages/ui",
   releaseChannel: "Slack channel id, e.g. C0BE0BRGAT0",
@@ -30870,6 +31084,20 @@ function clearSecretsConfirmationError(unsets, existing, confirmed) {
   if (confirmed) return null;
   return `org project set: --unset secrets clears the WHOLE catalog for ${existing?.slug ?? "this project"} (${count} declared entr${count === 1 ? "y" : "ies"} would be removed). To drop ONE entry use --unset-secret <KEY>; re-run with --confirm-clear-secrets to wipe all ${count}.`;
 }
+function parseSuiteHoldVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: suiteHold must be a JSON object {"reason":"...","since":"..."}');
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error('org project set: suiteHold must be a JSON object {"reason":"...","since":"..."}');
+  const hold = parsed;
+  if (typeof hold.reason !== "string" || !hold.reason.trim()) throw new Error("org project set: suiteHold.reason must be a non-empty string naming the freeze");
+  if (hold.since !== void 0 && (typeof hold.since !== "string" || !hold.since.trim())) throw new Error('org project set: suiteHold.since must be a non-empty string (e.g. "2026-09-28")');
+  if (Object.keys(hold).some((k) => k !== "reason" && k !== "since")) throw new Error("org project set: suiteHold accepts only reason and since");
+  return { reason: hold.reason, ...typeof hold.since === "string" ? { since: hold.since } : {} };
+}
 function buildProjectSetPatch(input) {
   const patch = {};
   if (input.class) {
@@ -30947,6 +31175,8 @@ function buildProjectSetPatch(input) {
     } else if (key === "suite") {
       if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(raw)) throw new Error("org project set: suite must be a lowercase kebab slug (e.g. mm-work)");
       patch[key] = raw;
+    } else if (key === "suiteHold") {
+      patch[key] = parseSuiteHoldVar(raw);
     } else if (key === "releaseChannel") {
       patch[key] = parseReleaseChannelVar(raw);
     } else if (key === "releaseLanguage") {
@@ -31356,7 +31586,7 @@ async function readSecretStdin() {
   }
   const chunks = [];
   for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  return stripTrailingCRLF(Buffer.concat(chunks).toString("utf8"));
 }
 function makeSecretsDeps(cfg) {
   return {
@@ -31508,6 +31738,10 @@ function registerSecretsCommands(program3) {
     });
     if (!ok) process.exitCode = 1;
   }));
+  secrets.command("undeclare <key>").description("project-admin self-undeclare: retire a secrets-catalog entry for your own repo (catalog metadata only \u2014 never a value); declare's exact inverse (MMI-Hub#7524). Refuses (409) while a live vault value still exists for the key at any declared stage \u2014 delete the value first (`secrets rm`), then undeclare. A key that is not declared is a no-op, not an error.").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action((key, o) => withSecrets(async (d) => {
+    const ok = await secretsUndeclare(d, key, { repo: o.repo, json: o.json });
+    if (!ok) process.exitCode = 1;
+  }));
   secrets.command("verify <key>").description("validate a known provider secret without printing its value; a key with no configured provider verifier falls back to a value-free PRESENT/ABSENT reachability check (#3436)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--slug <slug>", "org-infra namespace (e.g. _org) for a granted org secret").action((key, o) => withSecrets(async (d) => {
     const ok = await secretsVerify(d, key, o);
     if (!ok) process.exitCode = 1;
@@ -33370,9 +33604,13 @@ function applyWaivers(checks, waivers) {
   const set = new Set(waivers);
   return checks.map((c) => !c.ok && set.has(c.label) ? { ...c, waived: true } : c);
 }
+var laneReasons = (doctor) => doctor.findings.filter((f) => (f.severity === "blocker" || f.code === "origin-unverified") && f.code !== SUITE_GUARD_CODE);
+function onlySuiteLeadOwned(doctor) {
+  return !doctor.ready && laneReasons(doctor).length === 0 && doctor.findings.some((f) => f.code === SUITE_GUARD_CODE);
+}
 function laneNotEvaluatedFromThisBranch(doctor) {
   if (doctor.ready) return void 0;
-  const reasons = doctor.findings.filter((f) => f.severity === "blocker" || f.code === "origin-unverified");
+  const reasons = laneReasons(doctor);
   const only = reasons.length === 1 ? reasons[0] : void 0;
   return only?.code === "branch-mismatch" ? only.title : void 0;
 }
@@ -33383,7 +33621,7 @@ function attachTrainDoctorVerdicts(report, trainDoctors) {
   });
   return {
     ...report,
-    ok: report.ok && marked.every((doctor) => doctor.ready || doctor.notEvaluatedFromThisBranch !== void 0),
+    ok: report.ok && marked.every((doctor) => doctor.ready || doctor.notEvaluatedFromThisBranch !== void 0 || onlySuiteLeadOwned(doctor)),
     ...marked.length ? { trainDoctors: marked } : {}
   };
 }
@@ -33397,6 +33635,8 @@ function renderBootstrapVerifyReport(report) {
     lines2.push("", formatTrainDoctor(doctor));
     if (doctor.notEvaluatedFromThisBranch) {
       lines2.push(`  NOT EVALUATED from this branch \u2014 ${doctor.notEvaluatedFromThisBranch}; one checkout stands on one branch, so this lane does not fail the verify (#6677). Run \`mmi-cli devops train doctor --lane ${doctor.lane}\` from that branch for its own verdict.`);
+    } else if (onlySuiteLeadOwned(doctor)) {
+      lines2.push("  SUITE MEMBER: this lane is run from the suite lead (mmi-cli devops suite rcand|release), so suite-member-solo does not fail the verify (#7511).");
     }
   }
   return lines2.join("\n");
@@ -33863,7 +34103,7 @@ function registerBootstrapCommands(program3) {
     }
     const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
-    const readFile9 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
+    const readFile10 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
       const tmp = (0, import_node_path28.join)((0, import_node_os17.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
@@ -34019,7 +34259,7 @@ function registerBootstrapCommands(program3) {
             registryMeta?.requiredCheckBranches,
             registryMeta?.requiredChecks
           );
-          const rendered = resolveSeedContent(gateSeed, gateVars, readFile9);
+          const rendered = resolveSeedContent(gateSeed, gateVars, readFile10);
           if (rendered === null || missingPlaceholders(rendered).length) return failGraceful("bootstrap apply: registry gate template is unreadable or has unfilled placeholders");
           const base = (await readTargetedSeedFiles(repo, scopedPlan, onlyTarget, scopedPlan.baseSha, controlClient)).base?.content ?? null;
           configGateAction = planGateFromConfig(base, rendered);
@@ -34123,7 +34363,7 @@ function registerBootstrapCommands(program3) {
             ...vars,
             ...registryMeta?.requiredChecks?.length ? { GATE_RULESET_CONTEXTS_JSON: rulesetVars.GATE_RULESET_CONTEXTS_JSON } : {},
             ...registryMeta?.requiredCheckBranches?.length ? { GATE_RULESET_BRANCH_REFS_JSON: rulesetVars.GATE_RULESET_BRANCH_REFS_JSON } : {}
-          } : vars, readFile9, preservedContent);
+          } : vars, readFile10, preservedContent);
           if (!writeContent.ok) {
             return fail(`bootstrap apply: ${resolved.target}: ${writeContent.reason} \u2014 refusing to overwrite repo-owned content`);
           }
@@ -34278,7 +34518,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
       }
       const rulesetSeed = repo.toLowerCase() === "mutmutco/mmi-hub" ? void 0 : manifest.seeds.find((s) => s.target === ".github/rulesets/mmi-product-required-checks.json");
       if (rulesetSeed) {
-        const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile9);
+        const rulesetContent = resolveSeedContent({ ...rulesetSeed, target: rulesetSeed.target.replace("{{REPO_SLUG}}", slug) }, vars, readFile10);
         if (rulesetContent) {
           try {
             const client = controlClient;
@@ -35139,6 +35379,16 @@ function pathOf(url) {
   }
 }
 var bundlesOf = (members) => Object.fromEntries(members.map((m) => [m.id, m.bundles]));
+async function holdSplit(deps, modules) {
+  const pairs = await Promise.all(modules.map(async (m) => [m, await deps.hold(m)]));
+  return {
+    active: pairs.filter(([, hold]) => !hold).map(([m]) => m),
+    held: pairs.flatMap(([m, hold]) => hold ? [{ id: m.id, repo: m.repo, reason: hold.reason, ...hold.since ? { since: hold.since } : {} }] : [])
+  };
+}
+function heldMatches(recorded, now) {
+  return recorded.length === now.length && now.every((h) => recorded.some((r) => r.id === h.id && r.repo === h.repo));
+}
 function suiteReleaseTag(rc) {
   if (!RC_TAG.test(rc)) throw new Error(`invalid rc tag ${rc}`);
   return rc.replace(/-rc\.\d+$/, "");
@@ -35157,7 +35407,7 @@ function readSuiteCut(path2) {
   } catch {
     throw new Error(`suite cut record unreadable at ${path2}; repair it, never recut`);
   }
-  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
+  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.heldMembers !== void 0 && (!Array.isArray(record.heldMembers) || record.heldMembers.some((h) => !h.id || !h.repo || typeof h.reason !== "string" || !h.reason.trim() || h.since !== void 0 && typeof h.since !== "string" || record.members.some((m) => m.id === h.id))) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
     throw new Error(`suite cut record has unknown or invalid state at ${path2}; repair it, never recut`);
   return record;
 }
@@ -35212,8 +35462,10 @@ async function suiteRcand(deps, opts) {
   if (!opts.ownerGo) throw new Error("suite rcand requires --owner-go (rc uses live data); nothing was written");
   const members = suiteMembers(await deps.registry());
   const modules = members.filter((m) => m.repo !== SUITE_REPO);
+  const { active, held } = await holdSplit(deps, modules);
+  const heldById = new Map(held.map((h) => [h.id, h]));
   const plan = [
-    ...modules.map((m) => `${m.repo}: normal rcand + module-rc-publish.yml (once)`),
+    ...modules.map((m) => heldById.has(m.id) ? `${m.repo}: HELD: ${heldById.get(m.id).reason}` : `${m.repo}: normal rcand + module-rc-publish.yml (once)`),
     `${SUITE_REPO}: one PR for both rc/main pins, wait for merge`,
     `${SUITE_REPO}: rcand`
   ];
@@ -35233,7 +35485,7 @@ async function suiteRcand(deps, opts) {
     const [leadDevelopment, leadPreviousRc, snapshots] = await Promise.all([
       deps.head(SUITE_REPO, "development"),
       deps.head(SUITE_REPO, "rc"),
-      Promise.all(modules.map(async (m) => {
+      Promise.all(active.map(async (m) => {
         const [backend, development, rcHead] = await Promise.all([deps.backend(m), deps.head(m.repo, "development"), deps.head(m.repo, "rc")]);
         const previousRc = rcHead ?? await deps.head(m.repo, "main");
         if (!backend.version || !backend.host || !development || !SHA2.test(development) || !previousRc || !SHA2.test(previousRc)) throw new Error(`${m.repo}: live backend or branch snapshot is unproven; no cut started`);
@@ -35241,12 +35493,14 @@ async function suiteRcand(deps, opts) {
       }))
     ]);
     if (!leadDevelopment || !leadPreviousRc || !SHA2.test(leadDevelopment) || !SHA2.test(leadPreviousRc)) throw new Error("MM-Work development/rc SHA unproven; no cut started");
-    const created = { schema: SCHEMA, lead: SUITE_REPO, leadDevelopment, leadPreviousRc, members: snapshots };
+    const created = { schema: SCHEMA, lead: SUITE_REPO, leadDevelopment, leadPreviousRc, members: snapshots, ...held.length ? { heldMembers: held } : {} };
     writeSuiteCut(deps.recordPath, created);
     record = created;
   }
   if (!record) throw new Error("suite cut record unavailable after initialization");
-  if (record.members.length !== modules.length || modules.some((m) => !record.members.some((r) => r.repo === m.repo && r.id === m.id)))
+  if (!heldMatches(record.heldMembers ?? [], held))
+    throw new Error("suite hold changed since cut began; finish or abandon this cut, then re-cut with the new holds");
+  if (record.members.length !== active.length || active.some((m) => !record.members.some((r) => r.repo === m.repo && r.id === m.id)))
     throw new Error("suite roster changed since cut began; refuse to omit or add a member");
   const quiet = [];
   for (const member of record.members) {
@@ -35316,7 +35570,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
   }
   const pins = suitePins(record, bundlesOf(modules));
   await deps.verifyLeadCut(record.leadDevelopment);
-  const pr = await deps.pin({ cut: record.leadDevelopment, pins });
+  const pr = await deps.pin({ cut: record.leadDevelopment, pins, heldIds: record.heldMembers?.map((h) => h.id) });
   await deps.verifyLeadCut(record.leadDevelopment);
   if (record.pinPr && record.pinPr !== pr.pr) throw new Error(`pin PR changed from ${record.pinPr} to ${pr.pr}; stop`);
   record.pinPr = pr.pr;
@@ -35333,12 +35587,14 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
   }
   return { plan, record };
 }
-async function suiteRelease(deps, ownerGo) {
+async function suiteRelease(deps, ownerGo, big = false) {
   if (!ownerGo) throw new Error("suite release requires --owner-go; nothing was written");
   const record = readSuiteCut(deps.recordPath);
   if (!record?.pinMerged || !record.leadRcTag) throw new Error("no completed suite rc cut and merged pin PR; release refused");
   const members = suiteMembers(await deps.registry()).filter((m) => m.repo !== SUITE_REPO);
-  if (members.length !== record.members.length || members.some((m) => !record.members.some((r) => r.repo === m.repo && r.id === m.id))) throw new Error("suite roster changed after the cut; release refused");
+  const { active, held } = await holdSplit(deps, members);
+  if (!heldMatches(record.heldMembers ?? [], held)) throw new Error("suite hold changed after the cut; release refused");
+  if (active.length !== record.members.length || active.some((m) => !record.members.some((r) => r.repo === m.repo && r.id === m.id))) throw new Error("suite roster changed after the cut; release refused");
   await deps.verifyPins(suitePins(record, bundlesOf(members)), record.leadRcTag);
   for (const member of record.members) {
     if (member.carried) {
@@ -35384,7 +35640,7 @@ Each member's live release must serve <data>/main/module.js at its main pin path
         console.warn(`${member.repo}: released as ${member.releasedAs ?? suiteReleaseTag(member.tag)} and hotfixed to ${member.hotfixedTo}, which is live; recorded as released (#7482)`);
       } else {
         if (member.releasedAs && member.releasedAs !== suiteReleaseTag(member.tag)) console.warn(`${member.repo}: its rc already shipped as ${member.releasedAs}, not ${suiteReleaseTag(member.tag)}; finishing that release (#7464)`);
-        await deps.release(member.repo, member.releasedAs ?? suiteReleaseTag(member.tag), member.sha);
+        await deps.release(member.repo, member.releasedAs ?? suiteReleaseTag(member.tag), member.sha, { suiteTag: suiteReleaseTag(record.leadRcTag) });
       }
       member.released = true;
       writeSuiteCut(deps.recordPath, record);
@@ -35396,7 +35652,7 @@ Each member's live release must serve <data>/main/module.js at its main pin path
     }
   }
   if (!record.leadReleased) {
-    await deps.release(SUITE_REPO, suiteReleaseTag(record.leadRcTag), record.leadRcSha);
+    await deps.release(SUITE_REPO, suiteReleaseTag(record.leadRcTag), record.leadRcSha, { big });
     record.leadReleased = true;
     writeSuiteCut(deps.recordPath, record);
   }
@@ -35424,14 +35680,14 @@ var import_node_path43 = require("node:path");
 init_cli_shared();
 
 // src/command-register-train-operations.ts
-var import_promises8 = require("node:fs/promises");
+var import_promises9 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
 init_client_version();
 init_house_map();
 
 // src/hotfix-apply.ts
-var import_promises4 = require("node:fs/promises");
+var import_promises5 = require("node:fs/promises");
 
 // src/release-announce.ts
 var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
@@ -36400,7 +36656,7 @@ async function runHotfixReleaseLocked(deps, versionInput, options, doctor) {
     }
     let lines2;
     try {
-      lines2 = summaryFileLines(await (deps.readFile ?? ((p) => (0, import_promises4.readFile)(p, "utf8")))(options.announceSummaryFile));
+      lines2 = summaryFileLines(await (deps.readFile ?? ((p) => (0, import_promises5.readFile)(p, "utf8")))(options.announceSummaryFile));
     } catch (e) {
       throw new Error(`could not read --announce-summary-file ${options.announceSummaryFile}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`);
     }
@@ -36451,6 +36707,7 @@ ${decision.note}`);
     await deps.run("gh", ["release", "create", tag, "--repo", ctx.repo, "--target", "main", "--generate-notes", "--latest"]);
     releaseNote = `Release ${tag} created (target main)`;
   }
+  await writePlainWordsSection(deps, options, ctx.repo, meta, tag);
   await recordHotfixPhase(ledger, anchors, "githubRelease", { state: "complete", sha: mergedSha, note: releaseNote }, "the immutable tag, the green wall, and origin/main");
   const prepared = prepareServedChannel(deps, { repo: ctx.repo, releaseSha: mergedSha, watch: true });
   const runs = [];
@@ -37775,8 +38032,8 @@ function annotateChangeMeaning(changed, policy, read) {
 function isMeaningfulRow(file) {
   return file.meaningful !== false;
 }
-function loadPolicy(root, readFile9 = readFileOrNull2) {
-  const raw = readFile9((0, import_node_path30.join)(root, POLICY_FILE));
+function loadPolicy(root, readFile10 = readFileOrNull2) {
+  const raw = readFile10((0, import_node_path30.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   return parsePolicy(raw, POLICY_FILE);
 }
@@ -38724,12 +38981,16 @@ function releaseProgressVerdict(status, subject = "Release") {
 }
 
 // src/suite-pin.ts
-var import_promises5 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 var import_node_path34 = require("node:path");
 async function openSuiteCutPinPr(deps, input) {
   if (!/^[a-f0-9]{40}$/.test(input.cut) || !input.pins.length) throw new Error("suite pin PR needs an anchored cut and at least one module");
   const ids = input.pins.map((p) => p.module);
   if (new Set(ids).size !== ids.length) throw new Error("suite pin PR contains a duplicate module");
+  const heldIds = input.heldIds ?? [];
+  if (new Set(heldIds).size !== heldIds.length) throw new Error("suite pin PR contains a duplicate held member");
+  const covered = [...ids, ...heldIds];
+  if (new Set(covered).size !== covered.length) throw new Error("suite pin PR holds a member it also pins");
   const branch = `suite-pin/cut-${input.cut.slice(0, 16)}`;
   const registry2 = async (ref = "development") => {
     const get = JSON.parse(await deps.run("gh", ["api", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=${encodeURIComponent(ref)}`]));
@@ -38740,7 +39001,7 @@ async function openSuiteCutPinPr(deps, input) {
   try {
     const rows = await registry2();
     const members = suiteMembers(rows).filter((m) => m.repo !== SUITE_REPO);
-    if (members.length !== ids.length || members.some((m) => !ids.includes(m.id))) throw new Error("cut pins do not match the complete MM-Work roster");
+    if (members.length !== covered.length || members.some((m) => !covered.includes(m.id))) throw new Error("cut pins do not match the complete MM-Work roster");
     for (const pin of input.pins) {
       for (const url of [pin.rc, pin.main]) {
         const parsed = new URL(url);
@@ -38762,8 +39023,8 @@ async function openSuiteCutPinPr(deps, input) {
     });
     if (prs.length && matches(await registry2(branch))) return { status: "pending", pr: prs[0].url };
     if (!prs.length && matches(rows)) throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
-    await (0, import_promises5.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises5.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", prs.length ? branch : "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     if (prs.length) {
@@ -38776,7 +39037,7 @@ async function openSuiteCutPinPr(deps, input) {
     }
     for (const stage of ["rc", "main"]) {
       const path2 = (0, import_node_path34.join)(scratch, `${stage}-pins.json`);
-      await (0, import_promises5.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
+      await (0, import_promises6.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
     await run("git", ["add", "seed/modules.json"]);
@@ -38806,7 +39067,7 @@ async function openSuiteCutPinPr(deps, input) {
   } catch (e) {
     throw new Error(`suite cut pin PR FAILED: ${e.message}; merge/verify the single ${SUITE_REPO} development pin PR, then rerun the cut (never recut member tags)`);
   } finally {
-    if (scratch) await (0, import_promises5.rm)(scratch, { recursive: true, force: true });
+    if (scratch) await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
   }
 }
 async function openSuitePinPr(deps, input) {
@@ -38825,8 +39086,8 @@ async function openSuitePinPr(deps, input) {
     url.searchParams.set("v", tag);
     const pin = url.toString();
     const branch = `suite-pin/${stage}-${member.id}-${tag}`;
-    await (0, import_promises5.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
-    scratch = await (0, import_promises5.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
     await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
     const existing = JSON.parse(await run("gh", ["pr", "list", "--repo", SUITE_REPO, "--head", branch, "--state", "all", "--json", "url,state"]));
@@ -38864,14 +39125,14 @@ async function openSuitePinPr(deps, input) {
   } catch (e) {
     throw new Error(`suite pin PR FAILED for ${repo} ${tag}: ${e.message}; remedy: ${remedy}`);
   } finally {
-    if (scratch) await (0, import_promises5.rm)(scratch, { recursive: true, force: true });
+    if (scratch) await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
   }
 }
 
 // src/command-register-collaboration.ts
 var import_node_child_process17 = require("node:child_process");
 var import_node_fs42 = require("node:fs");
-var import_promises7 = require("node:fs/promises");
+var import_promises8 = require("node:fs/promises");
 init_clean_exit();
 init_cli_shared();
 init_error_codes();
@@ -40144,7 +40405,7 @@ function postMergeReconWarnings(input) {
 }
 
 // src/pr-commands.ts
-var import_promises6 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 init_cli_shared();
 init_error_codes();
 var GC_GH_TIMEOUT_MS2 = 2e4;
@@ -40298,10 +40559,10 @@ function registerPrLifecycleCommands(program3) {
     let body;
     try {
       if (o.title || o.titleFile) {
-        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises6.readFile, readStdin });
+        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
       }
       if (o.body || o.bodyFile) {
-        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
       }
     } catch (e) {
       return fail(`pr edit: ${e.message}`);
@@ -40331,7 +40592,7 @@ function registerPrLifecycleCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises6.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
     } catch (e) {
       return fail(`pr comment: ${e.message}`);
     }
@@ -42112,6 +42373,7 @@ function unlinkEscapingReparsePoints(root, primaryRoot) {
     try {
       entries = (0, import_node_fs40.readdirSync)(dir, { withFileTypes: true });
     } catch (e) {
+      if (e.code === "ENOENT") continue;
       return { ok: false, error: `cannot scan ${normPath2(dir)} for reparse points: ${errorMessage(e)}` };
     }
     for (const entry of entries) {
@@ -42691,34 +42953,6 @@ function renderResidueSweepLines(report) {
   return lines2;
 }
 
-// src/pr-deploy-dev.ts
-function slugOfRepo(repo) {
-  return repo.split("/")[1]?.toLowerCase() ?? "";
-}
-async function planDevDeployOnDevelopmentMerge(repo, baseRef, deps) {
-  if (baseRef !== "development") return { applicable: false, reason: "not-development-base" };
-  const slug = slugOfRepo(repo);
-  if (!slug) return { applicable: false, reason: "unreadable" };
-  let project2;
-  try {
-    project2 = await fetchProjectBySlug(slug, deps);
-  } catch {
-    return { applicable: false, reason: "unreadable" };
-  }
-  const model = project2?.deployModel;
-  if (!model || !isCentralDispatchModel(model)) return { applicable: false, reason: "not-tenant" };
-  return {
-    applicable: true,
-    // The issue's fallback ask, verbatim-shaped: the gap must be visible and actionable at the moment it opens.
-    manualPointer: `dev not redeployed \u2014 run \`mmi-cli devops runtime tenant redeploy ${repo} dev\``
-  };
-}
-async function dispatchDevDeploy(repo, deps) {
-  const res = await tenantDeploy({ repo, stage: "dev" }, deps);
-  if (res.ok) return { ok: true };
-  return { ok: false, detail: res.body?.error ?? res.error ?? `HTTP ${res.status}` };
-}
-
 // src/command-register-collaboration.ts
 var DEFAULT_PRIORITY = "medium";
 function argvWantsJson2() {
@@ -42916,7 +43150,7 @@ function registerCollaborationCommands(program3) {
       try {
         title = await resolveIssueTitle(
           { title: opts.title, titleFile: opts.titleFile },
-          { readFile: import_promises7.readFile, readStdin }
+          { readFile: import_promises8.readFile, readStdin }
         );
       } catch (e) {
         return fail(
@@ -42970,8 +43204,8 @@ function registerCollaborationCommands(program3) {
     let surfaceInferred;
     try {
       issueType = resolveCreateType(o.type, "issue create", o.label);
-      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
       if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
       priority = resolveCreatePriority(o.priority, "issue create");
       extraLabels = [...o.label ?? []];
@@ -43247,7 +43481,7 @@ function registerCollaborationCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
     } catch (e) {
       return fail(`issue comment: ${e.message}`);
     }
@@ -43307,8 +43541,8 @@ ${list}`);
     let title;
     const sourceRepo = o.repo ?? await resolveRepo(void 0);
     try {
-      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
       priority = resolveCreatePriority(o.priority, "report");
       if (!ISSUE_TYPES.includes(o.type)) {
         throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
@@ -43362,8 +43596,8 @@ ${list}`);
     let args;
     try {
       skill = assertSkillName(o.skill);
-      rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
-      const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
+      rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
+      const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
       title = buildSkillLessonTitle(skill, rawTitle);
       priority = resolveCreatePriority(o.priority, "skill-lesson");
       body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -43424,8 +43658,8 @@ ${list}`);
     let body;
     let title;
     try {
-      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises7.readFile, readStdin });
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises7.readFile, readStdin });
+      title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises8.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
     } catch (e) {
       return fail(`pr create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
     }
@@ -43930,7 +44164,7 @@ ${list}`);
         console.error(line);
       }
     }
-    const credential = await pollToken().catch(() => void 0) ? "app_installation" : "user";
+    const credential = "user";
     if (o.json) printLine(JSON.stringify({ ...result, credential }));
     else printLine(
       `pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""} (credential: ${credential})` + (result.branchFinality ? ` \u2014 ${result.branchFinality}` : "")
@@ -43960,8 +44194,6 @@ ${list}`);
     const baseRef = prMeta.base;
     const headRefOid = (prMeta.oid ?? "").trim() || void 0;
     if (!repoForPostCleanup) throw new Error("pr merge: cannot resolve target repository");
-    const devDeployDeps = repoForPostCleanup ? registryClientDeps(await loadConfig()) : void 0;
-    const devDeployPlan = repoForPostCleanup && devDeployDeps ? await planDevDeployOnDevelopmentMerge(repoForPostCleanup, baseRef, devDeployDeps).catch(() => ({ applicable: false, reason: "unreadable" })) : { applicable: false, reason: "unreadable" };
     const closingGuardInput = await withAlreadyClosedCommitTargets(
       await readClosingGuardInput(number, repoArgs, repoForPostCleanup, "pr merge"),
       async (n) => {
@@ -44191,7 +44423,6 @@ ${list}`);
       const enqueued = describePrMergeEnqueuedReason(await pollGhPrChecks(number, repoArgs).catch(() => void 0));
       console.log(JSON.stringify({ mergeStatus: "auto-merge-enqueued", enqueuedReason: enqueued.reason, pr: number, branch: headRef, state: state || "unknown", upgradedToAuto: upgradedToAuto || void 0 }));
       console.warn(`pr merge: PR #${number} is ENQUEUED, not merged \u2014 ${enqueued.message}.`);
-      if (devDeployPlan.applicable) console.warn(`pr merge: ${devDeployPlan.manualPointer} once the merge lands (auto-merge does not redeploy the dev stage).`);
       if (upgradedToAuto && !o.auto) {
         console.warn(`pr merge: exiting ${PR_MERGE_ENQUEUED_EXIT_CODE} so a chained command does not treat this as a completed merge.`);
         process.exitCode = PR_MERGE_ENQUEUED_EXIT_CODE;
@@ -44301,8 +44532,6 @@ ${list}`);
     } else if (repoForPostCleanup) {
       clearPostMergeReconRecovery(process.cwd(), repoForPostCleanup, number);
     }
-    const devDeploy = devDeployPlan.applicable && devDeployDeps && remoteNotAttemptedReason !== "pr-already-merged" ? await dispatchDevDeploy(repoForPostCleanup, devDeployDeps) : void 0;
-    const devDeployManual = devDeployPlan.applicable ? devDeployPlan.manualPointer : void 0;
     let observedMethod;
     if (remoteNotAttemptedReason === "pr-already-merged" && repoForPostCleanup) {
       try {
@@ -44337,14 +44566,10 @@ ${list}`);
       ...boardAdvance.entries.length ? { boardAdvance: boardAdvance.entries } : {},
       boardAdvanceStatus: boardAdvance.status,
       ...crossRepoFilingIssue.status !== "not-applicable" ? { crossRepoFilingIssue } : {},
-      ...recovery ? { postMergeReconRecovery: recovery } : {},
-      ...devDeploy ? { devDeploy: devDeploy.ok ? { dispatched: true } : { dispatched: false, manual: devDeployManual } } : {}
+      ...recovery ? { postMergeReconRecovery: recovery } : {}
     }));
     for (const line of renderPrMergeCleanupLines(localCleanup)) console.warn(line);
     for (const line of renderResidueSweepLines(residueSweep)) console.warn(line);
-    if (devDeploy && !devDeploy.ok) {
-      console.error(`pr merge: ${devDeployManual} (${devDeploy.detail})`);
-    }
     for (const line of postMergeReconWarnings({
       context: "pr merge",
       boardAdvance,
@@ -44408,7 +44633,7 @@ function trainGitArgs(args) {
 async function announceSummaryRefusal(path2, isHub = false) {
   let lines2;
   try {
-    lines2 = summaryFileLines(await (0, import_promises8.readFile)(path2, "utf8"));
+    lines2 = summaryFileLines(await (0, import_promises9.readFile)(path2, "utf8"));
   } catch (e) {
     return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
   }
@@ -44445,9 +44670,8 @@ function trainApplyDeps() {
     trainWriter: (verb, cwd) => acquireTrainWriterLock(cwd, `mmi-cli devops ${verb}`),
     run: async (file, args) => {
       const timeout = file === "node" && args[1] === "prepare" ? NODE_PREPARE_TIMEOUT_MS : file === "node" && args[1] === "verify" ? NODE_VERIFY_TIMEOUT_MS : file === "npm" && (args[0] === "version" || args[0] === "ci" || args[0] === "install") ? NPM_FOLD_TIMEOUT_MS : file === "npm" ? NPM_TRAIN_TIMEOUT_MS : file === "bash" && /jerv-gateway-release-deploy\.sh$/.test(args[0] ?? "") ? JERV_GATEWAY_DEPLOY_TIMEOUT_MS : file === "git" && args[0] === "commit" ? GIT_COMMIT_TIMEOUT_MS : file !== "gh" ? GIT_TIMEOUT_MS : args[0] === "run" && args[1] === "watch" ? GH_RUN_WATCH_TIMEOUT_MS : GH_TRAIN_TIMEOUT_MS;
-      const watchToken = file === "gh" && args[0] === "run" && args[1] === "watch" ? await pollToken() : void 0;
       try {
-        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout, ...watchToken ? { env: { ...process.env, GH_TOKEN: watchToken } } : {} })).stdout;
+        return isWin3 && file === "npm" ? (await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout })).stdout : (await execFileP(file, file === "git" ? trainGitArgs(args) : args, { timeout })).stdout;
       } catch (e) {
         throw surfaceTrainSubprocessFailure(e, file, args);
       }
@@ -44517,8 +44741,8 @@ function trainApplyDeps() {
         }
         return body.status;
       },
-      readFile: (path2) => (0, import_promises8.readFile)(path2, "utf8"),
-      removeFile: (path2) => (0, import_promises8.unlink)(path2),
+      readFile: (path2) => (0, import_promises9.readFile)(path2, "utf8"),
+      removeFile: (path2) => (0, import_promises9.unlink)(path2),
       // #6521/#6523: the project's own release channel AND releaseLanguage, read from registry META in ONE
       // checked read. Same shape as fetchEdgeDomains below: a FAILED read refuses by name so the announce
       // note reports a failed read, never a project that configured nothing.
@@ -44846,7 +45070,8 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       { flags: "--abort", description: "with --apply, delete only a proven unpublished failed release candidate on any registered deploy model and restore local main for a same-version recut (#3944/#5650/#5657)" },
       { flags: "--supersede-deploy", description: "with --apply, master-approved closure of a content-caused failed deploy leg on a PUBLISHED release whose immutable tag can never deploy green \u2014 the next patch train then carries the fix (#6553); combined with --supersede-publish it closes BOTH content-caused legs in one approved closure (#6752)" },
       { flags: "--supersede-publish", description: "with --apply, master-approved closure of a content-caused failed publish leg on a fully PROMOTED release whose immutable tag can never publish green \u2014 a deferred Jerv-Hub operator-host Gateway deploy leg is run and verified as part of the closure \u2014 the next patch train then carries the fix (#6638/#6742); combined with --supersede-deploy it closes BOTH content-caused legs in one approved closure (#6752)" },
-      { flags: "--retry-publish <run-id>", description: "with --apply, retry one proven failed or cancelled Hub publish release run (#3949/#5797)" }
+      { flags: "--retry-publish <run-id>", description: "with --apply, retry one proven failed or cancelled Hub publish release run (#3949/#5797)" },
+      { flags: "--big", description: "marks this release big for the mm-work suite `## In plain words` section even though its patch tag alone would not read as one (#7510); automatic for a minor/major bump \u2014 this is only for a patch a project-admin wants surfaced as big" }
     ];
     for (const f of RELEASE_ONLY_FLAGS) {
       if (commandName === "release") {
@@ -44874,6 +45099,9 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.announceSummaryFile && commandName !== "release") {
         return fail(`${commandName}: --announce-summary-file applies only to release \u2014 rcand posts no release announcement. Run: mmi-cli devops release --announce-summary-file <path>`);
       }
+      if (o.big && commandName !== "release") {
+        return fail(`${commandName}: --big applies only to release \u2014 it marks the mm-work suite plain-words section, which only a Release carries. Run: mmi-cli devops release --big`);
+      }
       if (o.abort && commandName !== "release") {
         return fail(`${commandName}: --abort applies only to release \u2014 it rolls back a proven unpublished release tag. Run: mmi-cli devops release --abort --apply`);
       }
@@ -44916,7 +45144,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         if (o.abort) return fail("release: --supersede-deploy --supersede-publish and --abort are mutually exclusive \u2014 the closure is for a PUBLISHED release, abort only ever deletes a proven unpublished candidate");
         if (o.retryPublish) return fail("release: --supersede-deploy --supersede-publish cannot be combined with --retry-publish \u2014 a content-caused failure on the immutable tag cannot be retried green");
         if (!o.apply) return fail("release: --supersede-deploy --supersede-publish requires --apply after explicit master approval; nothing was written");
-        if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
+        if (o.watch || o.announceSummaryFile || o.ack || o.dev || o.big) {
           return fail("release: --supersede-deploy --supersede-publish accepts only --apply, --repo, --json and --out; it closes ledger legs and dispatches nothing");
         }
         if (o.repo) {
@@ -44933,7 +45161,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.retryPublish) {
         if (o.resume || o.abort) return fail("release: --retry-publish cannot be combined with --resume or --abort");
         if (!o.apply) return fail("release: --retry-publish requires --apply after explicit approval; nothing was written");
-        if (o.announceSummaryFile || o.ack || o.dev) return fail("release: --retry-publish accepts only --apply, --watch, --repo, --json and --out");
+        if (o.announceSummaryFile || o.ack || o.dev || o.big) return fail("release: --retry-publish accepts only --apply, --watch, --repo, --json and --out");
         if (o.repo) {
           const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli devops release --retry-publish ${o.retryPublish} --apply${o.watch ? " --watch" : ""}`);
           if (!guard.ok) return fail(`release: ${guard.message}`);
@@ -44957,7 +45185,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.abort) {
         if (o.resume) return fail("release: --abort and --resume are mutually exclusive \u2014 abort removes an unpublished tag while resume preserves and promotes it");
         if (!o.apply) return fail("release: --abort requires --apply after explicit approval; nothing was written");
-        if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
+        if (o.watch || o.announceSummaryFile || o.ack || o.dev || o.big) {
           return fail("release: --abort accepts only --apply, --repo, --json and --out; promotion flags cannot be combined with rollback");
         }
         if (o.repo) {
@@ -44976,7 +45204,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         if (o.abort) return fail("release: --supersede-deploy and --abort are mutually exclusive \u2014 the closure is for a PUBLISHED release, abort only ever deletes a proven unpublished candidate");
         if (o.retryPublish) return fail("release: --supersede-deploy cannot be combined with --retry-publish");
         if (!o.apply) return fail("release: --supersede-deploy requires --apply after explicit master approval; nothing was written");
-        if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
+        if (o.watch || o.announceSummaryFile || o.ack || o.dev || o.big) {
           return fail("release: --supersede-deploy accepts only --apply, --repo, --json and --out; it closes a ledger leg and dispatches nothing");
         }
         if (o.repo) {
@@ -44995,7 +45223,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         if (o.abort) return fail("release: --supersede-publish and --abort are mutually exclusive \u2014 the closure is for a PROMOTED release, abort only ever deletes a proven unpublished candidate");
         if (o.retryPublish) return fail("release: --supersede-publish cannot be combined with --retry-publish \u2014 a content-caused failure on the immutable tag cannot be retried green");
         if (!o.apply) return fail("release: --supersede-publish requires --apply after explicit master approval; nothing was written");
-        if (o.watch || o.announceSummaryFile || o.ack || o.dev) {
+        if (o.watch || o.announceSummaryFile || o.ack || o.dev || o.big) {
           return fail("release: --supersede-publish accepts only --apply, --repo, --json and --out; it closes a ledger leg and dispatches nothing");
         }
         if (o.repo) {
@@ -45023,7 +45251,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
           const raw = await withReleaseProgress(
             trainApplyDeps(),
             "Checking the existing release",
-            (deps) => runReleaseResume(deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, suiteSolo: o.suiteSolo })
+            (deps) => runReleaseResume(deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, suiteSolo: o.suiteSolo, big: o.big })
           );
           const result = raw.dispatch?.workflowRuns ? { ...raw, dispatch: { ...raw.dispatch, workflowRuns: raw.dispatch.workflowRuns.map(workflowRunWithEvidence) } } : raw;
           const projectInfoSync = await withReleaseProgress(
@@ -45087,7 +45315,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       if (o.apply) {
         try {
           const ack = (o.ack ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-          const apply = (deps) => runTrainApply(commandName, deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, ack, dev: o.dev, suiteSolo: o.suiteSolo });
+          const apply = (deps) => runTrainApply(commandName, deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, ack, dev: o.dev, suiteSolo: o.suiteSolo, big: o.big });
           const raw = await withReleaseProgress(trainApplyDeps(), commandName === "release" ? "Preparing release" : "Preparing release candidate", apply);
           const result = raw.workflowRuns ? { ...raw, workflowRuns: raw.workflowRuns.map(workflowRunWithEvidence) } : raw;
           let projectInfoSync;
@@ -45338,7 +45566,10 @@ function rcRunCauseFromLog(log) {
   const causes = [...new Set([...log.matchAll(/##\[error\](?!Process completed with exit code)([^\r\n]+)/g)].map((m) => m[1].trim()).filter(Boolean))];
   return causes.length ? `: ${causes.join("; ")}` : "";
 }
-function suiteTrainIo(root, summaryFile) {
+function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
+  return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
+}
+function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
   const recordPath = repoRuntimeStatePath(root, "suite", "cut.json");
   const base = (0, import_node_path43.join)(repoRuntimeStatePath(root, "suite"), "checkouts");
   const checkout = async (repo) => {
@@ -45386,6 +45617,17 @@ function suiteTrainIo(root, summaryFile) {
     if (!health.ok) throw new Error(`${member.repo}: live backend health could not be proved at ${url}; stop`);
     return { version: live.deployedTag, host };
   };
+  const hold = async (member) => {
+    const slug = member.repo.split("/")[1].toLowerCase();
+    const read = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
+    if (!read.ok) throw new Error(`${member.repo}: registry META unreadable for suiteHold (${read.error}); stop`);
+    const value = read.project?.suiteHold;
+    if (value === void 0 || value === null) return null;
+    const raw = value;
+    if (typeof raw.reason !== "string" || !raw.reason.trim())
+      throw new Error(`${member.repo}: registry META suiteHold is malformed; set it as {"reason":"...","since":"..."} or clear it with --unset suiteHold; stop`);
+    return { reason: raw.reason, ...typeof raw.since === "string" && raw.since ? { since: raw.since } : {} };
+  };
   const tagSha = async (repo, tag) => {
     try {
       return await gh(["api", `repos/${repo}/commits/${encodeURIComponent(tag)}`, "--jq", ".sha"]);
@@ -45432,8 +45674,9 @@ function suiteTrainIo(root, summaryFile) {
       return { tag: result.tag, sha: result.tagSha };
     }
   });
-  const release = async (repo, expected, rcSha) => inTrain(repo, async (deps) => {
+  const release = async (repo, expected, rcSha, opts) => inTrain(repo, async (deps) => {
     await prepareRcCheckout((args) => deps.run("git", args), repo);
+    const plainWords = { announceSummaryFile: memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles), big: opts?.big, suiteTag: opts?.suiteTag };
     const current = await tagSha(repo, expected);
     if (current) {
       await deps.run("git", ["fetch", "origin", "--tags"]);
@@ -45442,10 +45685,10 @@ function suiteTrainIo(root, summaryFile) {
       } catch {
         throw new Error(`${repo}: existing ${expected} does not carry this suite's rc SHA ${rcSha}; refuse stale release`);
       }
-      const result = await runReleaseResume(deps, { watch: true });
+      const result = await runReleaseResume(deps, { watch: true, ...plainWords });
       if (result.tag !== expected || result.state !== "aligned") throw new Error(`${repo}: release resume not complete at ${expected} (${result.tag}/${result.state})`);
     } else {
-      const result = await withEnv("MMI_RELEASE_VERSION", expected.replace(/^v/, ""), () => runTrainApply("release", deps, { watch: true }));
+      const result = await withEnv("MMI_RELEASE_VERSION", expected.replace(/^v/, ""), () => runTrainApply("release", deps, { watch: true, ...plainWords }));
       if (result.tag !== expected || result.deployStatus !== "success") throw new Error(`${repo}: release is not green at expected ${expected} (${result.tag}/${result.deployStatus})`);
     }
   });
@@ -45533,6 +45776,7 @@ function suiteTrainIo(root, summaryFile) {
     recordPath,
     registry: registry2,
     backend,
+    hold,
     head: async (repo, branch) => {
       try {
         return await gh(["api", `repos/${repo}/git/ref/heads/${branch}`, "--jq", ".object.sha"]);
@@ -45596,6 +45840,15 @@ function suiteTrainIo(root, summaryFile) {
 // src/suite-commands.ts
 init_cli_shared();
 var import_node_fs44 = require("node:fs");
+function parseMemberSummaryFiles(entries) {
+  const memberSummaryFiles = {};
+  for (const entry of entries) {
+    const eq = entry.indexOf("=");
+    if (eq < 0) throw new Error(`--member-summary-file expects <owner/repo>=<path>, got ${entry}`);
+    memberSummaryFiles[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return memberSummaryFiles;
+}
 function registerSuiteCommands(program3) {
   const suite = program3.command("suite").description("MM-Work suite status, candidate cut and release (#7262/#7263)");
   const leadRoot = async () => {
@@ -45643,23 +45896,25 @@ function registerSuiteCommands(program3) {
       return fail(`suite abandon: ${e.message}`);
     }
   });
-  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train").option("--json", "structured receipt").action(async (o) => {
+  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: a member's OWN plain-words summary (#7510) \u2014 never the suite lead's summary reused; a member with no entry still ships, with the coordinator-ruled no-change line", (val, prev = []) => [...prev, val], []).option("--big", "marks MM-Work's own release big for the plain-words section (#7510); a member is never marked big through this flag \u2014 it is big only via the read route's automatic minor/major detection").option("--json", "structured receipt").action(async (o) => {
     try {
       if (!o.ownerGo) throw new Error("suite release requires --owner-go; nothing was written");
       if (!o.announceSummaryFile) throw new Error("suite release requires --announce-summary-file before promoting any member");
       const lines2 = (0, import_node_fs44.readFileSync)(o.announceSummaryFile, "utf8").split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
       if (lines2.length < 3 || lines2.length > 6) throw new Error("suite release announcement needs 3\u20136 curated lines before promoting any member");
+      const memberSummaryFiles = parseMemberSummaryFiles(o.memberSummaryFile ?? []);
       const root = await leadRoot();
       const unlock = await acquireTrainWriterLock(root, "suite release");
       let result;
       try {
-        result = await suiteRelease(suiteTrainIo(root, o.announceSummaryFile), true);
+        result = await suiteRelease(suiteTrainIo(root, o.announceSummaryFile, memberSummaryFiles), true, o.big === true);
       } finally {
         await unlock();
       }
       console.log(o.json ? JSON.stringify(result, null, 2) : [
         `suite release: ${result.leadRcTag} \u2192 main`,
         ...result.members.map((m) => m.carried ? `  - ${m.repo}: carried, untouched` : `  - ${m.repo}: ${m.tag} \u2192 main ${m.released ? "released" : "pending"}`),
+        ...result.heldMembers?.length ? ["held (frozen live release, untouched):", ...result.heldMembers.map((h) => `  - ${h.repo}: HELD: ${h.reason}`)] : [],
         `  - MM-Work: ${result.leadReleased ? "released" : "pending"}; announcement: ${result.announcement}`
       ].join("\n"));
     } catch (e) {
@@ -48691,7 +48946,7 @@ function renderTrackToDirectResult(result) {
 }
 
 // src/schedules-commands.ts
-var import_promises9 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 init_clean_exit();
 init_github_client();
 init_cli_shared();
@@ -48885,9 +49140,9 @@ function registerSchedulesCommands(program3) {
           await failGraceful("org schedules --doc: refusing to regenerate the doc from an incomplete read (see warnings above).");
           return;
         }
-        const docText = await (0, import_promises9.readFile)(o.doc, "utf8");
+        const docText = await (0, import_promises10.readFile)(o.doc, "utf8");
         const spliced = spliceDoc(docText, renderDocSection(entries, now.toISOString()));
-        await (0, import_promises9.writeFile)(o.doc, spliced, "utf8");
+        await (0, import_promises10.writeFile)(o.doc, spliced, "utf8");
         reportParked(parkedLines);
         reportDrift(drift);
         console.log(`org schedules: wrote ${entries.length} entries into ${o.doc}`);
@@ -49625,7 +49880,7 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 // src/tenant-artifact.ts
 var import_node_crypto15 = require("node:crypto");
 var import_node_fs48 = require("node:fs");
-var import_promises10 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 var import_node_path46 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
@@ -49637,7 +49892,7 @@ async function sha256File(path2) {
 async function putTenantArtifact(repo, stage, inputPath, deps) {
   if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
   const path2 = (0, import_node_path46.resolve)(inputPath);
-  const info = await (0, import_promises10.stat)(path2);
+  const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
   const sha2562 = await sha256File(path2);
@@ -50119,7 +50374,7 @@ init_github_client();
 init_hub_auth();
 
 // src/schedules-lift-command.ts
-var import_promises11 = require("node:fs/promises");
+var import_promises12 = require("node:fs/promises");
 var import_node_path49 = require("node:path");
 init_clean_exit();
 init_cli_shared();
@@ -50142,14 +50397,14 @@ var RegistryUnreachableError = class extends Error {
 async function readWorkflowFiles(dir) {
   let names;
   try {
-    names = await (0, import_promises11.readdir)(dir);
+    names = await (0, import_promises12.readdir)(dir);
   } catch {
     return [];
   }
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises11.readFile)((0, import_node_path49.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises12.readFile)((0, import_node_path49.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -51876,6 +52131,7 @@ function ciAuditDeps2() {
     client: defaultGitHubClient(),
     listProjects: async () => fetchProjectsList(registryClientDeps(await cfgPromise)),
     getProjectMeta: async (slug) => fetchProjectBySlug(slug, registryClientDeps(await cfgPromise)),
+    getDeployFacts: async (slug) => fetchDeployFactsBySlug(slug, registryClientDeps(await cfgPromise)),
     // Continuous CI delivery (#1550): the gate re-seed renders from the Hub's on-disk seed templates.
     // Resolve from the installed package root so the reconcile works from any org repo checkout; when the
     // Hub root is not locatable (e.g. a global npm install without a local checkout), return null so the