@mutmutco/cli 4.5.77 → 4.5.79

package/dist/main.cjs

@@ -6986,6 +6986,24 @@ function findClaimedButUnregisteredClosings(text, closing, alreadyClosed = []) {
   }
   return [...claimed].filter((n) => !registered.has(n) && !closed.has(n));
 }
+function findLineStartClosings(text, repo) {
+  const found = /* @__PURE__ */ new Set();
+  let inFence = false;
+  for (const line of text.split(/\r?\n/)) {
+    if (FENCE_LINE_RE.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence || !LINE_START_CLOSING_RE.test(line)) continue;
+    const m = findClosingMentions(line)[0];
+    if (!m || m.negated || !Number.isInteger(m.issue) || m.issue <= 0) continue;
+    const link = /\[#\d+\]\(([^)\s]+)\)/.exec(line);
+    if (link && !(link[1] ?? "").toLowerCase().includes(`github.com/${repo.toLowerCase()}/issues/${m.issue}`)) continue;
+    found.add(m.issue);
+  }
+  const ambiguous = new Set(findCrossRepoAmbiguousClosings(text, [...found], repo));
+  return [...found].filter((n) => !ambiguous.has(n));
+}
 function claimedClosingWarning(unregistered, context = "pr merge") {
   const named = unregistered.map((n) => `#${n}`).join(", ");
   const first = `#${unregistered[0] ?? "N"}`;
@@ -14348,7 +14366,7 @@ var PRODUCT_PENDING_RULESET_PREFIX = "mmi-product-required-checks-pending-";
 var PRODUCT_GATE_CONTEXT = "gate";
 var PRODUCT_RULESET_PATH = ".github/rulesets/mmi-product-required-checks.json";
 function reseedProductRulesetStrictness(current, seed, declared = {}) {
-  const parse = (raw) => {
+  const parse2 = (raw) => {
     const policy2 = JSON.parse(raw);
     if (!policy2 || typeof policy2 !== "object" || Array.isArray(policy2) || policy2.name !== PRODUCT_RULESET_NAME || policy2.target !== "branch" || !Array.isArray(policy2.rules) || policy2.rules.some((r) => !r || typeof r !== "object" || Array.isArray(r) || typeof r.type !== "string")) {
       throw new Error("product ruleset must be a branch ruleset object with well-formed rules");
@@ -14360,11 +14378,11 @@ function reseedProductRulesetStrictness(current, seed, declared = {}) {
     }
     return { policy: policy2, parameters: parameters2 };
   };
-  const canonical = parse(seed);
+  const canonical = parse2(seed);
   const strict = canonical.parameters.strict_required_status_checks_policy;
   if (typeof strict !== "boolean") throw new Error("canonical product ruleset must declare boolean strictness");
   if (current === null) return seed;
-  const { policy, parameters } = parse(current);
+  const { policy, parameters } = parse2(current);
   let changed = parameters.strict_required_status_checks_policy !== strict;
   parameters.strict_required_status_checks_policy = strict;
   if (declared.requiredChecks) {
@@ -17231,10 +17249,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.77",
-    tag: "v4.5.77",
-    commit: "760ee9725625",
-    npm: "@mutmutco/cli@4.5.77"
+    version: "4.5.79",
+    tag: "v4.5.79",
+    commit: "542d3fde121b",
+    npm: "@mutmutco/cli@4.5.79"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17251,14 +17269,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.77"
+          v3Target: "v4.5.79"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.77 and redeploy the Hub Lambda from tag v4.5.77 (760ee9725625); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.77 (@mutmutco/cli@4.5.77, tag commit 760ee9725625 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.79 and redeploy the Hub Lambda from tag v4.5.79 (542d3fde121b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.79 (@mutmutco/cli@4.5.79, tag commit 542d3fde121b \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20053,12 +20071,12 @@ async function isStrayUnreleasedTag(deps, tag, remoteSha, repo) {
   return deps.run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"]).then(() => false).catch((e) => /not found|HTTP 404/i.test(e instanceof Error ? e.message : String(e)));
 }
 function cmpReleaseTag(a, b) {
-  const parse = (t) => {
+  const parse2 = (t) => {
     const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(t.trim());
     return m ? { major: +m[1], minor: +m[2], patch: +m[3] } : null;
   };
-  const left = parse(a);
-  const right = parse(b);
+  const left = parse2(a);
+  const right = parse2(b);
   if (!left || !right) throw new Error(`cmpReleaseTag expects vX.Y.Z tags, got ${a} vs ${b}`);
   return left.major - right.major || left.minor - right.minor || left.patch - right.patch;
 }
@@ -20072,10 +20090,10 @@ async function listRemoteReleaseTags(deps) {
   }
   return [...tags].sort(cmpReleaseTag);
 }
-async function assertComputedReleaseTagStillNext(deps, tag) {
+async function assertComputedReleaseTagStillNext(deps, tag, preOneZero = false) {
   if (!/^v\d+\.\d+\.\d+$/.test(tag)) return;
   const remote = await listRemoteReleaseTags(deps);
-  const newer = remote.filter((t) => cmpReleaseTag(t, tag) > 0);
+  const newer = remote.filter((t) => cmpReleaseTag(t, tag) > 0 && !(preOneZero && !t.startsWith("v0.")));
   if (newer.length === 0) return;
   const latest = newer[newer.length - 1];
   throw new Error(
@@ -21697,6 +21715,17 @@ Resume it:  ${resumeCommand}
   );
 }
 
+// src/pre-one-zero.ts
+function preOneZeroInForce(meta) {
+  return !!meta?.suite && meta.preOneZero !== false;
+}
+function assertPreOneZero(repo, meta, tag) {
+  if (preOneZeroInForce(meta) && /^v?[1-9]\d*\./.test(tag)) {
+    throw new Error(`${repo} is a ${meta.suite} suite member held on 0.x.y; ${tag} would be major >= 1. Only the owner lifts this: set registry META preOneZero to false. If the tag came from a stale scripts/next-version.mjs, propagate the current seed first (#7699).`);
+  }
+  return tag;
+}
+
 // src/train-doctor.ts
 var import_node_child_process9 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
@@ -24833,7 +24862,7 @@ async function runTrainDoctor(input) {
   let newestRemoteReleaseTag;
   try {
     remoteTags = tagNames(await runGitRemoteRead(train, ["ls-remote", "--tags", "origin", "refs/tags/v*"]));
-    const releaseTags = await listRemoteReleaseTags(train);
+    const releaseTags = (await listRemoteReleaseTags(train)).filter((t) => !preOneZeroInForce(meta) || t.startsWith("v0."));
     const latest = releaseTags[releaseTags.length - 1];
     newestRemoteReleaseTag = latest;
     if (latest) {
@@ -26055,7 +26084,7 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   let tagLedgerStarted = false;
   const recoveryInput = { repo: ctx.repo, tag, stage: "main", deployModel, meta, branchHints };
   try {
-    await assertComputedReleaseTagStillNext(deps, tag);
+    await assertComputedReleaseTagStillNext(deps, tag, preOneZeroInForce(meta));
     if (deployModel === "hub-serverless") {
       await deps.run("node", ["scripts/release-distribution.mjs", "assert-release-lineage", tag.replace(/^v/, ""), "--release-commit", releaseSha]);
     }
@@ -26200,12 +26229,12 @@ function resumeFollowUpOf(state) {
   return state === "aligned" ? "complete" : state;
 }
 function compareRcTagsNewestFirst(a, b) {
-  const parse = (tag) => {
+  const parse2 = (tag) => {
     const match = /^v(\d+)\.(\d+)\.(\d+)-rc\.(\d+)$/.exec(tag);
     return match ? match.slice(1).map(Number) : [];
   };
-  const left = parse(a);
-  const right = parse(b);
+  const left = parse2(a);
+  const right = parse2(b);
   for (let i = 0; i < 4; i++) {
     const delta = (right[i] ?? 0) - (left[i] ?? 0);
     if (delta !== 0) return delta;
@@ -26479,7 +26508,7 @@ Nothing was written. Inspect ${ledger.path} before retrying.`);
 async function runReleaseResumePipeline(deps, options, prepared) {
   const watch = options.watch ?? false;
   const { ctx, meta, branchHints, directTrack, deployModel } = prepared;
-  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((t) => t.trim()).filter((t) => /^v\d+\.\d+\.\d+$/.test(t));
+  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((t) => t.trim()).filter((t) => (preOneZeroInForce(meta) ? /^v0\.\d+\.\d+$/ : /^v\d+\.\d+\.\d+$/).test(t));
   const tag = tags[0];
   if (!tag) throw new Error("release --resume: no final v* release tag found \u2014 there is no release to resume");
   const tagSha = await probeRemoteTag(deps, tag);
@@ -26839,7 +26868,7 @@ async function runReleaseAbortLocked(deps, options) {
     throw new Error("release --abort must run from the primary checkout left on main by the failed train; nothing was written");
   }
   await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
-  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((tag2) => tag2.trim()).filter((tag2) => /^v\d+\.\d+\.\d+$/.test(tag2));
+  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((tag2) => tag2.trim()).filter((tag2) => (preOneZeroInForce(meta) ? /^v0\.\d+\.\d+$/ : /^v\d+\.\d+\.\d+$/).test(tag2));
   const tag = tags[0];
   if (!tag) throw new Error("release --abort found no final v* tag; nothing was written");
   const tagSha = await probeRemoteTag(deps, tag);
@@ -27024,7 +27053,7 @@ async function runTrainApplyPipeline(mode, input) {
       "nothing to promote: origin/development is not ahead of origin/rc"
     );
     const deployModel2 = await preflight(deps, ctx, "rc", meta);
-    const releaseBase = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
+    const releaseBase = requireValue(clean2(await nextVersion(deps, ctx, meta, "cycle")), "release base");
     const { tolerated: tolerated2, predicted: predicted2 } = await preflightMergeToMain(
       deps,
       deployModel2,
@@ -27049,7 +27078,7 @@ async function runTrainApplyPipeline(mode, input) {
       else await mergeWithToleratedResolution(deps, "development", "development -> rc", "theirs", tolerated2);
       rcSha = requireValue(clean2(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
       resume = await resolveRcResumeTag(deps, releaseBase, rcSha, rcTagProbe);
-      tag2 = resume.tag ?? requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+      tag2 = resume.tag ?? requireValue(clean2(await nextVersion(deps, ctx, meta, "rc")), "rc tag");
       requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
       assertTagAddressableRequiredContexts(deps, requiredChecks, ctx.repo);
       const anchors2 = { repo: ctx.repo, tag: tag2, tagSha: rcSha };
@@ -27129,7 +27158,7 @@ ${spent.note}`), rcandRecovery(tag2));
       "nothing to release: origin/development is not ahead of origin/main"
     );
     const deployModel2 = await preflight(deps, ctx, "main", meta);
-    const tag2 = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
+    const tag2 = requireValue(clean2(await nextVersion(deps, ctx, meta, "cycle")), "release tag");
     const rcShaAtRelease = !directTrack && hasRcBranch ? clean2(await deps.run("git", ["rev-parse", "origin/rc"])) : "";
     const { foldPaths: foldPaths2, tolerated: tolerated2, predicted: predicted2 } = await preflightMergeToMain(
       deps,
@@ -27247,7 +27276,7 @@ ${spent.note}`), rcandRecovery(tag2));
     );
   }
   const releasedRcSha = clean2(await deps.run("git", ["rev-parse", "origin/rc"]));
-  const tag = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
+  const tag = requireValue(clean2(await nextVersion(deps, ctx, meta, "release")), "release tag");
   const tagProbe = { remoteSha: await probeRemoteTag(deps, tag) };
   const preFold = {};
   const { versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, "mmi-cli devops release --apply", async () => {
@@ -27306,19 +27335,23 @@ ${spent.note}`), rcandRecovery(tag2));
     ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {}
   };
 }
-async function latestLocalReleaseTag(deps, mergedInto) {
+async function nextVersion(deps, ctx, meta, mode) {
+  const held = preOneZeroInForce(meta);
+  return assertPreOneZero(ctx.repo, meta, clean2(await deps.run("node", ["scripts/next-version.mjs", mode, ...held ? ["--pre-one-zero"] : []])));
+}
+async function latestLocalReleaseTag(deps, mergedInto, preOneZero = false) {
   const tags = clean2(await deps.run("git", ["tag", "--list", "v*", ...mergedInto ? ["--merged", mergedInto] : []])).split("\n");
   let latest = { major: 0, minor: 0, patch: 0 };
   for (const tag of tags) {
     const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
-    if (!m) continue;
+    if (!m || preOneZero && m[1] !== "0") continue;
     const v = { major: +m[1], minor: +m[2], patch: +m[3] };
     const delta = v.major - latest.major || v.minor - latest.minor || v.patch - latest.patch;
     if (delta > 0) latest = v;
   }
   return latest;
 }
-async function resolveTrainBumpIntent(deps, env = process.env, latestRelease) {
+async function resolveTrainBumpIntent(deps, env = process.env, latestRelease, preOneZero = false) {
   const explicitIntent = (env.MMI_BUMP_INTENT ?? "").trim();
   if (explicitIntent) {
     if (!TRAIN_BUMP_INTENTS.includes(explicitIntent)) {
@@ -27331,7 +27364,8 @@ async function resolveTrainBumpIntent(deps, env = process.env, latestRelease) {
     const m = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(explicitVersion);
     if (!m) throw new Error(`MMI_RELEASE_VERSION must be X.Y.Z (got ${explicitVersion})`);
     const explicit = { major: +m[1], minor: +m[2], patch: +m[3] };
-    const latest = latestRelease ?? await latestLocalReleaseTag(deps);
+    if (preOneZero && explicit.major >= 1) throw new Error(`MMI_RELEASE_VERSION ${explicitVersion} is major >= 1 but this suite member is held on 0.x.y; only the owner lifts it (registry META preOneZero=false) (#7699)`);
+    const latest = latestRelease ?? await latestLocalReleaseTag(deps, void 0, preOneZero);
     const delta = explicit.major - latest.major || explicit.minor - latest.minor || explicit.patch - latest.patch;
     if (delta <= 0) {
       throw new Error(
@@ -27342,8 +27376,8 @@ async function resolveTrainBumpIntent(deps, env = process.env, latestRelease) {
   }
   return "patch";
 }
-async function resolveHotfixVersion(deps, env = process.env) {
-  const latest = await latestLocalReleaseTag(deps, "origin/main");
+async function resolveHotfixVersion(deps, env = process.env, preOneZero = false) {
+  const latest = await latestLocalReleaseTag(deps, "origin/main", preOneZero);
   if (latest.major === 0 && latest.minor === 0 && latest.patch === 0) {
     throw new Error("no vX.Y.Z release tag found on origin/main \u2014 cannot derive the hotfix PATCH version");
   }
@@ -27355,14 +27389,14 @@ async function resolveHotfixVersion(deps, env = process.env) {
     declared.push({
       name: "MMI_BUMP_INTENT",
       value: explicitIntent,
-      intent: await resolveTrainBumpIntent(deps, { MMI_BUMP_INTENT: explicitIntent }, latest)
+      intent: await resolveTrainBumpIntent(deps, { MMI_BUMP_INTENT: explicitIntent }, latest, preOneZero)
     });
   }
   if (explicitVersion) {
     declared.push({
       name: "MMI_RELEASE_VERSION",
       value: explicitVersion,
-      intent: await resolveTrainBumpIntent(deps, { MMI_RELEASE_VERSION: explicitVersion }, latest)
+      intent: await resolveTrainBumpIntent(deps, { MMI_RELEASE_VERSION: explicitVersion }, latest, preOneZero)
     });
   }
   const nonPatch = declared.find((d) => d.intent !== "patch");
@@ -27386,8 +27420,8 @@ async function runTrainApplyLocked(command, deps, options = {}) {
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
   await runGitRemoteRead(deps, ["fetch", "origin"]);
-  const bumpIntent = await resolveTrainBumpIntent(deps);
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+  const bumpIntent = await resolveTrainBumpIntent(deps, process.env, void 0, preOneZeroInForce(meta));
   const branchHints = await loadReleaseTrackBranchHints(deps);
   const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
   const pipelineInput = { deps, ctx, command, meta, branchHints, watch, options, bumpIntent };
@@ -32604,6 +32638,7 @@ function assignWaves(repos, canarySlug) {
 function statusFor(read, currentSha) {
   if (!read) return { status: "pending", record: {} };
   if (read.drift === "match") return { status: "match", record: { mergeSha: read.pr?.mergeSha } };
+  if (read.prUnread) return { status: "red", record: {} };
   const pr = read.pr;
   if (!pr) return { status: "pending", record: {} };
   if (pr.sourceSha && pr.sourceSha !== currentSha) return { status: "pending", record: {} };
@@ -35056,9 +35091,10 @@ LIVE apply to ${repo}:
       desiredByRepo.set(r.repo, desired);
       const drift = compareSeedBytes(desired, content);
       let pr;
+      let prUnread = false;
       try {
         const listBranchPrs = async (branch) => {
-          const listed = await gh2(["pr", "list", "--repo", r.repo, "--head", branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit,body,files", "--limit", "100"]);
+          const listed = await gh2(["pr", "list", "--repo", r.repo, "--head", branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit,body,files,headRefName", "--limit", "100"]);
           return JSON.parse(listed.stdout || "[]");
         };
         const targetSpecific = (await listBranchPrs(propagationBranch(r.repo, seed.target))).map((p2) => ({ ...p2, files: p2.files?.map((f) => f.path) }));
@@ -35073,11 +35109,19 @@ LIVE apply to ${repo}:
           const checks = rollup.length === 0 ? "none" : rollup.some((c) => c.conclusion === "FAILURE" || c.state === "FAILURE") ? "red" : rollup.every((c) => c.conclusion === "SUCCESS" || c.state === "SUCCESS") ? "success" : "pending";
           const sourceSha = p.body?.match(/Propagates MMI-Hub@([0-9a-fA-F]{7,40})/)?.[1];
           pr = { number: p.number, url: p.url, state: p.state === "MERGED" ? "merged" : p.state === "CLOSED" ? "closed" : "open", checks, mergeSha: p.mergeCommit?.oid, sourceSha };
+          if (pr.state === "open" && sourceSha && sourceSha !== seedSource.sha && p.headRefName) {
+            const head = await gh2(["api", `repos/${r.repo}/contents/${enc(seed.target)}?ref=${encodeURIComponent(p.headRefName)}`]);
+            const parsedHead = JSON.parse(head.stdout);
+            const headContent = parsedHead.encoding === "base64" && typeof parsedHead.content === "string" ? decodeGitHubContents(parsedHead.content) : null;
+            if (compareSeedBytes(desired, headContent) === "match") pr.sourceSha = seedSource.sha;
+          }
         }
-      } catch {
-        pr = void 0;
+      } catch (e) {
+        prUnread = true;
+        process.stderr.write(`bootstrap propagate: could not read ${r.repo}'s propagation PRs for ${seed.target}: ${e.message}
+`);
       }
-      reads.push({ repo: r.repo, drift: drift === "waived" ? "match" : drift, pr });
+      reads.push({ repo: r.repo, drift: drift === "waived" ? "match" : drift, pr, prUnread });
     }
     let functionGateSatisfied = !isWorkflowSeed;
     if (isWorkflowSeed && canarySlug) {
@@ -35593,10 +35637,41 @@ function formatSuiteStatus(report) {
 var import_node_fs29 = require("node:fs");
 var import_node_path29 = require("node:path");
 var import_node_crypto13 = require("node:crypto");
+
+// src/kit-version.ts
+var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
+function kitSatisfies(shell2, module2) {
+  const s = parse(shell2);
+  const m = parse(module2);
+  if (!s || !m) return true;
+  for (let i = 1; i <= 3; i++) if (Number(s[i]) !== Number(m[i])) return Number(s[i]) > Number(m[i]);
+  return !s[4] || Boolean(m[4]);
+}
+function kitFromBundle(js) {
+  const direct = /export\s+(?:const|let|var)\s+__kit\s*=\s*["']([^"']+)["']/.exec(js);
+  if (direct) return direct[1];
+  const local = /[{,]\s*([\w$]+)\s+as\s+__kit\b/.exec(js)?.[1];
+  if (!local) return void 0;
+  const name = local.replace(/[$]/g, "\\$&");
+  return new RegExp(`(?:^|[\\s;,{}])(?:const|let|var)?\\s*${name}\\s*=\\s*["']([^"']+)["']`).exec(js)?.[1];
+}
+function kitRefusals(shell2, modules) {
+  return modules.filter((m) => !kitSatisfies(shell2, m.kit)).map((m) => `${m.id}: built on kit ${m.kit}, newer than the MM-Work shell's kit ${shell2}`);
+}
+
+// src/suite-train.ts
 var SCHEMA = "mmi-suite-cut/v1";
 var SHA2 = /^[a-f0-9]{40}$/i;
 var RC_TAG = /^v\d+\.\d+\.\d+-rc\.\d+$/;
 var RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
+async function kitCheck(deps, shellSha, bundles, where) {
+  const shell2 = shellSha ? await deps.shellKit(shellSha) : void 0;
+  const kits = await Promise.all(bundles.map(async (b) => ({ id: b.id, kit: b.url ? await deps.bundleKit(b.url) : void 0 })));
+  const refused = kitRefusals(shell2, kits);
+  if (refused.length) throw new Error(`kit check (${where}) refused; a module built on a newer kit crashes the older shell. Release the newer kit to MM-Work first (or rebuild the module on the shell's kit):
+${refused.join("\n")}`);
+  return `kit check (${where}): shell kit ${shell2 ?? "unknown"}; ${kits.map((k) => `${k.id} __kit ${k.kit ?? "none"}`).join(", ") || "no modules"}`;
+}
 function suitePins(record, bundles) {
   return record.members.map((m) => m.carried ? { module: m.id, rc: m.rcPin, main: m.mainPin } : {
     module: m.id,
@@ -35708,6 +35783,8 @@ async function suiteRcand(deps, opts) {
     `${SUITE_REPO}: one PR for both rc/main pins, wait for merge`,
     `${SUITE_REPO}: rcand`
   ];
+  const lead = await deps.head(SUITE_REPO, "development");
+  plan.push(await kitCheck(deps, lead, active.map((m) => ({ id: m.id, url: m.bundles.dev })), "dev bundles"));
   if (opts.dryRun) return { plan };
   let record = readSuiteCut(deps.recordPath);
   if (record?.leadReleased && record.announcement === "pending") {
@@ -35829,6 +35906,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
       throw new Error(`${member.repo}: live backend or development changed during the cut; pins unchanged`);
   }
   const pins = suitePins(record, bundlesOf(modules));
+  await kitCheck(deps, record.leadDevelopment, pins.map((p) => ({ id: p.module, url: p.rc })), "rc bundles");
   await deps.verifyLeadCut(record.leadDevelopment);
   const pr = await deps.pin({ cut: record.leadDevelopment, pins, heldIds: record.heldMembers?.map((h) => h.id) });
   await deps.verifyLeadCut(record.leadDevelopment);
@@ -36610,7 +36688,7 @@ async function runHotfixStartLocked(deps, options, doctor) {
   await deps.run("git", ["fetch", "origin", "--tags"]);
   const { deployModel, meta } = await hotfixPreflight(deps, ctx, "start");
   const bumpNotes = [];
-  let resolved = await resolveHotfixVersion(deps);
+  let resolved = await resolveHotfixVersion(deps, process.env, preOneZeroInForce(meta));
   for (; ; ) {
     const priorPr = await findHotfixPr(deps, ctx, resolved.tag);
     if ((priorPr?.state ?? "").toUpperCase() !== "MERGED") break;
@@ -37793,7 +37871,6 @@ async function advanceClosedIssuesToDone(deps) {
       error: `expected an array of closing issue references, got ${closing === null ? "null" : typeof closing}`
     };
   }
-  if (closing.length === 0) return { status: "none", entries: [] };
   const refs = [];
   for (const [i, candidate] of closing.entries()) {
     const repo = repoOf2(candidate);
@@ -37807,6 +37884,29 @@ async function advanceClosedIssuesToDone(deps) {
     refs.push({ ref: candidate, repo });
   }
   const entries = [];
+  const fallbackNumbers = /* @__PURE__ */ new Set();
+  let fallbackError;
+  if (deps.fallback) {
+    try {
+      const registered = new Set(refs.filter((r) => r.repo.toLowerCase() === deps.repo.toLowerCase()).map((r) => r.ref.number));
+      for (const n of [...new Set(await deps.fallback.fetchClaimed())].filter((n2) => !registered.has(n2))) {
+        try {
+          const closed = await deps.fallback.closeIssue(n);
+          if ("error" in closed) entries.push({ issue: `#${n}`, moved: false, status: "failed", error: `GitHub did not register the closing reference and the CLI could not close it (${closed.error})` });
+          else if (closed.state === "closed") {
+            fallbackNumbers.add(n);
+            const [owner, name] = deps.repo.split("/");
+            refs.push({ ref: { number: n, repository: { name: name ?? "", owner: { login: owner ?? "" } } }, repo: deps.repo });
+          }
+        } catch (e) {
+          entries.push({ issue: `#${n}`, moved: false, status: "failed", error: `GitHub did not register the closing reference and the CLI could not close it (${e.message})` });
+        }
+      }
+    } catch (e) {
+      fallbackError = e.message;
+    }
+  }
+  if (refs.length === 0 && entries.length === 0) return { status: "none", entries: [], ...fallbackError ? { fallbackError } : {} };
   for (const { ref, repo } of refs) {
     if (repo.toLowerCase() !== deps.repo.toLowerCase()) {
       entries.push({
@@ -37847,14 +37947,15 @@ async function advanceClosedIssuesToDone(deps) {
       entries.push({ issue, moved: false, status: "failed", error: e.message });
     }
   }
-  return { status: entries.every((e) => e.moved) ? "ok" : "partial", entries };
+  for (const e of entries) if (fallbackNumbers.has(Number(e.issue.slice(1)))) e.closedByFallback = true;
+  return { status: entries.every((e) => e.moved) && !fallbackError ? "ok" : "partial", entries, ...fallbackError ? { fallbackError } : {} };
 }
 function boardAdvanceFailures(result) {
   return (result?.entries ?? []).filter((e) => !e.moved);
 }
 function boardAdvanceExitCode(result) {
   if (!result) return void 0;
-  if (result.status === "fetch-failed") return 1;
+  if (result.status === "fetch-failed" || result.fallbackError) return 1;
   return boardAdvanceFailures(result).length > 0 ? 1 : void 0;
 }
 function boardAdvanceFailureMessage(result) {
@@ -37863,6 +37964,7 @@ function boardAdvanceFailureMessage(result) {
     return `pr merge: could not read the PR's closing issues (${result.error ?? "unknown error"}) \u2014 the PR MERGED, but no board item was advanced. Check the board by hand.`;
   }
   const failures = boardAdvanceFailures(result);
+  if (result.fallbackError) return `pr merge: could not read the PR body to close unregistered closing lines (${result.fallbackError}) \u2014 the PR MERGED; check by hand whether its "Closes #N" issues are still open.`;
   if (!failures.length) return void 0;
   const named = failures.map((f) => f.error ? `${f.issue} (${f.error})` : f.issue).join(", ");
   return `pr merge: board advance incomplete for ${named} \u2014 the PR MERGED, but ${failures.length === 1 ? "this issue" : "these issues"} did not reach Done on the board.`;
@@ -38955,6 +39057,41 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
   }
   return advanceClosedIssuesToDone({
     repo,
+    // #7691: GitHub sometimes fails to register a body `Closes #N`, so the merge closes nothing. Close the
+    // still-OPEN issues the body claims on a deliberate line-start closing line (same repo only). GitHub closes
+    // only for PRs into the default branch, so a PR into rc/main (a train or hotfix PR) never falls back.
+    fallback: {
+      fetchClaimed: async () => {
+        const { stdout } = await execFileP("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "body,baseRefName"], { timeout: GC_GH_TIMEOUT_MS });
+        const { body, baseRefName } = JSON.parse(stdout || "null") ?? {};
+        if (typeof body !== "string" || typeof baseRefName !== "string") throw new Error("gh returned no PR body or base branch");
+        const repoView = await execFileP("gh", ["repo", "view", repo, "--json", "defaultBranchRef"], { timeout: GC_GH_TIMEOUT_MS });
+        const defaultBranch = JSON.parse(repoView.stdout || "null")?.defaultBranchRef?.name;
+        if (typeof defaultBranch !== "string" || !defaultBranch) throw new Error("gh returned no default branch");
+        if (baseRefName !== defaultBranch) return [];
+        return findLineStartClosings(body, repo);
+      },
+      closeIssue: async (n) => {
+        try {
+          const view = await execFileP("gh", ["issue", "view", String(n), "--repo", repo, "--json", "state"], { timeout: GC_GH_TIMEOUT_MS });
+          if (JSON.parse(view.stdout || "null")?.state !== "OPEN") return { state: "already-closed" };
+          await execFileP("gh", [
+            "issue",
+            "close",
+            String(n),
+            "--repo",
+            repo,
+            "--reason",
+            "completed",
+            "--comment",
+            `Closed by the CLI after PR #${prNumber} merged: its body says it closes this issue, but GitHub did not register the closing reference (#7691).`
+          ], { timeout: GH_MUTATION_TIMEOUT_MS });
+          return { state: "closed" };
+        } catch (e) {
+          return { error: e.message };
+        }
+      }
+    },
     fetchClosingIssues: async () => {
       const { stdout } = await execFileP("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "closingIssuesReferences"], { timeout: GC_GH_TIMEOUT_MS });
       const parsed = JSON.parse(stdout || "null");
@@ -44224,6 +44361,11 @@ ${list}`);
 `
       );
     }
+    const safeTitle = rewriteUnregisteredClosingKeywords(title, findClosingMentions(body).map((m) => m.issue));
+    if (safeTitle !== title) {
+      title = safeTitle;
+      process.stderr.write('pr create: WARNING \u2014 rewrote close-keyword text in the title to "part of #N": the squash commit subject would close it (#7688). Put closing keywords on a "Closes #N" body line.\n');
+    }
     const docsCheck = await checkDocsIndexAtHead({ repo: o.repo, head: o.head }, createPrCreateDocsIndexDeps());
     if (docsCheck && !docsCheck.ok) {
       return fail(`pr create: ${docsCheck.detail} \u2014 ${docsCheck.fix}`);
@@ -45171,7 +45313,7 @@ async function requireFreshTrainCli(commandName) {
   process.exit(converge.reexecCode);
 }
 var GH_TRAIN_TIMEOUT_MS = 3e4;
-var GH_RUN_WATCH_TIMEOUT_MS = 20 * 6e4;
+var GH_RUN_WATCH_TIMEOUT_MS = 90 * 6e4;
 var NODE_PREPARE_TIMEOUT_MS = 10 * 6e4;
 var NODE_VERIFY_TIMEOUT_MS = 5 * 6e4;
 var NPM_TRAIN_TIMEOUT_MS = 6e4;
@@ -46102,9 +46244,9 @@ function isMissingRef(message2) {
   return /404|Not Found|No commit found for SHA/.test(message2);
 }
 function releaseTagsFrom(out) {
-  const parse = (t) => t.slice(1).split(".").map(Number);
+  const parse2 = (t) => t.slice(1).split(".").map(Number);
   return out.split(/\s+/).filter((t) => /^v\d+\.\d+\.\d+$/.test(t)).sort((a, b) => {
-    const [x, y] = [parse(a), parse(b)];
+    const [x, y] = [parse2(a), parse2(b)];
     return x[0] - y[0] || x[1] - y[1] || x[2] - y[2];
   });
 }
@@ -46395,6 +46537,22 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
           throw new Error(`${pin.module}: MM-Work ${ref} pins do not equal the tested cut (${row?.bundles.main ?? "no main pin"} vs ${pin.main}); release refused`);
       }
     },
+    shellKit: async (sha) => {
+      await exec("git", ["fetch", "--quiet", "origin", "--tags"], root, WATCH_TIMEOUT);
+      try {
+        return (await exec("git", ["describe", "--tags", "--match", "ds-v[0-9]*", "--abbrev=0", sha], root)).replace(/^ds-v/, "") || void 0;
+      } catch {
+        return void 0;
+      }
+    },
+    bundleKit: async (url) => {
+      try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(GH_TIMEOUT) });
+        return res.ok ? kitFromBundle(await res.text()) : void 0;
+      } catch {
+        return void 0;
+      }
+    },
     release,
     shippedTag,
     sameContent: sameContent2,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.77",
+  "version": "4.5.79",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",