@mutmutco/cli 4.5.83 → 4.5.84

package/dist/main.cjs

@@ -3967,7 +3967,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
     const negativeNumberArg = (arg) => {
       if (!/^-(\d+|\d*\.\d+)(e[+-]?\d+)?$/.test(arg)) return false;
       return !this._getCommandAndAncestors().some(
-        (cmd) => cmd.options.map((opt) => opt.short).some((short) => /^-\d$/.test(short))
+        (cmd) => cmd.options.map((opt) => opt.short).some((short3) => /^-\d$/.test(short3))
       );
     };
     let activeVariadicOption = null;
@@ -17268,10 +17268,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.83",
-    tag: "v4.5.83",
-    commit: "d092dda5d5e6",
-    npm: "@mutmutco/cli@4.5.83"
+    version: "4.5.84",
+    tag: "v4.5.84",
+    commit: "86b566fd9857",
+    npm: "@mutmutco/cli@4.5.84"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17288,14 +17288,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.83"
+          v3Target: "v4.5.84"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.83 and redeploy the Hub Lambda from tag v4.5.83 (d092dda5d5e6); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.83 (@mutmutco/cli@4.5.83, tag commit d092dda5d5e6 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.84 and redeploy the Hub Lambda from tag v4.5.84 (86b566fd9857); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.84 (@mutmutco/cli@4.5.84, tag commit 86b566fd9857 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20287,6 +20287,10 @@ var SUITE_CUT_TOKEN = /* @__PURE__ */ Symbol("suite-cut");
 function suiteCutContext(repo, lead) {
   return { repo, lead, token: SUITE_CUT_TOKEN };
 }
+var SUITE_LEAD_TOKEN = /* @__PURE__ */ Symbol("suite-lead");
+function suiteLeadContext(lead) {
+  return { repo: lead, lead, token: SUITE_LEAD_TOKEN };
+}
 function validSuiteCutContext(repo, context) {
   return !!context && context.token === SUITE_CUT_TOKEN && context.repo.toLowerCase() === repo.toLowerCase();
 }
@@ -20300,7 +20304,12 @@ function isBundleOnlySuiteMember(repo, suite) {
 }
 function suiteMemberRefusal(repo, meta, lane, solo = false, cut) {
   const suite = meta?.suite;
-  if (!suite || !isBundleOnlySuiteMember(repo, suite)) return null;
+  if (!suite) return null;
+  if (!isBundleOnlySuiteMember(repo, suite)) {
+    if (solo || cut?.token === SUITE_LEAD_TOKEN && cut.repo.toLowerCase() === repo.toLowerCase()) return null;
+    const route = lane === "hotfix" ? "hotfix the affected member from its own checkout, then run mmi-cli devops suite release --owner-go" : `run mmi-cli devops suite ${lane} --owner-go`;
+    return `${repo} is the ${suite} suite lead; a plain ${lane} would cut it without its members: ${route}. A lead-only ${lane} needs --suite-solo --owner-go.`;
+  }
   if (authorisedSuiteCut(repo, meta, cut)) return null;
   if (lane !== "rcand" && solo) return null;
   return `${repo} is part of the ${suite} suite; run the suite cut/release from ${suiteLeadRepo(repo, suite)} (mmi-cli devops suite rcand|release). A solo backend release needs --suite-solo --owner-go.`;
@@ -35595,6 +35604,7 @@ init_github_client();
 init_cli_shared();
 
 // src/suite-status.ts
+var import_node_crypto13 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -35604,6 +35614,54 @@ var REPOS = {
   katip: "mutmutco/MMI-Katip"
 };
 var STAGES3 = ["dev", "rc", "main"];
+var MAPPING_MARKER = /<!-- mmi-suite-members (\{[^\n]*\}) -->/;
+function suiteMappingBlock(tag, mapping) {
+  const rows = Object.entries(mapping).map(([id, v]) => `- ${id}: ${v}`).join("\n");
+  return `<!-- mmi-suite-members ${JSON.stringify(mapping)} -->
+## Suite ${tag} members
+${rows}
+`;
+}
+function parseSuiteMapping(body) {
+  const raw = MAPPING_MARKER.exec(body ?? "")?.[1];
+  if (!raw) return void 0;
+  try {
+    const v = JSON.parse(raw);
+    return Object.values(v).every((x) => typeof x === "string") ? v : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var sha256 = (b) => (0, import_node_crypto13.createHash)("sha256").update(b).digest("hex");
+async function proveBundle(url, tag, fetchUrl) {
+  const get = async (u) => {
+    try {
+      return await fetchUrl(u);
+    } catch (e) {
+      return `unreachable (${e.message})`;
+    }
+  };
+  const bundle = await get(url);
+  if (typeof bundle === "string") return { state: "unprovable", detail: `bundle ${bundle}` };
+  if (bundle.status !== 200) return { state: "unprovable", detail: `bundle HTTP ${bundle.status}` };
+  const served = sha256(bundle.body);
+  const recordUrl = new URL(url);
+  recordUrl.search = "";
+  recordUrl.pathname = recordUrl.pathname.replace(/[^/]*$/, "module.json");
+  const rec = await get(recordUrl.toString());
+  if (typeof rec === "string") return { state: "unprovable", detail: `build record ${rec}; served ${served.slice(0, 12)}` };
+  if (rec.status !== 200) return { state: "unprovable", detail: `build record not served (HTTP ${rec.status}); served ${served.slice(0, 12)}` };
+  let record;
+  try {
+    record = JSON.parse(Buffer.from(rec.body).toString("utf8"));
+  } catch {
+    return { state: "unprovable", detail: `build record unreadable; served ${served.slice(0, 12)}` };
+  }
+  if (typeof record.tag !== "string" || typeof record.sha256 !== "string") return { state: "unprovable", detail: `build record malformed; served ${served.slice(0, 12)}` };
+  if (record.tag !== tag) return { state: "mismatch", detail: `host serves ${record.tag}, pinned ${tag}` };
+  if (record.sha256.toLowerCase() !== served) return { state: "mismatch", detail: `served ${served.slice(0, 12)}, pinned ${record.sha256.slice(0, 12)}` };
+  return { state: "proven", detail: `sha ${served.slice(0, 12)}` };
+}
 function suiteMembers(raw) {
   if (!Array.isArray(raw)) throw new Error("MM-Work seed/modules.json is unreadable");
   const members = [{ repo: SUITE_REPO, id: "mm-work", bundles: {} }];
@@ -35639,6 +35697,7 @@ async function stageStatus(member, stage, deps) {
   let served = "unknown";
   let source = "unknown";
   let commit;
+  let note;
   let deployStatus;
   const pin = stage !== "dev" ? bundleTag(member.bundles[stage]) : void 0;
   if (pin) {
@@ -35660,47 +35719,157 @@ async function stageStatus(member, stage, deps) {
     else {
       try {
         commit = await deps.tagCommit(member.repo, served);
+        if (!commit && stage === "main") note = `pin names no release (tag ${served} absent)`;
       } catch {
       }
     }
   }
-  const lag = commit && head !== "unknown" ? commit.toLowerCase() !== head.toLowerCase() : null;
+  let lag = commit && head !== "unknown" ? commit.toLowerCase() !== head.toLowerCase() : null;
+  let proof;
+  if (pin && stage !== "dev" && deps.fetchUrl) {
+    proof = await proveBundle(member.bundles[stage], pin, deps.fetchUrl);
+    if (proof.state === "mismatch") lag = true;
+  }
   return {
     stage,
     head,
     served,
     source,
-    lag: source === "registry-pin" && lag === false ? null : lag,
+    lag: source === "registry-pin" && lag === false && proof?.state !== "proven" ? null : lag,
+    ...proof ? { proof } : {},
+    ...note ? { note } : {},
     ...deployStatus ? { deployStatus } : {}
   };
 }
 async function readSuiteStatus(deps) {
   const members = suiteMembers(await deps.registry());
-  return {
-    suite: "mm-work",
-    members: await Promise.all(members.map(async (member) => ({
-      repo: member.repo,
-      id: member.id,
-      stages: await Promise.all(STAGES3.map((stage) => stageStatus(member, stage, deps)))
-    })))
-  };
+  const rows = await Promise.all(members.map(async (member) => ({
+    repo: member.repo,
+    id: member.id,
+    stages: await Promise.all(STAGES3.map((stage) => stageStatus(member, stage, deps)))
+  })));
+  if (!deps.leadTags || !deps.registryAt) return { suite: "mm-work", members: rows };
+  const tags = await deps.leadTags().catch(() => []);
+  const latest = (rc) => tags.filter((t) => /^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(t) && t.includes("-rc.") === rc).sort((a, b) => compareVersions(b, a))[0];
+  const leadTag = { rc: latest(true), main: latest(false) };
+  const lead = rows[0].stages;
+  for (const stage of ["rc", "main"]) {
+    const tag = leadTag[stage];
+    if (!tag) continue;
+    let pins = [];
+    try {
+      pins = suiteMembers(await deps.registryAt(tag));
+    } catch {
+    }
+    for (const row of rows.slice(1)) {
+      const st = row.stages.find((s) => s.stage === stage);
+      st.suitePin = { suite: tag, pin: bundleTag(pins.find((m) => m.id === row.id)?.bundles[stage]) };
+    }
+  }
+  const recorded = leadTag.main && deps.leadReleaseBody ? parseSuiteMapping(await deps.leadReleaseBody(leadTag.main).catch(() => null)) : void 0;
+  return { suite: "mm-work", lead: { dev: lead[0].head, rc: leadTag.rc ?? "n/a", main: leadTag.main ?? "unknown", ...recorded ? { members: recorded } : {} }, members: rows };
+}
+var short = (v) => /^[a-f0-9]{40}$/i.test(v) ? v.slice(0, 12) : v;
+var proofText = (p) => p ? p.state === "proven" ? "proven" : p.state === "mismatch" ? `mismatch (${p.detail})` : `unprovable (${p.detail})` : "";
+function formatSuiteMarkdown(report) {
+  const cell = (st) => !st || st.source === "n/a" ? "n/a" : short(st.served);
+  const by = (st, name) => st?.suitePin ? `${name} ${st.suitePin.suite}${st.suitePin.pin && st.suitePin.pin !== st.served ? ` (pins ${st.suitePin.pin})` : st.suitePin.pin ? "" : " (no pin)"}` : "";
+  const lines2 = ["| Member | dev | rc | main | Pinned by suite |", "| --- | --- | --- | --- | --- |"];
+  if (report.lead) lines2.push(`| MM-Work (suite) | ${short(report.lead.dev)} | ${report.lead.rc} | ${report.lead.main} | - |`);
+  for (const m of report.members.slice(report.lead ? 1 : 0)) {
+    const [dev, rc, main] = ["dev", "rc", "main"].map((s) => m.stages.find((x) => x.stage === s));
+    lines2.push(`| ${m.repo.split("/")[1]} | ${cell(dev)} | ${cell(rc)} | ${cell(main)} | ${[by(rc, "rc"), by(main, "main")].filter(Boolean).join(", ") || "-"} |`);
+  }
+  return lines2.join("\n");
 }
 function formatSuiteStatus(report) {
   const lines2 = [
     "suite mm-work \u2014 registry pins are declarations, tenant versions require a healthy probe",
+    ...report.lead ? [`suite version: dev ${short(report.lead.dev)}  rc ${report.lead.rc}  main ${report.lead.main}`] : [],
+    ...report.lead?.members ? [`suite ${report.lead.main} = members ${Object.entries(report.lead.members).map(([id, v]) => `${id} ${v}`).join(", ")} (recorded by suite hotfix, #7738)`] : [],
     "member             stage  head          served             source          lag"
   ];
   for (const member of report.members) for (const row of member.stages) {
     const served = /^[a-f0-9]{40}$/i.test(row.served) ? row.served.slice(0, 12) : row.served;
-    lines2.push(`${member.repo.split("/")[1].padEnd(18)} ${row.stage.padEnd(6)} ${row.head.slice(0, 12).padEnd(13)} ${served.padEnd(18)} ${row.source.padEnd(15)} ${row.source === "n/a" ? "n/a" : row.lag === null ? "?" : row.lag ? "LAG" : "ok"}`);
+    lines2.push(`${member.repo.split("/")[1].padEnd(18)} ${row.stage.padEnd(6)} ${row.head.slice(0, 12).padEnd(13)} ${served.padEnd(18)} ${row.source.padEnd(15)} ${row.source === "n/a" ? "n/a" : row.lag === null ? row.note ?? "?" : row.lag ? "LAG" : "ok"}${row.proof ? `  ${proofText(row.proof)}` : ""}${row.suitePin ? `  by suite ${row.suitePin.suite}` : ""}`);
   }
   return lines2.join("\n");
 }
+async function setSuiteHold(deps, member, hold) {
+  const wanted = member.toLowerCase();
+  const found = suiteMembers(await deps.registry()).find((m) => m.repo.toLowerCase() === wanted || m.repo.split("/")[1].toLowerCase() === wanted || m.id === wanted);
+  if (!found) throw new Error(`${member} is not an MM-Work suite member; nothing was written`);
+  if (found.repo === SUITE_REPO) throw new Error(`${SUITE_REPO} is the suite lead and cannot be held; nothing was written`);
+  const slug = found.repo.split("/")[1].toLowerCase();
+  const before = await deps.read(slug);
+  if (!before.ok || !before.project) throw new Error(`${found.repo}: registry META unreadable${before.ok ? "" : ` (${before.error})`}; nothing was written`);
+  const track = before.project.releaseTrack;
+  const res = await deps.write(slug, { suiteHold: hold ? parseSuiteHoldVar(JSON.stringify(hold)) : null, repo: found.repo, ...track ? { releaseTrack: track } : {} });
+  if (!res.ok) throw new Error(`${found.repo}: registry write failed (HTTP ${res.status}${res.error ? `, ${res.error}` : ""})`);
+  const after = await deps.read(slug);
+  if (!after.ok || !after.project) throw new Error(`${found.repo}: write sent but read-back failed; verify with org project get`);
+  const got = after.project.suiteHold ?? null;
+  if (JSON.stringify(got) !== JSON.stringify(hold)) throw new Error(`${found.repo}: read-back suiteHold ${JSON.stringify(got)} does not match what was written`);
+  if (track && after.project.releaseTrack !== track) throw new Error(`${found.repo}: releaseTrack changed from ${track} to ${after.project.releaseTrack ?? "unset"} by the write; restore it with org project set --release-track ${track}`);
+  return hold ? `${found.repo}: HELD (${hold.reason})` : `${found.repo}: hold cleared`;
+}
+
+// src/suite-dev.ts
+var WALK = 20;
+var short2 = (s) => s && /^[a-f0-9]{40}$/i.test(s) ? s.slice(0, 12) : s ?? "-";
+var same = (a, b) => !!a && !!b && a.toLowerCase() === b.toLowerCase();
+async function newestGreen(deps, repo) {
+  const checks = await deps.requiredChecks(repo);
+  for (const sha of await deps.commits(repo, WALK)) {
+    const runs = await deps.checkRuns(repo, sha);
+    if (checks.every((name) => {
+      const latest = runs.filter((r) => r.name === name).sort((a, b) => b.id - a.id)[0];
+      return latest?.status === "completed" && latest.conclusion === "success";
+    })) return sha;
+  }
+  return void 0;
+}
+async function readSuiteDev(deps) {
+  const report = await deps.status();
+  return Promise.all(report.members.map(async (m) => {
+    const st = m.stages.find((s) => s.stage === "dev");
+    const row = { repo: m.repo, head: st.head, served: st.served };
+    if (st.source === "n/a") return { ...row, state: "converged", note: "no dev stage" };
+    if (st.lag === false) return { ...row, state: "converged", note: "dev serves the development head" };
+    let green;
+    try {
+      green = await newestGreen(deps, m.repo);
+    } catch (e) {
+      return { ...row, state: "unknown", note: `checks unreadable (${e.message})` };
+    }
+    const last = st.deployStatus?.lastRun;
+    if (st.served === "unknown") return { ...row, green, state: "unknown", note: `dev version unproven (health probe failed or no deploy record)${last?.url ? `; last deploy ${last.conclusion ?? last.status}: ${last.url}` : ""}` };
+    if (same(st.served, green)) return { ...row, green, state: "converged", note: `dev serves the newest green SHA; head ${short2(st.head)} is not green yet` };
+    if (!green) return { ...row, state: "blocked", note: `no green SHA in the last ${WALK} development commits` };
+    if (last?.conclusion === "failure") return { ...row, green, state: "blocked", note: `last dev deploy failed: ${last.url ?? "no run url"}` };
+    return { ...row, green, state: "lagging", note: `newest green ${short2(green)} not deployed yet; the dev auto-deploy sweep (every 15 min) picks it up` };
+  }));
+}
+function formatSuiteDev(rows) {
+  return [
+    "member             head          served        green         state      note",
+    ...rows.map((r) => `${r.repo.split("/")[1].padEnd(18)} ${short2(r.head).padEnd(13)} ${short2(r.served).padEnd(13)} ${short2(r.green).padEnd(13)} ${r.state.padEnd(10)} ${r.note}`)
+  ].join("\n");
+}
+async function waitSuiteDev(deps, opts) {
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  for (let waited = 0; ; waited += opts.intervalMs) {
+    const rows = await readSuiteDev(deps);
+    opts.onTick?.(rows);
+    if (!rows.some((r) => r.state === "lagging") || waited + opts.intervalMs > opts.timeoutMs) return rows;
+    await sleep2(opts.intervalMs);
+  }
+}
 
 // src/suite-train.ts
 var import_node_fs29 = require("node:fs");
 var import_node_path29 = require("node:path");
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -35791,7 +35960,7 @@ function readSuiteCut(path2) {
 }
 function writeSuiteCut(path2, record) {
   (0, import_node_fs29.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto13.randomBytes)(8).toString("hex")}.tmp`;
+  const temp = `${path2}.${(0, import_node_crypto14.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs29.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
     (0, import_node_fs29.renameSync)(temp, path2);
@@ -35836,8 +36005,41 @@ function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Dat
   (0, import_node_fs29.renameSync)(recordPath, archive);
   return { archive, orphanTags: record.members.filter((m) => m.tag).map((m) => `${m.repo}@${m.tag}`) };
 }
+async function suiteRestoreMainPins(deps) {
+  const record = readSuiteCut(deps.recordPath);
+  if (!record?.pinPr || record.leadReleased || record.members.some((m) => m.released)) return void 0;
+  const pins = [];
+  for (const m of record.members) {
+    if (m.carried || !m.tag || !m.priorMain) continue;
+    const planned = suiteReleaseTag(m.tag);
+    if (!await deps.tagSha(m.repo, planned)) pins.push({ module: m.id, planned, prior: m.priorMain });
+  }
+  return pins.length ? deps.restoreMain({ cut: record.leadDevelopment, pins }) : void 0;
+}
+async function dryRunStatus(deps, m) {
+  const [dev, rc] = await Promise.all([deps.head(m.repo, "development"), deps.head(m.repo, "rc")]);
+  const previousRc = rc ?? await deps.head(m.repo, "main");
+  if (!dev || !previousRc) return "branch heads unreadable";
+  const verdict = await deps.contains(m.repo, dev, previousRc) ? "carried (no change on development since its last rc tag)" : "new candidate";
+  let pending = "";
+  try {
+    const why = await pendingBackend(deps, m, dev);
+    if (why) pending = `; pending backend release (${why})`;
+  } catch (e) {
+    pending = `; live backend unreadable (${e.message})`;
+  }
+  return verdict + pending;
+}
+var NOT_BACKEND = /^(module|docs|\.github)\/|\.md$/;
+async function pendingBackend(deps, m, dev) {
+  const { version } = await deps.backend(m);
+  const live = await deps.tagSha(m.repo, version);
+  if (!live || await deps.contains(m.repo, dev, live)) return "";
+  const files = (await deps.changedPaths(m.repo, live, dev)).filter((f) => !NOT_BACKEND.test(f));
+  return files.length ? `${files.length} backend file(s) changed since live ${version}, e.g. ${files[0]}` : "";
+}
 async function suiteRcand(deps, opts) {
-  if (!opts.ownerGo) throw new Error("suite rcand requires --owner-go (rc uses live data); nothing was written");
+  if (!opts.ownerGo && !opts.dryRun) throw new Error("suite rcand requires --owner-go (rc uses live data); nothing was written");
   const members = suiteMembers(await deps.registry());
   const modules = members.filter((m) => m.repo !== SUITE_REPO);
   const { active, held } = await holdSplit(deps, modules);
@@ -35849,7 +36051,10 @@ async function suiteRcand(deps, opts) {
   ];
   const lead = await deps.head(SUITE_REPO, "development");
   plan.push(await kitCheck(deps, lead, active.map((m) => ({ id: m.id, url: m.bundles.dev })), "dev bundles"));
-  if (opts.dryRun) return { plan };
+  if (opts.dryRun) {
+    plan.push(...await Promise.all(modules.map(async (m) => `${m.repo}: ${heldById.has(m.id) ? "HELD" : await dryRunStatus(deps, m)}`)));
+    return { plan };
+  }
   let record = readSuiteCut(deps.recordPath);
   if (record?.leadReleased && record.announcement === "pending") {
     const reason = await deps.announceSkipReason(record);
@@ -35872,6 +36077,12 @@ async function suiteRcand(deps, opts) {
     record = void 0;
   }
   if (!record) {
+    const pending = (await Promise.all(active.map(async (m) => {
+      const dev = await deps.head(m.repo, "development");
+      const why = dev ? await pendingBackend(deps, m, dev) : "";
+      return why ? `${m.repo} (${why})` : "";
+    }))).filter(Boolean);
+    if (pending.length) throw new Error(`member backends not live yet: ${pending.join("; ")}. Release each from its own checkout first (mmi-cli devops release --suite-solo --owner-go), or hold it (suite hold set), then re-run suite rcand; nothing was cut`);
     const [leadDevelopment, leadPreviousRc, snapshots] = await Promise.all([
       deps.head(SUITE_REPO, "development"),
       deps.head(SUITE_REPO, "rc"),
@@ -35972,6 +36183,11 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
   const pins = suitePins(record, bundlesOf(modules));
   await kitCheck(deps, record.leadDevelopment, pins.map((p) => ({ id: p.module, url: p.rc })), "rc bundles");
   await deps.verifyLeadCut(record.leadDevelopment);
+  for (const member of record.members) {
+    const prior = modules.find((m) => m.id === member.id)?.bundles.main;
+    if (!member.carried && !member.priorMain && prior && pinVersion(prior) !== suiteReleaseTag(member.tag)) member.priorMain = prior;
+  }
+  writeSuiteCut(deps.recordPath, record);
   const pr = await deps.pin({ cut: record.leadDevelopment, pins, heldIds: record.heldMembers?.map((h) => h.id) });
   await deps.verifyLeadCut(record.leadDevelopment);
   if (record.pinPr && record.pinPr !== pr.pr) throw new Error(`pin PR changed from ${record.pinPr} to ${pr.pr}; stop`);
@@ -36075,6 +36291,112 @@ Each member's live release must serve <data>/main/module.js at its main pin path
   }
   return record;
 }
+var hotfixRecordPath = (deps) => (0, import_node_path29.join)((0, import_node_path29.dirname)(deps.recordPath), "hotfix.json");
+function readSuiteHotfix(path2) {
+  let raw;
+  try {
+    raw = (0, import_node_fs29.readFileSync)(path2, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return void 0;
+    throw e;
+  }
+  let r;
+  try {
+    r = JSON.parse(raw);
+  } catch {
+    throw new Error(`suite hotfix record unreadable at ${path2}; repair it, never restart`);
+  }
+  if (r.schema !== "mmi-suite-hotfix/v1" || !r.repo || !r.member || !r.from || r.tag !== void 0 && !RELEASE_TAG.test(r.tag) || r.released && !r.tag || r.pinMerged && !r.released || r.leadTag !== void 0 && (!RELEASE_TAG.test(r.leadTag) || !r.pinMerged) || r.leadReleased && !r.leadTag || r.mapped && !r.leadReleased)
+    throw new Error(`suite hotfix record has unknown or invalid state at ${path2}; repair it, never restart`);
+  return r;
+}
+function writeSuiteHotfix(path2, record) {
+  writeSuiteCut(path2, record);
+}
+async function suiteHotfix(deps, opts) {
+  if (!opts.ownerGo && !opts.dryRun) throw new Error("suite hotfix requires --owner-go (it ships a member and MM-Work to production); nothing was written");
+  const wanted = opts.member.toLowerCase();
+  const found = suiteMembers(await deps.registry()).find((m) => m.repo.toLowerCase() === wanted || m.repo.split("/")[1].toLowerCase() === wanted || m.id === wanted);
+  if (!found) throw new Error(`${opts.member} is not an MM-Work suite member; nothing was written`);
+  if (found.repo === SUITE_REPO) throw new Error(`${SUITE_REPO} is the suite lead; hotfix a member, this command cuts the lead; nothing was written`);
+  const held = await deps.hold(found);
+  if (held) throw new Error(`${found.repo} is HELD (${held.reason}); clear it with suite hold clear before a suite hotfix; nothing was written`);
+  const plan = [
+    `${found.repo}: hotfix start --from ${opts.from} + release (suite-solo, in-process)`,
+    `${SUITE_REPO}: main pin PR for ${found.id}, wait for merge`,
+    `${SUITE_REPO}: hotfix (patch) carrying only the merged pin PR onto main`,
+    `${SUITE_REPO}: record suite version -> member versions on its release`
+  ];
+  if (opts.dryRun) return { plan };
+  const cut = readSuiteCut(deps.recordPath);
+  if (cut && !cut.leadReleased) throw new Error(`an unfinished suite cut (${cut.leadRcTag ?? "no lead tag"}) is in flight; finish it with suite release or retire it with suite abandon first`);
+  const path2 = hotfixRecordPath(deps);
+  let record = readSuiteHotfix(path2);
+  if (record?.mapped) {
+    (0, import_node_fs29.renameSync)(path2, `${path2}.${record.leadTag}.json`);
+    record = void 0;
+  }
+  if (record && record.repo !== found.repo) throw new Error(`an unfinished suite hotfix for ${record.repo} is recorded; finish it (rerun with that member) first`);
+  const rec = record ?? { schema: "mmi-suite-hotfix/v1", member: found.id, repo: found.repo, from: opts.from, ...opts.ack?.length ? { ack: opts.ack } : {} };
+  const save = () => writeSuiteHotfix(path2, rec);
+  save();
+  const resume = `rerun suite hotfix ${found.id} --from ${rec.from} --owner-go to resume`;
+  if (!rec.tag) {
+    const started = await deps.hotfixStart(found.repo, { from: rec.from, ack: rec.ack });
+    if (!RELEASE_TAG.test(started.tag)) throw new Error(`${found.repo}: hotfix start returned no vX.Y.Z tag`);
+    rec.tag = started.tag;
+    save();
+  }
+  if (!rec.released) {
+    let out;
+    try {
+      out = await deps.hotfixRelease(found.repo, rec.tag);
+    } catch (e) {
+      throw new Error(`${e.message}; the hotfix ${rec.tag} is recorded: ${resume}`);
+    }
+    if (out.tag !== rec.tag) throw new Error(`${found.repo}: released ${out.tag}, expected ${rec.tag}; stop`);
+    rec.released = true;
+    save();
+  }
+  if (!rec.pinMerged) {
+    const pin = await deps.soloPin(found.repo, rec.tag);
+    if (pin.status === "superseded") throw new Error(`${found.id} pin at ${rec.tag} is superseded by ${pin.pr}; a newer ${found.id} release owns the pin; stop`);
+    rec.pinPr = pin.pr;
+    save();
+    if (pin.status !== "merged") throw new Error(`pin PR ${pin.pr} is pending; merge it, then ${resume} (the hotfix is not repeated)`);
+    rec.pinMerged = true;
+    save();
+  }
+  if (!rec.leadTag) {
+    const prNumber = /\/pull\/(\d+)$/.exec(rec.pinPr ?? "")?.[1];
+    if (!prNumber) throw new Error(`pin PR ${rec.pinPr ?? "(none)"} has no PR number; MM-Work not hotfixed`);
+    const started = await deps.hotfixStart(SUITE_REPO, { from: prNumber });
+    if (!RELEASE_TAG.test(started.tag)) throw new Error(`${SUITE_REPO}: hotfix start returned no vX.Y.Z tag`);
+    rec.leadTag = started.tag;
+    save();
+  }
+  const leadTag = rec.leadTag;
+  if (!rec.leadReleased) {
+    let out;
+    try {
+      out = await deps.hotfixRelease(SUITE_REPO, leadTag);
+    } catch (e) {
+      throw new Error(`${e.message}; the MM-Work hotfix ${leadTag} is recorded: ${resume}`);
+    }
+    if (out.tag !== leadTag) throw new Error(`${SUITE_REPO}: released ${out.tag}, expected ${leadTag}; stop`);
+    rec.leadReleased = true;
+    save();
+  }
+  if (!rec.mapped) {
+    const mapping = await deps.suiteMapping(leadTag);
+    if (mapping[found.id] !== rec.tag) throw new Error(`MM-Work ${leadTag} pins ${found.id} at ${mapping[found.id] ?? "nothing"}, not the hotfix ${rec.tag}; mapping not recorded`);
+    await deps.recordMapping(leadTag, mapping);
+    rec.mapping = mapping;
+    rec.mapped = true;
+    save();
+  }
+  return { plan, record: rec };
+}
 
 // src/suite-rc-data.ts
 var RC_DATA_VAULT_REPO = "mutmutco/MM-Work";
@@ -36593,8 +36915,8 @@ async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
   if (sources.length === 0) return { failures: [], skipped: [] };
   const { mkdtemp: mkdtemp2, rm: rm2 } = await import("node:fs/promises");
   const { tmpdir: tmpdir11 } = await import("node:os");
-  const { join: join45 } = await import("node:path");
-  const dir = await mkdtemp2(join45(tmpdir11(), "mmi-hotfix-preflight-"));
+  const { join: join46 } = await import("node:path");
+  const dir = await mkdtemp2(join46(tmpdir11(), "mmi-hotfix-preflight-"));
   const wt = { run: (file, args) => deps.run(file, file === "git" ? ["-C", dir, ...args] : args) };
   const failures = [];
   const skipped = [];
@@ -39767,6 +40089,59 @@ async function openSuiteCutPinPr(deps, input) {
     if (scratch) await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
   }
 }
+async function openSuiteRestorePinPr(deps, input) {
+  if (!/^[a-f0-9]{40}$/.test(input.cut)) throw new Error("suite restore PR needs an anchored cut");
+  const branch = `suite-pin/restore-${input.cut.slice(0, 16)}`;
+  let scratch = "";
+  try {
+    const prs = JSON.parse(await deps.run("gh", ["pr", "list", "--repo", SUITE_REPO, "--head", branch, "--state", "all", "--json", "url,state"]));
+    if (prs.some((p) => p.state === "CLOSED")) throw new Error(`${branch} was closed without landing`);
+    if (prs.length) return { status: prs.some((p) => p.state === "MERGED") ? "merged" : "pending", pr: prs[0].url };
+    const get = JSON.parse(await deps.run("gh", ["api", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=development`]));
+    if (!get.content) throw new Error("MM-Work seed/modules.json is unreadable");
+    const rows = JSON.parse(Buffer.from(get.content, "base64").toString("utf8"));
+    const todo = input.pins.filter((p) => {
+      try {
+        return new URL(rows.find((r) => r.id === p.module)?.bundles?.main ?? "").searchParams.get("v") === p.planned;
+      } catch {
+        return false;
+      }
+    });
+    if (!todo.length) return void 0;
+    await (0, import_promises6.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
+    scratch = await (0, import_promises6.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
+    const run = (file, args) => deps.run(file, args, scratch);
+    await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
+    await run("git", ["switch", "-c", branch]);
+    const path2 = (0, import_node_path34.join)(scratch, "main-pins.json");
+    await (0, import_promises6.writeFile)(path2, JSON.stringify(todo.map((p) => ({ module: p.module, url: p.prior }))));
+    await run("node", ["scripts/pin-modules.mjs", "--stage", "main", "--pins", path2]);
+    await run("git", ["add", "seed/modules.json"]);
+    await run("git", ["commit", "-m", `Restore main pins of abandoned suite cut ${input.cut.slice(0, 12)} (#7758)`]);
+    await run("git", ["push", "origin", branch]);
+    const pr = (await run("gh", [
+      "pr",
+      "create",
+      "--repo",
+      SUITE_REPO,
+      "--base",
+      "development",
+      "--head",
+      branch,
+      "--title",
+      "Restore main pins of abandoned suite cut",
+      "--body",
+      `Abandoned cut ${input.cut.slice(0, 12)} pinned main to releases that never shipped (${todo.map((p) => `${p.module} ${p.planned}`).join(", ")}); restore the pre-cut pins (#7758).`
+    ])).trim();
+    if (!pr.includes("/pull/")) throw new Error(`gh pr create returned no PR URL: ${pr}`);
+    await run("gh", ["pr", "merge", pr, "--repo", SUITE_REPO, "--auto", "--squash"]);
+    return { status: "pending", pr };
+  } catch (e) {
+    throw new Error(`suite restore pin PR FAILED: ${e.message}; rerun suite abandon --owner-go (the record is kept until the restore PR exists)`);
+  } finally {
+    if (scratch) await (0, import_promises6.rm)(scratch, { recursive: true, force: true });
+  }
+}
 async function openSuitePinPr(deps, input) {
   const { repo, tag, stage } = input;
   const remedy = `open/merge the ${SUITE_REPO} development pin PR for ${repo} ${tag}, then rerun the same train command; do not recut the tag \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#suite-pin-pr`;
@@ -39978,7 +40353,7 @@ init_github_quota();
 
 // src/issue-commands.ts
 var import_node_fs34 = require("node:fs");
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -40451,7 +40826,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto14.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto15.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -45839,7 +46214,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   async function pinSoloMember(repo, tag) {
     const read = await fetchProjectBySlugChecked(slugOf(repo), registryClientDeps(await loadConfig()));
     if (!read.ok || !read.project) throw new Error(`suite pin PR FAILED: registry META unreadable for ${repo} (${read.ok ? "missing" : read.error}); rerun the same train command after restoring registry access \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#suite-pin-pr`);
-    if (!suiteMemberRefusal(repo, read.project, "release")) return void 0;
+    if (!isBundleOnlySuiteMember(repo, read.project.suite)) return void 0;
     const root = (await execFileP("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
     return openSuitePinPr({ root, run: async (file, args, cwd) => (await execFileP(file, args, { cwd, timeout: GIT_TIMEOUT_MS })).stdout }, { repo, tag, stage: "main" });
   }
@@ -45874,8 +46249,8 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
       } catch (e) {
         return fail(`${commandName}: ${e.message}`);
       }
-      if (o.suiteSolo !== o.ownerGo || commandName === "rcand" && (o.suiteSolo || o.ownerGo))
-        return fail(`${commandName}: solo suite releases require BOTH --suite-solo --owner-go on release or hotfix release; rcand must run from the suite lead`);
+      if (o.suiteSolo !== o.ownerGo)
+        return fail(`${commandName}: --suite-solo and --owner-go must be passed together (a solo member release/hotfix, or a lead-only cut; a member rcand is always refused)`);
       if (o.ack && commandName !== "release") {
         return fail(`${commandName}: --ack applies only to release \u2014 it overrides the rc -> main hotfix-coverage guard, which rcand does not run. Run: mmi-cli devops release --ack <shas>`);
       }
@@ -46377,16 +46752,18 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
       throw new Error(`${repo}: suite checkout origin mismatch at ${target}; stop`);
     return target;
   };
-  const inTrain = async (repo, action) => {
+  const inTrain = async (repo, action, solo = false) => {
     const target = await checkout(repo);
     const before = process.cwd();
     process.chdir(target);
     try {
       const deps = trainApplyDeps();
-      if (repo !== SUITE_REPO) {
+      if (solo) {
+      } else if (repo !== SUITE_REPO) {
         deps.suiteCut = suiteCutContext(repo, SUITE_REPO);
         deps.announce = async () => ({ status: "skipped", note: "suite announcement belongs to MM-Work" });
       } else {
+        deps.suiteCut = suiteLeadContext(SUITE_REPO);
         deps.announce = async () => ({ status: "skipped", note: "suite announcement after all members" });
       }
       return await action(deps);
@@ -46595,12 +46972,18 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
         return false;
       }
     },
+    changedPaths: async (repo, base2, head) => {
+      const target = await checkout(repo);
+      await exec("git", ["fetch", "--quiet", "origin", "--tags"], target, WATCH_TIMEOUT);
+      return (await exec("git", ["diff", "--name-only", base2, head], target)).split("\n").map((f) => f.trim()).filter(Boolean);
+    },
     rcand: runRcand,
     publish,
     preflight: preflight2,
     publishMain,
     preflightMain,
     pin: (input) => openSuiteCutPinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, input),
+    restoreMain: (input) => openSuiteRestorePinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, input),
     verifyLeadCut: async (sha) => {
       const current = await gh(["api", `repos/${SUITE_REPO}/git/ref/heads/development`, "--jq", ".object.sha"]);
       if (current.toLowerCase() === sha.toLowerCase()) return;
@@ -46632,6 +47015,39 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
         return void 0;
       }
     },
+    // #7738: a member hotfixes as suite-solo; the lead hotfixes under its suite-lead capability (inTrain sets it).
+    hotfixStart: (repo, o) => inTrain(repo, async (deps) => {
+      const r = await runHotfixStart(deps, { from: o.from, ack: o.ack, suiteSolo: repo !== SUITE_REPO });
+      return { tag: r.tag };
+    }, repo !== SUITE_REPO),
+    hotfixRelease: (repo, tag) => inTrain(repo, async (deps) => ({ tag: (await runHotfixRelease(deps, tag, { suiteSolo: repo !== SUITE_REPO })).tag }), repo !== SUITE_REPO),
+    // #7738: the #7714 solo pin leg, polled until the auto-merge lands (30 s x 40 = 20 min), then the caller decides.
+    soloPin: async (repo, tag) => {
+      for (let i = 0; ; i++) {
+        const pin = await openSuitePinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, { repo, tag, stage: "main" });
+        if (pin.status !== "pending" || i >= 40) return pin;
+        await new Promise((resolve7) => setTimeout(resolve7, 3e4));
+      }
+    },
+    suiteMapping: async (leadTag) => {
+      const rows = suiteMembers(await registry2(leadTag)).filter((m) => m.repo !== SUITE_REPO);
+      return Object.fromEntries(rows.map((m) => {
+        const v = bundleTag(m.bundles.main);
+        if (!v) throw new Error(`${m.id}: MM-Work ${leadTag} has no versioned main pin; mapping not recorded`);
+        return [m.id, v];
+      }));
+    },
+    recordMapping: async (leadTag, mapping) => {
+      const body = await gh(["release", "view", leadTag, "--repo", SUITE_REPO, "--json", "body", "--jq", ".body"]);
+      if (parseSuiteMapping(body)) return;
+      const dir = repoRuntimeStatePath(root, "suite");
+      (0, import_node_fs43.mkdirSync)(dir, { recursive: true });
+      const file = (0, import_node_path43.join)(dir, `notes-${leadTag}.md`);
+      (0, import_node_fs43.writeFileSync)(file, `${body}
+
+${suiteMappingBlock(leadTag, mapping)}`);
+      await gh(["release", "edit", leadTag, "--repo", SUITE_REPO, "--notes-file", file]);
+    },
     release,
     shippedTag,
     sameContent: sameContent2,
@@ -46688,9 +47104,9 @@ function registerSuiteCommands(program3) {
     if (repo?.toLowerCase() !== SUITE_REPO.toLowerCase()) throw new Error(`suite commands run only from ${SUITE_REPO} (got ${repo ?? "unknown"})`);
     return (await execFileP("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   };
-  suite.command("rcand").description("cut all module candidates, publish bundle-only rc, merge one two-stage pin PR, then cut MM-Work").option("--owner-go", "explicit approval: rc tests on live data").option("--dry-run", "show the roster and sequence without writing").option("--json", "structured receipt").action(async (o) => {
+  suite.command("rcand").description("cut all module candidates, publish bundle-only rc, merge one two-stage pin PR, then cut MM-Work").option("--owner-go", "explicit approval: rc tests on live data (not needed for --dry-run)").option("--dry-run", "read-only: per member HELD / carried / new candidate, flagging a pending backend release; no --owner-go needed. Shows the roster and sequence without writing").option("--json", "structured receipt").action(async (o) => {
     try {
-      if (!o.ownerGo) throw new Error("suite rcand requires --owner-go (rc uses live data); nothing was written");
+      if (!o.ownerGo && !o.dryRun) throw new Error("suite rcand requires --owner-go (rc uses live data); nothing was written");
       const root = await leadRoot();
       const unlock = o.dryRun ? async () => void 0 : await acquireTrainWriterLock(root, "suite rcand");
       let result;
@@ -46709,19 +47125,39 @@ function registerSuiteCommands(program3) {
       return fail(`suite rcand: ${e.message}`);
     }
   });
+  const holdCmd = suite.command("hold").description("freeze or unfreeze a member live release in the suite train (registry META suiteHold, #7735)");
+  const holdWrite = async (member, hold) => {
+    try {
+      const root = await leadRoot();
+      const reg = registryClientDeps(await loadConfig());
+      console.log(await setSuiteHold({
+        registry: () => suiteTrainIo(root).registry(),
+        read: (slug) => fetchProjectBySlugChecked(slug, reg),
+        write: (slug, patch) => upsertProject(slug, patch, reg)
+      }, member, hold));
+    } catch (e) {
+      return fail(`suite hold: ${e.message}`);
+    }
+  };
+  holdCmd.command("set <member-repo>").description("cut the member out of the suite train until cleared").requiredOption("--reason <text>", "why the live release is frozen").option("--since <date>", "when the freeze began (e.g. 2026-09-28)").action((member, o) => holdWrite(member, { reason: o.reason, ...o.since ? { since: o.since } : {} }));
+  holdCmd.command("clear <member-repo>").description("put the member back in the suite train").action((member) => holdWrite(member, null));
   suite.command("abandon").description("retire an unfinished cut: archive the record; member rc tags stay (#7396). A cut whose pin PR landed but released nothing needs --owner-go (#7450)").option("--owner-go", "explicit owner approval to retire a cut whose pin PR already landed").option("--json", "structured receipt").action(async (o) => {
     try {
       const root = await leadRoot();
       const unlock = await acquireTrainWriterLock(root, "suite abandon");
       let result;
+      let restored;
       try {
-        result = suiteAbandon(suiteTrainIo(root).recordPath, o.ownerGo === true);
+        const io = suiteTrainIo(root);
+        restored = o.ownerGo === true ? await suiteRestoreMainPins(io) : void 0;
+        result = suiteAbandon(io.recordPath, o.ownerGo === true);
       } finally {
         await unlock();
       }
       console.log(o.json ? JSON.stringify(result, null, 2) : [
         `suite abandon: archived the cut record to ${result.archive}`,
         ...result.orphanTags.length ? ["  member rc tags left in place (immutable; the next cut reuses one still unreleased on its rc head, #7450):", ...result.orphanTags.map((t) => `  - ${t}`)] : ["  no member rc tag was minted"],
+        ...restored ? [`  main pins the cut planned for unreleased tags are restored by ${restored.pr} (${restored.status}, #7758)`] : [],
         "  the next suite rcand --owner-go re-snapshots every member"
       ].join("\n"));
     } catch (e) {
@@ -46753,6 +47189,26 @@ function registerSuiteCommands(program3) {
       return fail(`suite release: ${e.message}`);
     }
   });
+  suite.command("hotfix <member>").description("member hotfix, main pin PR, MM-Work patch release, and the recorded suite version -> member versions mapping (#7738)").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR(s) or SHA(s) the member hotfix carries").option("--ack <shas>", "dev shas verified as not needed on main (see hotfix start --ack)").option("--owner-go", "explicit owner approval: ships the member and MM-Work to production (not needed for --dry-run)").option("--dry-run", "read-only: print the ordered plan; writes nothing").option("--json", "structured receipt").action(async (member, o) => {
+    try {
+      if (!o.ownerGo && !o.dryRun) throw new Error("suite hotfix requires --owner-go (it ships to production); nothing was written. --dry-run prints the plan");
+      const root = await leadRoot();
+      const unlock = o.dryRun ? async () => void 0 : await acquireTrainWriterLock(root, "suite hotfix");
+      let result;
+      try {
+        result = await suiteHotfix(suiteTrainIo(root), { member, from: o.from, ack: o.ack?.split(",").map((s) => s.trim()).filter(Boolean), ownerGo: o.ownerGo, dryRun: o.dryRun });
+      } finally {
+        await unlock();
+      }
+      console.log(o.json ? JSON.stringify(result, null, 2) : [
+        `suite hotfix ${o.dryRun ? "dry-run" : "receipt"}:`,
+        ...result.plan.map((line) => `  - ${line}`),
+        ...result.record?.mapping ? [`  - MM-Work ${result.record.leadTag} = members ${Object.entries(result.record.mapping).map(([id, v]) => `${id} ${v}`).join(", ")}`] : []
+      ].join("\n"));
+    } catch (e) {
+      return fail(`suite hotfix: ${e.message}`);
+    }
+  });
   suite.command("rc-data").description("switch the rc Preview envs between the live and rc data sets as one bound switch (#7588)").option("--to <direction>", "switch source: live or rc").option("--apply", "write the switch (default is a dry-run plan)").option("--owner-go", "explicit approval: touches the live data key").option("--json", "structured receipt").action(async (o) => {
     try {
       if (o.to !== "live" && o.to !== "rc") throw new Error(`--to must be live or rc (got ${o.to ?? "nothing"}); nothing was written`);
@@ -46778,56 +47234,101 @@ function registerSuiteCommands(program3) {
       return fail(`suite rc-data: ${e.message}`);
     }
   });
-  suite.command("status").description("compare served versions with development, rc and main branch heads across MM-Work modules").option("--suite <name>", "suite name (mm-work)", "mm-work").option("--json", "structured output").action(async (o) => {
+  suite.command("status").description("compare served versions with development, rc and main branch heads across MM-Work modules").option("--suite <name>", "suite name (mm-work)", "mm-work").option("--json", "structured output").option("--markdown", "print a markdown docs table of member versions per stage and the suite tag that pins each").action(async (o) => {
     if (o.suite !== "mm-work") return fail("suite status: only mm-work is supported");
     const github = defaultGitHubClient();
     const cfg = await loadConfig();
     const registry2 = registryClientDeps(cfg);
     try {
-      const report = await readSuiteStatus({
-        registry: async () => {
-          const file = await github.rest("GET", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=development`);
-          if (!file?.content) throw new Error("MM-Work module registry is unavailable");
-          return JSON.parse(decodeGitHubContents(file.content));
-        },
-        head: async (repo, branch) => {
-          try {
-            const ref = await github.rest("GET", `repos/${repo}/git/ref/heads/${branch}`);
-            return ref?.object?.sha ?? "";
-          } catch (e) {
-            if (e instanceof GitHubApiError && e.status === 404) return null;
-            throw e;
-          }
-        },
-        tagCommit: async (repo, tag) => {
-          const commit = await github.rest("GET", `repos/${repo}/commits/${encodeURIComponent(tag)}`);
-          return commit?.sha;
-        },
-        deploy: async (repo, stage) => {
-          const slug = repo.split("/")[1].toLowerCase();
-          const facts = await fetchDeployFactsBySlug(slug, registry2);
-          if (!facts) return void 0;
-          const url = publicUrlFromDeployFact(facts.stages[stage]);
-          const [health, lastRun] = await Promise.all([
-            url ? probePublicHealth(url) : Promise.resolve(void 0),
-            fetchLastTenantDeployRun(slug, stage)
-          ]);
-          return buildDeployStatusReport({
-            repo,
-            slug,
-            stage,
-            deployFacts: facts,
-            lastRun: lastRun.run,
-            lastRunAbsence: lastRun.absence,
-            health
-          });
-        }
-      });
-      console.log(o.json ? JSON.stringify(report, null, 2) : formatSuiteStatus(report));
+      const report = await readSuiteStatus(suiteStatusDeps(github, registry2));
+      console.log(o.json ? JSON.stringify(report, null, 2) : o.markdown ? formatSuiteMarkdown(report) : formatSuiteStatus(report));
     } catch (e) {
       return fail(`suite status: ${e.message}`);
     }
   });
+  suite.command("dev").description("per member: development head, the version dev serves and the newest green SHA; --wait until none is lagging (#7739)").option("--wait", "poll every 60s until no member is lagging (blocked or unknown members end the wait)").option("--timeout <minutes>", "how long --wait polls", "30").option("--json", "structured output").action(async (o) => {
+    const github = defaultGitHubClient();
+    const registry2 = registryClientDeps(await loadConfig());
+    const status = suiteStatusDeps(github, registry2);
+    const deps = {
+      status: () => readSuiteStatus(status),
+      commits: async (repo, limit) => (await github.rest("GET", `repos/${repo}/commits?sha=development&per_page=${limit}`) ?? []).map((c) => c.sha),
+      checkRuns: async (repo, sha) => (await github.rest("GET", `repos/${repo}/commits/${sha}/check-runs?per_page=100`))?.check_runs ?? [],
+      requiredChecks: async (repo) => {
+        const meta = await fetchProjectBySlugChecked(repo.split("/")[1].toLowerCase(), registry2);
+        if (!meta.ok) throw new Error(`${repo} META unreadable: ${meta.error}`);
+        return meta.project?.requiredChecks ?? ["gate"];
+      }
+    };
+    try {
+      const minutes = Number(o.timeout);
+      if (!Number.isFinite(minutes) || minutes <= 0) return fail("suite dev: --timeout must be a positive number of minutes");
+      const rows = o.wait ? await waitSuiteDev(deps, { timeoutMs: minutes * 6e4, intervalMs: 6e4, onTick: (r) => {
+        if (!o.json) console.error(`suite dev: ${r.filter((x) => x.state === "lagging").length} lagging`);
+      } }) : await readSuiteDev(deps);
+      console.log(o.json ? JSON.stringify(rows, null, 2) : formatSuiteDev(rows));
+      if (rows.some((r) => r.state !== "converged")) process.exitCode = 1;
+    } catch (e) {
+      return fail(`suite dev: ${e.message}`);
+    }
+  });
+}
+function suiteStatusDeps(github, registry2) {
+  return {
+    registry: async () => {
+      const file = await github.rest("GET", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=development`);
+      if (!file?.content) throw new Error("MM-Work module registry is unavailable");
+      return JSON.parse(decodeGitHubContents(file.content));
+    },
+    head: async (repo, branch) => {
+      try {
+        const ref = await github.rest("GET", `repos/${repo}/git/ref/heads/${branch}`);
+        return ref?.object?.sha ?? "";
+      } catch (e) {
+        if (e instanceof GitHubApiError && e.status === 404) return null;
+        throw e;
+      }
+    },
+    tagCommit: async (repo, tag) => {
+      try {
+        const commit = await github.rest("GET", `repos/${repo}/commits/${encodeURIComponent(tag)}`);
+        return commit?.sha;
+      } catch (e) {
+        if (e instanceof GitHubApiError && (e.status === 404 || e.status === 422)) return void 0;
+        throw e;
+      }
+    },
+    fetchUrl: async (url) => {
+      const res = await fetch(url, { signal: AbortSignal.timeout(1e4), redirect: "follow" });
+      return { status: res.status, body: new Uint8Array(await res.arrayBuffer()) };
+    },
+    leadTags: async () => (await github.rest("GET", `repos/${SUITE_REPO}/tags?per_page=100`) ?? []).map((t) => t.name),
+    leadReleaseBody: async (tag) => (await github.rest("GET", `repos/${SUITE_REPO}/releases/tags/${encodeURIComponent(tag)}`))?.body ?? null,
+    registryAt: async (ref) => {
+      const file = await github.rest("GET", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=${encodeURIComponent(ref)}`);
+      if (!file?.content) throw new Error(`MM-Work seed/modules.json at ${ref} is unavailable`);
+      return JSON.parse(decodeGitHubContents(file.content));
+    },
+    deploy: async (repo, stage) => {
+      const slug = repo.split("/")[1].toLowerCase();
+      const facts = await fetchDeployFactsBySlug(slug, registry2);
+      if (!facts) return void 0;
+      const url = publicUrlFromDeployFact(facts.stages[stage]);
+      const [health, lastRun] = await Promise.all([
+        url ? probePublicHealth(url) : Promise.resolve(void 0),
+        fetchLastTenantDeployRun(slug, stage)
+      ]);
+      return buildDeployStatusReport({
+        repo,
+        slug,
+        stage,
+        deployFacts: facts,
+        lastRun: lastRun.run,
+        lastRunAbsence: lastRun.absence,
+        health
+      });
+    }
+  };
 }
 
 // src/discovery-commands.ts
@@ -50826,14 +51327,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var import_node_fs48 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
 var import_node_path46 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto15.createHash)("sha256");
+  const hash = (0, import_node_crypto16.createHash)("sha256");
   for await (const chunk of (0, import_node_fs48.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -50843,8 +51344,8 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
   const info = await (0, import_promises11.stat)(path2);
   if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
   if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
-  const sha2562 = await sha256File(path2);
-  const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256: sha2562 }, deps);
+  const sha2563 = await sha256File(path2);
+  const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256: sha2563 }, deps);
   if (!prepared.ok) {
     const detail = prepared.body?.error ?? prepared.error ?? `HTTP ${prepared.status}`;
     throw new Error(`tenant artifact put: ${detail}`);
@@ -50872,8 +51373,8 @@ async function putTenantArtifact(repo, stage, inputPath, deps) {
     throw error;
   }
   if (!uploaded.ok) throw new Error(`tenant artifact put: object upload failed (HTTP ${uploaded.status})`);
-  if (body.size !== info.size || body.sha256 !== sha2562 || typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt))) throw new Error("tenant artifact put: Hub returned inconsistent artifact metadata");
-  return { artifactId: body.artifactId, repo, stage, size: info.size, sha256: sha2562, expiresAt: body.expiresAt };
+  if (body.size !== info.size || body.sha256 !== sha2563 || typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt))) throw new Error("tenant artifact put: Hub returned inconsistent artifact metadata");
+  return { artifactId: body.artifactId, repo, stage, size: info.size, sha256: sha2563, expiresAt: body.expiresAt };
 }
 
 // src/tenant-sweep.ts
@@ -51063,13 +51564,13 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 var import_node_fs50 = require("node:fs");
 var import_node_os22 = require("node:os");
 var import_node_path48 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var import_node_fs49 = require("node:fs");
 var import_node_path47 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
@@ -51082,7 +51583,7 @@ function repoPath(root, declaredPath, label) {
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto16.createHash)("sha256");
+  const hash = (0, import_node_crypto17.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs49.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs49.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -51112,10 +51613,10 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha256 = (bytes) => `sha256:${(0, import_node_crypto17.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2562 = (bytes) => `sha256:${(0, import_node_crypto18.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
-  const committed = committedBytes ? sha256(committedBytes) : ABSENT;
-  const rebuiltExpected = rebuiltBytes ? sha256(rebuiltBytes) : ABSENT;
+  const committed = committedBytes ? sha2562(committedBytes) : ABSENT;
+  const rebuiltExpected = rebuiltBytes ? sha2562(rebuiltBytes) : ABSENT;
   return { path: path2, status: committed === rebuiltExpected ? "current" : "stale", committed, rebuiltExpected };
 }
 function distTreeIdentity(labels, rebuilt, committed, digest) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.83",
+  "version": "4.5.84",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",