@mutmutco/codex-plugin 4.5.133 → 4.5.135

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.133",
+  "version": "4.5.135",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -18274,10 +18274,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.133",
-    tag: "v4.5.133",
-    commit: "1b86fb08bbf0",
-    npm: "@mutmutco/cli@4.5.133"
+    version: "4.5.135",
+    tag: "v4.5.135",
+    commit: "2ae28f97dd36",
+    npm: "@mutmutco/cli@4.5.135"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18294,14 +18294,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.133"
+          v3Target: "v4.5.135"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.133 and redeploy the Hub Lambda from tag v4.5.133 (1b86fb08bbf0); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.133 (@mutmutco/cli@4.5.133, tag commit 1b86fb08bbf0 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.135 and redeploy the Hub Lambda from tag v4.5.135 (2ae28f97dd36); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.135 (@mutmutco/cli@4.5.135, tag commit 2ae28f97dd36 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -26387,34 +26387,105 @@ Cut by ${formatSessionIdentity(cutBy)}
 var PLAIN_WORDS_HEADING = "## In plain words";
 var PLAIN_WORDS_HEADING_TR = "## Sade s\xF6zlerle";
 var PLAIN_WORDS_MARKER = "<!-- mmi:big -->";
-function buildPlainWordsSection(lines2, big, heading = PLAIN_WORDS_HEADING) {
-  const [title, ...notes] = lines2;
-  const body = [heading, title ?? "", ...notes.slice(0, 5).map((n) => `- ${n}`)];
+var REPORT_ID = /^[A-Za-z0-9_-]{1,64}$/;
+async function collectReleaseCredits(deps, repo, body) {
+  try {
+    const [owner, name] = repo.split("/");
+    const prs = /* @__PURE__ */ new Set();
+    let changes = false;
+    for (const line of body.split(/\r?\n/)) {
+      if (line.startsWith("## ")) changes = line === "## What's Changed";
+      if (!changes) continue;
+      const match = line.match(/\bin https:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/(\d+)\s*$/);
+      if (match?.[1]?.toLowerCase() === repo.toLowerCase()) prs.add(Number(match[2]));
+    }
+    const ids = /* @__PURE__ */ new Set();
+    for (const number of [...prs].sort((a, b) => a - b)) {
+      const query = "query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100){nodes{body} pageInfo{hasNextPage}}}}}";
+      const result = JSON.parse(clean2(await deps.run("gh", ["api", "graphql", "-f", `query=${query}`, "-f", `owner=${owner}`, "-f", `name=${name}`, "-F", `number=${number}`])));
+      const refs = result.data?.repository?.pullRequest?.closingIssuesReferences;
+      if (result.errors?.length || !Array.isArray(refs?.nodes) || refs.pageInfo?.hasNextPage !== false) throw new Error(`closing issues unavailable or truncated for PR #${number}`);
+      for (const issue of refs.nodes) {
+        if (typeof issue?.body !== "string") throw new Error(`issue body unavailable for PR #${number}`);
+        const footer = issue.body.trim().match(/(?:^|\n)---\r?\nReported by a person in MM-Work \((?:dev|rc|main)\), module `[^`\r\n]+`, report `([A-Za-z0-9_-]{1,64})`\. Filed by the Hub \(#7389\)\.$/);
+        if (footer?.[1]) ids.add(footer[1]);
+      }
+    }
+    return [...ids].sort().slice(0, 20);
+  } catch (e) {
+    (deps.warn ?? console.warn)(`release credits omitted for ${repo}: ${e.message}`);
+    return [];
+  }
+}
+var UPDATE_SECTIONS = {
+  en: { fixed: "Fixed", new: "New" },
+  tr: { fixed: "D\xFCzeldi", new: "Yeni" }
+};
+var UPDATE_LINE_MAX = 120;
+var UPDATE_SECTION_MAX = 8;
+var UPDATE_LINE = /^[^:\s][^:]{0,39}: \S.*\.$/u;
+var UPDATE_FORBIDDEN = /#\d|\bv?\d+\.\d+\.\d+|^(?:feat|fix|chore|refactor|docs|test|ci|build|perf|style)\b/;
+function parseUpdateNotes(content, lang = "en") {
+  const words = UPDATE_SECTIONS[lang];
+  const lines2 = content.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+  const notes = { fixed: [], new: [] };
+  let section;
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of lines2) {
+    const key = line === words.fixed ? "fixed" : line === words.new ? "new" : void 0;
+    if (key) {
+      if (seen.has(key) || key === "fixed" && seen.has("new")) throw new Error(`${lang} summary: "${words.fixed}" then "${words.new}", each at most once \u2014 see ${SUMMARY_GUIDE}`);
+      seen.add(key);
+      section = key;
+      continue;
+    }
+    if (!section) throw new Error(`${lang} summary: start with "${words.fixed}" or "${words.new}" on its own line \u2014 see ${SUMMARY_GUIDE}`);
+    if (line.length > UPDATE_LINE_MAX || !UPDATE_LINE.test(line) || UPDATE_FORBIDDEN.test(line)) {
+      throw new Error(`${lang} summary line must read "<Area>: <sentence>." in at most ${UPDATE_LINE_MAX} characters, with no issue numbers, versions or commit prefixes: "${line}" \u2014 see ${SUMMARY_GUIDE}`);
+    }
+    notes[section].push(line);
+  }
+  for (const key of seen) {
+    const n = notes[key].length;
+    if (n === 0 || n > UPDATE_SECTION_MAX) throw new Error(`${lang} summary: each section needs 1\u2013${UPDATE_SECTION_MAX} lines (found ${n}) \u2014 see ${SUMMARY_GUIDE}`);
+  }
+  if (!seen.size) throw new Error(`${lang} summary needs a "${words.fixed}" or "${words.new}" section \u2014 see ${SUMMARY_GUIDE}`);
+  return notes;
+}
+function buildPlainWordsSection(notes, big, lang = "en", credits = []) {
+  const words = UPDATE_SECTIONS[lang];
+  const body = [lang === "en" ? PLAIN_WORDS_HEADING : PLAIN_WORDS_HEADING_TR];
+  for (const key of ["fixed", "new"]) {
+    if (notes[key].length) body.push(`### ${words[key]}`, ...notes[key].map((n) => `- ${n}`));
+  }
   if (big) body.push(PLAIN_WORDS_MARKER);
+  const ids = [...new Set(credits.filter((id) => REPORT_ID.test(id)))].sort().slice(0, 20);
+  if (ids.length) body.push(`<!-- mmi:credits ${ids.join(",")} -->`);
   return body.join("\n");
 }
 var SUMMARY_GUIDE = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing";
-function validatePlainWordsSummary(content) {
-  const lines2 = content.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-  if (lines2[0]?.startsWith("No changes to this module")) throw new Error(`requires a real MM-Work title, not the no-change placeholder \u2014 see ${SUMMARY_GUIDE}`);
-  if (lines2.length < 3 || lines2.length > 6) throw new Error(`requires 3\u20136 curated non-empty lines (title + 2\u20135 notes; found ${lines2.length}) \u2014 see ${SUMMARY_GUIDE}`);
-}
-function validateSuiteReleaseSummary(path2) {
-  if (!path2) throw new Error(`requires --announce-summary-file <path> before promoting any member \u2014 see ${SUMMARY_GUIDE}`);
-  let content;
-  try {
-    content = (0, import_node_fs25.readFileSync)(path2, "utf8");
-  } catch (e) {
-    throw new Error(`could not read summary file ${path2}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
+var SUMMARY_FLAG = { en: "--announce-summary-file", tr: "--announce-summary-file-tr" };
+function validateSuiteReleaseSummary(path2, pathTr) {
+  const files = [["en", path2], ["tr", pathTr]];
+  for (const [lang, file] of files) {
+    if (!file) throw new Error(`requires ${SUMMARY_FLAG[lang]} <path> before promoting any member \u2014 see ${SUMMARY_GUIDE}`);
+  }
+  for (const [lang, file] of files) {
+    let content;
+    try {
+      content = (0, import_node_fs25.readFileSync)(file, "utf8");
+    } catch (e) {
+      throw new Error(`could not read summary file ${file}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
+    }
+    parseUpdateNotes(content, lang);
   }
-  validatePlainWordsSummary(content);
 }
-async function validateReleaseSummaries(releases, files, releaseExists) {
+async function validateReleaseSummaries(releases, files, filesTr, releaseExists) {
   const refusals = [];
   for (const { repo, tag } of releases) {
     if (await releaseExists(repo, tag)) continue;
     try {
-      validateSuiteReleaseSummary(files[repo]);
+      validateSuiteReleaseSummary(files[repo], filesTr[repo]);
     } catch (e) {
       refusals.push(`${repo}: ${e.message}`);
     }
@@ -26422,15 +26493,20 @@ async function validateReleaseSummaries(releases, files, releaseExists) {
   if (refusals.length) throw new Error(`suite release summaries refused; no member was released:
 ${refusals.join("\n")}`);
 }
-async function requireSuiteReleaseSummary(deps, path2) {
-  if (!path2) throw new Error(`a new mm-work suite Release requires --announce-summary-file <path> with a title + 2\u20135 notes \u2014 see ${SUMMARY_GUIDE}`);
-  let content;
-  try {
-    content = await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(path2);
-  } catch (e) {
-    throw new Error(`could not read --announce-summary-file ${path2}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
+async function requireSuiteReleaseSummary(deps, path2, pathTr) {
+  const files = [["en", path2], ["tr", pathTr]];
+  for (const [lang, file] of files) {
+    if (!file) throw new Error(`a new mm-work suite Release requires ${SUMMARY_FLAG[lang]} <path> in the update-notes template \u2014 see ${SUMMARY_GUIDE}`);
+  }
+  for (const [lang, file] of files) {
+    let content;
+    try {
+      content = await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(file);
+    } catch (e) {
+      throw new Error(`could not read ${SUMMARY_FLAG[lang]} ${file}: ${e.message} \u2014 see ${SUMMARY_GUIDE}`);
+    }
+    parseUpdateNotes(content, lang);
   }
-  validatePlainWordsSummary(content);
 }
 function upsertPlainWordsSection(body, section) {
   let rest = body;
@@ -26454,28 +26530,27 @@ function upsertPlainWordsSection(body, section) {
 
 ${trimmedRest}` : section;
 }
-function plainWordsSummaryLines(content) {
-  return content.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).slice(0, 6);
-}
 async function writePlainWordsIfSuiteMember(deps, args) {
   if (args.meta?.suite !== "mm-work") return;
   try {
-    if (!args.summaryLines?.length) return;
-    const lines2 = args.summaryLines;
+    if (!args.summary) return;
+    const body = clean2(await deps.run("gh", ["release", "view", args.tag, "--repo", args.repo, "--json", "body", "-q", ".body"]));
+    const credits = await collectReleaseCredits(deps, args.repo, body);
     const section = [
-      buildPlainWordsSection(lines2, args.big === true),
-      ...args.summaryLinesTr?.length ? [buildPlainWordsSection(args.summaryLinesTr, false, PLAIN_WORDS_HEADING_TR)] : []
+      buildPlainWordsSection(args.summary, args.big === true, "en", credits),
+      ...args.summaryTr ? [buildPlainWordsSection(args.summaryTr, false, "tr")] : []
     ].join("\n\n");
-    const body = clean2(await deps.run("gh", ["release", "view", args.tag, "--repo", args.repo, "--json", "body", "-q", ".body"]));
     await deps.run("gh", ["release", "edit", args.tag, "--repo", args.repo, "--notes", upsertPlainWordsSection(body, section)]);
-  } catch {
+  } catch (e) {
+    (deps.warn ?? console.warn)(`plain-words write failed for ${args.repo}@${args.tag}: ${e.message}`);
   }
 }
 async function writePlainWordsSection(deps, options, repo, meta, tag) {
   try {
-    const summaryLines = options.announceSummaryFile ? plainWordsSummaryLines(await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(options.announceSummaryFile)) : void 0;
-    const summaryLinesTr = options.announceSummaryFileTr ? plainWordsSummaryLines(await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(options.announceSummaryFileTr)) : void 0;
-    await writePlainWordsIfSuiteMember(deps, { repo, tag, meta, summaryLines, summaryLinesTr, big: options.big, suiteTag: options.suiteTag });
+    const read = deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8"));
+    const summary = options.announceSummaryFile ? parseUpdateNotes(await read(options.announceSummaryFile), "en") : void 0;
+    const summaryTr = options.announceSummaryFileTr ? parseUpdateNotes(await read(options.announceSummaryFileTr), "tr") : void 0;
+    await writePlainWordsIfSuiteMember(deps, { repo, tag, meta, summary, summaryTr, big: options.big, suiteTag: options.suiteTag });
   } catch {
   }
 }
@@ -27810,7 +27885,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
   const preMainPartial = await isStrayUnreleasedTag(deps, tag, tagSha, ctx.repo);
   const promotedPartial = !preMainPartial && await isPromotedUnreleasedTag(deps, tag, tagSha, ctx.repo);
   const partialRelease = preMainPartial || promotedPartial;
-  if (partialRelease && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
+  if (partialRelease && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile, options.announceSummaryFileTr);
   if (!partialRelease) {
     try {
       await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
@@ -28686,7 +28761,7 @@ async function runTrainApplyLocked(command, deps, options = {}) {
   const branchHints = await loadReleaseTrackBranchHints(deps);
   const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
   assertSuiteAutoVersion(ctx.repo, meta, process.env, command === "release" && !directTrack);
-  if (command === "release" && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
+  if (command === "release" && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile, options.announceSummaryFileTr);
   const pipelineInput = { deps, ctx, command, meta, branchHints, watch, options, bumpIntent };
   if (command === "rcand") {
     if (directTrack) {
@@ -39021,7 +39096,7 @@ async function runHotfixReleaseLocked(deps, versionInput, options, doctor) {
     await assertConsumerBomLineage(deps, mergedSha, tag);
   }
   const releaseExists = await hotfixReleaseExists(deps, ctx, tag);
-  if (!releaseExists && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile);
+  if (!releaseExists && meta.suite === "mm-work") await requireSuiteReleaseSummary(deps, options.announceSummaryFile, options.announceSummaryFileTr);
   if (!releaseExists && isHubControlRepo(ctx.repo)) {
     if (!options.announceSummaryFile) {
       throw new Error("a new MMI-Hub hotfix Release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same hotfix release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing");
@@ -47436,16 +47511,18 @@ async function announceSummaryLineCountRefusal(path2) {
     return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
   }
   const lines2 = summaryFileLines(content);
+  const first = content.split(/\r?\n/).map((s) => s.trim()).find(Boolean);
+  if (first && Object.values(UPDATE_SECTIONS).some((w) => first === w.fixed || first === w.new)) return null;
   return lines2.length < 3 || lines2.length > 6 ? `release: --announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing` : null;
 }
-async function announceSummaryRefusal(path2, isHub = false) {
+async function announceSummaryRefusal(path2, isHub = false, isWorkSuite = false) {
   let lines2;
   try {
     lines2 = summaryFileLines(await (0, import_promises9.readFile)(path2, "utf8"));
   } catch (e) {
     return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
   }
-  if (lines2.length < 3 || lines2.length > 6) {
+  if (!isWorkSuite && (lines2.length < 3 || lines2.length > 6)) {
     return `release: --announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
   }
   if (isHub) {
@@ -47917,6 +47994,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit project-admin or master approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded repo-authorized train after explicit approval (Hub: master only)").option("--suite-solo", "release one suite module alone, or cut the suite lead alone (requires --owner-go; a member rcand is always refused)").option("--owner-go", "explicit owner approval for a suite-solo backend release").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
     const RELEASE_ONLY_FLAGS = [
       { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line release Slack summary; required for a new MMI-Hub --apply (#883/#3901) and for a product repo whose registry META sets `releaseChannel` (#6523), in its `releaseLanguage`; nothing is posted to a project channel without it" },
+      { flags: "--announce-summary-file-tr <path>", description: "Turkish update-notes summary; required next to --announce-summary-file for a new mm-work suite Release (#8230)" },
       { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
       { flags: "--dev", description: "full-track repos release development -> main directly, skipping rc (refuses if rc carries content not in development; no-op on direct-track repos) (#1062)" },
       { flags: "--abort", description: "with --apply, delete only a proven unpublished failed release candidate on any registered deploy model and restore local main for a same-version recut (#3944/#5650/#5657)" },
@@ -48110,7 +48188,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
           const raw = await withReleaseProgress(
             trainApplyDeps(),
             "Checking the existing release",
-            (deps) => runReleaseResume(deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, suiteSolo: o.suiteSolo, big: o.big })
+            (deps) => runReleaseResume(deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, announceSummaryFileTr: o.announceSummaryFileTr, suiteSolo: o.suiteSolo, big: o.big })
           );
           const result = raw.dispatch?.workflowRuns ? { ...raw, dispatch: { ...raw.dispatch, workflowRuns: raw.dispatch.workflowRuns.map(workflowRunWithEvidence) } } : raw;
           const projectInfoSync = await withReleaseProgress(
@@ -48166,7 +48244,7 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
         }
         if (isWorkSuite) {
           try {
-            await requireSuiteReleaseSummary({}, o.announceSummaryFile);
+            await requireSuiteReleaseSummary({}, o.announceSummaryFile, o.announceSummaryFileTr);
           } catch (e) {
             return fail(`release: ${e.message}`);
           }
@@ -48177,14 +48255,14 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
               isHub ? "release: a new MMI-Hub release requires --announce-summary-file <path> with 3-6 short LLM-curated lines; create the summary file, then rerun the same release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing" : `release: ${slug} announces to its project release channel, so a new release requires --announce-summary-file <path> with 3-6 short plain-language lines in the project's releaseLanguage (${releaseLanguage2}); create the summary file, then rerun the same release command \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`
             );
           }
-          const refusal = await announceSummaryRefusal(o.announceSummaryFile, isHub);
+          const refusal = await announceSummaryRefusal(o.announceSummaryFile, isHub, isWorkSuite);
           if (refusal) return fail(refusal);
         }
       }
       if (o.apply) {
         try {
           const ack = (o.ack ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-          const apply = (deps) => runTrainApply(commandName, deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, ack, dev: o.dev, suiteSolo: o.suiteSolo, big: o.big });
+          const apply = (deps) => runTrainApply(commandName, deps, { watch: o.watch, announceSummaryFile: o.announceSummaryFile, announceSummaryFileTr: o.announceSummaryFileTr, ack, dev: o.dev, suiteSolo: o.suiteSolo, big: o.big });
           const raw = await withReleaseProgress(trainApplyDeps(), commandName === "release" ? "Preparing release" : "Preparing release candidate", apply);
           const result = raw.workflowRuns ? { ...raw, workflowRuns: raw.workflowRuns.map(workflowRunWithEvidence) } : raw;
           let projectInfoSync;
@@ -48369,16 +48447,16 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     if (o.suiteSolo !== o.ownerGo) return fail("hotfix start: solo suite hotfix requires BOTH --suite-solo --owner-go");
     return runHotfixSub("start", () => runHotfixStart(trainApplyDeps(), { from: o.from, suiteSolo: o.suiteSolo, ack: o.ack ? o.ack.split(",").map((s) => s.trim()).filter(Boolean) : void 0 }), o, renderHotfixStart);
   });
-  hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--ack <shas>", "accepted for flag symmetry with hotfix start; hotfix release proves every carry by ancestry, so it is ignored here, never an error (#7338)").option("--retry-deploy", "re-run only the failed deploy and/or fold-port alignment legs of a published hotfix of this same tag (#6985)").option("--suite-solo", "release one suite module alone (requires --owner-go)").option("--owner-go", "explicit owner approval for a solo backend hotfix").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => {
+  hotfixCmd.command("release <version>").description("after the hotfix PR is merged + checks green: tag, GitHub Release, watch deploy/publish, verify distribution (idempotent)").option("--json", "machine-readable output").option("--announce-summary-file <path>", "agent-curated 3-6 line release Slack summary; required for a NEW MMI-Hub hotfix Release (#883/#3901/#6068), optional for a product repo announcing to its project release channel (#6517)").option("--announce-summary-file-tr <path>", "Turkish update-notes summary; required next to --announce-summary-file for a new mm-work suite hotfix Release (#8230)").option("--carries <pr#|sha[,pr#|sha...]>", "declared fix target(s) this hotfix must carry; each must be proven present before tagging (#3056)").option("--ack <shas>", "accepted for flag symmetry with hotfix start; hotfix release proves every carry by ancestry, so it is ignored here, never an error (#7338)").option("--retry-deploy", "re-run only the failed deploy and/or fold-port alignment legs of a published hotfix of this same tag (#6985)").option("--suite-solo", "release one suite module alone (requires --owner-go)").option("--owner-go", "explicit owner approval for a solo backend hotfix").option("--out <path>", "write the result to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)").action(async (version, o) => {
     if (o.suiteSolo !== o.ownerGo) return fail("hotfix release: solo suite release requires BOTH --suite-solo --owner-go");
     if (o.retryDeploy) {
-      if (o.announceSummaryFile || o.carries) {
+      if (o.announceSummaryFile || o.announceSummaryFileTr || o.carries) {
         return fail("hotfix release: --retry-deploy accepts only --json and --out; it re-runs failed deploy/alignment legs of the published tag and does not recut");
       }
       return runHotfixSub("retry-deploy", () => runHotfixRetryDeploy(trainApplyDeps(), version), o, renderHotfixRetryDeploy);
     }
     return runHotfixSub("release", async () => {
-      const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, carries: o.carries ? [o.carries] : [], suiteSolo: o.suiteSolo, ...o.ack ? { ack: o.ack.split(",").map((s) => s.trim()).filter(Boolean) } : {} });
+      const result = await runHotfixRelease(trainApplyDeps(), version, { announceSummaryFile: o.announceSummaryFile, announceSummaryFileTr: o.announceSummaryFileTr, carries: o.carries ? [o.carries] : [], suiteSolo: o.suiteSolo, ...o.ack ? { ack: o.ack.split(",").map((s) => s.trim()).filter(Boolean) } : {} });
       const suitePin = o.suiteSolo ? await pinCompletedMember(result) : void 0;
       const projectInfoSync = await runProjectInfoSyncLeg(runProjectInfoSyncCallback, result.repo);
       return { ...result, projectInfoSync, ...o.suiteSolo ? { suiteSolo: true, suitePin } : {} };
@@ -48711,10 +48789,11 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
   };
   return {
     recordPath,
-    validateHotfixSummary: () => requireSuiteReleaseSummary({}, summaryFile),
+    validateHotfixSummary: () => requireSuiteReleaseSummary({}, summaryFile, summaryFileTr),
     validateReleaseSummaries: (releases) => validateReleaseSummaries(
       releases,
       { ...memberSummaryFiles, [SUITE_REPO]: summaryFile },
+      { ...memberSummaryFilesTr, [SUITE_REPO]: summaryFileTr },
       async (repo, tag) => {
         try {
           await gh(["release", "view", tag, "--repo", repo, "--json", "tagName"]);
@@ -48805,7 +48884,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     },
     // #7738: a member hotfixes as suite-solo; the lead hotfixes under its suite-lead capability (inTrain sets it).
     hotfixStart: (repo, o) => inTrain(repo, async (deps) => {
-      await requireSuiteReleaseSummary(deps, summaryFile);
+      await requireSuiteReleaseSummary(deps, summaryFile, summaryFileTr);
       const r = await runHotfixStart(deps, { from: o.from, ack: o.ack, suiteSolo: repo !== SUITE_REPO });
       return { tag: r.tag };
     }, repo !== SUITE_REPO),
@@ -48989,7 +49068,7 @@ function registerSuiteCommands(program3) {
       return fail(`suite abandon: ${e.message}`);
     }
   });
-  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: required title + 2\u20135 notes for each member being released; carried members need none", (val, prev = []) => [...prev, val], []).option("--announce-summary-file-tr <path>", "Turkish plain-words summary for MM-Work itself").option("--member-summary-file-tr <owner/repo=path>", "repeatable: a member's own Turkish plain-words summary", (val, prev = []) => [...prev, val], []).option("--revamp <owner/repo>", `repeatable: marks that repo's release an owner-approved revamp in the plain-words section \u2014 the only "big" signal; versions carry no meaning (#8224)`, (val, prev = []) => [...prev, val], []).option("--big", "alias for --revamp mutmutco/MM-Work (#7510)").option("--json", "structured receipt").action(async (o) => {
+  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: required update-notes summary (Fixed/New) for each member being released; carried members need none (#8230)", (val, prev = []) => [...prev, val], []).option("--announce-summary-file-tr <path>", "required Turkish update-notes summary (D\xFCzeldi/Yeni) for MM-Work itself (#8230)").option("--member-summary-file-tr <owner/repo=path>", "repeatable: required Turkish update-notes summary for each member being released (#8230)", (val, prev = []) => [...prev, val], []).option("--revamp <owner/repo>", `repeatable: marks that repo's release an owner-approved revamp in the plain-words section \u2014 the only "big" signal; versions carry no meaning (#8224)`, (val, prev = []) => [...prev, val], []).option("--big", "alias for --revamp mutmutco/MM-Work (#7510)").option("--json", "structured receipt").action(async (o) => {
     try {
       if (!o.ownerGo) throw new Error("suite release requires --owner-go; nothing was written");
       const memberSummaryFiles = parseMemberSummaryFiles(o.memberSummaryFile ?? []);
@@ -49012,7 +49091,7 @@ function registerSuiteCommands(program3) {
       return fail(`suite release: ${e.message}`);
     }
   });
-  suite.command("hotfix <member>").description("member hotfix, main pin PR, MM-Work patch release, and the recorded suite version -> member versions mapping (#7738)").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR(s) or SHA(s) the member hotfix carries").option("--ack <shas>", "dev shas verified as not needed on main (see hotfix start --ack)").option("--announce-summary-file <path>", "required title + 2\u20135 notes for the member and lead hotfix Releases").option("--announce-summary-file-tr <path>", "optional Turkish plain-words notes").option("--owner-go", "explicit owner approval: ships the member and MM-Work to production (not needed for --dry-run)").option("--dry-run", "read-only: print the ordered plan; writes nothing").option("--json", "structured receipt").action(async (member, o) => {
+  suite.command("hotfix <member>").description("member hotfix, main pin PR, MM-Work patch release, and the recorded suite version -> member versions mapping (#7738)").requiredOption("--from <pr#|sha[,pr#|sha...]>", "merged development PR(s) or SHA(s) the member hotfix carries").option("--ack <shas>", "dev shas verified as not needed on main (see hotfix start --ack)").option("--announce-summary-file <path>", "required update-notes summary (Fixed/New) for the member and lead hotfix Releases (#8230)").option("--announce-summary-file-tr <path>", "required Turkish update-notes summary (D\xFCzeldi/Yeni) (#8230)").option("--owner-go", "explicit owner approval: ships the member and MM-Work to production (not needed for --dry-run)").option("--dry-run", "read-only: print the ordered plan; writes nothing").option("--json", "structured receipt").action(async (member, o) => {
     try {
       if (!o.ownerGo && !o.dryRun) throw new Error("suite hotfix requires --owner-go (it ships to production); nothing was written. --dry-run prints the plan");
       const root = await leadRoot();

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.133",
+  "version": "4.5.135",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.133",
+  "version": "4.5.135",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/org-guide/references/work-and-releases.md

@@ -109,7 +109,7 @@ commit, so build and verify the lines from one pass over that range —
 subject, body and changed files — never from subjects, PR titles or memory; a line whose claim is not
 in that output does not go in the file. A Hub summary never mentions a Jerv-side project; the train
 refuses such a line.
-Every new MM-Work suite Release, solo and hotfix included, requires a real `--announce-summary-file` (title plus 2–5 notes, never `No changes to this module`), and a suite release requires a `--member-summary-file owner/repo=path` for every member it releases; optional `--announce-summary-file-tr` and repeatable `--member-summary-file-tr owner/repo=path` add Turkish plain words.
+Every new MM-Work suite Release, solo and hotfix included, requires `--announce-summary-file` and `--announce-summary-file-tr` in the bilingual update-notes template of the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md) (`Fixed`/`Düzeldi`, then `New`/`Yeni`, with `<Area>: <sentence>.` lines). A suite release requires `--member-summary-file owner/repo=path` and `--member-summary-file-tr owner/repo=path` for every member it releases. Details: the release skill.
 
 Announcement delivery uses the developer's GitHub-authenticated Hub session. The Hub checks project
 authority, resolves the registered channel, and reads the MMI Future Slack key inside its vault boundary.

package/skills/release/SKILL.md

@@ -15,8 +15,8 @@ Full-track repos ship exactly what is on `rc` (never `development`): merge `rc
 
 In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
 
-Every new mm-work suite Release (including solo and hotfix releases) requires `--announce-summary-file <path>` with a real title and 2–5 notes (3–6 non-empty lines); missing files, out-of-range summaries and titles starting with `No changes to this module` refuse before tagging. Suite release also requires a valid `--member-summary-file <owner/repo=path>` for every member being released, before promoting any member; carried, held and already-released members need none, and existing Releases can resume without new files.
-Use `--member-summary-file <owner/repo=path>` for English member notes, `--announce-summary-file-tr <path>` for MM-Work's Turkish notes and repeatable `--member-summary-file-tr <owner/repo=path>` for Turkish member notes; Turkish files remain optional.
+Every new mm-work suite Release (including solo and hotfix releases) requires both `--announce-summary-file <path>` (English) and `--announce-summary-file-tr <path>` (Turkish, "sen" form) in the update-notes template. The canonical wording lives in the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md); this repo links it and never copies it. Each file has the section word `Fixed` / `Düzeldi` (the problem the person saw, present tense) and/or `New` / `Yeni` (what you can now do) on its own line, Fixed first, each only when it has lines. Under them go 1–8 lines of `<Area>: <sentence>.`, each at most 120 characters, with no issue numbers, versions or commit prefixes. Off-template or missing files refuse before tagging. Do not write the head (app · date · time) or the thanks line: MM-Work renders both from the Release date and credits. Suite release also requires a valid `--member-summary-file <owner/repo=path>` and `--member-summary-file-tr <owner/repo=path>` for every member being released, before promoting any member. Carried, held and already-released members need none, and existing Releases can resume without new files.
+The `/user-releases` feed serves template notes as `updateNotes: {en?, tr?: {fixed[], new[]}}`. Older title-and-notes bodies keep `plainWords` and get `updateNotes: null`.
 
 Read META and name the lane before describing or executing anything:
 
@@ -40,7 +40,7 @@ The JSON is on stdout alone; a stale CLI first prints its self-update notice on
 
 Run from the primary checkout on the lane's start branch (`rc`; `development` for direct-track and `--dev`). A Jerv-Hub release on Windows must run under Git Bash (`"C:/Program Files/Git/bin/bash.exe" -lc "…"`) — the train refuses `--apply` before tagging when it is not. Export the bump intent once from the bare argument — `MMI_BUMP_INTENT=minor|major|patch`, unset → `patch`; `MMI_RELEASE_VERSION=X.Y.Z` only for an exact target the tag math cannot derive.
 
-Two cases need a summary file. (1) **MMI-Hub** — always: write a fresh 3–6 line neutral summary to `f=$(mkdir -p .jerv/tmp && mktemp .jerv/tmp/release-summary.XXXXXX)` — sourced from the range `origin/main..origin/development`, rewritten in Hub-subsystem terms, never a product or brand name, and never a Jerv-side project (the train refuses such a line). Hub scope is only `mutmutco/MMI-Hub`: never a product's board, `ds-propagate.yml`, or a product's deploy state. **Build and verify every line from ONE command's output**, never from commit subjects or PR titles alone: `git log --stat --format='%h %s%n%b' origin/main..origin/development` gives each commit's subject, its full body (where a bundled PR records `Closes #N`) and the files it changed in a single pass. A line whose claim you cannot point to in that output does not go in the file, and every `#N` a Hub line cites must appear there: the train refuses `--apply` on a citation that ships in no commit of the cut. (2) **Any product repo whose META carries `releaseChannel`** (`mmi-cli oracle org project get {owner}/{repo} --json`) — required too: read `releaseLanguage` (default `en`) and write 3–6 lines IN THAT LANGUAGE, in plain words for the project's audience: what changed and why it matters to a user; no commit prefixes, no issue or PR numbers, no file names, no product-internal jargon. The train refuses `--apply` without the file, and raw release notes are never posted to a project channel. A repo with no `releaseChannel` announces nothing, but an mm-work suite repo still requires the summary for its GitHub Release.
+Two cases need a summary file. (1) **MMI-Hub** — always: write a fresh 3–6 line neutral summary to `f=$(mkdir -p .jerv/tmp && mktemp .jerv/tmp/release-summary.XXXXXX)` — sourced from the range `origin/main..origin/development`, rewritten in Hub-subsystem terms, never a product or brand name, and never a Jerv-side project (the train refuses such a line). Hub scope is only `mutmutco/MMI-Hub`: never a product's board, `ds-propagate.yml`, or a product's deploy state. **Build and verify every line from ONE command's output**, never from commit subjects or PR titles alone: `git log --stat --format='%h %s%n%b' origin/main..origin/development` gives each commit's subject, its full body (where a bundled PR records `Closes #N`) and the files it changed in a single pass. A line whose claim you cannot point to in that output does not go in the file, and every `#N` a Hub line cites must appear there: the train refuses `--apply` on a citation that ships in no commit of the cut. (2) **Any product repo whose META carries `releaseChannel`** (`mmi-cli oracle org project get {owner}/{repo} --json`) — required too: read `releaseLanguage` (default `en`) and write 3–6 lines IN THAT LANGUAGE, in plain words for the project's audience: what changed and why it matters to a user; no commit prefixes, no issue or PR numbers, no file names, no product-internal jargon. The train refuses `--apply` without the file, and raw release notes are never posted to a project channel. A repo with no `releaseChannel` announces nothing, but an mm-work suite repo still requires the summary for its GitHub Release. An mm-work suite repo's summary follows the update-notes template below instead of the 3–6 line rule.
 
 ```bash
 mkdir -p .jerv/tmp