@mutmutco/codex-plugin 4.5.94 → 4.5.96

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.94",
+  "version": "4.5.96",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -7460,11 +7460,11 @@ function workflowEntry(repo, workflowPath, yamlText) {
   };
 }
 var DECLARED_ENTRIES = [
-  { name: "mmi-backup (mm-central, mm-work, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh; every Docker volume is tarred and every running Postgres container is pg_dumpall'd beside it (#7147; source scripts/nightly-backup.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
+  { name: "mmi-backup (mm-central, mm-work)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh; every Docker volume is tarred and every running Postgres container is pg_dumpall'd beside it (#7147; source scripts/nightly-backup.sh); owner-approved mmi-oguz rebuild as CI-only mmi-runner2 with full erasure and no backups (#7859); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
   // #7148: a backup nobody restored is a hope. Monthly, restore the latest artifact of every
   // archived stage (including a stage whose containers are down) into scratch Postgres and compare
   // row counts, and read-verify every storage archive against its listing; per-stage PASS/FAIL.
-  { name: "mmi-backup-restore-check (mm-central, mm-work, mmi-oguz)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
+  { name: "mmi-backup-restore-check (mm-central, mm-work)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); owner-approved mmi-oguz rebuild as CI-only mmi-runner2 with full erasure and no backups (#7859); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
   // #7662 (MM-Work#1520): Vercel Cron's 15-minute central mail call, moved to the box with MM-Work. The app
   // calls its own endpoint with its own CRON_SECRET via docker exec, so the secret stays in the container.
   { name: "mm-work-mail-tick (mm-work)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mm-work-mail-tick \u2192 /opt/mmi-control/mm-work-mail-tick.sh; GET /api/internal/mail per stage listed in MM_WORK_MAIL_STAGES (source scripts/mm-work-mail-tick.sh; log /var/log/mm-work-mail-tick.log)" },
@@ -7472,10 +7472,11 @@ var DECLARED_ENTRIES = [
   // setup-node before it can prune, so at 100% it dies at checkout and never prunes — the cleanup is
   // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
   // a no-op below 90% disk, which is why 15 minutes is affordable.
-  { name: "mmi-runner-hygiene-oob (mmi-runner)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-hygiene \u2192 /opt/mmi-control/runner-hygiene-oob.sh; routine docker/cache prunes every tick, _work relief only at >=90% disk (verify: mmi-cli devops runtime box get mmi-runner --ssh)" },
+  { name: "mmi-runner-hygiene-oob (mmi-runner, mmi-runner2)", cadence: "*/15 * * * * + 5-59/15,10-59/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-hygiene \u2192 /opt/mmi-control/runner-hygiene-oob.sh; routine docker/cache prunes every 15 min, relief-only pressure checks between, _work relief at >=90% disk or <8 GiB free; second-host rollout #7859 (verify each box via mmi-cli devops runtime box get <box> --ssh)" },
   // #4118: Listening + systemd-active ≠ GitHub online after acquirejob 503. restart.conf cannot see
   // it; an Actions workflow on mmi-live cannot heal it when half the fleet is offline. Root cron.
   { name: "mmi-runner-online-reconcile (mmi-runner)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; API-offline + _diag acquirejob, max 2 restarts/tick (verify: mmi-cli devops runtime box get mmi-runner --ssh)" },
+  { name: "mmi-runner-online-reconcile (mmi-runner2)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; scripts/runner2-online-reconcile.cron selects lanes 13-16, disables credential files, _diag acquirejob only, max 2 restarts/tick; rollout #7859 (verify: mmi-cli devops runtime box get mmi-runner2 --ssh)" },
   // #5292: a lane that holds a dispatched JOB but produces zero output past the budget honestly
   // reports "busy", so the online reconcile never fires and GitHub will not re-dispatch while the
   // run holds the assignment. This tick cancels + re-triggers those runs (max 1/tick, debounced).
@@ -7483,7 +7484,7 @@ var DECLARED_ENTRIES = [
   // #3852: the runner /tmp sweep — daily inode hygiene (03:41 UTC), deliberately the one clutter path the
   // out-of-band disk-relief script must never touch. Verified installed 2026-08-18: the cron.d file and
   // flock line match scripts/runner-tmp-sweep.cron exactly.
-  { name: "mmi-runner-tmp-sweep (mmi-runner)", cadence: "41 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-tmp-sweep \u2192 /opt/mmi-control/runner-tmp-sweep.sh; hourly inode hygiene, 6h age (#6274), flock -n (verify: mmi-cli devops runtime box get mmi-runner --ssh)" }
+  { name: "mmi-runner-tmp-sweep (mmi-runner, mmi-runner2)", cadence: "41 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-tmp-sweep \u2192 /opt/mmi-control/runner-tmp-sweep.sh; hourly inode hygiene, 6h age (#6274), flock -n; second-host rollout #7859 (verify each box via mmi-cli devops runtime box get <box> --ssh)" }
   // RETIRED 2026-08-18 (MMI-Hub#5234): `zuber-bake` (every 30 min) and `zuber-bake-full` (daily 00:30 UTC)
   // were declared as zuber systemd timers. The ZuberShade full park (#1774, 2026-08-06) stopped them: on
   // the box (46.225.58.31) zuber-bake.timer / zuber-bake-full.timer answer not-found and
@@ -17255,10 +17256,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.94",
-    tag: "v4.5.94",
-    commit: "f01a89cb9110",
-    npm: "@mutmutco/cli@4.5.94"
+    version: "4.5.96",
+    tag: "v4.5.96",
+    commit: "191fc3cf3396",
+    npm: "@mutmutco/cli@4.5.96"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17275,14 +17276,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.94"
+          v3Target: "v4.5.96"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.94 and redeploy the Hub Lambda from tag v4.5.94 (f01a89cb9110); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.94 (@mutmutco/cli@4.5.94, tag commit f01a89cb9110 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.96 and redeploy the Hub Lambda from tag v4.5.96 (191fc3cf3396); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.96 (@mutmutco/cli@4.5.96, tag commit 191fc3cf3396 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -36127,6 +36128,21 @@ async function suiteMarkAbandoned(deps, ownerGo = false) {
   for (const t of tags) await deps.markAbandoned(t.repo, t.tag, t.sha);
   return tags.map((t) => `${t.repo}@${t.tag}`);
 }
+async function retireFailedLeadRcLedger(deps, ownerGo) {
+  if (!(0, import_node_fs29.existsSync)(deps.ledgerPath)) return void 0;
+  return withLedgerLock(deps.ledgerPath, async (fence) => {
+    const ledger = parseReleaseLedger((0, import_node_fs29.readFileSync)(deps.ledgerPath, "utf8"));
+    const states = Object.values(ledger.phases).map((p) => p.state);
+    if (ledger.repo !== SUITE_REPO || ledger.lane !== "rcand" || ledger.phases.promotion.state === "complete" || !states.includes("failed")) return void 0;
+    if (!ownerGo) throw new Error(`the lead's failed rcand ledger for ${ledger.tag} blocks every train; retire it with suite abandon --owner-go`);
+    if ((await deps.rcHead())?.toLowerCase() === ledger.tagSha.toLowerCase()) throw new Error(`origin rc already points at ${ledger.tag}; it was promoted, so its ledger is not retired`);
+    const archive = (0, import_node_path29.join)((0, import_node_path29.dirname)(deps.ledgerPath), `phases.archive-${ledger.tag}.json`);
+    if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`ledger archive already exists at ${archive}; inspect before retiring again`);
+    await deps.markAbandoned(SUITE_REPO, ledger.tag, ledger.tagSha);
+    await fence(() => (0, import_node_fs29.renameSync)(deps.ledgerPath, archive));
+    return `${ledger.tag} (ledger archived to ${archive})`;
+  });
+}
 function suiteAbandon(recordPath, ownerGo = false, now = /* @__PURE__ */ new Date()) {
   const record = abandonableCut(recordPath, ownerGo);
   const archive = `${recordPath}.abandoned-${record.leadDevelopment.slice(0, 12)}-${now.toISOString().replace(/[:.]/g, "")}.json`;
@@ -37000,8 +37016,8 @@ function bothSidesText(portFailures, portLaneShas) {
   if (rows.length === 0) return "";
   return `BEFORE that --ack: ${rows.map((r) => `${r.label} also conflicts on ${r.paths.join(", ")}`).join("; ")}, which exist on both branches \u2014 the port resolves them by hand for main, so land the SAME resolution on development first (the --ack covers the whole commit, and the next release would otherwise overwrite or clash with the main-only content). `;
 }
-function formatHotfixBatchPreflightRefusal(failures, fromSpecs, portLaneShas = /* @__PURE__ */ new Map()) {
-  const lines2 = failures.map((f) => `  - ${f.label}: ${f.blocking.join(", ")}`);
+function formatHotfixBatchPreflightRefusal(failures, fromSpecs, portLaneShas = /* @__PURE__ */ new Map(), context = { sources: failures, ackedShas: [] }) {
+  const lines2 = failures.map((f) => `  - ${f.label}: ${f.blocking.join(", ")}` + (f.afterAbortedPicks?.length ? ` (observed after aborted pick(s): ${f.afterAbortedPicks.join(", ")}; may depend on those missing changes)` : ""));
   const portFailures = failures.filter((f) => portLaneShas.has(f.sha));
   const synthFailures = failures.filter((f) => !portLaneShas.has(f.sha));
   const head = `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
@@ -37009,15 +37025,15 @@ ${lines2.join("\n")}
 `;
   const batchFrom = fromSpecs.join(",");
   const guide = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused";
-  if (portFailures.length > 0) {
-    const originals = portFailures.map((f) => f.sha.slice(0, 7)).join(",");
-    const portText = `${portFailures.length === failures.length ? "Every failing pick" : `Pick(s) ${portFailures.map((f) => f.label).join(", ")}`} fail on path(s) ABSENT on origin/main but present on origin/development, so a development-based cite-only synthesis PR cannot carry them (a new development commit cannot add files development already has \u2014 its cherry-pick onto main carries nothing, #7669). Use the main-based PORT-COMMIT lane: cut a branch FROM origin/main, add ONE port commit that brings the listed path(s) and the fix onto main-lineage (e.g. \`git checkout origin/development -- <paths>\` then the fix), push it and keep it pushed until the release \u2014 never merge it into development \u2014 then run \`mmi-cli devops hotfix start --from <portSHA> --ack ${originals}\` (a bare SHA is accepted; the originals are the acked development fixes the port replaces), and record the port SHA in the hotfix PR body. The port commit never reaches development and will not patch-id match, so the NEXT rc\u2192main release must pass \`--ack <the hotfix's main commit>\` (hotfix-coverage). ` + bothSidesText(portFailures, portLaneShas);
-    if (synthFailures.length === 0) return `${head}${portText}Never hand-resolve onto main; see ${guide}`;
-    return `${head}Mixed batch \u2014 two lanes. ${portText}Pick(s) ${synthFailures.map((f) => f.label).join(", ")} fit the development-based cite-only synthesis lane instead: cut the branch FROM origin/development, regenerate the conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the #5096 flow). Then rerun \`mmi-cli devops hotfix start --from <synthesis merge SHA(s)>,<portSHA> --ack ${originals}\` (the original --from was ${batchFrom}) \u2014 never hand-resolve onto main; never a main-parented branch into development; see ${guide}`;
-  }
-  return `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
-${lines2.join("\n")}
-Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
+  const replaceNow = failures.filter((f) => !f.afterAbortedPicks?.length);
+  const replacements = new Map(replaceNow.map((f, i) => [f.sha, `<replacementSHA${i + 1}>`]));
+  const picks = context.sources.map((s) => replacements.get(s.sha) ?? s.sha).join(",");
+  const exclusions = [.../* @__PURE__ */ new Set([...context.ackedShas, ...replaceNow.map((f) => f.sha)])].join(",");
+  const mapping = replaceNow.map((f) => `${replacements.get(f.sha)} replaces ${f.label} (${f.sha})`).join("; ");
+  const dependencyNote = failures.some((f) => f.afterAbortedPicks?.length) ? "Later failures were observed after earlier picks were aborted. Keep those original SHAs in the retry. Re-preflight the complete repaired batch before treating a later path absent on static origin/main as an independent port requirement. If a later pick still fails, replacing it requires separate approval for its exact original SHA. " : "";
+  const portText = portFailures.length > 0 ? `Pick(s) ${portFailures.map((f) => f.label).join(", ")} have path(s) ABSENT on origin/main but present on origin/development. If they still fail after prerequisite repairs, use the main-based PORT-COMMIT lane: cut a branch FROM origin/main, add the missing paths and fix, push it and keep it pushed until the release \u2014 never merge it into development. Record the port SHA in the hotfix PR body. The NEXT rc\u2192main release must pass \`--ack <the hotfix's main commit>\` (hotfix-coverage). ` + bothSidesText(portFailures, portLaneShas) : "";
+  const repairText = synthFailures.length > 0 ? `Pick(s) ${synthFailures.map((f) => f.label).join(", ")} need a development repair PR: cut FROM origin/development and land the conflict correction through normal CI. Its picked commit must carry the required main-clean delta; merely citing the original fixes carries no content and grants no coverage exemption. If that delta cannot be produced on development, stop and ask the owner for a scoped port plan. ` : "";
+  return `${head}${portFailures.length > 0 && synthFailures.length > 0 ? "Mixed batch. " : ""}${dependencyNote}${portText}${repairText}Original ordered --from: ${batchFrom}. Replacement mapping: ${mapping}. Keep every passing pick in its original position and retain existing approved exclusions. Additional owner approval required for replacing/excluding original development commit(s): ${replaceNow.map((f) => f.sha).join(",")}. No cite-only marker is implemented; mmi-hotfix-carries is release verification only. Only after that explicit approval, replace the placeholders and rerun \`mmi-cli devops hotfix start --from ${picks} --ack ${exclusions}\`. Re-preflight the whole batch. Never hand-resolve onto main or merge a main-parented branch into development; see ${guide}`;
 }
 var CHERRY_PICKED_FROM = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 async function scanHotfixPickGaps(deps, sources, tolerated, rcRef) {
@@ -37107,7 +37123,8 @@ async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
           failures.push({
             label: source.label,
             sha: source.sha,
-            blocking: blocking.length > 0 ? blocking : [message2.split("\n")[0] ?? message2]
+            blocking: blocking.length > 0 ? blocking : [message2.split("\n")[0] ?? message2],
+            ...failures.length > 0 ? { afterAbortedPicks: failures.map((f) => f.label) } : {}
           });
         }
       }
@@ -37322,7 +37339,7 @@ async function runHotfixStartLocked(deps, options, doctor) {
     const preflight2 = await preflightHotfixBatchPicks(deps, sources, pickTolerated);
     if (preflight2.failures.length > 0) {
       const portLaneShas = await classifyHotfixPortLanePicks(deps, preflight2.failures);
-      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs, portLaneShas));
+      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs, portLaneShas, { sources, ackedShas }));
     }
     if (preflight2.skipped.length > 0) {
       const skippedShas = new Set(preflight2.skipped.map((s) => s.sha));
@@ -47480,8 +47497,14 @@ function registerSuiteCommands(program3) {
       let result;
       let restored;
       let marked;
+      let retired;
       try {
         const io = suiteTrainIo(root);
+        retired = await retireFailedLeadRcLedger({ ledgerPath: releaseLedgerPath(root), rcHead: () => io.head(SUITE_REPO, "rc").then((h) => h ?? void 0), markAbandoned: io.markAbandoned }, o.ownerGo === true);
+        if (retired && !(0, import_node_fs44.existsSync)(io.recordPath)) {
+          console.log(o.json ? JSON.stringify({ retiredLeadRc: retired }, null, 2) : `suite abandon: retired the lead's failed, never-promoted rc candidate ${retired}; marked abandoned on origin (#7854)`);
+          return;
+        }
         restored = o.ownerGo === true ? await suiteRestoreMainPins(io) : void 0;
         marked = await suiteMarkAbandoned(io, o.ownerGo === true);
         result = suiteAbandon(io.recordPath, o.ownerGo === true);
@@ -47492,6 +47515,7 @@ function registerSuiteCommands(program3) {
         `suite abandon: archived the cut record to ${result.archive}`,
         ...result.orphanTags.length ? ["  member rc tags left in place (immutable; the next cut reuses one still unreleased on its rc head, #7450):", ...result.orphanTags.map((t) => `  - ${t}`)] : ["  no member rc tag was minted"],
         ...restored ? [`  main pins the cut planned for unreleased tags are restored by ${restored.pr} (${restored.status}, #7758)`] : [],
+        ...retired ? [`  retired the lead's failed, never-promoted rc candidate ${retired} (#7854)`] : [],
         ...marked.length ? [`  marked abandoned on origin, so the hotfix guard stops counting them as active (#7801): ${marked.join(", ")}`] : [],
         "  the next suite rcand --owner-go re-snapshots every member"
       ].join("\n"));

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.94",
+  "version": "4.5.96",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.94",
+  "version": "4.5.96",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",