@mutmutco/codex-plugin 4.5.95 → 4.5.97

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.95",
+  "version": "4.5.97",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -5927,7 +5927,7 @@ async function waitForPrChecks(deps) {
       reason = NO_CI_LIVE_CHECKS_CONTRADICTION_REASON;
       deps.log?.(`merge CI policy contradiction: ${reason}; waiting for live PR checks`);
       policy = "wait-for-checks";
-      queuedStates.push(firstState);
+      if (!deps.pollChecksWithEvidence) queuedStates.push(firstState);
     } catch (e) {
       if (!isRetryableGitHubWaitReadError(e)) {
         return { policy, status: "failure", reason: waitReadFailureMessage(e), detail: "github-read-failed" };
@@ -5955,6 +5955,8 @@ async function waitForPrChecks(deps) {
   let successStreak = 0;
   let failureStreak = 0;
   let zeroRunsStreak = 0;
+  let evidenceHeadSha;
+  let lastEvidence;
   report("starting");
   while (now() < deadline) {
     if (deps.pollRateLimit) {
@@ -5986,7 +5988,17 @@ async function waitForPrChecks(deps) {
     }
     let state;
     try {
-      state = queuedStates.shift() ?? await deps.pollChecks();
+      if (queuedStates.length) state = queuedStates.shift();
+      else if (deps.pollChecksWithEvidence) {
+        lastEvidence = await deps.pollChecksWithEvidence();
+        if (evidenceHeadSha !== void 0 && evidenceHeadSha !== lastEvidence.headSha) {
+          successStreak = 0;
+          failureStreak = 0;
+          zeroRunsStreak = 0;
+        }
+        evidenceHeadSha = lastEvidence.headSha;
+        state = lastEvidence.state;
+      } else state = await deps.pollChecks();
     } catch (e) {
       if (!isRetryableGitHubWaitReadError(e)) {
         return { policy, status: "failure", reason: waitReadFailureMessage(e), detail: "github-read-failed", waitedMs: now() - started };
@@ -6032,7 +6044,13 @@ async function waitForPrChecks(deps) {
     if (state === "success") {
       successStreak += 1;
       if (successStreak >= PR_CHECKS_SUCCESS_CONFIRMATIONS) {
-        return { policy, status: "success", reason, detail: "checks-success" };
+        return {
+          policy,
+          status: "success",
+          reason,
+          detail: "checks-success",
+          ...lastEvidence ? { headSha: lastEvidence.headSha, checks: lastEvidence.checks, workflowRuns: lastEvidence.workflows } : {}
+        };
       }
       lastDetail = "confirming-success";
       await deps.sleep(PR_CHECKS_CONFIRM_MS);
@@ -6347,6 +6365,36 @@ async function pollRestPrChecks(prNumber, repo, gh2 = defaultGhApi, requiredCont
   const { relevant } = partitionByRequired(entries, requiredContexts);
   return derivePollState(relevant);
 }
+async function pollRestPrChecksWithWorkflowEvidence(prNumber, repo, gh2 = defaultGhApi) {
+  const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh2);
+  const [entries, rawRuns] = await Promise.all([
+    fetchHeadCheckEntries(snapshot.headSha, repo, gh2),
+    gh2(["--paginate", `repos/${repo}/actions/runs?head_sha=${encodeURIComponent(snapshot.headSha)}&per_page=100`, "--jq", ".workflow_runs[] | {id, name, head_sha, status, conclusion, html_url}"])
+  ]);
+  const checks = entries.filter((entry) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(entry.name)).map((entry) => ({ name: entry.name, state: entry.bucket }));
+  const workflows = parseNdjsonLines(rawRuns).flatMap((run) => {
+    if (run.head_sha !== snapshot.headSha || typeof run.id !== "number" || typeof run.name !== "string" || typeof run.status !== "string") return [];
+    if (AUXILIARY_RELEASE_CHECK_CONTEXTS.has(run.name)) return [];
+    return [{
+      id: run.id,
+      name: run.name,
+      headSha: snapshot.headSha,
+      status: run.status,
+      conclusion: typeof run.conclusion === "string" ? run.conclusion : null,
+      ...typeof run.html_url === "string" ? { url: run.html_url } : {}
+    }];
+  });
+  const workflowBuckets = workflows.map((run) => {
+    if (run.status !== "completed") return "pending";
+    return run.conclusion === "success" || run.conclusion === "neutral" || run.conclusion === "skipped" ? "pass" : "fail";
+  });
+  return {
+    state: derivePollState([...checks.map((check) => check.state), ...workflowBuckets]),
+    headSha: snapshot.headSha,
+    checks,
+    workflows
+  };
+}
 async function pollRestCommitChecks(sha, repo, gh2 = defaultGhApi) {
   return derivePollState(partitionByRequired(await fetchHeadCheckEntries(sha, repo, gh2), null).relevant);
 }
@@ -7460,11 +7508,11 @@ function workflowEntry(repo, workflowPath, yamlText) {
   };
 }
 var DECLARED_ENTRIES = [
-  { name: "mmi-backup (mm-central, mm-work, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh; every Docker volume is tarred and every running Postgres container is pg_dumpall'd beside it (#7147; source scripts/nightly-backup.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
+  { name: "mmi-backup (mm-central, mm-work)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh; every Docker volume is tarred and every running Postgres container is pg_dumpall'd beside it (#7147; source scripts/nightly-backup.sh); owner-approved mmi-oguz rebuild as CI-only mmi-runner2 with full erasure and no backups (#7859); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
   // #7148: a backup nobody restored is a hope. Monthly, restore the latest artifact of every
   // archived stage (including a stage whose containers are down) into scratch Postgres and compare
   // row counts, and read-verify every storage archive against its listing; per-stage PASS/FAIL.
-  { name: "mmi-backup-restore-check (mm-central, mm-work, mmi-oguz)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
+  { name: "mmi-backup-restore-check (mm-central, mm-work)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); owner-approved mmi-oguz rebuild as CI-only mmi-runner2 with full erasure and no backups (#7859); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
   // #7662 (MM-Work#1520): Vercel Cron's 15-minute central mail call, moved to the box with MM-Work. The app
   // calls its own endpoint with its own CRON_SECRET via docker exec, so the secret stays in the container.
   { name: "mm-work-mail-tick (mm-work)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mm-work-mail-tick \u2192 /opt/mmi-control/mm-work-mail-tick.sh; GET /api/internal/mail per stage listed in MM_WORK_MAIL_STAGES (source scripts/mm-work-mail-tick.sh; log /var/log/mm-work-mail-tick.log)" },
@@ -7472,10 +7520,11 @@ var DECLARED_ENTRIES = [
   // setup-node before it can prune, so at 100% it dies at checkout and never prunes — the cleanup is
   // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
   // a no-op below 90% disk, which is why 15 minutes is affordable.
-  { name: "mmi-runner-hygiene-oob (mmi-runner)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-hygiene \u2192 /opt/mmi-control/runner-hygiene-oob.sh; routine docker/cache prunes every tick, _work relief only at >=90% disk (verify: mmi-cli devops runtime box get mmi-runner --ssh)" },
+  { name: "mmi-runner-hygiene-oob (mmi-runner, mmi-runner2)", cadence: "*/15 * * * * + 5-59/15,10-59/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-hygiene \u2192 /opt/mmi-control/runner-hygiene-oob.sh; routine docker/cache prunes every 15 min, relief-only pressure checks between, _work relief at >=90% disk or <8 GiB free; second-host rollout #7859 (verify each box via mmi-cli devops runtime box get <box> --ssh)" },
   // #4118: Listening + systemd-active ≠ GitHub online after acquirejob 503. restart.conf cannot see
   // it; an Actions workflow on mmi-live cannot heal it when half the fleet is offline. Root cron.
   { name: "mmi-runner-online-reconcile (mmi-runner)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; API-offline + _diag acquirejob, max 2 restarts/tick (verify: mmi-cli devops runtime box get mmi-runner --ssh)" },
+  { name: "mmi-runner-online-reconcile (mmi-runner2)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; scripts/runner2-online-reconcile.cron selects lanes 13-16, disables credential files, _diag acquirejob only, max 2 restarts/tick; rollout #7859 (verify: mmi-cli devops runtime box get mmi-runner2 --ssh)" },
   // #5292: a lane that holds a dispatched JOB but produces zero output past the budget honestly
   // reports "busy", so the online reconcile never fires and GitHub will not re-dispatch while the
   // run holds the assignment. This tick cancels + re-triggers those runs (max 1/tick, debounced).
@@ -7483,7 +7532,7 @@ var DECLARED_ENTRIES = [
   // #3852: the runner /tmp sweep — daily inode hygiene (03:41 UTC), deliberately the one clutter path the
   // out-of-band disk-relief script must never touch. Verified installed 2026-08-18: the cron.d file and
   // flock line match scripts/runner-tmp-sweep.cron exactly.
-  { name: "mmi-runner-tmp-sweep (mmi-runner)", cadence: "41 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-tmp-sweep \u2192 /opt/mmi-control/runner-tmp-sweep.sh; hourly inode hygiene, 6h age (#6274), flock -n (verify: mmi-cli devops runtime box get mmi-runner --ssh)" }
+  { name: "mmi-runner-tmp-sweep (mmi-runner, mmi-runner2)", cadence: "41 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-tmp-sweep \u2192 /opt/mmi-control/runner-tmp-sweep.sh; hourly inode hygiene, 6h age (#6274), flock -n; second-host rollout #7859 (verify each box via mmi-cli devops runtime box get <box> --ssh)" }
   // RETIRED 2026-08-18 (MMI-Hub#5234): `zuber-bake` (every 30 min) and `zuber-bake-full` (daily 00:30 UTC)
   // were declared as zuber systemd timers. The ZuberShade full park (#1774, 2026-08-06) stopped them: on
   // the box (46.225.58.31) zuber-bake.timer / zuber-bake-full.timer answer not-found and
@@ -13142,6 +13191,7 @@ function deriveLoopStaleness(item, loopState, now = Date.now()) {
   };
 }
 var CLAIM_MARKER_PATTERN = /<!--\s*mmi-claim:\s*(\{[\s\S]*?\})\s*-->/g;
+var CLAIM_RELEASE_PATTERN = /<!--\s*mmi-claim-release:\s*(\{[\s\S]*?\})\s*-->/g;
 var CLAIM_MARKER_LIVE_MS = 24 * 60 * 6e4;
 var CLAIM_STAMP_IDLE_MS = 4 * 60 * 6e4;
 function isValidClaimMarker(parsed) {
@@ -13160,10 +13210,36 @@ function parseClaimMarkers(body) {
   }
   return out;
 }
+function isValidClaimRelease(parsed) {
+  if (!parsed || typeof parsed !== "object") return false;
+  const release = parsed;
+  return typeof release.v === "number" && typeof release.ts === "string" && Number.isFinite(Date.parse(release.ts)) && (release.session === void 0 || typeof release.session === "string") && (release.surface === void 0 || typeof release.surface === "string") && (release.host === void 0 || typeof release.host === "string");
+}
+function parseClaimReleases(body) {
+  const out = [];
+  for (const match of body.matchAll(CLAIM_RELEASE_PATTERN)) {
+    try {
+      const parsed = JSON.parse(match[1]);
+      if (isValidClaimRelease(parsed)) out.push(parsed);
+    } catch {
+    }
+  }
+  return out;
+}
+function renderClaimReleaseBody(release) {
+  return `Released by \`${formatSessionIdentity(release)}\` at ${release.ts}.
+
+<!-- mmi-claim-release: ${JSON.stringify(release)} -->`;
+}
 function latestClaimMarker(comments) {
   for (let i = comments.length - 1; i >= 0; i -= 1) {
-    const markers = parseClaimMarkers(comments[i].body);
-    if (markers.length) return markers[markers.length - 1];
+    const body = comments[i].body;
+    const markers = parseClaimMarkers(body);
+    const releases = parseClaimReleases(body);
+    if (!markers.length && !releases.length) continue;
+    if (!releases.length) return markers[markers.length - 1];
+    if (!markers.length) return void 0;
+    return body.lastIndexOf("mmi-claim-release:") > body.lastIndexOf("mmi-claim:") ? void 0 : markers[markers.length - 1];
   }
   return void 0;
 }
@@ -13197,7 +13273,7 @@ function claimFromMarker(item, marker, linked = {}, now = Date.now()) {
     holder: describeClaimMarker(marker),
     ageMs: now - Date.parse(marker.ts),
     currentlyClaimed: item.assignees.length > 0 && item.status === "In Progress",
-    ...claimStampStaleness(marker, { activityAt: [item.updatedAt, ...linked.activityAt ?? []], linkedWork: linked.linkedWork }, now)
+    ...claimStampStaleness(marker, { activityAt: [...linked.activityAt ?? []], linkedWork: linked.linkedWork }, now)
   };
 }
 function classifyClaimableMarker(comments, actor, now = Date.now(), activityAt = []) {
@@ -13279,7 +13355,7 @@ async function demoteLiveClaimedClaimables(scope, client, actor = describeSessio
       warnings.push(`${item.ref} left claimable: claim-marker evidence could not be read`);
       continue;
     }
-    const verdict = classifyClaimableMarker(comments, actor, deps.now, [item.updatedAt]);
+    const verdict = classifyClaimableMarker(comments, actor, deps.now);
     if (verdict.verdict === "claimable") {
       stillClaimable.push(item);
     } else if (verdict.verdict === "owned") {
@@ -14200,6 +14276,20 @@ async function unclaimBoardIssue(options, deps = {}) {
     if (!options.allowPartial) throw new Error(warning);
     return { item, viewer, repo: currentRepo, status: item.status, partial: true, warning };
   }
+  try {
+    const actor = deps.session ?? describeSessionIdentity();
+    const release = {
+      v: 1,
+      session: actor.session,
+      surface: actor.surface,
+      host: actor.host,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await postIssueComment(client, { ref: item.ref, body: renderClaimReleaseBody(release) });
+  } catch (e) {
+    process.stderr.write(`warning: ${item.ref} was unclaimed, but recording the release marker comment failed: ${ghError(e)}
+`);
+  }
   const optionId = cfg.statusOptions[toStatus];
   let unclaimCredential = "user";
   try {
@@ -15223,7 +15313,7 @@ function createDocsIndexDeps(repoRoot2) {
 
 // src/gate-budget.ts
 var BLESSED_RUN_WITH_BUDGET_SHA = "5ce541add569e54e7ca96de67a768577d3d604e4";
-var BLESSED_RUNNER_GATE_SHA = "a6ee756d94fd95884451381e94408f0348eb11db";
+var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
 var FULL_SHA = /^[0-9a-f]{40}$/;
@@ -17255,10 +17345,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.95",
-    tag: "v4.5.95",
-    commit: "d6d4a135bce9",
-    npm: "@mutmutco/cli@4.5.95"
+    version: "4.5.97",
+    tag: "v4.5.97",
+    commit: "72af9cdfc1b7",
+    npm: "@mutmutco/cli@4.5.97"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17275,14 +17365,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.95"
+          v3Target: "v4.5.97"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.95 and redeploy the Hub Lambda from tag v4.5.95 (d6d4a135bce9); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.95 (@mutmutco/cli@4.5.95, tag commit d6d4a135bce9 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.97 and redeploy the Hub Lambda from tag v4.5.97 (72af9cdfc1b7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.97 (@mutmutco/cli@4.5.97, tag commit 72af9cdfc1b7 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -30464,8 +30554,10 @@ function trainPlanTargetsFromTags(tags, explicitRaw) {
 }
 function derivedStagePlan(derived, shell2, stops = true) {
   const { port } = derived;
-  const envOrder = ["MMI_STAGE", "MMI_PORT", "COMPOSE_PROFILES"];
-  const resolved = { MMI_STAGE: "development", MMI_PORT: String(port), COMPOSE_PROFILES: "local" };
+  const baseOrder = ["MMI_STAGE", "MMI_PORT", "COMPOSE_PROFILES"];
+  const projectName = derived.config.env?.COMPOSE_PROJECT_NAME?.trim();
+  const envOrder = projectName ? [...baseOrder, "COMPOSE_PROJECT_NAME"] : baseOrder;
+  const resolved = { MMI_STAGE: "dev", MMI_PORT: String(port), COMPOSE_PROFILES: "local", ...projectName ? { COMPOSE_PROJECT_NAME: projectName } : {} };
   const ensureEnv = shell2 === "powershell" ? `if (-not (Test-Path -LiteralPath '.env')) { Copy-Item -LiteralPath '.env.example' -Destination '.env' }` : `[ -f .env ] || cp .env.example .env`;
   const envPrefix = shell2 === "powershell" ? envOrder.map((k) => `$env:${k}='${resolved[k]}'`).join("; ") : envOrder.map((k) => `${k}=${resolved[k]}`).join(" ");
   const build = shell2 === "powershell" ? `${envPrefix}; ${derived.config.build ?? "docker compose build --no-cache"}` : `${envPrefix} ${derived.config.build ?? "docker compose build --no-cache"}`;
@@ -37015,8 +37107,8 @@ function bothSidesText(portFailures, portLaneShas) {
   if (rows.length === 0) return "";
   return `BEFORE that --ack: ${rows.map((r) => `${r.label} also conflicts on ${r.paths.join(", ")}`).join("; ")}, which exist on both branches \u2014 the port resolves them by hand for main, so land the SAME resolution on development first (the --ack covers the whole commit, and the next release would otherwise overwrite or clash with the main-only content). `;
 }
-function formatHotfixBatchPreflightRefusal(failures, fromSpecs, portLaneShas = /* @__PURE__ */ new Map()) {
-  const lines2 = failures.map((f) => `  - ${f.label}: ${f.blocking.join(", ")}`);
+function formatHotfixBatchPreflightRefusal(failures, fromSpecs, portLaneShas = /* @__PURE__ */ new Map(), context = { sources: failures, ackedShas: [] }) {
+  const lines2 = failures.map((f) => `  - ${f.label}: ${f.blocking.join(", ")}` + (f.afterAbortedPicks?.length ? ` (observed after aborted pick(s): ${f.afterAbortedPicks.join(", ")}; may depend on those missing changes)` : ""));
   const portFailures = failures.filter((f) => portLaneShas.has(f.sha));
   const synthFailures = failures.filter((f) => !portLaneShas.has(f.sha));
   const head = `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
@@ -37024,15 +37116,15 @@ ${lines2.join("\n")}
 `;
   const batchFrom = fromSpecs.join(",");
   const guide = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused";
-  if (portFailures.length > 0) {
-    const originals = portFailures.map((f) => f.sha.slice(0, 7)).join(",");
-    const portText = `${portFailures.length === failures.length ? "Every failing pick" : `Pick(s) ${portFailures.map((f) => f.label).join(", ")}`} fail on path(s) ABSENT on origin/main but present on origin/development, so a development-based cite-only synthesis PR cannot carry them (a new development commit cannot add files development already has \u2014 its cherry-pick onto main carries nothing, #7669). Use the main-based PORT-COMMIT lane: cut a branch FROM origin/main, add ONE port commit that brings the listed path(s) and the fix onto main-lineage (e.g. \`git checkout origin/development -- <paths>\` then the fix), push it and keep it pushed until the release \u2014 never merge it into development \u2014 then run \`mmi-cli devops hotfix start --from <portSHA> --ack ${originals}\` (a bare SHA is accepted; the originals are the acked development fixes the port replaces), and record the port SHA in the hotfix PR body. The port commit never reaches development and will not patch-id match, so the NEXT rc\u2192main release must pass \`--ack <the hotfix's main commit>\` (hotfix-coverage). ` + bothSidesText(portFailures, portLaneShas);
-    if (synthFailures.length === 0) return `${head}${portText}Never hand-resolve onto main; see ${guide}`;
-    return `${head}Mixed batch \u2014 two lanes. ${portText}Pick(s) ${synthFailures.map((f) => f.label).join(", ")} fit the development-based cite-only synthesis lane instead: cut the branch FROM origin/development, regenerate the conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the #5096 flow). Then rerun \`mmi-cli devops hotfix start --from <synthesis merge SHA(s)>,<portSHA> --ack ${originals}\` (the original --from was ${batchFrom}) \u2014 never hand-resolve onto main; never a main-parented branch into development; see ${guide}`;
-  }
-  return `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
-${lines2.join("\n")}
-Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
+  const replaceNow = failures.filter((f) => !f.afterAbortedPicks?.length);
+  const replacements = new Map(replaceNow.map((f, i) => [f.sha, `<replacementSHA${i + 1}>`]));
+  const picks = context.sources.map((s) => replacements.get(s.sha) ?? s.sha).join(",");
+  const exclusions = [.../* @__PURE__ */ new Set([...context.ackedShas, ...replaceNow.map((f) => f.sha)])].join(",");
+  const mapping = replaceNow.map((f) => `${replacements.get(f.sha)} replaces ${f.label} (${f.sha})`).join("; ");
+  const dependencyNote = failures.some((f) => f.afterAbortedPicks?.length) ? "Later failures were observed after earlier picks were aborted. Keep those original SHAs in the retry. Re-preflight the complete repaired batch before treating a later path absent on static origin/main as an independent port requirement. If a later pick still fails, replacing it requires separate approval for its exact original SHA. " : "";
+  const portText = portFailures.length > 0 ? `Pick(s) ${portFailures.map((f) => f.label).join(", ")} have path(s) ABSENT on origin/main but present on origin/development. If they still fail after prerequisite repairs, use the main-based PORT-COMMIT lane: cut a branch FROM origin/main, add the missing paths and fix, push it and keep it pushed until the release \u2014 never merge it into development. Record the port SHA in the hotfix PR body. The NEXT rc\u2192main release must pass \`--ack <the hotfix's main commit>\` (hotfix-coverage). ` + bothSidesText(portFailures, portLaneShas) : "";
+  const repairText = synthFailures.length > 0 ? `Pick(s) ${synthFailures.map((f) => f.label).join(", ")} need a development repair PR: cut FROM origin/development and land the conflict correction through normal CI. Its picked commit must carry the required main-clean delta; merely citing the original fixes carries no content and grants no coverage exemption. If that delta cannot be produced on development, stop and ask the owner for a scoped port plan. ` : "";
+  return `${head}${portFailures.length > 0 && synthFailures.length > 0 ? "Mixed batch. " : ""}${dependencyNote}${portText}${repairText}Original ordered --from: ${batchFrom}. Replacement mapping: ${mapping}. Keep every passing pick in its original position and retain existing approved exclusions. Additional owner approval required for replacing/excluding original development commit(s): ${replaceNow.map((f) => f.sha).join(",")}. No cite-only marker is implemented; mmi-hotfix-carries is release verification only. Only after that explicit approval, replace the placeholders and rerun \`mmi-cli devops hotfix start --from ${picks} --ack ${exclusions}\`. Re-preflight the whole batch. Never hand-resolve onto main or merge a main-parented branch into development; see ${guide}`;
 }
 var CHERRY_PICKED_FROM = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 async function scanHotfixPickGaps(deps, sources, tolerated, rcRef) {
@@ -37122,7 +37214,8 @@ async function preflightHotfixBatchPicks(deps, sources, pickTolerated) {
           failures.push({
             label: source.label,
             sha: source.sha,
-            blocking: blocking.length > 0 ? blocking : [message2.split("\n")[0] ?? message2]
+            blocking: blocking.length > 0 ? blocking : [message2.split("\n")[0] ?? message2],
+            ...failures.length > 0 ? { afterAbortedPicks: failures.map((f) => f.label) } : {}
           });
         }
       }
@@ -37337,7 +37430,7 @@ async function runHotfixStartLocked(deps, options, doctor) {
     const preflight2 = await preflightHotfixBatchPicks(deps, sources, pickTolerated);
     if (preflight2.failures.length > 0) {
       const portLaneShas = await classifyHotfixPortLanePicks(deps, preflight2.failures);
-      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs, portLaneShas));
+      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs, portLaneShas, { sources, ackedShas }));
     }
     if (preflight2.skipped.length > 0) {
       const skippedShas = new Set(preflight2.skipped.map((s) => s.sha));
@@ -39570,11 +39663,6 @@ var PROTECTED_BRANCHES = /* @__PURE__ */ new Set(["development", "main", "master
 function isProtectedBranch(branch) {
   return PROTECTED_BRANCHES.has(branch.trim());
 }
-function deriveComposeProjectName(worktreePath) {
-  const base = worktreePath.replace(/\\/g, "/").replace(/\/+$/, "").split("/").pop()?.toLowerCase() ?? "";
-  const name = base.replace(/[^a-z0-9_-]+/g, "_").replace(/^[^a-z0-9]+/, "");
-  return name || void 0;
-}
 
 // src/pr-merge-helpers.ts
 function buildPrMergeArgs(input) {
@@ -41787,6 +41875,53 @@ function parsePrChecksTable(stdout) {
   }
   return rows;
 }
+function includeMissingRequiredChecks(rows, required) {
+  const reported = new Set(rows.map((row) => row.name));
+  const missing = [...new Set(required)].filter((name) => !reported.has(name)).map((name) => ({
+    name,
+    status: "missing",
+    details: "expected required check has not reported"
+  }));
+  return [...rows, ...missing];
+}
+async function requiredCheckContexts(repo, prNumber) {
+  const { stdout: prOutput } = await execFileP("gh", ["pr", "view", String(prNumber), "--repo", repo, "--json", "baseRefName"], { timeout: GC_GH_TIMEOUT_MS2 });
+  const baseRef = JSON.parse(prOutput).baseRefName;
+  if (typeof baseRef !== "string" || !baseRef) throw new Error("pull request response had no base branch");
+  const read = async (path2) => {
+    try {
+      const { stdout } = await execFileP("gh", ["api", path2], { timeout: GC_GH_TIMEOUT_MS2 });
+      return JSON.parse(stdout);
+    } catch (e) {
+      const err = e;
+      if (/\b404\b|Not Found/i.test(`${err.stderr ?? ""} ${err.message ?? ""}`)) return null;
+      throw e;
+    }
+  };
+  const [classic, rules] = await Promise.all([
+    read(`repos/${repo}/branches/${encodeURIComponent(baseRef)}/protection/required_status_checks`),
+    read(`repos/${repo}/rules/branches/${encodeURIComponent(baseRef)}`)
+  ]);
+  const contexts = /* @__PURE__ */ new Set();
+  const oldContexts = classic?.contexts;
+  if (Array.isArray(oldContexts)) {
+    for (const name of oldContexts) if (typeof name === "string") contexts.add(name);
+  }
+  if (Array.isArray(rules)) {
+    for (const rule of rules) {
+      const required = rule.type === "required_status_checks" ? rule.parameters?.required_status_checks : void 0;
+      if (Array.isArray(required)) for (const check of required) {
+        const name = check?.context;
+        if (typeof name === "string") contexts.add(name);
+      }
+    }
+  }
+  return [...contexts];
+}
+function checksStateWithExpected(state, rows, required) {
+  const checks = includeMissingRequiredChecks(rows, required);
+  return checks.some((row) => row.status === "missing") && (state === "success" || state === "no-checks-reported") ? { state: "incomplete", rows: checks } : { state, rows: checks };
+}
 function parseLinkedIssues(body) {
   const refs = /* @__PURE__ */ new Set();
   const re = /\b(?:close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved|ref|refs|re|references)\s+#(\d+)\b/gi;
@@ -42047,6 +42182,7 @@ function registerPrLifecycleCommands(program3) {
       return stdout;
     };
     const withLogs = async (rows) => o.logs ? attachFailureLogs(rows, fetchLog) : rows;
+    let expected = [];
     const snap = async () => {
       let stdout = "";
       let stderr = "";
@@ -42061,14 +42197,15 @@ function registerPrLifecycleCommands(program3) {
       const parsed = parseGhPrChecksResult(stdout, stderr);
       const state = pollStateFromParsed(parsed);
       const rows = parsePrChecksTable(stdout);
-      return { state, rows };
+      return checksStateWithExpected(state, rows, expected);
     };
     try {
+      expected = await requiredCheckContexts(repo, n);
       if (!o.watch) {
         const { state, rows } = await snap();
         const output = { state, checks: await withLogs(rows) };
         console.log(JSON.stringify(output));
-        if (state === "failure" || state === "failing") process.exitCode = 1;
+        if (state === "failure" || state === "failing" || state === "incomplete") process.exitCode = 1;
         return;
       }
       const deadline = Date.now() + CHECKS_WATCH_TIMEOUT_MS;
@@ -42799,11 +42936,18 @@ function parseDockerContainerLs(stdout) {
 function containersPublishingPort(containers, port) {
   return containers.filter((c) => c.publishedHostPorts.includes(port));
 }
+function stageComposeProjectName(cwd) {
+  const parts = cwd.replace(/\\/g, "/").replace(/\/+$/, "").split("/").filter(Boolean);
+  const base = parts.pop() ?? "";
+  const parent = parts.pop();
+  const raw = parent ? `${parent}-${base}` : base;
+  const name = raw.toLowerCase().replace(/[^a-z0-9_-]+/g, "_").replace(/^[^a-z0-9]+/, "");
+  return name || "mmi-stage";
+}
 function isOwnComposeContainer(container, cwd) {
   if (container.composeWorkingDir && normPath(container.composeWorkingDir) === normPath(cwd)) return true;
   if (container.composeWorkingDir && pathUnder(container.composeWorkingDir, cwd)) return true;
-  const derived = deriveComposeProjectName(cwd);
-  return Boolean(derived && container.composeProject === derived);
+  return container.composeProject === stageComposeProjectName(cwd);
 }
 function planStagePortTeardown(containers, port, cwd) {
   const ownProjects = [];
@@ -43045,11 +43189,13 @@ function composeResolvesPort(cwd) {
   return (0, import_node_fs38.existsSync)(envFile) && envFileKeys((0, import_node_fs38.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
+  const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
   return {
     // Vault secrets first so the stage-selection contract (MMI_STAGE/MMI_PORT/…) always wins on any collision.
     ...vaultEnvMerge ?? {},
     ...stageProcessEnv(stagePort, stageExtraEnv(config, stagePort)),
-    ...stagePort != null && !composeResolvesPort(cwd) ? { PORT: String(stagePort) } : {}
+    ...stagePort != null && !composeResolvesPort(cwd) ? { PORT: String(stagePort) } : {},
+    COMPOSE_PROJECT_NAME: composeProject
   };
 }
 function stageComposeFiles(cwd) {
@@ -43199,6 +43345,58 @@ async function killTree(pid) {
     }
   }
 }
+async function describeExitedComposeServices(cwd, env) {
+  const dockerEnv = { ...process.env, ...env };
+  const run = (args) => execFileP3("docker", args, {
+    cwd,
+    windowsHide: true,
+    timeout: DOCKER_TIMEOUT_MS,
+    maxBuffer: 1024 * 1024 * 4,
+    env: dockerEnv
+  }).then(({ stdout }) => stdout);
+  let rows;
+  try {
+    const text = (await run(["compose", "ps", "--all", "--format", "json"])).trim();
+    if (!text) return void 0;
+    try {
+      const parsed = JSON.parse(text);
+      rows = Array.isArray(parsed) ? parsed : [parsed];
+    } catch {
+      rows = text.split(/\r?\n/).flatMap((line) => {
+        try {
+          return [JSON.parse(line)];
+        } catch {
+          return [];
+        }
+      });
+    }
+  } catch {
+    return void 0;
+  }
+  const exited = rows.filter((row) => typeof row.State === "string" && /^(exited|dead)$/i.test(row.State));
+  if (!exited.length) return void 0;
+  const parts = [];
+  for (const row of exited.slice(0, 3)) {
+    const service = String(row.Service ?? row.Name ?? "unknown");
+    let exit = row.ExitCode ?? row.exitCode;
+    if (exit == null && row.ID) {
+      try {
+        exit = (await run(["inspect", "--format", "{{.State.ExitCode}}", String(row.ID)])).trim() || void 0;
+      } catch {
+      }
+    }
+    let tail = "";
+    try {
+      tail = (await run(["compose", "logs", "--no-color", "--tail", "50", service])).trim();
+    } catch {
+    }
+    parts.push(`service '${service}' exited before health (exit ${exit ?? "unknown"})${tail ? ` \u2014 log tail:
+${tail}` : ""}`);
+  }
+  return `
+compose services exited before health:
+${parts.join("\n")}`;
+}
 async function waitForHealth(url, timeoutMs, anyStatus = false) {
   const deadline = Date.now() + timeoutMs;
   let last = "";
@@ -43299,7 +43497,15 @@ async function startStage(config = {}, opts = {}) {
     if (state.healthUrl) await waitForHealth(state.healthUrl, opts.timeoutMs ?? 6e4, config.healthAnyStatus);
     else await waitForProcessStability(child2);
   } catch (e) {
+    let detail;
+    if (state.healthUrl) {
+      try {
+        detail = await describeExitedComposeServices(cwd, upEnv);
+      } catch {
+      }
+    }
     await cleanupStageState(state, [statePath, globalStatePath], opts.timeoutMs ?? 6e4, cwd, upEnv);
+    if (detail) throw new Error(`${e.message}${detail}`, { cause: e });
     throw e;
   }
   const result = {
@@ -45240,6 +45446,11 @@ ${list}`);
     } else {
       printLine(`${label}: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
       for (const line of failedChecksReceiptLines(label, result)) printLine(line);
+      if (result.status === "success" && result.headSha) {
+        const checks = result.checks?.map((check) => `${check.name}=${check.state}`).join(", ") || "none";
+        const workflows = result.workflowRuns?.map((run) => `${run.name}#${run.id}=${run.status}/${run.conclusion ?? "pending"}`).join(", ") || "none";
+        printLine(`${label}: verified head ${result.headSha}; checks: ${checks}; workflows: ${workflows}`);
+      }
     }
     if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
     if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
@@ -45292,6 +45503,7 @@ ${list}`);
       // pending must hold the wait open, and a non-required red must fail it; #4396's scoping is the
       // merge paths' contract (`pr land`, `pr merge --wait`), which mirror the GitHub merge button.
       pollChecks: () => pollRestPrChecks(number, repo),
+      pollChecksWithEvidence: () => pollRestPrChecksWithWorkflowEvidence(number, repo),
       pollMergeable: () => pollRestPrMergeable(number, repo),
       pollRateLimit: () => waitLoopCorePool("pr checks-wait"),
       // #3388: on a confirmed red, read the failing runs' annotations so a wall-clock budget kill stops
@@ -51810,10 +52022,13 @@ function deriveStage(inputs) {
     // #2655: only bootstrap a `.env` when the repo ships `.env.example` (legacy). Without it, the stage is
     // vault-native — the runner injects the declared dev secrets into the compose process env (no disk file).
     ...inputs.hasEnvExample ? { ensureEnv: { example: ".env.example", target: ".env" } } : {},
-    // MMI_PORT is the host-published port (the free STAGE_PORT); PORT is intentionally absent so compose
-    // reads the container's bind port from .env rather than this overriding it to the publish port (#1505).
+    // MMI_STAGE is the local dev stage name the estate compose contract selects on (`${MMI_STAGE:-dev}`
+    // in the seeded compose template): `development` never matched it, so a derived stage booted with
+    // the wrong stage identity (#7870). MMI_PORT is the host-published port (the free STAGE_PORT); PORT
+    // is intentionally absent so compose reads the container's bind port from .env rather than this
+    // overriding it to the publish port (#1505).
     env: {
-      MMI_STAGE: "development",
+      MMI_STAGE: "dev",
       MMI_PORT: "$STAGE_PORT",
       COMPOSE_PROFILES: "local"
     }
@@ -52012,13 +52227,20 @@ function registerStageCommands(program3) {
     const portRangeMeta = project2?.portRange ?? void 0;
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
+    const resolution = decideStage({
+      registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
+      hasCompose: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
+      repo
+    });
+    if (resolution.source === "derived" && resolution.derived) {
+      resolution.derived.config.env = {
+        ...resolution.derived.config.env,
+        COMPOSE_PROJECT_NAME: stageComposeProjectName(process.cwd())
+      };
+    }
     return {
-      resolution: decideStage({
-        registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-        hasCompose: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
-        hasEnvExample: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
-        repo
-      }),
+      resolution,
       project: project2,
       cfg
     };

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.95",
+  "version": "4.5.97",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.95",
+  "version": "4.5.97",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",