@miadi/connector 0.1.12 → 0.1.13

package/README.md

@@ -20,7 +20,7 @@ Call `get_capabilities` first. It names the signed-in person, their Miadi API ti
 
 | kind | tools |
 |---|---|
-| reads | `get_capabilities` `get_context` `list_circles` `get_circle` `list_sessions` `get_session` `get_evidence` `read_episode_file` `get_evaluations` `get_narrative_beats` `review_lookup` `review_versions` `handoff_status` `list_records` `get_run_result` `mission_status` `provider_capabilities` `search` `fetch` |
+| reads | `get_capabilities` `get_context` `list_circles` `get_circle` `list_sessions` `get_session` `get_evidence` `read_episode_file` `get_evaluations` `get_narrative_beats` `review_lookup` `review_versions` `handoff_status` `list_records` `get_run_result` `mission_status` `provider_capabilities` `mission_model_preflight` `search` `fetch` |
 | contributions | `append_observation` `open_inquiry` `link_records` `propose_narrative_beat` `record_evaluation` `register_source_intent` `record_handoff` `update_handoff` `prepare_calendar_event` `save_research` |
 | requests (approved by a person) | `propose_work` `propose_session_completion` `request_authorized_run` `request_session_steer` `request_review_operation` `request_deep_diver` `link_review_to_episode` `request_inquiry_episode` |
 | decisions in the conversation | `show_decisions` (cards), `decide_request` (called by the card only) |
@@ -46,9 +46,13 @@ The model that asked cannot approve its own request.
 
 `mission_status` joins one mission read-only: its source request and decision, the sessions bound to it (each with how it is bound — a signed `session:` ref, the delivered brief's target, or the requested name), its issues and PRs, its steering grant, and where it stands stage by stage — approved, queued, delivered, running, merged, released, closed — each by its evidence, so an idle pane or a merge is never read as completion. Live panes and Miadi's session view are joined only for the write tier.
 
+A mission is found by the issue it implements (jgwill/Miadi#913). `request_authorized_run` and `propose_work` take `primary_issue`; older requests are read by their first issue ref, as an inference. An issue held as primary by several requests answers `ambiguous_mission` with the candidates, an issue only cited answers `related_only`, and only a record id or a declared primary that no older request holds by inference (`contested`) authorizes a steer, release or closure (`identity.authorizes_actions`). A release receipt names artifact, target, production check and check time; record it as `completion_receipt.release` on a handoff that cites the mission. `released` is `verified` only when the connector confirms it itself (the target is `miadi-connector` and the running version is the one released); any other complete receipt within seven days is `receipt_recorded`, with who recorded it and whether that was the approver. Old checks are `stale`; a version string, a future date or an incomplete receipt is `claimed_unverified`. `closed` needs an approved `propose_session_completion` ending (`exit` or `complete_then_exit`) that names the mission in its `mission` field and ends one of the mission's sessions; a completed request is `request_completed`. A GitHub reference the connector cannot read is `unverified`, with the reason (`no_github_token`, `not_visible_to_token`…), never `not_found`.
+
 `request_session_steer` sends one authorized follow-up to one existing live agent, within the steering grant an approved run carries (`steering: { max_attempts, expires_at, pane }` on `request_authorized_run`). It peeks at the bound pane — the grant's pane or the session's first pane, never whichever pane is active — refuses a busy agent or a pane that is not an agent, types the exact instruction literally, and re-peeks to verify the agent accepted it (`accepted`) or only holds it at the prompt (`submitted`). Every attempt leaves a durable artifact with the instruction's sha256, its grant, its target and both captures. A steer the grant does not cover waits for one explicit scoped human decision on its `approval_url`, which runs exactly that instruction once.
 
-`request_authorized_run` may name a `provider` (`codex`, `pi`, `copilot`, `claude`). The connector verifies it is installed on the host before recording anything; an unknown or unavailable provider answers `provider_unavailable` and the mission stays unstarted. With no provider named, the first installed provider in the preference order is resolved and named in the brief; Claude Code is never chosen silently — it runs only when named. `provider_capabilities` (write tier) reports what the host has installed, the sign-in evidence, the preference order, and the read-only Jev routing preflight (`unconfigured` without `MIADI_JEV_URL`). A provider name inside a task's text selects nothing.
+`request_authorized_run` may name a `provider` (`codex`, `pi`, `copilot`, `claude`). The connector verifies it is installed on the host before recording anything; an unknown or unavailable provider answers `provider_unavailable` and the mission stays unstarted. With no provider named, the first installed provider in the preference order is resolved and named in the brief; Claude Code is never chosen silently — it runs only when named. `provider_capabilities` (write tier) reports what the host has installed, the sign-in evidence, the preference order, and the read-only Jev check: `unconfigured` without `JEV_AI_API_KEY` or `TYPESAFE_API_KEY` in the connector's environment, else the models Jev lists for the key (no charge). A provider name inside a task's text selects nothing.
+
+`mission_model_preflight` (write tier) answers, for one mission, which provider and model fit its task type and criticality, and how that is known: contract `miadi.mission_model_preflight` v1, candidates with their configured default model, sign-in evidence (config directory only), quota `unknown`, policy eligibility, a review floor, and a recommendation or an abstention with reasons. Its `decider.source` is `static_fallback`, `jev` or `synthetic_fixture`. Jev is asked only with `consult_jev: true` and a key on the host; it is sent task type, criticality and candidates, never task text, mission id or repository, and its answer is advisory: uncalibrated, below 0.8 or outside the contract, the preflight abstains. A reported `launch` on another provider than the approved one answers `provider_mismatch` before anything is asked. It authorizes nothing. `bench/model-preflight-bench.mjs` compares the 0.1.12 baseline, the static preflight and Jev on synthetic scenarios; `bench/results/` keeps the runs.
 
 ### Deciding inside the conversation
 

package/dist/index.d.ts

@@ -5,7 +5,8 @@ export { MiadiOAuthProvider, SCOPES, SCOPE_READ, SCOPE_CONTRIBUTE, type Person }
 export { CIRCLES, CIRCLE_IDS, CLAIM_CATEGORIES, DOMAINS, HANDOFF_STATES, RECORD_KINDS, current, type ConnectorRecord, type CircleId, type ClaimCategory, type RecordKind, } from "./records.js";
 export { TOOL_STATUS } from "./tools.js";
 export { runBrief, readQueueState } from "./approve.js";
-export { PROVIDERS, discoverProviders, resolveProvider, routerPreflight, type ProviderAvailability, type ProviderId, type ProviderResolution, type RouterPreflight, } from "./providers.js";
-export { missionStatus, resolveMissionSubject, type MissionStatus, type MissionStatusDeps } from "./mission-status.js";
+export { PROVIDERS, discoverProviders, jevConfigOf, resolveProvider, routerPreflight, type JevConfig, type ProviderAvailability, type ProviderId, type ProviderResolution, type RouterPreflight, } from "./providers.js";
+export { missionStatus, primaryIssueOf, resolveMissionSubject, type MissionStatus, type MissionStatusDeps, type MissionIdentity } from "./mission-status.js";
+export { modelPreflight, candidatesFor, buildJevRequest, decisionState, jevAdapter, reviewFloor, PREFLIGHT_CONTRACT, PREFLIGHT_VERSION, JEV_CONFIDENCE_FLOOR, type ModelPreflight, type ModelCandidate, type JevAdapter, type JevRequest, } from "./model-preflight.js";
 export { AGENT_COMMANDS, BUSY_PATTERNS, STEER_STATUSES, checkGrant, isBusy, readSteerArtifact, steerAttempts, steerSession, steeringGrantOf, tmuxAdapter, type SteerDeps, type SteerResult, type SteerStatus, type SteeringGrant, type TmuxLike, } from "./steer.js";
 export { VERSION } from "./version.js";

package/dist/index.js

@@ -5,7 +5,8 @@ export { MiadiOAuthProvider, SCOPES, SCOPE_READ, SCOPE_CONTRIBUTE } from "./oaut
 export { CIRCLES, CIRCLE_IDS, CLAIM_CATEGORIES, DOMAINS, HANDOFF_STATES, RECORD_KINDS, current, } from "./records.js";
 export { TOOL_STATUS } from "./tools.js";
 export { runBrief, readQueueState } from "./approve.js";
-export { PROVIDERS, discoverProviders, resolveProvider, routerPreflight, } from "./providers.js";
-export { missionStatus, resolveMissionSubject } from "./mission-status.js";
+export { PROVIDERS, discoverProviders, jevConfigOf, resolveProvider, routerPreflight, } from "./providers.js";
+export { missionStatus, primaryIssueOf, resolveMissionSubject } from "./mission-status.js";
+export { modelPreflight, candidatesFor, buildJevRequest, decisionState, jevAdapter, reviewFloor, PREFLIGHT_CONTRACT, PREFLIGHT_VERSION, JEV_CONFIDENCE_FLOOR, } from "./model-preflight.js";
 export { AGENT_COMMANDS, BUSY_PATTERNS, STEER_STATUSES, checkGrant, isBusy, readSteerArtifact, steerAttempts, steerSession, steeringGrantOf, tmuxAdapter, } from "./steer.js";
 export { VERSION } from "./version.js";

package/dist/mission-status.d.ts

@@ -1,8 +1,19 @@
 /**
- * Read-only mission status (jgwill/Miadi#893, Phase 1A): where one mission
- * stands, joined from the connector ledger, the factory queue, tmux, Miadi's
- * session view and GitHub — with every stage named by its evidence, so an idle
- * pane or a merge is never read as completion.
+ * Read-only mission status (jgwill/Miadi#893, Phase 1A; corrected by #913): where
+ * one mission stands, joined from the connector ledger, the factory queue, tmux,
+ * Miadi's session view and GitHub — with every stage named by its evidence, so an
+ * idle pane, a merge, a version string or a completed request is never read as
+ * release or closure.
+ *
+ * Mission identity (#913 A). A record's *primary* issue is the one it implements:
+ * `body.primary_issue` when the requester declared it (provenance `declared`),
+ * else, for records made before that field, the first owner/repo#n in its refs
+ * (provenance `first_issue_ref`, an inference). Every other issue it cites is
+ * *related*. An issue or session reference resolves to one mission only when one
+ * candidate holds it as primary; several are `ambiguous_mission`, and a reference
+ * cited only as related is `related_only`. Newest-first selection is gone.
+ * Only `exact` (a record id) and `declared_primary` authorize a steer, release or
+ * closure against the answer; an inference names its candidate and authorizes nothing.
  *
  * The caller (tools.ts) decides the viewer's tier first: without the write
  * tier there are no operator details (live panes, session internals); the
@@ -19,20 +30,96 @@ export interface MissionSession {
     /** Present when Miadi's session view was joined (write tier). */
     miadi?: unknown;
 }
+/** What the connector could establish about a GitHub reference. `unverified` is never `not_found`: without access the connector cannot tell. */
+export interface IssueLookup {
+    state: string;
+    title?: string;
+    merged?: boolean;
+    /** Why the state is `unverified`: no_github_token, not_visible_to_token, token_rejected, forbidden_or_rate_limited, github_<status>, unreachable. */
+    access?: string;
+}
+/** A release receipt: what was released, where, and how production was checked, when. */
+export interface ReleaseEvidence {
+    artifact: string;
+    target: string;
+    verified_at: string;
+    verification: string;
+    /** The record that carries it and who made it. */
+    record: string;
+    by: string;
+    /** The receipt was recorded by the person who approved the mission. */
+    by_approver: boolean;
+    /** The version the connector itself is running, when the receipt's target is the connector. */
+    live_version?: string;
+}
+export interface ClosureEvidence {
+    record: string;
+    ending: string;
+    session_id: string;
+    /** The ending names one of the mission's own sessions. False when the mission names none to compare. */
+    session_bound: boolean;
+    decided_by?: string;
+    decided_at?: string;
+}
 export interface MissionStageTruth {
     approved: boolean;
+    /** The decision as taken: approve or approve_with_changes, the approver's instructions and what is still outstanding. */
+    approval: {
+        state: string;
+        choice?: string;
+        instructions?: string;
+        outstanding: string[];
+    };
     queued: boolean;
     delivered: boolean;
     /** "evidence" only while a bound session is live; an idle pane proves nothing. */
     running: "evidence" | "no_evidence";
-    pr_merged: "merged" | "open_or_absent" | "no_pr";
-    released: "evidence" | "no_evidence";
+    /** The run_request or work_proposal finished. This is the request, not the mission. */
+    request_completed: boolean;
+    /** "unverified": GitHub could not be read, so no merge state is claimed either way. */
+    pr_merged: "merged" | "open_or_absent" | "no_pr" | "unverified";
+    /**
+     * verified: the connector itself confirmed it: the receipt targets miadi-connector and the running version
+     * is the one released. receipt_recorded: a complete, fresh receipt (artifact, target, production check, time)
+     * recorded by the named person; the connector cannot check it. stale: the check is older than the freshness
+     * window. live_mismatch: the connector runs another version than its receipt names. claimed_unverified: a
+     * version, a published flag, an incomplete or future-dated release object. no_evidence: nothing.
+     */
+    released: "verified" | "receipt_recorded" | "stale" | "live_mismatch" | "claimed_unverified" | "no_evidence";
+    release_evidence?: ReleaseEvidence;
+    /** True only with an approved ending (exit or complete_then_exit) naming this mission in its `mission` field, for one of its sessions. A completed request is not a closure. */
     closed: boolean;
+    closure_evidence?: ClosureEvidence;
+}
+export type MissionResolution = "exact" | "declared_primary" | "inferred_primary" | "ambiguous_mission" | "related_only";
+export interface MissionCandidate {
+    id: string;
+    kind: string;
+    created_at: string;
+    /** primary: the reference is this record's primary issue. related: an issue it cites and does not implement. cited: a session it cites. */
+    relation: "primary" | "related" | "cited";
+    /** declared: body.primary_issue. first_issue_ref: inferred from the first issue in refs. cited_ref: the reference is in its refs. */
+    provenance: "declared" | "first_issue_ref" | "cited_ref";
+    primary_issue?: string;
+}
+export interface MissionIdentity {
+    resolution: MissionResolution;
+    /** A declared primary that another request also holds by inference: reported, not authorizing. */
+    contested?: boolean;
+    /** True only for exact and an uncontested declared_primary: a steer, release or closure may name this mission. */
+    authorizes_actions: boolean;
+    primary_issue?: {
+        ref: string;
+        provenance: "declared" | "first_issue_ref";
+    };
+    /** Every request citing the reference, newest first, with its relation. Empty for an exact id. */
+    candidates: MissionCandidate[];
 }
 export interface MissionStatus {
     ref: string;
     found: boolean;
     via?: string;
+    identity?: MissionIdentity;
     subject?: {
         id: string;
         kind: string;
@@ -48,9 +135,11 @@ export interface MissionStatus {
     sessions?: MissionSession[];
     issues?: {
         ref: string;
+        relation: "primary" | "related";
         state: string;
         title?: string;
         merged?: boolean;
+        access?: string;
     }[];
     steering?: {
         grant: "none" | "active" | "expired_grant" | "exhausted";
@@ -72,16 +161,33 @@ export interface MissionStatusDeps {
     paneBusy?: (session: string) => "busy" | "idle" | "unknown";
     /** Miadi's session view by session:<uuid> (write tier only). */
     sessionOf?: (id: string) => Promise<unknown>;
-    issueOf?: (owner: string, repo: string, n: string) => Promise<{
-        state: string;
-        title?: string;
-        merged?: boolean;
-    }>;
+    issueOf?: (owner: string, repo: string, n: string) => Promise<IssueLookup>;
+    /** The version a package runs at on this host, when the connector can know it (its own VERSION). */
+    liveVersionOf?: (pkg: string) => string | undefined;
+    /** How old a production check may be and still count as verified. Default seven days. */
+    releaseFreshnessMs?: number;
     now?: () => Date;
 }
-/** The record a mission reference resolves to, and how it was found. */
-export declare function resolveMissionSubject(ref: string, records: ConnectorRecord[]): {
-    record: ConnectorRecord;
+export declare const RELEASE_FRESHNESS_MS: number;
+/** The issue a mission implements, and how that is known. */
+export declare function primaryIssueOf(record: ConnectorRecord): {
+    ref: string;
+    provenance: "declared" | "first_issue_ref";
+} | undefined;
+export interface ResolvedSubject {
+    record?: ConnectorRecord;
     via: string;
-} | null;
+    resolution: MissionResolution;
+    contested?: boolean;
+    candidates: MissionCandidate[];
+}
+/** Whether a resolved reference may be acted on: an exact id, or a declared primary nobody else holds. */
+export declare function authorizesActions(found: Pick<ResolvedSubject, "resolution" | "contested">): boolean;
+/**
+ * The record a mission reference resolves to, how it was found, and every other
+ * candidate. `record` is absent when the reference is ambiguous or only related.
+ * Expects the folded ledger (`current()`), so a superseding record never stands
+ * as a mission of its own.
+ */
+export declare function resolveMissionSubject(ref: string, records: ConnectorRecord[]): ResolvedSubject | null;
 export declare function missionStatus(ref: string, records: ConnectorRecord[], deps: MissionStatusDeps): Promise<MissionStatus>;

package/dist/mission-status.js

@@ -1,27 +1,69 @@
 import { steerAttempts, steeringGrantOf, checkGrant } from "./steer.js";
 const ISSUE_REF = /^([\w.-]+)\/([\w.-]+)#(\d+)$/;
 const SESSION_REF = /^session:([0-9a-f-]{36})$/;
-/** The record a mission reference resolves to, and how it was found. */
+const MISSION_KINDS = new Set(["run_request", "work_proposal"]);
+const CLOSING_ENDINGS = new Set(["exit", "complete_then_exit"]);
+export const RELEASE_FRESHNESS_MS = 7 * 24 * 3600_000;
+const CLOCK_SKEW_MS = 5 * 60_000;
+/** A release receipt whose target the connector can check itself. */
+const SELF_TARGET = /miadi-connector/;
+/** The issue a mission implements, and how that is known. */
+export function primaryIssueOf(record) {
+    const declared = record.body?.primary_issue;
+    if (typeof declared === "string" && ISSUE_REF.test(declared))
+        return { ref: declared, provenance: "declared" };
+    const first = record.refs.find((r) => ISSUE_REF.test(r));
+    return first ? { ref: first, provenance: "first_issue_ref" } : undefined;
+}
+const newestFirst = (a, b) => b.created_at.localeCompare(a.created_at);
+function candidate(r, relation, provenance) {
+    const primary = primaryIssueOf(r);
+    return { id: r.id, kind: r.kind, created_at: r.created_at, relation, provenance, ...(primary ? { primary_issue: primary.ref } : {}) };
+}
+/** Whether a resolved reference may be acted on: an exact id, or a declared primary nobody else holds. */
+export function authorizesActions(found) {
+    return found.resolution === "exact" || (found.resolution === "declared_primary" && !found.contested);
+}
+/**
+ * The record a mission reference resolves to, how it was found, and every other
+ * candidate. `record` is absent when the reference is ambiguous or only related.
+ * Expects the folded ledger (`current()`), so a superseding record never stands
+ * as a mission of its own.
+ */
 export function resolveMissionSubject(ref, records) {
     const exact = records.find((r) => r.id === ref);
     if (exact)
-        return { record: exact, via: "record_id" };
-    const session = SESSION_REF.exec(ref);
-    if (session) {
-        const citing = records
-            .filter((r) => (r.kind === "run_request" || r.kind === "work_proposal") && r.refs.includes(ref))
-            .sort((a, b) => b.created_at.localeCompare(a.created_at));
-        if (citing.length)
-            return { record: citing[0], via: "session_ref" };
-        return null;
+        return { record: exact, via: "record_id", resolution: "exact", candidates: [] };
+    const missions = records.filter((r) => MISSION_KINDS.has(r.kind)).sort(newestFirst);
+    if (SESSION_REF.test(ref)) {
+        const citing = missions.filter((r) => r.refs.includes(ref));
+        if (!citing.length)
+            return null;
+        if (citing.length === 1)
+            return { record: citing[0], via: "session_ref", resolution: "inferred_primary", candidates: [candidate(citing[0], "cited", "cited_ref")] };
+        return { via: "session_ref", resolution: "ambiguous_mission", candidates: citing.map((r) => candidate(r, "cited", "cited_ref")) };
     }
     if (ISSUE_REF.test(ref)) {
-        const citing = records
-            .filter((r) => (r.kind === "run_request" || r.kind === "work_proposal") && (r.refs.includes(ref) || r.evidence_refs.includes(ref)))
-            .sort((a, b) => b.created_at.localeCompare(a.created_at));
-        if (citing.length)
-            return { record: citing[0], via: "issue_ref" };
-        return null;
+        const citing = missions.filter((r) => r.refs.includes(ref) || r.evidence_refs.includes(ref));
+        if (!citing.length)
+            return null;
+        const cands = citing.map((r) => {
+            const primary = primaryIssueOf(r);
+            return primary?.ref === ref ? candidate(r, "primary", primary.provenance) : candidate(r, "related", "cited_ref");
+        });
+        const declared = cands.filter((c) => c.relation === "primary" && c.provenance === "declared");
+        const inferred = cands.filter((c) => c.relation === "primary" && c.provenance === "first_issue_ref");
+        const pick = (c) => citing.find((r) => r.id === c.id);
+        if (declared.length === 1) {
+            return { record: pick(declared[0]), via: "issue_ref", resolution: "declared_primary", ...(inferred.length ? { contested: true } : {}), candidates: cands };
+        }
+        if (declared.length > 1)
+            return { via: "issue_ref", resolution: "ambiguous_mission", candidates: cands };
+        if (inferred.length === 1)
+            return { record: pick(inferred[0]), via: "issue_ref", resolution: "inferred_primary", candidates: cands };
+        if (inferred.length > 1)
+            return { via: "issue_ref", resolution: "ambiguous_mission", candidates: cands };
+        return { via: "issue_ref", resolution: "related_only", candidates: cands };
     }
     return null;
 }
@@ -48,12 +90,108 @@ function nextAction(record, standing, queue) {
                 : "The request is done. A mission closes when its session's ending is decided, not when this request completes.";
     }
 }
+const str = (v) => (typeof v === "string" ? v.trim() : "");
+/** name@version from "npm:@scope/name@1.2.3" or "@scope/name@1.2.3". */
+function artifactVersion(artifact) {
+    const m = /^(?:npm:)?((?:@[\w.-]+\/)?[\w.-]+)@(\d[\w.+-]*)$/.exec(artifact.trim());
+    return m ? { pkg: m[1], version: m[2] } : undefined;
+}
+/** Records that carry evidence about this mission: itself, then any record citing its id, newest first. */
+function evidenceRecords(record, records) {
+    const citing = records.filter((r) => r.id !== record.id && (r.refs.includes(record.id) || r.evidence_refs.includes(record.id))).sort(newestFirst);
+    return [record, ...citing];
+}
+function releaseTruth(record, records, deps, now) {
+    let claimed = false;
+    for (const r of evidenceRecords(record, records)) {
+        const receipt = (r.completion_receipt ?? {});
+        const rel = (receipt.release ?? r.body?.release);
+        if (rel && typeof rel === "object") {
+            const ev = { artifact: str(rel.artifact), target: str(rel.target), verified_at: str(rel.verified_at), verification: str(rel.verification) };
+            const at = Date.parse(ev.verified_at);
+            if (!ev.artifact || !ev.target || !ev.verification || Number.isNaN(at) || at > now.getTime() + CLOCK_SKEW_MS) {
+                claimed = true;
+                continue;
+            }
+            const approver = str((record.completion_receipt ?? {}).decided_by?.person_id);
+            const evidence = { ...ev, record: r.id, by: r.actor.name, by_approver: Boolean(approver) && r.actor.person_id === approver };
+            const av = artifactVersion(ev.artifact);
+            const self = av && SELF_TARGET.test(ev.target) ? deps.liveVersionOf?.(av.pkg) : undefined;
+            if (av && self !== undefined) {
+                evidence.live_version = self;
+                if (self !== av.version)
+                    return { released: "live_mismatch", release_evidence: evidence };
+            }
+            if (now.getTime() - at > (deps.releaseFreshnessMs ?? RELEASE_FRESHNESS_MS))
+                return { released: "stale", release_evidence: evidence };
+            return { released: self !== undefined ? "verified" : "receipt_recorded", release_evidence: evidence };
+        }
+        if (r.id === record.id && (receipt.published || receipt.version))
+            claimed = true;
+    }
+    return { released: claimed ? "claimed_unverified" : "no_evidence" };
+}
+/**
+ * The approved ending that closes this mission: it names the mission in its own `mission` field (one ending,
+ * one mission; a citation in refs is not enough) and, when the mission names sessions, ends one of them.
+ */
+function closureTruth(record, records, missionSessions) {
+    const endings = records
+        .filter((r) => {
+        const b = (r.body ?? {});
+        if (r.kind !== "session_completion_proposal" || r.approval_state !== "approved" || b.mission !== record.id)
+            return false;
+        if (!CLOSING_ENDINGS.has(str(b.ending)))
+            return false;
+        return missionSessions.size === 0 || missionSessions.has(str(b.session_id));
+    })
+        .sort(newestFirst);
+    const e = endings[0];
+    if (!e)
+        return undefined;
+    const receipt = (e.completion_receipt ?? {});
+    const sessionId = str(e.body.session_id);
+    return {
+        record: e.id,
+        ending: str(e.body.ending),
+        session_id: sessionId,
+        session_bound: missionSessions.has(sessionId),
+        ...(str(receipt.decided_by?.name) ? { decided_by: str(receipt.decided_by.name) } : {}),
+        ...(str(receipt.decided_at) ? { decided_at: str(receipt.decided_at) } : {}),
+    };
+}
 export async function missionStatus(ref, records, deps) {
     const notes = [];
     const found = resolveMissionSubject(ref, records);
     if (!found)
         return { ref, found: false, notes: ["No mission record resolves from this reference."] };
+    if (!found.record) {
+        const ambiguous = found.resolution === "ambiguous_mission";
+        return {
+            ref,
+            found: false,
+            via: found.via,
+            identity: { resolution: found.resolution, authorizes_actions: false, candidates: found.candidates },
+            next_authorized_action: "Name the mission by its record id. Nothing is steered, released or closed against this reference.",
+            notes: [
+                ambiguous
+                    ? "Several requests hold this reference as their primary mission; none is chosen for you, the newest included."
+                    : "Requests cite this reference only as related; none implements it, so it names no mission.",
+            ],
+        };
+    }
     const { record, via } = found;
+    const primary = primaryIssueOf(record);
+    const identity = {
+        resolution: found.resolution,
+        ...(found.contested ? { contested: true } : {}),
+        authorizes_actions: authorizesActions(found),
+        ...(primary ? { primary_issue: primary } : {}),
+        candidates: found.candidates,
+    };
+    if (found.resolution === "inferred_primary") {
+        notes.push(`Resolved by inference (${via === "session_ref" ? "the only request citing this session" : "the first issue in the request's refs"}). Name ${record.id} before any steer, release or closure.`);
+    }
     const standing = deps.projectOf(record) ?? undefined;
     const queue = deps.queueOf?.(record);
     const now = deps.now?.() ?? new Date();
@@ -64,7 +202,6 @@ export async function missionStatus(ref, records, deps) {
     const named = String(record.body.session ?? "") || undefined;
     const seen = new Set();
     const addSession = (session, association) => {
-        const key = `${association}:${session}`;
         if (seen.has(session))
             return;
         seen.add(session);
@@ -74,7 +211,6 @@ export async function missionStatus(ref, records, deps) {
             live: live ? (live.has(session) ? "running" : "absent") : "unknown",
             ...(deps.paneBusy && live?.has(session) ? { activity: deps.paneBusy(session) } : {}),
         });
-        void key;
     };
     if (typeof briefTo === "string" && briefTo)
         addSession(briefTo.replace(/^new:/, ""), "brief_target");
@@ -91,14 +227,22 @@ export async function missionStatus(ref, records, deps) {
         notes.push("Live session state was not joined (the viewer's tier or the host does not allow it).");
     const issues = [];
     if (deps.issueOf) {
-        for (const r of [...record.refs, ...record.evidence_refs]) {
+        for (const r of [...new Set([...record.refs, ...record.evidence_refs])]) {
             const m = ISSUE_REF.exec(r);
             if (!m)
                 continue;
-            const issue = await deps
-                .issueOf(m[1], m[2], m[3])
-                .catch(() => ({ state: "unavailable" }));
-            issues.push({ ref: r, state: issue.state, ...(issue.title ? { title: issue.title } : {}), ...(issue.merged !== undefined ? { merged: issue.merged } : {}) });
+            const issue = await deps.issueOf(m[1], m[2], m[3]).catch(() => ({ state: "unverified", access: "unreachable" }));
+            issues.push({
+                ref: r,
+                relation: primary?.ref === r ? "primary" : "related",
+                state: issue.state,
+                ...(issue.title ? { title: issue.title } : {}),
+                ...(issue.merged !== undefined ? { merged: issue.merged } : {}),
+                ...(issue.access ? { access: issue.access } : {}),
+            });
+        }
+        if (issues.some((i) => i.state === "unverified")) {
+            notes.push("Some GitHub references could not be read by the connector; they are unverified, not missing.");
         }
     }
     const grant = steeringGrantOf(record);
@@ -108,22 +252,47 @@ export async function missionStatus(ref, records, deps) {
     const receipt = (record.completion_receipt ?? {});
     const anyLive = sessions.some((s) => s.live === "running");
     const prs = issues.filter((i) => i.merged !== undefined);
+    const unverifiedRefs = issues.some((i) => i.state === "unverified");
+    const release = releaseTruth(record, records, deps, now);
+    const missionSessions = new Set(sessions.map((x) => x.session.replace(/^session:/, "")));
+    const closure = closureTruth(record, records, missionSessions);
+    const choice = standing?.decision?.choice ?? (str(receipt.decision) || undefined);
+    const instructions = standing?.decision?.instructions ?? (str(receipt.instructions) || undefined);
     const stageTruth = {
         approved: record.approval_state === "approved",
+        approval: {
+            state: record.approval_state ?? "not_required",
+            ...(choice ? { choice } : {}),
+            ...(instructions ? { instructions } : {}),
+            outstanding: standing?.outstanding ?? [],
+        },
         queued: queue?.state === "queued" || queue?.state === "delivered",
         delivered: queue?.state === "delivered",
         running: anyLive ? "evidence" : "no_evidence",
-        pr_merged: prs.length ? (prs.every((p) => p.merged) ? "merged" : "open_or_absent") : "no_pr",
-        released: receipt.published || receipt.version ? "evidence" : "no_evidence",
-        closed: standing?.stage === "completed" && standing?.standing === "done",
+        request_completed: record.state === "completed",
+        pr_merged: unverifiedRefs ? "unverified" : prs.length ? (prs.every((p) => p.merged) ? "merged" : "open_or_absent") : "no_pr",
+        released: release.released,
+        ...(release.release_evidence ? { release_evidence: release.release_evidence } : {}),
+        closed: Boolean(closure),
+        ...(closure ? { closure_evidence: closure } : {}),
     };
     if (stageTruth.running === "no_evidence" && record.approval_state === "approved") {
         notes.push("No bound session shows live; an idle or absent pane is not proof of completion or failure.");
     }
+    if (stageTruth.request_completed && !stageTruth.closed) {
+        notes.push("The request completed; the mission stays open until an approved session ending cites it.");
+    }
+    if (stageTruth.pr_merged === "merged" && stageTruth.released !== "verified" && stageTruth.released !== "receipt_recorded") {
+        notes.push("Merged is not released: no fresh production check is recorded for this mission.");
+    }
+    if (found.contested) {
+        notes.push("This request declares the issue, and an earlier request holds it by inference; neither is acted on by issue. Name the record id.");
+    }
     return {
         ref,
         found: true,
         via,
+        identity,
         subject: {
             id: record.id,
             kind: record.kind,
@@ -138,7 +307,9 @@ export async function missionStatus(ref, records, deps) {
         issues,
         steering: { grant: grantState, attempts_used: attempts, ...(grant?.max_attempts !== undefined ? { max_attempts: grant.max_attempts } : {}) },
         stage_truth: stageTruth,
-        next_authorized_action: nextAction(record, standing ?? null, queue),
+        next_authorized_action: identity.authorizes_actions
+            ? nextAction(record, standing ?? null, queue)
+            : `Not authorizing (${found.contested ? "contested" : "inferred"}): call mission_status with ${record.id} before acting. ${nextAction(record, standing ?? null, queue)}`,
         notes,
     };
 }