@mokoconsulting/mcp-mokosuite 1.0.0 → 1.1.0-dev.360

package/.mokogit/workflows/auto-bump.yml

@@ -30,6 +30,13 @@ on:
       - '.mokogit/**'
       - '.gitea/**'
       - '.github/**'
+      - '**/*.md'
+      - 'wiki/**'
+      - '.editorconfig'
+      - '.gitignore'
+      - '.gitattributes'
+      - '.gitmessage'
+      - 'LICENSE'
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -61,6 +68,7 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
           fi
           if [ -d "/opt/mokocli/cli" ]; then
+            git -C /opt/mokocli pull --ff-only --quiet 2>/dev/null || echo "  (mokocli auto-refresh skipped)"
             echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
           else
             git clone --depth 1 --branch main --quiet \

package/.mokogit/workflows/auto-release.yml

@@ -7,7 +7,7 @@
 # INGROUP: MokoCLI.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogit/workflows/auto-release.yml
-# VERSION: 05.02.00
+# VERSION: 06.02.00
 # BRIEF: Universal build & release � detects platform from metadata API
 #
 # +=======================================================================+
@@ -25,20 +25,56 @@
 name: "Universal: Build & Release"
 
 on:
+  # RC preview: build a release-candidate when a PR to main is opened / updated.
   pull_request:
     types: [opened, synchronize, closed]
     branches:
       - main
     paths-ignore:
-      - '.mokogit/workflows/**'
-      - '*.md'
+      - '.mokogit/**'
+      - '.gitea/**'
+      - '.github/**'
+      - '.vscode/**'
+      - '.idea/**'
+      - 'docs/**'
       - 'wiki/**'
+      - '**/*.md'
       - '.editorconfig'
       - '.gitignore'
       - '.gitattributes'
+      - '.gitmodules'
       - '.gitmessage'
-      - 'LICENSE' 
-  # Daily safety-net: catch merges whose pull_request event never created a run
+      - 'phpstan.neon'
+      - 'LICENSE'
+  # Stable release on every PUSH to main (a merged promotion) — the same
+  # push-based principle as pre-release's dev-channel build. A push trigger is
+  # race-free vs the old pull_request:closed, which could miss its run when this
+  # workflow file re-synced from the template concurrently with the merge.
+  # Loop-safe: the workflow's own commits to main are either paths-ignored (the
+  # CHANGELOG promote step → **/*.md) or carry [skip ci] (mokocli's build commit
+  # + the changelog commit), and the release job's if: re-checks [skip ci], so a
+  # self-push never re-triggers a release. The non-code paths-ignore also means a
+  # docs/CI-only push to main does not release.
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '.mokogit/**'
+      - '.gitea/**'
+      - '.github/**'
+      - '.vscode/**'
+      - '.idea/**'
+      - 'docs/**'
+      - 'wiki/**'
+      - '**/*.md'
+      - '.editorconfig'
+      - '.gitignore'
+      - '.gitattributes'
+      - '.gitmodules'
+      - '.gitmessage'
+      - 'phpstan.neon'
+      - 'LICENSE'
+  # Daily safety-net: catch merges whose push event never created a run
   # (e.g. this workflow file being re-synced from the template concurrently with the
   # merge). Off-round minute to avoid a fleet-wide spike. The safety-net job below
   # only dispatches a release when main actually has unreleased changes.
@@ -65,11 +101,27 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  # Serialise the release path per COMMIT, not per ref: push / schedule /
+  # workflow_dispatch for the SAME main commit collapse into one group and
+  # de-dup as pending, so a fleet-wide burst does not stack N redundant
+  # publish pipelines for one release. Never cancel a publish already in
+  # progress (cancel-in-progress: false) -- cancelling mid-publish could leave
+  # a half-created release (npmjs published but Gitea-registry publish dropped).
+  group: auto-release-${{ github.event.head_commit.id || github.sha }}
+  cancel-in-progress: false
+
 jobs:
   # ── PR Opened → Rename branch to RC and build RC release ─────────────────────────
   promote-rc:
     name: Promote to RC
     runs-on: release
+    # Own-repo writes: move rc + create release (contents:write), and dispatch
+    # deploy-rc (actions:write) — all via the per-repo github.token.
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
     # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     # Trigger-loop guard (#404 follow-up): NEVER run on bot/sync branches. A
     # template-sync/provisioning push (e.g. chore/mokoonyx-template-sync-*) that opens or
@@ -85,11 +137,7 @@ jobs:
             (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
             (github.event.action == 'synchronize' && github.event.pull_request.merged != true)
           ) &&
-          !startsWith(github.event.pull_request.head.ref, 'chore/') &&
-          !startsWith(github.event.pull_request.head.ref, 'sync/') &&
-          !startsWith(github.event.pull_request.head.ref, 'bot/') &&
-          !startsWith(github.event.pull_request.head.ref, 'mokoonyx-template-sync') &&
-          !startsWith(github.event.pull_request.head.ref, 'template-sync') &&
+          github.event.pull_request.head.ref == 'dev' &&
           !contains(github.event.pull_request.title, '[skip ci]') &&
           !contains(github.event.pull_request.title, '[skip sync]')
         ) ||
@@ -100,7 +148,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.MOKOGIT_TOKEN }}
+          token: ${{ github.token }}
           fetch-depth: 1
           submodules: recursive
 
@@ -111,25 +159,47 @@ jobs:
         run: |
           if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
             echo Using pre-installed /opt/mokocli
+            # Keep the pre-installed copy current with mokocli main (auto-refresh; soft — never fails the run).
+            if git -C /opt/mokocli rev-parse --git-dir >/dev/null 2>&1; then
+              git -C /opt/mokocli pull --ff-only --quiet 2>/dev/null || echo "  (mokocli git refresh skipped)"
+              REFRESH_TOK="$(printf '%s' "${MOKO_CLONE_TOKEN}" | tr -d '[:space:]')"
+              if [ -n "${REFRESH_TOK}" ] && command -v composer >/dev/null 2>&1; then
+                composer config -g http-basic.git.mokoconsulting.tech x-access-token "${REFRESH_TOK}" 2>/dev/null || true
+                ( cd /opt/mokocli && composer install --no-dev --no-interaction --no-progress --optimize-autoloader --quiet ) 2>/dev/null || echo "  (mokocli composer refresh skipped)"
+              fi
+            fi
             echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
           else
             echo Falling back to fresh clone
             if ! command -v composer > /dev/null 2>&1; then
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
+            # Strip any stray whitespace/newline a pasted secret may carry, and mask
+            # it; the unquoted URL below otherwise word-splits on a trailing newline
+            # in MOKOGIT_TOKEN and git clone dies with "fatal: Too many arguments".
+            MOKO_CLONE_TOKEN="$(printf '%s' "${MOKO_CLONE_TOKEN}" | tr -d '[:space:]')"
+            echo "::add-mask::${MOKO_CLONE_TOKEN}"
+            if [ -z "${MOKO_CLONE_TOKEN}" ]; then
+              echo "::error::MOKOGIT_TOKEN secret is empty — cannot clone mokocli fallback." >&2
+              exit 1
+            fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            CLONE_URL="https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git"
+            git clone --depth 1 --branch main --quiet "${CLONE_URL}" /tmp/mokocli
             cd /tmp/mokocli
             # Authenticate to the MokoGIT private Composer registry (git.mokoconsulting.tech)
             # declared in mokocli composer.json (preferred-install=dist) before installing deps.
             composer config -g http-basic.git.mokoconsulting.tech x-access-token "${MOKO_CLONE_TOKEN}"
+            export COMPOSER_AUTH="{\"http-basic\":{\"git.mokoconsulting.tech\":{\"username\":\"x-access-token\",\"password\":\"${MOKO_CLONE_TOKEN}\"}}}"
             composer install --no-dev --no-interaction --no-progress --optimize-autoloader --quiet
             echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
           fi
 
       - name: Rename branch to rc
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
+          PUSH_TOK="$(printf '%s' "$MOKOGIT_TOKEN" | tr -d '[:space:]')"; [ -z "$PUSH_TOK" ] && PUSH_TOK="${{ github.token }}"; echo "::add-mask::$PUSH_TOK"
           API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           AUTH="Authorization: token ${{ github.token }}"
           FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
@@ -145,7 +215,7 @@ jobs:
           # returns HTTP 405 on ANY protected branch (force or not, even for a user in
           # the force-push allowlist), so it cannot move a protected rc. git push honors
           # the push + force-push allowlists and creates rc if it is absent.
-          PUSH_URL="https://x-access-token:${{ github.token }}@${MOKOGIT_URL#https://}/${GIT_ORG}/${GIT_REPO}.git"
+          PUSH_URL="https://x-access-token:${PUSH_TOK}@${MOKOGIT_URL#https://}/${GIT_ORG}/${GIT_REPO}.git"
           git config --global user.name "mokogit-actions[bot]"
           git config --global user.email "actions@mokoconsulting.tech"
           git fetch --no-tags "$PUSH_URL" "${FROM}"
@@ -170,15 +240,23 @@ jobs:
       - name: Trigger RC deploy
         run: |
           # Workflow-token pushes do NOT wake downstream workflows; dispatch deploy-rc explicitly.
-          curl -sf -X POST -H "Authorization: token ${{ github.token }}" \n            -H "Content-Type: application/json" \n            "${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}/actions/workflows/deploy-rc.yml/dispatches" \n            -d '{"ref":"rc"}' \n            && echo "Dispatched deploy-rc on rc" \n            || echo "::warning::deploy-rc dispatch failed (no deploy-rc.yml on rc? non-go platform)"
+          curl -sf -X POST -H "Authorization: token ${{ github.token }}" \
+            -H "Content-Type: application/json" \
+            "${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}/actions/workflows/deploy-rc.yml/dispatches" \
+            -d '{"ref":"rc"}' \
+            && echo "Dispatched deploy-rc on rc" \
+            || echo "::warning::deploy-rc dispatch failed (no deploy-rc.yml on rc? non-go platform)"
 
       - name: Checkout rc and configure git
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
+          PUSH_TOK="$(printf '%s' "$MOKOGIT_TOKEN" | tr -d '[:space:]')"; [ -z "$PUSH_TOK" ] && PUSH_TOK="${{ github.token }}"; echo "::add-mask::$PUSH_TOK"
           git fetch origin rc
           git checkout rc
           git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
           git config --local user.name "mokogit-actions[bot]"
-          git remote set-url origin "https://x-access-token:${{ github.token }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Publish RC release
         continue-on-error: true
@@ -236,19 +314,28 @@ jobs:
     name: Build & Release Pipeline
     runs-on: release
     # Skip on template repos (Template-*) — they scaffold other repos and do not release.
-    # Trigger-loop guard (#404 follow-up): a merged bot/sync PR (template-sync/provisioning)
-    # must not fire a release. We gate the merged-PR path on the PR HEAD ref prefix and on
-    # [skip ci]/[skip sync] title markers; workflow_dispatch stays exempt (explicit human run).
+    # Stable release fires on a merged PR into main (pull_request:closed + merged) OR a
+    # direct PUSH to main. The pull_request path is the reliable one — a PR-merge does not
+    # always emit a base-branch push event to Actions, so relying on push alone silently
+    # skipped releases (the scheduled-safety-net below was the band-aid). The release
+    # steps already read github.event.pull_request.head.ref, so they handle both events.
+    # Loop guard: skip a self-push that carries
+    # [skip ci]/[skip sync] (mokocli's build commit + the changelog-promote commit); the
+    # non-code paths-ignore on the push trigger already drops docs/CI-only pushes.
+    # workflow_dispatch stays exempt (explicit human run).
     if: >-
       !startsWith(github.event.repository.name, 'Template-') &&
       (
         (
+          github.event_name == 'push' &&
+          !contains(github.event.head_commit.message, '[skip ci]') &&
+          !contains(github.event.head_commit.message, '[skip sync]')
+        ) ||
+        (
+          github.event_name == 'pull_request' &&
+          github.event.action == 'closed' &&
           github.event.pull_request.merged == true &&
-          !startsWith(github.event.pull_request.head.ref, 'chore/') &&
-          !startsWith(github.event.pull_request.head.ref, 'sync/') &&
-          !startsWith(github.event.pull_request.head.ref, 'bot/') &&
-          !startsWith(github.event.pull_request.head.ref, 'mokoonyx-template-sync') &&
-          !startsWith(github.event.pull_request.head.ref, 'template-sync') &&
+          github.event.pull_request.base.ref == 'main' &&
           !contains(github.event.pull_request.title, '[skip ci]') &&
           !contains(github.event.pull_request.title, '[skip sync]')
         ) ||
@@ -259,15 +346,18 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.MOKOGIT_TOKEN }}
+          token: ${{ github.token }}
           fetch-depth: 0
           submodules: recursive
 
       - name: Configure git for bot pushes
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
+          PUSH_TOK="$(printf '%s' "$MOKOGIT_TOKEN" | tr -d '[:space:]')"; [ -z "$PUSH_TOK" ] && PUSH_TOK="${{ github.token }}"; echo "::add-mask::$PUSH_TOK"
           git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
           git config --local user.name "mokogit-actions[bot]"
-          git remote set-url origin "https://x-access-token:${{ github.token }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Check for merge conflict markers
         run: |
@@ -286,7 +376,6 @@ jobs:
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
         run: |
           if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
             echo Using pre-installed /opt/mokocli
@@ -296,13 +385,23 @@ jobs:
             if ! command -v composer > /dev/null 2>&1; then
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
+            # Strip any stray whitespace/newline a pasted secret may carry, and mask
+            # it; the unquoted URL below otherwise word-splits on a trailing newline
+            # in MOKOGIT_TOKEN and git clone dies with "fatal: Too many arguments".
+            MOKO_CLONE_TOKEN="$(printf '%s' "${MOKO_CLONE_TOKEN}" | tr -d '[:space:]')"
+            echo "::add-mask::${MOKO_CLONE_TOKEN}"
+            if [ -z "${MOKO_CLONE_TOKEN}" ]; then
+              echo "::error::MOKOGIT_TOKEN secret is empty — cannot clone mokocli fallback." >&2
+              exit 1
+            fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            CLONE_URL="https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git"
+            git clone --depth 1 --branch main --quiet "${CLONE_URL}" /tmp/mokocli
             cd /tmp/mokocli
             # Authenticate to the MokoGIT private Composer registry (git.mokoconsulting.tech)
             # declared in mokocli composer.json (preferred-install=dist) before installing deps.
             composer config -g http-basic.git.mokoconsulting.tech x-access-token "${MOKO_CLONE_TOKEN}"
+            export COMPOSER_AUTH="{\"http-basic\":{\"git.mokoconsulting.tech\":{\"username\":\"x-access-token\",\"password\":\"${MOKO_CLONE_TOKEN}\"}}}"
             composer install --no-dev --no-interaction --no-progress --optimize-autoloader --quiet
             echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
           fi
@@ -310,7 +409,14 @@ jobs:
       - name: "Detect platform"
         id: platform
         run: |
-          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+          # Detect the platform from the repo's NATIVE manifest and emit it to
+          # $GITHUB_OUTPUT for downstream steps. READ-ONLY: the former metadata
+          # write-back (platform_detect.php --update --token --owner --repo) has
+          # been REMOVED — platform is now derived from the native manifest by the
+          # MokoCLI build agent, so this workflow no longer writes to the metadata
+          # registry. Non-fatal (|| true) so a detection hiccup never blocks a release.
+          php ${MOKO_CLI}/platform_detect.php --path . --github-output \
+            2>/dev/null || true
           php ${MOKO_CLI}/manifest_read.php --path . --github-output 2>/dev/null || true
 
       - name: "Determine version bump level"
@@ -437,45 +543,22 @@ jobs:
           if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
             php ${MOKO_CLI}/changelog_promote.php --path . --version "$VERSION"
             git add CHANGELOG.md
-            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true
+            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}] [skip ci]" || true
             git push origin main || true
             echo "Changelog promoted: [Unreleased] → [${VERSION}]"
           fi
 
-      # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
-      - name: "Step 9: Mirror release to GitHub"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          secrets.GH_MIRROR_TOKEN != ''
-        continue-on-error: true
+      - name: Dispatch npm publish (bump has persisted to main)
         run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
-          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
-          php ${MOKO_CLI}/release_mirror.php \
-            --version "$VERSION" --tag "$RELEASE_TAG" \
-            --token "${{ github.token }}" --api-base "$API_BASE" \
-            --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
-            --branch main 2>&1 || true
-          echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
-
-      # -- STEP 10: Sync main branch to GitHub mirror ----------------------------
-      - name: "Step 10: Push main to GitHub mirror"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          secrets.GH_MIRROR_TOKEN != ''
-        continue-on-error: true
-        run: |
-          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          GH_ORG=$(echo "$GH_REPO" | cut -d/ -f1)
-          GH_NAME=$(echo "$GH_REPO" | cut -d/ -f2)
-          git remote add github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
-            git remote set-url github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
-          git fetch origin main --depth=1
-          git push github origin/main:refs/heads/main --force 2>/dev/null \
-            && echo "main branch pushed to GitHub mirror" \
-            || echo "WARNING: GitHub mirror push failed"
+          curl -sf -X POST -H "Authorization: token ${{ github.token }}" \
+            -H "Content-Type: application/json" \
+            "${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}/actions/workflows/npm-publish.yml/dispatches" \
+            -d '{"ref":"main"}' \
+            && echo "Dispatched npm-publish on main" \
+            || echo "::warning::npm-publish dispatch failed (no npm-publish.yml on this repo? non-npm platform)"
+
+      # GitHub mirroring (release assets + main branch) moved to an out-of-band
+      # OAuth push-mirror (Gitea repo setting) — former Steps 9 & 10 removed.
 
       - name: "Step 11: Delete rc branch (dev reset moved to cascade-dev.yml)"
         if: steps.version.outputs.skip != 'true'
@@ -519,9 +602,13 @@ jobs:
         continue-on-error: true
         run: |
           API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          # No `|| true`: let a failed dev-version advance surface as a red step.
+          # `continue-on-error: true` above still keeps the release itself green,
+          # but a swallowed exit code is what let this go unnoticed for months
+          # (dev silently drifting below stable → dev-channel updates vanish).
           php ${MOKO_CLI}/version_reset_dev.php \
             --token "${{ github.token }}" --api-base "${API_BASE}" \
-            --branch dev --path . 2>&1 || true
+            --branch dev --path . 2>&1
 
       # -- Summary --------------------------------------------------------------
       - name: Pipeline Summary
@@ -559,8 +646,10 @@ jobs:
     name: Scheduled release safety-net
     runs-on: ubuntu-latest
     if: github.event_name == 'schedule' && !startsWith(github.event.repository.name, 'Template-')
+    # Own-repo write: dispatch a release when main has unreleased changes.
     permissions:
       contents: read
+      actions: write
     steps:
       - name: Checkout main
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -571,6 +660,8 @@ jobs:
       - name: Dispatch release if main has unreleased changes
         env:
           MOKOGIT_TOKEN: ${{ github.token }}
+          NTFY_URL: ${{ vars.NTFY_URL }}
+          NTFY_TOPIC: ${{ vars.NTFY_TOPIC }}
         run: |
           # [Unreleased] is non-empty precisely when changes were merged but not yet
           # released (the release job promotes it to a version and empties it).
@@ -583,14 +674,36 @@ jobs:
             exit 0
           fi
           echo "Unreleased changes detected on main — a merge release was likely missed."
-          echo "Dispatching a release via the safety-net."
+          API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
+          # Snapshot the newest run id BEFORE dispatching. Gitea can return 2xx to
+          # workflow_dispatch WITHOUT creating a run (see mokocli#499), so an HTTP
+          # 204 is NOT proof of recovery — confirm a new run actually appears.
+          before=$(curl -s -H "Authorization: token ${MOKOGIT_TOKEN}" "${API}/actions/tasks?limit=1" \
+            | python3 -c "import sys,json;r=json.load(sys.stdin).get('workflow_runs',[]);print(r[0]['id'] if r else 0)" 2>/dev/null || echo 0)
+          echo "Dispatching a release via the safety-net (newest run before = ${before})."
           HTTP=$(curl -s -o /dev/null -w '%{http_code}' -X POST \
             -H "Authorization: token ${MOKOGIT_TOKEN}" \
             -H "Content-Type: application/json" \
             -d '{"ref":"main","inputs":{"action":"release"}}' \
-            "${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}/actions/workflows/auto-release.yml/dispatches")
-          if [ "$HTTP" = "204" ] || [ "$HTTP" = "201" ] || [ "$HTTP" = "200" ]; then
-            echo "Release dispatched (HTTP $HTTP)."
-          else
-            echo "::warning::Safety-net release dispatch failed (HTTP $HTTP)"
+            "${API}/actions/workflows/auto-release.yml/dispatches")
+          echo "Dispatch HTTP ${HTTP}."
+          # Verify a NEW run actually materialised (a 2xx alone is not proof).
+          created=0
+          for i in $(seq 1 12); do
+            sleep 10
+            newest=$(curl -s -H "Authorization: token ${MOKOGIT_TOKEN}" "${API}/actions/tasks?limit=8" \
+              | python3 -c "import sys,json;rs=json.load(sys.stdin).get('workflow_runs',[]);print(max([r['id'] for r in rs] or [0]))" 2>/dev/null || echo 0)
+            if [ "${newest:-0}" -gt "${before:-0}" ]; then created=1; break; fi
+          done
+          if [ "$created" = "1" ]; then
+            echo "Release run created — safety-net recovery succeeded."
+            exit 0
+          fi
+          # No run materialised: turn the silent no-op into a LOUD, actionable failure.
+          echo "::error::Safety-net dispatched a release (HTTP ${HTTP}) but NO run was created — Gitea workflow_dispatch no-run (mokocli#499). main has UNRELEASED changes that did not publish. Recover by merging a change to main or running auto-release from the web UI."
+          if [ -n "${NTFY_URL:-}" ] && [ -n "${NTFY_TOPIC:-}" ]; then
+            curl -s -X POST -H "Title: Release recovery FAILED" -H "Priority: high" \
+              -d "Safety-net could not recover a missed release on ${{ github.repository }}: workflow_dispatch created no run (mokocli#499). Trigger a release manually." \
+              "${NTFY_URL%/}/${NTFY_TOPIC}" >/dev/null 2>&1 || true
           fi
+          exit 1