@muggleai/works 5.27.0-staging.245 → 5.27.0-staging.246

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "muggleai",
       "source": "./plugin",
       "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-      "version": "5.27.0-staging.245"
+      "version": "5.27.0-staging.246"
     }
   ]
 }

package/dist/{chunk-FI6VHHZN.js → chunk-6BAB7IVG.js}

@@ -5705,7 +5705,7 @@ async function checkServiceStack(params) {
   const snapshot = await readGenerationStore({ directory: ledgerDir(), emptyRecord: EMPTY_STACK_RECORD });
   const swept = sweepStackRecord({ record: snapshot.record, now: Date.now(), isAlive: isProcessAlive });
   const ownLease = swept.leases.find((lease) => lease.cwd === cwd) ?? null;
-  const base = { cwd, generation: snapshot.generation, mismatches: [], peerLease: null };
+  const base = { cwd, generation: snapshot.generation, mismatches: [], peerLease: null, servedNeeds: [] };
   const isClaimedByCaller = ownLease?.needs.some((need) => need.port === params.port) ?? false;
   const peerLease = params.port === void 0 || isClaimedByCaller ? void 0 : swept.leases.find((lease) => lease.cwd !== cwd && lease.needs.some((need) => need.port === params.port));
   if (peerLease !== void 0) {
@@ -5734,7 +5734,12 @@ async function checkServiceStack(params) {
       mismatches
     };
   }
-  return { ...base, verdict: "VALID" /* Valid */, reason: "every claimed port serves the claimed code" };
+  return {
+    ...base,
+    verdict: "VALID" /* Valid */,
+    reason: "every claimed port serves the claimed code",
+    servedNeeds: ownLease.needs
+  };
 }
 async function startStackRun(params) {
   const cwd = await resolveCheckoutRoot({ cwd: params.cwd, runGit: params.runGit ?? runGitCommand });
@@ -9596,6 +9601,20 @@ async function findRunStackRefusal(params) {
   });
   return REFUSING_VERDICTS.has(report.verdict) ? report : null;
 }
+async function readServedStack(params) {
+  if (!isLoopbackUrl(params.localUrl)) return [];
+  const report = await checkServiceStack({ cwd: params.cwd, runGit: params.runGit, readListener: params.readListener });
+  return report.servedNeeds;
+}
+function recordServedStack(params) {
+  if (params.servedStack.length === 0 || params.stackChange !== null) return;
+  const storage = getRunResultStorageService();
+  const runResult = storage.getRunResult(params.runId);
+  if (!runResult) return;
+  storage.updateRunResult(params.runId, {
+    localExecutionContext: { ...runResult.localExecutionContext, servedStack: params.servedStack }
+  });
+}
 async function runUnderStackLease(params) {
   if (!isLoopbackUrl(params.localUrl)) return await params.execute();
   const runId = randomUUID();
@@ -9985,6 +10004,7 @@ var executeTestGenerationTool = {
       logger7.warn("Test generation refused: service stack", { verdict: stackRefusal.verdict, cwd: input.cwd });
       return { content: formatRunStackRefusal(stackRefusal, input.cwd), isError: true, data: stackRefusal };
     }
+    const servedStack = await readServedStack({ cwd: input.cwd, localUrl: input.localUrl });
     try {
       const generationRun = await runUnderStackLease({
         cwd: input.cwd,
@@ -10012,6 +10032,7 @@ var executeTestGenerationTool = {
         generationRun.errorMessage ? `**Error:** ${generationRun.errorMessage}` : ""
       ].filter(Boolean).join("\n");
       const stackChange = await findStackChangedDuringRun({ cwd: input.cwd, localUrl: input.localUrl });
+      recordServedStack({ runId: generationRun.id, servedStack, stackChange });
       const reportedContent = stackChange ? content + formatStackChangedDuringRun(stackChange) : content;
       return {
         content: reportedContent,
@@ -10051,6 +10072,7 @@ var executeReplayTool = {
       logger7.warn("Test replay refused: service stack", { verdict: stackRefusal.verdict, cwd: input.cwd });
       return { content: formatRunStackRefusal(stackRefusal, input.cwd), isError: true, data: stackRefusal };
     }
+    const servedStack = await readServedStack({ cwd: input.cwd, localUrl: input.localUrl });
     try {
       const replayRun = await runUnderStackLease({
         cwd: input.cwd,
@@ -10079,6 +10101,7 @@ var executeReplayTool = {
         replayRun.errorMessage ? `**Error:** ${replayRun.errorMessage}` : ""
       ].filter(Boolean).join("\n");
       const stackChange = await findStackChangedDuringRun({ cwd: input.cwd, localUrl: input.localUrl });
+      recordServedStack({ runId: replayRun.id, servedStack, stackChange });
       const reportedContent = stackChange ? content + formatStackChangedDuringRun(stackChange) : content;
       return {
         content: reportedContent,

package/dist/{chunk-SJBYMBC2.js → chunk-PT5EGMBA.js}

@@ -1,4 +1,4 @@
-import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir2, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, getElectronAppSignedFromVersion, getReleaseSignerIdentityUri, verifyFileChecksum, resolveElectronAppExecutablePath, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assertDeviceCodeClientProvisioned, performLogin, getActiveElectronAppReleaseStream, buildToolInputJsonSchema, toolRequiresAuth, getCallerCredentials, parseElectronAppDirName, getElectronAppReleaseTagPrefix, hasShownDisclosure, markDisclosureShown, getBundledElectronAppVersion, getElectronAppVersionSource, getCredentialsFilePath, ElectronAppReleaseStream, buildElectronAppChecksumsUrl, __require, getDisclosureCopy, buildOnboardingPlan, applyOnboardingAnswers, needsOnboarding, buildLlmSourcePlan, describeLlmSourceStatus, resolveLlmSourceStatus, readRunView, RunViewError, renderRunViewText, writeRunViewHtml, openBrowserUrl, evaluateCheckoutFreshness, runGitCommand, BLOCKING_FRESHNESS_VERDICTS, claimServiceStack, BUSY_EXIT_CODE, checkServiceStack, releaseServiceStack, readServiceStackStatus, resolvePreferences, OnboardingBlanketChoice, PreferenceKey, LlmSource, applyLlmSourceSelection, describeStackMismatch, getDataDir, DEFAULT_LOCAL_LLM_BASE_URL, isValidLocalBaseUrl } from './chunk-FI6VHHZN.js';
+import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir2, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, getElectronAppSignedFromVersion, getReleaseSignerIdentityUri, verifyFileChecksum, resolveElectronAppExecutablePath, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assertDeviceCodeClientProvisioned, performLogin, getActiveElectronAppReleaseStream, buildToolInputJsonSchema, toolRequiresAuth, getCallerCredentials, parseElectronAppDirName, getElectronAppReleaseTagPrefix, hasShownDisclosure, markDisclosureShown, getBundledElectronAppVersion, getElectronAppVersionSource, getCredentialsFilePath, ElectronAppReleaseStream, buildElectronAppChecksumsUrl, __require, getDisclosureCopy, buildOnboardingPlan, applyOnboardingAnswers, needsOnboarding, buildLlmSourcePlan, describeLlmSourceStatus, resolveLlmSourceStatus, readRunView, RunViewError, renderRunViewText, writeRunViewHtml, openBrowserUrl, evaluateCheckoutFreshness, runGitCommand, BLOCKING_FRESHNESS_VERDICTS, claimServiceStack, BUSY_EXIT_CODE, checkServiceStack, releaseServiceStack, readServiceStackStatus, resolvePreferences, OnboardingBlanketChoice, PreferenceKey, LlmSource, applyLlmSourceSelection, describeStackMismatch, getDataDir, DEFAULT_LOCAL_LLM_BASE_URL, isValidLocalBaseUrl, local_exports } from './chunk-6BAB7IVG.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { v4 } from 'uuid';
@@ -356,6 +356,16 @@ function parentIsAlive(pid) {
   }
 }
 
+// src/pr-walkthrough/constants.ts
+var REPORT_SENTINEL = "muggle-pr-section";
+var WALKTHROUGH_SLOT_MARKER = "<!-- muggle-pr-walkthrough:v1 -->";
+var WALKTHROUGH_SKIPPED_MARKER = "<!-- muggle-pr-walkthrough-status:skipped -->";
+var WALKTHROUGH_COMMENT_HEADING = "### Muggle AI \u2014 PR visual walkthrough";
+var RERUN_NOTICE_OPENING = "<!-- muggle-pr-walkthrough-rerun -->";
+var SHORT_SHA_LENGTH = 7;
+var GH_COMMENT_TIMEOUT_MS = 1e4;
+var DEPENDENCY_BOT_LOGINS = ["dependabot[bot]", "renovate[bot]"];
+
 // src/cli/pr-section/constants.ts
 var DETAIL_IMAGE_WIDTH = 720;
 var STEP_IMAGE_WIDTH = 640;
@@ -369,6 +379,84 @@ var SHORT_ID_LABEL_SEPARATOR = " \xB7 ";
 var TEST_DETAILS_ANCHOR_PREFIX = "muggle-test-";
 var STEP_PAIR_IMAGE_WIDTH = 420;
 var MAX_COMMENT_BYTES = 64e3;
+var FULL_COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
+var BASELINE_FAILED_STATUS = "failed";
+
+// src/cli/pr-section/baseline.ts
+var refused = (refusalReason) => ({ isCredited: false, refusalReason });
+async function resolveBaseRange(deps) {
+  const baseRef = deps.baseBranch ? `refs/remotes/origin/${deps.baseBranch}` : await deps.runGit(["symbolic-ref", "refs/remotes/origin/HEAD"], deps.cwd);
+  if (!baseRef) return null;
+  const baseTipSha = await deps.runGit(["rev-parse", "--verify", `${baseRef}^{commit}`], deps.cwd);
+  if (!baseTipSha) return null;
+  const mergeBaseSha = await deps.runGit(["merge-base", "HEAD", baseTipSha], deps.cwd);
+  return mergeBaseSha ? { mergeBaseSha, baseTipSha } : null;
+}
+async function isOnBaseSinceFork(sha, range, deps) {
+  const isAncestor = async (ancestor, descendant) => await deps.runGit(["merge-base", "--is-ancestor", ancestor, descendant], deps.cwd) !== null;
+  return await isAncestor(range.mergeBaseSha, sha) && await isAncestor(sha, range.baseTipSha);
+}
+function servedCommitsOf(baselineRun) {
+  const servedStack = baselineRun.localExecutionContext?.servedStack;
+  if (!Array.isArray(servedStack)) return [];
+  return servedStack.map((servedNeed) => servedNeed?.headSha).filter((sha) => typeof sha === "string" && FULL_COMMIT_SHA_PATTERN.test(sha));
+}
+async function judgeBaseline(test, baselineRunId, range, deps) {
+  if (range === null) return refused("the base branch could not be resolved in this checkout");
+  const baselineRun = deps.readRunResult(baselineRunId);
+  if (!baselineRun) return refused("no such run in the local run store");
+  if (baselineRun.id === test.runId) return refused("it is the failing run itself");
+  if (baselineRun.cloudTestCaseId !== test.testCaseId) return refused(`it ran test case ${baselineRun.cloudTestCaseId}`);
+  if (baselineRun.status !== BASELINE_FAILED_STATUS) return refused(`its status is ${baselineRun.status}`);
+  if (test.runSettingsId && baselineRun.cloudRunSettingsId && baselineRun.cloudRunSettingsId !== test.runSettingsId) {
+    return refused("it ran under a different runSettings record");
+  }
+  const servedCommits = servedCommitsOf(baselineRun);
+  if (servedCommits.length === 0) return refused("it recorded no stack it served");
+  for (const servedSha of servedCommits) {
+    if (!await isOnBaseSinceFork(servedSha, range, deps)) continue;
+    return {
+      isCredited: true,
+      failsOnBase: {
+        baselineRunId: baselineRun.id,
+        baselineSha: servedSha,
+        ...baselineRun.viewUrl && { viewUrl: baselineRun.viewUrl }
+      }
+    };
+  }
+  const span = `${range.mergeBaseSha.slice(0, SHORT_SHA_LENGTH)}..${range.baseTipSha.slice(0, SHORT_SHA_LENGTH)}`;
+  return refused(`none of the commits it served is on the base between ${span}`);
+}
+function withoutFailsOnBase(test) {
+  const uncredited = { ...test };
+  delete uncredited.failsOnBase;
+  return uncredited;
+}
+async function verifyBaselineFailures(report, deps) {
+  let range;
+  const tests = [];
+  for (const test of report.tests) {
+    if (test.status !== "failed") {
+      tests.push(test);
+      continue;
+    }
+    const uncredited = withoutFailsOnBase(test);
+    if (!test.baselineRunId) {
+      tests.push(uncredited);
+      continue;
+    }
+    if (range === void 0) range = await resolveBaseRange(deps);
+    const judgment = await judgeBaseline(uncredited, test.baselineRunId, range, deps);
+    if (judgment.isCredited) {
+      tests.push({ ...uncredited, failsOnBase: judgment.failsOnBase });
+      continue;
+    }
+    deps.stderrWrite(`build-pr-section: baseline ${test.baselineRunId} for "${test.name}" not credited: ${judgment.refusalReason}
+`);
+    tests.push(uncredited);
+  }
+  return { ...report, tests };
+}
 
 // src/e2e-result/types.ts
 var UnpassedCaseStatus = /* @__PURE__ */ ((UnpassedCaseStatus2) => {
@@ -400,8 +488,12 @@ function describeUnpassedCase(unpassed) {
   const outcome = unpassed.status === "failed" /* Failed */ && unpassed.failedStep !== void 0 ? `failed at step ${unpassed.failedStep}` : unpassed.status;
   return `${outcome}: ${escapeHtml(unpassed.detail)}`;
 }
+function describeFailsOnBase(failsOnBase) {
+  const baselineLink = failsOnBase.viewUrl ? ` ([baseline run](${failsOnBase.viewUrl}))` : "";
+  return ` \xB7 also fails on base \`${failsOnBase.baselineSha.slice(0, SHORT_SHA_LENGTH)}\`${baselineLink}`;
+}
 function renderUnpassedCaseBullet(unpassed, linkText, linkTarget) {
-  return `- ${UNPASSED_STATUS_EMOJI[unpassed.status]} **${escapeHtml(withResolutionLabel(unpassed.name, unpassed.resolutionLabel))}** \u2014 ${describeUnpassedCase(unpassed)} \xB7 [${linkText}](${linkTarget})`;
+  return `- ${UNPASSED_STATUS_EMOJI[unpassed.status]} **${escapeHtml(withResolutionLabel(unpassed.name, unpassed.resolutionLabel))}** \u2014 ${describeUnpassedCase(unpassed)} \xB7 [${linkText}](${linkTarget})` + (unpassed.failsOnBase ? describeFailsOnBase(unpassed.failsOnBase) : "");
 }
 var UnpassedCaseSchema = z.object({
   name: z.string(),
@@ -411,7 +503,8 @@ var UnpassedCaseSchema = z.object({
   status: z.enum(UnpassedCaseStatus),
   failedStep: z.number().int().positive().optional(),
   detail: z.string(),
-  viewUrl: z.string()
+  viewUrl: z.string(),
+  failsOnBase: z.object({ baselineRunId: z.string(), baselineSha: z.string(), viewUrl: z.string().optional() }).optional()
 });
 var E2eResultRecordSchema = z.object({
   total: z.number().int().nonnegative(),
@@ -467,7 +560,8 @@ function toUnpassedCase(test) {
       status: "failed" /* Failed */,
       failedStep: failureOrdinal(test, test.failureStepIndex),
       detail: oneLineDetail(test.error),
-      viewUrl: test.viewUrl
+      viewUrl: test.viewUrl,
+      ...test.failsOnBase && { failsOnBase: test.failsOnBase }
     };
   }
   if (test.status === "inconclusive") {
@@ -532,6 +626,9 @@ var FailedTestSchema = z.object({
   steps: z.array(StepSchema),
   failureStepIndex: z.number().int().nonnegative(),
   error: z.string().min(1),
+  // A run of the same test case on the PR's base the author says failed too; build-pr-section verifies it before
+  // the walkthrough credits it.
+  baselineRunId: z.string().min(1).optional(),
   artifactsDir: z.string().min(1).optional(),
   useCaseName: z.string().min(1).optional(),
   description: z.string().min(1).optional(),
@@ -1054,7 +1151,7 @@ async function resolveGsScreenshotUrls(report, opts) {
     if (gsUrls.length === 0) {
       return report;
     }
-    const mcps = await import('./src-33XQK7NM.js');
+    const mcps = await import('./src-MCJFH7AB.js');
     const credentials = await mcps.getCallerCredentialsAsync();
     if (!credentials.bearerToken && !credentials.apiKey) {
       stderrWrite(
@@ -1148,7 +1245,15 @@ ${err.issues.map((i) => `  - ${i.path.join(".")}: ${i.message}`).join("\n")}
     }
     return 1;
   }
-  const resolvedReport = await resolveGsScreenshotUrls(report, { stderrWrite: opts.stderrWrite });
+  const verifyBaselines = opts.verifyBaselines ?? ((parsedReport) => verifyBaselineFailures(parsedReport, {
+    cwd: process.cwd(),
+    baseBranch: opts.baseBranch,
+    runGit: runGitCommand,
+    readRunResult: (runId) => local_exports.getRunResultStorageService().getRunResult(runId),
+    stderrWrite: opts.stderrWrite
+  }));
+  const verifiedReport = await verifyBaselines(report);
+  const resolvedReport = await resolveGsScreenshotUrls(verifiedReport, { stderrWrite: opts.stderrWrite });
   const sentinelCost = Buffer.byteLength(`${REPORT_SECTION_SENTINEL}
 `, "utf-8");
   const renderedSection = buildPrSection(resolvedReport, {
@@ -1174,7 +1279,8 @@ async function buildPrSectionCommand(options) {
     stdin: process.stdin,
     stdoutWrite: (s) => process.stdout.write(s),
     stderrWrite: (s) => process.stderr.write(s),
-    maxBodyBytes
+    maxBodyBytes,
+    baseBranch: options.base
   });
   if (code !== 0) {
     process.exitCode = code;
@@ -3192,16 +3298,6 @@ var NON_APP_PATH_PATTERNS = [
   /^\.gitlab-ci\.yml$/
 ];
 
-// src/pr-walkthrough/constants.ts
-var REPORT_SENTINEL = "muggle-pr-section";
-var WALKTHROUGH_SLOT_MARKER = "<!-- muggle-pr-walkthrough:v1 -->";
-var WALKTHROUGH_SKIPPED_MARKER = "<!-- muggle-pr-walkthrough-status:skipped -->";
-var WALKTHROUGH_COMMENT_HEADING = "### Muggle AI \u2014 PR visual walkthrough";
-var RERUN_NOTICE_OPENING = "<!-- muggle-pr-walkthrough-rerun -->";
-var SHORT_SHA_LENGTH = 7;
-var GH_COMMENT_TIMEOUT_MS = 1e4;
-var DEPENDENCY_BOT_LOGINS = ["dependabot[bot]", "renovate[bot]"];
-
 // src/pr-walkthrough/comment.ts
 function renderReservedComment() {
   return `${WALKTHROUGH_SLOT_MARKER}
@@ -3411,6 +3507,7 @@ var CHECK_SUMMARY_MAX_CASES = 50;
 var OUTCOME_CONCLUSIONS = {
   ["settled" /* Settled */]: "success" /* Success */,
   ["e2e-not-passing" /* E2eNotPassing */]: "failure" /* Failure */,
+  ["e2e-fails-on-base" /* E2eFailsOnBase */]: "neutral" /* Neutral */,
   ["rerun-in-progress" /* RerunInProgress */]: null,
   ["unsettled" /* Unsettled */]: "failure" /* Failure */,
   ["unreadable" /* Unreadable */]: "neutral" /* Neutral */
@@ -3427,15 +3524,32 @@ function countLabel(count, status) {
   return count > 0 ? `${count} ${status}` : null;
 }
 function renderNotPassingSummary(record) {
+  return renderCaseSummary(
+    record,
+    `E2E acceptance did not pass \u2014 ${unpassedTally(record)} of ${testCaseCount(record)}. Fix them, re-run the whole suite, and update the walkthrough comment; editing it re-runs this check.`
+  );
+}
+function renderFailsOnBaseSummary(record) {
+  return renderCaseSummary(
+    record,
+    `E2E acceptance: ${unpassedTally(record)} of ${testCaseCount(record)}, each verified to fail on the base too. This PR did not cause them; fix them on the base branch.`
+  );
+}
+function testCaseCount(record) {
+  return `${record.total} test ${record.total === 1 ? "case" : "cases"}`;
+}
+function unpassedTally(record) {
   const failed2 = record.unpassed.filter((c) => c.status === "failed" /* Failed */).length;
-  const tally = [
+  return [
     countLabel(failed2, "failed" /* Failed */),
     countLabel(record.unpassed.length - failed2, "inconclusive" /* Inconclusive */)
   ].filter((part) => part !== null).join(", ");
+}
+function renderCaseSummary(record, headline) {
   const listed = record.unpassed.slice(0, CHECK_SUMMARY_MAX_CASES).map((unpassed) => renderUnpassedCaseBullet(unpassed, "open run", unpassed.viewUrl));
   const hidden = record.unpassed.length - listed.length;
   return [
-    `E2E acceptance did not pass \u2014 ${tally} of ${record.total} test ${record.total === 1 ? "case" : "cases"}. Fix them, re-run the whole suite, and update the walkthrough comment; editing it re-runs this check.`,
+    headline,
     "",
     ...listed,
     ...hidden > 0 ? [`- \u2026and ${hidden} more \u2014 see the walkthrough comment.`] : []
@@ -3469,7 +3583,10 @@ function judgeComments(pr, comments, run) {
   }
   const record = latestE2eResult(bodies);
   if (record && record.unpassed.length > 0) {
-    return { outcome: "e2e-not-passing" /* E2eNotPassing */, summary: renderNotPassingSummary(record) };
+    const isEveryUnpassedOnBase = record.unpassed.every(
+      (unpassed) => unpassed.status === "failed" /* Failed */ && unpassed.failsOnBase !== void 0
+    );
+    return isEveryUnpassedOnBase ? { outcome: "e2e-fails-on-base" /* E2eFailsOnBase */, summary: renderFailsOnBaseSummary(record) } : { outcome: "e2e-not-passing" /* E2eNotPassing */, summary: renderNotPassingSummary(record) };
   }
   const outcome = verdictNow === "satisfied" /* Satisfied */ ? "settled" /* Settled */ : "unsettled" /* Unsettled */;
   return { outcome, summary: FIXED_SUMMARIES[outcome] };
@@ -6058,8 +6175,8 @@ function renderReloadReport(report, isDryRun) {
   const lines = report.decisions.map((decision) => {
     const label = decision.name ?? decision.shortId ?? decision.sessionId;
     const failed2 = report.failedSessionIds.includes(decision.sessionId) ? " (restart failed)" : "";
-    const refused = report.untrustedSessionIds.includes(decision.sessionId) ? ` (left running: ${decision.cwd ?? "its workspace"} refuses a background restart \u2014 run /reload-plugins in it)` : "";
-    return `  ${decision.action.padEnd(16)} ${label}  ${decision.reason}${failed2}${refused}`;
+    const refused2 = report.untrustedSessionIds.includes(decision.sessionId) ? ` (left running: ${decision.cwd ?? "its workspace"} refuses a background restart \u2014 run /reload-plugins in it)` : "";
+    return `  ${decision.action.padEnd(16)} ${label}  ${decision.reason}${failed2}${refused2}`;
   });
   const isRestart = (action) => action === "respawn" /* Respawn */ || action === "resume-reconcile" /* ResumeReconcile */;
   const respawnVerb = isDryRun ? "would restart" : "restarted";
@@ -6137,7 +6254,7 @@ function createProgram() {
   program.command("login").description("Authenticate with Muggle AI (uses device code flow)").option("--key-name <name>", "Name for the API key").option("--key-expiry <expiry>", "API key expiry: 30d, 90d, 1y, never", "90d").action(loginCommand);
   program.command("logout").description("Clear stored credentials").action(logoutCommand);
   program.command("status").description("Show authentication status").action(statusCommand);
-  program.command("build-pr-section").description("Render a muggle-do PR body evidence block from an e2e report on stdin").option("--max-body-bytes <n>", "Max UTF-8 byte budget for the PR body (default 60000)").action(buildPrSectionCommand);
+  program.command("build-pr-section").description("Render a muggle-do PR body evidence block from an e2e report on stdin").option("--max-body-bytes <n>", "Max UTF-8 byte budget for the PR body (default 60000)").option("--base <branch>", "Branch the PR merges into, for verifying cited baseline runs (default: the remote's default branch)").action(buildPrSectionCommand);
   program.command("run-view").argument("[runId]", "Run id, or a unique prefix of one (default: the newest run)").description("Show a local run's steps beside the frames they produced").option("--html", "Render a self-contained HTML page instead of terminal text").option("--open", "Open the rendered page in the default browser (implies --html)").option("--out-dir <dir>", "Directory to write the page into (default: current directory)").action(runViewCommand);
   program.command("pr-walkthrough-check").description("Check that a PR's Muggle AI walkthrough comment carries a result or a stated skip").option("--repo <owner/repo>", "Repository (default: $GITHUB_REPOSITORY)").option("--pr <number>", "Pull request number (default: the Actions event payload)").option("--head-sha <sha>", "Commit the check run attaches to (default: the PR head)").option("--check-run", "Publish the verdict as a check run instead of failing the process").action(prWalkthroughCheckCommand);
   program.command("checkout-freshness").description("Fetch the base branch and check that a checkout is built on its latest commit").option("--cwd <dir>", "Directory inside the checkout (default: the current directory)").option("--base <branch>", "Branch the change merges into (default: origin's default branch)").option("--no-fetch", "Check against the last fetched base instead of fetching").option("--json", "Print the full report as JSON").action(checkoutFreshnessCommand);

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runCli } from './chunk-SJBYMBC2.js';
-import './chunk-FI6VHHZN.js';
+import { runCli } from './chunk-PT5EGMBA.js';
+import './chunk-6BAB7IVG.js';
 
 // src/cli/main.ts
 runCli().catch((error) => {

package/dist/index.js

@@ -1,2 +1,2 @@
-export { src_exports as commands, createUnifiedMcpServer, server_exports as server } from './chunk-SJBYMBC2.js';
-export { createChildLogger, e2e_exports as e2e, getConfig, getLocalQaTools, getLogger, getQaTools, local_exports as localQa, mcp_exports as mcp, e2e_exports as qa, src_exports as shared } from './chunk-FI6VHHZN.js';
+export { src_exports as commands, createUnifiedMcpServer, server_exports as server } from './chunk-PT5EGMBA.js';
+export { createChildLogger, e2e_exports as e2e, getConfig, getLocalQaTools, getLogger, getQaTools, local_exports as localQa, mcp_exports as mcp, e2e_exports as qa, src_exports as shared } from './chunk-6BAB7IVG.js';

package/dist/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muggle",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.27.0-staging.245",
+  "version": "5.27.0-staging.246",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/dist/plugin/.codex-mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.27.0-staging.245",
+        "@muggleai/works@5.27.0-staging.246",
         "serve"
       ],
       "env": {

package/dist/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muggle",
-  "version": "5.27.0-staging.245",
+  "version": "5.27.0-staging.246",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
   "author": {
     "name": "Muggle AI",

package/dist/plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "muggle",
   "displayName": "Muggle AI",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.27.0-staging.245",
+  "version": "5.27.0-staging.246",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/dist/plugin/.mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.27.0-staging.245",
+        "@muggleai/works@5.27.0-staging.246",
         "serve"
       ]
     }

package/dist/plugin/skills/do/e2e-repair.md

@@ -54,6 +54,8 @@ Map each bucket to exactly one disposition. Buckets are defined in [`../_shared/
 
 A `repair` disposition requires a named defect: the failing step, expected-versus-actual, and the code path it implicates. Without one it is `ask`, whatever the bucket said.
 
+**A failure the diff cannot explain may predate it.** When a `product-defect` or `product-uxux` failure names no code path the diff touched, replay the same test case against a checkout of the base before repairing anything: a worktree at the base tip's full SHA, with its own stack claim and services, under the same runSettings record. If that run fails the same way, its disposition is `baseline` — the defect is on the base, not this change's to fix — and the entry carries that run's id as `baselineRunId` into the walkthrough report ([`../muggle-pr-visual-walkthrough/e2e-report-assembly.md`](../muggle-pr-visual-walkthrough/e2e-report-assembly.md)). If it passes, the change caused the failure and the original disposition stands. A `baseline` entry is never re-run or waived; when every remaining failure is `baseline`, the loop clears.
+
 An Inconclusive entry Stage 6 recorded as `prerequisites unmet` never executed. It carries no bucket and none may be derived from it — there is no run to read. Its disposition is `ask`, and the question names the missing prerequisite: what failed is the project's test-plan chain, not the diff.
 
 An Inconclusive entry Stage 6 recorded as `primary failed` never executed either: it is a record held back by its test case's failed primary. It takes no disposition of its own; the primary's entry is the one repaired, and re-running the test case runs it again.

package/dist/plugin/skills/muggle-pr-visual-walkthrough/e2e-report-assembly.md

@@ -30,6 +30,7 @@ For each result:
 2. `viewUrl` — from the run result (deep-links to the specific run).
 3. `status` — from `muggle-local-run-result-get`.
 4. If failed: also capture `failureStepIndex`, `error`, `artifactsDir` from the run result.
+5. If the caller hands over a `baselineRunId` for a failed entry — a run of the same test case against the base that failed too — set it on the entry. `build-pr-section` credits it only after checking the run itself: same test case, failed, same runSettings record, and a stack that served a base commit between the PR's fork point and the base tip. A credited failure reads "also fails on base" and stops holding the walkthrough check red; a refused one is named on stderr and stays a plain failure. Pass `--base <branch>` when the PR does not target the remote's default branch.
 
 ## Last-resort: no cloud refs on the run result
 

package/dist/release-manifest.json

@@ -1,7 +1,7 @@
 {
   "release": "5.26.0",
-  "buildId": "run-245-1",
-  "commitSha": "d4e56d068786541b25d22819c6336d5c5f5baf6b",
-  "buildTime": "2026-10-29T16:50:53Z",
+  "buildId": "run-246-1",
+  "commitSha": "a4306b9b72399d0b48c1242356d766a492e6fc1b",
+  "buildTime": "2026-10-29T17:19:18Z",
   "serviceName": "muggle-ai-works-mcp"
 }

package/dist/{src-33XQK7NM.js → src-MCJFH7AB.js}

@@ -1 +1 @@
-export { ACTION_SCRIPT_FILE_NAME, BASE_REMOTE_NAME, BLOCKING_FRESHNESS_VERDICTS, BRANCH_CREATION_REFLOG_PREFIX, BUSY_EXIT_CODE, CLAUDE_CODE_AUTH_STATUS_ARGS, CLAUDE_CODE_CHECK_TIMEOUT_MS, CLAUDE_CODE_EXECUTABLE, CLAUDE_CODE_EXECUTABLE_NOT_FOUND_CODE, CLAUDE_CODE_SESSION_LINK_ENV_VARS, CLAUDE_CODE_VERSION_ARGS, CheckoutFreshnessVerdict, ClaudeCodeReadiness, DEFAULT_LOCAL_LLM_BASE_URL, DEFAULT_PREFERENCES, ELECTRON_APP_EXECUTABLE_PATH_SEGMENTS, ElectronAppPlatform, ElectronAppReleaseStream, HTML_VIEW_OFFER_LINE, LLM_CREDENTIALS_FILE_MODE, LLM_CREDENTIALS_FILE_NAME, LLM_SOURCE_HEADER, LLM_SOURCE_OPTIONS, LLM_SOURCE_OWNED_ENV_NAMES, LLM_SOURCE_PROMPT, LLM_SOURCE_SCOPE_NOTE, LlmSource, MASKED_API_KEY_PREFIX, MASKED_API_KEY_VISIBLE_CHARS, MAX_LISTED_INHERITED_COMMITS, ONBOARDING_BLANKET_OPTIONS, ONBOARDING_CHOICE_GROUPS, ONBOARDING_MAX_OFFERS, ONBOARDING_PRIMER_BULLETS, ONBOARDING_PRIMER_HEADLINE, ONBOARDING_TOGGLE_GROUPS, ONBOARDING_TOGGLE_PROMPT, ONBOARDING_UNSELECTED_TOGGLE_VALUE, OnboardingBlanketChoice, OnboardingGroupKind, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RUN_SESSIONS_DIR_NAME, RUN_VIEW_DASHBOARD_LINK_LABEL, RunViewError, RuntimeTarget, SCREENSHOT_DIR_RELATIVE_PATH, SCREENSHOT_FILE_EXTENSION, StackCheckVerdict, StackClaimVerdict, StackMismatchKind, StackPortAction, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, applyLlmSourceSelection, applyOnboardingAnswers, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppDirName, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, buildLlmSourcePlan, buildOnboardingPlan, buildToolInputJsonSchema, calculateFileChecksum, checkServiceStack, claimServiceStack, completeOnboarding, createApiKeyWithToken, createChildLogger, decideStackClaim, decideStackReap, decideStackRelease, decideStackRunEnd, decideStackRunStart, deleteApiKeyData, deleteCredentials, describeLlmSourceStatus, describeStackMismatch, e2e_exports as e2e, evaluateCheckoutFreshness, findVacatedNeeds, finishStackRun, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDashboardBaseUrl, getDataDir2 as getDataDir, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppSignedFromVersion, getElectronAppVersion, getElectronAppVersionSource, getLlmSourceOption, getLocalQaTools, getLogger, getOnboardingToggleKeys, getPlatformKey, getQaTools, getReleaseSignerIdentityUri, getRunSessionsDir, getValidApiKeyData, getValidCredentials, hasApiKey, isElectronAppInstalled, isElectronAppPlatform, isFirstRun, isValidLocalBaseUrl, loadApiKeyData, loadCredentials, local_exports as localQa, markOnboardingCompleted, maskLlmApiKey, mcp_exports as mcp, needsConflict, needsOnboarding, openBrowserUrl, parseElectronAppDirName, performLogin, performLogout, pollDeviceCode, portOfUrl, e2e_exports as qa, readPreferencesMetadata, readRunView, readServiceStackStatus, reapServiceStack, reconcileProjectPreferences, recordOnboardingSkip, releaseServiceStack, renderRunViewHtml, renderRunViewText, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveBlanketPreferences, resolveElectronAppExecutablePath, resolveElectronAppPathOrNull, resolveLlmSourceStatus, resolveOnboardingAnswers, resolvePreferences, resolveRunSessionPath, resolveRuntimeTarget, resolveTogglePreferences, runGitCommand, saveApiKey, saveApiKeyData, saveCredentials, startDeviceCodeFlow, startStackRun, stopVacatedServices, toDisplayRef, toolRequiresAuth, validatePreference, verifyFileChecksum, writeLlmEnvBlock, writePreferences, writePreferencesWithMetadata, writeRunViewHtml } from './chunk-FI6VHHZN.js';
+export { ACTION_SCRIPT_FILE_NAME, BASE_REMOTE_NAME, BLOCKING_FRESHNESS_VERDICTS, BRANCH_CREATION_REFLOG_PREFIX, BUSY_EXIT_CODE, CLAUDE_CODE_AUTH_STATUS_ARGS, CLAUDE_CODE_CHECK_TIMEOUT_MS, CLAUDE_CODE_EXECUTABLE, CLAUDE_CODE_EXECUTABLE_NOT_FOUND_CODE, CLAUDE_CODE_SESSION_LINK_ENV_VARS, CLAUDE_CODE_VERSION_ARGS, CheckoutFreshnessVerdict, ClaudeCodeReadiness, DEFAULT_LOCAL_LLM_BASE_URL, DEFAULT_PREFERENCES, ELECTRON_APP_EXECUTABLE_PATH_SEGMENTS, ElectronAppPlatform, ElectronAppReleaseStream, HTML_VIEW_OFFER_LINE, LLM_CREDENTIALS_FILE_MODE, LLM_CREDENTIALS_FILE_NAME, LLM_SOURCE_HEADER, LLM_SOURCE_OPTIONS, LLM_SOURCE_OWNED_ENV_NAMES, LLM_SOURCE_PROMPT, LLM_SOURCE_SCOPE_NOTE, LlmSource, MASKED_API_KEY_PREFIX, MASKED_API_KEY_VISIBLE_CHARS, MAX_LISTED_INHERITED_COMMITS, ONBOARDING_BLANKET_OPTIONS, ONBOARDING_CHOICE_GROUPS, ONBOARDING_MAX_OFFERS, ONBOARDING_PRIMER_BULLETS, ONBOARDING_PRIMER_HEADLINE, ONBOARDING_TOGGLE_GROUPS, ONBOARDING_TOGGLE_PROMPT, ONBOARDING_UNSELECTED_TOGGLE_VALUE, OnboardingBlanketChoice, OnboardingGroupKind, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RUN_SESSIONS_DIR_NAME, RUN_VIEW_DASHBOARD_LINK_LABEL, RunViewError, RuntimeTarget, SCREENSHOT_DIR_RELATIVE_PATH, SCREENSHOT_FILE_EXTENSION, StackCheckVerdict, StackClaimVerdict, StackMismatchKind, StackPortAction, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, applyLlmSourceSelection, applyOnboardingAnswers, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppDirName, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, buildLlmSourcePlan, buildOnboardingPlan, buildToolInputJsonSchema, calculateFileChecksum, checkServiceStack, claimServiceStack, completeOnboarding, createApiKeyWithToken, createChildLogger, decideStackClaim, decideStackReap, decideStackRelease, decideStackRunEnd, decideStackRunStart, deleteApiKeyData, deleteCredentials, describeLlmSourceStatus, describeStackMismatch, e2e_exports as e2e, evaluateCheckoutFreshness, findVacatedNeeds, finishStackRun, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDashboardBaseUrl, getDataDir2 as getDataDir, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppSignedFromVersion, getElectronAppVersion, getElectronAppVersionSource, getLlmSourceOption, getLocalQaTools, getLogger, getOnboardingToggleKeys, getPlatformKey, getQaTools, getReleaseSignerIdentityUri, getRunSessionsDir, getValidApiKeyData, getValidCredentials, hasApiKey, isElectronAppInstalled, isElectronAppPlatform, isFirstRun, isValidLocalBaseUrl, loadApiKeyData, loadCredentials, local_exports as localQa, markOnboardingCompleted, maskLlmApiKey, mcp_exports as mcp, needsConflict, needsOnboarding, openBrowserUrl, parseElectronAppDirName, performLogin, performLogout, pollDeviceCode, portOfUrl, e2e_exports as qa, readPreferencesMetadata, readRunView, readServiceStackStatus, reapServiceStack, reconcileProjectPreferences, recordOnboardingSkip, releaseServiceStack, renderRunViewHtml, renderRunViewText, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveBlanketPreferences, resolveElectronAppExecutablePath, resolveElectronAppPathOrNull, resolveLlmSourceStatus, resolveOnboardingAnswers, resolvePreferences, resolveRunSessionPath, resolveRuntimeTarget, resolveTogglePreferences, runGitCommand, saveApiKey, saveApiKeyData, saveCredentials, startDeviceCodeFlow, startStackRun, stopVacatedServices, toDisplayRef, toolRequiresAuth, validatePreference, verifyFileChecksum, writeLlmEnvBlock, writePreferences, writePreferencesWithMetadata, writeRunViewHtml } from './chunk-6BAB7IVG.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@muggleai/works",
   "mcpName": "io.github.multiplex-ai/muggle",
-  "version": "5.27.0-staging.245",
+  "version": "5.27.0-staging.246",
   "description": "13 years of Microsoft hyperscale engineering, packaged as a harness for your AI coding agent.",
   "type": "module",
   "main": "dist/index.js",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muggle",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.27.0-staging.245",
+  "version": "5.27.0-staging.246",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/plugin/.codex-mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.27.0-staging.245",
+        "@muggleai/works@5.27.0-staging.246",
         "serve"
       ],
       "env": {

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muggle",
-  "version": "5.27.0-staging.245",
+  "version": "5.27.0-staging.246",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
   "author": {
     "name": "Muggle AI",

package/plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "muggle",
   "displayName": "Muggle AI",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.27.0-staging.245",
+  "version": "5.27.0-staging.246",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/plugin/.mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.27.0-staging.245",
+        "@muggleai/works@5.27.0-staging.246",
         "serve"
       ]
     }

package/plugin/skills/do/e2e-repair.md

@@ -54,6 +54,8 @@ Map each bucket to exactly one disposition. Buckets are defined in [`../_shared/
 
 A `repair` disposition requires a named defect: the failing step, expected-versus-actual, and the code path it implicates. Without one it is `ask`, whatever the bucket said.
 
+**A failure the diff cannot explain may predate it.** When a `product-defect` or `product-uxux` failure names no code path the diff touched, replay the same test case against a checkout of the base before repairing anything: a worktree at the base tip's full SHA, with its own stack claim and services, under the same runSettings record. If that run fails the same way, its disposition is `baseline` — the defect is on the base, not this change's to fix — and the entry carries that run's id as `baselineRunId` into the walkthrough report ([`../muggle-pr-visual-walkthrough/e2e-report-assembly.md`](../muggle-pr-visual-walkthrough/e2e-report-assembly.md)). If it passes, the change caused the failure and the original disposition stands. A `baseline` entry is never re-run or waived; when every remaining failure is `baseline`, the loop clears.
+
 An Inconclusive entry Stage 6 recorded as `prerequisites unmet` never executed. It carries no bucket and none may be derived from it — there is no run to read. Its disposition is `ask`, and the question names the missing prerequisite: what failed is the project's test-plan chain, not the diff.
 
 An Inconclusive entry Stage 6 recorded as `primary failed` never executed either: it is a record held back by its test case's failed primary. It takes no disposition of its own; the primary's entry is the one repaired, and re-running the test case runs it again.

package/plugin/skills/muggle-pr-visual-walkthrough/e2e-report-assembly.md

@@ -30,6 +30,7 @@ For each result:
 2. `viewUrl` — from the run result (deep-links to the specific run).
 3. `status` — from `muggle-local-run-result-get`.
 4. If failed: also capture `failureStepIndex`, `error`, `artifactsDir` from the run result.
+5. If the caller hands over a `baselineRunId` for a failed entry — a run of the same test case against the base that failed too — set it on the entry. `build-pr-section` credits it only after checking the run itself: same test case, failed, same runSettings record, and a stack that served a base commit between the PR's fork point and the base tip. A credited failure reads "also fails on base" and stops holding the walkthrough check red; a refused one is named on stderr and stays a plain failure. Pass `--base <branch>` when the PR does not target the remote's default branch.
 
 ## Last-resort: no cloud refs on the run result