@mutmutco/claude-plugin 4.5.173 → 4.5.175

package/cli/dist/main.cjs

@@ -13366,6 +13366,234 @@ function findDuplicateLesson(source, openLessons) {
 // src/board-doctor-config.ts
 init_github_client();
 
+// src/sub-issue.ts
+init_error_codes();
+init_github_quota();
+function buildResolveIdArgs(ref) {
+  const args = ["issue", "view", String(ref.number), "--json", "id", "--jq", ".id"];
+  if (ref.repo) args.push("--repo", ref.repo);
+  return args;
+}
+function buildAddSubIssueArgs(parentId, subIssueId) {
+  if (!parentId) throw new Error("addSubIssue: parentId is required");
+  if (!subIssueId) throw new Error("addSubIssue: subIssueId is required");
+  return [
+    "api",
+    "graphql",
+    "-f",
+    "query=mutation($p:ID!,$c:ID!){addSubIssue(input:{issueId:$p,subIssueId:$c}){issue{number subIssues{totalCount}} subIssue{number}}}",
+    "-f",
+    `p=${parentId}`,
+    "-f",
+    `c=${subIssueId}`
+  ];
+}
+function parseAddSubIssueResult(stdout) {
+  try {
+    const issue = JSON.parse(stdout)?.data?.addSubIssue;
+    const parentNumber = issue?.issue?.number;
+    const subIssueNumber = issue?.subIssue?.number;
+    const totalCount = issue?.issue?.subIssues?.totalCount;
+    if (typeof parentNumber !== "number" || typeof subIssueNumber !== "number") return void 0;
+    return { parentNumber, subIssueNumber, totalCount: typeof totalCount === "number" ? totalCount : 0 };
+  } catch {
+    return void 0;
+  }
+}
+var RESOLVE_ID_TIMEOUT_MS = 1e4;
+async function resolveIssueNodeId(runGh, ref, fallbackRepo) {
+  const resolved = ref.repo ? ref : { ...ref, repo: fallbackRepo };
+  const id = (await runGh(buildResolveIdArgs(resolved), RESOLVE_ID_TIMEOUT_MS)).trim();
+  if (!id) throw new Error(`could not resolve node id for issue #${ref.number}${resolved.repo ? ` in ${resolved.repo}` : ""}`);
+  return id;
+}
+var SubIssueRestFallbackError = class extends Error {
+  constructor(message2, reason) {
+    super(message2);
+    this.reason = reason;
+    this.name = "SubIssueRestFallbackError";
+  }
+  reason;
+};
+async function linkSubIssue(runGh, parentRef, childRef, defaultRepo) {
+  const parent = parseIssueRef(parentRef);
+  const child2 = parseIssueRef(childRef);
+  try {
+    const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
+    const subIssueId = await resolveIssueNodeId(runGh, child2, defaultRepo);
+    const stdout = await runGh(buildAddSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
+    const result = parseAddSubIssueResult(stdout);
+    if (!result) throw new Error(`addSubIssue returned an unexpected response:
+${stdout.trim() || "(empty)"}`);
+    return result;
+  } catch (graphqlError) {
+    if (!isRateLimitRefusal(graphqlError)) throw graphqlError;
+    const parentRepo = parent.repo ?? defaultRepo;
+    const childRepo = child2.repo ?? defaultRepo;
+    if (!parentRepo || !childRepo) throw graphqlError;
+    try {
+      const childPath = `repos/${childRepo}/issues/${child2.number}`;
+      const childIssue = JSON.parse(await runGh(["api", childPath], RESOLVE_ID_TIMEOUT_MS));
+      if (!Number.isSafeInteger(childIssue.id) || !childIssue.id) throw new Error(`REST issue ${childRepo}#${child2.number} has no numeric id`);
+      await runGh([
+        "api",
+        "-X",
+        "POST",
+        `repos/${parentRepo}/issues/${parent.number}/sub_issues`,
+        "-F",
+        `sub_issue_id=${childIssue.id}`
+      ], GH_MUTATION_TIMEOUT_MS);
+      const confirmed = JSON.parse(await runGh(["api", childPath], RESOLVE_ID_TIMEOUT_MS));
+      const actual = resolveParentField(confirmed);
+      if (!("parent" in actual) || !actual.parent || actual.parent.repo.toLowerCase() !== parentRepo.toLowerCase() || actual.parent.number !== parent.number) {
+        throw new Error(`REST link not verified for ${childRepo}#${child2.number}: ${"parentReadError" in actual ? actual.parentReadError : "parent differs or is absent"}`);
+      }
+      let totalCount = 0;
+      try {
+        const parentIssue = JSON.parse(await runGh(["api", `repos/${parentRepo}/issues/${parent.number}`], RESOLVE_ID_TIMEOUT_MS));
+        if (typeof parentIssue.sub_issues_summary?.total === "number") totalCount = parentIssue.sub_issues_summary.total;
+      } catch {
+      }
+      return { parentNumber: parent.number, subIssueNumber: child2.number, totalCount };
+    } catch (restError) {
+      const err = restError;
+      const detail = (err.stderr || err.message || String(restError)).trim();
+      throw new SubIssueRestFallbackError(
+        `GraphQL link rate-limited; REST link not verified: ${detail}`,
+        isRateLimitRefusal(restError) ? "rate_limited" : "failed"
+      );
+    }
+  }
+}
+function buildRemoveSubIssueArgs(parentId, subIssueId) {
+  if (!parentId) throw new Error("removeSubIssue: parentId is required");
+  if (!subIssueId) throw new Error("removeSubIssue: subIssueId is required");
+  return [
+    "api",
+    "graphql",
+    "-f",
+    "query=mutation($p:ID!,$c:ID!){removeSubIssue(input:{issueId:$p,subIssueId:$c}){issue{number subIssues{totalCount}} subIssue{number}}}",
+    "-f",
+    `p=${parentId}`,
+    "-f",
+    `c=${subIssueId}`
+  ];
+}
+function parseRemoveSubIssueResult(stdout) {
+  try {
+    const issue = JSON.parse(stdout)?.data?.removeSubIssue;
+    const parentNumber = issue?.issue?.number;
+    const subIssueNumber = issue?.subIssue?.number;
+    const totalCount = issue?.issue?.subIssues?.totalCount;
+    if (typeof parentNumber !== "number" || typeof subIssueNumber !== "number") return void 0;
+    return { parentNumber, subIssueNumber, totalCount: typeof totalCount === "number" ? totalCount : 0 };
+  } catch {
+    return void 0;
+  }
+}
+async function unlinkSubIssue(runGh, parentRef, childRef, defaultRepo) {
+  const parent = parseIssueRef(parentRef);
+  const child2 = parseIssueRef(childRef);
+  const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
+  const subIssueId = await resolveIssueNodeId(runGh, child2, defaultRepo);
+  const stdout = await runGh(buildRemoveSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
+  const result = parseRemoveSubIssueResult(stdout);
+  if (!result) throw new Error(`removeSubIssue returned an unexpected response:
+${stdout.trim() || "(empty)"}`);
+  return result;
+}
+function parseParentIssueUrl(apiUrl) {
+  if (typeof apiUrl !== "string" || !apiUrl.trim()) return null;
+  const match = /\/repos\/([^/]+\/[^/]+)\/issues\/(\d+)\/?$/.exec(apiUrl.trim());
+  if (!match) return null;
+  const [, repo, number] = match;
+  return { repo, number: Number(number), url: `https://github.com/${repo}/issues/${number}` };
+}
+function resolveParentField(payload) {
+  if (!payload || typeof payload !== "object") {
+    return { parentReadError: "issue payload was empty or not an object" };
+  }
+  if (!("sub_issues_summary" in payload)) {
+    return { parentReadError: "issue payload carries no sub-issue fields \u2014 parent state is unknown, not absent" };
+  }
+  const raw = payload.parent_issue_url;
+  if (raw === void 0 || raw === null) return { parent: null };
+  const parsed = typeof raw === "string" ? parseParentIssueUrl(raw) : null;
+  return parsed ? { parent: parsed } : { parentReadError: `unrecognised parent_issue_url: ${JSON.stringify(raw)}` };
+}
+async function readIssueParent(runGh, repo, number) {
+  try {
+    const stdout = await runGh(["api", `repos/${repo}/issues/${number}`], RESOLVE_ID_TIMEOUT_MS);
+    const resolved = resolveParentField(JSON.parse(stdout));
+    return "parent" in resolved ? resolved.parent : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isParentConflictMessage(text) {
+  return typeof text === "string" && /sub[- ]?issue may only have one parent/i.test(text);
+}
+function buildReparentConflictPayload(input) {
+  const { childRepo, childNumber, requestedParent, currentParent, offendingFlag } = input;
+  const child2 = `${childRepo}#${childNumber}`;
+  const payload = { code: ERROR_CODES.ERR_STATE_CONFLICT };
+  if (offendingFlag) payload.offending_flag = offendingFlag;
+  if (!currentParent) {
+    return {
+      message: currentParent === null ? `${child2} cannot be reparented under ${requestedParent} \u2014 GitHub refused it under the one-parent rule, but reading the issue back showed no parent at all. Something changed it concurrently; re-read with \`mmi-cli oracle issue view ${childNumber} --repo ${childRepo}\` and retry` : `${child2} cannot be reparented under ${requestedParent} \u2014 GitHub allows a sub-issue exactly one parent and it already has one. Its current parent could not be read; check with \`mmi-cli oracle issue view ${childNumber} --repo ${childRepo}\``,
+      payload
+    };
+  }
+  const current = `${currentParent.repo}#${currentParent.number}`;
+  const sameRepo2 = currentParent.repo.toLowerCase() === childRepo.toLowerCase();
+  const repoFlag = ` --repo ${childRepo}`;
+  payload.current_parent = current;
+  const requested = parseIssueRef(requestedParent);
+  const alreadyThere = currentParent.number === requested.number && (requested.repo ?? childRepo).toLowerCase() === currentParent.repo.toLowerCase();
+  if (!alreadyThere) {
+    payload.corrected_command = `mmi-cli oracle issue unlink-child ${sameRepo2 ? String(currentParent.number) : current} ${childNumber}${repoFlag} && mmi-cli oracle issue edit ${childNumber}${repoFlag} --parent ${requestedParent}`;
+  }
+  return {
+    message: alreadyThere ? `${child2} is already a sub-issue of ${current} \u2014 GitHub allows a sub-issue exactly one parent, so this reparent is a no-op it refuses rather than performs; nothing to do` : `${child2} already has a parent (${current}) \u2014 GitHub allows a sub-issue exactly one parent. Reparenting it under ${requestedParent} would REMOVE it from ${current}; unlink it there first if that is what you want`,
+    payload
+  };
+}
+async function classifyReparentFailure(e, runGh, childRepo, childNumber, requestedParent, offendingFlag) {
+  const err = e;
+  if (!isParentConflictMessage((err.stderr || err.message || String(e)).trim())) return void 0;
+  const currentParent = await readIssueParent(runGh, childRepo, childNumber);
+  return buildReparentConflictPayload({ childRepo, childNumber, requestedParent, currentParent, offendingFlag });
+}
+function parentLinkFields(result, error, parentRef, childRef, reason = "failed") {
+  if (result) return { parent: result, parentLink: "linked" };
+  if (parentRef !== void 0 && childRef) return {
+    parentLink: reason,
+    parentLinkError: error ?? "parent link was not verified",
+    parentLinkRecovery: `mmi-cli oracle issue link-child ${parentRef} ${childRef}`
+  };
+  return {};
+}
+
+// src/issue-comment.ts
+async function postIssueComment(client, input) {
+  const parsed = parseIssueRef(input.ref);
+  const repo = parsed.repo ?? input.defaultRepo;
+  if (!repo) throw new Error("could not resolve repo \u2014 pass --repo owner/repo");
+  if (input.body.trim().length === 0) throw new Error("comment body is empty");
+  const comment = await client.rest(
+    "POST",
+    `repos/${repo}/issues/${parsed.number}/comments`,
+    { body: { body: input.body } }
+  );
+  if (!comment?.html_url) throw new Error("GitHub did not return a comment URL");
+  return {
+    number: parsed.number,
+    repo,
+    url: `https://github.com/${repo}/issues/${parsed.number}`,
+    commentUrl: comment.html_url
+  };
+}
+
 // ../infra/board-vocab.mjs
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
@@ -13468,17 +13696,55 @@ async function boardDoctor(options, deps = {}) {
   if (claimedItems.length > 0) {
     let next = 0;
     const fetchOpenPulls = openPullsFetcher(client);
+    const actor = deps.session ?? describeSessionIdentity();
     const livenessWorker = async () => {
       while (next < claimedItems.length) {
         const item = claimedItems[next++];
         const evidence = await gatherClaimLiveness(client, item.repository, item.number, fetchOpenPulls);
+        const holderProvenDead = Boolean(
+          evidence.marker && evidence.sessionState === "dead" && isHostSessionId(evidence.marker.session) && !evidence.openPr && !evidence.branch
+        );
         const freshMarker = evidence.sessionState === "live" || evidence.sessionState !== "dead" && evidence.markerAgeMs !== void 0 && evidence.markerAgeMs < CLAIM_MARKER_LIVE_MS;
         const bits = [
           evidence.marker ? `claim marker ${describeClaimMarker(evidence.marker)} ${formatClaimAge(evidence.markerAgeMs)} old` + (evidence.sessionState ? `; local session ${evidence.sessionState}` : "") : evidence.failed.includes("comments") ? "claim marker unreadable" : "no claim marker",
           evidence.openPr,
           evidence.branch ? `branch ${evidence.branch}` : void 0
         ].filter((bit) => Boolean(bit)).join("; ");
-        if (freshMarker || evidence.openPr || evidence.branch) {
+        if (holderProvenDead && evidence.marker) {
+          const holder = describeClaimMarker(evidence.marker);
+          try {
+            await client.rest("DELETE", `repos/${item.repository}/issues/${item.number}/assignees`, {
+              body: { assignees: item.assignees }
+            });
+            try {
+              const release = {
+                v: 1,
+                session: actor.session,
+                surface: actor.surface,
+                host: actor.host,
+                ts: (/* @__PURE__ */ new Date()).toISOString()
+              };
+              await postIssueComment(client, { ref: item.ref, body: renderClaimReleaseBody(release) });
+            } catch (e) {
+              process.stderr.write(`warning: ${item.ref} was unclaimed by board doctor, but recording the release marker comment failed: ${ghError(e)}
+`);
+            }
+            await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.statusFieldId, cfg.statusOptions["Todo"]);
+            append(
+              "possibly-abandoned-claim",
+              { ...item, assignees: [], status: "Todo", statusOptionId: cfg.statusOptions["Todo"] },
+              `${item.ref}: auto-released proven-dead claim holder ${holder} -> Todo (${bits})`
+            );
+            result.fixed += 1;
+          } catch (e) {
+            append(
+              "possibly-abandoned-claim",
+              item,
+              `${item.ref}: proven-dead claim holder ${holder} auto-release failed (${ghError(e)}); ${bits}`
+            );
+            result.failed += 1;
+          }
+        } else if (freshMarker || evidence.openPr || evidence.branch) {
           liveClaims.push({ type: "live-claim", item, detail: `${item.ref}: live \u2014 ${bits}` });
         } else if (evidence.failed.length > 0) {
           liveClaims.push({
@@ -14161,7 +14427,11 @@ async function readBoard(options, deps = {}) {
   }
   const readComments = claimMarkerCommentsReader(client);
   for (const scope of ["primary", "secondary"]) {
-    await markStaleClaimStamps(report[scope], readComments, { pullRequests, writable: writableOrUnknown(writable) });
+    await markStaleClaimStamps(report[scope], readComments, {
+      viewerLogin: report.viewer,
+      pullRequests,
+      writable: writableOrUnknown(writable)
+    });
   }
   for (const scope of ["primary", "secondary"]) {
     const filtered = await filterDependencyBlockedClaimables(report[scope].claimable, client, {
@@ -14171,7 +14441,10 @@ async function readBoard(options, deps = {}) {
     report.warnings.push(...filtered.warnings);
   }
   for (const scope of ["primary", "secondary"]) {
-    const demoted = await demoteLiveClaimedClaimables(report[scope], client, void 0, { fetchComments: readComments });
+    const demoted = await demoteLiveClaimedClaimables(report[scope], client, void 0, {
+      fetchComments: readComments,
+      viewerLogin: report.viewer
+    });
     report.warnings.push(...demoted.warnings);
     report.partial = report.partial || demoted.partial;
   }
@@ -14695,11 +14968,22 @@ function claimFromMarker(item, marker, linked = {}, now = Date.now()) {
     ...claimStampStaleness(marker, { activityAt: [...linked.activityAt ?? []], linkedWork: linked.linkedWork }, now)
   };
 }
-function classifyClaimableMarker(comments, actor, now = Date.now(), activityAt = []) {
+function latestClaimMarkerAuthor(comments) {
+  if (!latestClaimMarker(comments)) return void 0;
+  for (let i = comments.length - 1; i >= 0; i -= 1) {
+    if (latestClaimMarker([comments[i]])) {
+      return comments[i].author || comments[i].login || comments[i].user?.login || void 0;
+    }
+  }
+  return void 0;
+}
+function classifyClaimableMarker(comments, actor, now = Date.now(), activityAt = [], viewerLogin) {
   const marker = comments ? latestClaimMarker(comments) : void 0;
   if (!marker) return { verdict: "claimable" };
-  const ownership = laneOwnership(marker, actor);
-  if (ownership === "mine") return { verdict: "owned", holder: describeClaimMarker(marker) };
+  const markerBy = comments ? latestClaimMarkerAuthor(comments) : void 0;
+  if (isSeatClaimMarker(marker, actor, { viewerLogin: viewerLogin ?? markerBy, markerBy, now })) {
+    return { verdict: "owned", holder: describeClaimMarker(marker) };
+  }
   if (!claimStampStaleness(marker, { activityAt }, now).stale) {
     return { verdict: "taken", holder: describeClaimMarker(marker) };
   }
@@ -14714,7 +14998,10 @@ function claimMarkerCommentsReader(client) {
         if (item.detailsUnavailable) return void 0;
         if (item.details && !item.details.commentsUnread && !item.details.omittedComments) return item.details.comments;
         const comments = await client.restPaginate(`repos/${item.repository}/issues/${item.number}/comments`);
-        return comments.map((comment) => ({ body: comment.body ?? "" }));
+        return comments.map((comment) => ({
+          body: comment.body ?? "",
+          ...comment.user?.login ? { author: comment.user.login } : {}
+        }));
       })();
       cache.set(item, read);
     }
@@ -14725,6 +15012,7 @@ async function markStaleClaimStamps(scope, readComments, options = {}) {
   const actor = options.actor ?? describeSessionIdentity();
   const now = options.now ?? Date.now();
   const promoted = [];
+  const adoptedOwned = [];
   const buckets = ["userOwned", "claimable", "unownedInFlight", "taken"];
   const issues = buckets.flatMap((bucket) => scope[bucket]).filter((item) => item.contentType === "Issue");
   const read = /* @__PURE__ */ new Map();
@@ -14744,19 +15032,35 @@ async function markStaleClaimStamps(scope, readComments, options = {}) {
       const comments = read.get(item);
       const marker = comments ? latestClaimMarker(comments) : void 0;
       if (!marker) continue;
+      const markerBy = comments ? latestClaimMarkerAuthor(comments) : void 0;
+      const effectiveViewer = options.viewerLogin ?? (bucket === "userOwned" ? item.assignees[0] : markerBy);
+      const ownSeat = isSeatClaimMarker(marker, actor, {
+        viewerLogin: effectiveViewer,
+        markerBy: markerBy ?? (bucket === "userOwned" ? item.assignees[0] : void 0),
+        now
+      });
       const prs = (options.pullRequests ?? []).filter((pr) => pr.closesIssues.some((ref) => ref.toLowerCase() === item.ref.toLowerCase()));
       item.claim = claimFromMarker(item, marker, {
         activityAt: prs.map((pr) => pr.updatedAt),
         linkedWork: prs.some((pr) => !pr.updatedAt)
       }, now);
+      if (ownSeat && bucket !== "userOwned" && bucket !== "claimable") {
+        kept.pop();
+        adoptedOwned.push(item);
+        continue;
+      }
       const movable = bucket === "userOwned" || bucket === "unownedInFlight";
-      if (movable && item.claim.stale && laneOwnership(marker, actor) !== "mine" && (!options.writable || options.writable.has(item.repository.toLowerCase()))) {
+      if (movable && item.claim.stale && !ownSeat && (!options.writable || options.writable.has(item.repository.toLowerCase()))) {
         kept.pop();
         promoted.push(item);
       }
     }
     scope[bucket] = kept;
   }
+  if (adoptedOwned.length) {
+    scope.userOwned.push(...adoptedOwned);
+    scope.userOwned.sort(compareItems);
+  }
   if (promoted.length) {
     scope.claimable.push(...promoted);
     scope.claimable.sort(compareItems);
@@ -14785,7 +15089,7 @@ async function demoteLiveClaimedClaimables(scope, client, actor = describeSessio
       warnings.push(`${item.ref} left claimable: claim-marker evidence could not be read`);
       continue;
     }
-    const verdict = classifyClaimableMarker(comments, actor, deps.now);
+    const verdict = classifyClaimableMarker(comments, actor, deps.now, [], deps.viewerLogin);
     if (verdict.verdict === "claimable") {
       stillClaimable.push(item);
     } else if (verdict.verdict === "owned") {
@@ -14811,7 +15115,7 @@ var CLAIM_SESSION_ACTIVITY_MS = 30 * 6e4;
 var CLAIM_SESSION_PROBE_CACHE_MS = 6e4;
 var claimSessionProbeCache = /* @__PURE__ */ new Map();
 function probeLocalClaimSession(marker, now = Date.now()) {
-  if (!marker.session || !marker.host || marker.host.toLowerCase() !== (0, import_node_os11.hostname)().toLowerCase()) return void 0;
+  if (!isHostSessionId(marker.session) || !marker.host || marker.host.toLowerCase() !== (0, import_node_os11.hostname)().toLowerCase()) return void 0;
   if (!marker.surface?.toLowerCase().startsWith("claude")) return void 0;
   const cacheKey = `${marker.host.toLowerCase()}/${marker.session}`;
   const cached = claimSessionProbeCache.get(cacheKey);
@@ -14989,8 +15293,19 @@ function laneOwnership(marker, current) {
   }
   return "unknown";
 }
+function isSeatClaimMarker(marker, current, context = {}) {
+  if (!marker) return false;
+  if (laneOwnership(marker, current) === "mine") return true;
+  if (!context.viewerLogin || !context.markerBy) return false;
+  if (context.markerBy.toLowerCase() !== context.viewerLogin.toLowerCase()) return false;
+  if (!sameClaimHost(marker.host, current.host)) return false;
+  if (!marker.surface || !current.surface || marker.surface !== current.surface) return false;
+  if (!isHostSessionId(marker.session)) return false;
+  const state = context.sessionState ?? probeLocalClaimSession(marker, context.now);
+  return state === "dead";
+}
 function laneResumeEvidence(evidence) {
-  if (!evidence.marker || evidence.sessionState !== "dead" || evidence.failed.length > 0) return void 0;
+  if (!evidence.marker || evidence.sessionState !== "dead") return void 0;
   if (!isHostSessionId(evidence.marker.session)) return void 0;
   const artifacts = [evidence.openPr, evidence.branch ? `live branch ${evidence.branch}` : void 0].filter(Boolean);
   return `prior claim by lane ${describeClaimMarker(evidence.marker)} (@${evidence.markerBy}, ${formatClaimAge(evidence.markerAgeMs)} old) is verifiably not running on this host \u2014 its local session transcript is gone or stale${artifacts.length ? `; resuming over ${artifacts.join("; ")}` : ""}`;
@@ -15002,13 +15317,17 @@ async function checkLaneContest(client, item, actor = describeSessionIdentity(),
     evidence = await gatherClaimLiveness(livenessClient, item.repository, item.number, openPullsFetcher(livenessClient));
   }
   const ownership = laneOwnership(evidence.marker, actor);
-  const sameOwner = Boolean(viewerLogin && evidence.markerBy && evidence.markerBy.toLowerCase() === viewerLogin.toLowerCase());
-  const resume = ownership !== "mine" && sameOwner ? laneResumeEvidence(evidence) : void 0;
-  const live = ownership === "mine" ? [] : liveEvidenceLines(evidence, item.repository);
-  const unverifiable = ownership === "mine" ? [] : evidence.failed;
-  const contested = ownership !== "mine" && !resume && (live.length > 0 || unverifiable.length > 0);
+  const ownSeat = isSeatClaimMarker(evidence.marker, actor, {
+    viewerLogin,
+    markerBy: evidence.markerBy,
+    sessionState: evidence.sessionState
+  });
+  const resume = ownership !== "mine" && ownSeat ? laneResumeEvidence(evidence) : void 0;
+  const live = ownSeat ? [] : liveEvidenceLines(evidence, item.repository);
+  const unverifiable = ownSeat ? [] : evidence.failed;
+  const contested = !ownSeat && !resume && (live.length > 0 || unverifiable.length > 0);
   const carry = staleWorkLines(evidence);
-  const staleStamp = !contested && !resume && ownership !== "mine" && evidence.marker ? `stale claim stamp ${describeClaimMarker(evidence.marker)} (idle ${formatClaimAge(claimStampStaleness(evidence.marker, { activityAt: [evidence.lastCommentAt] }).idleMs)})${carry.length ? `; continue its ${carry.join(" and ")}` : ""}` : void 0;
+  const staleStamp = !contested && !resume && !ownSeat && evidence.marker ? `stale claim stamp ${describeClaimMarker(evidence.marker)} (idle ${formatClaimAge(claimStampStaleness(evidence.marker, { activityAt: [evidence.lastCommentAt] }).idleMs)})${carry.length ? `; continue its ${carry.join(" and ")}` : ""}` : void 0;
   return {
     contested,
     live,
@@ -15043,236 +15362,6 @@ function ghError(e) {
 // src/board-claim-move.ts
 init_github_client();
 init_github_quota();
-
-// src/sub-issue.ts
-init_error_codes();
-init_github_quota();
-function buildResolveIdArgs(ref) {
-  const args = ["issue", "view", String(ref.number), "--json", "id", "--jq", ".id"];
-  if (ref.repo) args.push("--repo", ref.repo);
-  return args;
-}
-function buildAddSubIssueArgs(parentId, subIssueId) {
-  if (!parentId) throw new Error("addSubIssue: parentId is required");
-  if (!subIssueId) throw new Error("addSubIssue: subIssueId is required");
-  return [
-    "api",
-    "graphql",
-    "-f",
-    "query=mutation($p:ID!,$c:ID!){addSubIssue(input:{issueId:$p,subIssueId:$c}){issue{number subIssues{totalCount}} subIssue{number}}}",
-    "-f",
-    `p=${parentId}`,
-    "-f",
-    `c=${subIssueId}`
-  ];
-}
-function parseAddSubIssueResult(stdout) {
-  try {
-    const issue = JSON.parse(stdout)?.data?.addSubIssue;
-    const parentNumber = issue?.issue?.number;
-    const subIssueNumber = issue?.subIssue?.number;
-    const totalCount = issue?.issue?.subIssues?.totalCount;
-    if (typeof parentNumber !== "number" || typeof subIssueNumber !== "number") return void 0;
-    return { parentNumber, subIssueNumber, totalCount: typeof totalCount === "number" ? totalCount : 0 };
-  } catch {
-    return void 0;
-  }
-}
-var RESOLVE_ID_TIMEOUT_MS = 1e4;
-async function resolveIssueNodeId(runGh, ref, fallbackRepo) {
-  const resolved = ref.repo ? ref : { ...ref, repo: fallbackRepo };
-  const id = (await runGh(buildResolveIdArgs(resolved), RESOLVE_ID_TIMEOUT_MS)).trim();
-  if (!id) throw new Error(`could not resolve node id for issue #${ref.number}${resolved.repo ? ` in ${resolved.repo}` : ""}`);
-  return id;
-}
-var SubIssueRestFallbackError = class extends Error {
-  constructor(message2, reason) {
-    super(message2);
-    this.reason = reason;
-    this.name = "SubIssueRestFallbackError";
-  }
-  reason;
-};
-async function linkSubIssue(runGh, parentRef, childRef, defaultRepo) {
-  const parent = parseIssueRef(parentRef);
-  const child2 = parseIssueRef(childRef);
-  try {
-    const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
-    const subIssueId = await resolveIssueNodeId(runGh, child2, defaultRepo);
-    const stdout = await runGh(buildAddSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
-    const result = parseAddSubIssueResult(stdout);
-    if (!result) throw new Error(`addSubIssue returned an unexpected response:
-${stdout.trim() || "(empty)"}`);
-    return result;
-  } catch (graphqlError) {
-    if (!isRateLimitRefusal(graphqlError)) throw graphqlError;
-    const parentRepo = parent.repo ?? defaultRepo;
-    const childRepo = child2.repo ?? defaultRepo;
-    if (!parentRepo || !childRepo) throw graphqlError;
-    try {
-      const childPath = `repos/${childRepo}/issues/${child2.number}`;
-      const childIssue = JSON.parse(await runGh(["api", childPath], RESOLVE_ID_TIMEOUT_MS));
-      if (!Number.isSafeInteger(childIssue.id) || !childIssue.id) throw new Error(`REST issue ${childRepo}#${child2.number} has no numeric id`);
-      await runGh([
-        "api",
-        "-X",
-        "POST",
-        `repos/${parentRepo}/issues/${parent.number}/sub_issues`,
-        "-F",
-        `sub_issue_id=${childIssue.id}`
-      ], GH_MUTATION_TIMEOUT_MS);
-      const confirmed = JSON.parse(await runGh(["api", childPath], RESOLVE_ID_TIMEOUT_MS));
-      const actual = resolveParentField(confirmed);
-      if (!("parent" in actual) || !actual.parent || actual.parent.repo.toLowerCase() !== parentRepo.toLowerCase() || actual.parent.number !== parent.number) {
-        throw new Error(`REST link not verified for ${childRepo}#${child2.number}: ${"parentReadError" in actual ? actual.parentReadError : "parent differs or is absent"}`);
-      }
-      let totalCount = 0;
-      try {
-        const parentIssue = JSON.parse(await runGh(["api", `repos/${parentRepo}/issues/${parent.number}`], RESOLVE_ID_TIMEOUT_MS));
-        if (typeof parentIssue.sub_issues_summary?.total === "number") totalCount = parentIssue.sub_issues_summary.total;
-      } catch {
-      }
-      return { parentNumber: parent.number, subIssueNumber: child2.number, totalCount };
-    } catch (restError) {
-      const err = restError;
-      const detail = (err.stderr || err.message || String(restError)).trim();
-      throw new SubIssueRestFallbackError(
-        `GraphQL link rate-limited; REST link not verified: ${detail}`,
-        isRateLimitRefusal(restError) ? "rate_limited" : "failed"
-      );
-    }
-  }
-}
-function buildRemoveSubIssueArgs(parentId, subIssueId) {
-  if (!parentId) throw new Error("removeSubIssue: parentId is required");
-  if (!subIssueId) throw new Error("removeSubIssue: subIssueId is required");
-  return [
-    "api",
-    "graphql",
-    "-f",
-    "query=mutation($p:ID!,$c:ID!){removeSubIssue(input:{issueId:$p,subIssueId:$c}){issue{number subIssues{totalCount}} subIssue{number}}}",
-    "-f",
-    `p=${parentId}`,
-    "-f",
-    `c=${subIssueId}`
-  ];
-}
-function parseRemoveSubIssueResult(stdout) {
-  try {
-    const issue = JSON.parse(stdout)?.data?.removeSubIssue;
-    const parentNumber = issue?.issue?.number;
-    const subIssueNumber = issue?.subIssue?.number;
-    const totalCount = issue?.issue?.subIssues?.totalCount;
-    if (typeof parentNumber !== "number" || typeof subIssueNumber !== "number") return void 0;
-    return { parentNumber, subIssueNumber, totalCount: typeof totalCount === "number" ? totalCount : 0 };
-  } catch {
-    return void 0;
-  }
-}
-async function unlinkSubIssue(runGh, parentRef, childRef, defaultRepo) {
-  const parent = parseIssueRef(parentRef);
-  const child2 = parseIssueRef(childRef);
-  const parentId = await resolveIssueNodeId(runGh, parent, defaultRepo);
-  const subIssueId = await resolveIssueNodeId(runGh, child2, defaultRepo);
-  const stdout = await runGh(buildRemoveSubIssueArgs(parentId, subIssueId), GH_MUTATION_TIMEOUT_MS);
-  const result = parseRemoveSubIssueResult(stdout);
-  if (!result) throw new Error(`removeSubIssue returned an unexpected response:
-${stdout.trim() || "(empty)"}`);
-  return result;
-}
-function parseParentIssueUrl(apiUrl) {
-  if (typeof apiUrl !== "string" || !apiUrl.trim()) return null;
-  const match = /\/repos\/([^/]+\/[^/]+)\/issues\/(\d+)\/?$/.exec(apiUrl.trim());
-  if (!match) return null;
-  const [, repo, number] = match;
-  return { repo, number: Number(number), url: `https://github.com/${repo}/issues/${number}` };
-}
-function resolveParentField(payload) {
-  if (!payload || typeof payload !== "object") {
-    return { parentReadError: "issue payload was empty or not an object" };
-  }
-  if (!("sub_issues_summary" in payload)) {
-    return { parentReadError: "issue payload carries no sub-issue fields \u2014 parent state is unknown, not absent" };
-  }
-  const raw = payload.parent_issue_url;
-  if (raw === void 0 || raw === null) return { parent: null };
-  const parsed = typeof raw === "string" ? parseParentIssueUrl(raw) : null;
-  return parsed ? { parent: parsed } : { parentReadError: `unrecognised parent_issue_url: ${JSON.stringify(raw)}` };
-}
-async function readIssueParent(runGh, repo, number) {
-  try {
-    const stdout = await runGh(["api", `repos/${repo}/issues/${number}`], RESOLVE_ID_TIMEOUT_MS);
-    const resolved = resolveParentField(JSON.parse(stdout));
-    return "parent" in resolved ? resolved.parent : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function isParentConflictMessage(text) {
-  return typeof text === "string" && /sub[- ]?issue may only have one parent/i.test(text);
-}
-function buildReparentConflictPayload(input) {
-  const { childRepo, childNumber, requestedParent, currentParent, offendingFlag } = input;
-  const child2 = `${childRepo}#${childNumber}`;
-  const payload = { code: ERROR_CODES.ERR_STATE_CONFLICT };
-  if (offendingFlag) payload.offending_flag = offendingFlag;
-  if (!currentParent) {
-    return {
-      message: currentParent === null ? `${child2} cannot be reparented under ${requestedParent} \u2014 GitHub refused it under the one-parent rule, but reading the issue back showed no parent at all. Something changed it concurrently; re-read with \`mmi-cli oracle issue view ${childNumber} --repo ${childRepo}\` and retry` : `${child2} cannot be reparented under ${requestedParent} \u2014 GitHub allows a sub-issue exactly one parent and it already has one. Its current parent could not be read; check with \`mmi-cli oracle issue view ${childNumber} --repo ${childRepo}\``,
-      payload
-    };
-  }
-  const current = `${currentParent.repo}#${currentParent.number}`;
-  const sameRepo2 = currentParent.repo.toLowerCase() === childRepo.toLowerCase();
-  const repoFlag = ` --repo ${childRepo}`;
-  payload.current_parent = current;
-  const requested = parseIssueRef(requestedParent);
-  const alreadyThere = currentParent.number === requested.number && (requested.repo ?? childRepo).toLowerCase() === currentParent.repo.toLowerCase();
-  if (!alreadyThere) {
-    payload.corrected_command = `mmi-cli oracle issue unlink-child ${sameRepo2 ? String(currentParent.number) : current} ${childNumber}${repoFlag} && mmi-cli oracle issue edit ${childNumber}${repoFlag} --parent ${requestedParent}`;
-  }
-  return {
-    message: alreadyThere ? `${child2} is already a sub-issue of ${current} \u2014 GitHub allows a sub-issue exactly one parent, so this reparent is a no-op it refuses rather than performs; nothing to do` : `${child2} already has a parent (${current}) \u2014 GitHub allows a sub-issue exactly one parent. Reparenting it under ${requestedParent} would REMOVE it from ${current}; unlink it there first if that is what you want`,
-    payload
-  };
-}
-async function classifyReparentFailure(e, runGh, childRepo, childNumber, requestedParent, offendingFlag) {
-  const err = e;
-  if (!isParentConflictMessage((err.stderr || err.message || String(e)).trim())) return void 0;
-  const currentParent = await readIssueParent(runGh, childRepo, childNumber);
-  return buildReparentConflictPayload({ childRepo, childNumber, requestedParent, currentParent, offendingFlag });
-}
-function parentLinkFields(result, error, parentRef, childRef, reason = "failed") {
-  if (result) return { parent: result, parentLink: "linked" };
-  if (parentRef !== void 0 && childRef) return {
-    parentLink: reason,
-    parentLinkError: error ?? "parent link was not verified",
-    parentLinkRecovery: `mmi-cli oracle issue link-child ${parentRef} ${childRef}`
-  };
-  return {};
-}
-
-// src/issue-comment.ts
-async function postIssueComment(client, input) {
-  const parsed = parseIssueRef(input.ref);
-  const repo = parsed.repo ?? input.defaultRepo;
-  if (!repo) throw new Error("could not resolve repo \u2014 pass --repo owner/repo");
-  if (input.body.trim().length === 0) throw new Error("comment body is empty");
-  const comment = await client.rest(
-    "POST",
-    `repos/${repo}/issues/${parsed.number}/comments`,
-    { body: { body: input.body } }
-  );
-  if (!comment?.html_url) throw new Error("GitHub did not return a comment URL");
-  return {
-    number: parsed.number,
-    repo,
-    url: `https://github.com/${repo}/issues/${parsed.number}`,
-    commentUrl: comment.html_url
-  };
-}
-
-// src/board-claim-move.ts
 var CLAIM_CONCURRENCY = 5;
 function withGatedWriteChainHint(message2) {
   return `${message2}
@@ -15694,7 +15783,7 @@ async function unclaimBoardIssue(options, deps = {}) {
   }
   const toStatus = options.toStatus ?? "Todo";
   if (item.contentType === "Issue") {
-    const contest = await checkLaneContest(client, item);
+    const contest = await checkLaneContest(client, item, deps.session ?? describeSessionIdentity(), viewer);
     if (contest.contested) {
       if (!options.force) {
         throw new Error(withGatedWriteChainHint(laneContestMessage(item.ref, contest, "unclaim")));
@@ -19104,10 +19193,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.173",
-    tag: "v4.5.173",
-    commit: "065efddb8d28",
-    npm: "@mutmutco/cli@4.5.173"
+    version: "4.5.175",
+    tag: "v4.5.175",
+    commit: "8efcf884c10f",
+    npm: "@mutmutco/cli@4.5.175"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19124,14 +19213,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.173"
+          v3Target: "v4.5.175"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.173 and redeploy the Hub Lambda from tag v4.5.173 (065efddb8d28); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.173 (@mutmutco/cli@4.5.173, tag commit 065efddb8d28 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.175 and redeploy the Hub Lambda from tag v4.5.175 (8efcf884c10f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.175 (@mutmutco/cli@4.5.175, tag commit 8efcf884c10f \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -32417,6 +32506,76 @@ async function waitBoardEvents(since, waitS, deps) {
 
 // src/board-commands.ts
 init_github_quota();
+init_github_client();
+
+// src/issue-decision.ts
+var DECISION_KINDS = ["decision", "correction", "approval"];
+var DECISION_SOURCES = ["typed", "ask-user", "relay"];
+var MARKER_PATTERN = /<!--\s*mmi-decision:\s*(\{[\s\S]*?\})\s*-->/g;
+var JSON_GT_ESCAPE = "\\u003e";
+function decisionReminders(m) {
+  const out = [];
+  if (m.via === "relay" && !m.by) out.push("reminder: name the relaying session with --by <endpoint> so readers can trace the relay");
+  if (m.kind === "correction" && !m.learning) out.push("reminder: a correction also gets its learning note (jerv_learning_note); pass it as --learning when you have it");
+  return out;
+}
+function buildDecisionMarker(input) {
+  const kind = input.kind;
+  if (!DECISION_KINDS.includes(kind)) throw new Error(`--kind must be one of: ${DECISION_KINDS.join(", ")}`);
+  const via = input.via;
+  if (!DECISION_SOURCES.includes(via)) throw new Error(`--via must be one of: ${DECISION_SOURCES.join(", ")}`);
+  const quote = (input.quote ?? "").trim();
+  if (!quote) throw new Error("--quote is required: the owner's words verbatim, never a paraphrase");
+  const at = input.at ?? "";
+  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(at) || Number.isNaN(Date.parse(at))) throw new Error("--at must be an ISO time, e.g. 2026-10-17T10:29:00Z");
+  return {
+    v: 1,
+    kind,
+    quote,
+    at: new Date(at).toISOString(),
+    via,
+    ...input.by?.trim() ? { by: input.by.trim() } : {},
+    ...input.learning?.trim() ? { learning: input.learning.trim() } : {}
+  };
+}
+function renderDecisionComment(m) {
+  const source = m.via === "relay" ? `relayed by ${m.by}` : m.via;
+  const quoted = m.quote.split("\n").map((l) => `> ${l}`).join("\n");
+  const json = JSON.stringify(m).replace(/-->/g, `--${JSON_GT_ESCAPE}`);
+  return `**Owner ${m.kind}** (${source}, ${m.at})
+
+${quoted}${m.learning ? `
+
+Learning record: ${m.learning}` : ""}
+
+<!-- mmi-decision: ${json} -->`;
+}
+function parseDecisionMarkers(comments) {
+  const out = [];
+  for (const comment of comments ?? []) {
+    for (const match of (comment.body ?? "").matchAll(MARKER_PATTERN)) {
+      try {
+        const m = JSON.parse(match[1]);
+        if (m.v === 1 && DECISION_KINDS.includes(m.kind) && DECISION_SOURCES.includes(m.via) && typeof m.quote === "string" && typeof m.at === "string") out.push(m);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function formatDecisionLines(ref, markers) {
+  if (!markers.length) return [];
+  return [
+    `Owner rulings on ${ref} (${markers.length}) \u2014 read before acting:`,
+    ...markers.map((m) => `  [${m.kind}] ${m.at} ${m.via === "relay" ? `relay ${m.by}` : m.via}: "${m.quote.replace(/\s+/g, " ")}"${m.learning ? ` (learning ${m.learning})` : ""}`)
+  ];
+}
+async function readIssueDecisions(client, repo, number) {
+  const comments = await client.restPaginate(`repos/${repo}/issues/${number}/comments`);
+  return parseDecisionMarkers(comments);
+}
+
+// src/board-commands.ts
 function refuseRateLimited(e, json) {
   if (!isRateLimitedError(e)) return false;
   if (json) console.log(JSON.stringify(e.receipt));
@@ -32486,6 +32645,13 @@ function registerBoardCommands(program3) {
       else console.log(`Warning: ${warning}`);
     }
   }
+  async function claimDecisions(item) {
+    try {
+      return { decisions: await readIssueDecisions(defaultGitHubClient(), item.repository, item.number) };
+    } catch (e) {
+      return { warning: `owner rulings on ${item.repository}#${item.number} unread (${e.message}) \u2014 run \`mmi-cli oracle issue view ${item.number} --repo ${item.repository} --comments\` before acting` };
+    }
+  }
   function claimVerdict(ref, result) {
     const holder = formatClaimHolder(result.holder);
     const previousHolder = result.staleStamp ?? (result.previousHolder ? formatClaimHolder(result.previousHolder) : "another lane");
@@ -32541,9 +32707,11 @@ function registerBoardCommands(program3) {
           check: o.check,
           allowPartial: o.allowPartial
         }, { snapshot: registryClientDeps(config) });
-        if (o.json) return console.log(JSON.stringify(result));
+        const ruled = await claimDecisions(result.item);
+        if (o.json) return console.log(JSON.stringify({ ...result, ...ruled.decisions ? { decisions: ruled.decisions } : {}, ...ruled.warning ? { warnings: [...result.warnings ?? [], ruled.warning] } : {} }));
         console.log(claimVerdict(result.item.ref, result));
-        printClaimWarnings(result.warnings);
+        for (const line of formatDecisionLines(result.item.ref, ruled.decisions ?? [])) console.log(line);
+        printClaimWarnings([...result.warnings ?? [], ...ruled.warning ? [ruled.warning] : []]);
       } catch (e) {
         if (refuseRateLimited(e, o.json)) return;
         if (refuseNotClaimable(e, o.json)) return;
@@ -32562,14 +32730,17 @@ function registerBoardCommands(program3) {
         check: o.check,
         allowPartial: o.allowPartial
       }, { snapshot: registryClientDeps(config) });
+      const ruled = await Promise.all(bulk.results.map((r) => r.claimed ? claimDecisions(r.item) : Promise.resolve({})));
+      const rulingWarnings = ruled.flatMap((r) => r.warning ? [r.warning] : []);
       if (o.json) {
-        console.log(JSON.stringify(bulk.results));
-        printClaimWarnings(bulk.warnings, true);
+        console.log(JSON.stringify(bulk.results.map((r, i) => ruled[i].decisions ? { ...r, decisions: ruled[i].decisions } : r)));
+        printClaimWarnings([...bulk.warnings ?? [], ...rulingWarnings], true);
       } else {
-        for (const result of bulk.results) {
+        bulk.results.forEach((result, i) => {
           console.log(result.claimed ? claimVerdict(result.ref, result) : `Skipped ${result.ref}: ${result.reason}`);
-        }
-        printClaimWarnings(bulk.warnings);
+          if (result.claimed) for (const line of formatDecisionLines(result.ref, ruled[i].decisions ?? [])) console.log(line);
+        });
+        printClaimWarnings([...bulk.warnings ?? [], ...rulingWarnings]);
       }
       if (bulk.failed > 0) process.exitCode = 1;
     } catch (e) {
@@ -32733,18 +32904,18 @@ function registerBoardCommands(program3) {
         concurrency: Number(o.concurrency) || void 0
       });
       if (o.json) return console.log(JSON.stringify(result));
-      console.log(`board doctor: scanned ${result.scanned}, findings ${result.findings}${o.fix ? `, fixed ${result.fixed}, failed ${result.failed}` : ""}`);
+      console.log(`board doctor: scanned ${result.scanned}, findings ${result.findings}${o.fix || result.fixed || result.failed ? `, fixed ${result.fixed}, failed ${result.failed}` : ""}`);
       for (const finding of result.items) {
         console.log(`  [${finding.type}] ${finding.detail}`);
       }
       for (const claim of result.liveClaims) {
         console.log(`  [${claim.type}] ${claim.detail}`);
       }
-      if (result.findings > 0 && !o.fix) {
+      if (result.findings > result.fixed && !o.fix) {
         console.log("Run `mmi-cli oracle board doctor --fix` to apply automatic fixes.");
         process.exitCode = 1;
       }
-      if (o.fix && result.failed) process.exitCode = 1;
+      if ((o.fix || result.failed) && result.failed) process.exitCode = 1;
     } catch (e) {
       return failGraceful(`board doctor failed: ${e.message}`);
     }
@@ -33210,7 +33381,7 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold", "internalPeers"];
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold", "internalPeers", "previews"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -33600,6 +33771,24 @@ function parseStageAllowlistVar(raw) {
   }
   return { key: row.key, stages: row.stages };
 }
+function parsePreviewsVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: previews must be JSON, e.g. {"seed":"deploy/preview-seed.sh"}');
+  }
+  const shape = "org project set: previews must be { seed, secrets? } \u2014 seed a repo-relative script path (no leading / or ..) and secrets a non-empty array (max 40) of env key names";
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(shape);
+  const row = parsed;
+  const unknown = Object.keys(row).filter((key) => key !== "seed" && key !== "secrets");
+  if (unknown.length > 0) throw new Error(`org project set: previews has unknown field(s): ${unknown.join(", ")}`);
+  const { seed, secrets } = row;
+  if (typeof seed !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$/.test(seed) || seed.includes("..")) throw new Error(shape);
+  if (secrets === void 0) return { seed };
+  if (!Array.isArray(secrets) || secrets.length === 0 || secrets.length > 40 || !secrets.every((k) => typeof k === "string" && /^[A-Z_][A-Z0-9_]*$/.test(k))) throw new Error(shape);
+  return { seed, secrets };
+}
 function parseCiExemptReasonVar(raw) {
   const trimmed = raw.trim();
   if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
@@ -33754,7 +33943,8 @@ var SETTABLE_VAR_KEYS = [
   "installer",
   "notifyOnDeploy",
   "vercelVersionEnv",
-  "stageAllowlist"
+  "stageAllowlist",
+  "previews"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -33786,6 +33976,7 @@ var SETTABLE_VAR_HINTS = {
   notifyOnDeploy: 'JSON stage array, e.g. ["dev"] \u2014 successful tenant-deploy sends <stage>-deployed to the project repo (#7358)',
   vercelVersionEnv: "JSON {project,key,team?} \u2014 train sets this Vercel env to the release tag before the main/rc push (#7362)",
   stageAllowlist: "JSON {key,stages[]} \u2014 `org access sync` writes the developer/admin company-email allowlist to <stage>/<key> for each listed stage (#7678)",
+  previews: "JSON {seed,secrets?} \u2014 per-PR preview contract; absent means previews off; clear with --unset previews (#8405)",
   ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,affectedCmd,workdir,cacheDepPath,pyVersion}"
 };
@@ -33981,6 +34172,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseVercelVersionEnvVar(raw);
     } else if (key === "stageAllowlist") {
       patch[key] = parseStageAllowlistVar(raw);
+    } else if (key === "previews") {
+      patch[key] = parsePreviewsVar(raw);
     } else if (key === "ciExemptReason") {
       patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
@@ -47620,7 +47813,8 @@ function registerCollaborationCommands(program3) {
       if (o.comments || o.context) {
         const boardProjectId = o.context ? await resolveBoardProjectId(o.repo) : void 0;
         const data2 = await runIssueViewContext(queryDeps(), { number: targetNumber, repo: targetRepo2, comments: Boolean(o.comments), context: Boolean(o.context), jsonFields: gh2.ghFields, boardProjectId });
-        return { data: data2, parent: await readParentField(targetNumber, targetRepo2) };
+        const decisions = parseDecisionMarkers(data2.comments);
+        return { data: { ...data2, decisions }, parent: await readParentField(targetNumber, targetRepo2) };
       }
       const data = await ghJson(["issue", "view", String(targetNumber), "--repo", targetRepo2, "--json", gh2.ghFields]);
       return { data, parent: await readParentField(targetNumber, targetRepo2) };
@@ -47733,6 +47927,25 @@ function registerCollaborationCommands(program3) {
       return failGraceful(`issue comment: ${(err.stderr || err.message || String(e)).trim()}`);
     }
   });
+  jsonParity(issue.command("decision <ref>").description("record an owner decision, correction or approval VERBATIM on the issue it governs (machine-readable mmi-decision marker; board claim and issue view --comments show every one) and print {number,repo,url,commentUrl} JSON").requiredOption("--kind <kind>", `one of: ${DECISION_KINDS.join(", ")}`).requiredOption("--quote <text>", "the owner's words verbatim (never a paraphrase)").requiredOption("--at <iso>", "when the owner said it, ISO time (e.g. 2026-10-17T10:29:00Z)").requiredOption("--via <source>", `one of: ${DECISION_SOURCES.join(", ")}`).option("--by <endpoint>", "relaying session, for --via relay").option("--learning <ref>", "learning record id or issue ref, for --kind correction").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
+    let marker;
+    try {
+      parseIssueRef(ref, o.repo);
+      marker = buildDecisionMarker(o);
+    } catch (e) {
+      return fail(`issue decision: ${e.message}`);
+    }
+    const repo = await resolveRepo(parseIssueRef(ref, o.repo).repo ?? o.repo);
+    if (!repo) return fail("issue decision: could not resolve repo \u2014 pass --repo owner/repo");
+    try {
+      console.log(JSON.stringify(await postIssueComment(defaultGitHubClient(), { ref, defaultRepo: repo, body: renderDecisionComment(marker) })));
+      for (const line of decisionReminders(marker)) process.stderr.write(`${line}
+`);
+    } catch (e) {
+      const err = e;
+      return failGraceful(`issue decision: ${(err.stderr || err.message || String(e)).trim()}`);
+    }
+  });
   jsonParity(issue.command("check <ref>").description("tick (or with --off untick) a task-list checkbox in an issue/epic body by its item text and print {number,repo,item,checked,changed} JSON").requiredOption("--item <text>", "the checklist item to match \u2014 exact item text, else a unique substring").option("--off", "untick the item ([x] \u2014 [ ]) instead of ticking it").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
     let parsed;
     try {