@mutmutco/claude-plugin 4.5.209 → 4.5.211

package/cli/dist/main.cjs

@@ -6365,21 +6365,177 @@ function splitInlineSelectors(argv, flags) {
   }
   return out;
 }
+var BOARD_MOVE_OWN_FLAGS = ["--repo", "--allow-partial", "--json"];
+var BOARD_SHOW_OWN_FLAGS = ["--json", "--repo", "--allow-partial", "--out"];
+var BOARD_READ_OWN_FLAGS = [
+  "--json",
+  "--repo",
+  "--direct",
+  "--snapshot-only",
+  "--min-cursor",
+  "--bundle-details",
+  "--bodies",
+  "--allow-partial",
+  "--out"
+];
+var BOARD_OTHER_OWN_FLAGS = {
+  unclaim: ["--json", "--repo", "--to-status", "--force", "--holder-dead", "--allow-partial"],
+  attach: ["--repo", "--json"],
+  "set-priority": ["--json", "--repo"],
+  "archive-done": ["--json", "--repo", "--apply"],
+  doctor: ["--json", "--repo", "--fix", "--concurrency"],
+  events: ["--since", "--wait", "--repo", "--json"]
+};
+var BOARD_TARGET_PLACEHOLDER = {
+  unclaim: "<issue>",
+  attach: "<issues>",
+  "set-priority": "<issue> <priority>"
+};
+var WORKBOARD_VERB_ALIASES = {
+  claim: "claim",
+  move: "move",
+  status: "move",
+  "set-status": "move",
+  show: "show",
+  view: "show",
+  get: "show",
+  read: "read",
+  list: "read",
+  ls: "read",
+  items: "read",
+  unclaim: "unclaim",
+  release: "unclaim",
+  attach: "attach",
+  add: "attach",
+  "set-priority": "set-priority",
+  priority: "set-priority",
+  "archive-done": "archive-done",
+  archive: "archive-done",
+  doctor: "doctor",
+  events: "events"
+};
+var WORKBOARD_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "--status",
+  "--to-status",
+  "--issue",
+  "--number",
+  "--repo",
+  "--for",
+  "--out",
+  "--min-cursor",
+  "--since",
+  "--wait",
+  "--concurrency"
+]);
+var ISSUE_TOKEN = /^(?:\d+|[\w.-]+\/[\w.-]+#\d+|#\d+)$/;
+function scanWorkboardArgs(rest) {
+  const positionals = [];
+  const values = /* @__PURE__ */ new Map();
+  const flags = [];
+  for (let i = 0; i < rest.length; i += 1) {
+    const tok = rest[i];
+    if (!tok.startsWith("-")) {
+      positionals.push(tok);
+      continue;
+    }
+    const eq = tok.startsWith("--") ? tok.indexOf("=") : -1;
+    const name = eq > 0 ? tok.slice(0, eq) : tok;
+    let value;
+    if (eq > 0) value = tok.slice(eq + 1);
+    else if (WORKBOARD_VALUE_FLAGS.has(name) && rest[i + 1] !== void 0 && !rest[i + 1].startsWith("-")) {
+      value = rest[i + 1];
+      i += 1;
+    }
+    if (value !== void 0) values.set(name, [...values.get(name) ?? [], value]);
+    flags.push({ name, tokens: eq > 0 ? [tok] : value !== void 0 ? [name, value] : [name] });
+  }
+  return {
+    positionals,
+    values,
+    flagArgs: (ownFlags) => flags.filter((f) => ownFlags.includes(f.name)).flatMap((f) => f.tokens)
+  };
+}
+var quoteArg = (v) => /\s/.test(v) ? `"${v}"` : v;
 function workboardClaimRecovery(unknownToken, argv, paths, ownFlags = BOARD_CLAIM_OWN_FLAGS) {
   if (unknownToken !== "workboard") return void 0;
   const catalog = [...paths];
-  if (!catalog.includes("oracle board claim") && !catalog.includes("board claim")) return void 0;
-  const tail = unknownCommandTail(argv, "workboard");
-  if (tail[0] !== "claim") return void 0;
-  const canonicalPath = "oracle board claim";
-  const positionals = tail.slice(1);
+  const inCatalog = (sub2) => catalog.includes(`oracle board ${sub2}`) || catalog.includes(`board ${sub2}`);
+  let tail = unknownCommandTail(argv, "workboard");
+  let skip = 0;
+  if ((tail[0] === "item" || tail[0] === "items") && !(tail.length === 1 && tail[0] === "items")) {
+    tail = tail.slice(1);
+    skip = 1;
+  }
+  const verb = tail[0];
+  let sub = verb === void 0 ? "read" : WORKBOARD_VERB_ALIASES[verb] ?? (inCatalog(verb) ? verb : void 0);
+  if (sub === void 0) return void 0;
+  if (sub === "claim") {
+    if (!inCatalog("claim")) return void 0;
+    const canonicalPath2 = "oracle board claim";
+    const positionals = tail.slice(1);
+    let corrected2;
+    if (positionals.length > 0) {
+      corrected2 = [`mmi-cli ${canonicalPath2}`, ...positionals, ...survivingFlagArgs(argv, "", ownFlags)].join(" ");
+    } else {
+      const normalized = splitInlineSelectors(argv, ["--issue", "--number"]);
+      const usedFlag = normalized.includes("--issue") ? "--issue" : normalized.includes("--number") ? "--number" : "--issue";
+      corrected2 = formatPositionalTarget(canonicalPath2, "issues", { flag: usedFlag, argv: normalized, ownFlags });
+    }
+    return { canonicalPath: canonicalPath2, corrected: corrected2, hint: `did you mean \`${corrected2}\`?` };
+  }
+  const verbAt = argv.indexOf("workboard") + 1 + skip;
+  const scan = scanWorkboardArgs(argv.slice(verb === void 0 ? verbAt : verbAt + 1));
+  const issueValues = [...scan.values.get("--issue") ?? [], ...scan.values.get("--number") ?? []];
+  if (sub === "read" && verb !== void 0 && (scan.positionals.length > 0 || issueValues.length > 0)) sub = "show";
+  if (!inCatalog(sub)) return void 0;
+  const canonicalPath = `oracle board ${sub}`;
+  const head = `mmi-cli ${canonicalPath}`;
   let corrected;
-  if (positionals.length > 0) {
-    corrected = [`mmi-cli ${canonicalPath}`, ...positionals, ...survivingFlagArgs(argv, "", ownFlags)].join(" ");
+  if (sub === "move") {
+    const flagStatus = scan.values.get("--status")?.[0] ?? scan.values.get("--to-status")?.[0];
+    let status = flagStatus;
+    let issues = [];
+    const pos = scan.positionals;
+    if (status !== void 0) {
+      issues = pos;
+    } else if (pos.length >= 2) {
+      if (ISSUE_TOKEN.test(pos[0]) && !ISSUE_TOKEN.test(pos[pos.length - 1])) {
+        status = pos[pos.length - 1];
+        issues = pos.slice(0, -1);
+      } else {
+        status = pos[0];
+        issues = pos.slice(1);
+      }
+    } else if (pos.length === 1) {
+      if (ISSUE_TOKEN.test(pos[0])) issues = pos;
+      else status = pos[0];
+    }
+    if (issues.length === 0) issues = issueValues;
+    corrected = [
+      head,
+      status !== void 0 ? quoteArg(status) : "<status>",
+      ...issues.length > 0 ? issues : ["<issues>"],
+      ...scan.flagArgs(BOARD_MOVE_OWN_FLAGS)
+    ].join(" ");
+  } else if (sub === "show") {
+    if (scan.positionals.length > 0) {
+      corrected = [head, ...scan.positionals, ...scan.flagArgs(BOARD_SHOW_OWN_FLAGS)].join(" ");
+    } else {
+      const normalized = splitInlineSelectors(argv, ["--issue", "--number"]);
+      const usedFlag = normalized.includes("--issue") ? "--issue" : normalized.includes("--number") ? "--number" : "--issue";
+      corrected = formatPositionalTarget(canonicalPath, "issue", { flag: usedFlag, argv: normalized, ownFlags: BOARD_SHOW_OWN_FLAGS });
+    }
+  } else if (sub === "read") {
+    corrected = [head, ...survivingFlagArgs(argv, "", BOARD_READ_OWN_FLAGS)].join(" ");
   } else {
-    const normalized = splitInlineSelectors(argv, ["--issue", "--number"]);
-    const usedFlag = normalized.includes("--issue") ? "--issue" : normalized.includes("--number") ? "--number" : "--issue";
-    corrected = formatPositionalTarget(canonicalPath, "issues", { flag: usedFlag, argv: normalized, ownFlags });
+    const declared = BOARD_OTHER_OWN_FLAGS[sub] ?? ["--json", "--repo"];
+    const targets = [...issueValues, ...scan.positionals];
+    const placeholder = BOARD_TARGET_PLACEHOLDER[sub];
+    corrected = [
+      head,
+      ...targets.length > 0 ? targets.map(quoteArg) : placeholder ? [placeholder] : [],
+      ...scan.flagArgs(declared)
+    ].join(" ");
   }
   return { canonicalPath, corrected, hint: `did you mean \`${corrected}\`?` };
 }
@@ -6427,6 +6583,45 @@ function normalizeBoardClaimIssueArgv(argv) {
   argv.splice(claimAt + 1, 0, value);
   return true;
 }
+function normalizeWorkboardClaimArgv(argv) {
+  const workboardAt = argv[2] === "oracle" ? 3 : 2;
+  if (argv[workboardAt] !== "workboard" || argv[workboardAt + 1] !== "claim") return false;
+  const tail = argv.slice(workboardAt + 2);
+  let selectorAt = -1;
+  let selectorSpan = 0;
+  let selected;
+  let targets = 0;
+  for (let i = 0; i < tail.length; i += 1) {
+    const tok = tail[i];
+    const eq = tok.indexOf("=");
+    const name = eq > 0 ? tok.slice(0, eq) : tok;
+    if (name === "--issue" || name === "--number") {
+      if (selectorAt >= 0) return false;
+      selectorAt = i;
+      selectorSpan = eq > 0 ? 1 : 2;
+      selected = eq > 0 ? tok.slice(eq + 1) : tail[++i];
+      if (!selected || selected.startsWith("-")) return false;
+    } else if (BOARD_CLAIM_VALUE_FLAGS.has(name)) {
+      const value = eq > 0 ? tok.slice(eq + 1) : tail[++i];
+      if (!value || value.startsWith("-")) return false;
+    } else if (BOARD_CLAIM_BOOLEAN_FLAGS.has(tok) || tok === "--dry-run" || tok === "--validate-only") {
+      continue;
+    } else if (tok.startsWith("-") || !tok) {
+      return false;
+    } else {
+      targets += 1;
+    }
+  }
+  if (selected !== void 0) {
+    if (targets > 0) return false;
+    tail.splice(selectorAt, selectorSpan);
+    tail.unshift(selected);
+  } else if (targets === 0) {
+    return false;
+  }
+  argv.splice(2, argv.length - 2, "oracle", "board", "claim", ...tail);
+  return true;
+}
 function classifyParseError(plain) {
   if (/unknown command/i.test(plain)) return "unknown-command";
   if (/unknown option|missing required argument|too many arguments|argument missing|is invalid\. Allowed choices are|cannot be used with/i.test(plain)) {
@@ -10413,6 +10608,10 @@ async function fetchTrainAuthority(repo, deps) {
     }
     const body = await res.json();
     if (typeof body?.train !== "boolean" || !body.role) return { ok: false, error: "malformed train-authority response" };
+    if (body.authenticatedDelegation !== void 0 && (body.authenticatedDelegation !== true || !body.train || body.repo !== repo || body.delegatedActor !== body.login || !/^[A-Za-z0-9-]{1,39}$/.test(body.delegatedActor ?? ""))) {
+      return { ok: false, error: "malformed delegated train-authority response" };
+    }
+    if (body.delegatedActor !== void 0 && body.authenticatedDelegation !== true) return { ok: false, error: "unverified delegated actor" };
     return { ok: true, authority: body };
   } catch (e) {
     return { ok: false, error: e.message };
@@ -15142,6 +15341,12 @@ function renderClaimReleaseBody(release) {
 
 <!-- mmi-claim-release: ${JSON.stringify(release)} -->`;
 }
+function formatClaimMarker(actor, ts = (/* @__PURE__ */ new Date()).toISOString()) {
+  const marker = { v: 1, session: actor.session, surface: actor.surface, host: actor.host, ts };
+  return `Claimed by \`${describeClaimMarker(marker)}\` at ${marker.ts}.
+
+<!-- mmi-claim: ${JSON.stringify(marker)} -->`;
+}
 function latestClaimMarker(comments) {
   for (let i = comments.length - 1; i >= 0; i -= 1) {
     const body = comments[i].body;
@@ -15466,6 +15671,7 @@ async function gatherClaimLiveness(client, repo, number, fetchOpenPulls) {
         `repos/${repo}/branches/${encodeURIComponent(out.branch)}`
       );
       out.branchAt = head?.commit?.commit?.committer?.date ?? void 0;
+      out.branchSha = head?.commit?.sha ?? void 0;
     } catch {
     }
   }
@@ -15532,13 +15738,27 @@ function isSeatClaimMarker(marker, current, context = {}) {
   const state = context.sessionState ?? probeLocalClaimSession(marker, context.now);
   return state === "dead";
 }
+function isSameBranchClaimResume(contest, repo, landing = {}) {
+  const headBranch = landing.headBranch?.replace(/^refs\/heads\//, "").replace(/^[^/:]+:/, "").trim();
+  const headSha = landing.headSha?.trim();
+  if (!headBranch && !headSha) return false;
+  if (!contest.marker || contest.unverifiable.length > 0 || contest.live.length === 0) return false;
+  const branchLine = /^live branch ([^\s]+) on /;
+  const fromContest = contest.branch?.replace(/ \(head of open PR .*\)$/, "").trim();
+  const fromLive = contest.live.map((line) => branchLine.exec(line)?.[1]).find(Boolean);
+  const liveBranch = fromContest || fromLive;
+  const matches = Boolean(headBranch && liveBranch && liveBranch === headBranch) || Boolean(headSha && contest.branchSha && contest.branchSha === headSha);
+  if (!matches) return false;
+  const ownBranchLine = liveBranch ? `live branch ${liveBranch} ` : "live branch ";
+  return contest.live.every((line) => /^claim marker from /.test(line) || line.startsWith(ownBranchLine) && line.endsWith(` on ${repo}`));
+}
 function laneResumeEvidence(evidence) {
   if (!evidence.marker || evidence.sessionState !== "dead") return void 0;
   if (!isHostSessionId(evidence.marker.session)) return void 0;
   const artifacts = [evidence.openPr, evidence.branch ? `live branch ${evidence.branch}` : void 0].filter(Boolean);
   return `prior claim by lane ${describeClaimMarker(evidence.marker)} (@${evidence.markerBy}, ${formatClaimAge(evidence.markerAgeMs)} old) is verifiably not running on this host \u2014 its local session transcript is gone or stale${artifacts.length ? `; resuming over ${artifacts.join("; ")}` : ""}`;
 }
-async function checkLaneContest(client, item, actor = describeSessionIdentity(), viewerLogin, appClient) {
+async function checkLaneContest(client, item, actor = describeSessionIdentity(), viewerLogin, appClient, landing) {
   const livenessClient = await selectLivenessClient(client, appClient);
   let evidence = await gatherClaimLiveness(livenessClient, item.repository, item.number, openPullsFetcher(livenessClient));
   if (evidence.failed.some((channel) => channel !== "session")) {
@@ -15550,10 +15770,21 @@ async function checkLaneContest(client, item, actor = describeSessionIdentity(),
     markerBy: evidence.markerBy,
     sessionState: evidence.sessionState
   });
-  const resume = ownership !== "mine" && ownSeat ? laneResumeEvidence(evidence) : void 0;
+  let resume = ownership !== "mine" && ownSeat ? laneResumeEvidence(evidence) : void 0;
   const live = ownSeat ? [] : liveEvidenceLines(evidence, item.repository);
   const unverifiable = ownSeat ? [] : evidence.failed;
-  const contested = !ownSeat && !resume && (live.length > 0 || unverifiable.length > 0);
+  let contested = !ownSeat && !resume && (live.length > 0 || unverifiable.length > 0);
+  if (contested && landing && isSameBranchClaimResume({
+    contested: true,
+    live,
+    unverifiable,
+    marker: evidence.marker,
+    branch: evidence.branch,
+    branchSha: evidence.branchSha
+  }, item.repository, landing)) {
+    contested = false;
+    resume = `same-branch resume over live branch ${evidence.branch ?? landing.headBranch}`;
+  }
   const carry = staleWorkLines(evidence);
   const staleStamp = !contested && !resume && !ownSeat && evidence.marker ? `stale claim stamp ${describeClaimMarker(evidence.marker)} (idle ${formatClaimAge(claimStampStaleness(evidence.marker, { activityAt: [evidence.lastCommentAt] }).idleMs)})${carry.length ? `; continue its ${carry.join(" and ")}` : ""}` : void 0;
   return {
@@ -15563,7 +15794,9 @@ async function checkLaneContest(client, item, actor = describeSessionIdentity(),
     ownership,
     marker: evidence.marker,
     resume,
-    ...staleStamp ? { staleStamp } : {}
+    ...staleStamp ? { staleStamp } : {},
+    ...evidence.branch ? { branch: evidence.branch } : {},
+    ...evidence.branchSha ? { branchSha: evidence.branchSha } : {}
   };
 }
 function laneContestParts(contest) {
@@ -15576,12 +15809,16 @@ function isUnknownHold(contest) {
   return !contest.marker && contest.live.length === 0 && contest.unverifiable.length > 0;
 }
 var CONTESTED_CLAIM_RECOVERY = "leave the holder's work untouched and choose another unclaimed item or coordinate a handoff (use --force only for an intentional takeover)";
+function contestedClaimRecovery(ref) {
+  const repo = /^([^/\s#]+\/[^/\s#]+)#\d+$/.exec(ref)?.[1];
+  return `${CONTESTED_CLAIM_RECOVERY}; list free items with: mmi-cli oracle board read --json${repo ? ` --repo ${repo}` : ""} and pick from its claimable list`;
+}
 function laneContestMessage(ref, contest, verb) {
   const { holder, why } = laneContestParts(contest);
   if (isUnknownHold(contest)) {
-    return verb === "claim" ? `${ref} cannot be verified as free: ${holder} (${why}); the liveness reads failed so the claim is refused fail-closed \u2014 ${CONTESTED_CLAIM_RECOVERY}` : `refusing to unclaim ${ref}: ${holder} (${why}); the liveness reads failed so the unclaim is refused fail-closed \u2014 re-run with --force --holder-dead once you have evidence the holder lane is dead, or wait for it to go stale (#6625)`;
+    return verb === "claim" ? `${ref} cannot be verified as free: ${holder} (${why}); the liveness reads failed so the claim is refused fail-closed \u2014 ${contestedClaimRecovery(ref)}` : `refusing to unclaim ${ref}: ${holder} (${why}); the liveness reads failed so the unclaim is refused fail-closed \u2014 re-run with --force --holder-dead once you have evidence the holder lane is dead, or wait for it to go stale (#6625)`;
   }
-  return verb === "claim" ? `${ref} is already claimed by ${holder} with live evidence of active work (${why}); ${CONTESTED_CLAIM_RECOVERY}` : `refusing to unclaim ${ref}: ${holder} shows live evidence of active work (${why}); re-run with --force --holder-dead once you have evidence the holder lane is dead, or wait for it to go stale (#6625)`;
+  return verb === "claim" ? `${ref} is already claimed by ${holder} with live evidence of active work (${why}); ${contestedClaimRecovery(ref)}` : `refusing to unclaim ${ref}: ${holder} shows live evidence of active work (${why}); re-run with --force --holder-dead once you have evidence the holder lane is dead, or wait for it to go stale (#6625)`;
 }
 function ghError(e) {
   const err = e;
@@ -15714,6 +15951,7 @@ async function prepareClaimContext(options, selectors, deps, collected, snapshot
     cfg,
     client,
     items: collected.items,
+    selectedRefs: new Set(selectors.map((selector) => `${selector.repo}#${selector.number}`.toLowerCase())),
     writable: writableOrUnknown(writable),
     report,
     session: deps.session ?? describeSessionIdentity(),
@@ -15825,7 +16063,9 @@ async function claimOneBoardItem(ctx, selector, options) {
       return;
     }
     if (!options.force) {
-      const refusal = laneContestMessage(item.ref, contest, "claim");
+      const candidateRefs = [...report.primary.claimable, ...report.secondary.claimable].filter((candidate) => candidate.contentType === "Issue" && candidate.state === "OPEN" && !candidate.claim?.currentlyClaimed && !ctx.selectedRefs.has(candidate.ref.toLowerCase())).map((candidate) => candidate.ref);
+      const alternatives = candidateRefs.length ? `Board snapshot candidates (not guaranteed free): ${candidateRefs.join(", ")}` : "Board snapshot candidates: none in this read";
+      const refusal = `${laneContestMessage(item.ref, contest, "claim")}. ${alternatives}; refresh mmi-cli oracle board read before claiming.`;
       throw new Error(options.bulk ? refusal : withGatedWriteChainHint(refusal));
     }
     previousHolder = displaced();
@@ -19421,10 +19661,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.209",
-    tag: "v4.5.209",
-    commit: "2449709d554c",
-    npm: "@mutmutco/cli@4.5.209"
+    version: "4.5.211",
+    tag: "v4.5.211",
+    commit: "cbbcc24fc015",
+    npm: "@mutmutco/cli@4.5.211"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19441,14 +19681,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.209"
+          v3Target: "v4.5.211"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.209 and redeploy the Hub Lambda from tag v4.5.209 (2449709d554c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.209 (@mutmutco/cli@4.5.209, tag commit 2449709d554c \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.211 and redeploy the Hub Lambda from tag v4.5.211 (cbbcc24fc015); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.211 (@mutmutco/cli@4.5.211, tag commit cbbcc24fc015 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21592,9 +21832,12 @@ async function buildTrainApplyContext(deps) {
   const repo = requireValue(clean2(await deps.run("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"])), "repo");
   const [owner, name] = repo.split("/");
   if (!owner || !name) throw new Error(`repo must be owner/name, got ${repo}`);
-  const login = await readTrainLogin(deps);
   const verdict = await deps.trainAuthority(repo);
   if (!verdict.ok) throw new Error(`${commandAuthorityLabel(owner)}: train authority could not be verified (${verdict.error})`);
+  if (verdict.authenticatedDelegation === true && (!verdict.train || !/^[A-Za-z0-9-]{1,39}$/.test(verdict.delegatedActor ?? ""))) {
+    throw new Error("invalid delegated train authority");
+  }
+  const login = verdict.authenticatedDelegation === true ? verdict.delegatedActor : await readTrainLogin(deps);
   if (!verdict.train) {
     throw new Error(`${commandAuthorityLabel(owner)}: @${login} is ${verdict.role} \u2014 no train authority on ${repo}`);
   }
@@ -23952,46 +24195,51 @@ var import_node_fs30 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
 var import_node_path28 = require("node:path");
 
-// src/actions-billing-preflight.ts
-var CANARY_WORKFLOW = "actions-job-start-canary.yml";
-var CANARY_REPO = "mutmutco/MMI-Hub";
-var ACTIONS_BILLING_BLOCK_RE = /job was not started because recent account payments have failed|account payments have failed|spending limit needs to be increased|Billing & plans/i;
-var CANARY_POLLS = 20;
-var CANARY_POLL_MS = 1e3;
-function isActionsBillingBlockText(text) {
-  return ACTIONS_BILLING_BLOCK_RE.test(text);
-}
-function interpretActionsJobStart(input) {
-  const text = input.text ?? "";
-  if (isActionsBillingBlockText(text)) return "billing-blocked";
-  const jobs = input.jobs ?? [];
-  if (jobs.some((job) => isActionsBillingBlockText(JSON.stringify(job)))) return "billing-blocked";
-  if (jobs.some((job) => Array.isArray(job.steps) && job.steps.length > 0 || Boolean(job.startedAt))) {
-    return "started";
-  }
-  if (jobs.length > 0 && jobs.every((job) => {
-    const finished = job.conclusion === "failure" || job.status === "completed";
-    const empty = !Array.isArray(job.steps) || job.steps.length === 0;
-    return finished && empty && !job.startedAt;
-  })) {
-    return "never-started";
+// ../shared/runner-fallback.ts
+var HOSTED_RUNNER_LABEL_RE = /\b(?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*)\b/i;
+function classifyRunnerCost(selector) {
+  const raw = selector.replace(/\s+#.*$/gm, "").trim();
+  if (HOSTED_RUNNER_LABEL_RE.test(raw)) return "hosted";
+  const json = /^\$\{\{\s*fromJSON\('([^']+)'\)\s*\}\}$/.exec(raw);
+  if (json) {
+    try {
+      const labels2 = JSON.parse(json[1]);
+      return Array.isArray(labels2) && labels2.length > 0 && labels2.every((l) => typeof l === "string" && /^[\w-]+$/.test(l)) && labels2.some((l) => l.toLowerCase() === "self-hosted") ? "self-hosted" : "unknown";
+    } catch {
+      return "unknown";
+    }
   }
-  return "pending";
-}
-var CANARY_ACCESS_BLOCK_RE = /HTTP 404|HTTP 403|Not Found|Resource not accessible|must have admin rights|not authorized|no identity|401/i;
-function isCanaryAccessBlockText(text) {
-  return !isActionsBillingBlockText(text) && CANARY_ACCESS_BLOCK_RE.test(text);
-}
-function actionsCanaryUndispatchedRefusal(detail) {
-  return new Error(
-    `release refused: the hosted-job canary (#5604) was not dispatched, so a hosted job start is UNPROVEN \u2014 this is NOT a billing verdict. ${detail} The Hub dispatches ${CANARY_WORKFLOW} with its App token for a train-authorized caller (#6319): refresh the Hub session (\`gh auth login\`) and retry, and confirm \`mmi-cli oracle org access role <owner/repo>\` reports train authority. Nothing was tagged or pushed \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#actions-job-start-canary`
-  );
+  if (raw.includes("${{")) return "unknown";
+  const labels = /^\[[^\[\]]+\]$/.test(raw) ? raw.slice(1, -1).split(",").map((s) => s.trim().replace(/^(['"])(.*)\1$/, "$2")) : /^(?:-\s*[^\n]+\s*)+$/.test(raw) ? raw.split("\n").map((s) => s.trim().replace(/^-\s*/, "").replace(/^(['"])(.*)\1$/, "$2")) : [raw.replace(/^(['"])(.*)\1$/, "$2")];
+  return labels.every((l) => /^[\w-]+$/.test(l)) && labels.some((l) => l.toLowerCase() === "self-hosted") ? "self-hosted" : "unknown";
 }
-function actionsBillingRefusal(detail) {
-  return new Error(
-    `release refused: GitHub Actions cannot start a hosted job (billing/spending). ${detail} Fix Billing & plans / the org spending limit, then rerun. Do not mint a new tag. If a tag is already on origin, use \`mmi-cli devops release --retry-publish <run-id> --apply\` on that exact run \u2014 never recut.`
-  );
+var STANDARD_HOSTED_ALLOWLIST = [
+  ["mutmutco/MMI-Hub", ".github/workflows/launcher-build.yml", "build", "windows-latest"]
+];
+function standardHostedLabelFor(repo, path2, jobId) {
+  return STANDARD_HOSTED_ALLOWLIST.find(([r, p, j]) => r === repo && p === path2 && j === jobId)?.[3];
+}
+function classifyJobRunnerCost(selector, jobBody, standardHostedLabel) {
+  const direct = classifyRunnerCost(selector);
+  const matrix = /^\$\{\{\s*matrix\.([\w-]+)\s*\}\}$/.exec(selector.trim());
+  if (!matrix || direct === "hosted") return direct;
+  const strategy = /^    strategy:\s*\n((?: {6,}[^\n]*\n?|\s*\n)*)/m.exec(jobBody)?.[1];
+  const matrixBody = strategy && /^      matrix:[^\S\n]*\n((?: {8,}[^\n]*\n?|\s*\n)*)/m.exec(strategy)?.[1];
+  const include = matrixBody && /^        include:[^\S\n]*\n((?: {10,}[^\n]*\n?|\s*\n)*)$/.exec(matrixBody)?.[1];
+  if (!include) return "unknown";
+  const rows = include.split(/^ {10}- /m).slice(1);
+  if (!rows.length) return "unknown";
+  const costs = rows.map((row) => {
+    const match = new RegExp(`^(?: {12})?${matrix[1]}:\\s*(.+)$`, "m").exec(row);
+    if (standardHostedLabel && match?.[1].trim() === standardHostedLabel) return "standard-hosted";
+    return match ? classifyRunnerCost(match[1]) : "unknown";
+  });
+  if (costs.includes("hosted")) return "hosted";
+  if (costs.includes("unknown")) return "unknown";
+  return costs.includes("standard-hosted") ? "standard-hosted" : "self-hosted";
 }
+
+// src/actions-billing-preflight.ts
 function parseJson(raw, label) {
   try {
     return JSON.parse(raw);
@@ -23999,153 +24247,31 @@ function parseJson(raw, label) {
     throw new Error(`${label} was not valid JSON`);
   }
 }
-async function scanRepoForBillingBlock(deps, repo) {
-  let raw;
-  try {
-    raw = await deps.run("gh", [
-      "run",
-      "list",
-      "--repo",
-      repo,
-      "--limit",
-      "8",
-      "--json",
-      "databaseId,conclusion,status,displayTitle,url"
-    ]);
-  } catch {
-    return void 0;
-  }
-  const rows = parseJson(raw, `gh run list --repo ${repo}`);
-  if (!Array.isArray(rows)) return void 0;
-  for (const row of rows) {
-    const blob = `${row.displayTitle ?? ""} ${row.conclusion ?? ""} ${row.url ?? ""}`;
-    if (isActionsBillingBlockText(blob)) {
-      return `${repo} run ${row.databaseId ?? row.url ?? "(unknown)"} already names a billing/spending block`;
-    }
-    if (row.conclusion !== "failure" && row.status !== "completed") continue;
-    if (typeof row.databaseId !== "number") continue;
-    try {
-      const view = await deps.run("gh", [
-        "run",
-        "view",
-        String(row.databaseId),
-        "--repo",
-        repo,
-        "--json",
-        "jobs,conclusion,displayTitle,url"
-      ]);
-      const parsed = parseJson(view, `gh run view ${row.databaseId}`);
-      const verdict = interpretActionsJobStart({
-        jobs: parsed.jobs,
-        text: `${parsed.displayTitle ?? ""} ${parsed.conclusion ?? ""} ${view}`
-      });
-      if (verdict === "billing-blocked" || verdict === "never-started") {
-        return `${repo} run ${row.databaseId} (${parsed.url ?? row.url ?? "no url"}): hosted job never started` + (verdict === "billing-blocked" ? " (billing/spending refusal)" : " (empty steps)");
-      }
-    } catch {
-    }
-  }
-  return void 0;
-}
-async function correlateCanaryRun(deps, nonce) {
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  let lastError = "no matching canary run";
-  for (let attempt = 0; attempt < 8; attempt++) {
-    if (attempt > 0) await sleep2(CANARY_POLL_MS);
-    let raw;
-    try {
-      raw = await deps.run("gh", [
-        "run",
-        "list",
-        "--repo",
-        CANARY_REPO,
-        "--workflow",
-        CANARY_WORKFLOW,
-        "--limit",
-        "10",
-        "--json",
-        "databaseId,displayTitle,status,createdAt"
-      ]);
-    } catch (e) {
-      lastError = e instanceof Error ? e.message : String(e);
-      continue;
-    }
-    const rows = parseJson(
-      raw,
-      "canary gh run list"
-    );
-    const match = rows.find((row) => (row.displayTitle ?? "").includes(nonce) && typeof row.databaseId === "number");
-    if (match?.databaseId) return match.databaseId;
-  }
-  throw new Error(
-    `could not correlate ${CANARY_WORKFLOW} on ${CANARY_REPO} (nonce ${nonce}): ${lastError}`
-  );
-}
-async function dispatchCanary(deps, targetRepo2, nonce) {
-  const attempts = [];
-  if (deps.dispatchActionsCanary) {
-    try {
-      await deps.dispatchActionsCanary({ repo: targetRepo2, nonce });
-      return;
-    } catch (e) {
-      attempts.push(`Hub App dispatch: ${e instanceof Error ? e.message : String(e)}`);
-    }
-  }
-  try {
-    await deps.run("gh", [
-      "workflow",
-      "run",
-      CANARY_WORKFLOW,
-      "--repo",
-      CANARY_REPO,
-      "-f",
-      `nonce=${nonce}`
-    ]);
-    return;
-  } catch (e) {
-    attempts.push(`gh workflow run --repo ${CANARY_REPO}: ${e instanceof Error ? e.message : String(e)}`);
-  }
-  const detail = `could not dispatch ${CANARY_WORKFLOW} on ${CANARY_REPO} \u2014 ${attempts.join(" | ")}.`;
-  if (attempts.some((a) => isActionsBillingBlockText(a))) {
-    throw actionsBillingRefusal(`${detail} A hosted publish job may not start (the v1.54.2 class).`);
-  }
-  throw actionsCanaryUndispatchedRefusal(
-    attempts.every((a) => isCanaryAccessBlockText(a)) ? `${detail} Every door answered with an access refusal \u2014 the caller may read MMI-Hub but not start its workflows.` : detail
-  );
-}
-var HOSTED_LABEL_RE = /\b(?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*)\b/;
-var FALLBACK_EXPR_GLOBAL_RE = /\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'(?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*)'\s*\|\|\s*fromJSON\('\[[^\n']+\]'\)\s*\}\}/g;
-var AUTOMATIC_TRIGGERS = /* @__PURE__ */ new Set(["push", "pull_request", "pull_request_target", "release", "schedule", "workflow_run", "merge_group", "create", "deployment", "repository_dispatch", "check_run", "check_suite", "issues", "issue_comment"]);
-function workflowTriggers(yaml) {
-  const lines2 = yaml.split(/\r?\n/);
-  const i = lines2.findIndex((l) => /^(?:on|"on"|'on'):(?:\s|$)/.test(l));
-  if (i < 0) return [];
-  const inline = lines2[i].replace(/^[^:]+:\s*/, "").replace(/\s+#.*$/, "").trim();
-  if (inline) return inline.replace(/^\[|\]$/g, "").split(",").map((s) => s.trim().replace(/^['"]|['"]$/g, "")).filter(Boolean);
-  const out = [];
-  for (const line of lines2.slice(i + 1)) {
-    if (/^\S/.test(line)) break;
-    const m = /^ {2}([A-Za-z_]+):/.exec(line) ?? /^ {2}- ([A-Za-z_]+)\s*$/.exec(line);
-    if (m) out.push(m[1]);
-  }
-  return out;
-}
-function workflowNeedsHostedRunner(yaml) {
-  const body = yaml.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join("\n").replace(FALLBACK_EXPR_GLOBAL_RE, "");
-  return HOSTED_LABEL_RE.test(body) && workflowTriggers(yaml).some((t) => AUTOMATIC_TRIGGERS.has(t));
+function workflowNeedsHostedRunner(yaml, localWorkflows = /* @__PURE__ */ new Set(), where) {
+  const jobs = parseWorkflowJobs(yaml.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join("\n"));
+  return !jobs.length || jobs.some((job) => {
+    const callee = /^    uses:\s*\.\/(.+)$/m.exec(job.body)?.[1];
+    if (callee && localWorkflows.has(callee)) return false;
+    const section = /^    runs-on:([^\n]*(?:\n {6,}[^\n]*)*)/m.exec(job.body)?.[1] ?? "";
+    const selector = section.split("\n").map((line) => line.trim()).join("\n");
+    const cost = classifyJobRunnerCost(selector, job.body, where && standardHostedLabelFor(where.repo, where.path, job.id));
+    return cost !== "self-hosted" && cost !== "standard-hosted";
+  });
 }
 async function hostedWorkflowsOf(deps, repo) {
   const list = parseJson(
     await deps.run("gh", ["api", `repos/${repo}/contents/.github/workflows`]),
     `${repo} workflow listing`
   );
-  const hosted = [];
+  if (!Array.isArray(list) || !list.some((f) => f.type === "file" && /\.ya?ml$/.test(f.path ?? ""))) throw new Error("no workflow inventory");
+  const workflows = [];
   for (const f of list) {
-    if (f.type !== "file" || !f.path || !/\.ya?ml$/.test(f.path) || f.name === CANARY_WORKFLOW) continue;
+    if (f.type !== "file" || !f.path || !/\.ya?ml$/.test(f.path)) continue;
     const raw = parseJson(await deps.run("gh", ["api", `repos/${repo}/contents/${f.path}`]), `${repo} ${f.path}`);
-    if (workflowNeedsHostedRunner(Buffer.from(raw.content ?? "", "base64").toString("utf8"))) hosted.push(f.path);
+    workflows.push({ path: f.path, body: Buffer.from(raw.content ?? "", "base64").toString("utf8") });
   }
-  return hosted;
+  const local = new Set(workflows.map((file) => file.path));
+  return workflows.filter((file) => workflowNeedsHostedRunner(file.body, local, { repo, path: file.path })).map((file) => file.path);
 }
 async function assertActionsJobsCanStart(deps, targetRepo2) {
   let hosted;
@@ -24155,50 +24281,11 @@ async function assertActionsJobsCanStart(deps, targetRepo2) {
     hosted = void 0;
   }
   if (hosted && hosted.length === 0) {
-    process.stderr.write(`actions preflight: ${targetRepo2} has no automatically triggered GitHub-hosted job; hosted canary skipped (#7721)
+    process.stderr.write(`actions preflight: ${targetRepo2} source selectors are self-hosted only; no canary dispatch; access/isolation/execution unproven (#8911)
 `);
     return;
   }
-  const scanned = await scanRepoForBillingBlock(deps, targetRepo2);
-  if (scanned) throw actionsBillingRefusal(scanned);
-  if (targetRepo2.toLowerCase() !== CANARY_REPO.toLowerCase()) {
-    const hubScan = await scanRepoForBillingBlock(deps, CANARY_REPO);
-    if (hubScan) throw actionsBillingRefusal(hubScan);
-  }
-  const nonce = `5604-${(deps.now ?? Date.now)().toString(36)}`;
-  await dispatchCanary(deps, targetRepo2, nonce);
-  const runId = await correlateCanaryRun(deps, nonce);
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  let last = "pending";
-  let url = `https://github.com/${CANARY_REPO}/actions/runs/${runId}`;
-  for (let attempt = 0; attempt < CANARY_POLLS; attempt++) {
-    if (attempt > 0) await sleep2(CANARY_POLL_MS);
-    const view = await deps.run("gh", [
-      "run",
-      "view",
-      String(runId),
-      "--repo",
-      CANARY_REPO,
-      "--json",
-      "jobs,status,conclusion,url,displayTitle"
-    ]);
-    const parsed = parseJson(view, `canary gh run view ${runId}`);
-    if (parsed.url) url = parsed.url;
-    last = interpretActionsJobStart({
-      jobs: parsed.jobs,
-      text: `${parsed.displayTitle ?? ""} ${parsed.conclusion ?? ""} ${view}`
-    });
-    if (last === "started") {
-      await deps.run("gh", ["run", "cancel", String(runId), "--repo", CANARY_REPO]).catch(() => "");
-      return;
-    }
-    if (last === "billing-blocked" || last === "never-started") {
-      throw actionsBillingRefusal(`${url}: hosted canary ${last} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#actions-job-start-canary`);
-    }
-  }
-  throw actionsBillingRefusal(
-    `${url}: hosted canary stayed ${last} after ${CANARY_POLLS} polls \u2014 cannot prove a hosted job can start \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#actions-job-start-canary`
-  );
+  throw new Error(`release refused (#8911): ${hosted ? `paid or unresolved runner path(s): ${hosted.join(", ")}` : "runner inventory unreadable; self-hosted-only selection unproven"}. Remove paid selectors/fallbacks and verify existing self-hosted access and isolation before tagging.`);
 }
 
 // src/train-apply-recovery.ts
@@ -25734,6 +25821,9 @@ function failedRunIdentity(run, repo) {
 function manualRunAction(run, repo) {
   return `safe next action: diagnose with gh run view ${run.runId} --repo ${repo} --log-failed; rerun by hand only when the cause is fixed: gh run rerun ${run.runId} --repo ${repo} --failed (never re-tag)`;
 }
+function runsOnShaAction(repo, sha) {
+  return `safe next action: mmi-cli devops read run list --repo ${repo} --commit ${sha} --json databaseId,workflowName,event,status,conclusion to identify the run`;
+}
 async function readFailedRunsOnSha(deps, repo, sha) {
   try {
     const rows = JSON.parse(await deps.run("gh", [
@@ -25809,7 +25899,7 @@ async function correlateCandidateRunsToRequiredContexts(deps, repo, sha, candida
   if (contexts.length === 0) {
     return {
       unique: false,
-      note: `the failure names no failed required context \u2014 rerunning the first failed run could rerun an unrelated workflow; manual intervention required; safe next action: gh run list --repo ${repo} --commit ${sha.slice(0, 12)} to identify the run`
+      note: `the failure names no failed required context \u2014 rerunning the first failed run could rerun an unrelated workflow; manual intervention required; ${runsOnShaAction(repo, sha)}`
     };
   }
   const failedChecks = await readFailedCheckRunsOnSha(deps, repo, sha);
@@ -25862,7 +25952,7 @@ async function transientRecoveryForFailedPhase(deps, input) {
     };
   }
   if (candidates.length === 0) {
-    return { reran: false, recovered: false, note: `no failed run with an id could be classified on ${sha.slice(0, 12)} \u2014 manual intervention required (no marker proof, no automatic rerun); safe next action: gh run list --repo ${input.repo} --commit ${sha.slice(0, 12)} to identify the run` };
+    return { reran: false, recovered: false, note: `no failed run with an id could be classified on ${sha.slice(0, 12)} \u2014 manual intervention required (no marker proof, no automatic rerun); ${runsOnShaAction(input.repo, sha)}` };
   }
   if (enumerated && phase === "ordinaryCi") {
     const correlation = await correlateCandidateRunsToRequiredContexts(deps, input.repo, sha, candidates, extractFailedRequiredContexts(failure));
@@ -30301,33 +30391,6 @@ function registryRepoKey(repo) {
   return repo.toLowerCase();
 }
 
-// ../shared/runner-fallback.ts
-var RUNNER_FALLBACK_EXPR_RE = /^\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'((?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*))'\s*\|\|\s*fromJSON\('(\[[^\n']+\])'\)\s*\}\}$/;
-var FLEET_ONLY_RUNNER_JOBS = {
-  "backup-health.yml:judge": "SSH backup inventory; hosted source-IP access unverified",
-  "browser-pass.yml:browser-pass": "owner-bounded two-lane browser capacity",
-  "app-publish.yml:publish": "SSH tenant publish; hosted source-IP access unverified",
-  "get-publish.yml:publish": "SSH installer publish; hosted source-IP access unverified",
-  "get-publish-desktop.yml:publish": "SSH installer publish; hosted source-IP access unverified",
-  "hetzner-knownhosts-pin.yml:pin": "SSH host-key probe; hosted source-IP access unverified",
-  "module-rc-publish.yml:publish": "SSH live-container snapshot and tenant persistent state",
-  "tenant-control.yml:control": "SSH tenant control; hosted source-IP access unverified",
-  "tenant-deploy.yml:deploy": "SSH tenant deploy; hosted source-IP access unverified",
-  "tenant-reconcile.yml:reconcile": "SSH tenant reconciliation; hosted source-IP access unverified"
-};
-function parseRunnerFallbackExpression(runsOn) {
-  const match = RUNNER_FALLBACK_EXPR_RE.exec(runsOn.trim());
-  if (!match) return void 0;
-  try {
-    const parsed = JSON.parse(match[2]);
-    if (!Array.isArray(parsed) || !parsed.length || !parsed.every((item) => typeof item === "string")) return void 0;
-    if (!parsed.some((item) => item.toLowerCase() === "self-hosted")) return void 0;
-    return { hosted: match[1], labels: parsed };
-  } catch {
-    return void 0;
-  }
-}
-
 // src/ci-audit.ts
 var HUB_REPO4 = "mutmutco/MMI-Hub";
 var HUB_GATE_CONTEXTS = ["cli", "infra", "docs"];
@@ -30392,20 +30455,18 @@ function auditRunnerFallbacks(repo, files) {
   for (const { path: path2, body } of files) {
     const jobs = parseWorkflowJobs(body.split(/\r?\n/).filter((line) => !/^\s*#/.test(line)).join("\n"));
     for (const job of jobs) {
-      const runsOn = /^    runs-on:\s*(.+)$/m.exec(job.body)?.[1] ?? "";
       const runnerSection = /^    runs-on:([^\n]*(?:\n {6,}[^\n]*)*)/m.exec(job.body)?.[1] ?? "";
-      const fallback = parseRunnerFallbackExpression(runsOn);
-      const selfHosted = !!fallback || /self-hosted/i.test(runnerSection) || /matrix\./.test(runsOn) && /self-hosted/i.test(job.body);
-      if (!selfHosted) continue;
-      const key = `${path2.split("/").pop()}:${job.id}`;
-      const marked = /#\s*mmi-runner:\s*fleet-only\s*[—–-]+\s*(\S.*?)\s*$/.exec(runsOn)?.[1];
-      const exemption = (repo === HUB_REPO4 ? FLEET_ONLY_RUNNER_JOBS[key] : void 0) ?? marked;
-      const safe = !!fallback;
+      const callee = /^    uses:\s*(.+)$/m.exec(job.body)?.[1];
+      if (callee?.startsWith("./") && files.some((file) => file.path === callee.slice(2))) continue;
+      if (callee && /^mutmutco\/MMI-Hub\/\.github\/workflows\/[\w.-]+\.ya?ml@[\w./-]+$/.test(callee)) continue;
+      const standardHostedLabel = standardHostedLabelFor(repo, path2, job.id);
+      const cost = classifyJobRunnerCost(runnerSection.split("\n").map((line) => line.trim()).join("\n"), job.body, standardHostedLabel);
+      const ok = !callee && (cost === "self-hosted" || cost === "standard-hosted");
       checks.push({
-        ok: !!exemption || safe,
-        label: `runner has hosted backup (#8671): ${path2}:${job.id}`,
-        detail: exemption ? `fleet-only: ${exemption}` : safe ? void 0 : "self-hosted runner does not use the vars.MMI_RUNNER_FALLBACK backup expression",
-        remediation: exemption || safe ? void 0 : `Use runs-on: \${{ vars.MMI_RUNNER_FALLBACK == 'hosted' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","x64","mmi-live"]') }} (keeping the job's original self-hosted tuple). See gh-runner-runbook.md.`
+        ok,
+        label: cost === "standard-hosted" ? `runner uses exact standard-hosted exception (#8912): ${path2}:${job.id}` : `runner is self-hosted only (#8911): ${path2}:${job.id}`,
+        detail: callee ? `unknown callee runner policy: ${callee}` : cost === "hosted" ? "paid GitHub-hosted runner selection is forbidden" : cost === "unknown" ? "unknown runner selector; not proven self-hosted" : cost === "standard-hosted" ? "exact Hub launcher windows-latest matrix leg permitted within included Enterprise minutes; runner access and isolation not established" : "self-hosted selection only; runner access and isolation not established",
+        remediation: ok ? void 0 : `Use only a verified accessible self-hosted tuple, with no hosted fallback; resolve unknown selectors/callees. Preserve checks and artifacts. See gh-runner-runbook.md (${repo}).`
       });
     }
   }
@@ -30630,7 +30691,7 @@ function rulesetCoversReleaseBranches(payload, track) {
 function releaseBranchRefsCovered(conditions, track) {
   const include = conditions?.ref_name?.include;
   if (!Array.isArray(include)) return [];
-  const releaseRefs = track === "full" ? ["refs/heads/rc", "refs/heads/main"] : ["refs/heads/main"];
+  const releaseRefs = branchesForTrack(track).filter((branch) => branch !== "development").map((branch) => `refs/heads/${branch}`);
   return releaseRefs.filter((ref) => include.some((entry) => typeof entry === "string" && refPatternCovers(entry, ref)));
 }
 function unreachableReleaseContexts(input) {
@@ -30859,6 +30920,18 @@ async function auditRepoCi(repo, callerDeps) {
   const explicitNoCi = registryCi === "none" || registryRequiredChecks === null || Array.isArray(registryRequiredChecks) && registryRequiredChecks.length === 0;
   const deployableGated = repoClass === "deployable" && !explicitNoCi;
   const info = await restJson2(deps, `repos/${repo}`, {});
+  if (info.archived === true) {
+    return {
+      repo,
+      class: repoClass,
+      mergePolicy: "wait-for-checks",
+      ok: false,
+      checks: [],
+      explicitNoCi,
+      excludedReason: "GitHub archived repository (read-only)"
+    };
+  }
+  let releaseReadFailure;
   const baseBranch = repoClass === "content" ? "main" : "development";
   checks.push({
     ok: info.allow_auto_merge === true,
@@ -31061,14 +31134,29 @@ async function auditRepoCi(repo, callerDeps) {
         const releaseBranches = releaseBranchRefsCovered(productRuleset.conditions, resolveReleaseTrack(meta, void 0, repo));
         if (releaseBranches.length > 0) {
           const emittedByBranch = {};
+          const absent = [];
+          const unreadable = [];
           for (const ref of releaseBranches) {
-            emittedByBranch[ref] = await resolveEmittedPrContexts(deps, repo, ref.replace("refs/heads/", ""));
+            const branch = ref.replace("refs/heads/", "");
+            const present = await branchPresence(deps, repo, branch);
+            if (present === false) absent.push(branch);
+            else if (present === void 0) unreadable.push(branch);
+            else {
+              emittedByBranch[ref] = await resolveEmittedPrContexts(deps, repo, branch);
+              if (emittedByBranch[ref] === void 0) unreadable.push(branch);
+            }
           }
+          if (unreadable.length) releaseReadFailure = `release branch reachability unreadable: [${unreadable.join(", ")}] \u2014 no emitter conclusion`;
+          const presenceNote = [
+            absent.length ? `absent: [${absent.join(", ")}] \u2014 no emitter requirement audited` : "",
+            unreadable.length ? `unreadable: [${unreadable.join(", ")}] \u2014 cannot audit emitters` : ""
+          ].filter(Boolean).join("; ");
           const unreachable = unreachableReleaseContexts({ requiredContexts: liveContexts, releaseBranches, emittedByBranch, ignore: TRAIN_PR_ONLY_CONTEXTS });
           checks.push({
             ok: unreachable.length === 0,
             label: RELEASE_BRANCH_REACHABLE_LABEL,
-            detail: unreachable.length === 0 ? void 0 : unreachable.map((u) => `${u.branch.replace("refs/heads/", "")} requires [${u.unreachable.join(", ")}] but its own workflows emit none of them`).join("; ") + " \u2014 a base-" + unreachable.map((u) => u.branch.replace("refs/heads/", "")).join("/") + " PR (e.g. a hotfix) can never satisfy the gate and stays permanently BLOCKED",
+            severity: unreadable.length ? "warn" : absent.length ? "info" : void 0,
+            detail: unreachable.length === 0 ? presenceNote || void 0 : unreachable.map((u) => `${u.branch.replace("refs/heads/", "")} requires [${u.unreachable.join(", ")}] but its own workflows emit none of them`).join("; ") + " \u2014 a base-" + unreachable.map((u) => u.branch.replace("refs/heads/", "")).join("/") + " PR (e.g. a hotfix) can never satisfy the gate and stays permanently BLOCKED" + (presenceNote ? `; ${presenceNote}` : ""),
             remediation: unreachable.length === 0 ? void 0 : `Remove the unreachable context(s) from those branches in the ${PRODUCT_RULESET_NAME} ruleset conditions and ${PRODUCT_RULESET_REF}, or add the emitting workflow to the branch`
           });
         }
@@ -31124,7 +31212,7 @@ async function auditRepoCi(repo, callerDeps) {
       const body = await fetchFileContent(deps, repo, baseBranch, path2);
       if (body == null) continue;
       if (isGateWorkflowPath(path2)) gateBodies.push({ path: path2, body });
-      if (!/^\s*concurrency:/m.test(body) || !/^\s*cancel-in-progress:[ \t]*(?:true|\$\{\{\s*github\.event_name\s*==\s*(['"])pull_request\1\s*\}\})[ \t]*(?:#.*)?$/m.test(body)) {
+      if (!/^\s*concurrency:/m.test(body) || !/^\s*cancel-in-progress:[ \t]*(?:true|\$\{\{\s*github\.event_name\s*(?:==\s*(['"])pull_request\1|!=\s*(['"])merge_group\2)\s*\}\})[ \t]*(?:#.*)?$/m.test(body)) {
         if (NO_CANCEL_WAIVER.test(body)) waived.push(path2);
         else missing.push(path2);
       }
@@ -31183,34 +31271,45 @@ async function auditRepoCi(repo, callerDeps) {
   if (failure) {
     return { repo, class: repoClass, mergePolicy: policy, ok: false, checks: [], explicitNoCi, unauditedReason: failure };
   }
-  const ok = checks.every((c) => c.ok);
-  return { repo, class: repoClass, mergePolicy: policy, ok, checks, explicitNoCi };
+  const ok = !releaseReadFailure && checks.every((c) => c.ok);
+  return {
+    repo,
+    class: repoClass,
+    mergePolicy: policy,
+    ok,
+    checks,
+    explicitNoCi,
+    ...releaseReadFailure ? { unauditedReason: releaseReadFailure } : {}
+  };
 }
 var REGISTRY_UNREADABLE_DETAIL = `the registry roster read returned nothing \u2014 the fleet was NOT audited. 0 repos read from the registry; the number left unaudited is unknown because the roster is what names them. This is "cannot audit the fleet", never "the fleet is green". Under GitHub Actions the CLI needs a CI Hub session (MMI_HUB_TOKEN, minted from the job's OIDC claim via POST /auth/session-ci) \u2014 an App installation token has no /user identity and can never pass /auth/session (#3215).`;
 async function auditOrgCi(deps, repoFilter) {
   if (repoFilter) {
     const report = await auditRepoCi(repoFilter, deps);
-    return { ok: report.ok, scope: "single-repo", repos: [report] };
+    return { ok: report.ok, scope: "single-repo", repos: [report], excludedCount: report.excludedReason ? 1 : 0 };
   }
   const projects = await deps.listProjects();
   if (!projects || projects.length === 0) {
-    return { ok: false, scope: "registry-unreadable", repos: [], scopeDetail: REGISTRY_UNREADABLE_DETAIL };
+    return { ok: false, scope: "registry-unreadable", repos: [], excludedCount: 0, scopeDetail: REGISTRY_UNREADABLE_DETAIL };
   }
   const targets = collectRegistryRepos(projects);
   const repos = [];
   for (const repo of targets) {
     repos.push(await auditRepoCi(repo, deps));
   }
-  return { ok: repos.every((r) => r.ok), scope: "fleet", repos };
+  const audited = repos.filter((r) => !r.excludedReason);
+  return { ok: audited.length > 0 && audited.every((r) => r.ok), scope: "fleet", repos, excludedCount: repos.length - audited.length };
 }
 function renderCiAuditScopeLine(report) {
   if (report.scope === "registry-unreadable") {
     return `scope: REGISTRY UNREADABLE \u2014 repos audited: 0 \u2014 ${report.scopeDetail ?? REGISTRY_UNREADABLE_DETAIL}`;
   }
+  const excluded = report.repos.filter((r) => r.excludedReason).length;
+  const count = `repos audited: ${report.repos.length - excluded}${excluded ? ` \u2014 repos excluded: ${excluded}` : ""}`;
   if (report.scope === "single-repo") {
-    return `scope: single-repo (explicit --repo) \u2014 repos audited: ${report.repos.length} \u2014 this is NOT a fleet verdict`;
+    return `scope: single-repo (explicit --repo) \u2014 ${count} \u2014 this is NOT a fleet verdict`;
   }
-  return `scope: fleet (registry roster) \u2014 repos audited: ${report.repos.length}`;
+  return `scope: fleet (registry roster) \u2014 ${count}`;
 }
 function renderCiAuditMarkdown(report) {
   const lines2 = [
@@ -31218,16 +31317,16 @@ function renderCiAuditMarkdown(report) {
     "",
     renderCiAuditScopeLine(report),
     "",
-    `Fleet: ${report.ok ? "OK" : "GAPS"} (${report.repos.filter((r) => r.ok).length}/${report.repos.length} repos ready)`,
+    `Fleet: ${report.ok ? "OK" : "GAPS"} (${report.repos.filter((r) => r.ok && !r.excludedReason).length}/${report.repos.filter((r) => !r.excludedReason).length} repos ready)`,
     "",
     "| Repo | Class | Policy | OK | Top gap |",
     "|------|-------|--------|----|---------|"
   ];
   for (const r of report.repos) {
-    const gap = r.unauditedReason ? `CANNOT AUDIT \u2014 ${r.unauditedReason}` : r.checks.find((c) => !c.ok)?.label ?? "\u2014";
-    lines2.push(`| ${r.repo} | ${r.class} | ${r.mergePolicy} | ${r.ok ? "yes" : "no"} | ${gap} |`);
+    const gap = r.excludedReason ? `EXCLUDED \u2014 ${r.excludedReason}` : r.unauditedReason ? `CANNOT AUDIT \u2014 ${r.unauditedReason}` : r.checks.find((c) => !c.ok)?.label ?? "\u2014";
+    lines2.push(`| ${r.repo} | ${r.class} | ${r.excludedReason ? "\u2014" : r.mergePolicy} | ${r.excludedReason ? "excluded" : r.ok ? "yes" : "no"} | ${gap} |`);
   }
-  const advisories = report.repos.flatMap((r) => r.checks.filter((c) => c.severity && c.label === PENDING_LANDING_LABEL).map((c) => `- ${c.severity === "warn" ? "WARN" : "INFO"} ${r.repo}: ${c.label} \u2014 ${c.detail ?? ""}`));
+  const advisories = report.repos.flatMap((r) => r.checks.filter((c) => c.severity).map((c) => `- ${c.severity === "warn" ? "WARN" : "INFO"} ${r.repo}: ${c.label} \u2014 ${c.detail ?? ""}`));
   if (advisories.length) lines2.push("", ...advisories);
   return lines2.join("\n");
 }
@@ -31237,12 +31336,15 @@ function renderCiAuditText(report) {
     renderCiAuditScopeLine(report)
   ];
   for (const r of report.repos) {
-    const verdict = r.unauditedReason ? "CANNOT AUDIT" : r.ok ? "OK" : "GAP";
+    const verdict = r.excludedReason ? "EXCLUDED" : r.unauditedReason ? "CANNOT AUDIT" : r.ok ? "OK" : "GAP";
     lines2.push(`
-${r.repo} (${r.class}, policy=${r.mergePolicy}) ${verdict}`);
+${r.repo} (${r.class}, policy=${r.excludedReason ? "not audited" : r.mergePolicy}) ${verdict}`);
+    if (r.excludedReason) {
+      lines2.push(`  EXCLUDED \u2014 ${r.excludedReason}`);
+      continue;
+    }
     if (r.unauditedReason) {
       lines2.push(`  UNAUDITED \u2014 ${r.unauditedReason}`);
-      continue;
     }
     for (const c of r.checks) {
       lines2.push(`  ${!c.ok ? "FAIL" : c.severity === "warn" ? "WARN" : c.severity === "info" ? "INFO" : "OK"} ${c.label}${c.detail ? ` \u2014 ${c.detail}` : ""}`);
@@ -31261,6 +31363,10 @@ async function applyCiReconcileMergeSettingsFromReport(repo, deps, report) {
     errors.push(unauditedReconcileError(report.unauditedReason));
     return { repo, applied, skipped, errors };
   }
+  if (report.excludedReason) {
+    skipped.push(`excluded \u2014 ${report.excludedReason}; no reconcile change made`);
+    return { repo, applied, skipped, errors };
+  }
   const mergeChecks = report.checks.filter((c) => c.label.startsWith("allow_") || c.label.startsWith("delete_branch") || c.label.startsWith("has_wiki"));
   const needsPatch = mergeChecks.some((c) => !c.ok);
   if (!needsPatch) {
@@ -31564,6 +31670,9 @@ async function applyCiReconcileRepo(repo, deps, options = {}) {
     return { repo, applied: [], skipped: [], errors: ["product-ruleset requires registry META requiredChecks"] };
   }
   const report = await auditRepoCi(repo, deps);
+  if (report.excludedReason) {
+    return { repo, applied: [], skipped: [`excluded \u2014 ${report.excludedReason}; no reconcile change made`], errors: [] };
+  }
   if (report.unauditedReason) {
     return { repo, applied: [], skipped: [], errors: [unauditedReconcileError(report.unauditedReason)] };
   }
@@ -45976,7 +46085,7 @@ async function checkDocsIndexAtHead(opts, deps) {
   return {
     ok: false,
     detail: `${DOCS_INDEX_PATH} is stale at the commit this PR would open from \u2014 it no longer matches the docs/ tree there (checked ${ref} over ${relDocs.length} indexed doc${relDocs.length === 1 ? "" : "s"})`,
-    fix: "run `mmi-cli oracle docs index --write`, commit docs/index.md, and push again before retrying `pr create`"
+    fix: "run `mmi-cli oracle docs index --write`, commit docs/index.md, and push again before retrying `pr create`; freshness is checked at the pushed commit regardless of merge-queue state, so regenerate and commit docs/index.md BEFORE `pr create`, never defer it to after merge"
   };
 }
 
@@ -46066,6 +46175,10 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
     if (state?.toLowerCase() === "closed") continue;
     const contest = await checkContest(client, { repository: repo, number }, actor, viewerLogin, deps.appClient);
     if (!contest.contested) continue;
+    if (isSameBranchClaimResume(contest, repo, { headBranch: deps.head, headSha: deps.headSha })) {
+      await client.rest("POST", `repos/${repo}/issues/${number}/comments`, { body: { body: formatClaimMarker(actor) } }).catch(() => void 0);
+      continue;
+    }
     const ref = `${repo}#${number}`;
     const commentsPath = `repos/${repo}/issues/${number}/comments`;
     const now = deps.now ?? Date.now;
@@ -48588,9 +48701,14 @@ ${list}`);
     if (docsCheck && !docsCheck.ok) {
       return fail(`pr create: ${docsCheck.detail} \u2014 ${docsCheck.fix}`);
     }
-    const claimRefusal = await prCreateClaimRefusal(body, o.repo);
-    if (claimRefusal) return fail(claimRefusal);
     const createHead = o.head ?? await gitOut(["symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => "");
+    const shaRef = o.head ? `refs/heads/${o.head.replace(/^[^/:]+:/, "")}` : "HEAD";
+    const createHeadSha = await gitOut(["rev-parse", "--verify", "--quiet", shaRef]).catch(() => "");
+    const claimRefusal = await prCreateClaimRefusal(body, o.repo, {
+      head: createHead || void 0,
+      headSha: createHeadSha || void 0
+    });
+    if (claimRefusal) return fail(claimRefusal);
     const mergedHeadWarning = await prCreateMergedHeadWarning({ head: createHead || void 0, repo: o.repo });
     if (mergedHeadWarning) process.stderr.write(`${mergedHeadWarning}
 `);
@@ -49743,7 +49861,12 @@ function trainApplyDeps() {
     runSelf: async (args) => (await execFileP(process.execPath, [process.argv[1], ...canonicalArgvFor(args)], { timeout: 3e4 })).stdout,
     trainAuthority: async (repo) => {
       const verdict = await fetchTrainAuthority(repo, registryClientDeps(await loadConfig()));
-      return verdict.ok ? { ok: true, role: verdict.authority.role, train: verdict.authority.train } : verdict;
+      return verdict.ok ? {
+        ok: true,
+        role: verdict.authority.role,
+        train: verdict.authority.train,
+        ...verdict.authority.authenticatedDelegation === true ? { authenticatedDelegation: true, delegatedActor: verdict.authority.delegatedActor } : {}
+      } : verdict;
     },
     // Hub-App-authority dispatch of the central tenant deploy (#953) — the Hub fires the
     // workflow_dispatch with its App token, so the caller needs no MMI-Hub Actions write.
@@ -54737,9 +54860,13 @@ function parseBrokerAssignee(raw) {
 var SINGLE_SHOT_TIMEOUT_MS = 6e4;
 var BROKER_MAX_BUFFER = 64 * 1024 * 1024;
 var PR_QUEUE_QUERY = "query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){mergeQueueEntry{state position enqueuedAt estimatedTimeToMerge headCommit{oid}}}}}";
+function missingBrokerPrRepoMessage(subcommand, number) {
+  const example = subcommand === "list" ? "mmi-cli devops read pr list --repo <owner/repo> --state open --json number,title,headRefName" : subcommand === "diff" ? `mmi-cli devops read pr diff ${number ?? "<number>"} --repo <owner/repo> --name-only` : `mmi-cli devops read pr queue ${number ?? "<number>"} --repo <owner/repo> --json`;
+  return `read pr ${subcommand}: required option '--repo <owner/repo>' not specified \u2014 broker PR ${subcommand} reads do not infer the repo from a worktree's git origin; pass --repo <owner/repo> explicitly (e.g. \`${example}\`)`;
+}
 function buildPrQueueSpec(number, o) {
   const repo = parseBrokerRepo(o.repo, "--repo");
-  if (!repo) throw new Error("read pr queue: --repo is required");
+  if (!repo) throw new Error(missingBrokerPrRepoMessage("queue", number));
   const [owner, name] = repo.split("/");
   return { program: "gh", args: ["api", "graphql", "-f", `query=${PR_QUEUE_QUERY}`, "-f", `owner=${owner}`, "-f", `name=${name}`, "-F", `number=${parseBrokerId(number, "PR number")}`], timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
 }
@@ -54793,12 +54920,19 @@ function parseBrokerCreated(v) {
   if (!CREATED_RE.test(v)) throw new Error(`--created must be a GitHub created filter like ">=2026-10-11T00:30:00Z" (got ${JSON.stringify(v)})`);
   return v;
 }
+function parseBrokerCommit(v) {
+  if (v === void 0) return void 0;
+  if (!/^[0-9a-f]{40}$/i.test(v)) throw new Error(`read: --commit must be a full 40-character commit SHA (received '${v}')`);
+  return v;
+}
 function buildRunListSpec(o) {
   const args = withJson(withRepo(["run", "list"], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
   const workflow = parseBrokerWorkflow(o.workflow);
   if (workflow) args.push("--workflow", workflow);
   const branch = parseBrokerBranch(o.branch);
   if (branch) args.push("--branch", branch);
+  const commit = parseBrokerCommit(o.commit);
+  if (commit) args.push("--commit", commit);
   const status = parseBrokerRunStatus(o.status);
   if (status) args.push("--status", status);
   const created = parseBrokerCreated(o.created);
@@ -54895,7 +55029,7 @@ async function runBrokerGh(run, spec, write = (chunk) => process.stdout.write(ch
     return 0;
   } catch (e) {
     const err = e;
-    if (typeof err.stdout === "string" && err.stdout) write(redactPrivateCredential(err.stdout, env));
+    if (typeof err.stdout === "string" && err.stdout) process.stderr.write(redactPrivateCredential(err.stdout, env));
     const code = ghExitCodeOf(e);
     if (code !== null) {
       if (typeof err.stderr === "string" && err.stderr) process.stderr.write(redactPrivateCredential(err.stderr, env));
@@ -55002,7 +55136,7 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
     }
     await dispatchGh(spec, "read run view");
   });
-  run.command("list").description("list workflow runs (workflow/branch/status/created/limit/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--workflow <name>", "filter by workflow name or file", workflowOpt).option("--branch <name>", "filter by branch", branchOpt).option("--status <status>", "filter by run status", runStatusOpt).option("--created <filter>", 'only runs created in this window, e.g. ">=2026-10-11T00:30:00Z" (#8096)', (v) => parseBrokerCreated(v)).option("--limit <n>", "maximum runs to fetch (1-100)", intOpt("--limit", 1, 100)).action(async (o) => {
+  run.command("list").description("list workflow runs (workflow/branch/commit/status/created/limit/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--workflow <name>", "filter by workflow name or file", workflowOpt).option("--branch <name>", "filter by branch", branchOpt).option("--commit <sha>", "filter by the full 40-character head commit SHA (#8937)", (v) => parseBrokerCommit(v)).option("--status <status>", "filter by run status", runStatusOpt).option("--created <filter>", 'only runs created in this window, e.g. ">=2026-10-11T00:30:00Z" (#8096)', (v) => parseBrokerCreated(v)).option("--limit <n>", "maximum runs to fetch (1-100)", intOpt("--limit", 1, 100)).action(async (o) => {
     let spec;
     try {
       spec = buildRunListSpec(o);
@@ -55021,13 +55155,16 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
     await dispatchGh(spec, "read run watch");
   });
   const pr = read.command("pr").description("pull-request reads \u2014 view/list/diff ride gh; queue uses fixed GraphQL; checks is REST-backed (deterministic closed-custody adapter; native was EMPTY only on the historical #3035 fixture)");
-  pr.command("list").description("list viewer-free PRs (author/viewer filters stay personal)").requiredOption("--repo <owner/repo>", "target repo", repoOpt).option("--json [fields]", "native gh JSON fields", jsonOpt).addOption(new Option("--state <state>", "open|closed|merged|all").choices(["open", "closed", "merged", "all"])).option("--base <branch>", "base branch", branchOpt).option("--head <branch>", "head branch", branchOpt).option("--label <label>", "filter by label", labelOpt).option("--search <query>", "viewer-free search", (v) => parseBrokerPrSearch(v)).option("--assignee <login>", "explicit assignee (viewer refused)", assigneeOpt).option("--limit <n>", "maximum PRs (1-100)", intOpt("--limit", 1, 100)).action(async (o) => {
+  pr.command("list").description("list viewer-free PRs (author/viewer filters stay personal)").option("--repo <owner/repo>", "target repo (required \u2014 no git-origin default)", repoOpt).option("--json [fields]", "native gh JSON fields", jsonOpt).addOption(new Option("--state <state>", "open|closed|merged|all").choices(["open", "closed", "merged", "all"])).option("--base <branch>", "base branch", branchOpt).option("--head <branch>", "head branch", branchOpt).option("--label <label>", "filter by label", labelOpt).option("--search <query>", "viewer-free search", (v) => parseBrokerPrSearch(v)).option("--assignee <login>", "explicit assignee (viewer refused)", assigneeOpt).option("--limit <n>", "maximum PRs (1-100)", intOpt("--limit", 1, 100)).action(async (o) => {
+    if (!o.repo) return fail(missingBrokerPrRepoMessage("list"));
     await dispatchGh(buildPrListSpec(o), "read pr list");
   });
-  pr.command("diff").description("read a bounded PR diff on the App pool").requiredOption("--repo <owner/repo>", "target repo", repoOpt).option("--name-only", "only changed file names").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+  pr.command("diff").description("read a bounded PR diff on the App pool").option("--repo <owner/repo>", "target repo (required \u2014 no git-origin default)", repoOpt).option("--name-only", "only changed file names").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+    if (!o.repo) return fail(missingBrokerPrRepoMessage("diff", number));
     await dispatchGh(buildPrDiffSpec(number, o), "read pr diff");
   });
-  pr.command("queue").description("read one PR mergeQueueEntry (fixed GraphQL query, no permission widening)").requiredOption("--repo <owner/repo>", "target repo", repoOpt).option("--json", "machine-readable mergeQueueEntry (null when not queued)").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+  pr.command("queue").description("read one PR mergeQueueEntry (fixed GraphQL query, no permission widening)").option("--repo <owner/repo>", "target repo (required \u2014 no git-origin default)", repoOpt).option("--json", "machine-readable mergeQueueEntry (null when not queued)").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+    if (!o.repo) return fail(missingBrokerPrRepoMessage("queue", number));
     const spec = buildPrQueueSpec(number, o);
     requireBrokerApp("read pr queue");
     try {
@@ -55160,9 +55297,13 @@ var RELEASE_LATEST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/latest$`);
 var RELEASE_TAG_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/tags/(${NAME})$`);
 var RELEASE_ASSET_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/assets/\\d+$`);
 var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
+var API_GET_RECOVERY = " No other GET read exists \u2014 do not retry path variants; use a dedicated mmi-cli subcommand or ask a human token holder. This refusal exits 1 on stderr with nothing on stdout: check the exit code and never merge stderr into stdout (2>&1) before JSON-parsing.";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
-  const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
+  const refuse = () => {
+    const hint = /^[A-Za-z]:[/\\]/.test(path2) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
+    return new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.${API_GET_RECOVERY}${hint}`);
+  };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
   const q = path2.indexOf("?");
   const base = q === -1 ? path2 : path2.slice(0, q);
@@ -55183,7 +55324,7 @@ function parseApiGetPath(rawPath) {
   if (CONTENTS_BASE_RE.test(base) && (query === "" || CONTENTS_QUERY_RE.test(query))) {
     return { kind: "contents", path: path2, paginate: false };
   }
-  throw new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
+  throw refuse();
 }
 var ZIP_TIMEOUT_MS = 12e4;
 var ZIP_MAX_BUFFER = 512 * 1024 * 1024;
@@ -59180,7 +59321,7 @@ ci.command("reconcile").description("audit + optionally apply merge settings and
   }
   const deps = ciAuditDeps2();
   const audit = await auditOrgCi(deps, o.repo);
-  const applyResults = o.apply ? await Promise.all(audit.repos.map((r) => applyCiReconcileRepo(r.repo, deps))) : o.parkRuleset ? await Promise.all(audit.repos.map((r) => parkProductRuleset(r.repo, deps))) : [];
+  const applyResults = o.apply ? await Promise.all(audit.repos.filter((r) => !r.excludedReason).map((r) => applyCiReconcileRepo(r.repo, deps))) : o.parkRuleset ? await Promise.all(audit.repos.filter((r) => !r.excludedReason).map((r) => parkProductRuleset(r.repo, deps))) : [];
   const payload = { audit, apply: applyResults };
   if (o.json) console.log(JSON.stringify(payload, null, 2));
   else {
@@ -59511,6 +59652,7 @@ function printHouseRootHelp(house) {
   consoleIo.log(lines2.join("\n"));
 }
 resolveVerbAliasShim(process.argv);
+normalizeWorkboardClaimArgv(process.argv);
 resolveHouseShim(process.argv);
 normalizeBoardClaimIssueArgv(process.argv);
 program2.parseAsync(process.argv).then(() => finishCliRun()).catch((e) => failGraceful(e.message));