@mutmutco/claude-plugin 4.6.3 → 4.6.5

package/cli/dist/main.cjs

@@ -400,7 +400,7 @@ function isFilingWriteApi(rest) {
     }
   }
   if (method === "POST" && path2 && /^repos\/[^/]+\/[^/]+\/(issues|pulls)$/.test(path2)) return true;
-  if (method === "PUT" && path2 && /^repos\/[^/]+\/[^/]+\/pulls\/\d+\/merge$/.test(path2)) return true;
+  if (method === "PUT" && path2 && /^repos\/[^/]+\/[^/]+\/pulls\/\d+\/merge(-async)?$/.test(path2)) return true;
   return false;
 }
 function isViewerFreeGhRead(args) {
@@ -1216,6 +1216,8 @@ var init_house_map = __esm({
       // personal and App allowance visibility
       api: "devops",
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
+      run: "devops",
+      // #9479: one named workflow run — currently the bounded `run cancel <id>` write
       ci: "devops",
       // the CI/gate audit
       jev: "devops",
@@ -1353,6 +1355,7 @@ __export(cli_shared_exports, {
   fail: () => fail,
   failGraceful: () => failGraceful,
   failGracefulEnvelope: () => failGracefulEnvelope,
+  ghFilingAppEnv: () => ghFilingAppEnv,
   gitOut: () => gitOut,
   githubLogin: () => githubLogin,
   hubHeaders: () => hubHeaders,
@@ -1383,10 +1386,10 @@ function setGhReadTokenProvider(provider) {
 function setGhWriteTokenProvider(provider) {
   ghWriteTokenProvider = provider;
 }
-async function ghFilingAppEnv(file, args) {
-  if (!ghWriteTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || process.env.MMI_ACTOR?.trim() === "personal") return void 0;
+async function ghFilingAppEnv(file, args, requireApp = false) {
+  if (!ghWriteTokenProvider || !/(^|[\\/])gh(\.exe)?$/i.test(file) || !requireApp && process.env.MMI_ACTOR?.trim() === "personal") return void 0;
   if (!isAppFilingWrite(args)) return void 0;
-  const explicitApp = process.env.MMI_ACTOR?.trim() === "app";
+  const explicitApp = requireApp || process.env.MMI_ACTOR?.trim() === "app";
   let token;
   try {
     token = await ghWriteTokenProvider();
@@ -1599,16 +1602,26 @@ var init_cli_shared = __esm({
         rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options, ...env ? { env } : {} })
       );
       const appEnv = options.env ? void 0 : await ghReadAppEnv(file, args) ?? await ghFilingAppEnv(file, args);
+      const reportsCredential = !options.env && /(^|[\\/])gh(\.exe)?$/i.test(file) && isAppFilingWrite(args);
+      const tag = async (call, credential) => {
+        if (!reportsCredential) return call;
+        try {
+          return { ...await call, credential };
+        } catch (e) {
+          if (e && typeof e === "object") e.credential = credential;
+          throw e;
+        }
+      };
       if (/(^|[\\/])gh(\.exe)?$/i.test(file) && args[0] !== "auth") {
         const callerEnv = options.env;
         const pool = appEnv ? "app" : !callerEnv ? ambientPool() : !callerEnv.GH_TOKEN ? "personal" : callerEnv.MMI_GH_POOL === "app" ? "app" : callerEnv.GH_TOKEN === process.env.GH_TOKEN ? ambientPool() : "caller";
         recordGhUsage("gh", pool, args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" "));
       }
-      if (!appEnv) return run();
+      if (!appEnv) return tag(run(), options.env?.MMI_GH_POOL === "app" ? "app_installation" : "user");
       try {
-        return await run(appEnv);
+        return await tag(run(appEnv), "app_installation");
       } catch (e) {
-        if (shouldRetryIntegrationRefusalOnAmbient(e)) return run();
+        if (shouldRetryIntegrationRefusalOnAmbient(e)) return tag(run(), "user");
         throw e;
       }
     };
@@ -15263,6 +15276,8 @@ async function mintInstallationToken(deps) {
 }
 var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
   ["ci cancel-orphans", { metadata: "read", actions: "write" }],
+  // #9479: one named run cancelled under the same actions:write profile as the orphan sweep.
+  ["run cancel", { metadata: "read", actions: "write" }],
   ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }],
   // #8401: the detached related-issue lookup (issue list/view reads + one marker comment) — no identity contract.
   ["issue discover-related", { metadata: "read", issues: "write" }]
@@ -15953,9 +15968,6 @@ var REST_GH_TIMEOUT_MS = 2e4;
 var pollTokenProvider;
 var pollTokenOnce;
 var lastPollSource;
-function lastRestPollSource() {
-  return lastPollSource;
-}
 function setPollTokenProvider(provider) {
   pollTokenProvider = provider;
   pollTokenOnce = void 0;
@@ -16798,6 +16810,30 @@ async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
 }
 
 // src/claim-marker-client.ts
+var claimWriteTokenProvider;
+var claimWriteTokenOnce;
+function setClaimWriteTokenProvider(provider) {
+  claimWriteTokenProvider = provider;
+  claimWriteTokenOnce = void 0;
+}
+async function selectClaimWriteClient(client, appClient) {
+  if (appClient) return appClient;
+  if (!claimWriteTokenProvider) return client;
+  let token;
+  try {
+    claimWriteTokenOnce ??= claimWriteTokenProvider();
+    token = await claimWriteTokenOnce;
+  } catch (e) {
+    claimWriteTokenOnce = void 0;
+    const detail = e instanceof Error ? e.message : String(e);
+    throw new Error(`${detail} \u2014 refusing personal-token fallback for claim write (#9511)`);
+  }
+  if (!token) {
+    claimWriteTokenOnce = void 0;
+    throw new Error("app actor: claim write token unavailable \u2014 refusing personal-token fallback for claim write (#9511)");
+  }
+  return createGitHubClient({ token: async () => token });
+}
 async function selectLivenessClient(client, appClient) {
   if (appClient) return appClient;
   let token;
@@ -21309,7 +21345,7 @@ async function loadConfigForBoardSelector(selector, repoOption) {
 var SKILL_LESSON_LABEL = "skill-lesson";
 var SKILL_LESSON_FILE_LABELS = [SKILL_LESSON_LABEL, LEARNING_LABEL2];
 var SKILL_LESSON_LOOP_KIND = "lesson";
-var SKILL_NAMES = ["board", "bootstrap", "epic", "hotfix", "rcand", "release", "secrets"];
+var SKILL_NAMES = ["board", "bootstrap", "epic", "hotfix", "intercom-guest", "mmi-help", "org-guide", "rcand", "release", "secrets"];
 function assertSkillName(name) {
   const match = SKILL_NAMES.find((skill) => skill === name);
   if (!match) throw new Error(`unknown skill "${name}" \u2014 expected one of: ${SKILL_NAMES.join(", ")}`);
@@ -21342,6 +21378,9 @@ function findDuplicateLesson(source, openLessons) {
 // src/board-doctor-config.ts
 init_github_client();
 
+// src/issue-comment.ts
+init_github_client();
+
 // src/sub-issue.ts
 init_error_codes();
 init_github_quota();
@@ -21551,6 +21590,40 @@ function parentLinkFields(result, error, parentRef, childRef, reason = "failed")
 }
 
 // src/issue-comment.ts
+async function editIssueComment(client, input) {
+  const parsed = parseIssueRef(input.ref);
+  const repo = parsed.repo ?? input.defaultRepo;
+  if (!repo) throw new Error("could not resolve repo \u2014 pass --repo owner/repo");
+  if (!input.replace.length) throw new Error("--replace must not be empty; use --edit <commentId> --replace <text> --with <text>");
+  if (!/^\d+$/.test(input.commentId)) throw new Error(`--edit takes a numeric comment id, got: ${input.commentId}`);
+  const path2 = `repos/${repo}/issues/comments/${input.commentId}`;
+  let comment;
+  try {
+    comment = await client.rest("GET", path2);
+  } catch (e) {
+    if (e instanceof GitHubApiError && e.status === 404) {
+      throw new Error(`comment ${input.commentId} does not exist on ${repo}`);
+    }
+    throw e;
+  }
+  const expectedAnchor = `/issues/${parsed.number}#issuecomment-${input.commentId}`;
+  if (!comment.html_url?.toLowerCase().endsWith(expectedAnchor.toLowerCase())) {
+    throw new Error(`comment ${input.commentId} is not a comment on ${repo}#${parsed.number} (it lives at ${comment.html_url ?? "unknown"})`);
+  }
+  const body = comment.body ?? "";
+  const count = body.split(input.replace).length - 1;
+  if (count !== 1) throw new Error(`--replace must match exactly once; found ${count} occurrences in comment ${input.commentId}`);
+  const index = body.indexOf(input.replace);
+  const newBody = body.slice(0, index) + input.with + body.slice(index + input.replace.length);
+  await client.rest("PATCH", path2, { body: { body: newBody } });
+  return {
+    number: parsed.number,
+    repo,
+    url: `https://github.com/${repo}/issues/${parsed.number}`,
+    commentUrl: comment.html_url,
+    edited: true
+  };
+}
 async function postIssueComment(client, input) {
   const parsed = parseIssueRef(input.ref);
   const repo = parsed.repo ?? input.defaultRepo;
@@ -22059,9 +22132,12 @@ function detailCandidates(report, options = {}) {
   const scopes = [report.primary, report.secondary];
   return scopes.flatMap((scope) => options.all ? [...scope.userOwned, ...scope.claimable, ...scope.taken, ...scope.unownedInFlight] : [...scope.userOwned, ...scope.claimable]).filter((item) => item.contentType === "Issue");
 }
+function boardNotFoundRemedy(board, repoExplicit) {
+  return repoExplicit ? `--repo already names the repo, so inspect the repo's registered board coordinates with \`mmi-cli oracle org project get <owner/repo>\` (resolved board: ${board.owner} #${board.number})` : "if it lives on a different board, pass --repo <owner/repo> for the repo that owns it";
+}
 function boardNotFoundError(ref, board, opts = {}) {
   const verb = opts.verb ?? "is not on";
-  const remedy = opts.remedy ?? "if it lives on a different board, pass --repo <owner/repo> for the repo that owns it";
+  const remedy = opts.remedy ?? boardNotFoundRemedy(board, opts.repoExplicit === true);
   return new Error(`${ref} ${verb} the ${board.owner} #${board.number} board; ${remedy}`);
 }
 var NotClaimableError = class extends Error {
@@ -22489,7 +22565,7 @@ async function showBoardItem(options, deps = {}) {
   const currentRepo = await resolveCurrentRepo(options, deps);
   const selector = parseIssueSelector(options.selector, currentRepo, options.repo);
   const { item } = await fetchIssueProjectItem(client, cfg, selector);
-  if (!item) throw boardNotFoundError(`${selector.repo}#${selector.number}`, { owner: cfg.projectOwner, number: cfg.projectNumber });
+  if (!item) throw boardNotFoundError(`${selector.repo}#${selector.number}`, { owner: cfg.projectOwner, number: cfg.projectNumber }, { repoExplicit: options.repo !== void 0 });
   if (item.contentType === "Issue") {
     try {
       item.details = await fetchIssueDetails(client, item.repository, item.number);
@@ -23319,7 +23395,7 @@ function isSameBranchClaimResume(contest, repo, landing = {}) {
   const headBranch = landing.headBranch?.replace(/^refs\/heads\//, "").replace(/^[^/:]+:/, "").trim();
   const headSha = landing.headSha?.trim();
   if (!headBranch && !headSha) return false;
-  if (!contest.marker || contest.unverifiable.length > 0 || contest.live.length === 0) return false;
+  if (contest.unverifiable.length > 0 || contest.live.length === 0) return false;
   const branchLine = /^live branch ([^\s]+) on /;
   const fromContest = contest.branch?.replace(/ \(head of open PR .*\)$/, "").trim();
   const fromLive = contest.live.map((line) => branchLine.exec(line)?.[1]).find(Boolean);
@@ -23360,7 +23436,9 @@ async function checkLaneContest(client, item, actor = describeSessionIdentity(),
     branchSha: evidence.branchSha
   }, item.repository, landing)) {
     contested = false;
-    resume = `same-branch resume over live branch ${evidence.branch ?? landing.headBranch}`;
+    if (evidence.marker) {
+      resume = `same-branch resume over live branch ${evidence.branch ?? landing.headBranch}`;
+    }
   }
   const carry = staleWorkLines(evidence);
   const staleStamp = !contested && !resume && !ownSeat && evidence.marker ? `stale claim stamp ${describeClaimMarker(evidence.marker)} (idle ${formatClaimAge(claimStampStaleness(evidence.marker, { activityAt: [evidence.lastCommentAt] }).idleMs)})${carry.length ? `; continue its ${carry.join(" and ")}` : ""}` : void 0;
@@ -23426,7 +23504,7 @@ async function moveBoardItem(options, deps = {}) {
   const lookup = await fetchIssueProjectItem(client, cfg, selector);
   const item = lookup.item;
   if (!item) {
-    throw boardNotFoundError(`${selector.repo}#${selector.number}`, { owner: cfg.projectOwner, number: cfg.projectNumber });
+    throw boardNotFoundError(`${selector.repo}#${selector.number}`, { owner: cfg.projectOwner, number: cfg.projectNumber }, { repoExplicit: options.repo !== void 0 });
   }
   const optionId = cfg.statusOptions[options.status];
   let credential = "user";
@@ -23529,6 +23607,9 @@ async function prepareClaimContext(options, selectors, deps, collected, snapshot
   return {
     cfg,
     client,
+    appClient: deps.appClient,
+    git: deps.git ?? defaultGit,
+    landing: deps.landing,
     items: collected.items,
     selectedRefs: new Set(selectors.map((selector) => `${selector.repo}#${selector.number}`.toLowerCase())),
     writable: writableOrUnknown(writable),
@@ -23621,7 +23702,7 @@ async function claimOneBoardItem(ctx, selector, options) {
   if (!verdict.ok) throw new NotClaimableError(verdict.reason, { ref: fresh.ref, status: fresh.status });
   item = fresh;
   const refuseIfContested = async () => {
-    const contest = await checkLaneContest(client, item, ctx.session, report.viewer);
+    const contest = await checkLaneContest(client, item, ctx.session, report.viewer, ctx.appClient, ctx.landing);
     resumeEvidence = void 0;
     staleStamp = void 0;
     const displaced = () => ({
@@ -23632,6 +23713,24 @@ async function claimOneBoardItem(ctx, selector, options) {
         host: contest.marker.host
       } : {}
     });
+    if (contest.contested && !ctx.landing && contest.branch) {
+      const candidateBranch = contest.branch.replace(/ \(head of open PR .*\)$/, "").trim();
+      const originRepo = repoFromRemoteUrl(await ctx.git(["remote", "get-url", "origin"]).catch(() => ""));
+      if (originRepo && originRepo.toLowerCase() === item.repository.toLowerCase()) {
+        const localSha = (await ctx.git(["rev-parse", "--verify", `refs/heads/${candidateBranch}^{commit}`]).catch(() => "")).trim();
+        const currentBranch2 = (await ctx.git(["symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => "")).trim();
+        if (localSha && (!contest.branchSha || localSha === contest.branchSha) || currentBranch2 === candidateBranch) {
+          const localLanding = { headBranch: candidateBranch, ...localSha ? { headSha: localSha } : {} };
+          if (isSameBranchClaimResume(contest, item.repository, localLanding)) {
+            if (contest.marker) {
+              resumeEvidence = `same-branch resume over live branch ${contest.branch}`;
+              previousHolder = displaced();
+            }
+            return;
+          }
+        }
+      }
+    }
     if (!contest.contested) {
       if (contest.resume && contest.marker) {
         resumeEvidence = contest.resume;
@@ -23643,10 +23742,14 @@ async function claimOneBoardItem(ctx, selector, options) {
       return;
     }
     if (!options.force) {
+      if (options.bulk) {
+        const { holder: holder2, why } = laneContestParts(contest);
+        throw new Error(isUnknownHold(contest) ? `${item.ref} cannot be verified as free: ${holder2} (${why}); the liveness reads failed so the claim is refused fail-closed \u2014 ${CONTESTED_CLAIM_RECOVERY}` : `${item.ref} is already claimed by ${holder2} with live evidence of active work (${why}); ${CONTESTED_CLAIM_RECOVERY}`);
+      }
       const candidateRefs = [...report.primary.claimable, ...report.secondary.claimable].filter((candidate) => candidate.contentType === "Issue" && candidate.state === "OPEN" && !candidate.claim?.currentlyClaimed && !ctx.selectedRefs.has(candidate.ref.toLowerCase())).map((candidate) => candidate.ref);
       const alternatives = candidateRefs.length ? `Board snapshot candidates (not guaranteed free): ${candidateRefs.join(", ")}` : "Board snapshot candidates: none in this read";
       const refusal = `${laneContestMessage(item.ref, contest, "claim")}. ${alternatives}; refresh mmi-cli oracle board read before claiming.`;
-      throw new Error(options.bulk ? refusal : withGatedWriteChainHint(refusal));
+      throw new Error(withGatedWriteChainHint(refusal));
     }
     previousHolder = displaced();
   };
@@ -23655,19 +23758,21 @@ async function claimOneBoardItem(ctx, selector, options) {
     if (options.check) {
       return { item, viewer: report.viewer, repo: report.repo, status: "In Progress", partial: false, ...heldReceipt(), alreadyClaimed: true, checked: true };
     }
-    const renewed = await postClaimMarkerComment(client, item, ctx.session, staleStamp);
+    const appWriter2 = await selectClaimWriteClient(client, ctx.appClient);
+    const renewed = await postClaimMarkerComment(appWriter2, item, ctx.session, staleStamp);
     return { item, viewer: report.viewer, repo: report.repo, status: "In Progress", partial: false, ...heldReceipt(), alreadyClaimed: true, renewed };
   }
   if (options.check) {
     return { item, viewer: report.viewer, repo: report.repo, status: item.status, partial: false, ...claimedReceipt(), checked: true };
   }
   await refuseIfContested();
+  const appWriter = await selectClaimWriteClient(client, ctx.appClient);
   try {
-    await client.rest("POST", `repos/${item.repository}/issues/${item.number}/assignees`, { body: { assignees: [assignedLogin] } });
+    await appWriter.rest("POST", `repos/${item.repository}/issues/${item.number}/assignees`, { body: { assignees: [assignedLogin] } });
   } catch (e) {
     throw new Error(`claim failed before board status changed: ${ghError(e)}`);
   }
-  await postClaimMarkerComment(client, item, ctx.session, staleStamp);
+  await postClaimMarkerComment(appWriter, item, ctx.session, staleStamp);
   let credential = "user";
   try {
     ({ credential } = await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.statusFieldId, cfg.statusOptions["In Progress"]));
@@ -23699,6 +23804,13 @@ async function claimBoardIssue(options, deps = {}) {
   const result = await claimOneBoardItem(ctx, selector, options);
   return ctx.report.warnings.length ? { ...result, warnings: [...ctx.report.warnings] } : result;
 }
+function formatBulkClaimSummary(results) {
+  const skipped = results.filter((r) => !r.claimed);
+  if (skipped.length === 0) return void 0;
+  const landed = results.filter((r) => r.claimed).map((r) => r.ref);
+  const notClaimed = skipped.map((r) => `${r.ref}${/already claimed by /i.test(r.reason) ? " (held by another lane)" : ""}`);
+  return `claimed ${landed.length} of ${results.length}: ${landed.length ? `${landed.join(", ")} landed` : "none landed"}; not claimed: ${notClaimed.join(", ")}`;
+}
 async function claimBoardIssues(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
   const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
@@ -23828,7 +23940,7 @@ async function unclaimBoardIssue(options, deps = {}) {
   const selector = parseIssueSelector(options.selector, currentRepo, options.repo);
   const { viewer, item } = await fetchIssueProjectItem(client, cfg, selector);
   if (!item) {
-    throw boardNotFoundError(`${selector.repo}#${selector.number}`, { owner: cfg.projectOwner, number: cfg.projectNumber });
+    throw boardNotFoundError(`${selector.repo}#${selector.number}`, { owner: cfg.projectOwner, number: cfg.projectNumber }, { repoExplicit: options.repo !== void 0 });
   }
   const toStatus = options.toStatus ?? "Todo";
   if (item.contentType === "Issue") {
@@ -23846,8 +23958,9 @@ async function unclaimBoardIssue(options, deps = {}) {
       }
     }
   }
+  const appWriter = await selectClaimWriteClient(client, deps.appClient);
   try {
-    await client.rest("DELETE", `repos/${item.repository}/issues/${item.number}/assignees`, {
+    await appWriter.rest("DELETE", `repos/${item.repository}/issues/${item.number}/assignees`, {
       body: { assignees: item.assignees }
     });
   } catch (e) {
@@ -23864,7 +23977,7 @@ async function unclaimBoardIssue(options, deps = {}) {
       host: actor.host,
       ts: (/* @__PURE__ */ new Date()).toISOString()
     };
-    await postIssueComment(client, { ref: item.ref, body: renderClaimReleaseBody(release) });
+    await postIssueComment(appWriter, { ref: item.ref, body: renderClaimReleaseBody(release) });
   } catch (e) {
     process.stderr.write(`warning: ${item.ref} was unclaimed, but recording the release marker comment failed: ${ghError(e)}
 `);
@@ -27287,10 +27400,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.3",
-    tag: "v4.6.3",
-    commit: "602adde0ce4c",
-    npm: "@mutmutco/cli@4.6.3"
+    version: "4.6.5",
+    tag: "v4.6.5",
+    commit: "cd6f8a959ed5",
+    npm: "@mutmutco/cli@4.6.5"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27307,14 +27420,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.3"
+          v3Target: "v4.6.5"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.3 and redeploy the Hub Lambda from tag v4.6.3 (602adde0ce4c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.3 (@mutmutco/cli@4.6.3, tag commit 602adde0ce4c \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.5 and redeploy the Hub Lambda from tag v4.6.5 (cd6f8a959ed5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.5 (@mutmutco/cli@4.6.5, tag commit cd6f8a959ed5 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -28993,16 +29106,16 @@ async function writeFleetLockstepRuleset(client, body, liveId, target, org) {
     await client.rest("PUT", `orgs/${org}/rulesets/${liveId}`, { body, timeoutMs: 2e4 });
   }
   const read = await fetchFleetLockstepRuleset(client, org);
-  const settled = read.kind === "ok" ? read.ruleset : void 0;
-  const shapeDrift = settled ? diffFleetLockstepShape(settled) : [`ruleset '${FLEET_LOCKSTEP_RULESET_NAME}' absent after apply`];
-  const includeSettled = settled ? sameSetCi(settled.conditions?.repository_name?.include, body.conditions.repository_name.include) : false;
-  const enforcementSettled = settled?.enforcement === body.enforcement;
+  const settled2 = read.kind === "ok" ? read.ruleset : void 0;
+  const shapeDrift = settled2 ? diffFleetLockstepShape(settled2) : [`ruleset '${FLEET_LOCKSTEP_RULESET_NAME}' absent after apply`];
+  const includeSettled = settled2 ? sameSetCi(settled2.conditions?.repository_name?.include, body.conditions.repository_name.include) : false;
+  const enforcementSettled = settled2?.enforcement === body.enforcement;
   if (shapeDrift.length || !includeSettled || !enforcementSettled) {
     throw new Error(`fleet lockstep ruleset apply did not settle: ${[...shapeDrift, includeSettled ? "" : "include list differs", enforcementSettled ? "" : "enforcement differs"].filter(Boolean).join("; ")}`);
   }
   return {
     action: liveId == null ? "created" : "updated",
-    id: settled?.id,
+    id: settled2?.id,
     target,
     include: body.conditions.repository_name.include,
     verified: true
@@ -40015,7 +40128,7 @@ var PRIMARY_GROUPS = [
   ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
 var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["oauth", "org", "runtime", "plugin", "packages", "github", "archive-prune", "intercom", "jev"]);
-var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup", "read"]);
+var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup", "read", "run"]);
 var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "dist", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
 var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
@@ -40061,6 +40174,8 @@ var COMMAND_OWNERSHIP = {
   api: { module_owner: "cli/src/api-read.ts", consumer: "agent-workflow" },
   github: { module_owner: "cli/src/github-budget.ts", consumer: "release-operator" },
   read: { module_owner: "cli/src/app-read-broker.ts", consumer: "agent-workflow" },
+  run: { module_owner: "cli/src/merge-group-orphans.ts", consumer: "agent-workflow" },
+  // #9479
   ci: { module_owner: "cli/src/ci-audit.ts", consumer: "release-operator" },
   rcand: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
   release: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
@@ -41025,14 +41140,23 @@ function parseScope(value) {
 function trailerBlockBreak(body, line) {
   const lines2 = String(body ?? "").split(/\r?\n/);
   const at = lines2.findIndex((candidate) => candidate.trim() === line);
-  if (at === -1) return "";
+  if (at === -1) return { after: "", before: "" };
   for (let i = at + 1; i < lines2.length; i += 1) {
     const next = lines2[i];
     if (!next.trim()) continue;
-    if (/^[A-Za-z][A-Za-z0-9-]*:\s/.test(next)) return "";
-    return next.trim();
+    if (/^[A-Za-z][A-Za-z0-9-]*:\s/.test(next)) return { after: "", before: "" };
+    return { after: next.trim(), before: "" };
   }
-  return "";
+  let paraStart = at;
+  while (paraStart > 0 && lines2[paraStart - 1].trim() !== "") {
+    paraStart -= 1;
+  }
+  for (let i = paraStart; i < at; i += 1) {
+    const prev = lines2[i];
+    if (/^[A-Za-z][A-Za-z0-9-]*:\s/.test(prev) || /^[ \t]+\S/.test(prev)) continue;
+    return { after: "", before: prev.trim() };
+  }
+  return { after: "", before: "" };
 }
 function clipParagraph(line) {
   const flat = String(line).trim().replace(/\s+/g, " ");
@@ -41040,6 +41164,11 @@ function clipParagraph(line) {
 }
 function invisibleTrailer(sha, line, body = "") {
   const broken = trailerBlockBreak(body, line);
+  const brokenDiagnostic = broken.after ? `  Broken by the paragraph after the trailer-shaped line, which ends git's final block:
+    ${clipParagraph(broken.after)}
+` : broken.before ? `  Broken by the non-trailer line before the trailer-shaped line, which prevents git from recognizing the final block:
+    ${clipParagraph(broken.before)}
+` : "  The trailer-shaped line is not in the message's FINAL `Key: value` block \u2014 prose or an\n  unindented wrap either before or after it ends that block.\n";
   return {
     kind: "malformed-override-trailer",
     paths: [],
@@ -41055,9 +41184,7 @@ function invisibleTrailer(sha, line, body = "") {
   The nearest waiver wins, and it supersedes this one \u2014 no force-push, no re-filed branch.
   Diagnosis: git parsed no ${TRAILER_KEY} trailer for ${sha.slice(0, 8)} at all \u2014 read its own view first:
     git log -1 --format='%(trailers)' ${sha.slice(0, 8)}
-` + (broken ? `  Broken by the paragraph after the trailer-shaped line, which ends git's final block:
-    ${clipParagraph(broken)}
-` : "  The trailer-shaped line is not in the message's FINAL `Key: value` block \u2014 prose or an\n  unindented wrap either before or after it ends that block.\n") + `  Forward fix, no hand-reformatting \u2014 let git build the block from one message:
+` + brokenDiagnostic + `  Forward fix, no hand-reformatting \u2014 let git build the block from one message:
     git commit --allow-empty --trailer "${TRAILER_KEY}: <reason>"
   That commit's message IS a valid final trailer block, so it is the nearest (winning) waiver.`
   };
@@ -41595,6 +41722,31 @@ ${commit.body}`.trim();
   if (!overrides.length) return null;
   return [...bodies, [...overrides, ...coauthors].join("\n")].join("\n\n");
 }
+function prBodyTrailerSource(prBody) {
+  const lines2 = prBody.split("\n");
+  const separator = lines2.findIndex((line) => GH_MESSAGE_SEPARATOR.test(line.trim()));
+  return separator === -1 ? prBody : lines2.slice(0, separator).join("\n");
+}
+function prBodyPreservesCommitOverrides(commits, headline, prBody, cwd) {
+  const key = `${TRAILER_KEY.toLowerCase()}:`;
+  const required = [];
+  for (const commit of commits) {
+    for (const trailer of parseTrailers(`${commit.headline}
+
+${commit.body}`.trim(), cwd)) {
+      const normalized = trailer.toLowerCase();
+      if (normalized.startsWith(key) && !required.includes(normalized)) required.push(normalized);
+    }
+  }
+  if (!required.length) return true;
+  const source = prBodyTrailerSource(prBody);
+  const recognized = parseTrailers(`${headline}
+
+${source}`.trim(), cwd).map((trailer) => trailer.toLowerCase()).filter((trailer) => trailer.startsWith(key));
+  const textual = (source.match(/^Test-Policy-Override:\s*\S/gim) ?? []).length;
+  if (textual !== recognized.length) return false;
+  return required.every((trailer) => recognized.includes(trailer));
+}
 function resolveBase(cwd, explicit) {
   const candidates = [explicit, process.env.TEST_POLICY_BASE, "origin/development", "origin/main"].filter(Boolean);
   for (const ref of candidates) {
@@ -41797,7 +41949,17 @@ async function hasPrMergeQueue(repo, base, gh2 = readApi) {
   if (result.mergeQueue === void 0) throw new Error(`merge queue policy unreadable for ${repo}:${base}`);
   return result.mergeQueue !== null;
 }
-var writeApi = async (args) => (await execFileP("gh", ["api", ...args], { timeout: GH_MUTATION_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 })).stdout;
+var writeApi = async (args) => {
+  const { stdout, credential } = await execFileP("gh", ["api", ...args], { timeout: GH_MUTATION_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 });
+  return { stdout, credential };
+};
+var autoMergeApi = async (pr, repo, head) => {
+  const args = ["pr", "merge", pr, "-R", repo, "--squash", "--auto", "--match-head-commit", head];
+  const env = await ghFilingAppEnv("gh", args, true);
+  if (!env) throw new Error("app actor: filing write token unavailable for merge-queue auto-merge fallback");
+  await execFileP("gh", args, { timeout: GH_MUTATION_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024, env });
+  return { credential: "app_installation" };
+};
 var ASYNC_HEADERS = ["-H", "Accept: application/vnd.github+json", "-H", "X-GitHub-Api-Version: 2026-03-10"];
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
 function admissionJournal(repo, pr, root) {
@@ -41813,23 +41975,31 @@ function admissionJournal(repo, pr, root) {
   const path2 = (number) => (0, import_node_path30.join)(directory, `${number}.jsonl`);
   const validate = (value, previous) => {
     const row = value;
-    if (!row || row.version !== 1 || row.repo !== repo.toLowerCase() || row.pr !== pr || !/^[a-f0-9]{40}$/i.test(row.head) || !UUID.test(row.intentId) || !Number.isSafeInteger(row.createdAt) || row.createdAt <= 0 || !Number.isSafeInteger(row.observedAt) || row.observedAt < row.createdAt || !["dispatching", "pending", "enqueued", "merged", "failed", "ejected"].includes(row.state) || row.uuid !== void 0 && !UUID.test(row.uuid) || row.state === "pending" && !row.uuid || row.queueEntry !== void 0 && (!row.queueEntry || typeof row.queueEntry.headCommitOid !== "string" || !/^[a-f0-9]{40}$/i.test(row.queueEntry.headCommitOid) || typeof row.queueEntry.enqueuedAt !== "string" || !Number.isFinite(Date.parse(row.queueEntry.enqueuedAt)))) {
+    if (!row || row.version !== 1 || row.repo !== repo.toLowerCase() || row.pr !== pr || !/^[a-f0-9]{40}$/i.test(row.head) || !UUID.test(row.intentId) || !Number.isSafeInteger(row.createdAt) || row.createdAt <= 0 || !Number.isSafeInteger(row.observedAt) || row.observedAt < row.createdAt || !["dispatching", "pending", "enqueued", "merged", "failed", "ejected"].includes(row.state) || row.credential !== void 0 && !["app_installation", "user"].includes(row.credential) || row.uuid !== void 0 && !UUID.test(row.uuid) || row.state === "pending" && !row.uuid || row.queueEntry !== void 0 && (!row.queueEntry || typeof row.queueEntry.headCommitOid !== "string" || !/^[a-f0-9]{40}$/i.test(row.queueEntry.headCommitOid) || typeof row.queueEntry.enqueuedAt !== "string" || !Number.isFinite(Date.parse(row.queueEntry.enqueuedAt)))) {
       throw new Error("queue admission receipt is invalid; preserve it and reconcile the prior request");
     }
     if (!previous) {
       if (row.state !== "dispatching" || row.uuid || row.queueEntry || row.observedAt !== row.createdAt) throw new Error("queue admission intent record is invalid");
-    } else if (row.head !== previous.head || row.intentId !== previous.intentId || row.createdAt !== previous.createdAt || row.observedAt < previous.observedAt || row.state === "dispatching" || previous.uuid && row.uuid !== previous.uuid || ["enqueued", "merged", "failed", "ejected"].includes(previous.state) && (row.state !== previous.state || row.uuid !== previous.uuid) && !(previous.state === "enqueued" && row.state === "ejected" && row.uuid === previous.uuid)) {
+    } else if (row.head !== previous.head || row.intentId !== previous.intentId || row.createdAt !== previous.createdAt || row.observedAt < previous.observedAt || row.state === "dispatching" || previous.uuid && row.uuid !== previous.uuid || previous.credential !== void 0 && row.credential !== previous.credential || ["enqueued", "merged", "failed", "ejected"].includes(previous.state) && (row.state !== previous.state || row.uuid !== previous.uuid) && !(previous.state === "enqueued" && row.state === "ejected" && row.uuid === previous.uuid)) {
       throw new Error("queue admission receipt has an illegal transition or changed operation identity");
     }
     return row;
   };
-  const load = () => {
+  const load = (number = attempt) => {
     let previous;
-    for (const line of (0, import_node_fs33.readFileSync)(path2(attempt), "utf8").trimEnd().split("\n")) previous = validate(JSON.parse(line), previous);
+    for (const line of (0, import_node_fs33.readFileSync)(path2(number), "utf8").trimEnd().split("\n")) previous = validate(JSON.parse(line), previous);
     return previous;
   };
   return {
     receipt: attempt ? load() : void 0,
+    /** #9504: the exact attempt this invocation selected, so a later attempt recorded at the same head can never supply its credential. */
+    findByIntentId(intentId) {
+      for (let number = 1; number <= attempt; number++) {
+        const receipt = load(number);
+        if (receipt.intentId === intentId) return receipt;
+      }
+      return void 0;
+    },
     create(head) {
       const createdAt = Date.now();
       const initial = { version: 1, repo: repo.toLowerCase(), pr, head, intentId: (0, import_node_crypto10.randomUUID)(), createdAt, observedAt: createdAt, state: "dispatching" };
@@ -41841,9 +42011,9 @@ function admissionJournal(repo, pr, root) {
       }
       return true;
     },
-    save(state, uuid, queueEntry) {
+    save(state, uuid, queueEntry, credential) {
       const previous = load();
-      const receipt = validate({ ...previous, state, observedAt: Date.now(), ...uuid ? { uuid } : {}, ...queueEntry ? { queueEntry } : {} }, previous);
+      const receipt = validate({ ...previous, state, observedAt: Date.now(), ...uuid ? { uuid } : {}, ...queueEntry ? { queueEntry } : {}, ...credential && previous.credential === void 0 ? { credential } : {} }, previous);
       (0, import_node_fs33.appendFileSync)(path2(attempt), JSON.stringify(receipt) + "\n", { flush: true });
       load();
     }
@@ -41866,6 +42036,21 @@ function admissionResponse(output) {
   }
   return { code: Number(response[1]), body: result };
 }
+function admissionRejected(reason) {
+  if (/enqueuer is not authorized to merge|not authorized to merge/i.test(reason)) {
+    return {
+      mergeStatus: "failed",
+      retryable: false,
+      admissionCause: "enqueuer-not-authorized",
+      error: `queue admission rejected (missing merge permission): ${reason}. The landing identity reported in \`credential\` may not merge into this base through the merge queue. Granting it (the GitHub App's merge permission, or a ruleset bypass) is a repository or organization setting only an admin can change; do not rerun pr land until that grant exists, and never fall back to a personal token.`
+    };
+  }
+  return {
+    mergeStatus: "failed",
+    retryable: false,
+    error: `queue admission rejected: ${reason}. Resolve the reported cause, then explicitly rerun pr land; it will repeat preflight before a new request.`
+  };
+}
 async function submitQueueAdmission(pr, repo, head, read, write, options, resume = false) {
   const unknown = (reason) => ({
     mergeStatus: "failed",
@@ -41873,11 +42058,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     outcomeUnknown: true,
     error: `queue submission outcome unknown: ${reason}. Preserve the receipt and rerun pr land to reconcile read-only; no new request was sent after this uncertainty.`
   });
-  const rejected = (reason) => ({
-    mergeStatus: "failed",
-    retryable: false,
-    error: `queue admission rejected: ${reason}. Resolve the reported cause, then explicitly rerun pr land; it will repeat preflight before a new request.`
-  });
+  const rejected = admissionRejected;
   const reconcile = async (reason, recordEntry = false) => {
     try {
       const observed = await readPrMergeQueue(pr, repo, read);
@@ -41889,6 +42070,22 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
         }
         return { mergeStatus: "auto-merge-enqueued" };
       }
+      const saved = recordEntry ? admissionJournal(repo, pr, options.receiptDirectory).receipt : void 0;
+      if (saved?.queueEntry && observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid === saved.head) {
+        const enqueuedAt = Date.parse(saved.queueEntry.enqueuedAt);
+        const events = await readArrayPages(
+          `repos/${repo}/issues/${pr}/timeline?per_page=100`,
+          options.timelineRead ?? read,
+          "queue ejection timeline unreadable"
+        );
+        const times = (name) => events.filter((event) => event.event === name).map((event) => Date.parse(event.created_at));
+        const adds = times("added_to_merge_queue").filter((at) => at >= enqueuedAt);
+        const removals = adds.length === 1 ? times("removed_from_merge_queue").filter((at) => at > adds[0]) : [];
+        if (removals.length === 1) {
+          journal.save("ejected");
+          return rejected("the previous admission was ejected by GitHub; rerun to submit a new intent");
+        }
+      }
     } catch {
     }
     return unknown(reason);
@@ -41909,24 +42106,6 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     } catch {
     }
   }
-  if (receipt?.state === "enqueued" && !superseded) {
-    try {
-      const observed = await readPrMergeQueue(pr, repo, read);
-      if (observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid === receipt.head) {
-        const events = await readArrayPages(
-          `repos/${repo}/issues/${pr}/timeline?per_page=100`,
-          options.timelineRead ?? read,
-          "queue ejection timeline unreadable"
-        );
-        const admittedAt = receipt.queueEntry ? Date.parse(receipt.queueEntry.enqueuedAt) : receipt.observedAt;
-        if (events.some((event) => event.event === "removed_from_merge_queue" && Date.parse(event.created_at) > admittedAt)) {
-          journal.save("ejected");
-          return rejected("the previous admission was ejected by GitHub; rerun to submit a new intent");
-        }
-      }
-    } catch {
-    }
-  }
   if (superseded && receipt?.state === "enqueued") {
     try {
       journal.save("ejected");
@@ -41935,6 +42114,10 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     }
   }
   if (receipt && receipt.state !== "failed" && receipt.state !== "ejected" && !superseded) {
+    if (options.selection) {
+      options.selection.selected = true;
+      options.selection.intentId = receipt.intentId;
+    }
     if (receipt.state === "enqueued" || receipt.state === "merged") return reconcile(`reconcile-needed for ${repo}#${pr}, submitted head ${receipt.head}, operation ${receipt.uuid ?? "completed immediately"}: admission completed but current membership is absent; inspect the exact queue candidate/ejection before a new intent`, receipt.state === "enqueued");
     if (!receipt.uuid) return reconcile(`the previous send for ${repo}#${pr}, submitted head ${receipt.head}, has no saved operation UUID`);
   } else {
@@ -41943,12 +42126,17 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       if (!journal.create(head)) return submitQueueAdmission(pr, repo, head, read, write, options, true);
       journal = admissionJournal(repo, pr, options.receiptDirectory);
       receipt = journal.receipt;
+      if (options.selection) {
+        options.selection.selected = true;
+        options.selection.intentId = receipt.intentId;
+      }
     } catch {
       return unknown("the pre-send checkpoint failed; no request was dispatched");
     }
     let output;
+    let credential;
     try {
-      output = await write([
+      const written = await write([
         `repos/${repo}/pulls/${pr}/merge-async`,
         "--method",
         "PUT",
@@ -41961,8 +42149,10 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
         "-f",
         `sha=${head}`
       ]);
+      ({ stdout: output, credential } = typeof written === "string" ? { stdout: written, credential: void 0 } : written);
     } catch (error) {
       output = error.stdout ?? "";
+      credential = error.credential;
     }
     try {
       response = admissionResponse(output);
@@ -41972,19 +42162,51 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     const { code, body } = response;
     if (code === 200 && ["enqueued", "merged"].includes(body.status ?? "")) {
       try {
-        journal.save(body.status);
+        journal.save(body.status, void 0, void 0, credential);
       } catch {
         return reconcile("the completed operation could not be checkpointed");
       }
       return reconcile(`GitHub reported ${body.status}, but matching-head membership or merged state is unconfirmed`, body.status === "enqueued");
     }
+    const tryAutoMergeFallback = async (reason, uuid) => {
+      const autoMerge = options.autoMerge ?? (write === writeApi ? autoMergeApi : void 0);
+      if (!/enqueuer is not authorized to merge/i.test(reason) || !autoMerge) return void 0;
+      try {
+        const fallback = await autoMerge(pr, repo, head);
+        const fallbackCredential = fallback?.credential ?? credential ?? receipt?.credential;
+        const observed = await readPrMergeQueue(pr, repo, read);
+        if (observed.state === "MERGED" && observed.headRefOid === head) {
+          try {
+            journal.save("merged", uuid, void 0, fallbackCredential);
+          } catch {
+            return reconcile("the completed auto-merge fallback could not be checkpointed");
+          }
+          return { mergeStatus: "merged" };
+        }
+        if (observed.isInMergeQueue && observed.headRefOid === head) {
+          const entry = observed.mergeQueueEntry;
+          const queueEntry = entry?.headCommit && entry.enqueuedAt ? { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt } : void 0;
+          try {
+            journal.save("enqueued", uuid, queueEntry, fallbackCredential);
+          } catch {
+            return reconcile("the enqueued auto-merge fallback could not be checkpointed");
+          }
+          return { mergeStatus: "auto-merge-enqueued" };
+        }
+      } catch {
+      }
+      return void 0;
+    };
     if (code === 400 || code === 403 || code === 404 || code === 422) {
+      const reason = body.details?.message ?? body.message ?? `HTTP ${code}`;
+      const fallbackResult = await tryAutoMergeFallback(reason);
+      if (fallbackResult) return fallbackResult;
       try {
-        journal.save("failed");
+        journal.save("failed", void 0, void 0, credential);
       } catch {
         return unknown("the explicit rejection could not be checkpointed");
       }
-      return rejected(body.details?.message ?? body.message ?? `HTTP ${code}`);
+      return rejected(reason);
     }
     const details = body.details;
     if (code !== 202 && code !== 409 || body.status !== "pending" || !UUID.test(details?.uuid ?? "")) return reconcile("the send returned no recognized admission result");
@@ -41992,7 +42214,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       return unknown("an existing operation has different or missing queue/head/no-bypass options; inspect that operation before continuing");
     }
     try {
-      journal.save("pending", details.uuid);
+      journal.save("pending", details.uuid, void 0, credential);
     } catch {
       return reconcile("the accepted operation UUID could not be checkpointed");
     }
@@ -42015,6 +42237,36 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       continue;
     }
     if (!["failed", "enqueued", "merged"].includes(status ?? "")) return reconcile("the operation returned an unrecognized state");
+    if (status === "failed") {
+      const reason = details?.message ?? "GitHub reported a failed operation";
+      const autoMerge = options.autoMerge ?? (write === writeApi ? autoMergeApi : void 0);
+      if (/enqueuer is not authorized to merge/i.test(reason) && autoMerge && receipt.head === head) {
+        try {
+          const fallback = await autoMerge(pr, repo, head);
+          const fallbackCredential = fallback?.credential ?? receipt?.credential;
+          const observed = await readPrMergeQueue(pr, repo, read);
+          if (observed.state === "MERGED" && observed.headRefOid === head) {
+            try {
+              journal.save("merged", receipt.uuid, void 0, fallbackCredential);
+            } catch {
+              return reconcile("the completed auto-merge fallback could not be checkpointed");
+            }
+            return { mergeStatus: "merged" };
+          }
+          if (observed.isInMergeQueue && observed.headRefOid === head) {
+            const entry = observed.mergeQueueEntry;
+            const queueEntry = entry?.headCommit && entry.enqueuedAt ? { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt } : void 0;
+            try {
+              journal.save("enqueued", receipt.uuid, queueEntry, fallbackCredential);
+            } catch {
+              return reconcile("the enqueued auto-merge fallback could not be checkpointed");
+            }
+            return { mergeStatus: "auto-merge-enqueued" };
+          }
+        } catch {
+        }
+      }
+    }
     try {
       journal.save(status, receipt.uuid);
     } catch {
@@ -42047,8 +42299,12 @@ async function enqueuePrMergeQueue(pr, repo, options = {}) {
   if (!pull || !pull.id || !/^[a-f0-9]{40}$/i.test(pull.headRefOid)) throw new Error(`merge queue PR #${pr} identity unreadable`);
   const head = options.expectedHeadOid ?? pull.headRefOid;
   if (head !== pull.headRefOid) return { mergeStatus: "failed", retryable: false, error: `merge queue head changed: expected ${head}, observed ${pull.headRefOid}` };
-  if (pull.state === "MERGED") return { mergeStatus: "merged" };
-  if (pull.isInMergeQueue) return { mergeStatus: "auto-merge-enqueued" };
+  const stamp = (result2, selected = false, intentId) => {
+    const credential = admissionCredential(repo, pr, head, options.receiptDirectory, selected, intentId);
+    return credential === "unknown" ? result2 : { ...result2, credential };
+  };
+  if (pull.state === "MERGED") return stamp({ mergeStatus: "merged" });
+  if (pull.isInMergeQueue) return stamp({ mergeStatus: "auto-merge-enqueued" });
   if (pull.state !== "OPEN") return { mergeStatus: "failed", error: `PR #${pr} is ${pull.state}; no queue submission` };
   const closing = [...pull.closingIssuesReferences.nodes.map((node) => node.number)];
   let page = pull.closingIssuesReferences.pageInfo;
@@ -42144,7 +42400,20 @@ ${pull.body}`;
     return preparation("queue-message", targets, `GitHub's unchanged ${policy.body} message is unsafe for ${targets.map((number) => `${repo}#${number}`).join(", ")}. ${verdict.message}`);
   }
   const requiredBody = options.bodyText ?? composedBody;
-  if (requiredBody && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
+  const prBodyPreservesOverrides = requiredBody != null && method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null && prBodyPreservesCommitOverrides(messages, headline, pull.body, process.cwd());
+  if (requiredBody && !prBodyPreservesOverrides && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
+    if (method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null) {
+      return {
+        mergeStatus: "failed",
+        preparation: {
+          status: "preparation-needed",
+          reason: "queue-message-override",
+          issueTargets: [],
+          nextAction: "PR author: this repository squashes with PR_BODY, so place the required Test-Policy-Override trailer(s) in the PR body final trailer block (e.g. mmi-cli devops pr edit <n> --body-file <path>) without a body override, then rerun pr land. Keep repository settings unchanged."
+        },
+        error: "queue preparation needed: repository squash policy is PR_BODY, and the PR body does not carry the required Test-Policy-Override trailer(s) in its final Git-recognized trailer block"
+      };
+    }
     return preparation("queue-message-override", [], "the requested sanitized body or trailer arrangement cannot be sent to queue admission");
   }
   const current = await queueGraphql(
@@ -42155,8 +42424,9 @@ ${pull.body}`;
   if (current.pullRequest.headRefOid !== head || current.pullRequest.title !== pull.title || current.pullRequest.body !== pull.body) {
     return { mergeStatus: "failed", retryable: false, error: "queue source or PR text changed during preparation; rerun pr land against the new revision" };
   }
-  const result = await submitQueueAdmission(pr, repo, head, queueRead, write, { ...options, timelineRead: read });
-  return { ...result, ...verdict.message ? { warning: verdict.message } : {} };
+  const selection = { selected: false };
+  const result = await submitQueueAdmission(pr, repo, head, queueRead, write, { ...options, timelineRead: read, selection });
+  return { ...stamp(result, selection.selected, selection.intentId), ...verdict.message ? { warning: verdict.message } : {} };
 }
 function decideQueueMergeRoute(hasQueue, method, headRef) {
   if (!hasQueue) return "normal";
@@ -42194,8 +42464,50 @@ function prMergeQueueLine(result) {
       return `pr land: PR #${result.pr} merge queue timeout on ${queue.base}`;
   }
 }
+function admissionCredential(repo, pr, head, receiptDirectory, selected = false, intentId) {
+  try {
+    const journal = admissionJournal(repo, pr.replace(/^0+(?=\d)/, ""), receiptDirectory);
+    const saved = intentId ? journal.findByIntentId(intentId) : journal.receipt;
+    const live = saved && ["pending", "enqueued", "merged"].includes(saved.state);
+    return saved && saved.head.toLowerCase() === head.toLowerCase() && (selected || live) ? saved.credential ?? "unknown" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function observeQueuedAdmission(repo, pr, snapshot, receiptDirectory) {
+  try {
+    const journal = admissionJournal(repo, pr.replace(/^0+(?=\d)/, ""), receiptDirectory);
+    const saved = journal.receipt;
+    if (!saved || !["pending", "enqueued", "merged"].includes(saved.state) || snapshot.headRefOid?.toLowerCase() !== saved.head.toLowerCase()) return {};
+    const entry = snapshot.mergeQueueEntry;
+    if (saved.queueEntry) {
+      if (entry?.enqueuedAt && entry.enqueuedAt !== saved.queueEntry.enqueuedAt) return { mismatched: true };
+    } else if ((saved.state === "enqueued" || saved.state === "pending") && snapshot.isInMergeQueue && entry?.headCommit && entry.enqueuedAt) {
+      try {
+        journal.save("enqueued", saved.uuid, { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt });
+      } catch {
+        return {};
+      }
+    }
+    return saved.credential ? { credential: saved.credential } : {};
+  } catch {
+    return {};
+  }
+}
 
 // src/merge-group-orphans.ts
+var SETTLE_POLLS = 6;
+var SETTLE_MS = 5e3;
+async function settled(repo, id, deps) {
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  let status = "unknown";
+  for (let poll = 0; poll < SETTLE_POLLS; poll++) {
+    await sleep2(SETTLE_MS);
+    status = JSON.parse(await deps.read([`repos/${repo}/actions/runs/${id}`])).status ?? "unknown";
+    if (status === "completed") break;
+  }
+  return status;
+}
 async function isOrphan(run, repo, deps) {
   const match = /^gh-readonly-queue\/(.+)\/pr-([1-9][0-9]*)-([a-f0-9]+)$/i.exec(run.head_branch);
   if (!match || run.event !== "merge_group") return false;
@@ -42215,7 +42527,7 @@ async function isOrphan(run, repo, deps) {
   }
 }
 async function cancelMergeGroupOrphans(repo, apply, deps) {
-  const report = { repo, apply, candidates: [], cancelled: [], errors: [] };
+  const report = { repo, apply, candidates: [], cancelled: [], forceRequested: [], forceCancelled: [], errors: [] };
   try {
     if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error("expected --repo owner/repo");
     const runs2 = [];
@@ -42237,7 +42549,18 @@ async function cancelMergeGroupOrphans(repo, apply, deps) {
       for (const run of confirmed) {
         if (!await isOrphan(run, repo, deps)) continue;
         await deps.cancel(repo, run.id);
-        report.cancelled.push(run.id);
+        let status = await settled(repo, run.id, deps);
+        let forced = false;
+        if (status !== "completed" && await isOrphan(run, repo, deps)) {
+          await deps.forceCancel(repo, run.id);
+          report.forceRequested.push(run.id);
+          forced = true;
+          status = await settled(repo, run.id, deps);
+        }
+        if (status === "completed") {
+          report.cancelled.push(run.id);
+          if (forced) report.forceCancelled.push(run.id);
+        } else report.errors.push(`cancel-orphans: run ${run.id} still ${status} after cancel${forced ? " and force-cancel" : ""}`);
       }
     }
   } catch (error) {
@@ -42263,17 +42586,68 @@ function registerCancelOrphans(ci2, writeToken) {
           timeout: 2e4,
           env: { ...process.env, GH_TOKEN: token }
         });
+      },
+      forceCancel: async (repo, id) => {
+        token ??= await writeToken();
+        await execFileP("gh", ["api", `repos/${repo}/actions/runs/${id}/force-cancel`, "--method", "POST"], {
+          timeout: 2e4,
+          env: { ...process.env, GH_TOKEN: token }
+        });
       }
     });
     if (options.json) console.log(JSON.stringify(report, null, 2));
     else {
       for (const run of report.candidates) console.log(`${run.id} ${run.head_branch} ${run.html_url}`);
-      console.log(`cancel-orphans: ${report.candidates.length} candidates; ${report.cancelled.length} cancelled${options.apply ? "" : " (report only; use --apply)"}`);
+      console.log(`cancel-orphans: ${report.candidates.length} candidates; ${report.cancelled.length} cancelled (verified completed; ${report.forceCancelled.length} of them after force-cancel; ${report.forceRequested.length} force-cancel request(s))${options.apply ? "" : " (report only; use --apply)"}`);
       for (const error of report.errors) console.error(error);
     }
     if (report.errors.length) process.exitCode = 1;
   });
 }
+var RUN_CANCEL_STATUS = "cancel-requested";
+var RUN_FORCE_CANCEL_STATUS = "force-cancel-requested";
+async function cancelWorkflowRun(repo, id, deps, force = false) {
+  const raw = String(id).trim();
+  if (!/^[1-9]\d*$/.test(raw)) throw new Error(`run cancel: <id> must be a positive workflow run id (received '${String(id)}')`);
+  const runId = Number(raw);
+  if (!Number.isSafeInteger(runId)) throw new Error(`run cancel: <id> ${raw} is beyond the safe integer range; refusing to address a different run`);
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error(`run cancel: --repo must be owner/repo (received '${repo}')`);
+  try {
+    if (force && deps.forceCancel) await deps.forceCancel(repo, runId);
+    else await deps.cancel(repo, runId);
+  } catch (error) {
+    const detail = String(error.stderr ?? error);
+    throw new Error(/\b403\b/.test(detail) ? "run cancel: GitHub App denied (HTTP 403); actions:write permission is required; no personal-token fallback" : `run cancel: ${detail}`);
+  }
+  return { ok: true, repo, runId, ...force ? { force: true } : {}, status: force ? RUN_FORCE_CANCEL_STATUS : RUN_CANCEL_STATUS };
+}
+function registerRunCancel(run, writeToken) {
+  run.command("cancel <id>").description("cancel one queued or in-progress workflow run on the org App (actions:write); requests the cancel and prints a receipt").requiredOption("--repo <owner/repo>", "repository that owns the run").option("--force", "force-cancel the run so always() jobs stop too (#9512)").option("--json", "machine-readable receipt").action(async (id, options) => {
+    let receipt;
+    try {
+      receipt = await cancelWorkflowRun(options.repo, id, {
+        cancel: async (repo, runId) => {
+          const token = await writeToken();
+          await execFileP("gh", ["api", `repos/${repo}/actions/runs/${runId}/cancel`, "--method", "POST"], {
+            timeout: 2e4,
+            env: { ...process.env, GH_TOKEN: token }
+          });
+        },
+        forceCancel: async (repo, runId) => {
+          const token = await writeToken();
+          await execFileP("gh", ["api", `repos/${repo}/actions/runs/${runId}/force-cancel`, "--method", "POST"], {
+            timeout: 2e4,
+            env: { ...process.env, GH_TOKEN: token }
+          });
+        }
+      }, options.force === true);
+    } catch (error) {
+      return fail(error.message);
+    }
+    if (options.json) console.log(JSON.stringify(receipt));
+    else console.log(`run cancel: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.force ? "force-cancel" : "cancel"} requested (status: ${receipt.status})`);
+  });
+}
 
 // src/board-commands.ts
 init_cli_shared();
@@ -42690,6 +43064,8 @@ function registerBoardCommands(program3) {
           console.log(result.claimed ? claimVerdict(result.ref, result) : `Skipped ${result.ref}: ${result.reason}`);
           if (result.claimed) for (const line of formatDecisionLines(result.ref, ruled[i].decisions ?? [])) console.log(line);
         });
+        const summary = formatBulkClaimSummary(bulk.results);
+        if (summary) console.log(summary);
         printClaimWarnings([...bulk.warnings ?? [], ...rulingWarnings]);
       }
       if (bulk.failed > 0) process.exitCode = 1;
@@ -46353,13 +46729,14 @@ function filledDocCheck(label, text, path2) {
   const unfilled = unfilledDocPlaceholders(text);
   return { ok: unfilled.length === 0, label, detail: unfilled.length ? `unfilled: ${unfilled.join(", ")}` : void 0 };
 }
-var NPMRC_PATHS = [".npmrc", "web/.npmrc"];
+var NPMRC_PATHS = [".npmrc", "module/.npmrc", "web/.npmrc"];
 var SCOPED_GITHUB_PACKAGES_RE = /^\s*@[A-Za-z0-9-]+:registry\s*=\s*https:\/\/npm\.pkg\.github\.com/m;
 var GITHUB_PACKAGES_AUTH_RE = /^\s*\/\/npm\.pkg\.github\.com\/:_authToken\s*=(.*)$/m;
 function npmrcAuthValueIsPlaceholder(value) {
   const trimmed = value.trim();
   return trimmed === "" || /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/.test(trimmed);
 }
+var GH_PACKAGES_SCOPE_NOTE = ". Note that `gh auth token` only works as a Packages credential when that login carries the read:packages scope \u2014 without it the same install fails as `E403 ... Permission permission_denied: The token ... does not match expected scopes` (a scope refusal, not a 401/E401). Recoveries: widen the login with `gh auth refresh -h github.com -s read:packages`, or keep the token keyless in the Jerv vault key `GH_PACKAGES_READ_TOKEN` and supply it with `jerv-cli vault use`";
 function npmrcGitHubPackagesAuthCheck(path2, text) {
   if (text === null || !SCOPED_GITHUB_PACKAGES_RE.test(text)) return null;
   const label = `${path2} authenticates GitHub Packages`;
@@ -46368,7 +46745,7 @@ function npmrcGitHubPackagesAuthCheck(path2, text) {
     return {
       ok: false,
       label,
-      detail: `${path2} points a scope at npm.pkg.github.com with no token line \u2014 add \`//npm.pkg.github.com/:_authToken=<token>\` with a real value, or keep the line as \`\${NODE_AUTH_TOKEN}\` and supply the token in the shell for every install (NODE_AUTH_TOKEN=$(gh auth token) npm ci) \u2014 otherwise npm ci 401s outside a setup-node CI job`
+      detail: `${path2} points a scope at npm.pkg.github.com with no token line \u2014 add \`//npm.pkg.github.com/:_authToken=<token>\` with a real value, or keep the line as \`\${NODE_AUTH_TOKEN}\` and supply the token in the shell for every install (NODE_AUTH_TOKEN=$(gh auth token) npm ci) \u2014 otherwise npm ci 401s outside a setup-node CI job` + GH_PACKAGES_SCOPE_NOTE
     };
   }
   if (npmrcAuthValueIsPlaceholder(match[1])) {
@@ -46376,7 +46753,7 @@ function npmrcGitHubPackagesAuthCheck(path2, text) {
     return {
       ok: false,
       label,
-      detail: `${path2} carries only the placeholder //npm.pkg.github.com/:_authToken=${carried} \u2014 declared, not proven: GitHub Packages reads that line only while NODE_AUTH_TOKEN is exported in the same shell, so a lane, laptop or container with it unset 401s before anything names the cause. Two recoveries: put a real token value in the line, or supply the token from the shell (NODE_AUTH_TOKEN=$(gh auth token) npm ci)`
+      detail: `${path2} carries only the placeholder //npm.pkg.github.com/:_authToken=${carried} \u2014 declared, not proven: GitHub Packages reads that line only while NODE_AUTH_TOKEN is exported in the same shell, so a lane, laptop or container with it unset 401s before anything names the cause. Two recoveries: put a real token value in the line, or supply the token from the shell (NODE_AUTH_TOKEN=$(gh auth token) npm ci)` + GH_PACKAGES_SCOPE_NOTE
     };
   }
   return { ok: true, label };
@@ -46564,7 +46941,15 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       });
     }
   }
-  for (const path2 of NPMRC_PATHS) {
+  const tree = await restJson3(
+    deps,
+    `repos/${repo}/git/trees/${encodeURIComponent(baseBranch)}?recursive=1`,
+    {}
+  );
+  const discoveredNpmrcPaths = (tree.tree ?? []).filter(
+    (entry) => entry.type === "blob" && typeof entry.path === "string" && (entry.path === ".npmrc" || entry.path.endsWith("/.npmrc"))
+  ).map((entry) => entry.path);
+  for (const path2 of /* @__PURE__ */ new Set([...NPMRC_PATHS, ...discoveredNpmrcPaths])) {
     const check = npmrcGitHubPackagesAuthCheck(path2, await contentText(deps, repo, baseBranch, path2));
     if (check) checks.push(check);
   }
@@ -51778,7 +52163,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
       if (now() >= deadline) break;
       const checks = await deps.waitForChecks(prNumber, repo, deadline - now());
       if (checks.status !== "success" && checks.status !== "skipped") {
-        return { mergeStatus: "failed", error: `${result.error ?? "merge failed"}
+        return { ...result, mergeStatus: "failed", error: `${result.error ?? "merge failed"}
 registration wait: checks-wait ${checks.status}: ${checks.detail ?? checks.reason ?? "unknown"}` };
       }
       if (now() >= deadline) break;
@@ -51924,6 +52309,8 @@ async function runPrLand(prNumber, options, deps) {
   if (hasQueue && !deps.enqueueQueue) throw new Error("queue-only enqueue adapter unavailable; no merge dispatched");
   const merge = await mergeAutoWithTransientRetry(prNumber, repo, hasQueue ? { ...deps, mergeAuto: (pr, target) => deps.enqueueQueue(pr, target, pinned) } : deps);
   base.mergeStatus = merge.mergeStatus;
+  if (merge.credential) base.credential = merge.credential;
+  if (merge.credentialRole) base.credentialRole = merge.credentialRole;
   if (merge.mergeStatus === "queue-admission-pending") {
     return { ...base, status: "queue-admission-pending", outcomeUnknown: true, queueAdmission: merge.queueAdmission, error: merge.error };
   }
@@ -51985,9 +52372,19 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
   const timeoutMs = options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS;
   const deadline = deadlineMs ?? now() + timeoutMs;
   let attempt = 0;
+  let credentialMismatched = false;
+  const observe = (read) => {
+    const seen = deps.observeQueued?.(pr, base.repo, read);
+    if (seen?.mismatched) {
+      credentialMismatched = true;
+      delete base.credential;
+    }
+    if (!credentialMismatched && seen?.credential && !base.credential) base.credential = seen.credential;
+  };
   while (now() < deadline) {
     const read = snapshot ?? await deps.readMergeQueue(pr, base.repo);
     snapshot = void 0;
+    if (read.isInMergeQueue || read.state === "MERGED") observe(read);
     if (read.state === "MERGED") return queueMerged(base, deps);
     if (read.isInMergeQueue) {
       base.mergeQueue = {
@@ -52000,7 +52397,10 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
     } else if (read.state === "OPEN" && !read.autoMergeRequest) {
       await sleep2(PR_LAND_EJECT_CONFIRM_MS);
       const again = await deps.readMergeQueue(pr, base.repo);
-      if (again.state === "MERGED") return queueMerged(base, deps);
+      if (again.state === "MERGED") {
+        observe(again);
+        return queueMerged(base, deps);
+      }
       if (again.isInMergeQueue || again.autoMergeRequest) {
         snapshot = again;
         continue;
@@ -52055,6 +52455,10 @@ function renderPrLandTable(entries) {
   const width = (i) => Math.max(...rows.map((r) => r[i].length));
   return rows.map((r) => `${r[0].padEnd(width(0))}  ${r[1].padEnd(width(1))}  ${r[2]}`).join("\n");
 }
+function landCredentials(results) {
+  const each = results.map((r) => r.credential ?? "unknown");
+  return { each, overall: each.length === 0 ? "unknown" : new Set(each).size === 1 ? each[0] : "mixed" };
+}
 
 // src/git-worktree-observation.ts
 function parseGitWorktreePorcelain(text) {
@@ -52255,6 +52659,12 @@ ${err?.stdout ?? ""}`.split("\n").map((line) => line.trim()).filter((line) => li
 var defaultGhMergeAutoIo = {
   gh: async (args, timeoutMs) => (await execFileP("gh", args, { timeout: timeoutMs })).stdout
 };
+var credentialedGh = {
+  gh: async (args, timeoutMs) => {
+    const { stdout, credential } = await execFileP("gh", args, { timeout: timeoutMs });
+    return { stdout, credential };
+  }
+};
 function resolveSquashMergeBodyText(commits, allowedClosing, cwd) {
   const policy = squashBodyWithOverride(commits, cwd);
   const base = policy ?? defaultSquashBodyFromCommits(commits);
@@ -52316,14 +52726,34 @@ async function ghAdminTrueMergeWhenClean(prNumber, repo, opts = {}) {
   return { mergeStatus: "merged" };
 }
 async function ghMergeAutoEnqueue(prNumber, repo, method, extra) {
-  const io = extra?.io ?? defaultGhMergeAutoIo;
+  let credential;
+  let refusedAsMerged = false;
+  const source = extra?.io ?? credentialedGh;
+  const note = (args2, value) => {
+    if (args2[0] === "pr" && args2[1] === "merge" && value) credential = value;
+  };
+  const io = {
+    gh: async (ghArgs, timeoutMs) => {
+      try {
+        const out = await source.gh(ghArgs, timeoutMs);
+        if (typeof out === "string") return out;
+        note(ghArgs, out.credential);
+        return out.stdout;
+      } catch (e) {
+        note(ghArgs, e?.credential);
+        if (ghArgs[0] === "pr" && ghArgs[1] === "merge" && /already been merged/i.test(String(e?.message ?? ""))) refusedAsMerged = true;
+        throw e;
+      }
+    }
+  };
   const args = repo ? ["--repo", repo] : [];
   const overrideBody = await composeOverrideBodyFile(prNumber, args, io.gh, {
     allowedClosing: method === "--squash" ? extra?.allowedClosing : void 0,
     bodyText: method === "--squash" ? extra?.bodyText : void 0
   });
   try {
-    return await mergeAutoEnqueueWithBody(prNumber, args, method, io, overrideBody?.path, extra?.mergeQueue, extra?.matchHeadCommit);
+    const result = await mergeAutoEnqueueWithBody(prNumber, args, method, io, overrideBody?.path, extra?.mergeQueue, extra?.matchHeadCommit);
+    return credential ? { ...result, credential, ...refusedAsMerged && result.mergeStatus === "merged" ? { credentialRole: "attempted-write" } : {} } : result;
   } finally {
     overrideBody?.cleanup();
   }
@@ -55727,7 +56157,7 @@ async function observePrCreateClaims(body, repoOption, deps = {}) {
       if (findings.length) throw new Error("pr create: claim findings must be resolved before restamping");
       if (attempted) throw new Error("pr create: claim restamp already attempted; observe again before retrying");
       attempted = true;
-      const writer = deps.client ?? defaultGitHubClient();
+      const writer = await selectClaimWriteClient(deps.client ?? defaultGitHubClient(), deps.appClient);
       for (const number of restamps) {
         await writer.rest("POST", `repos/${repo}/issues/${number}/comments`, { body: { body: formatClaimMarker(actor) } });
       }
@@ -55743,11 +56173,11 @@ function catFileBatch(root, ref, paths) {
   if (paths.length === 0) return Promise.resolve([]);
   return new Promise((resolve7) => {
     const chunks = [];
-    let settled = false;
+    let settled2 = false;
     const child2 = (0, import_node_child_process15.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
     const finish = (ok = false) => {
-      if (settled) return;
-      settled = true;
+      if (settled2) return;
+      settled2 = true;
       clearTimeout(timer);
       resolve7(ok ? parseCatFileBatch(Buffer.concat(chunks), paths.length) : []);
     };
@@ -55913,6 +56343,21 @@ async function preparePrCreate(input, deps = createPreparationDeps(input)) {
     }
   };
 }
+async function retryPrCreateIdentityDrift(input, deps, notify = (line) => process.stderr.write(line)) {
+  notify("pr create: WARNING \u2014 candidate or policy/config identity changed during preparation; re-reading the head, base and policy/config identity and preparing once more (#9470)\n");
+  const preparation = await preparePrCreate(input, deps);
+  if (preparation.findings.length) {
+    return { preparation, error: new Error(`preparation found ${preparation.findings.length} blocker(s) after re-reading the current identity: ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${finding.detail}`).join("; ")}`) };
+  }
+  try {
+    await preparation.commit();
+    return { preparation };
+  } catch (error) {
+    const message2 = error.message;
+    if (!message2.includes("identity changed during preparation")) return { preparation, error };
+    return { preparation, error: new Error(`${message2}. Automatic re-preparation ran once and the identity drifted again \u2014 this is retryable: re-run \`mmi-cli devops pr create\` (same title/body/head/base) against the current head and base; a concurrent push, rebase or policy/config commit caused it, and re-preparing loses nothing.`) };
+  }
+}
 function createPreparationDeps(input, io = {}) {
   const exec3 = io.exec ?? execFileP;
   const git3 = async (args) => (await exec3("git", args, { timeout: GIT_TIMEOUT_MS })).stdout.trim();
@@ -56196,10 +56641,10 @@ function healthPollIntervalMs() {
 }
 function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
   return new Promise((resolve7, reject2) => {
-    let settled = false;
+    let settled2 = false;
     const finish = (fn) => {
-      if (settled) return;
-      settled = true;
+      if (settled2) return;
+      settled2 = true;
       clearTimeout(timer);
       child2.removeAllListeners("error");
       child2.removeAllListeners("exit");
@@ -58258,7 +58703,15 @@ function registerCollaborationCommands(program3) {
       return fail(`issue link-child: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
     }
   });
-  jsonParity(issue.command("comment <ref>").description("post a Markdown comment to an issue and print {number,repo,url,commentUrl} JSON").option("--body <body>", "comment body (markdown; prefer --body-file for multiline Markdown)").option("--body-file <path|->", "read comment body from a UTF-8 file, or from stdin with -").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).action(async (ref, o) => {
+  jsonParity(issue.command("comment <ref>").description("post or exact-text edit a Markdown issue comment and print {number,repo,url,commentUrl} JSON").option("--body <body>", "comment body (markdown; prefer --body-file for multiline Markdown)").option("--body-file <path|->", "read comment body from a UTF-8 file, or from stdin with -").option("--repo <owner/repo>", "repo for a bare ref (defaults to the current repo)")).option("--edit <commentId>", "edit an existing comment on this issue").option("--replace <text>", "exact text to replace (must occur exactly once)").option("--with <text>", "replacement text (may be empty)").action(async (ref, o) => {
+    const editShape = "--edit <commentId> --replace <text> --with <text> (without --body/--body-file)";
+    if (o.edit !== void 0) {
+      if (o.replace === void 0 || o.with === void 0 || o.body !== void 0 || o.bodyFile !== void 0 || o.replace.length === 0) {
+        return fail(`issue comment: use ${editShape}; --replace must not be empty`);
+      }
+    } else if (o.replace !== void 0 || o.with !== void 0) {
+      return fail(`issue comment: --replace/--with require ${editShape}`);
+    }
     let parsed;
     try {
       parsed = parseIssueRef(ref, o.repo);
@@ -58267,14 +58720,14 @@ function registerCollaborationCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
+      body = o.edit !== void 0 ? "" : await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises8.readFile, readStdin });
     } catch (e) {
       return fail(`issue comment: ${e.message}`);
     }
     const repo = await resolveRepo(parsed.repo ?? o.repo);
     if (!repo) return fail("issue comment: could not resolve repo \u2014 pass --repo owner/repo");
     try {
-      const result = await postIssueComment(defaultGitHubClient(), { ref, defaultRepo: repo, body });
+      const result = o.edit !== void 0 ? await editIssueComment(defaultGitHubClient(), { ref, defaultRepo: repo, commentId: o.edit, replace: o.replace, with: o.with }) : await postIssueComment(defaultGitHubClient(), { ref, defaultRepo: repo, body });
       console.log(JSON.stringify(result));
     } catch (e) {
       const err = e;
@@ -58483,7 +58936,7 @@ ${list}`);
       title = safeTitle;
       process.stderr.write('pr create: WARNING \u2014 rewrote close-keyword text in the title to "part of #N": the squash commit subject would close it (#7688). Put closing keywords on a "Closes #N" body line.\n');
     }
-    const preparation = await preparePrCreate({ body, repo: o.repo, head: o.head, base: o.base });
+    let preparation = await preparePrCreate({ body, repo: o.repo, head: o.head, base: o.base });
     if (preparation.findings.length) return fail(`pr create: preparation found ${preparation.findings.length} blocker(s):
 ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${finding.detail}`).join("\n")}`, { code: ERROR_CODES.ERR_STATE_CONFLICT });
     for (const observation of preparation.observations.filter((item) => item.state === "skipped")) {
@@ -58497,7 +58950,16 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
     try {
       await preparation.commit();
     } catch (error) {
-      return fail(`pr create: preparation commit failed \u2014 ${error.message}`);
+      const message2 = error.message;
+      if (!message2.includes("identity changed during preparation")) return fail(`pr create: preparation commit failed \u2014 ${message2}`);
+      const retry = await retryPrCreateIdentityDrift({ body, repo: o.repo, head: o.head, base: o.base }, createPreparationDeps({ body, repo: o.repo, head: o.head, base: o.base }));
+      if (retry.error) return fail(`pr create: preparation commit failed after one automatic re-preparation \u2014 ${retry.error.message}`, { code: ERROR_CODES.ERR_STATE_CONFLICT });
+      preparation = retry.preparation;
+      if (preparation.candidate?.head !== createHead) {
+        const retriedHeadWarning = await prCreateMergedHeadWarning({ head: preparation.candidate?.head || void 0, repo: o.repo });
+        if (retriedHeadWarning) process.stderr.write(`${retriedHeadWarning}
+`);
+      }
     }
     const created = await ghCreate(buildPrArgs({ title, body, base: preparation.candidate.base, head: preparation.candidate.head, repo: preparation.candidate.repo, draft: o.draft }), { allowHeadPublication: false });
     if (isGhCreateRateLimited(created)) {
@@ -58859,6 +59321,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
           return receipt;
         },
         readMergeQueue: readPrMergeQueue,
+        observeQueued: (prNumber, repo, snapshot) => observeQueuedAdmission(repo, prNumber, snapshot),
         findMergeGroupRun: findPrMergeGroupRun,
         queueProgress: (receipt) => {
           const line = prMergeQueueLine(receipt);
@@ -59047,7 +59510,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         inFlight = Math.max(1, inFlight - 1);
       }
     });
-    const credential = lastRestPollSource() === "app" ? "app_installation" : "user";
+    const { each: credentials, overall: credential } = landCredentials(entries.map((e) => e.result));
     if (numbers.length === 1) {
       const { result, cleanup } = entries[0];
       if (opts.json) printLine(JSON.stringify({ ...result, ...cleanup ? { cleanup } : {}, credential }));
@@ -59058,7 +59521,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         if (cleanup) printLine(`pr land: ${cleanup}`);
       }
     } else if (opts.json) {
-      printLine(JSON.stringify({ results: entries.map((e) => ({ ...e.result, outcome: e.outcome, ...e.cleanup ? { cleanup: e.cleanup } : {} })), summary: Object.fromEntries(["merged", "ejected", "timeout", "queued", "queue-admission-pending", "failed"].map((k) => [k, entries.filter((e) => e.outcome === k).length])), credential }));
+      printLine(JSON.stringify({ results: entries.map((e, i) => ({ ...e.result, credential: credentials[i], outcome: e.outcome, ...e.cleanup ? { cleanup: e.cleanup } : {} })), summary: Object.fromEntries(["merged", "ejected", "timeout", "queued", "queue-admission-pending", "failed"].map((k) => [k, entries.filter((e) => e.outcome === k).length])), credential }));
     } else {
       printLine(renderPrLandTable(entries));
       printLine(`pr land: ${entries.filter((e) => e.outcome === "merged").length}/${entries.length} merged (credential: ${credential})`);
@@ -64808,8 +65271,7 @@ function parseBrokerPrState(raw) {
 }
 function buildPrListSpec(o) {
   const repo = parseBrokerRepo(o.repo, "--repo");
-  const fields = parseBrokerJsonFields(o.json);
-  rejectPrViewQueueFields(fields, "<number>", repo, "list");
+  const fields = rejectPrViewQueueFields(parseBrokerJsonFields(o.json), "<number>", repo, "list");
   const args = withJson(withRepo(["pr", "list"], repo), fields, o.json);
   const state = parseBrokerPrState(o.state);
   if (state) args.push("--state", state);
@@ -64876,18 +65338,24 @@ function buildRunWatchSpec(id, o) {
 }
 function rejectPrViewQueueFields(fields, number, repo, verb = "view") {
   const badField = fields?.split(",").find((field) => field === "mergeQueueEntry" || field === "isInMergeQueue");
-  if (!badField) return;
+  if (!badField) return fields;
   const targetRepo2 = repo ?? "<owner/repo>";
   const remaining = fields?.split(",").filter((f) => f && f !== "mergeQueueEntry" && f !== "isInMergeQueue").join(",") ?? "";
-  throw new Error(
-    `read pr ${verb}: '${badField}' is not a gh pr ${verb} --json field \u2014 read the merge queue with \`mmi-cli devops read pr queue ${number} --repo ${targetRepo2} --json\` and drop it from --json${remaining ? `; for the remaining fields run \`mmi-cli devops read pr ${verb} ${number}${repo ? ` --repo ${repo}` : ""} --json ${remaining}\`` : ""}`
+  if (!remaining) {
+    throw new Error(
+      `read pr ${verb}: '${badField}' is not a gh pr ${verb} --json field \u2014 read the merge queue with \`mmi-cli devops read pr queue ${number} --repo ${targetRepo2} --json\` and drop it from --json`
+    );
+  }
+  process.stderr.write(
+    `read pr ${verb}: dropped '${badField}' (not a gh pr ${verb} --json field) \u2014 read the merge queue with \`mmi-cli devops read pr queue ${number} --repo ${targetRepo2} --json\`
+`
   );
+  return remaining;
 }
 function buildPrViewSpec(ref, o) {
   const number = parseBrokerId(ref, "PR number");
-  const jsonFields = parseBrokerJsonFields(o.json);
   const repo = parseBrokerRepo(o.repo, "--repo");
-  rejectPrViewQueueFields(jsonFields, number, repo);
+  const jsonFields = rejectPrViewQueueFields(parseBrokerJsonFields(o.json), number, repo);
   const args = withJson(withRepo(["pr", "view", number], repo), jsonFields, o.json);
   if (o.comments) args.push("--comments");
   return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
@@ -64961,7 +65429,34 @@ function ghExitCodeOf(error) {
   const code = error.code;
   return typeof code === "number" ? code : null;
 }
-function brokerGhFailureHint(failureText, args) {
+var RUN_LIST_RECOVERY_FLAGS = ["--repo", "--branch", "--commit", "--event", "--workflow", "--status", "--created", "--limit"];
+function shellWord(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function formatBrokerRunListRecovery(spec, jq) {
+  const tokens2 = spec.args.slice(2);
+  const valueOf = (flag) => {
+    const index = tokens2.indexOf(flag);
+    if (index === -1) return void 0;
+    const next = tokens2[index + 1];
+    return next === void 0 || next.startsWith("-") ? void 0 : next;
+  };
+  const words = ["MMI_ACTOR=app", "mmi-cli", "devops", "read", "run", "list"];
+  const repo = valueOf("--repo");
+  words.push("--repo", repo === void 0 ? "<owner/repo>" : shellWord(repo));
+  for (const flag of RUN_LIST_RECOVERY_FLAGS.slice(1)) {
+    const value = valueOf(flag);
+    if (value !== void 0) words.push(flag, shellWord(value));
+  }
+  if (tokens2.includes("--json")) {
+    const fields = valueOf("--json");
+    words.push("--json");
+    if (fields !== void 0) words.push(shellWord(fields));
+  }
+  if (jq !== void 0) words.push("--jq", `'${jq.replace(/'/g, `'\\''`)}'`);
+  return `re-run exactly this read: \`${words.join(" ")}\` \u2014 it carries every filter gh was given, because a reconstructed list that drops them answers a different question`;
+}
+function brokerGhFailureHint(failureText, args, jq) {
   const target = args[0] === "pr" && args[1] === "view" ? args[2] : void 0;
   const unknownField = /Unknown JSON field: "([^"]+)"/.exec(failureText)?.[1] ?? /Unknown JSON field: ([A-Za-z][A-Za-z0-9]*)/.exec(failureText)?.[1];
   if (unknownField === "mergeQueueEntry" || unknownField === "isInMergeQueue") {
@@ -64973,9 +65468,12 @@ function brokerGhFailureHint(failureText, args) {
   if (/Could not resolve to a PullRequest/i.test(failureText)) {
     return `GitHub could not resolve the PR${target ? ` #${target}` : ""} \u2014 verify the number and that --repo names the repo that owns it before retrying; an identical re-run fails the same way`;
   }
+  if (args[0] === "run" && args[1] === "list") {
+    return formatBrokerRunListRecovery({ program: "gh", args: [...args], timeoutMs: SINGLE_SHOT_TIMEOUT_MS }, jq);
+  }
   return void 0;
 }
-async function runBrokerGh(run, spec, write = (chunk) => process.stdout.write(chunk)) {
+async function runBrokerGh(run, spec, write = (chunk) => process.stdout.write(chunk), jq) {
   const env = brokerChildEnv();
   let output;
   try {
@@ -64987,7 +65485,7 @@ async function runBrokerGh(run, spec, write = (chunk) => process.stdout.write(ch
     if (code !== null) {
       if (typeof err.stderr === "string" && err.stderr) process.stderr.write(redactPrivateCredential(err.stderr, env));
       const failure = `${typeof err.stdout === "string" ? err.stdout : ""}${typeof err.stderr === "string" ? err.stderr : ""}`;
-      const recovery = brokerGhFailureHint(failure, spec.args) ?? "inspect stderr; retry the same typed read and only parse stdout after success";
+      const recovery = brokerGhFailureHint(failure, spec.args, jq) ?? "inspect stderr; retry the same typed read and only parse stdout after success";
       process.stderr.write(`read: gh ${spec.args.slice(0, 2).join(" ")} failed on the App pool (exit ${code}) \u2014 ${recovery}
 `);
       return code;
@@ -64998,7 +65496,8 @@ async function runBrokerGh(run, spec, write = (chunk) => process.stdout.write(ch
     try {
       JSON.parse(output);
     } catch {
-      process.stderr.write(`read: gh ${spec.args.slice(0, 2).join(" ")} returned ${output.trim() ? "invalid" : "empty"} JSON on the App pool \u2014 retry the same typed read; only parse stdout after success
+      const recovery = spec.args[0] === "run" && spec.args[1] === "list" ? `${formatBrokerRunListRecovery(spec, jq)}; only parse stdout after success` : "retry the same typed read; only parse stdout after success";
+      process.stderr.write(`read: gh ${spec.args.slice(0, 2).join(" ")} returned ${output.trim() ? "invalid" : "empty"} JSON on the App pool \u2014 ${recovery}
 `);
       return 1;
     }
@@ -65080,13 +65579,13 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
     requireBrokerApp(label);
     try {
       if (jq === void 0) {
-        process.exitCode = await runBrokerGh(ghRun, spec);
+        process.exitCode = await runBrokerGh(ghRun, spec, void 0, void 0);
         return;
       }
       let out = "";
       const code = await runBrokerGh(ghRun, spec, (chunk) => {
         out += chunk;
-      });
+      }, jq);
       if (code === 0) await emitJson(out, jq);
       process.exitCode = code;
     } catch (e) {
@@ -65309,7 +65808,7 @@ function typedReadHint(path2) {
       return say(`mmi-cli devops read issue view <issue> --repo ${slug} --json comments`, `; a comment is read through its issue, so match the comment whose url ends in issuecomment-${id}`);
     }
     if (sub === "events" || sub === "timeline") {
-      return say(`mmi-cli devops read issue view ${item} --repo ${slug} --json state,stateReason,closedAt,labels,assignees,comments`, "; the raw event/timeline history itself has no read");
+      return say(`mmi-cli devops read issue view ${item} --repo ${slug} --json state,stateReason,closedAt,closedBy,labels,assignees,comments`, "; closedBy carries the merge evidence (merged, mergedAt, mergeCommit.oid), while the raw event/timeline history itself has no read");
     }
     return say(`mmi-cli devops read issue view ${item} --repo ${slug} --json title,body,state,labels,comments`);
   }
@@ -65339,11 +65838,17 @@ function tagsReadHint(path2) {
   const slug = `${match[1]}/${match[2]}`;
   return ` No App-token REST read exists for git tags or refs \u2014 read git tags directly with \`git ls-remote --tags origin 'refs/tags/*'\` (no token needed; \`git ls-remote origin refs/tags/<tag>\` for one tag), or read tag-backed GitHub Releases with \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/releases?per_page=20"\`.`;
 }
+function branchRulesReadHint(path2) {
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:rules/branches/[^/?#]+|branches/[^/?#]+/protection(?:/|$)|rulesets(?:/|$))`).exec(path2.split("?")[0]);
+  if (!match) return "";
+  const slug = `${match[1]}/${match[2]}`;
+  return ` No raw rules, rulesets or branch-protection read is on the App allowlist, so retrying path or query variants cannot work \u2014 inspect a PR's required status contexts with \`MMI_ACTOR=app mmi-cli devops pr checks-required <pr> --repo ${slug} --json\`, or verify repository ruleset and branch-protection health with \`mmi-cli devops bootstrap verify --repo ${slug} --json\` and \`mmi-cli devops ci audit --repo ${slug} --json\`.`;
+}
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => {
     const hint = /^[A-Za-z]:[/\\]/.test(path2) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
-    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${hint}`;
+    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${hint}`;
     return new Error(`api get: refusing '${rawPath}' \u2014${routeHints}${API_GET_RECOVERY} Only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.`);
   };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
@@ -65395,14 +65900,16 @@ async function readAppApi(path2, runner = apiReadRunner) {
 function registerApiReadCommands(program3, overrides) {
   const spawn7 = overrides?.runner ?? apiReadRunner;
   const jqRun = overrides?.jqRunner ?? systemJqRunner;
-  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts, releases)");
-  api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
-    acceptHeaderFor(v);
-    return v.trim().toLowerCase();
-  }, "json").option("--jq <expr>", JQ_HELP, (v) => parseBrokerJq(v)).option("--out <file>", "write response bytes to a file (required for, and only valid with, actions artifact zips, job logs, and release assets)").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
+  const runGet = async (req, o) => {
     if (o.jq !== void 0 && (o.accept === "raw" || o.out !== void 0)) return fail("api get: --jq is only valid with JSON stdout reads (not --accept raw or --out)");
     const zip = req.kind === "actions-artifact-zip" || req.kind === "actions-job-logs" || req.kind === "release-asset";
-    if (zip !== (o.out !== void 0)) return fail(`api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs and repos/{owner}/{repo}/releases/assets/{id}`);
+    if (zip !== (o.out !== void 0)) {
+      const shapes = "api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs and repos/{owner}/{repo}/releases/assets/{id}";
+      if (!zip && o.out !== void 0) {
+        return fail(`${shapes} \u2014 drop --out and let the JSON body go to stdout (pipe it into node/jq, or use --jq <expr>), or use the typed read (e.g. \`mmi-cli devops read run list --repo <owner/repo> --json databaseId,workflowName,event,status,conclusion\`). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
+      }
+      return fail(shapes);
+    }
     const appRoute = req.kind.startsWith("actions-") || req.kind.startsWith("release-");
     if (appRoute) requireBrokerApp("api get");
     const env = appRoute || process.env.MMI_ACTOR?.trim() !== "personal" ? brokerChildEnv() : void 0;
@@ -65423,6 +65930,28 @@ function registerApiReadCommands(program3, overrides) {
       return fail(`api get: ${(err.stderr || err.message || String(e)).trim()}`);
     }
     process.stdout.write(body);
+  };
+  const withApiGetOptions = (cmd) => cmd.option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
+    acceptHeaderFor(v);
+    return v.trim().toLowerCase();
+  }, "json").option("--jq <expr>", JQ_HELP, (v) => parseBrokerJq(v)).option("--out <file>", "write response bytes to a file (required for, and only valid with, actions artifact zips, job logs, and release assets)");
+  const api = withApiGetOptions(
+    program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs/artifacts, releases)")
+  ).argument("[path]", "allowlisted GET path \u2014 shorthand for `api get <path>` (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, _o, cmd) => {
+    if (req === void 0) {
+      return fail(`api: name an allowlisted GET path \u2014 \`mmi-cli devops api <path>\` or \`mmi-cli devops api get <path>\`. Only these GET reads are allowed: ${API_GET_ALLOWED_SHAPES}.`);
+    }
+    return runGet(req, cmd.opts());
+  });
+  withApiGetOptions(
+    api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist")
+  ).argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o, cmd) => {
+    const parentOpts = cmd.parent?.opts() ?? {};
+    return runGet(req, {
+      accept: o.accept && o.accept !== "json" ? o.accept : parentOpts.accept ?? o.accept ?? "json",
+      jq: o.jq ?? parentOpts.jq,
+      out: o.out ?? parentOpts.out
+    });
   });
 }
 
@@ -69029,6 +69558,7 @@ setGhWriteTokenProvider(() => {
   }
   return filingToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, () => void 0);
 });
+setClaimWriteTokenProvider(() => mintFilingWriteToken(appActorDeps()).then((t) => t.token));
 setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
@@ -69036,7 +69566,7 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
   appActorCommand = commandPath4;
   setAuditCommand(commandPath4);
   if (commandPath4 !== "whoami diagnose-hub") emitCliCallTelemetry(commandPath4);
-  if (commandPath4 === "ci cancel-orphans") return;
+  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel") return;
   try {
     await activateAppActor(commandPath4, process.env, () => APP_WRITE_COMMANDS.has(commandPath4) ? mintCommandWriteToken(appActorDeps(), commandPath4) : mintInstallationToken(appActorDeps()));
   } catch (e) {
@@ -69871,6 +70401,10 @@ ci.command("audit").description("read-only fleet scan: gate workflow, ruleset co
 });
 registerCiChecksWait(ci);
 registerCancelOrphans(ci, async () => (await mintCommandWriteToken(appActorDeps(), "ci cancel-orphans")).token);
+registerRunCancel(
+  program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` is the only one, and it rides the org App actions:write profile"),
+  async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token
+);
 ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {
     return fail("ci reconcile: --apply and --park-ruleset ask for opposite things; pass one");