@mutmutco/claude-plugin 4.6.37 → 4.6.39

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.6.37",
+  "version": "4.6.39",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -15691,6 +15691,9 @@ var APP_SUBPROCESS_ROUTED_COMMANDS = /* @__PURE__ */ new Set([
   // #9871: queue enqueue + auto-merge fallback ride ghFilingAppEnv (#9490/#9528; receipt credential app_installation).
   "pr land"
 ]);
+function ineligibleActorNote(commandPath4) {
+  return commandPath4 === "board move" ? "app actor: board move retains the existing process identity; status-write credential is selected separately and reported in its receipt" : `app actor: note, not a failure \u2014 '${commandPath4}' is personal-only (viewer/@me/authorship), so it ran on the personal token despite ${APP_ACTOR_ENV}=app`;
+}
 async function activateAppActor(commandPath4, env, mint, note = (line) => process.stderr.write(`${line}
 `)) {
   activeQuotaScope = void 0;
@@ -15703,7 +15706,7 @@ async function activateAppActor(commandPath4, env, mint, note = (line) => proces
   if (!APP_ELIGIBLE_COMMANDS.has(commandPath4) && !APP_WRITE_COMMANDS.has(commandPath4)) {
     if (requested === "app" && !notedIneligibleCommand && !APP_SUBPROCESS_ROUTED_COMMANDS.has(commandPath4)) {
       notedIneligibleCommand = true;
-      note(`app actor: note, not a failure \u2014 '${commandPath4}' is personal-only (viewer/@me/authorship), so it ran on the personal token despite ${APP_ACTOR_ENV}=app`);
+      note(ineligibleActorNote(commandPath4));
     }
     return "personal";
   }
@@ -22767,23 +22770,8 @@ var BOARD_WRITE_REFUSAL_TYPES = /* @__PURE__ */ new Set(["INSUFFICIENT_SCOPES",
 async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
   if (process.env.MMI_ACTOR?.trim() === "app") {
     const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
-    try {
-      await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
-      return { credential: "app_installation" };
-    } catch (error) {
-      const refusal = error;
-      if (refusal?.rateLimited !== true || refusal.status !== 503 && refusal.status !== 429) throw error;
-      try {
-        const identity = await githubKeyringTokenRead();
-        if (identity.state !== "ok") throw error;
-        const owner = createGitHubClient({ token: async () => identity.token });
-        await owner.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
-      } catch {
-        throw error;
-      }
-      process.stderr.write("board write: Hub App allowance exhausted \u2014 wrote with your own GitHub login (#9053)\n");
-      return { credential: "user" };
-    }
+    await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
+    return { credential: "app_installation" };
   }
   try {
     await client.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
@@ -22928,19 +22916,20 @@ function renderBoardItem(item) {
   }
   return lines2.join("\n");
 }
+var CACHED_CONFIRM_CLAUSE = " \xB7 items closed/created after the build may still differ \u2014 confirm with --direct";
 function renderCachedBoardSource(report) {
   if (typeof report.stale?.ageMs === "number") {
     const ageSeconds = Math.floor(report.stale.ageMs / 1e3);
-    return `source: cache \xB7 built ${report.builtAt ? `${report.builtAt} (${ageSeconds}s old)` : `${ageSeconds}s ago`} \xB7 stale`;
+    return `source: cache \xB7 built ${report.builtAt ? `${report.builtAt} (${ageSeconds}s old)` : `${ageSeconds}s ago`} \xB7 stale${CACHED_CONFIRM_CLAUSE}`;
   }
   if (report.builtAt) {
     const builtMs = Date.parse(report.builtAt);
     if (Number.isFinite(builtMs)) {
-      return `source: cache \xB7 built ${report.builtAt} (${Math.max(0, Math.floor((Date.now() - builtMs) / 1e3))}s old) \xB7 fresh`;
+      return `source: cache \xB7 built ${report.builtAt} (${Math.max(0, Math.floor((Date.now() - builtMs) / 1e3))}s old) \xB7 fresh${CACHED_CONFIRM_CLAUSE}`;
     }
-    return `source: cache \xB7 built ${report.builtAt} \xB7 fresh`;
+    return `source: cache \xB7 built ${report.builtAt} \xB7 fresh${CACHED_CONFIRM_CLAUSE}`;
   }
-  return "source: cache";
+  return `source: cache${CACHED_CONFIRM_CLAUSE}`;
 }
 function renderBoardReport(report) {
   const lines2 = [`Board \xB7 ${report.project.title} \xB7 @${report.viewer}`, report.source === "cache" ? renderCachedBoardSource(report) : renderBoardSource()];
@@ -25235,6 +25224,20 @@ function upsertManagedSeedBlock(current, desired, begin, end) {
     action: "replace"
   };
 }
+async function headStrictlyBehind(execGit, head, remoteSha, defaultBranch) {
+  try {
+    await execGit(["fetch", "--no-tags", "--quiet", "origin", `refs/heads/${defaultBranch}`]);
+  } catch (e) {
+    return { superseded: false, unknown: `could not fetch origin/${defaultBranch} to check ancestry (${e.message})` };
+  }
+  try {
+    await execGit(["merge-base", "--is-ancestor", head, remoteSha]);
+    return { superseded: true };
+  } catch (e) {
+    if (e.code === 1) return { superseded: false };
+    return { superseded: false, unknown: `could not prove whether this checkout is an ancestor of origin/${defaultBranch} (${e.message}) \u2014 a shallow checkout cannot prove ancestry, so fetch full history` };
+  }
+}
 async function resolveHubSeedSource(execGit, defaultBranch = "development") {
   let status;
   try {
@@ -25262,9 +25265,19 @@ remedy (non-destructive): run this command from a clean dedicated worktree \u201
     return { ok: false, reason: `\`git ls-remote origin refs/heads/${defaultBranch}\` returned nothing \u2014 refusing to read seeds without a known upstream revision` };
   }
   if (head !== remoteSha) {
+    const behind = await headStrictlyBehind(execGit, head, remoteSha, defaultBranch);
+    if (behind.superseded) {
+      return {
+        ok: false,
+        superseded: true,
+        head,
+        remoteSha,
+        reason: `this checkout (${head}) is behind origin/${defaultBranch} (${remoteSha}) \u2014 a newer commit overtook this run, whose own queued run owns the tick; seeding nothing and exiting green`
+      };
+    }
     return {
       ok: false,
-      reason: `this checkout (${head}) is not origin/${defaultBranch} (${remoteSha}) \u2014 fast-forward to origin/${defaultBranch} first; a stale or ahead checkout must not seed the fleet`
+      reason: `this checkout (${head}) is not origin/${defaultBranch} (${remoteSha}) \u2014 fast-forward to origin/${defaultBranch} first; a stale or ahead checkout must not seed the fleet${behind.unknown ? ` (${behind.unknown})` : ""}`
     };
   }
   return { ok: true, sha: head };
@@ -28392,10 +28405,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.37",
-    tag: "v4.6.37",
-    commit: "94211a24e48a",
-    npm: "@mutmutco/cli@4.6.37"
+    version: "4.6.39",
+    tag: "v4.6.39",
+    commit: "2669c496b69e",
+    npm: "@mutmutco/cli@4.6.39"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28412,14 +28425,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.37"
+          v3Target: "v4.6.39"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.37 and redeploy the Hub Lambda from tag v4.6.37 (94211a24e48a); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.37 (@mutmutco/cli@4.6.37, tag commit 94211a24e48a \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.39 and redeploy the Hub Lambda from tag v4.6.39 (2669c496b69e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.39 (@mutmutco/cli@4.6.39, tag commit 2669c496b69e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -44002,7 +44015,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     for (let readAttempt = 0; readAttempt < maxReads; readAttempt++) {
       if (readAttempt) await sleep3(readAttempt * 1e3);
       try {
-        const observed = await readPrMergeQueue(pr, repo, read);
+        const observed = await readPrMergeQueue(pr, repo, read, options.sleep);
         if (observed.state === "MERGED" && observed.headRefOid === head) return markReenqueued({ mergeStatus: "merged" });
         if (observed.isInMergeQueue && observed.headRefOid === head) {
           const entry = observed.mergeQueueEntry;
@@ -44044,13 +44057,13 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
   if (receipt && (receipt.state === "enqueued" || receipt.state === "merged")) {
     if (receipt.head.toLowerCase() !== head.toLowerCase()) {
       try {
-        const observed = await readPrMergeQueue(pr, repo, read);
+        const observed = await readPrMergeQueue(pr, repo, read, options.sleep);
         superseded = observed.state === "OPEN" && !observed.isInMergeQueue;
       } catch {
       }
     } else {
       try {
-        const observed = await readPrMergeQueue(pr, repo, read);
+        const observed = await readPrMergeQueue(pr, repo, read, options.sleep);
         if (observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid?.toLowerCase() === receipt.head.toLowerCase()) {
           const boundMs = receipt.queueEntry ? Date.parse(receipt.queueEntry.enqueuedAt) : receipt.observedAt + UNWITNESSED_EJECTION_GRACE_MS;
           const events = await readArrayPages(
@@ -44253,6 +44266,15 @@ ${list}
 Co-authored-by: GitHub <noreply@github.com>
 `;
 }
+var WAIVER_KEYS = /^(?:Test-Policy-Override|Runbook-Unaffected)\s*:/i;
+function clipTrailer(trailer) {
+  return trailer.length > 120 ? `${trailer.slice(0, 117)}...` : trailer;
+}
+function describeWaiverText(label, message2, cwd) {
+  const block = parseTrailers(message2, cwd).filter((trailer) => WAIVER_KEYS.test(trailer));
+  const found = block.length ? `final trailer block holds ${block.map((trailer) => `\`${clipTrailer(trailer)}\``).join(" and ")}` : "git parses no Test-Policy-Override or Runbook-Unaffected trailer there";
+  return `${label}: ${found}`;
+}
 function checkQueueSquashOverride(title, pr, messages, root) {
   if (messages.length <= 1 || !messages.some((message2) => /^\s*Test-Policy-Override\s*:/im.test(`${message2.headline}
 ${message2.body}`)) || readMessageOverride2(githubQueueSquashMessage(title, pr, messages), root)) return void 0;
@@ -44386,7 +44408,8 @@ ${pull.body}`;
   }
   const requiredBody = options.bodyText ?? composedBody;
   const prBodyPreservesOverrides = requiredBody != null && method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null && prBodyPreservesCommitOverrides(messages, headline, pull.body, process.cwd());
-  if (requiredBody && !prBodyPreservesOverrides && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
+  const queueKeepsWaiver = options.bodyText == null && method !== "SQUASH" && Boolean(readMessageOverride2(actualMessage, process.cwd()));
+  if (requiredBody && !prBodyPreservesOverrides && !queueKeepsWaiver && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
     if (method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null) {
       return {
         kind: "refused",
@@ -44398,7 +44421,9 @@ ${pull.body}`;
             issueTargets: [],
             nextAction: `PR author: this repository squashes with PR_BODY, so place the required Test-Policy-Override trailer(s) in the PR body final trailer block (e.g. \`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) without a body override, then rerun \`pr land\`. Keep repository settings unchanged.`
           },
-          error: "queue preparation needed: repository squash policy is PR_BODY, and the PR body does not carry the required Test-Policy-Override trailer(s) in its final Git-recognized trailer block"
+          error: `queue preparation needed: repository squash policy is PR_BODY, and the PR body does not carry the required Test-Policy-Override trailer(s) in its final Git-recognized trailer block \u2014 ${describeWaiverText("the PR body", pull.body, process.cwd())}; ${describeWaiverText("the source commit messages", messages.map((message2) => `${message2.headline}
+
+${message2.body}`).join("\n\n"), process.cwd())}`
         }
       };
     }
@@ -44407,9 +44432,12 @@ ${pull.body}`;
       return keys.length ? keys.join(", ") : "none";
     };
     const source = options.bodyText != null ? "the explicit body override" : "the body composed from the source commit messages";
+    const sentLabel = method === "SQUASH" ? `squash ${policy.body ?? "unknown"}, ${messages.length} commit message${messages.length === 1 ? "" : "s"}` : `${method}${repository.merge_commit_message === "PR_BODY" ? " + PR body" : ""}`;
     const detail = `the requested sanitized body or trailer arrangement cannot be sent to queue admission: queue merge method ${method}, squash body policy ${policy.body ?? "unknown"}; required body is ${source} (trailer keys: ${trailerKeys(`${headline}
 
-${requiredBody}`)}), but the message the queue would send carries trailer keys: ${trailerKeys(actualMessage)}`;
+${requiredBody}`)}), but the message the queue would send carries trailer keys: ${trailerKeys(actualMessage)}. ${describeWaiverText(`the message the queue sends (${sentLabel})`, actualMessage, process.cwd())}; ${describeWaiverText("the source commit messages", messages.map((message2) => `${message2.headline}
+
+${message2.body}`).join("\n\n"), process.cwd())}.`;
     const next = options.bodyText != null ? `PR author: a merge queue accepts no body override; drop --body/--squash-body-file and place the required trailer(s) where the queue's ${method}${method === "SQUASH" ? ` (${policy.body})` : ""} message reads them, then rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.` : method !== "SQUASH" ? `PR author: the queue's ${method} method keeps the original commit messages, so the required trailer(s) must sit in a source commit message's final trailer block; amend the commit, push, re-run checks and \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.` : policy.body === "BLANK" ? `PR author: squash body policy BLANK sends an empty body, so no trailer from the commits or PR body reaches the queue commit; the waiver cannot survive queue admission with unchanged repository settings \u2014 remove the need for the override or ask a maintainer. Keep repository settings unchanged.` : `PR author: squash body policy ${policy.body} does not reproduce the composed body; consolidate the required trailer(s) into one source commit message's final trailer block, push, re-run checks and \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.`;
     const caveat = " GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy; the combined queue candidate must pass with the shared trailer reader.";
     return { kind: "refused", result: preparation("queue-message-override", [], detail, next + caveat) };
@@ -44459,7 +44487,7 @@ async function abandonQueueAdmission(pr, repo, options = {}) {
   }
   let snapshot;
   try {
-    snapshot = await readPrMergeQueue(pr, repo, options.read ?? actorReadApi);
+    snapshot = await readPrMergeQueue(pr, repo, options.read ?? actorReadApi, options.sleep);
   } catch (error) {
     return refuse(`the PR and queue state could not be read (${error.message}); the admission is unchanged`);
   }
@@ -44484,13 +44512,19 @@ function decideQueueMergeRoute(hasQueue, method, headRef) {
   if (!hasQueue) return "normal";
   return method === "--merge" && /^(release-align|hotfix-fold)\//.test(headRef) ? "admin-true-merge" : "pr-land";
 }
-async function readPrMergeQueue(pr, repo, gh2 = actorReadApi) {
+async function readPrMergeQueue(pr, repo, gh2 = actorReadApi, sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))) {
   if (!/^\d+$/.test(pr)) throw new Error("merge queue read requires a PR number");
-  const result = await queueGraphql(
-    repo,
-    `pullRequest(number:${pr}) { state isInMergeQueue mergeQueueEntry { state position enqueuedAt headCommit { oid } } autoMergeRequest { enabledAt } headRefOid }`,
-    gh2
-  );
+  const fields = `pullRequest(number:${pr}) { state isInMergeQueue mergeQueueEntry { state position enqueuedAt headCommit { oid } } autoMergeRequest { enabledAt } headRefOid }`;
+  let result;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      result = await queueGraphql(repo, fields, gh2);
+      break;
+    } catch (error) {
+      if (attempt >= 2 || !isUpstreamGitHubFault(execErrorText(error))) throw error;
+      await sleep2(2e3 * (attempt + 1));
+    }
+  }
   if (!result.pullRequest) throw new Error(`merge queue PR #${pr} not found`);
   const entry = result.pullRequest.mergeQueueEntry;
   if (entry && (entry.enqueuedAt !== void 0 && !Number.isFinite(Date.parse(entry.enqueuedAt)) || entry.headCommit && !/^[a-f0-9]{40}$/i.test(entry.headCommit.oid))) throw new Error("queue entry identity is unreadable");
@@ -44919,7 +44953,7 @@ async function dispatchWorkflow(repo, workflow, ref, inputs, deps) {
   const fields = ["-f", `ref=${ref}`];
   const names = /* @__PURE__ */ new Set();
   for (const input of inputs) {
-    const match = /^([A-Za-z_][A-Za-z0-9_]{0,63})=([^\r\n]{0,2048})$/.exec(input);
+    const match = /^([A-Za-z_][A-Za-z0-9_-]{0,63})=([^\r\n]{0,2048})$/.exec(input);
     if (!match || names.has(match[1])) throw new Error("run dispatch: invalid or duplicate input");
     names.add(match[1]);
     fields.push("-f", `inputs[${match[1]}]=${match[2]}`);
@@ -46446,7 +46480,7 @@ function refuseNotClaimable(e, json) {
   process.exitCode = 1;
   return true;
 }
-var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array:\n  {project, viewer, repo, primary, secondary, items, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET for ownership context:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\n`items` (#9974) is that same flat row array, already on the full report: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n  node -e \"const b=require('./.jerv/tmp/board.json');for(const i of b.items)console.log(i.number,i.status,i.title)\"\nIt is built from the same flattener as --flat, so `const rows = j.items || j` is now safe on either form.\n\nAdd --flat with --json for that array as the WHOLE output (no project/viewer/warnings envelope):\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nNever sniff the envelope \u2014 read `report.items` (or `primary`/`secondary`) by name. `j.items ?? j.rows ?? j`,\n`Object.values(j)` and any generic \"find the list\" wrapper are still guesses: before `items` existed they\nthrew `items is not iterable` before any row was read (#9956), and `j.rows` has never been a key. For a\nnumber|status|claim|title projection across non-Done rows, read --json --flat --out .jerv/tmp/board.json\nand filter that array locally (identical rows to `report.items`):\n  mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n\nA zero-byte or empty .jerv/tmp/*.json means the read FAILED \u2014 `Unexpected end of JSON input` is\nthe symptom of shell-redirected empty stdout, not malformed JSON \u2014 re-run with --out (which writes\nthe file only on success) and check the exit code before parsing.\n\nChanging an existing item's Status is a move, never a hand-written `gh api graphql`\n`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status\nfield-id lookup:\n  mmi-cli oracle board move <status> <ref>\n";
+var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array:\n  {project, viewer, repo, primary, secondary, items, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET for ownership context:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\n`items` (#9974) is that same flat row array, already on the full report: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n  node -e \"const b=require('./.jerv/tmp/board.json');for(const i of b.items)console.log(i.number,i.status,i.title)\"\nIt is built from the same flattener as --flat, so `const rows = j.items || j` is now safe on either form.\n\nAdd --flat with --json for that array as the WHOLE output (no project/viewer/warnings envelope):\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nNever sniff the envelope \u2014 read `report.items` (or `primary`/`secondary`) by name. `j.items ?? j.rows ?? j`,\n`Object.values(j)` and any generic \"find the list\" wrapper are still guesses: before `items` existed they\nthrew `items is not iterable` before any row was read (#9956), and `j.rows` has never been a key. For a\nnumber|status|claim|title projection across non-Done rows, read --json --flat --out .jerv/tmp/board.json\nand filter that array locally (identical rows to `report.items`):\n  mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new. That age grades the\nCOPY, not its content: the line ends `\xB7 items closed/created after the build may still differ \u2014 confirm\nwith --direct` (#10028), so re-read with --direct before treating a row as still open or still present.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n\nA zero-byte or empty .jerv/tmp/*.json means the read FAILED \u2014 `Unexpected end of JSON input` is\nthe symptom of shell-redirected empty stdout, not malformed JSON \u2014 re-run with --out (which writes\nthe file only on success) and check the exit code before parsing.\n\nChanging an existing item's Status is a move, never a hand-written `gh api graphql`\n`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status\nfield-id lookup:\n  mmi-cli oracle board move <status> <ref>\n";
 function flattenBoardReport(report) {
   const closingByRef = /* @__PURE__ */ new Map();
   for (const pull of report.pullRequests ?? []) {
@@ -51148,6 +51182,13 @@ var declaredProjectAdmins = (meta) => {
   return Array.isArray(list) ? list.filter((entry) => typeof entry === "string") : [];
 };
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
+function reportSuperseded(prefix, source, json) {
+  const head = source.head.slice(0, 8);
+  const remote = source.remoteSha.slice(0, 8);
+  const summary = `${prefix}: superseded \u2014 this checkout (${head}) is behind origin/development (${remote}); a newer run owns this tick, nothing seeded`;
+  if (json) console.log(JSON.stringify({ status: "superseded", checkoutSha: source.head, remoteSha: source.remoteSha, summary }, null, 2));
+  else console.log(summary);
+}
 async function gateRenderDiff(current, rendered) {
   const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path37.join)((0, import_node_os21.tmpdir)(), "mmi-gate-diff-"));
   const before = (0, import_node_path37.join)(dir, "committed-gate.yml");
@@ -51235,7 +51276,10 @@ async function propagationScope(classes, what) {
 }
 async function propagatePins(apply, json) {
   const source = await resolveHubSeedSource(execGitForSeedSource);
-  if (apply && !source.ok) return fail(`bootstrap propagate --pins --apply: ${source.reason}`);
+  if (apply && !source.ok) {
+    if (source.superseded) return reportSuperseded("bootstrap propagate --pins --apply", source, json);
+    return fail(`bootstrap propagate --pins --apply: ${source.reason}`);
+  }
   const { classOf, inClassRepos, canarySlug, sourcePilot } = await propagationScope(null, "hub action pins");
   const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
   const repos = [];
@@ -52360,7 +52404,10 @@ LIVE apply to ${repo}:
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs40.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
-    if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
+    if (!seedSource.ok) {
+      if (seedSource.superseded) return reportSuperseded("bootstrap propagate", seedSource, o.json);
+      return fail(`bootstrap propagate: ${seedSource.reason}`);
+    }
     const manifest = loadBootstrapSeeds((0, import_node_fs40.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter(isPropagatableSeed);
     if (!o.target) {
@@ -53359,7 +53406,7 @@ async function stageStatus(member, stage, deps) {
   if (pin) {
     served = pin;
     source = "registry-pin";
-  } else if (stage === "dev" || !member.bundles[stage]) {
+  } else {
     try {
       const status = await deps.deploy(member.repo, stage);
       deployStatus = status;
@@ -53505,10 +53552,12 @@ async function newestGreen(deps, repo) {
 async function readSuiteDev(deps) {
   const report = await deps.status();
   return Promise.all(report.members.map(async (m) => {
-    const st = m.stages.find((s) => s.stage === "dev");
+    const track = deps.releaseTrack ? await deps.releaseTrack(m.repo).catch(() => void 0) : void 0;
+    const stage = track === "single" ? "main" : "dev";
+    const st = m.stages.find((s) => s.stage === stage);
     const row = { repo: m.repo, head: st.head, served: st.served };
-    if (st.source === "n/a") return { ...row, state: "converged", note: "no dev stage" };
-    if (st.lag === false) return { ...row, state: "converged", note: "dev serves the development head" };
+    if (st.source === "n/a") return { ...row, state: "converged", note: `no ${stage} stage` };
+    if (st.lag === false) return { ...row, state: "converged", note: `${stage} serves the development head` };
     let green;
     try {
       green = await newestGreen(deps, m.repo);
@@ -53516,10 +53565,10 @@ async function readSuiteDev(deps) {
       return { ...row, state: "unknown", note: `checks unreadable (${e.message})` };
     }
     const last = st.deployStatus?.lastRun;
-    if (st.served === "unknown") return { ...row, green, state: "unknown", note: `dev version unproven (health probe failed or no deploy record)${last?.url ? `; last deploy ${last.conclusion ?? last.status}: ${last.url}` : ""}` };
-    if (same(st.served, green)) return { ...row, green, state: "converged", note: `dev serves the newest green SHA; head ${short2(st.head)} is not green yet` };
+    if (st.served === "unknown") return { ...row, green, state: "unknown", note: `${stage} version unproven (health probe failed or no deploy record)${last?.url ? `; last deploy ${last.conclusion ?? last.status}: ${last.url}` : ""}` };
+    if (same(st.served, green)) return { ...row, green, state: "converged", note: `${stage} serves the newest green SHA; head ${short2(st.head)} is not green yet` };
     if (!green) return { ...row, state: "blocked", note: `no green SHA in the last ${WALK} development commits` };
-    if (last?.conclusion === "failure") return { ...row, green, state: "blocked", note: `last dev deploy failed: ${last.url ?? "no run url"}` };
+    if (last?.conclusion === "failure") return { ...row, green, state: "blocked", note: `last ${stage} deploy failed: ${last.url ?? "no run url"}` };
     return { ...row, green, state: "lagging", note: `newest green ${short2(green)} not deployed yet; the dev auto-deploy sweep (every 15 min) picks it up` };
   }));
 }
@@ -58738,6 +58787,11 @@ ${lines2}`);
       if (deps.attach) {
         const attached = await deps.attach(row.number, rowRepo(spec), rowPriority);
         row.onBoard = attached.onBoard;
+        if (attached.prioritySet === false) {
+          row.status = "partial";
+          row.prioritySet = false;
+          row.priorityError = attached.priorityError;
+        }
         if (attached.projectItemId) row.projectItemId = attached.projectItemId;
         if (attached.boardAttach) {
           row.boardAttach = attached.boardAttach;
@@ -63536,8 +63590,10 @@ async function attachToProject(issueNumber, repo, priority) {
           await setBoardItemPriority(defaultGitHubClient(), cfg, projectItemId2, priority);
         } catch (e) {
           const err = e;
-          process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(err.stderr || err.message || String(e)).trim()}
+          const priorityError = (err.stderr || err.message || String(e)).trim();
+          process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${priorityError}; issue and board attachment already exist; do not recreate the issue
 `);
+          return { projectItemId: projectItemId2, onBoard: true, credential: "app_installation", prioritySet: false, priorityError };
         }
       }
       return { projectItemId: projectItemId2, onBoard: true, credential: "app_installation" };
@@ -63887,12 +63943,13 @@ function registerCollaborationCommands(program3) {
 `);
     const linkRecovery = parentRecoveryRef !== void 0 && !parent ? `mmi-cli oracle issue link-child ${parentRecoveryRef} ${childRef}` : void 0;
     console.log(JSON.stringify({
-      status: boardRecovery || linkRecovery ? "partial" : "created",
+      status: boardRecovery || linkRecovery || attached.prioritySet === false ? "partial" : "created",
       ...created,
       label: issueType,
       priority,
       projectItemId,
       onBoard,
+      ...attached.prioritySet === false ? { prioritySet: false, priorityError: attached.priorityError } : {},
       ...attachCredential ? { credential: attachCredential } : {},
       // #5489: partial receipt when the GitHub issue landed but Project v2 attach hit GraphQL quota.
       ...!onBoard ? {
@@ -64279,8 +64336,9 @@ ${list}`);
       }
     }
     const created = requireGhCreateOk(await ghCreate(args), "skill-lesson");
-    const { projectItemId, onBoard } = await attachToProject(created.number, targetRepo2, priority);
-    console.log(JSON.stringify({ ...created, projectItemId, onBoard }));
+    const attached = await attachToProject(created.number, targetRepo2, priority);
+    const { projectItemId, onBoard } = attached;
+    console.log(JSON.stringify({ ...created, projectItemId, onBoard, ...attached.prioritySet === false ? { status: "partial", prioritySet: false, priorityError: attached.priorityError } : {} }));
   });
   const pr = program3.command("pr").description("pull requests \u2014 reliable create with structured output");
   withExamples(pr.command("create").description("create a PR and print {number,url} JSON").option("--title <title>", "PR title").option("--title-file <path|->", "read the PR title from a UTF-8 file, or from stdin with -").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--draft", "open the PR in draft state (#2667)").option("--no-zeroci", "compatibility option; pr create does not mint receipts").option("--json", "machine-readable output (default; accepted for parity)").action(async (o) => {
@@ -67123,6 +67181,8 @@ function registerSuiteCommands(program3) {
     const status = suiteStatusDeps(github, registry2);
     const deps = {
       status: () => readSuiteStatus(status),
+      // #10020: a single-track member's one live stage is `main`; judge that row instead of the dev one.
+      releaseTrack: status.releaseTrack,
       commits: async (repo, limit) => (await github.rest("GET", `repos/${repo}/commits?sha=development&per_page=${limit}`) ?? []).map((c) => c.sha),
       checkRuns: async (repo, sha) => (await github.rest("GET", `repos/${repo}/commits/${sha}/check-runs?per_page=100`))?.check_runs ?? [],
       requiredChecks: async (repo) => {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.37",
+  "version": "4.6.39",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.6.37",
+  "version": "4.6.39",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -83,7 +83,9 @@ jobs:
     # that runs the full job; main must never become skippable via bootstrap vars alone while the
     # org ruleset still requires `gate` on main.
     if: ${{ github.event_name != 'push' || github.ref_name == '{{GATE_FULL_RUN_BRANCH}}' || github.ref_name == 'main' || github.ref_type == 'tag' }}
-    runs-on: ubuntu-latest  # #9248: included GitHub-hosted capacity, first choice for CI.
+    # #9248: included GitHub-hosted capacity, first choice for CI.
+    # #9668: GATE_HOSTED_SPILL_QUEUE=off routes it to the owned mmi-live lanes at Actions run-out.
+    runs-on: ${{ vars.GATE_HOSTED_SPILL_QUEUE == 'off' && fromJSON('["self-hosted","linux","x64","mmi-live"]') || 'ubuntu-latest' }}
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }{{GATE_SERVICES_YAML}}
     steps:{{GATE_VERDICT_STEP_YAML}}

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -21,7 +21,8 @@ jobs:
     # the earlier "included Ubuntu for light pre-gates" permission; it creates no new runner class — standard
     # included hosted labels are allowed (`ubuntu-*`, `windows-*`, `macos-*`, ARM variants; #8977); only
     # larger/paid images, GPU and custom runner groups stay refused.
-    runs-on: ubuntu-latest
+    # #9668: GATE_HOSTED_SPILL_QUEUE=off routes it to the owned mmi-live lanes at Actions run-out.
+    runs-on: ${{ vars.GATE_HOSTED_SPILL_QUEUE == 'off' && fromJSON('["self-hosted","linux","x64","mmi-live"]') || 'ubuntu-latest' }}
     timeout-minutes: 10
     steps:{{GATE_VERDICT_STEP_YAML}}
       - if: ${{ steps.development-gate.outputs.reuse != 'true' }}