@mutmutco/codex-plugin 4.5.148 → 4.5.150

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.148",
+  "version": "4.5.150",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -16296,6 +16296,9 @@ function checkRunbookClaims(root, docs, deps) {
   }
   return findings;
 }
+function localRunbookBase(refExists) {
+  return ["origin/development", "origin/main"].find(refExists);
+}
 function checkRunbookCoverage(docs, base, git3) {
   const changed = git3(["diff", "--name-only", `${base}...HEAD`]).split(/\r?\n/).filter(Boolean);
   const findings = [];
@@ -18666,10 +18669,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.148",
-    tag: "v4.5.148",
-    commit: "4fd7a2ad34c1",
-    npm: "@mutmutco/cli@4.5.148"
+    version: "4.5.150",
+    tag: "v4.5.150",
+    commit: "4dc71e3761ec",
+    npm: "@mutmutco/cli@4.5.150"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18686,14 +18689,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.148"
+          v3Target: "v4.5.150"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.148 and redeploy the Hub Lambda from tag v4.5.148 (4fd7a2ad34c1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.148 (@mutmutco/cli@4.5.148, tag commit 4fd7a2ad34c1 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.150 and redeploy the Hub Lambda from tag v4.5.150 (4dc71e3761ec); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.150 (@mutmutco/cli@4.5.150, tag commit 4dc71e3761ec \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -26425,6 +26428,7 @@ async function runTrainDoctor(input) {
     const emitters = (workflows ?? []).filter((f) => parseWorkflowJobIds(f.body).some((id) => required.some((context) => contextMatchesJobId(id, context))));
     const gateFiles = emitters.length ? emitters : (workflows ?? []).filter((f) => isGateWorkflowPath(f.path));
     const gates = gateFiles.length ? gateFiles.map((f) => f.path.split("/").pop()) : ["gate"];
+    const tagGateAwaitsPush = new Set(gateFiles.filter((f) => f.body.includes("scripts/gate-tag-reuse.mjs")).map((f) => f.path.split("/").pop()));
     try {
       const tip = await git3(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${startBranch}`]);
       for (const workflow of gates) {
@@ -26432,7 +26436,8 @@ async function runTrainDoctor(input) {
         let lastUrl = run.runUrl;
         let elapsed = 0;
         const startedAt = Date.now();
-        while (input.refuse && run.read === "found" && run.conclusion === "pending" && elapsed < CANDIDATE_PUSH_GATE_WAIT_MS) {
+        const awaitsPush = tagGateAwaitsPush.has(workflow);
+        while (input.refuse && !awaitsPush && run.read === "found" && run.conclusion === "pending" && elapsed < CANDIDATE_PUSH_GATE_WAIT_MS) {
           train.warn?.(`candidate push gate ${run.runUrl} still running \u2014 ${elapsed / 1e3}s elapsed (20m bound)`);
           await deps.sleep(CANDIDATE_PUSH_GATE_POLL_MS);
           run = await readTargetRun(train, repo, { workflow, event: "push" }, tip);
@@ -26454,6 +26459,8 @@ async function runTrainDoctor(input) {
           } catch {
           }
           add({ code: "candidate-push-gate-red", severity: "blocker", source: "origin", title: `${workflow} push gate failed on ${startBranch}@${tip.slice(0, 12)} \u2014 ${url}`, remedy: `${url} \u2014 failed job(s): ${jobs}. Fix on development through a normal CI-gated PR and rerun; --heal never clears a red gate` });
+        } else if (run.conclusion === "pending" && awaitsPush) {
+          add({ code: "candidate-push-gate-running", severity: "info", source: "origin", title: `${workflow} push gate still running \u2014 ${url}; the tag gate waits on it (scripts/gate-tag-reuse.mjs), so the train does not`, remedy: "nothing \u2014 a red push gate still blocks; the tag gate runs its full test union if this run ends red or times out (#8318)" });
         } else if (run.conclusion === "pending") {
           add({ code: "candidate-push-gate-running", severity: "warning", source: "origin", title: `${workflow} push gate still running \u2014 ${url}`, remedy: "wait for the run to conclude and rerun; apply waits up to 20 minutes before refusing" });
           if (input.refuse) throw new Error(`candidate push gate still running after 20 minutes \u2014 ${url}; nothing was tagged`);
@@ -40295,7 +40302,8 @@ function boardAdvanceFailureMessage(result) {
 }
 
 // src/pr-land.ts
-var PR_LAND_QUEUE_TIMEOUT_MS = 45 * 6e4;
+var PR_LAND_QUEUE_TIMEOUT_MS = 75 * 6e4;
+var PR_LAND_QUEUE_BATCH_SIZE = 5;
 function prHeadBehindBase(input) {
   if ((input.mergeStateStatus ?? "").toUpperCase() === "BEHIND") return true;
   return /out[- ]of[- ]date|not up to date|up to date with the base|update (?:the|your) branch/i.test(input.message ?? "");
@@ -40349,6 +40357,12 @@ async function updatePrHeadFromBase(input) {
   throw new Error(`GitHub accepted the update of ${input.head} from ${input.base} but the head did not move \u2014 check the PR, then rerun`);
 }
 var PR_LAND_POLL_MS = 6e4;
+var PR_LAND_POLL_MAX_MS = 5 * 6e4;
+function prLandPollDelayMs(attempt, waiting) {
+  const load = Math.max(1, Math.ceil(waiting / PR_LAND_QUEUE_BATCH_SIZE));
+  const age = Math.min(2, 1 + Math.floor(attempt / 15) * 0.5);
+  return Math.min(PR_LAND_POLL_MAX_MS, Math.round(PR_LAND_POLL_MS * load * age));
+}
 var PR_LAND_EJECT_CONFIRM_MS = 2e4;
 var PR_LAND_ENQUEUE_TIMEOUT_MS = 10 * 6e4;
 var PR_LAND_STATE_READ_RETRIES = 3;
@@ -40470,8 +40484,8 @@ async function runPrLand(prNumber, options, deps) {
     if (merge.mergeStatus === "merged") {
       return queueMerged(base, deps);
     }
-    const deadline = (deps.now ?? (() => Date.now()))() + PR_LAND_QUEUE_TIMEOUT_MS;
-    await (deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))))(PR_LAND_POLL_MS);
+    const deadline = (deps.now ?? (() => Date.now()))() + (options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS);
+    await (deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))))(deps.pollDelayMs?.(0) ?? PR_LAND_POLL_MS);
     return pollPrMergeQueue(prNumber, options, deps, base, void 0, deadline);
   }
   if (merge.mergeStatus === "merged") {
@@ -40510,7 +40524,9 @@ function queueMerged(base, deps) {
 async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
   const now = deps.now ?? (() => Date.now());
   const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
-  const deadline = deadlineMs ?? now() + PR_LAND_QUEUE_TIMEOUT_MS;
+  const timeoutMs = options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS;
+  const deadline = deadlineMs ?? now() + timeoutMs;
+  let attempt = 0;
   while (now() < deadline) {
     const read = snapshot ?? await deps.readMergeQueue(pr, base.repo);
     snapshot = void 0;
@@ -40540,16 +40556,45 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
       deps.queueProgress?.(result2);
       return result2;
     }
-    await sleep2(PR_LAND_POLL_MS);
+    await sleep2(deps.pollDelayMs?.(++attempt) ?? PR_LAND_POLL_MS);
   }
   const result = {
     ...base,
     mergeQueue: { ...base.mergeQueue, state: "timeout" },
-    error: "merge queue did not reach MERGED within 45 minutes \u2014 rerun pr land to resume polling"
+    error: `merge queue did not reach MERGED within ${Math.round(timeoutMs / 6e4)} minutes \u2014 rerun pr land to resume polling`
   };
   deps.queueProgress?.(result);
   return result;
 }
+function prLandOutcome(result) {
+  if (result.status !== "failed" && result.status !== "queued") return "merged";
+  if (result.status === "queued") return "queued";
+  const state = result.mergeQueue?.state;
+  return state === "ejected" || state === "timeout" ? state : "failed";
+}
+async function landMany(prs, landOne, cleanup, hooks) {
+  const safe = async (pr) => landOne(pr).catch((e) => ({ status: "failed", repo: "", pr, base: "", error: e.message }));
+  return Promise.all(prs.map(async (pr) => {
+    let result = await safe(pr);
+    if (prLandOutcome(result) === "ejected") {
+      hooks?.onRetry?.(pr, result);
+      result = { ...await safe(pr), retriedAfterEjection: true };
+    }
+    const outcome = prLandOutcome(result);
+    const cleaned = result.status === "merged-via-queue" ? await cleanup(result).catch((e) => `cleanup failed: ${e.message}`) : void 0;
+    hooks?.onDone?.();
+    return { pr, outcome, result, ...cleaned ? { cleanup: cleaned } : {} };
+  }));
+}
+function renderPrLandTable(entries) {
+  const rows = entries.map((e) => [
+    `#${e.pr}`,
+    e.outcome + (e.result.retriedAfterEjection ? " (after retry)" : ""),
+    [e.result.error, e.cleanup].filter(Boolean).join(" | ") || "-"
+  ]);
+  const width = (i) => Math.max(...rows.map((r) => r[i].length));
+  return rows.map((r) => `${r[0].padEnd(width(0))}  ${r[1].padEnd(width(1))}  ${r[2]}`).join("\n");
+}
 
 // src/test-policy-core.ts
 var import_node_child_process13 = require("node:child_process");
@@ -47253,205 +47298,246 @@ ${list}`);
   }
   class PrHeadBehindBaseError extends Error {
   }
-  pr.command("land <number>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").action(async (number, o) => {
-    if (/^(?:[^/]+\/[^/]+)?#\d+$/.test(number.trim())) {
-      try {
-        const parsed = parseIssueRef(number, o.repo);
-        number = String(parsed.number);
-        if (parsed.repo) o.repo = parsed.repo;
-      } catch (e) {
-        return fail(`pr land: ${e.message}`);
-      }
-    }
-    const repoArgs = o.repo ? ["--repo", o.repo] : [];
-    const startingPath = (await execFileP("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-    assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr land", { force: o.force });
-    const landRepoForGuard = await resolveRepo(o.repo).catch(() => void 0) ?? o.repo;
-    const landClosingGuardInput = await withAlreadyClosedCommitTargets(
-      await readClosingGuardInput(number, repoArgs, landRepoForGuard, "pr land"),
-      async (n) => {
-        if (!landRepoForGuard) return void 0;
-        const viewed = await ghJson(["issue", "view", String(n), "--repo", landRepoForGuard, "--json", "state"]);
-        return typeof viewed.state === "string" ? viewed.state : void 0;
-      }
-    );
-    const landSquashBody = squashBodyTextForMerge(landClosingGuardInput, true);
-    warnSquashBodyClosingStrip("pr land", landClosingGuardInput, landSquashBody);
-    const landClosingGuardVerdict = evaluateClosingGuard(landClosingGuardInput, {
-      force: o.force,
-      context: "pr land",
-      squashBodyText: landSquashBody
-    });
-    if (landClosingGuardVerdict.blocked) {
-      console.error(landClosingGuardVerdict.message);
-      process.exitCode = 1;
-      return;
-    }
-    if (landClosingGuardVerdict.message) console.warn(landClosingGuardVerdict.message);
-    let mergeQueueEnabled = false;
-    const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false, enqueueOnly: o.enqueueOnly }, {
-      hasMergeQueue: async (repo, base) => mergeQueueEnabled = await hasPrMergeQueue(repo, base),
-      readMergeQueue: readPrMergeQueue,
-      findMergeGroupRun: findPrMergeGroupRun,
-      queueProgress: (receipt) => {
-        if (!o.json) printLine(prMergeQueueLine(receipt));
-      },
-      resolveRepo: async (prNumber, repoOpt) => {
-        const knownRepo = repoOpt ?? await resolveRepo(o.repo).catch(() => void 0) ?? o.repo;
-        let repoFromGh = "";
-        let base = "";
-        if (knownRepo) {
-          const rested = await fetchRestPrSnapshot(prNumber, knownRepo).catch(() => void 0);
-          if (rested) {
-            console.warn("pr land: PR repo/base read via REST (App-capable poll identity) instead of gh GraphQL (#6834).");
-            repoFromGh = knownRepo;
-            base = rested.baseRef;
-          }
-        }
-        if (!repoFromGh || !base) {
-          const args = repoOpt ? ["--repo", repoOpt] : repoArgs;
-          const readEnv = await ghReadEnv();
-          const viewed = (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS, ...readEnv ? { env: readEnv } : {} })).stdout.trim();
-          [repoFromGh, base] = viewed.split(/\s+/);
-        }
-        const repo = repoOpt ?? repoFromGh;
-        if (!repo) throw new Error("pr land: could not resolve PR repo");
-        let track;
+  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 the queue's own check timeout is 60)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").action(async (numbers, opts) => {
+    const timeoutMinutes = opts.timeout === void 0 ? void 0 : Number(opts.timeout);
+    if (timeoutMinutes !== void 0 && !(timeoutMinutes > 0)) return fail("pr land: --timeout must be a positive number of minutes");
+    const queueTimeoutMs = timeoutMinutes !== void 0 ? Math.round(timeoutMinutes * 6e4) : PR_LAND_QUEUE_TIMEOUT_MS * Math.ceil(numbers.length / PR_LAND_QUEUE_BATCH_SIZE);
+    let inFlight = numbers.length;
+    const landOne = async (numberArg) => {
+      const o = { ...opts };
+      let number = numberArg;
+      const refused = (error) => ({ status: "failed", repo: o.repo ?? "", pr: number, base: "", error });
+      if (/^(?:[^/]+\/[^/]+)?#\d+$/.test(number.trim())) {
         try {
-          const meta = await fetchProjectBySlug(slugOf(repo), registryClientDeps(await loadConfig()));
-          if (meta) track = resolveReleaseTrack(meta, void 0, repo);
-        } catch {
+          const parsed = parseIssueRef(number, o.repo);
+          number = String(parsed.number);
+          if (parsed.repo) o.repo = parsed.repo;
+        } catch (e) {
+          return refused(e.message);
         }
-        if (isPromotionBase(base, track)) {
-          const shape = track ? `${track} track` : "unresolved track \u2014 strict reading";
-          throw new Error(`pr land: base branch ${base} is a promotion target (${shape}) \u2014 promotion merges stay human-only`);
+      }
+      const repoArgs = o.repo ? ["--repo", o.repo] : [];
+      const startingPath = (await execFileP("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
+      assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr land", { force: o.force });
+      const landRepoForGuard = await resolveRepo(o.repo).catch(() => void 0) ?? o.repo;
+      const landClosingGuardInput = await withAlreadyClosedCommitTargets(
+        await readClosingGuardInput(number, repoArgs, landRepoForGuard, "pr land"),
+        async (n) => {
+          if (!landRepoForGuard) return void 0;
+          const viewed = await ghJson(["issue", "view", String(n), "--repo", landRepoForGuard, "--json", "state"]);
+          return typeof viewed.state === "string" ? viewed.state : void 0;
         }
-        return { repo, base };
-      },
-      fetchTrainAuthority: async (repo) => fetchTrainAuthority(repo, registryClientDeps(await loadConfig())),
-      resolveCiPolicy: (repo) => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
-      waitForChecks: async (prNumber, repo) => {
-        const requiredContexts = await fetchRequiredCheckContexts(repo, "development").catch(() => null);
-        return waitForPrChecks({
-          resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
-          // #3024: REST-only wait loop — runPrLand's resolveRepo already guarantees `repo` is set.
-          pollChecks: () => pollRestPrChecks(prNumber, repo, void 0, requiredContexts),
-          // #2970: `pr land` only ever lands PRs based on development (resolveRepo above already rejects any
-          // other base), so the fast-fail message's base branch is always 'development' here.
-          pollMergeable: () => pollRestPrMergeable(prNumber, repo),
-          pollRateLimit: () => waitLoopCorePool("pr land"),
-          // #3388: `pr land` is the batch path — the one most likely to self-DOS the shared runner and
-          // then read its own wall-clock kill as a broken diff.
-          diagnoseFailure: () => waitLoopDiagnosis("pr land", prNumber, repo),
-          checksUrl: `https://github.com/${repo}/pull/${prNumber}/checks`,
-          checksDiagnosticCommand: `gh pr checks ${prNumber} --repo ${repo}`,
-          // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
-          pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
-          baseBranch: "development",
-          sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
-          log: (message2) => console.warn(message2),
-          // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
-          // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
-          progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr land: waiting on checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
-        });
-      },
-      // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
-      // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
-      // #4396: same required-status scoping as the wait loop above — a non-required red must not read
-      // as "not ready to retry" any more than it should have blocked the wait itself.
-      probeMergeReady: async (prNumber, repo) => {
-        const [snapshot, requiredContexts] = await Promise.all([
-          fetchRestPrSnapshot(prNumber, repo).catch(() => null),
-          // io-census-allow: a failed re-probe reads as open:false/mergeable:false below, the conservative 'not ready to retry' direction per the comment above
-          fetchRequiredCheckContexts(repo, "development").catch(() => null)
-          // io-census-allow: null is the established failed-state for this read (see pr-checks-rest.ts's partitionByRequired contract) — it makes every check required, the conservative direction
-        ]);
-        const checks = await pollRestPrChecks(prNumber, repo, void 0, requiredContexts).catch(() => "error");
-        return {
-          open: snapshot?.state === "open",
-          mergeable: snapshot?.mergeable === "MERGEABLE",
-          checksPassing: checks === "success" || checks === "no-checks-reported"
-        };
-      },
-      readPrState: async (prNumber, repo) => {
-        const args = repo ? ["--repo", repo] : [];
-        const readEnv = await ghReadEnv();
-        const result2 = await readGhPrStateWithRetry(async () => (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "mergeStateStatus,mergeable,state"], { timeout: GC_GH_TIMEOUT_MS, ...readEnv ? { env: readEnv } : {} })).stdout);
-        if (!result2.ok) {
-          if (isGitHubRateLimitError(result2.error)) return fetchRestPrLandState(prNumber, repo);
-          throw new Error(`could not read PR state: ${result2.error}`);
-        }
-        return JSON.parse(result2.state);
-      },
-      mergeAuto: (prNumber, repo) => ghMergeAutoEnqueue(prNumber, repo, "--squash", {
-        allowedClosing: landClosingGuardInput?.closing,
-        bodyText: landSquashBody,
-        mergeQueue: mergeQueueEnabled
-      }),
-      updateBranch: (prNumber, repo) => prLandUpdateBranch(prNumber, repo, Boolean(o.repo)),
-      pollMerged: async (prNumber, repo, deadlineMs) => {
-        let lastFailure;
-        while (Date.now() < deadlineMs) {
-          const read = await pollRestPrMerged(prNumber, repo);
-          if (read.state === "merged") return true;
-          if (read.state === "failed") {
-            lastFailure = read.error;
-            console.warn(`pr land: merged-state read FAILED (${read.error}) \u2014 retrying; this is not evidence the PR is unmerged`);
-          } else {
-            lastFailure = void 0;
+      );
+      const landSquashBody = squashBodyTextForMerge(landClosingGuardInput, true);
+      warnSquashBodyClosingStrip("pr land", landClosingGuardInput, landSquashBody);
+      const landClosingGuardVerdict = evaluateClosingGuard(landClosingGuardInput, {
+        force: o.force,
+        context: "pr land",
+        squashBodyText: landSquashBody
+      });
+      if (landClosingGuardVerdict.blocked) {
+        console.error(landClosingGuardVerdict.message);
+        return refused("refused by the closing-keyword guard (see the message above)");
+      }
+      if (landClosingGuardVerdict.message) console.warn(landClosingGuardVerdict.message);
+      let mergeQueueEnabled = false;
+      const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false, enqueueOnly: o.enqueueOnly, queueTimeoutMs }, {
+        pollDelayMs: (attempt) => prLandPollDelayMs(attempt, inFlight),
+        hasMergeQueue: async (repo, base) => mergeQueueEnabled = await hasPrMergeQueue(repo, base),
+        readMergeQueue: readPrMergeQueue,
+        findMergeGroupRun: findPrMergeGroupRun,
+        queueProgress: (receipt) => {
+          if (!o.json) printLine(prMergeQueueLine(receipt));
+        },
+        resolveRepo: async (prNumber, repoOpt) => {
+          const knownRepo = repoOpt ?? await resolveRepo(o.repo).catch(() => void 0) ?? o.repo;
+          let repoFromGh = "";
+          let base = "";
+          if (knownRepo) {
+            const rested = await fetchRestPrSnapshot(prNumber, knownRepo).catch(() => void 0);
+            if (rested) {
+              console.warn("pr land: PR repo/base read via REST (App-capable poll identity) instead of gh GraphQL (#6834).");
+              repoFromGh = knownRepo;
+              base = rested.baseRef;
+            }
+          }
+          if (!repoFromGh || !base) {
+            const args = repoOpt ? ["--repo", repoOpt] : repoArgs;
+            const readEnv = await ghReadEnv();
+            const viewed = (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "headRepository,baseRefName", "--jq", '.headRepository.nameWithOwner + " " + .baseRefName'], { timeout: GC_GH_TIMEOUT_MS, ...readEnv ? { env: readEnv } : {} })).stdout.trim();
+            [repoFromGh, base] = viewed.split(/\s+/);
           }
-          await new Promise((resolve8) => setTimeout(resolve8, PR_LAND_POLL_MS));
+          const repo = repoOpt ?? repoFromGh;
+          if (!repo) throw new Error("pr land: could not resolve PR repo");
+          let track;
+          try {
+            const meta = await fetchProjectBySlug(slugOf(repo), registryClientDeps(await loadConfig()));
+            if (meta) track = resolveReleaseTrack(meta, void 0, repo);
+          } catch {
+          }
+          if (isPromotionBase(base, track)) {
+            const shape = track ? `${track} track` : "unresolved track \u2014 strict reading";
+            throw new Error(`pr land: base branch ${base} is a promotion target (${shape}) \u2014 promotion merges stay human-only`);
+          }
+          return { repo, base };
+        },
+        fetchTrainAuthority: async (repo) => fetchTrainAuthority(repo, registryClientDeps(await loadConfig())),
+        resolveCiPolicy: (repo) => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
+        waitForChecks: async (prNumber, repo) => {
+          const requiredContexts = await fetchRequiredCheckContexts(repo, "development").catch(() => null);
+          return waitForPrChecks({
+            resolvePolicy: () => resolveRepoMergeCiPolicy(repo, ciAuditDeps()),
+            // #3024: REST-only wait loop — runPrLand's resolveRepo already guarantees `repo` is set.
+            pollChecks: () => pollRestPrChecks(prNumber, repo, void 0, requiredContexts),
+            // #2970: `pr land` only ever lands PRs based on development (resolveRepo above already rejects any
+            // other base), so the fast-fail message's base branch is always 'development' here.
+            pollMergeable: () => pollRestPrMergeable(prNumber, repo),
+            pollRateLimit: () => waitLoopCorePool("pr land"),
+            // #3388: `pr land` is the batch path — the one most likely to self-DOS the shared runner and
+            // then read its own wall-clock kill as a broken diff.
+            diagnoseFailure: () => waitLoopDiagnosis("pr land", prNumber, repo),
+            checksUrl: `https://github.com/${repo}/pull/${prNumber}/checks`,
+            checksDiagnosticCommand: `gh pr checks ${prNumber} --repo ${repo}`,
+            // #5400: same zero-runs delivery probe as checks-wait — do not burn the land budget on silence.
+            pollHeadWorkflowRunCount: () => waitLoopHeadWorkflowRunCount("pr land", prNumber, repo),
+            baseBranch: "development",
+            sleep: (ms) => new Promise((resolve8) => setTimeout(resolve8, ms)),
+            log: (message2) => console.warn(message2),
+            // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
+            // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
+            progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr land: waiting on checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+          });
+        },
+        // #2425: re-probe used ONLY to decide whether a failed `gh pr merge --auto` is worth retrying — a
+        // fresh read of state/mergeable/checks, independent of the merge call's own (possibly stale) error.
+        // #4396: same required-status scoping as the wait loop above — a non-required red must not read
+        // as "not ready to retry" any more than it should have blocked the wait itself.
+        probeMergeReady: async (prNumber, repo) => {
+          const [snapshot, requiredContexts] = await Promise.all([
+            fetchRestPrSnapshot(prNumber, repo).catch(() => null),
+            // io-census-allow: a failed re-probe reads as open:false/mergeable:false below, the conservative 'not ready to retry' direction per the comment above
+            fetchRequiredCheckContexts(repo, "development").catch(() => null)
+            // io-census-allow: null is the established failed-state for this read (see pr-checks-rest.ts's partitionByRequired contract) — it makes every check required, the conservative direction
+          ]);
+          const checks = await pollRestPrChecks(prNumber, repo, void 0, requiredContexts).catch(() => "error");
+          return {
+            open: snapshot?.state === "open",
+            mergeable: snapshot?.mergeable === "MERGEABLE",
+            checksPassing: checks === "success" || checks === "no-checks-reported"
+          };
+        },
+        readPrState: async (prNumber, repo) => {
+          const args = repo ? ["--repo", repo] : [];
+          const readEnv = await ghReadEnv();
+          const result2 = await readGhPrStateWithRetry(async () => (await execFileP("gh", ["pr", "view", prNumber, ...args, "--json", "mergeStateStatus,mergeable,state"], { timeout: GC_GH_TIMEOUT_MS, ...readEnv ? { env: readEnv } : {} })).stdout);
+          if (!result2.ok) {
+            if (isGitHubRateLimitError(result2.error)) return fetchRestPrLandState(prNumber, repo);
+            throw new Error(`could not read PR state: ${result2.error}`);
+          }
+          return JSON.parse(result2.state);
+        },
+        mergeAuto: (prNumber, repo) => ghMergeAutoEnqueue(prNumber, repo, "--squash", {
+          allowedClosing: landClosingGuardInput?.closing,
+          bodyText: landSquashBody,
+          mergeQueue: mergeQueueEnabled
+        }),
+        updateBranch: (prNumber, repo) => prLandUpdateBranch(prNumber, repo, Boolean(o.repo)),
+        pollMerged: async (prNumber, repo, deadlineMs) => {
+          let lastFailure;
+          while (Date.now() < deadlineMs) {
+            const read = await pollRestPrMerged(prNumber, repo);
+            if (read.state === "merged") return true;
+            if (read.state === "failed") {
+              lastFailure = read.error;
+              console.warn(`pr land: merged-state read FAILED (${read.error}) \u2014 retrying; this is not evidence the PR is unmerged`);
+            } else {
+              lastFailure = void 0;
+            }
+            await new Promise((resolve8) => setTimeout(resolve8, PR_LAND_POLL_MS));
+          }
+          if (lastFailure) {
+            throw new Error(
+              `pr land: could not verify whether PR #${prNumber} merged \u2014 the last merged-state read FAILED (${lastFailure}). The auto-merge enqueue stands; read the PR directly (gh pr view ${prNumber} --repo ${repo} --json merged,state) and rerun cleanup if it merged.`
+            );
+          }
+          return false;
         }
-        if (lastFailure) {
-          throw new Error(
-            `pr land: could not verify whether PR #${prNumber} merged \u2014 the last merged-state read FAILED (${lastFailure}). The auto-merge enqueue stands; read the PR directly (gh pr view ${prNumber} --repo ${repo} --json merged,state) and rerun cleanup if it merged.`
-          );
+      });
+      if (result.status !== "failed" && result.status !== "queued") {
+        const boardAdvance = await advanceClosedIssuesToDone2(number, result.repo);
+        const crossRepoFilingIssue = result.repo ? await reconcileCrossRepoFilingIssue(defaultGitHubClient(), result.repo, Number(number)) : { status: "failed", error: "could not resolve the PR repo for cross-repo filing-issue reconciliation" };
+        const recovery = result.repo ? buildPostMergeReconRecovery({
+          repo: result.repo,
+          pr: number,
+          boardAdvance,
+          crossRepoFilingIssue
+        }) : void 0;
+        let recoveryPath;
+        if (recovery) {
+          try {
+            recoveryPath = writePostMergeReconRecovery(process.cwd(), recovery);
+          } catch {
+          }
+        } else if (result.repo) {
+          clearPostMergeReconRecovery(process.cwd(), result.repo, number);
+        }
+        Object.assign(result, {
+          ...boardAdvance.entries.length ? { boardAdvance: boardAdvance.entries } : {},
+          boardAdvanceStatus: boardAdvance.status,
+          ...crossRepoFilingIssue.status !== "not-applicable" ? { crossRepoFilingIssue } : {},
+          ...recovery ? { postMergeReconRecovery: recovery } : {}
+        });
+        for (const line of postMergeReconWarnings({
+          context: "pr land",
+          boardAdvance,
+          crossRepoFilingIssue,
+          recovery,
+          recoveryPath
+        })) {
+          console.error(line);
         }
-        return false;
       }
-    });
-    if (result.status !== "failed" && result.status !== "queued") {
-      const boardAdvance = await advanceClosedIssuesToDone2(number, result.repo);
-      const crossRepoFilingIssue = result.repo ? await reconcileCrossRepoFilingIssue(defaultGitHubClient(), result.repo, Number(number)) : { status: "failed", error: "could not resolve the PR repo for cross-repo filing-issue reconciliation" };
-      const recovery = result.repo ? buildPostMergeReconRecovery({
-        repo: result.repo,
-        pr: number,
-        boardAdvance,
-        crossRepoFilingIssue
-      }) : void 0;
-      let recoveryPath;
-      if (recovery) {
-        try {
-          recoveryPath = writePostMergeReconRecovery(process.cwd(), recovery);
-        } catch {
-        }
-      } else if (result.repo) {
-        clearPostMergeReconRecovery(process.cwd(), result.repo, number);
+      return result;
+    };
+    const cwd0 = process.cwd();
+    const primaryRoot0 = (await execFileP("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.match(/^worktree (.+)$/m)?.[1];
+    const cleanupMerged = async (r) => {
+      if (opts.preserveWorktree) return "cleanup skipped (--preserve-worktree)";
+      const ran = await execFileP(process.execPath, [process.argv[1], ...canonicalArgvFor(["pr", "merge", r.pr, "--repo", r.repo])], {
+        cwd: (0, import_node_fs45.existsSync)(cwd0) ? cwd0 : primaryRoot0,
+        timeout: GH_MUTATION_TIMEOUT_MS * 3
+      }).then((x) => ({ stdout: x.stdout, stderr: x.stderr }), (e) => ({ stdout: e.stdout ?? "", stderr: e.stderr ?? "" }));
+      const json = ran.stdout.split("\n").reverse().find((l) => l.startsWith("{"));
+      if (!json) return `cleanup failed: ${ran.stderr.trim().split("\n").pop() || "no receipt"}`;
+      const c = JSON.parse(json);
+      const part = (x) => x ? `${x.status}${x.reason ? ` (${x.reason})` : ""}` : "n/a";
+      return `cleanup ${c.mergeStatus ?? "unknown"}: worktree ${part(c.worktree)}, branch ${part(c.localBranch)}`;
+    };
+    const entries = await landMany(numbers, landOne, cleanupMerged, {
+      onRetry: (pr2, r) => console.warn(`pr land: queue ejected PR #${pr2} (${r.error}) \u2014 landing it once more (head updated from base if behind)`),
+      onDone: () => {
+        inFlight = Math.max(1, inFlight - 1);
       }
-      Object.assign(result, {
-        ...boardAdvance.entries.length ? { boardAdvance: boardAdvance.entries } : {},
-        boardAdvanceStatus: boardAdvance.status,
-        ...crossRepoFilingIssue.status !== "not-applicable" ? { crossRepoFilingIssue } : {},
-        ...recovery ? { postMergeReconRecovery: recovery } : {}
-      });
-      for (const line of postMergeReconWarnings({
-        context: "pr land",
-        boardAdvance,
-        crossRepoFilingIssue,
-        recovery,
-        recoveryPath
-      })) {
-        console.error(line);
+    });
+    const credential = lastRestPollSource() === "app" ? "app_installation" : "user";
+    if (numbers.length === 1) {
+      const { result, cleanup } = entries[0];
+      if (opts.json) printLine(JSON.stringify({ ...result, ...cleanup ? { cleanup } : {}, credential }));
+      else {
+        printLine(
+          `pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""} (credential: ${credential})` + (result.branchFinality ? ` \u2014 ${result.branchFinality}` : "")
+        );
+        if (cleanup) printLine(`pr land: ${cleanup}`);
       }
+    } else if (opts.json) {
+      printLine(JSON.stringify({ results: entries.map((e) => ({ ...e.result, outcome: e.outcome, ...e.cleanup ? { cleanup: e.cleanup } : {} })), summary: Object.fromEntries(["merged", "ejected", "timeout", "queued", "failed"].map((k) => [k, entries.filter((e) => e.outcome === k).length])), credential }));
+    } else {
+      printLine(renderPrLandTable(entries));
+      printLine(`pr land: ${entries.filter((e) => e.outcome === "merged").length}/${entries.length} merged (credential: ${credential})`);
     }
-    const credential = lastRestPollSource() === "app" ? "app_installation" : "user";
-    if (o.json) printLine(JSON.stringify({ ...result, credential }));
-    else printLine(
-      `pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""} (credential: ${credential})` + (result.branchFinality ? ` \u2014 ${result.branchFinality}` : "")
-    );
-    if (result.status === "failed") process.exitCode = 1;
+    if (entries.some((e) => e.outcome !== "merged" && e.outcome !== "queued")) process.exitCode = 1;
   });
-  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo); from a foreign checkout the remote probe/delete address this repo and local cleanup runs only in the verified sibling checkout ../<repo>, else localBranch reports skipped-foreign-cwd and the receipt carries foreignCwd: true (#6148)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888); also the merge settings-proof bypass when delete_branch_on_merge cannot be proven (#6210)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict")).action(async (number, o) => {
+  jsonParity(pr.command("merge <number>").description("merge a PR (squash by default); archives gitignored tmp/** before worktree teardown; on no-ci repos run pr ci-policy / checks-wait first (#1432, #5679); on a merge-queue base use `pr land <n> [<n>...]` instead (#8322) \u2014 this verb is refused there except for train PRs").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo); from a foreign checkout the remote probe/delete address this repo and local cleanup runs only in the verified sibling checkout ../<repo>, else localBranch reports skipped-foreign-cwd and the receipt carries foreignCwd: true (#6148)").option("--auto", "enable auto-merge \u2014 merge once the base-branch policy is satisfied (use for policy-gated repos)").addOption(new Option("--disable-auto", "disable a queued auto-merge without merging").conflicts(["auto", "wait", "squash", "merge", "rebase", "preserveWorktree", "gc", "squashBodyFile", "force"])).option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m) \u2014 run as a background/monitor task or under a shell timeout above that budget; a short foreground timeout (e.g. 120s) kills it after checks pass and leaves the PR open (#6027)`).option("--preserve-worktree", "after merge, keep the local PR worktree/branch for an active batch (#1888); also the merge settings-proof bypass when delete_branch_on_merge cannot be proven (#6210)").option("--gc", "acknowledge deleting unarchived gitignored tmp/** evidence newer than the branch base (#5679)").option("--squash-body-file <path>", "squash commit body (overrides GitHub COMMIT_MESSAGES); use when a pushed commit mentions close/fix/resolve + #N that must not close (#5723)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict")).action(async (number, o) => {
     const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
     const repoArgs = o.repo ? ["--repo", o.repo] : [];
     if (o.disableAuto) {
@@ -47693,7 +47779,8 @@ ${list}`);
     });
     try {
       try {
-        await mergeOnce();
+        if (prMeta.state === "MERGED") remoteNotAttemptedReason = "pr-already-merged";
+        else await mergeOnce();
       } catch (e) {
         if (!(e instanceof PrHeadBehindBaseError)) throw e;
         const localCheckedOut = !foreignCwd && await prHeadCheckedOutHere(headRef, targetRepo2, Boolean(o.repo));
@@ -55799,8 +55886,19 @@ function registerDeveloperCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  docs.command("refs").description("deterministic doc reference gate: repo paths, markdown links, mmi-cli command refs, and pins across docs, org-guide, mmi-help, README and architecture must resolve, or exit 1").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs refs reads the current checkout").hideHelp()).option("--base <ref>", "require covered runbook sections to be touched against this merge base (#8126)").option("--runbooks-only", "check only operator runbooks (#8126)").option("--live", "check operator runbooks against registry tasks, vault names and HTTPS endpoints (implies --runbooks-only)").action(async (o) => {
+  docs.command("refs").description("deterministic doc reference gate: repo paths, markdown links, mmi-cli command refs, and pins across docs, org-guide, mmi-help, README and architecture must resolve, or exit 1").option("--json", "machine-readable findings list: { ok, docCount, findings[], warnings[] }").addOption(new Option("--repo <owner/repo>", "not accepted \u2014 docs refs reads the current checkout").hideHelp()).option("--base <ref>", "require covered runbook sections to be touched against this merge base (#8126)").option("--runbooks-only", "check only operator runbooks (#8126)").option("--live", "check operator runbooks against registry tasks, vault names and HTTPS endpoints (implies --runbooks-only)").option("--local", "pre-push mode (#8323): the CI runbook guard against origin/development (else origin/main) \u2014 implies --runbooks-only, offline, same verdict as the gate step").action(async (o) => {
     try {
+      if (o.local) {
+        o.runbooksOnly = true;
+        if (!o.base) {
+          const exists = /* @__PURE__ */ new Set();
+          for (const ref of ["origin/development", "origin/main"]) {
+            if (await execFileP("git", ["rev-parse", "--verify", "--quiet", ref], { timeout: GIT_TIMEOUT_MS }).then(() => true, () => false)) exists.add(ref);
+          }
+          o.base = localRunbookBase((ref) => exists.has(ref));
+          if (!o.base) return failGraceful("docs refs --local: neither origin/development nor origin/main exists \u2014 run `git fetch origin` or pass --base <ref>");
+        }
+      }
       if (o.repo) {
         const guard = planTrainApplyRepoGuard(o.repo, await resolveRepo(), `mmi-cli oracle docs refs${o.json ? " --json" : ""}`, "docs refs");
         if (!guard.ok) return failGraceful(guard.message);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.148",
+  "version": "4.5.150",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.148",
+  "version": "4.5.150",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",