@mutmutco/codex-plugin 4.6.12 → 4.6.14

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.12",
+  "version": "4.6.14",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -1674,6 +1674,7 @@ __export(board_write_exports, {
   BoardAttachError: () => BoardAttachError,
   addIssueToProjectViaHub: () => addIssueToProjectViaHub,
   boardAttachHttpError: () => boardAttachHttpError,
+  createBoardIssueViaHub: () => createBoardIssueViaHub,
   writeHubBoardField: () => writeHubBoardField
 });
 async function writeHubBoardField(request) {
@@ -1715,6 +1716,18 @@ function boardAttachHttpError(status, detail) {
   const code = status === 401 ? "hub_session_missing" : status === 403 ? "forbidden" : status === 429 ? "rate_limited" : status >= 500 ? "hub_unavailable" : "refused";
   return new BoardAttachError(code, status, detail);
 }
+async function createBoardIssueViaHub(request) {
+  const config = await loadConfig();
+  const res = await fetch(`${config.sagaApiUrl?.replace(/\/$/, "")}/board/issues`, {
+    method: "POST",
+    headers: await hubHeaders({ "content-type": "application/json" }),
+    body: JSON.stringify(request),
+    signal: AbortSignal.timeout(25e3)
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.number || !body.url) throw new Error(`board issue create HTTP ${res.status}: ${body?.error ?? "unconfirmed result"}`);
+  return { number: body.number, url: body.url, projectItemId: body.projectItemId, onBoard: Boolean(body.onBoard) };
+}
 var BOARD_ATTACH_HINTS, BoardAttachError;
 var init_board_write = __esm({
   "src/board-write.ts"() {
@@ -1723,7 +1736,7 @@ var init_board_write = __esm({
     BOARD_ATTACH_HINTS = {
       // #8965: honest, not a promise — attach did NOT run. App automation never has a Hub session by design.
       hub_session_missing: "No Hub session (an App installation token cannot open one). Hub adds new issues in registered repos to their board automatically when they are opened; check membership with `mmi-cli oracle board show <n> --repo <owner/repo>`. A human login or MMI_HUB_TOKEN (Actions /auth/session-ci) is needed only to attach older or transferred issues.",
-      forbidden: "the Hub denied this login: attach needs org-owner or repo-admin authority on <owner/repo>",
+      forbidden: "the Hub denied this login: attach needs org-owner, repo-admin or verified repository write authority on <owner/repo>",
       hub_unavailable: "the Hub or GitHub failed transiently; the add is idempotent, so rerun `mmi-cli oracle board attach <issue>`",
       rate_limited: "GitHub quota is exhausted; rerun `mmi-cli oracle board attach <issue>` after the reset",
       refused: "the Hub refused this attach; check the board registration for <owner/repo>"
@@ -13867,6 +13880,49 @@ function boardClaimStatusFlagRecovery(flag, canonicalPath, argv) {
     corrected: `mmi-cli ${kept.join(" ")}`
   };
 }
+function boardClaimLaneFlagRecovery(flag, canonicalPath, argv) {
+  if (canonicalPath !== "oracle board claim") return void 0;
+  if (!/^--(?:agent|actor|on-behalf)(?:=|$)/.test(flag)) return void 0;
+  const baseFlag = flag.split("=")[0];
+  const kept = [];
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok.startsWith(`${baseFlag}=`)) {
+      kept.push(`--for=${tok.slice(baseFlag.length + 1)}`);
+      continue;
+    }
+    if (tok === baseFlag) {
+      kept.push("--for");
+      if (i + 1 >= argv.length || argv[i + 1].startsWith("-")) kept.push("<login>");
+      continue;
+    }
+    kept.push(tok);
+  }
+  return {
+    message: `unknown option '${baseFlag}' \u2014 \`oracle board claim\` declares lane attribution as \`--for <login>\` ('assign to this login instead of @me \u2014 agent claims on behalf of the master')`,
+    corrected: `mmi-cli ${kept.join(" ")}`
+  };
+}
+var BOARD_CLAIM_AGENT_FLAGS = /* @__PURE__ */ new Set(["--agent", "--lane", "--by"]);
+function boardClaimAgentFlagRecovery(flag, canonicalPath, argv) {
+  if (canonicalPath !== "oracle board claim") return void 0;
+  const bare = flag.split("=")[0];
+  if (!BOARD_CLAIM_AGENT_FLAGS.has(bare)) return void 0;
+  const kept = [];
+  for (let i = 0; i < argv.length; i++) {
+    const tok = argv[i];
+    if (tok.startsWith(`${bare}=`)) continue;
+    if (tok === bare) {
+      if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) i++;
+      continue;
+    }
+    kept.push(tok);
+  }
+  return {
+    message: `unknown option '${bare}' \u2014 \`oracle board claim\` stamps the claiming session itself \u2014 drop ${bare} and its value; \`--for <login>\` assigns on behalf of another login`,
+    corrected: `mmi-cli ${kept.join(" ")}`
+  };
+}
 function issueCommentAppendOnlyRecovery(flag, canonicalPath, argv) {
   if (canonicalPath !== "oracle issue comment") return void 0;
   const hasEditVerb = argv.some((t, idx) => idx >= 3 && !t.startsWith("-") && /^(?:edit|update|patch|modify)$/i.test(t));
@@ -18983,9 +19039,10 @@ function surfaceInferenceSuffix(inferred) {
 }
 function uncertainSurfaceRefusal(inferred, command = "issue create") {
   if (!inferred.uncertain) return void 0;
+  const bareName = inferred.label.toLowerCase().startsWith(SURFACE_PREFIX) ? inferred.label.slice(SURFACE_PREFIX.length) : inferred.label;
   const alternatives = inferred.alternatives?.length ? ` Other candidates: ${inferred.alternatives.join(", ")}.` : "";
   return {
-    message: `${command}: surface inference is uncertain (${inferred.reason}) \u2014 pass --surface <value> to choose explicitly or --no-surface only when the filing is genuinely exempt.${alternatives}`,
+    message: `${command}: surface inference is uncertain (${inferred.reason}) \u2014 pass --surface <value> to choose explicitly or --no-surface only when the filing is genuinely exempt. The closest match was ${inferred.label} \u2014 re-run the same create with --surface ${bareName}.${alternatives}`,
     payload: {
       code: ERROR_CODES.ERR_MISSING_FLAG,
       offending_flag: "--surface",
@@ -25459,7 +25516,7 @@ var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
 var BLESSED_KIT_AGENT_FILES_SHA = "e976df208d891b215844386c1cac0f161946b6fa";
 var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
 var BLESSED_VERDICT_RECEIPT_SHA = "";
-var BLESSED_RUNNER_CHOICE_SHA = "f6b691f966611ec2a3b688c74c92a92f23133f41";
+var BLESSED_RUNNER_CHOICE_SHA = "cf35db6cdf053746bc5b2cd75f241a7d93cf7f48";
 var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
@@ -27010,6 +27067,24 @@ async function reconcileOrgNoAgentFilesRuleset(plan, client, org = ORG_LOGIN) {
   };
 }
 
+// src/registry-repositories.ts
+function qualifyRegistryRepo(raw) {
+  return raw.includes("/") ? raw : `mutmutco/${raw}`;
+}
+function registryRepoKey(repo) {
+  return repo.toLowerCase();
+}
+function repoProjectClaim(project2, repoKey) {
+  if (!project2) return 0;
+  const slug = typeof project2.slug === "string" ? project2.slug.toLowerCase() : void 0;
+  if (slug !== void 0 && slug === repoKey.split("/")[1]) return 3;
+  if (project2.projectType !== "hub-service") return 2;
+  return 1;
+}
+function preferPrimaryRepoProject(current, candidate, repoKey) {
+  return repoProjectClaim(candidate, repoKey) > repoProjectClaim(current, repoKey) ? candidate : current;
+}
+
 // src/safe-json.ts
 function safeJson(text, fallback) {
   try {
@@ -27291,17 +27366,23 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess, sanctioned
 }
 function loadAccessTargets(projectsJson) {
   const projects = safeJson(projectsJson, {}).projects ?? [];
-  const seen = /* @__PURE__ */ new Set();
-  const targets = [];
+  const byRepo = /* @__PURE__ */ new Map();
   for (const project2 of projects) {
     for (const repo of project2.repos ?? []) {
-      if (seen.has(repo)) continue;
-      seen.add(repo);
-      const cls = project2.class === "content" || project2.deployModel === "content" ? "content" : "deployable";
-      const releaseTrack = cls === "content" ? "trunk" : resolveReleaseTrack(project2, void 0, repo);
-      targets.push({ repo, class: cls, releaseTrack });
+      const key = repo.toLowerCase();
+      const existing = byRepo.get(key);
+      byRepo.set(key, {
+        repo: existing?.repo ?? repo,
+        project: preferPrimaryRepoProject(existing?.project, project2, key)
+      });
     }
   }
+  const targets = [];
+  for (const { repo, project: project2 } of byRepo.values()) {
+    const cls = project2.class === "content" || project2.deployModel === "content" ? "content" : "deployable";
+    const releaseTrack = cls === "content" ? "trunk" : resolveReleaseTrack(project2, void 0, repo);
+    targets.push({ repo, class: cls, releaseTrack });
+  }
   return targets;
 }
 function resolveOrgAuditTargets(registryProjects) {
@@ -27665,10 +27746,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.12",
-    tag: "v4.6.12",
-    commit: "9d7baf6ad8c7",
-    npm: "@mutmutco/cli@4.6.12"
+    version: "4.6.14",
+    tag: "v4.6.14",
+    commit: "5bbc73222ade",
+    npm: "@mutmutco/cli@4.6.14"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27685,14 +27766,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.12"
+          v3Target: "v4.6.14"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.12 and redeploy the Hub Lambda from tag v4.6.12 (9d7baf6ad8c7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.12 (@mutmutco/cli@4.6.12, tag commit 9d7baf6ad8c7 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.14 and redeploy the Hub Lambda from tag v4.6.14 (5bbc73222ade); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.14 (@mutmutco/cli@4.6.14, tag commit 5bbc73222ade \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -27923,7 +28004,10 @@ function buildOrgVersionsReport(projects, probes, generatedAt) {
         name: String(project2.name ?? project2.slug ?? "?")
       });
     }
-    for (const repo of repos2) projectByRepo.set(repo.trim().toLowerCase(), projectByRepo.get(repo.trim().toLowerCase()) ?? project2);
+    for (const repo of repos2) {
+      const key = repo.trim().toLowerCase();
+      projectByRepo.set(key, preferPrimaryRepoProject(projectByRepo.get(key), project2, key));
+    }
   }
   const repos = orgVersionRepos(projects).map((repo) => {
     const project2 = projectByRepo.get(repo.toLowerCase());
@@ -28942,7 +29026,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
     }
     for (const repo of repos2) {
       const key = repo.trim().toLowerCase();
-      projectByRepo.set(key, projectByRepo.get(key) ?? project2);
+      projectByRepo.set(key, preferPrimaryRepoProject(projectByRepo.get(key), project2, key));
     }
   }
   const repos = orgVersionRepos(projects).map((repo) => {
@@ -29030,15 +29114,16 @@ function defaultFleetTrackInventoryDeps(consistent = false) {
 async function readFleetTrackInventory(deps = defaultFleetTrackInventoryDeps()) {
   const projects = await deps.projects();
   const repos = orgVersionRepos(projects);
-  const branchByRepo = /* @__PURE__ */ new Map();
+  const projectByRepo = /* @__PURE__ */ new Map();
   for (const project2 of projects) {
     for (const repo of (project2.repos ?? []).filter(validRepo2)) {
       const key = repo.trim().toLowerCase();
-      if (!branchByRepo.has(key)) {
-        branchByRepo.set(key, typeof project2.branch === "string" ? project2.branch : void 0);
-      }
+      projectByRepo.set(key, preferPrimaryRepoProject(projectByRepo.get(key), project2, key));
     }
   }
+  const branchByRepo = new Map(
+    [...projectByRepo].map(([key, project2]) => [key, typeof project2.branch === "string" ? project2.branch : void 0])
+  );
   const [releaseProbes, pluginProbes, onboardingProbes] = await Promise.all([
     mapBounded2(repos, 6, (repo) => readOrgVersionProbe(deps.query, repo)),
     mapBounded2(repos, 6, (repo) => readFleetPluginProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase()))),
@@ -32267,7 +32352,7 @@ var STANDARD_HOSTED_ALLOWLIST = [
   ["mutmutco/MMI-Hub", ".github/workflows/launcher-build.yml", "build", "windows-latest"],
   ["mutmutco/Jerv-JervCode", ".github/workflows/release-archives.yml", "release-platform-arm64", "windows-11-arm"]
 ];
-var HOSTED_SPILL_RE = /^\$\{\{\s*(?:matrix\.[\w-]+\s*==\s*'[\w-]+'\s*&&\s*'([^']+)'\s*\|\|\s*)?fromJSON\(needs\.([\w-]+)\.outputs\.(\w+_runs_on)\s*\|\|\s*('[^']+')\)\s*\}\}$/;
+var HOSTED_SPILL_RE = /^\$\{\{\s*(?:matrix\.[\w-]+\s*==\s*'[\w-]+'\s*&&\s*(?:'(?<leg>[^']+)'|fromJSON\(needs\.(?<legDecider>[\w-]+)\.outputs\.(?<legOutput>\w+_runs_on)\s*\|\|\s*(?<legOwned>'[^']+')\))\s*\|\|\s*)?fromJSON\(needs\.(?<decider>[\w-]+)\.outputs\.(?<output>\w+_runs_on)\s*\|\|\s*(?<owned>'[^']+')\)\s*\}\}$/;
 var RUNNER_CHOICE_ACTION = "mutmutco/MMI-Hub/.github/actions/runner-choice";
 function runnerChoiceProduces(job, decider, output, source) {
   const needs = job.needs;
@@ -32297,8 +32382,11 @@ function classifyJobRunnerCost(job, allowance2, source) {
   if (approved(raw) || allowance2 === "windows-11-arm" && raw === allowance2) return "standard-hosted";
   const fallback = /^\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'([^']+)'\s*\|\|\s*(fromJSON\('[^']+'\))\s*\}\}$/.exec(raw);
   if (fallback && approved(fallback[1]) && classifyRunnerCost("${{ " + fallback[2] + " }}") === "self-hosted") return "standard-hosted";
-  const spill = HOSTED_SPILL_RE.exec(raw);
-  if (spill && source && (!spill[1] || STANDARD_HOSTED_LABEL_RE.test(spill[1])) && classifyRunnerCost(`\${{ fromJSON(${spill[4]}) }}`) === "self-hosted" && runnerChoiceProduces(job, spill[2], spill[3], source)) return "standard-hosted";
+  const layerZero = /^\$\{\{\s*vars\.[\w-]+\s*==\s*'off'\s*&&\s*(fromJSON\('[^']+'\))\s*\|\|\s*'([^']+)'\s*\}\}$/.exec(raw);
+  if (layerZero && classifyRunnerCost("${{ " + layerZero[1] + " }}") === "self-hosted" && STANDARD_HOSTED_LABEL_RE.test(layerZero[2])) return "standard-hosted";
+  const spill = HOSTED_SPILL_RE.exec(raw)?.groups;
+  const legOk = (g) => g.legDecider ? classifyRunnerCost(`\${{ fromJSON(${g.legOwned}) }}`) === "self-hosted" && Boolean(source) && runnerChoiceProduces(job, g.legDecider, g.legOutput, source) : !g.leg || STANDARD_HOSTED_LABEL_RE.test(g.leg);
+  if (spill && source && legOk(spill) && classifyRunnerCost(`\${{ fromJSON(${spill.owned}) }}`) === "self-hosted" && runnerChoiceProduces(job, spill.decider, spill.output, source)) return "standard-hosted";
   const direct = classifyRunnerCost(raw);
   const matrix = /^\$\{\{\s*matrix\.([\w-]+)(?:\.([\w-]+))?\s*\}\}$/.exec(raw);
   if (!matrix || direct === "hosted") return direct;
@@ -39110,14 +39198,6 @@ function renderPinDiffs(tick) {
   return tick.diffs.map((d) => [`${d.repo}:`, ...d.files.flatMap((f) => f.changes.map((c) => `  ${f.path}:${c.line} ${c.action} ${c.from === "development" ? "@development" : c.from.slice(0, 12)} -> ${c.to.slice(0, 12)}`))].join("\n")).join("\n");
 }
 
-// src/registry-repositories.ts
-function qualifyRegistryRepo(raw) {
-  return raw.includes("/") ? raw : `mutmutco/${raw}`;
-}
-function registryRepoKey(repo) {
-  return repo.toLowerCase();
-}
-
 // src/ci-audit.ts
 var import_yaml2 = __toESM(require_dist(), 1);
 var HUB_REPO5 = "mutmutco/MMI-Hub";
@@ -39186,6 +39266,92 @@ function auditRunnerFallbacks(repo, files, closure) {
     remediation: f.cost === "hosted" || f.cost === "unknown" ? "Resolve source reads and unsupported selectors/callees; preserve checks and artifacts. See gh-runner-runbook.md." : void 0
   }));
 }
+var yamlStrings = (value) => typeof value === "string" ? [value] : value && typeof value === "object" ? Object.values(value).flatMap(yamlStrings) : [];
+var survivesDeciderFailure = (job) => {
+  const guard = typeof job.if === "string" ? job.if.replace(/^\s*\$\{\{\s*|\s*\}\}\s*$/g, "").trim() : "";
+  return (guard === "!cancelled()" || guard.startsWith("!cancelled() &&") || /\balways\(\)/.test(guard)) && !/\bsuccess\(\)/.test(guard);
+};
+function auditDeciderSkipTrap(repo, files) {
+  const checks = [];
+  for (const { path: path2, body } of files) {
+    let doc;
+    try {
+      doc = (0, import_yaml2.parse)(body);
+    } catch {
+      continue;
+    }
+    const jobs = plainRecord(doc) && plainRecord(doc.jobs) ? Object.entries(doc.jobs).filter(([, j]) => plainRecord(j)) : [];
+    const deciders = /* @__PURE__ */ new Set();
+    for (const [id, job] of jobs) {
+      const selector = [
+        typeof job["runs-on"] === "string" ? job["runs-on"] : "",
+        ...typeof job.uses === "string" ? yamlStrings(job.with) : []
+      ].join("\n");
+      const found = [...new Set([...selector.matchAll(/needs\.([\w-]+)\.outputs\.\w+_runs_on/g)].map((m) => m[1]))];
+      if (!found.length) continue;
+      for (const d of found) deciders.add(d);
+      const guard = typeof job.if === "string" ? job.if.replace(/^\s*\$\{\{\s*|\s*\}\}\s*$/g, "").trim() : "";
+      const guarded = survivesDeciderFailure(job);
+      checks.push({
+        ok: guarded,
+        label: `job reading decider ${found.map((d) => `needs.${d}`).join(", ")} outputs survives a failed decider (#9670): ${repo}/${path2}:${id}`,
+        detail: guarded ? void 0 : `${id}: ${guard ? `if: \`${guard}\`` : "no if:"} lets a failed decider SKIP this job, and a skipped required check counts as passing`,
+        remediation: guarded ? void 0 : `Start the job's if: with \`!cancelled() &&\` (or use \`always()\`), never \`success()\`, so it runs on the owned fallback when ${found[0]} fails. See gh-runner-runbook.md.`
+      });
+      if (typeof job.uses === "string") {
+        const uses = job.uses;
+        const callee = uses.startsWith("./.github/workflows/") ? files.find((file) => file.path === uses.slice(2)) : void 0;
+        let target;
+        if (callee) {
+          try {
+            target = (0, import_yaml2.parse)(callee.body);
+          } catch {
+          }
+        }
+        const targetJobs = plainRecord(target) && plainRecord(target.jobs) ? target.jobs : void 0;
+        if (!targetJobs) checks.push({
+          ok: false,
+          label: `unverified decider consumer (#9678): ${repo}/${path2}:${id}`,
+          detail: `${id}: reusable workflow ${job.uses} is unresolved; decider runner inputs cannot be verified`
+        });
+        else {
+          const inputs = plainRecord(job.with) ? Object.entries(job.with).filter(([, value]) => yamlStrings(value).some((text) => /needs\.[\w-]+\.outputs\.\w+_runs_on/.test(text))).map(([name]) => name) : [];
+          for (const [targetId, targetJob] of Object.entries(targetJobs)) {
+            if (!plainRecord(targetJob) || typeof targetJob["runs-on"] !== "string") continue;
+            if (!inputs.some((name) => new RegExp(`inputs\\.${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-])`).test(targetJob["runs-on"]))) continue;
+            const ok = survivesDeciderFailure(targetJob);
+            checks.push({
+              ok,
+              label: `reusable decider consumer survives a failed decider (#9678): ${repo}/${callee.path}:${targetId}`,
+              detail: ok ? void 0 : `${id} -> ${targetId}: callee runner input needs !cancelled() or always(), never success()`
+            });
+          }
+        }
+      }
+    }
+    if (deciders.size) {
+      const possibleResult = /\btoJSON\s*\(\s*needs\s*\)|\bneeds\s*\.\s*\*\s*\.\s*result\b|\bneeds(?:\.[\w-]+)?\s*\[\s*(?!['"][\w-]+['"]\s*\])/;
+      for (const [id, job] of jobs) if (yamlStrings(job).some((text) => possibleResult.test(text))) {
+        checks.push({
+          ok: false,
+          label: `possible decider result read (#9678): ${repo}/${path2}:${id}`,
+          detail: `${id}: toJSON(needs), wildcard result or dynamic needs read may expose a failed decider result; use only explicit decider outputs`
+        });
+      }
+    }
+    for (const decider of deciders) {
+      const read = new RegExp(String.raw`needs(?:\.${decider}|\[\s*['"]${decider}['"]\s*\])(?:\.result|\[\s*['"]result['"]\s*\])`);
+      const readers = jobs.filter(([, job]) => yamlStrings(job).some((text) => read.test(text))).map(([id]) => id);
+      checks.push({
+        ok: readers.length === 0,
+        label: `needs.${decider}.result is never read (#9670): ${repo}/${path2}`,
+        detail: readers.length ? `${readers.join(", ")} read needs.${decider}.result; a decider that failed to start has no result to trust` : void 0,
+        remediation: readers.length ? `Remove the needs.${decider}.result read from ${readers.join(", ")}; the empty ${decider} output already selects the owned fallback. See gh-runner-runbook.md.` : void 0
+      });
+    }
+  }
+  return checks;
+}
 var LIVE_SELF_HOSTED_LINUX_LABELS = /* @__PURE__ */ new Set([
   "self-hosted",
   "linux",
@@ -39426,6 +39592,11 @@ function rulesetStatusChecks(rulesets) {
 function sortedUnique(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
 }
+function isGitHub404(e) {
+  const err = e;
+  if (err?.status === 404) return true;
+  return /\b404\b|\bnot found\b/i.test(String(err?.message ?? ""));
+}
 async function restJson2(deps, path2, fallback) {
   try {
     return await deps.client.rest("GET", path2) ?? fallback;
@@ -39795,7 +39966,23 @@ async function auditRepoCi(repo, callerDeps) {
   const registryRequiredChecks = meta?.requiredChecks;
   const explicitNoCi = registryCi === "none" || registryRequiredChecks === null || Array.isArray(registryRequiredChecks) && registryRequiredChecks.length === 0;
   const deployableGated = repoClass === "deployable" && !explicitNoCi;
-  const info = await restJson2(deps, `repos/${repo}`, {});
+  let info;
+  try {
+    info = await deps.client.rest("GET", `repos/${repo}`) ?? {};
+  } catch (e) {
+    if (isGitHub404(e)) {
+      return {
+        repo,
+        class: repoClass,
+        mergePolicy: "wait-for-checks",
+        ok: false,
+        checks: [],
+        explicitNoCi,
+        excludedReason: "GitHub repository returned 404 (not found)"
+      };
+    }
+    info = {};
+  }
   if (info.archived === true) {
     return {
       repo,
@@ -40140,6 +40327,7 @@ async function auditRepoCi(repo, callerDeps) {
       } catch (e) {
         checks.push({ ok: false, label: "runner workflow source is readable (#8958)", detail: e instanceof WorkflowSourceError ? e.message : "workflow source: read-failed" });
       }
+      checks.push(...auditDeciderSkipTrap(repo, workflows));
       checks.push(...auditSelfHostedRunnerHygiene(workflows));
       checks.push(...auditJevOutcomes(workflows));
       checks.push(...auditVerdictReceipt(workflows));
@@ -41876,8 +42064,9 @@ async function runPrLandOnce(prNumber, options, deps) {
     if (!verdict.ok) {
       return { ...base, error: `train authority unavailable: ${verdict.error}` };
     }
-    base.train = { role: verdict.authority.role, train: verdict.authority.train };
-    if (!verdict.authority.train) {
+    base.train = { role: verdict.authority.role, train: verdict.authority.train, ...verdict.authority.developmentMerge !== void 0 ? { developmentMerge: verdict.authority.developmentMerge } : {} };
+    const canMerge = verdict.authority.train || resolved.base === "development" && verdict.authority.developmentMerge === true;
+    if (!canMerge) {
       return {
         ...base,
         error: `@${verdict.authority.login ?? "caller"} is ${verdict.authority.role} \u2014 train not authorized on ${repo}; cannot land PR`
@@ -41917,11 +42106,13 @@ async function runPrLandOnce(prNumber, options, deps) {
       const preflight2 = await deps.preflightQueue(prNumber, repo, pinned);
       if (preflight2 && preflight2.mergeStatus === "failed") {
         const rawError = preflight2.error ?? "queue preparation needed";
+        const nextAction = preflight2.preparation?.nextAction;
+        const error = nextAction ? rawError.includes(nextAction) ? rawError : `${rawError} \u2014 ${nextAction}` : !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError;
         return {
           ...base,
           mergeStatus: "failed",
           ...preflight2.preparation ? { preparation: preflight2.preparation } : {},
-          error: !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError
+          error
         };
       }
     }
@@ -41975,7 +42166,8 @@ async function runPrLandOnce(prNumber, options, deps) {
   }
   if (merge.mergeStatus === "failed") {
     const rawError = merge.error ?? "merge failed";
-    const error = hasQueue && !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError;
+    const nextAction = merge.preparation?.nextAction;
+    const error = nextAction ? rawError.includes(nextAction) ? rawError : `${rawError} \u2014 ${nextAction}` : hasQueue && !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError;
     return { ...base, ...merge.preparation ? { preparation: merge.preparation } : {}, ...merge.outcomeUnknown ? { outcomeUnknown: true } : {}, error };
   }
   if (hasQueue) {
@@ -44362,7 +44554,7 @@ function refuseNotClaimable(e, json) {
   process.exitCode = 1;
   return true;
 }
-var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n";
+var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n\nA zero-byte or empty .jerv/tmp/*.json means the read FAILED \u2014 `Unexpected end of JSON input` is\nthe symptom of shell-redirected empty stdout, not malformed JSON \u2014 re-run with --out (which writes\nthe file only on success) and check the exit code before parsing.\n\nChanging an existing item's Status is a move, never a hand-written `gh api graphql`\n`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status\nfield-id lookup:\n  mmi-cli oracle board move <status> <ref>\n";
 function flattenBoardReport(report) {
   const closingByRef = /* @__PURE__ */ new Map();
   for (const pull of report.pullRequests ?? []) {
@@ -48676,7 +48868,11 @@ async function propagationScope(classes, what) {
   } catch (e) {
     return fail(e.message);
   }
-  const bySlugMeta = new Map(projects.flatMap((p) => (p.repos ?? []).map((r) => [(r.includes("/") ? r : `mutmutco/${r}`).toLowerCase(), p])));
+  const bySlugMeta = /* @__PURE__ */ new Map();
+  for (const p of projects) for (const r of p.repos ?? []) {
+    const key = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
+    bySlugMeta.set(key, preferPrimaryRepoProject(bySlugMeta.get(key), p, key));
+  }
   const classOf = (repo) => bySlugMeta.get(repo.toLowerCase())?.class ?? "deployable";
   const seedClasses = classes ?? [...new Set(rosterRepos.map(classOf))];
   const inClassRepos = rosterRepos.filter((repo) => seedClasses.includes(classOf(repo)));
@@ -48889,13 +49085,12 @@ function registerBootstrapCommands(program3) {
         return failGraceful("bootstrap drift: the registry roster is unreadable or empty \u2014 refusing to report a fleet verdict from a scope this command could not establish (#3808)");
       }
       targets = collectRegistryRepos(projects);
-      const byRepo = /* @__PURE__ */ new Map();
       const metaByRepo = /* @__PURE__ */ new Map();
       for (const p of projects) for (const r of p.repos ?? []) {
         const key = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
-        byRepo.set(key, p.class ?? "deployable");
-        metaByRepo.set(key, p);
+        metaByRepo.set(key, preferPrimaryRepoProject(metaByRepo.get(key), p, key));
       }
+      const byRepo = new Map([...metaByRepo].map(([key, p]) => [key, p.class ?? "deployable"]));
       classOf = (repo) => byRepo.get(repo.toLowerCase()) ?? "deployable";
       metaOf = (repo) => metaByRepo.get(repo.toLowerCase()) ?? null;
     }
@@ -55094,6 +55289,9 @@ async function openSuitePinPr(deps, input) {
   }
 }
 
+// src/command-register-collaboration.ts
+init_board_write();
+
 // src/pr-title-check.ts
 var CONVENTIONAL_PR_TITLE = /^(feat|fix|docs|chore|refactor|perf|test|build|ci|revert|style)(\([^)]+\))?!?: .+/;
 var EXEMPT_PR_TITLE = /^Merge pull request /;
@@ -59500,8 +59698,25 @@ function registerCollaborationCommands(program3) {
       }
       if (refusal && !surfaceWaived()) return fail(refusal.message, refusal.payload);
     }
-    await ensureLabelsExist(extraLabels, targetRepo2);
-    const created = await ghCreate(args);
+    let created;
+    try {
+      await ensureLabelsExist(extraLabels, targetRepo2);
+      created = await ghCreate(args);
+    } catch (error) {
+      if (o.parent !== void 0 || !/Could not resolve to a Repository|HTTP 404|Not Found/i.test(error.message)) throw error;
+      const filed = await createBoardIssueViaHub({ repo: targetRepo2, title, body, type: issueType, priority, labels: extraLabels });
+      const nextStep = filed.onBoard ? void 0 : `mmi-cli oracle board attach ${targetRepo2}#${filed.number}`;
+      console.log(JSON.stringify({
+        status: filed.onBoard ? "created" : "partial",
+        ...filed,
+        label: issueType,
+        priority,
+        credential: "app",
+        ...nextStep ? { boardAttach: "failed", nextStep, nextSteps: [nextStep] } : {},
+        ...surfaceInferred ? { surface_inferred: true, surface: surfaceInferred.label, surface_reason: surfaceInferred.reason } : {}
+      }));
+      return;
+    }
     if (isGhCreateRateLimited(created)) {
       console.log(JSON.stringify(created));
       process.exitCode = 1;
@@ -66144,12 +66359,12 @@ async function readRunLog(id, o, runner) {
   const base = `repos/${repo}/actions/runs/${runId}`;
   const pages = JSON.parse(await readAppApi(`${base}${attempt === void 0 ? "" : `/attempts/${attempt}`}/jobs`, runner));
   const jobs = pages.flatMap((page) => page.jobs);
-  const selected = jobs.filter((job) => jobName === void 0 ? FAILED2.has(job.conclusion ?? "") : job.name === jobName);
+  const selected = jobs.filter((job) => jobName === void 0 ? FAILED2.has(job.conclusion ?? "") : job.name === jobName || String(job.id) === jobName);
   const result = { runId, repo, jobs: [] };
   if (!selected.length && jobName === void 0) return { result, exitCode: 1, message: `read run log: no matching job for run ${runId} in ${repo}; conclusions seen: ${[...new Set(jobs.map((j) => j.conclusion ?? "pending"))].join(", ") || "none"}` };
   if (!selected.length) {
     const listed = jobs.slice(0, 30).map((j) => `${j.name} (${j.id})`).join(", ");
-    return { result, exitCode: 1, message: `read run log: --job takes the exact job name, not its id; jobs in run ${runId}: ${listed || "none"}${jobs.length > 30 ? `, \u2026+${jobs.length - 30} more` : ""}` };
+    return { result, exitCode: 1, message: `read run log: --job takes the exact job name or numeric job id; jobs in run ${runId}: ${listed || "none"}${jobs.length > 30 ? `, \u2026+${jobs.length - 30} more` : ""}` };
   }
   for (const job of selected) {
     const text = await readAppApi(`repos/${repo}/actions/jobs/${parseBrokerId(String(job.id), "job id")}/logs`, runner);
@@ -66158,7 +66373,7 @@ async function readRunLog(id, o, runner) {
   return { result, exitCode: 0 };
 }
 function registerRunLogRead(run, runner) {
-  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3)), "200").option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).option("--json", "emit runId, repo and jobs with failedStep/errorLines/tail").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
+  run.command("log").description("read workflow job logs on the App pool: error lines with \xB13 context and bounded tail (#8136); defaults to failed jobs, never personal").requiredOption("--repo <owner/repo>", "target repo on github.com", logRepo).addOption(new Option("--failed", "select failure/cancelled/timed_out jobs (default)").conflicts("job")).addOption(new Option("--job <name>", "select jobs with this exact name or numeric job id").argParser(logJob).conflicts("failed")).option("--tail <n>", "last lines per job (1-2000; default 200)", (v) => String(parseBrokerInt(v, "--tail", 1, 2e3)), "200").option("--attempt <n>", "run attempt (1-1000; default latest)", (v) => String(parseBrokerInt(v, "--attempt", 1, 1e3))).option("--json", "emit runId, repo and jobs with failedStep/errorLines/tail").argument("<runId>", "workflow run number", (v) => parseBrokerId(v, "run id")).action(async (id, o) => {
     requireBrokerApp("read run log");
     const env = brokerChildEnv();
     try {
@@ -66246,6 +66461,11 @@ function localJqEnv(base = process.env) {
   }
   return env;
 }
+function formatJqFailureMessage(code, stderr) {
+  const base = `--jq expression failed (jq exit ${code}): ${stderr.trim()}`;
+  if (!/Invalid escape/i.test(stderr)) return base;
+  return `${base} \u2014 the expression is handed to jq verbatim (mmi-cli never re-quotes it), so if a shell or seat layer collapsed a backslash, use an escape-free form such as \`test("bundle[.]css")\` or \`contains("bundle.css")\`, or drop --jq and filter the JSON locally`;
+}
 var systemJqRunner = (expr, input, env) => new Promise((resolveOut, reject2) => {
   const child2 = (0, import_node_child_process20.spawn)("jq", [...process.platform === "win32" ? ["--binary"] : [], "-r", "-c", expr], { env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
   let stdout = "";
@@ -66257,7 +66477,7 @@ var systemJqRunner = (expr, input, env) => new Promise((resolveOut, reject2) =>
     stderr += chunk;
   });
   child2.on("error", (e) => reject2(e.code === "ENOENT" ? new Error("--jq needs the jq binary on PATH and none was found \u2014 install jq, or drop --jq and filter the --json output locally") : e));
-  child2.on("close", (code) => code === 0 ? resolveOut(stdout) : reject2(new Error(`--jq expression failed (jq exit ${code}): ${stderr.trim()}`)));
+  child2.on("close", (code) => code === 0 ? resolveOut(stdout) : reject2(new Error(formatJqFailureMessage(code, stderr))));
   child2.stdin.on("error", () => {
   });
   child2.stdin.end(input);
@@ -66871,7 +67091,7 @@ var RELEASE_LATEST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/latest$`);
 var RELEASE_TAG_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/tags/(${NAME})$`);
 var RELEASE_ASSET_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/assets/\\d+$`);
 var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/issues/comments/{id}, repos/{owner}/{repo}/issues/{n}/comments[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/artifacts[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
-var API_GET_RECOVERY = " No other GET read exists \u2014 do not retry path variants; use a dedicated mmi-cli subcommand or ask a human token holder. This refusal exits 1 on stderr with nothing on stdout: check the exit code and never merge stderr into stdout (2>&1) before JSON-parsing.";
+var API_GET_RECOVERY = " No other GET read exists \u2014 do not retry path variants; use a dedicated mmi-cli subcommand or ask a human token holder. This refusal exits 1 on stderr with nothing on stdout: check the exit code and never merge stderr into stdout (2>&1) before JSON-parsing. Piping empty stdout into JSON.parse hides the stderr refusal; check the exit code before parsing.";
 var TYPED_READ_ROUTE_RE = new RegExp(`^repos/(${NAME})/(${NAME})/(issues|pulls)(?:/(comments/\\d+|\\d+)(?:/([a-z_]+))?)?$`);
 function typedReadHint(path2) {
   const match = TYPED_READ_ROUTE_RE.exec(path2.split("?")[0]);
@@ -66892,7 +67112,7 @@ function typedReadHint(path2) {
   }
   if (!item) return say(`mmi-cli devops read pr list --repo ${slug} --json number,title,state,headRefName`);
   if (item.startsWith("comments/")) return say(`mmi-cli devops read pr view <pr> --repo ${slug} --json comments,reviews`);
-  return say(`mmi-cli devops read pr view ${item} --repo ${slug} --json title,state,comments,reviews,commits,statusCheckRollup`);
+  return say(`mmi-cli devops read pr view ${item} --repo ${slug} --json title,state,comments,reviews,commits,statusCheckRollup,mergedAt,mergeCommit,headRefOid`, "; `mergedAt`, `mergeCommit` and `headRefOid` carry the merge and head evidence, and `--json` is a field list callers may narrow or extend");
 }
 function runsReadHint(path2) {
   const q = path2.indexOf("?");
@@ -66937,11 +67157,18 @@ function checkRunsReadHint(path2) {
   const slug = `${match[1]}/${match[2]}`;
   return ` Check-suite and check-run routes are deliberately outside the App allowlist \u2014 read per-check / per-job conclusions with the allowlisted \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs/<id>/jobs?per_page=100"\` or \`mmi-cli devops read run view <id> --repo ${slug} --json databaseId,workflowName,event,status,conclusion,jobs\`; check-run annotations and output text have no App-token read (ask a human token holder).`;
 }
+function workflowRunsReadHint(path2) {
+  const match = new RegExp(`^repos/(${NAME})/(${NAME})/actions/workflows(?:/([^/?#]+)(?:/runs)?)?(?:[/?#]|$)`).exec(path2.split("?")[0]);
+  if (!match) return "";
+  const [, owner, repo, workflow] = match;
+  const slug = `${owner}/${repo}`;
+  return ` Workflow routes are outside the App allowlist \u2014 use the typed workflow runs read \`MMI_ACTOR=app mmi-cli devops read run list --repo ${slug} --workflow ${workflow ?? "<workflow.yml>"} --branch <branch> --limit <n> --json databaseId,workflowName,event,status,conclusion\`, or the allowlisted REST runs list \`MMI_ACTOR=app mmi-cli devops api get "repos/${slug}/actions/runs?branch=<branch>&per_page=<n>"\`.`;
+}
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => {
     const hint = /^[A-Za-z]:[/\\]/.test(path2) ? " Git Bash/MSYS may have rewritten a leading-slash argument; retry with MSYS_NO_PATHCONV=1 and the slash-free repos/... path. The endpoint must still be allowlisted." : "";
-    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${hint}`;
+    const routeHints = `${typedReadHint(path2)}${runsReadHint(path2)}${orgScopedHint(path2)}${tagsReadHint(path2)}${branchRulesReadHint(path2)}${commitsReadHint(path2)}${checkRunsReadHint(path2)}${workflowRunsReadHint(path2)}${hint}`;
     return new Error(`api get: refusing '${rawPath}' \u2014${routeHints}${API_GET_RECOVERY} Only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}.`);
   };
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
@@ -67001,7 +67228,7 @@ function registerApiReadCommands(program3, overrides) {
       if (!zip && o.out !== void 0) {
         return fail(`${shapes} \u2014 drop --out and let the JSON body go to stdout (pipe it into node/jq, or use --jq <expr>), or use the typed read (e.g. \`mmi-cli devops read run list --repo <owner/repo> --json databaseId,workflowName,event,status,conclusion\`). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
       }
-      return fail(shapes);
+      return fail(`${shapes} \u2014 append \`--out <file>\` to this command (e.g. \`MMI_ACTOR=app mmi-cli devops api get ${req.path} --out .jerv/tmp/job.log\`), or for job logs use the typed read \`MMI_ACTOR=app mmi-cli devops read run log <runId> --repo <owner/repo> --job <name|id>\`. Shell redirection (\`>\` / \`2>&1\`) is not a substitute: this refusal exits 1 on stderr with nothing written to stdout, so \`>\` leaves a zero-byte file \u2014 delete it and check the exit code.`);
     }
     const appRoute = req.kind.startsWith("actions-") || req.kind.startsWith("release-");
     if (appRoute) requireBrokerApp("api get");
@@ -70572,7 +70799,7 @@ function envelopeAwareWriteErr(str2) {
     const invoked = resolveCommandFromArgv(program2, argv);
     const invokedPath = invoked ? canonicalPathFor(commandPath3(invoked)) ?? commandPath3(invoked) : void 0;
     const canonicalArgv = canonicalArgvFor(argv);
-    const claimStatus = invoked ? boardClaimStatusFlagRecovery(flag, invokedPath, canonicalArgv) ?? issueCommentAppendOnlyRecovery(flag, invokedPath, canonicalArgv) ?? trainPlanRedundantFlagRecovery(flag, invokedPath, canonicalArgv) : void 0;
+    const claimStatus = invoked ? boardClaimStatusFlagRecovery(flag, invokedPath, canonicalArgv) ?? boardClaimLaneFlagRecovery(flag, invokedPath, canonicalArgv) ?? boardClaimAgentFlagRecovery(flag, invokedPath, canonicalArgv) ?? issueCommentAppendOnlyRecovery(flag, invokedPath, canonicalArgv) ?? trainPlanRedundantFlagRecovery(flag, invokedPath, canonicalArgv) : void 0;
     if (claimStatus) {
       if (argvWantsJson3()) {
         process.stderr.write(

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.12",
+  "version": "4.6.14",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.12",
+  "version": "4.6.14",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -25,7 +25,12 @@ are `{ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}` (
 evidence object, null when unclaimed; `openPullRequests` lists the OPEN PRs whose closing-issue body links name
 the item — on the full JSON object that list lives at `report.pullRequests`, never `openPullRequests`). Partial reads
 exit nonzero; `--allow-partial` only when the dev accepts an incomplete board. The CLI partitions rows into
-**Yours**, **Free to claim** and **Taken**; stale stamps (4 hours without work) hold nothing. Partition rules,
+**Yours**, **Free to claim** and **Taken**; stale stamps (4 hours without work) hold nothing. Recovery
+moves: a zero-byte or empty `.jerv/tmp/*.json` (`Unexpected end of JSON input`) means a shell-redirected
+read FAILED — re-run with `--out` and check the exit code before parsing; a Status change on an existing
+item is `mmi-cli oracle board move <status> <ref>`, never a hand-written `gh api graphql`
+`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status field-id
+lookup. Partition rules,
 stamp details and `--out` rationale: [reference.md](reference.md).
 
 **Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run list --event`/`--jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`, `run list --event <event>`, or `MMI_ACTOR=app mmi-cli devops api get "repos/<owner>/<repo>/actions/runs?event=<event>&per_page=<n>"`); `--jq '<expr>'` on that typed read filters locally. Those typed reads take **one** number per call, exactly like native gh: a second number is refused as `too many arguments`, so read several issues by repeating the typed read once per number (one `--jq` each, joined `&&`). Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `mmi-cli oracle issue edit <ref> --body-file .jerv/tmp/issue-body.md`. When `node -e` reads saved JSON, pass an absolute path or use `JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))`: `require()` of a relative path (e.g. `tmp\board.json` from `cygpath -w`) throws MODULE_NOT_FOUND.

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -14,7 +14,7 @@ The server exposes `/health` and `/module.js`. Register the module's bundle URL,
 
 1. **Single source of truth:** the source folder of `packages/mmwork-ds` in `mutmutco/MM-Work`, owned by the MM-Work Design Lead (tokens, layers, component bundle, component docs, `DESIGN.md` and its `design.json` sidecar). Never edit the kit or its copies here; a missing piece or variant is built there first, or requested via kit MCP `request_piece`.
 2. **MM Artifact on Live Docs:** Live Docs (`Canlı belgeler / MM-Work`) displays document `3a5c79df-5274-40ad-a1b5-a75e67a74dac` (ATOMIC, module `mm-work-kit`), an MM Artifact in the `design-system` format rebuilt from the kit source on every kit release: Overview, Guide (kit README + `DESIGN.md`), Tokens, Atoms, Molecules, Organisms, Templates and Files. Browse it to see every piece live.
-3. **Impeccable knows Atomic Design at boot:** `impeccable context` loads `PRODUCT.md`, `DESIGN.md` and the `design.json` sidecar in `.impeccable`, which carry the Atomic Design contract 1.1.0: `Atoms -> Molecules -> Organisms -> Templates -> Pages`, upward-only composition enforced by `npx mmwork-check-ui --rules=all`. Pages arrange exported `@mutmutco/mmwork-ds` pieces around one template and never paint custom controls, raw `<button>`/`<input>`, `mw-*` classes, inline visual styles or raw hex/px values.
+3. **Impeccable knows Atomic Design at boot:** `impeccable context` loads `PRODUCT.md`, `DESIGN.md` and the `design.json` sidecar in `.impeccable`, which carry the Atomic Design contract 1.1.0: `Atoms -> Molecules -> Organisms -> Templates -> Pages`, upward-only composition enforced by `npm --prefix module run lint` (or `npm run lint` inside `module/`; `mmwork-check-ui` and `mmwork-check-i18n` are bins of `@mutmutco/mmwork-ds`, so a bare `npx mmwork-check-ui` outside that project's installed `node_modules` is resolved as a package name and 404s). Pages arrange exported `@mutmutco/mmwork-ds` pieces around one template and never paint custom controls, raw `<button>`/`<input>`, `mw-*` classes, inline visual styles or raw hex/px values.
 4. **Automatic propagation:** on every kit release the Hub kit-adopt workflow opens an adoption PR here that bumps `@mutmutco/mmwork-ds`, runs `mmwork-sync-impeccable`, and writes `DESIGN.md`, the `.impeccable` design manifest and `.impeccable/config.json` (`hook.enabled: true`) at the repository root, and deletes any stale copies under `module/`. These files are kit-owned: do not hand-edit them, and keep them committed even if `.impeccable/` is ignored (the adoption PR force-stages them).
 5. **Root only:** `PRODUCT.md`, `DESIGN.md`, the `.impeccable` design manifest and `.impeccable/config.json` live only at this repository's root, never duplicated under `module/`; a copy there makes Impeccable treat `module/` as a separate root without `PRODUCT.md` and the config. Run `impeccable context` from the root. Any suite-wide propagation of these files needs an explicit intercom ACK handshake with the MM-Work Design Lead naming the files written and removed, `impeccable context` + `impeccable doctor --json` verification, and the issue/PR reference.
 6. **Front-loaded harmony (owner, 2026-10-25; Hub#8837 / MM-Work#7668):** design work runs one workflow — Front-Loaded Impeccable v4.7.0 + MM Artifacts + Live Docs (`Canlı belgeler`, `3a5c79df-5274-40ad-a1b5-a75e67a74dac`) + Atomic Design Kit (`@mutmutco/mmwork-ds`). The former local stage skill is retired; preview and verify through these tools only.

package/skills/org-guide/SKILL.md

@@ -30,7 +30,7 @@ Read this entry before MMI work, then **only the relevant topic**. Human intro:
 | Consume, declare, rotate, or request a secret | [Vault and keyless access](references/vault.md) |
 | Register domains or configure Google OAuth | [Domains and OAuth](references/domains-and-oauth.md) |
 | Decide what belongs in a product repository | [Repository rules](references/repository-rules.md) |
-| Build an MM-Work module | not bundled — [MM-Work module guide](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md) in `@mutmutco/mmwork-ds`; read `pieces.json`, `mmwork.d.ts`, `FOR-AGENTS.md`, and `docs/components/<Piece>/guide.md` from the npm project declaring it (`module/node_modules/@mutmutco/mmwork-ds/`), never repo-root `node_modules`; when absent, fall back to `~/.jerv/cache/mmwork-ds/latest` or MM-Work `packages/mmwork-ds`, treat capability as unknown |
+| Build an MM-Work module | [Module guide](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md): from consumer, run `node <MMI-Hub>/scripts/design-pack-render.mjs --resolve-kit [<Piece>]` for kit root and `docs/components/<Piece>/guide.md`; prefers `module/node_modules/@mutmutco/mmwork-ds/`, falls back to `~/.jerv/cache/mmwork-ds/latest`. Read returned `piecesJson`, `types`, `forAgents`; absent means unknown capability. Never guess repo-root paths. |
 | Produce company-facing documents in the MM brand | not bundled — MM-Strategy MCP serves the brand kit (`mm_brand_guide`); install `@mutmutco/strategy` |
 
 Bundled guidance matches the installed plugin, not Jerv/JervCode; resolve current values/flags via live CLI.

package/skills/org-guide/references/design.md

@@ -49,6 +49,13 @@ design work follows one harmonized **Front-Loaded Impeccable v4.7.0 + MM Artifac
 - **Live Docs** (`Canlı belgeler` viewer) carry the living references, including the live
   design-system artifact `3a5c79df-5274-40ad-a1b5-a75e67a74dac`.
 - **Atomic Design Kit** (`@mutmutco/mmwork-ds`): kit pieces and tokens only, checked with `mmwork-check-ui`.
+  From the consumer, run `node <MMI-Hub>/scripts/design-pack-render.mjs --resolve-kit [<Piece>]`
+  to resolve the kit root and `docs/components/<Piece>/guide.md` in one JSON response. It prefers
+  `module/node_modules/@mutmutco/mmwork-ds/`, then the consumer's install, then
+  `~/.jerv/cache/mmwork-ds/latest`. Read the returned `piecesJson`, `types` and `forAgents` paths
+  before choosing pieces; `exists` reports whether the requested guide exists. Never guess
+  repo-root `node_modules/@mutmutco/mmwork-ds/docs/components/<Piece>.md`; component guides
+  live in `<Piece>/guide.md`. No install/cache means capability remains unknown.
 
 How the five pillars fit together (owner, 2026-10-25):
 
@@ -146,7 +153,19 @@ Craft essentials every agent applies (owner, 2026-10-25, #8839):
   `node scripts/design-pack-render.mjs --page-spec <spec.mjs>` (it SSR-renders `renderPage(ctx)` per
   theme mode and runs `impeccable detect --json` on the HTML), or `node artifacts/review/review.mjs
   <folder> --standalone` for a pack; never hand-roll an inline `node -e` SSR script, which evaluates
-  as CommonJS and fails on the spec's ESM `import` lines (#8876).
+  as CommonJS and fails on the spec's ESM `import` lines (#8876). For a folder of self-contained
+  static HTML boards (pre-rendered, every asset inside the folder), run
+  `node scripts/design-pack-render.mjs --pack <pack-dir> --boards <b-first.html,b-thread.html> --widths 1440,390`:
+  it serves `<pack-dir>` on `127.0.0.1`, measures each named board per width and theme, runs
+  `impeccable detect --json` over the board files and writes `check.json`. `--boards` takes one
+  comma-separated list (an unquoted shell glob passes only its first match); the server serves only
+  files directly inside `<pack-dir>`; and the run always exits 2 because rhythm and alignment stay
+  unmeasured, so it is not a full kit pass on its own. Boards that load `/kit/kit.css` and
+  `/kit/kit.js` are canvas boards: use `review.mjs <folder> --no-open`, which serves the kit beside
+  each board on `127.0.0.1` and runs live-DOM `impeccable detect` per board.
+  `artifacts/review/kit-assets.mjs`, `review.mjs`'s kit and board serving, and
+  `artifacts/format/check.mjs` are internals of the review server: no agent imports them or
+  re-implements them in an inline script (#9672).
 
 ### Shared support-script invocation
 

package/skills/org-guide/references/repository-rules.md

@@ -28,3 +28,4 @@ rules. Preserve product-owned content when updating managed sections.
 Use `mmi-cli tests policy --base <comparison-base>` and the repository's own checks before landing.
 For tooling repair, `mmi-hub status` reads state and `mmi-hub update` updates installed tooling;
 repository cleanup is a separate, explicit action, not an automatic consequence of asking for help.
+To find where `mmi-cli` emits a message or refusal, search the MMI-Hub checkout's `cli/src/**`; the installed tool is the published `@mutmutco/cli` and ships only bundled `dist`, so the global npm install root is not a searchable source tree.

package/skills/org-guide/references/work-and-releases.md

@@ -4,6 +4,10 @@ GitHub repository admins hold project-admin authority on their own projects with
 registry enrollment. Registry-listed admins with repository write access remain supported.
 Use `mmi-cli oracle org access role <owner/repo> --json` to verify authority for release,
 candidate, hotfix, and runtime operations. Organization membership role alone is not this check.
+Verified repository writers (GitHub write, maintain or admin) may land PRs targeting `development`
+on non-Hub repositories. `/train-authority` reports this separately as `developmentMerge`;
+it does not grant release, candidate, hotfix or runtime train authority. MMI-Hub development
+merges remain master-only.
 The Hub distribution train remains organization-master-only. It runs in the `hub-release` workflow on
 our self-hosted runners, dispatched by an org owner, never on a workstation (#9137).
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is

package/skills/release/suite.md

@@ -1,4 +1,4 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
+In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 
 Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.