@mutmutco/codex-plugin 4.6.28 → 4.6.30

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.28",
+  "version": "4.6.30",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -9092,6 +9092,73 @@ var require_dist = __commonJS({
   }
 });
 
+// src/ci-hosted-usage.ts
+var ci_hosted_usage_exports = {};
+__export(ci_hosted_usage_exports, {
+  projectHostedUsage: () => projectHostedUsage,
+  renderHostedUsage: () => renderHostedUsage
+});
+function projectHostedUsage(config, now = Date.now()) {
+  const summary = object(config.hostedUsage);
+  const state = object(summary?.state);
+  const tick = object(state?.lastTick);
+  const ok = object(state?.lastOk);
+  const record2 = object(summary?.record);
+  const unknowns = [];
+  let lastTick = null;
+  if (tick && typeof tick.ok === "boolean") {
+    lastTick = { ok: tick.ok };
+    if (iso(tick.at)) lastTick.at = tick.at;
+    if (typeof tick.complete === "boolean") lastTick.complete = tick.complete;
+    for (const k of ["scanned", "usedUsd", "remainingUsd", "paceUsdPerDay"]) {
+      if (typeof tick[k] === "number" && Number.isFinite(tick[k])) lastTick[k] = tick[k];
+    }
+    if (iso(tick.asOf)) lastTick.asOf = tick.asOf;
+  }
+  const lastOk = ok && iso(ok.at) && typeof ok.scanned === "number" && Number.isSafeInteger(ok.scanned) && ok.scanned >= 0 ? { at: ok.at, scanned: ok.scanned, ...typeof ok.complete === "boolean" && { complete: ok.complete } } : null;
+  const allowanceInputs = record2 && ["usedUsd", "remainingUsd", "paceUsdPerDay"].every((k) => typeof record2[k] === "number" && Number.isFinite(record2[k])) && iso(record2.asOf) && typeof record2.source === "string" && /^[\w .:/-]{1,64}$/.test(record2.source) ? { usedUsd: record2.usedUsd, remainingUsd: record2.remainingUsd, paceUsdPerDay: record2.paceUsdPerDay, asOf: record2.asOf, source: record2.source } : null;
+  const deployedRevision = typeof summary?.deployedRevision === "string" && /^[\w.+-]{1,128}$/.test(summary.deployedRevision) ? summary.deployedRevision : null;
+  if (!summary) unknowns.push("hostedUsage unavailable (server may predate this read or summary read failed)");
+  if (!deployedRevision) unknowns.push("deployedRevision unavailable");
+  if (!lastTick?.at) unknowns.push("lastTick.at unavailable");
+  if (!lastOk) unknowns.push("lastOk unavailable");
+  if (lastTick?.complete === void 0) unknowns.push("tick completeness unavailable");
+  if (!allowanceInputs) unknowns.push("allowance inputs and freshness unavailable");
+  if (summary && summary.record !== null && !allowanceInputs) unknowns.push("unrecognized allowance projection");
+  const age = allowanceInputs ? now - Date.parse(allowanceInputs.asOf) : null;
+  return {
+    source: { route: "GET /org/config", projection: "ORG#config hostedUsage", state: "CIHOSTED#v1/STATE", usage: "CIHOSTED#v1/USAGE" },
+    deployedRevision,
+    observedAt: new Date(now).toISOString(),
+    lastTick,
+    lastOk,
+    allowanceInputs,
+    decision: allowanceInputs ? "allowance served" : summary?.record === null ? "no allowance: record absent/malformed" : null,
+    complete: lastTick?.complete ?? null,
+    fresh: age === null ? null : age >= 0 && age < 12 * 36e5,
+    unknowns
+  };
+}
+function renderHostedUsage(read) {
+  const a = read.allowanceInputs;
+  return [
+    `${read.source.route} \u2014 ${read.source.projection} (${read.source.state}, ${read.source.usage})`,
+    `revision=${read.deployedRevision ?? "unknown"} observedAt=${read.observedAt}`,
+    `${read.decision ?? "decision unknown"}; complete=${read.complete ?? "unknown"} fresh=${read.fresh ?? "unknown"}`,
+    `lastTick=${read.lastTick?.at ?? "unknown"} ok=${read.lastTick?.ok ?? "unknown"}; lastOk=${read.lastOk?.at ?? "unknown"}`,
+    ...a ? [`Runtime allowance: used=$${a.usedUsd} remaining=$${a.remainingUsd} pace=$${a.paceUsdPerDay}/day asOf=${a.asOf} source=${a.source}`] : [],
+    ...read.unknowns.length ? [`Unknowns: ${read.unknowns.join("; ")}`] : []
+  ].join("\n");
+}
+var object, iso;
+var init_ci_hosted_usage = __esm({
+  "src/ci-hosted-usage.ts"() {
+    "use strict";
+    object = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+    iso = (v) => typeof v === "string" && Number.isFinite(Date.parse(v)) && new Date(v).toISOString() === v;
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -28181,10 +28248,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.28",
-    tag: "v4.6.28",
-    commit: "e21db51c4641",
-    npm: "@mutmutco/cli@4.6.28"
+    version: "4.6.30",
+    tag: "v4.6.30",
+    commit: "52569fa5c01e",
+    npm: "@mutmutco/cli@4.6.30"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28201,14 +28268,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.28"
+          v3Target: "v4.6.30"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.28 and redeploy the Hub Lambda from tag v4.6.28 (e21db51c4641); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.28 (@mutmutco/cli@4.6.28, tag commit e21db51c4641 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.30 and redeploy the Hub Lambda from tag v4.6.30 (52569fa5c01e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.30 (@mutmutco/cli@4.6.30, tag commit 52569fa5c01e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -31376,15 +31443,15 @@ function parseRuntimeIdentity(log, expected) {
   if (proofs.length !== 1) return unavailable("invalid-proof");
   const encoded = proofs[0].slice(prefix.length).trim();
   if (encoded.length > 16384) return unavailable("invalid-proof");
-  const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+  const object2 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
   const keys = (v, allowed) => Object.keys(v).length === allowed.length && Object.keys(v).every((k) => allowed.includes(k));
   const text = (v, re) => typeof v === "string" && re.test(v);
   try {
     const p = JSON.parse(encoded);
-    if (JSON.stringify(p) !== encoded || !object(p)) return unavailable("invalid-proof");
+    if (JSON.stringify(p) !== encoded || !object2(p)) return unavailable("invalid-proof");
     if (p.version !== 1) return unavailable("unsupported-version");
     const parts = expected.repo.split("/");
-    if (parts.length !== 2 || !parts.every(Boolean) || !object(p.target) || !keys(p.target, ["slug", "stage"]) || p.target.slug !== parts[1].toLowerCase() || p.target.stage !== expected.stage) return unavailable("target-mismatch");
+    if (parts.length !== 2 || !parts.every(Boolean) || !object2(p.target) || !keys(p.target, ["slug", "stage"]) || p.target.slug !== parts[1].toLowerCase() || p.target.stage !== expected.stage) return unavailable("target-mismatch");
     if (p.status === "unavailable") {
       if (!keys(p, ["version", "target", "status", "reason"]) || typeof p.reason !== "string" || !["selection-unavailable", "inspection-failed", "snapshot-changed", "output-too-large"].includes(p.reason)) return unavailable("invalid-proof");
       return unavailable(p.reason);
@@ -31392,7 +31459,7 @@ function parseRuntimeIdentity(log, expected) {
     if (!keys(p, ["version", "target", "status", "slot", "replicas"]) || p.status !== "available" || p.slot !== "blue" && p.slot !== "green" || !Array.isArray(p.replicas) || !p.replicas.length) return unavailable("invalid-proof");
     const seen = /* @__PURE__ */ new Set();
     for (const r of p.replicas) {
-      if (!object(r) || !keys(r, ["service", "container", "configuredRef", "actualImageID", "repoDigests", "health", "state"]) || !text(r.service, /^[A-Za-z0-9][A-Za-z0-9_-]*$/) || !text(r.container, /^[a-f0-9]{64}$/) || !text(r.configuredRef, /^[A-Za-z0-9][A-Za-z0-9._/@:-]*$/) || !text(r.actualImageID, /^sha256:[a-f0-9]{64}$/) || !Array.isArray(r.repoDigests) || !r.repoDigests.every((d) => text(d, /^[A-Za-z0-9][A-Za-z0-9._/:-]*@sha256:[a-f0-9]{64}$/)) || (typeof r.health !== "string" || !["healthy", "unhealthy", "starting", "not-configured", "unknown"].includes(r.health)) || r.state !== "running" || seen.has(r.container)) return unavailable("invalid-proof");
+      if (!object2(r) || !keys(r, ["service", "container", "configuredRef", "actualImageID", "repoDigests", "health", "state"]) || !text(r.service, /^[A-Za-z0-9][A-Za-z0-9_-]*$/) || !text(r.container, /^[a-f0-9]{64}$/) || !text(r.configuredRef, /^[A-Za-z0-9][A-Za-z0-9._/@:-]*$/) || !text(r.actualImageID, /^sha256:[a-f0-9]{64}$/) || !Array.isArray(r.repoDigests) || !r.repoDigests.every((d) => text(d, /^[A-Za-z0-9][A-Za-z0-9._/:-]*@sha256:[a-f0-9]{64}$/)) || (typeof r.health !== "string" || !["healthy", "unhealthy", "starting", "not-configured", "unknown"].includes(r.health)) || r.state !== "running" || seen.has(r.container)) return unavailable("invalid-proof");
       seen.add(r.container);
     }
     return p;
@@ -39296,8 +39363,9 @@ function blessedHubActionPins(constants = gate_budget_exports) {
   }
   return pins;
 }
+var PIN_COMMIT_FORMAT = "commit-format:runbook-unaffected";
 function pinTableDigest(pins) {
-  return (0, import_node_crypto11.createHash)("sha1").update([...pins].map(([a, s]) => `${a}@${s}`).sort().join("\n")).digest("hex");
+  return (0, import_node_crypto11.createHash)("sha1").update([PIN_COMMIT_FORMAT, ...[...pins].map(([a, s]) => `${a}@${s}`).sort()].join("\n")).digest("hex");
 }
 var HUB_ACTION_USE = /^(\s*-?\s*uses:\s*['"]?mutmutco\/mmi-hub\/\.github\/actions\/)([\w.-]+)@([^\s'"#]+)([^\n]*)$/i;
 function staleHubActionPins(body, pins = blessedHubActionPins()) {
@@ -39417,7 +39485,9 @@ async function runPinTick(input) {
       if (!next.changes.length) continue;
       lines2.push(...next.changes.map((c) => `- \`${path2}:${c.line}\` ${c.action}: \`${c.from.slice(0, 12)}\` \u2192 \`${c.to.slice(0, 12)}\``));
       const tmp = (0, import_node_path29.join)((0, import_node_os17.tmpdir)(), `mmi-pin-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      const put = { message: `ci: pin MMI-Hub actions in ${path2} to the blessed SHAs`, content: encodeGitHubContents(next.body), branch };
+      const put = { message: `ci: pin MMI-Hub actions in ${path2} to the blessed SHAs
+
+Runbook-Unaffected: SHA-only MMI-Hub action pin move; no workflow step changes`, content: encodeGitHubContents(next.body), branch };
       if (file.sha) put.sha = file.sha;
       (0, import_node_fs32.writeFileSync)(tmp, JSON.stringify(put), "utf8");
       try {
@@ -42384,9 +42454,19 @@ async function runPrLandOnce(prNumber, options, deps) {
       }
     }
   }
-  const checksWaitError = (checksWait) => {
+  const isConflicting = (state) => state.mergeStateStatus === "DIRTY" || state.mergeable === "CONFLICTING";
+  const conflictError = () => `pr land #${prNumber}: branch conflicts with base \u2014 merge origin/development into the branch (never rebase a pushed branch), rebuild any checked-in artifacts, then push before landing${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`;
+  const readPrState = async () => {
+    const state = await deps.readPrState(prNumber, repo);
+    if (!isConflicting(state)) return state;
+    await (deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))))(PR_HEAD_UPDATE_API_READ_DELAY_MS);
+    return deps.readPrState(prNumber, repo);
+  };
+  let prState;
+  const checksWaitError = async (checksWait) => {
     if (checksWait.status === "conflicting") {
-      return `checks-wait conflicting: ${checksWait.reason ?? "PR is conflicting with the base branch"}`;
+      prState = await readPrState();
+      return isConflicting(prState) ? conflictError() : void 0;
     }
     if (checksWait.status === "failure" || checksWait.status === "timeout" || checksWait.status === "rate-limited") {
       return `checks-wait ${checksWait.status}${checksWait.detail ? `: ${checksWait.detail}` : ""}`;
@@ -42394,11 +42474,11 @@ async function runPrLandOnce(prNumber, options, deps) {
     return void 0;
   };
   base.checksWait = await deps.waitForChecks(prNumber, repo);
-  const waitError = checksWaitError(base.checksWait);
-  if (waitError) return { ...base, error: hasQueue ? `${waitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : waitError };
+  const waitError = await checksWaitError(base.checksWait);
+  if (waitError) return { ...base, error: hasQueue && base.checksWait.status !== "conflicting" ? `${waitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : waitError };
   const driftAfterChecks = await headDrift("after checks");
   if (driftAfterChecks) return driftAfterChecks;
-  let prState = await deps.readPrState(prNumber, repo);
+  prState = prState ?? await readPrState();
   if (!hasQueue && pinned && prState.mergeStateStatus === "BEHIND") {
     return {
       ...base,
@@ -42413,16 +42493,11 @@ async function runPrLandOnce(prNumber, options, deps) {
       return { ...base, error: `pr land #${prNumber}: ${e.message}` };
     }
     base.checksWait = await deps.waitForChecks(prNumber, repo);
-    const reWaitError = checksWaitError(base.checksWait);
-    if (reWaitError) return { ...base, error: hasQueue ? `${reWaitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : reWaitError };
-    prState = await deps.readPrState(prNumber, repo);
-  }
-  if (prState.mergeStateStatus === "DIRTY" || prState.mergeable === "CONFLICTING") {
-    return {
-      ...base,
-      error: `pr land #${prNumber}: branch conflicts with base \u2014 rebase/merge development, rebuild any checked-in artifacts, then re-push before landing${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`
-    };
+    const reWaitError = await checksWaitError(base.checksWait);
+    if (reWaitError) return { ...base, error: hasQueue && base.checksWait.status !== "conflicting" ? `${reWaitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : reWaitError };
+    prState = await readPrState();
   }
+  if (isConflicting(prState)) return { ...base, error: conflictError() };
   if (hasQueue && !deps.enqueueQueue) throw new Error("queue-only enqueue adapter unavailable; no merge dispatched");
   const merge = await mergeAutoWithTransientRetry(prNumber, repo, hasQueue ? { ...deps, mergeAuto: (pr, target) => deps.enqueueQueue(pr, target, pinned) } : deps);
   base.mergeStatus = merge.mergeStatus;
@@ -58712,6 +58787,7 @@ function registerApiReadCommands(program3, overrides) {
     if (zip !== (o.out !== void 0)) {
       const shapes = "api get: --out <file> is required for, and only valid with, repos/{owner}/{repo}/actions/artifacts/{id}/zip and repos/{owner}/{repo}/actions/jobs/{id}/logs and repos/{owner}/{repo}/releases/assets/{id}";
       if (!zip && o.out !== void 0) {
+        if (req.kind === "contents") return fail(`${shapes} \u2014 for this file's bytes, drop --out and use \`--accept raw\` with a redirect: \`mmi-cli devops api get "${req.path}" --accept raw > <file>\` (decoded bytes on stdout, no base64 or JSON.parse). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
         return fail(`${shapes} \u2014 drop --out and let the JSON body go to stdout (pipe it into node/jq, or use --jq <expr>), or use the typed read (e.g. \`mmi-cli devops read run list --repo <owner/repo> --json databaseId,workflowName,event,status,conclusion\`). This refusal exits 1 on stderr with nothing written: check the exit code and never discard stderr (2>&1 / >/dev/null) before parsing.`);
       }
       return fail(`${shapes} \u2014 append \`--out <file>\` to this command (e.g. \`MMI_ACTOR=app mmi-cli devops api get ${req.path} --out .jerv/tmp/job.log\`), or for job logs use the typed read \`MMI_ACTOR=app mmi-cli devops read run log <runId> --repo <owner/repo> --job <name|id>\`. Shell redirection (\`>\` / \`2>&1\`) is not a substitute: this refusal exits 1 on stderr with nothing written to stdout, so \`>\` leaves a zero-byte file \u2014 delete it and check the exit code.`);
@@ -71172,6 +71248,24 @@ function parseWindow(raw, nowMs) {
   }
   return { ok: true, value: { since: formatUtc(nowMs - span), label: value, isDefault: false } };
 }
+function parseUntil(raw, nowMs) {
+  if (raw === void 0) return { ok: true, value: void 0 };
+  const value = raw.trim();
+  if (ABSOLUTE_WINDOW_RE.test(value)) return { ok: true, value: { until: value, label: value } };
+  const rel = RELATIVE_WINDOW_RE.exec(value);
+  if (!rel) {
+    return {
+      ok: false,
+      reason: `--until must be a relative window like 15m, 6h or 2d, or a UTC time like 2026-10-07T13:10Z (got '${value}')`
+    };
+  }
+  const unit = rel[2] === "m" ? MINUTE_MS : rel[2] === "h" ? 60 * MINUTE_MS : 24 * 60 * MINUTE_MS;
+  const span = Number(rel[1]) * unit;
+  if (span > TENANT_LOG_WINDOW_MAX_MS) {
+    return { ok: false, reason: `--until ${value} is wider than 30d \u2014 the journal keeps 7 days, so a wider window buys no history and unbounded work` };
+  }
+  return { ok: true, value: { until: formatUtc(nowMs - span), label: value } };
+}
 function tenantLogUnitPrefix(slug, stage) {
   if (!SLUG_RE.test(slug)) return { ok: false, reason: `'${slug}' is not a tenant slug \u2014 refusing to build a unit namespace from it` };
   if (!TENANT_LOG_STAGES.includes(stage)) {
@@ -71263,6 +71357,11 @@ async function readTenantLogs(deps, opts) {
   const nowMs = deps.now();
   const window = parseWindow(opts.since, nowMs);
   if (!window.ok) return window;
+  const until = parseUntil(opts.until, nowMs);
+  if (!until.ok) return until;
+  if (until.value && Date.parse(until.value.until) <= Date.parse(window.value.since)) {
+    return { ok: false, reason: `--until ${until.value.label} must be after --since ${window.value.label}` };
+  }
   if (opts.grep !== void 0 && opts.grep.length === 0) return { ok: false, reason: "--grep needs a non-empty literal needle" };
   const slug = opts.repo.includes("/") ? (opts.repo.split("/").pop() ?? "").toLowerCase() : opts.repo.toLowerCase();
   const facts = await deps.deployFacts(slug);
@@ -71273,7 +71372,8 @@ async function readTenantLogs(deps, opts) {
     stage: coords.value.stage,
     action: "logs",
     lines: tail.value,
-    logSince: window.value.since
+    logSince: window.value.since,
+    logUntil: until.value?.until
   });
   const credentials = deps.credentials?.() ?? [];
   const bounded = applyBound(redactJournal(read.logs ?? "", credentials), tail.value);
@@ -71296,12 +71396,15 @@ async function readTenantLogs(deps, opts) {
         since: window.value.since,
         sinceLabel: window.value.label,
         sinceIsDefault: window.value.isDefault,
+        ...until.value ? { until: until.value.until, untilLabel: until.value.label } : {},
         truncated: bounded.truncated,
         dropped: bounded.dropped,
         received: bounded.received
       },
-      ...opts.grep ? { grep: { needle: opts.grep, matched: filtered.matched } } : {},
-      units: observedUnits(filtered.lines, coords.value.unitPrefix),
+      ...opts.grep ? { grep: { needle: opts.grep, matched: filtered.matched, scanned: lines2.length } } : {},
+      // #9878: report units from the BOUNDED lines, not the grep survivors — a grep miss must still say
+      // which units answered, or a filter miss reads as data loss.
+      units: observedUnits(lines2, coords.value.unitPrefix),
       lines: filtered.lines,
       conclusion: read.conclusion,
       ...read.runUrl ? { runUrl: read.runUrl } : {},
@@ -71314,18 +71417,18 @@ function renderTenantLogs(r) {
     `runtime tenant logs ${r.repo} ${r.stage} \u2014 journald on the stage's own box, slot resolved from the tenant's coords (no unit name, no slot flag)`,
     `  tenant   ${r.slug} (DEPLOY#${r.stage})${r.box ? ` box ${r.box}` : ""}${r.deployedTag ? ` tag ${r.deployedTag}` : ""}`,
     `  units    ${r.unitPrefix}* (journald tag namespace derived from the coords)`,
-    `  window   since ${r.bound.since}${r.bound.sinceIsDefault ? " (default 1h)" : ""} \u2014 journald keys by container NAME, so a deploy-recreated container still answers`,
+    `  window   since ${r.bound.since}${r.bound.sinceIsDefault ? " (default 1h)" : ""}${r.bound.until ? ` until ${r.bound.until}` : ""} \u2014 journald keys by container NAME, so a deploy-recreated container still answers`,
     `  bound    last ${r.bound.tail} line(s) of that window (max ${r.bound.tailMax}, default ${r.bound.tailDefault})`
   ];
   if (r.bound.truncated) {
     out.push(`  NOTE     the box returned ${r.bound.received} line(s); the bound kept the last ${r.bound.tail} and dropped ${r.bound.dropped}`);
   }
   if (r.grep) {
-    out.push(`  grep     '${r.grep.needle}' kept ${r.grep.matched} of ${r.lines.length === r.grep.matched ? r.lines.length : r.bound.tail} returned line(s) \u2014 the filter runs on the BOUNDED tail, not the whole journal; widen --tail/--since to search further back`);
+    out.push(`  grep     '${r.grep.needle}' kept ${r.grep.matched} of ${r.grep.scanned} bounded line(s) \u2014 the filter runs on the BOUNDED tail, not the whole journal; widen --tail or narrow with --since/--until to search further back`);
   }
   out.push(`  observed ${r.units.length ? r.units.map((u) => `${u.unit} (${u.lines})`).join(", ") : `no ${r.unitPrefix}* lines in this window`}`);
   if (!r.lines.length) {
-    out.push("  (no lines \u2014 the window is empty for this tenant stage; widen --since rather than concluding the app was quiet)");
+    out.push(r.grep && r.grep.scanned > 0 ? `  NOTE     grep matched 0 of ${r.grep.scanned} bounded line(s) \u2014 that is a filter miss, not an empty window; narrow with --since/--until or widen --tail` : "  (no lines \u2014 the window is empty for this tenant stage; widen --since rather than concluding the app was quiet)");
   } else {
     out.push("---8<---");
     out.push(...r.lines);
@@ -73402,7 +73505,7 @@ tenant.command("status <owner/repo> <stage>").description("read tenant runtime r
   console.log(JSON.stringify(result, null, 2));
   if (result.publicProbe?.ok === false || result.edgeCertificate?.missing) process.exitCode = 1;
 });
-tenant.command("logs <owner/repo> <stage>").description("READ-ONLY: read a tenant stage's application journal (journald, so a deploy-recreated container still answers) \u2014 the unit namespace comes from the tenant's DEPLOY coords and the blue/green slot is chosen on the box, never from a flag; bounded and redacted (#9230)").option("--tail <n>", `lines to return (1-${TENANT_LOG_TAIL_MAX}, default ${TENANT_LOG_TAIL_DEFAULT}); the applied bound is printed`).option("--since <window>", "window start: a relative window like 15m, 6h or 2d, or a UTC time like 2026-10-07T13:10Z (default 1h)").option("--grep <needle>", "keep only returned lines containing this literal text (applied to the bounded tail, not the whole journal)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
+tenant.command("logs <owner/repo> <stage>").description("READ-ONLY: read a tenant stage's application journal (journald, so a deploy-recreated container still answers) \u2014 the unit namespace comes from the tenant's DEPLOY coords and the blue/green slot is chosen on the box, never from a flag; bounded and redacted (#9230)").option("--tail <n>", `lines to return (1-${TENANT_LOG_TAIL_MAX}, default ${TENANT_LOG_TAIL_DEFAULT}); the applied bound is printed`).option("--since <window>", "window start: a relative window like 15m, 6h or 2d, or a UTC time like 2026-10-07T13:10Z (default 1h)").option("--until <time>", "window end: same forms as --since (default: now) \u2014 the box returns the newest N lines OF the window, so end it earlier to reach older lines on a busy tenant (#9878)").option("--grep <needle>", "keep only returned lines containing this literal text (applied to the bounded tail, not the whole journal)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   try {
     const cfg = await loadConfig();
     const reg = registryClientDeps(cfg);
@@ -73410,12 +73513,12 @@ tenant.command("logs <owner/repo> <stage>").description("READ-ONLY: read a tenan
       {
         deployFacts: (slug) => fetchDeployFactsBySlug(slug, reg),
         // The one dispatch a log read may make. Never watched=false: the run's OUTPUT is the answer.
-        control: (opts) => runTenantControl(trainApplyDeps(), { repo: opts.repo, stage: opts.stage, action: opts.action, watch: true, lines: opts.lines, logSince: opts.logSince }),
+        control: (opts) => runTenantControl(trainApplyDeps(), { repo: opts.repo, stage: opts.stage, action: opts.action, watch: true, lines: opts.lines, logSince: opts.logSince, logUntil: opts.logUntil }),
         now: Date.now,
         // The credentials this process holds, so the repo's exact-string redactor can strip them.
         credentials: () => [process.env.GH_TOKEN].filter((c) => !!c)
       },
-      { repo, stage, tail: o.tail, since: o.since, grep: o.grep }
+      { repo, stage, tail: o.tail, since: o.since, until: o.until, grep: o.grep }
     );
     if (!result.ok) return failGraceful(`runtime tenant logs: ${result.reason}`);
     if (o.json) {
@@ -74132,6 +74235,13 @@ ci.command("audit").description("read-only fleet scan: gate workflow, ruleset co
   else console.log(renderCiAuditText(report));
   if (!report.ok) process.exitCode = 1;
 });
+ci.command("hosted-usage").description("read-only hosted tick and lane-demand allowance proof from org config").option("--json", "machine-readable output").action(async (o) => {
+  const org = await fetchOrgConfig(registryClientDeps(await loadConfig()));
+  if (!org) return failGraceful("ci hosted-usage: Hub org config unavailable");
+  const { projectHostedUsage: projectHostedUsage2, renderHostedUsage: renderHostedUsage2 } = await Promise.resolve().then(() => (init_ci_hosted_usage(), ci_hosted_usage_exports));
+  const read = projectHostedUsage2(org);
+  console.log(o.json ? JSON.stringify(read, null, 2) : renderHostedUsage2(read));
+});
 registerCiChecksWait(ci);
 registerCancelOrphans(ci, async () => (await mintCommandWriteToken(appActorDeps(), "ci cancel-orphans")).token);
 var runRoot = program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` and `run rerun <id> [--failed]`, both on the org App actions:write profile");

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.28",
+  "version": "4.6.30",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.28",
+  "version": "4.6.30",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/hotfix/suite.md

@@ -1,2 +1,2 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
+In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 

package/skills/rcand/suite.md

@@ -1,4 +1,4 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
+In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 
 Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.