@mutmutco/codex-plugin 4.6.30 → 4.6.32

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.30",
+  "version": "4.6.32",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -24526,19 +24526,7 @@ function formatBulkClaimSummary(results) {
   const notClaimed = skipped.map((r) => `${r.ref}${/already claimed by /i.test(r.reason) ? " (held by another lane)" : ""}`);
   return `claimed ${landed.length} of ${results.length}: ${landed.length ? `${landed.join(", ")} landed` : "none landed"}; not claimed: ${notClaimed.join(", ")}`;
 }
-async function claimBoardIssues(options, deps = {}) {
-  const cfg = resolveBoardConfig(options.config);
-  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
-  const selectors = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const raw of options.selectors) {
-    const selector = parseIssueSelector(raw, collected.repo, options.repo);
-    const key = `${selector.repo.toLowerCase()}#${selector.number}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    selectors.push(selector);
-  }
-  const ctx = await prepareClaimContext(options, selectors, deps, collected, snapshot);
+async function runBulkClaims(ctx, selectors, options) {
   const results = new Array(selectors.length);
   let next = 0;
   const worker = async () => {
@@ -24555,6 +24543,71 @@ async function claimBoardIssues(options, deps = {}) {
     }
   };
   await Promise.all(Array.from({ length: Math.min(CLAIM_CONCURRENCY, selectors.length) }, () => worker()));
+  return results;
+}
+function claimArgsError(refs, all) {
+  if (all && refs.length) return `--all claims the whole board; drop the explicit refs (${refs.join(" ")}) or drop --all`;
+  if (!all && !refs.length) return "missing issue ref: pass one or more refs, or --all for every open claimable item on the board";
+  return void 0;
+}
+async function claimAllBoardIssues(options, deps = {}) {
+  const cfg = resolveBoardConfig(options.config);
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
+  const ctx = await prepareClaimContext(options, [], deps, collected, snapshot);
+  const { primary } = ctx.report;
+  const assignee = options.assignee ?? "@me";
+  const login = assignee === "@me" ? ctx.report.viewer : assignee.replace(/^@/, "");
+  const selectors = [];
+  const skipped = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of [...primary.userOwned, ...primary.claimable, ...primary.unownedInFlight, ...primary.taken]) {
+    const key = item.ref.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (item.contentType !== "Issue") {
+      skipped.push({ ref: item.ref, reason: "not an issue" });
+      continue;
+    }
+    if (item.state !== "OPEN") {
+      skipped.push({ ref: item.ref, reason: `issue is ${item.state.toLowerCase()} but its card is ${item.status}` });
+      continue;
+    }
+    if (item.status === "In Review") {
+      skipped.push({ ref: item.ref, reason: "In Review \u2014 a whole-board claim does not pull review cards back to In Progress; claim it by ref to reclaim" });
+      continue;
+    }
+    const verdict = evaluateClaim(item, login);
+    if (!verdict.ok) {
+      skipped.push({ ref: item.ref, reason: verdict.reason.replace(/ \(never chain separate claims.*$/, "") });
+      continue;
+    }
+    selectors.push({ repo: item.repository, number: item.number });
+  }
+  ctx.selectedRefs = new Set(selectors.map((s) => `${s.repo}#${s.number}`.toLowerCase()));
+  const results = await runBulkClaims(ctx, selectors, options);
+  return {
+    viewer: ctx.report.viewer,
+    repo: ctx.report.repo,
+    results,
+    skipped,
+    failed: results.filter((result) => !result.claimed).length,
+    ...ctx.report.warnings.length ? { warnings: [...ctx.report.warnings] } : {}
+  };
+}
+async function claimBoardIssues(options, deps = {}) {
+  const cfg = resolveBoardConfig(options.config);
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
+  const selectors = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of options.selectors) {
+    const selector = parseIssueSelector(raw, collected.repo, options.repo);
+    const key = `${selector.repo.toLowerCase()}#${selector.number}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    selectors.push(selector);
+  }
+  const ctx = await prepareClaimContext(options, selectors, deps, collected, snapshot);
+  const results = await runBulkClaims(ctx, selectors, options);
   return {
     viewer: ctx.report.viewer,
     repo: ctx.report.repo,
@@ -25980,7 +26033,7 @@ var BLESSED_RUN_WITH_BUDGET_SHA = "cb31a94c89729beac83500ad4d301132dcfe2e4c";
 var BLESSED_RUNNER_GATE_SHA = "7f9a25df2ce7198c67407b42d0c548f75ce3f430";
 var BLESSED_RUNNER_CHECK_POLICY_SHA = "67bb2012710a96d21be825c29a5d5c2b4b8001e2";
 var BLESSED_KIT_AGENT_FILES_SHA = "e976df208d891b215844386c1cac0f161946b6fa";
-var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
+var BLESSED_JEV_FAILURES_SHA = "20ce7d5e0d85cdc7e14bbacbc8b6afdabee6bd41";
 var BLESSED_VERDICT_RECEIPT_SHA = "";
 var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
@@ -28248,10 +28301,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.30",
-    tag: "v4.6.30",
-    commit: "52569fa5c01e",
-    npm: "@mutmutco/cli@4.6.30"
+    version: "4.6.32",
+    tag: "v4.6.32",
+    commit: "0e477e5e2765",
+    npm: "@mutmutco/cli@4.6.32"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28268,14 +28321,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.30"
+          v3Target: "v4.6.32"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.30 and redeploy the Hub Lambda from tag v4.6.30 (52569fa5c01e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.30 (@mutmutco/cli@4.6.30, tag commit 52569fa5c01e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.32 and redeploy the Hub Lambda from tag v4.6.32 (0e477e5e2765); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.32 (@mutmutco/cli@4.6.32, tag commit 0e477e5e2765 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -42455,7 +42508,7 @@ async function runPrLandOnce(prNumber, options, deps) {
     }
   }
   const isConflicting = (state) => state.mergeStateStatus === "DIRTY" || state.mergeable === "CONFLICTING";
-  const conflictError = () => `pr land #${prNumber}: branch conflicts with base \u2014 merge origin/development into the branch (never rebase a pushed branch), rebuild any checked-in artifacts, then push before landing${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`;
+  const conflictError = () => `pr land #${prNumber}: branch conflicts with base \u2014 \`git fetch origin\`, merge origin/development into the branch (never rebase a pushed branch), resolve the conflicts, regenerate any checked-in artifacts, commit and push, then re-run \`mmi-cli devops pr land ${prNumber} --repo ${repo}\` once${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`;
   const readPrState = async () => {
     const state = await deps.readPrState(prNumber, repo);
     if (!isConflicting(state)) return state;
@@ -42503,6 +42556,9 @@ async function runPrLandOnce(prNumber, options, deps) {
   base.mergeStatus = merge.mergeStatus;
   if (merge.credential) base.credential = merge.credential;
   if (merge.credentialRole) base.credentialRole = merge.credentialRole;
+  if (merge.ejectedThenReenqueued) base.ejectedThenReenqueued = true;
+  if (merge.reconcileNeeded) base.reconcileNeeded = true;
+  if (merge.queueRemovalEvidence) base.queueRemovalEvidence = merge.queueRemovalEvidence;
   if (merge.mergeStatus === "queue-admission-pending") {
     return { ...base, status: "queue-admission-pending", outcomeUnknown: true, queueAdmission: merge.queueAdmission, error: merge.error };
   }
@@ -43674,6 +43730,7 @@ var autoMergeApi = async (pr, repo, head) => {
 };
 var ASYNC_HEADERS = ["-H", "Accept: application/vnd.github+json", "-H", "X-GitHub-Api-Version: 2026-03-10"];
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+var UNWITNESSED_EJECTION_GRACE_MS = 6e4;
 function admissionJournal(repo, pr, root) {
   const stateRoot = root ?? (process.platform === "win32" ? (0, import_node_path31.join)(process.env.LOCALAPPDATA || (0, import_node_path31.join)((0, import_node_os18.homedir)(), "AppData", "Local"), "MMI Future", "mmi-cli", "queue-admissions") : (0, import_node_path31.join)(process.env.XDG_STATE_HOME || (0, import_node_path31.join)((0, import_node_os18.homedir)(), ".local", "state"), "mmi-cli", "queue-admissions"));
   const directory = (0, import_node_path31.join)(stateRoot, (0, import_node_crypto12.createHash)("sha256").update(`${repo.toLowerCase()}#${pr}`).digest("hex"));
@@ -43687,12 +43744,12 @@ function admissionJournal(repo, pr, root) {
   const path2 = (number) => (0, import_node_path31.join)(directory, `${number}.jsonl`);
   const validate = (value, previous) => {
     const row = value;
-    if (!row || row.version !== 1 || row.repo !== repo.toLowerCase() || row.pr !== pr || !/^[a-f0-9]{40}$/i.test(row.head) || !UUID.test(row.intentId) || !Number.isSafeInteger(row.createdAt) || row.createdAt <= 0 || !Number.isSafeInteger(row.observedAt) || row.observedAt < row.createdAt || !["dispatching", "pending", "enqueued", "merged", "failed", "ejected"].includes(row.state) || row.credential !== void 0 && !["app_installation", "user"].includes(row.credential) || row.queueWitnessed !== void 0 && typeof row.queueWitnessed !== "boolean" || row.uuid !== void 0 && !UUID.test(row.uuid) || row.state === "pending" && !row.uuid || row.queueEntry !== void 0 && (!row.queueEntry || typeof row.queueEntry.headCommitOid !== "string" || !/^[a-f0-9]{40}$/i.test(row.queueEntry.headCommitOid) || typeof row.queueEntry.enqueuedAt !== "string" || !Number.isFinite(Date.parse(row.queueEntry.enqueuedAt)))) {
+    if (!row || row.version !== 1 || row.repo !== repo.toLowerCase() || row.pr !== pr || !/^[a-f0-9]{40}$/i.test(row.head) || !UUID.test(row.intentId) || !Number.isSafeInteger(row.createdAt) || row.createdAt <= 0 || !Number.isSafeInteger(row.observedAt) || row.observedAt < row.createdAt || !["dispatching", "pending", "enqueued", "merged", "failed", "ejected", "abandoned"].includes(row.state) || row.credential !== void 0 && !["app_installation", "user"].includes(row.credential) || row.queueWitnessed !== void 0 && typeof row.queueWitnessed !== "boolean" || row.uuid !== void 0 && !UUID.test(row.uuid) || row.state === "pending" && !row.uuid || row.queueEntry !== void 0 && (!row.queueEntry || typeof row.queueEntry.headCommitOid !== "string" || !/^[a-f0-9]{40}$/i.test(row.queueEntry.headCommitOid) || typeof row.queueEntry.enqueuedAt !== "string" || !Number.isFinite(Date.parse(row.queueEntry.enqueuedAt)))) {
       throw new Error("queue admission receipt is invalid; preserve it and reconcile the prior request");
     }
     if (!previous) {
       if (row.state !== "dispatching" || row.uuid || row.queueEntry || row.observedAt !== row.createdAt) throw new Error("queue admission intent record is invalid");
-    } else if (row.head !== previous.head || row.intentId !== previous.intentId || row.createdAt !== previous.createdAt || row.observedAt < previous.observedAt || row.state === "dispatching" || previous.uuid && row.uuid !== previous.uuid || previous.credential !== void 0 && row.credential !== previous.credential || ["enqueued", "merged", "failed", "ejected"].includes(previous.state) && (row.state !== previous.state || row.uuid !== previous.uuid) && !(previous.state === "enqueued" && row.state === "ejected" && row.uuid === previous.uuid)) {
+    } else if (row.head !== previous.head || row.intentId !== previous.intentId || row.createdAt !== previous.createdAt || row.observedAt < previous.observedAt || row.state === "dispatching" || previous.uuid && row.uuid !== previous.uuid || previous.credential !== void 0 && row.credential !== previous.credential || ["enqueued", "merged", "failed", "ejected"].includes(previous.state) && (row.state !== previous.state || row.uuid !== previous.uuid) && !(previous.state === "enqueued" && ["ejected", "abandoned"].includes(row.state) && row.uuid === previous.uuid)) {
       throw new Error("queue admission receipt has an illegal transition or changed operation identity");
     }
     return row;
@@ -43775,13 +43832,23 @@ function admissionRejected(reason, repo, pr) {
   };
 }
 async function submitQueueAdmission(pr, repo, head, read, write, options, resume = false) {
-  const unknown = (reason) => ({
+  let reenqueuedAfterEjection = false;
+  let removalEvidence;
+  const markReenqueued = (result) => reenqueuedAfterEjection ? {
+    ...result,
+    ejectedThenReenqueued: true,
+    ...removalEvidence ? { queueRemovalEvidence: removalEvidence } : {},
+    ...result.error ? { error: `re-enqueued after ejection: ${result.error}` } : {}
+  } : result;
+  const unknown = (reason) => markReenqueued({
     mergeStatus: "failed",
     retryable: false,
     outcomeUnknown: true,
-    error: `queue submission outcome unknown: ${reason}. Never hand-edit files under the mmi-cli queue-admissions receipt store (%LOCALAPPDATA%/MMI Future/mmi-cli/queue-admissions); read the queue entry with \`mmi-cli devops read pr queue ${pr} --repo ${repo} --json\` and rerun \`mmi-cli devops pr land ${pr} --repo ${repo} --json\` to reconcile read-only \u2014 no new request was sent after this uncertainty.`
+    reconcileNeeded: true,
+    ...removalEvidence ? { queueRemovalEvidence: removalEvidence } : {},
+    error: `queue submission outcome unknown: ${reason}. Never hand-edit files under the mmi-cli queue-admissions receipt store (%LOCALAPPDATA%/MMI Future/mmi-cli/queue-admissions); read the queue entry with \`mmi-cli devops read pr queue ${pr} --repo ${repo} --json\`; once the PR is verifiably OPEN at the submitted head and absent from the queue, abandon the stuck admission with \`mmi-cli devops pr land ${pr} --repo ${repo} --abandon-admission\` so a new intent needs no new head \u2014 no new request was sent after this uncertainty.`
   });
-  const rejected = (reason) => admissionRejected(reason, repo, pr);
+  const rejected = (reason) => markReenqueued(admissionRejected(reason, repo, pr));
   const reconcile = async (reason, recordEntry = false, resumingSaved = false) => {
     const maxReads = options.enqueueOnly ? 3 : 1;
     const sleep3 = options.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
@@ -43789,13 +43856,13 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       if (readAttempt) await sleep3(readAttempt * 1e3);
       try {
         const observed = await readPrMergeQueue(pr, repo, read);
-        if (observed.state === "MERGED" && observed.headRefOid === head) return { mergeStatus: "merged" };
+        if (observed.state === "MERGED" && observed.headRefOid === head) return markReenqueued({ mergeStatus: "merged" });
         if (observed.isInMergeQueue && observed.headRefOid === head) {
           const entry = observed.mergeQueueEntry;
           if (recordEntry && receipt?.head === head && entry?.headCommit && entry.enqueuedAt) {
             journal.save("enqueued", receipt?.uuid, { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt });
           }
-          return { mergeStatus: "auto-merge-enqueued" };
+          return markReenqueued({ mergeStatus: "auto-merge-enqueued" });
         }
         const saved = recordEntry ? admissionJournal(repo, pr, options.receiptDirectory).receipt : void 0;
         const boundMs = saved?.queueEntry ? Date.parse(saved.queueEntry.enqueuedAt) : resumingSaved && saved?.state === "enqueued" && saved.queueWitnessed === void 0 ? saved.observedAt : void 0;
@@ -43827,11 +43894,37 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
   let receipt = journal.receipt;
   let response;
   let superseded = false;
-  if (receipt && (receipt.state === "enqueued" || receipt.state === "merged") && receipt.head.toLowerCase() !== head.toLowerCase()) {
-    try {
-      const observed = await readPrMergeQueue(pr, repo, read);
-      superseded = observed.state === "OPEN" && !observed.isInMergeQueue;
-    } catch {
+  if (receipt && (receipt.state === "enqueued" || receipt.state === "merged")) {
+    if (receipt.head.toLowerCase() !== head.toLowerCase()) {
+      try {
+        const observed = await readPrMergeQueue(pr, repo, read);
+        superseded = observed.state === "OPEN" && !observed.isInMergeQueue;
+      } catch {
+      }
+    } else {
+      try {
+        const observed = await readPrMergeQueue(pr, repo, read);
+        if (observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid?.toLowerCase() === receipt.head.toLowerCase()) {
+          const boundMs = receipt.queueEntry ? Date.parse(receipt.queueEntry.enqueuedAt) : receipt.observedAt + UNWITNESSED_EJECTION_GRACE_MS;
+          const events = await readArrayPages(
+            `repos/${repo}/issues/${pr}/timeline?per_page=100`,
+            options.timelineRead ?? read,
+            "queue ejection timeline unreadable"
+          );
+          const removals = events.filter((event) => event.event === "removed_from_merge_queue" && Number.isFinite(Date.parse(event.created_at))).map((event) => Date.parse(event.created_at)).filter((at) => at > boundMs).sort((a, b) => a - b);
+          removalEvidence = {
+            source: receipt.queueEntry ? "queue-entry" : "receipt-checkpoint",
+            boundAt: new Date(boundMs).toISOString(),
+            removalsAfterBound: removals.map((at) => new Date(at).toISOString()),
+            checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          if (removals.length > 0) {
+            reenqueuedAfterEjection = true;
+            superseded = true;
+          }
+        }
+      } catch {
+      }
     }
   }
   if (superseded && receipt?.state === "enqueued") {
@@ -43841,7 +43934,7 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       return unknown("the superseded admission could not be checkpointed");
     }
   }
-  if (receipt && receipt.state !== "failed" && receipt.state !== "ejected" && !superseded) {
+  if (receipt && receipt.state !== "failed" && receipt.state !== "ejected" && receipt.state !== "abandoned" && !superseded) {
     if (options.selection) {
       options.selection.selected = true;
       options.selection.intentId = receipt.intentId;
@@ -43987,13 +44080,13 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     if (receipt.head !== head) return reconcile("the previous head completed admission; inspect current head and membership before continuing");
     return reconcile(`operation ${receipt.uuid} reported ${status}, but matching-head membership or merged state is unconfirmed`, status === "enqueued");
   }
-  return {
+  return markReenqueued({
     mergeStatus: "queue-admission-pending",
     retryable: false,
     outcomeUnknown: true,
     queueAdmission: { state: "pending", uuid: receipt.uuid, head: receipt.head },
     error: "GitHub accepted queue admission but has not confirmed queue membership. Rerun pr land to resume the saved operation read-only."
-  };
+  });
 }
 function githubQueueSquashMessage(title, pr, commits) {
   const list = commits.map((commit) => `* ${commit.headline}
@@ -44068,13 +44161,13 @@ async function inspectQueuePreparation(pr, repo, options) {
   const parsed = parseRestClosingGuardInput({ state: pull.state, title: pull.title, body: pull.body }, commits, repo);
   parsed.closing = closing;
   const policy = { title: repository.squash_merge_commit_title, body: repository.squash_merge_commit_message };
-  const preparation = (reason, targets, detail) => ({
+  const preparation = (reason, targets, detail, nextAction) => ({
     mergeStatus: "failed",
     preparation: {
       status: "preparation-needed",
       reason,
       issueTargets: targets.map((number) => `${repo}#${number}`),
-      nextAction: reason === "queue-message" ? `PR author: if PR #${pr} is meant to close ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"}, add ${targets.length ? targets.map((number) => `\`Closes #${number}\``).join(", ") : "`Closes #N`"} to the PR body (\`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) and rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\` without pushing a new head; if ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"} must stay open, remove the closing phrases from the source commit or PR text using ${targets.length ? targets.map((number) => `\`Part of #${number}\``).join(", ") : "`Part of #N`"} / ${targets.length ? targets.map((number) => `\`Refs #${number}\``).join(", ") : "`Refs #N`"}, then re-run checks and \`pr land\` with the prepared head. A queue cannot accept --squash-body-file.` : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged."
+      nextAction: nextAction ?? (reason === "queue-message" ? `PR author: if PR #${pr} is meant to close ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"}, add ${targets.length ? targets.map((number) => `\`Closes #${number}\``).join(", ") : "`Closes #N`"} to the PR body (\`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) and rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\` without pushing a new head; if ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"} must stay open, remove the closing phrases from the source commit or PR text using ${targets.length ? targets.map((number) => `\`Part of #${number}\``).join(", ") : "`Part of #N`"} / ${targets.length ? targets.map((number) => `\`Refs #${number}\``).join(", ") : "`Refs #N`"}, then re-run checks and \`pr land\` with the prepared head. A queue cannot accept --squash-body-file.` : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged.")
     },
     error: `queue preparation needed: ${detail}`
   });
@@ -44157,7 +44250,17 @@ ${pull.body}`;
         }
       };
     }
-    return { kind: "refused", result: preparation("queue-message-override", [], "the requested sanitized body or trailer arrangement cannot be sent to queue admission") };
+    const trailerKeys = (message2) => {
+      const keys = [...new Set(parseTrailers(message2.trim(), process.cwd()).map((trailer) => trailer.split(":")[0].trim()))];
+      return keys.length ? keys.join(", ") : "none";
+    };
+    const source = options.bodyText != null ? "the explicit body override" : "the body composed from the source commit messages";
+    const detail = `the requested sanitized body or trailer arrangement cannot be sent to queue admission: queue merge method ${method}, squash body policy ${policy.body ?? "unknown"}; required body is ${source} (trailer keys: ${trailerKeys(`${headline}
+
+${requiredBody}`)}), but the message the queue would send carries trailer keys: ${trailerKeys(actualMessage)}`;
+    const next = options.bodyText != null ? `PR author: a merge queue accepts no body override; drop --body/--squash-body-file and place the required trailer(s) where the queue's ${method}${method === "SQUASH" ? ` (${policy.body})` : ""} message reads them, then rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.` : method !== "SQUASH" ? `PR author: the queue's ${method} method keeps the original commit messages, so the required trailer(s) must sit in a source commit message's final trailer block; amend the commit, push, re-run checks and \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.` : policy.body === "BLANK" ? `PR author: squash body policy BLANK sends an empty body, so no trailer from the commits or PR body reaches the queue commit; the waiver cannot survive queue admission with unchanged repository settings \u2014 remove the need for the override or ask a maintainer. Keep repository settings unchanged.` : `PR author: squash body policy ${policy.body} does not reproduce the composed body; consolidate the required trailer(s) into one source commit message's final trailer block, push, re-run checks and \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.`;
+    const caveat = " GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy; the combined queue candidate must pass with the shared trailer reader.";
+    return { kind: "refused", result: preparation("queue-message-override", [], detail, next + caveat) };
   }
   return { kind: "ready", head, pull, read, queueRead, write, ...verdict.message ? { warning: verdict.message } : {} };
 }
@@ -44188,6 +44291,38 @@ async function enqueuePrMergeQueue(pr, repo, options = {}) {
   const result = await submitQueueAdmission(pr, repo, head, queueRead, write, { ...options, timelineRead: read, selection });
   return { ...stamp(result, selection.selected, selection.intentId), ...inspected.warning ? { warning: inspected.warning } : {} };
 }
+async function abandonQueueAdmission(pr, repo, options = {}) {
+  if (!/^\d+$/.test(pr)) return { status: "refused", repo, pr, reason: "a bare PR number is required" };
+  const refuse = (reason) => ({ status: "refused", repo, pr, reason });
+  let journal;
+  try {
+    journal = admissionJournal(repo, pr, options.receiptDirectory);
+  } catch (error) {
+    return refuse(`the durable admission receipt cannot be read (${error.message})`);
+  }
+  const receipt = journal.receipt;
+  if (!receipt) return refuse("no queue-admission receipt exists for this PR; nothing to abandon");
+  if (!["pending", "enqueued"].includes(receipt.state)) {
+    return refuse(`the saved admission is '${receipt.state}', not a stuck non-terminal 'pending'/'enqueued' receipt; nothing to abandon`);
+  }
+  let snapshot;
+  try {
+    snapshot = await readPrMergeQueue(pr, repo, options.read ?? actorReadApi);
+  } catch (error) {
+    return refuse(`the PR and queue state could not be read (${error.message}); the admission is unchanged`);
+  }
+  if (snapshot.state !== "OPEN") return refuse(`the PR is '${snapshot.state}', not OPEN; the admission is unchanged`);
+  if (!snapshot.headRefOid || snapshot.headRefOid.toLowerCase() !== receipt.head.toLowerCase()) {
+    return refuse(`the PR head is ${snapshot.headRefOid ?? "unreadable"}, not the receipt's submitted head ${receipt.head}; the admission is unchanged`);
+  }
+  if (snapshot.isInMergeQueue) return refuse("the PR is currently in the merge queue, so the admission is not stuck; the admission is unchanged");
+  try {
+    journal.save("abandoned");
+  } catch (error) {
+    return refuse(`the abandoned state could not be checkpointed (${error.message}); the admission is unchanged`);
+  }
+  return { status: "abandoned", repo, pr, head: receipt.head, ...receipt.uuid ? { operation: receipt.uuid } : {} };
+}
 function closingGuardDiagnostic(message2) {
   if (!message2) return "";
   const remedy = message2.search(/GitHub's merge queue composes|If this PR is meant to close/);
@@ -46100,7 +46235,7 @@ function refuseNotClaimable(e, json) {
   process.exitCode = 1;
   return true;
 }
-var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n\nA zero-byte or empty .jerv/tmp/*.json means the read FAILED \u2014 `Unexpected end of JSON input` is\nthe symptom of shell-redirected empty stdout, not malformed JSON \u2014 re-run with --out (which writes\nthe file only on success) and check the exit code before parsing.\n\nChanging an existing item's Status is a move, never a hand-written `gh api graphql`\n`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status\nfield-id lookup:\n  mmi-cli oracle board move <status> <ref>\n";
+var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nNever sniff the envelope \u2014 `j.items ?? j.rows ?? j`, `Object.values(j)` or any generic \"find the list\"\nwrapper throws `items is not iterable` before any row is read (#9956). For a number|status|claim|title\nprojection across non-Done rows, read --json --flat --out .jerv/tmp/board.json and filter that array locally:\n  mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n\nA zero-byte or empty .jerv/tmp/*.json means the read FAILED \u2014 `Unexpected end of JSON input` is\nthe symptom of shell-redirected empty stdout, not malformed JSON \u2014 re-run with --out (which writes\nthe file only on success) and check the exit code before parsing.\n\nChanging an existing item's Status is a move, never a hand-written `gh api graphql`\n`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status\nfield-id lookup:\n  mmi-cli oracle board move <status> <ref>\n";
 function flattenBoardReport(report) {
   const closingByRef = /* @__PURE__ */ new Map();
   for (const pull of report.pullRequests ?? []) {
@@ -46223,9 +46358,41 @@ function registerBoardCommands(program3) {
     }
   });
   withExamples(mutating(
-    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs); the board scan rides the Hub snapshot, same as board read").addHelpText("after", "\nclaim reads the board through the same Hub snapshot leg as `board read` (the App-installation\ncredential, never your personal GraphQL pool); the direct user-auth read is an emergency fallback\nand is named in a Warning line after the verdict (#6162).\n\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n\nreclaim from In Review (#6339): an In Review item with no holder, or one held by the claiming\nlogin, is claimable \u2014 it moves back to In Progress and the receipt names the status it came from.\nAn In Review item another login holds is refused (ask the holder, or wait for the review to land),\nand Done stays refused. The board status is the authority; no PR state is consulted.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
+    board.command("claim [issues...]").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs, or --all for the whole board); the board scan rides the Hub snapshot, same as board read").addHelpText("after", "\nclaim reads the board through the same Hub snapshot leg as `board read` (the App-installation\ncredential, never your personal GraphQL pool); the direct user-auth read is an emergency fallback\nand is named in a Warning line after the verdict (#6162).\n\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n\nreclaim from In Review (#6339): an In Review item with no holder, or one held by the claiming\nlogin, is claimable \u2014 it moves back to In Progress and the receipt names the status it came from.\nAn In Review item another login holds is refused (ask the holder, or wait for the review to land),\nand Done stays refused. The board status is the authority; no PR state is consulted.\n\nwhole board (#9930): --all reads the board once and claims every open item of this repo's primary\nboard that the per-ref claim may take (yours, unassigned Todo, unowned In Progress), carrying each\nitem's branch/worktree lane evidence forward like a per-ref claim. It prints one line per item, then\nthe refs it skipped and why (assigned to another login, In Review, closed, not an issue). Without\n--force a live foreign lane is skipped with its reason, never stolen; --force takes it as the\nper-ref --force would. --all with explicit refs is an error.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--all", "claim every open claimable item on the current repo's board in one pass (combine with --force/--repo; not with explicit refs) (#9930)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "oracle board claim", issues: args[0] ?? [] })
-  ).action(async (issueRefs, o) => {
+  ).action(async (issueRefs = [], o) => {
+    const argsError = claimArgsError(issueRefs, o.all);
+    if (argsError) return failGraceful(`oracle board claim failed: ${argsError}`);
+    if (o.all) {
+      try {
+        const config = await loadConfigForBoardSelector2("", o.repo);
+        const all = await claimAllBoardIssues({
+          config,
+          repo: o.repo,
+          assignee: o.for,
+          force: o.force,
+          check: o.check,
+          allowPartial: o.allowPartial
+        }, { snapshot: registryClientDeps(config) });
+        if (o.json) {
+          console.log(JSON.stringify({ results: all.results, skipped: all.skipped }));
+          printClaimWarnings(all.warnings, true);
+        } else {
+          for (const result of all.results) {
+            console.log(result.claimed ? claimVerdict(result.ref, result) : `Skipped ${result.ref}: ${result.reason}`);
+          }
+          for (const skip of all.skipped) console.log(`Skipped ${skip.ref}: ${skip.reason}`);
+          const landed = all.results.filter((r) => r.claimed).length;
+          console.log(`claim --all: ${landed} of ${all.results.length} attempted item(s) claimed; ${all.skipped.length} not attempted`);
+          printClaimWarnings(all.warnings);
+        }
+        if (all.failed > 0) process.exitCode = 1;
+      } catch (e) {
+        if (refuseRateLimited(e, o.json)) return;
+        return failGraceful(`oracle board claim failed: ${e.message}`);
+      }
+      return;
+    }
     if (issueRefs.length === 1) {
       const issueRef = issueRefs[0];
       try {
@@ -46284,11 +46451,13 @@ function registerBoardCommands(program3) {
   }), [
     "mmi-cli oracle board claim 2680",
     "mmi-cli oracle board claim 2680 2681 --for teammate-login",
-    "mmi-cli oracle board claim 2680 --check"
+    "mmi-cli oracle board claim 2680 --check",
+    "mmi-cli oracle board claim --all --force"
   ], [
     "Pass raw issue numbers/refs, not URLs.",
     "Claim already assigns and moves Status to In Progress, so do not also board move it.",
     "Multiple refs are handled as a batch and return per-item results.",
+    "To claim the whole board, use --all (with --force to take live lanes) instead of a hand-built ref list.",
     "--check is the live gate read (it calls GitHub); --dry-run only echoes the parsed argv plan.",
     // #5552: agents guess `oracle issue claim`; that route does not exist — board claim is the only write.
     "Never run `oracle issue claim` \u2014 claims are board mutations; only `oracle board claim <ref>` is valid.",
@@ -60798,23 +60967,53 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/pr-create-preparation.ts
+function rejectionReason(error) {
+  const text = (error instanceof Error ? error.message : String(error)).trim().split("\n")[0] || "no error detail";
+  return text.length > 300 ? `${text.slice(0, 300)}\u2026` : text;
+}
+var PERMISSION_REFUSAL = /Resource not accessible|HTTP 40[13]|40[13] (?:Forbidden|Unauthorized)|Bad credentials|must have admin rights|insufficient (?:permissions?|scope)|not authorized/i;
+async function observePolicy(deps, candidate) {
+  if (!candidate) return void 0;
+  try {
+    return await deps.policy(candidate);
+  } catch (error) {
+    const refusal = rejectionReason(error);
+    if (!PERMISSION_REFUSAL.test(refusal)) throw error;
+    await deps.fetchCandidate?.(candidate).catch(() => void 0);
+    let retried;
+    try {
+      retried = await deps.policy(candidate);
+    } catch (retryError) {
+      const second = rejectionReason(retryError);
+      if (!PERMISSION_REFUSAL.test(second)) throw retryError;
+      return {
+        check: "policy",
+        state: "skipped",
+        detail: `committed test policy was not observed: GitHub refused the policy read twice (${second}) \u2014 the identity running pr create lacks the permission that observation needs, repository Administration: read, which covers rulesets and the merge-queue configuration; grant it to the App installation (APP_POLL_PERMISSIONS or the installed App's permissions on ${candidate.repo}) or run with an owner GH_TOKEN. This is an unreadable guard, NOT a policy violation.`
+      };
+    }
+    process.stderr.write(`pr create: WARNING \u2014 the committed test-policy read was refused (${refusal}); re-fetched the candidate objects and retried it once (#9946)
+`);
+    return retried;
+  }
+}
 async function preparePrCreate(input, deps = createPreparationDeps(input)) {
   const observations = [];
-  const refs = await deps.candidate().catch(() => ({ findings: ["candidate refs unavailable; verify the repository and pushed head/base before retrying"] }));
+  const refs = await deps.candidate().catch((error) => ({ findings: [`candidate refs unavailable (${rejectionReason(error)}); verify the repository and pushed head/base before retrying`] }));
   observations.push(...refs.findings.map((detail) => ({ check: "refs", state: "unavailable", detail })));
   if (refs.candidate) observations.push({ check: "refs", state: "passed", detail: `candidate ${refs.candidate.headSha} against ${refs.candidate.baseSha}` });
   const reads = await Promise.allSettled([
     deps.claims(refs.candidate),
     refs.candidate ? deps.docs(refs.candidate) : Promise.resolve(void 0),
-    refs.candidate ? deps.policy(refs.candidate) : Promise.resolve(void 0)
+    observePolicy(deps, refs.candidate)
   ]);
   const [claims, docs, policy] = reads;
   if (claims.status === "fulfilled") {
     observations.push(...claims.value.findings.length ? claims.value.findings.map((detail) => ({ check: "claims", state: "failed", detail })) : [{ check: "claims", state: "passed", detail: "issue and claim evidence read" }]);
-  } else observations.push({ check: "claims", state: "unavailable", detail: "issue/claim evidence unavailable; retry the read" });
-  if (docs.status === "rejected") observations.push({ check: "docs", state: "unavailable", detail: "committed docs observation unavailable; retry the read" });
+  } else observations.push({ check: "claims", state: "unavailable", detail: `issue/claim evidence unavailable (${rejectionReason(claims.reason)}); retry the read` });
+  if (docs.status === "rejected") observations.push({ check: "docs", state: "unavailable", detail: `committed docs observation unavailable (${rejectionReason(docs.reason)}); retry the read` });
   else if (docs.value) observations.push({ check: "docs", state: docs.value.state, detail: [docs.value.detail, docs.value.fix].filter(Boolean).join(" \u2014 ") });
-  if (policy.status === "rejected") observations.push({ check: "policy", state: "unavailable", detail: "committed test-policy observation unavailable; check policy validity and fetch full candidate history before retrying" });
+  if (policy.status === "rejected") observations.push({ check: "policy", state: "unavailable", detail: `committed test-policy observation unavailable (${rejectionReason(policy.reason)}); check policy validity and fetch full candidate history before retrying` });
   else if (policy.value) observations.push(policy.value);
   const findings = observations.filter((item) => item.state === "failed" || item.state === "unavailable");
   let attempted = false;
@@ -60843,7 +61042,7 @@ async function preparePrCreate(input, deps = createPreparationDeps(input)) {
       await claims.value.restamp();
       const beforeCreate = await deps.candidate();
       if (beforeCreate.findings.length || JSON.stringify(beforeCreate.candidate) !== JSON.stringify(expected)) {
-        throw new Error("pr create: candidate changed while restamping claims; prepare again before creating the PR");
+        throw new Error("pr create: candidate identity changed during preparation while restamping claims; prepare the current head and base again");
       }
     }
   };
@@ -60916,6 +61115,15 @@ function createPreparationDeps(input, io = {}) {
   return {
     candidate: readCandidate,
     publish: (proof) => publishPreparedPrHead(proof, exec3),
+    // #9946: the retry needs the exact candidate objects. Fetch each ref on its own so a fork-only head
+    // that origin cannot resolve never costs the base fetch too, and never surface a fetch failure as the
+    // reason the policy read stayed unreadable.
+    fetchCandidate: async (candidate) => {
+      if (!candidate.root) return;
+      const branch = (name) => name.slice(name.lastIndexOf(":") + 1);
+      const refspecs = [.../* @__PURE__ */ new Set([candidate.head, candidate.base])].map((name) => `+refs/heads/${branch(name)}:refs/remotes/origin/${branch(name)}`);
+      await Promise.allSettled(refspecs.map((refspec) => exec3("git", ["-C", candidate.root, "fetch", "--no-tags", "origin", refspec], { timeout: GIT_TIMEOUT_MS })));
+    },
     claims: (candidate) => observePrCreateClaims(input.body, candidate?.repo ?? input.repo, { head: candidate?.head, headSha: candidate?.headSha }),
     docs: (candidate) => checkDocsIndexAtHead({ repo: candidate.repo, head: candidate.headSha }, docs),
     policy: async (candidate) => {
@@ -60946,7 +61154,12 @@ function createPreparationDeps(input, io = {}) {
           return result("failed", `${refusal.error} \u2014 ${refusal.preparation.nextAction}`);
         }
       }
-      const policy = runTestPolicy(candidate.root, { candidate: { head: candidate.headSha, base: candidate.baseSha } });
+      let policy;
+      try {
+        policy = runTestPolicy(candidate.root, { candidate: { head: candidate.headSha, base: candidate.baseSha } });
+      } catch (error) {
+        return result("unavailable", `committed test policy could not be evaluated: ${rejectionReason(error)} \u2014 fix test-policy.json if it is malformed, or run \`git fetch --unshallow\` if a history read failed`);
+      }
       return result(policy.ok ? "passed" : "failed", policy.ok ? `committed test policy passed at ${candidate.headSha}` : policy.findings.map((finding) => finding.detail).join("\n"));
     }
   };
@@ -62566,6 +62779,46 @@ var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
 function canonicalWorktreeRoot(primary) {
   return (0, import_node_path49.join)((0, import_node_path49.dirname)(primary), "mmi-worktrees", (0, import_node_path49.basename)(primary));
 }
+function lastSegment(p) {
+  return (0, import_node_path49.basename)(p.split(/[\\/]+/).filter(Boolean).pop() ?? p);
+}
+function readProvenance(folder, gitCommonDir, exists) {
+  const found = {
+    path: folder,
+    gitdirPresent: false,
+    registrationId: (0, import_node_path49.basename)(folder),
+    registrationPresent: false
+  };
+  try {
+    const pointer = /^\s*gitdir:\s*(.+?)\s*$/m.exec((0, import_node_fs53.readFileSync)((0, import_node_path49.join)(folder, ".git"), "utf8"));
+    if (pointer) {
+      const target = pointer[1];
+      found.gitdir = (0, import_node_path49.isAbsolute)(target) ? target : (0, import_node_path49.join)(folder, target);
+      found.gitdirPresent = exists(found.gitdir);
+      found.registrationId = lastSegment(found.gitdir);
+    }
+  } catch {
+  }
+  try {
+    found.registrationPresent = exists((0, import_node_path49.join)(gitCommonDir, "worktrees", found.registrationId));
+  } catch {
+  }
+  if (found.gitdir && found.gitdirPresent) {
+    try {
+      const head = (0, import_node_fs53.readFileSync)((0, import_node_path49.join)(found.gitdir, "HEAD"), "utf8").trim();
+      const branch = /^ref:\s*(.+?)\s*$/.exec(head);
+      if (branch) found.head = branch[1].startsWith("refs/heads/") ? branch[1].slice("refs/heads/".length) : `ref ${branch[1]}`;
+      else if (/^[0-9a-f]{7,64}$/i.test(head)) found.head = `detached ${head.slice(0, 12)}`;
+      else if (head) found.head = `ref ${head}`;
+    } catch {
+    }
+  }
+  try {
+    found.mtime = (0, import_node_fs53.statSync)(folder).mtime.toISOString();
+  } catch {
+  }
+  return found;
+}
 function norm2(p) {
   const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? s.toLowerCase() : s;
@@ -62660,7 +62913,7 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
         } catch {
         }
       } else {
-        report.unrecorded.push(child2);
+        report.unrecorded.push(readProvenance(child2, gitCommonDir, exists));
       }
     }
   }
@@ -62674,12 +62927,19 @@ function renderResidueSweepLines(report) {
   if (cleaned) lines2.push(`pr merge: removed ${cleaned} leftover worktree folder(s) from earlier merges${where}`);
   for (const k of report.kept) lines2.push(`pr merge: leftover folder still locked, retried on the next merge \u2014 ${k.path}`);
   if (report.unrecorded.length) {
-    const shown = report.unrecorded.slice(0, 5).join(", ");
+    const listed = report.unrecorded.slice(0, 5);
     const more = report.unrecorded.length > 5 ? `, \u2026 ${report.unrecorded.length - 5} more` : "";
-    lines2.push(`pr merge: ${report.unrecorded.length} unregistered folder(s) with content under the worktree root${where} were left untouched (not recorded by a merge): ${shown}${more}`);
+    lines2.push(`pr merge: ${report.unrecorded.length} unregistered folder(s) with content under the worktree root${where} were left untouched (not recorded by a merge): ${listed.map((u) => u.path).join(", ")}${more}`);
+    for (const u of listed) lines2.push(`pr merge:   left untouched ${u.path} \u2014 ${provenanceText(u)}`);
   }
   return lines2;
 }
+function provenanceText(u) {
+  const pointer = u.gitdir ? `.git \u2192 ${u.gitdir}${u.gitdirPresent ? "" : " (admin dir gone)"}` : ".git pointer missing";
+  const registration = `worktrees/${u.registrationId} ${u.registrationPresent ? "registered" : "not registered"}`;
+  const head = u.head ? `HEAD ${u.head}` : "HEAD unknown";
+  return `${pointer}; ${registration}; ${head}; ${u.mtime ? `modified ${u.mtime}` : "mtime unknown"}`;
+}
 
 // src/command-register-collaboration.ts
 var DEFAULT_PRIORITY = "medium";
@@ -63829,9 +64089,19 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
   }
   class PrHeadBehindBaseError extends Error {
   }
-  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "silence the leftover-scratch warning (scratch never blocks, #8785) and acknowledge a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 per-repo ruleset check_response_timeout_minutes is 15 default with 30/45/60 overrides in .github/rulesets/mmi-development-merge-queue.json; agents never edit the ruleset to shorten a queue wait)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
+  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--abandon-admission", "one stuck-receipt recovery, one PR per call: journal the saved non-terminal (pending/enqueued) queue-admission receipt terminal ONLY after positively observing the PR OPEN at the receipt head and absent from the queue; any unprovable observation refuses and changes nothing (#9951). The next pr land then submits a new intent with no new head").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "silence the leftover-scratch warning (scratch never blocks, #8785) and acknowledge a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 per-repo ruleset check_response_timeout_minutes is 15 default with 30/45/60 overrides in .github/rulesets/mmi-development-merge-queue.json; agents never edit the ruleset to shorten a queue wait)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
     const timeoutMinutes = opts.timeout === void 0 ? void 0 : Number(opts.timeout);
     if (timeoutMinutes !== void 0 && !(timeoutMinutes > 0)) return fail("pr land: --timeout must be a positive number of minutes");
+    if (opts.abandonAdmission) {
+      if (numbers.length !== 1) return fail("pr land: --abandon-admission abandons one PR per call");
+      const repo = await resolveRepo(opts.repo).catch(() => void 0) ?? opts.repo;
+      if (!repo) return fail("pr land: --abandon-admission needs --repo <owner/repo>; the PR repo could not be resolved");
+      const outcome = await abandonQueueAdmission(numbers[0], repo);
+      if (opts.json) printLine(JSON.stringify(outcome));
+      else printLine(outcome.status === "abandoned" ? `pr land: abandoned the stuck queue admission of PR #${outcome.pr} on ${repo}${outcome.operation ? ` (operation ${outcome.operation})` : ""} at head ${outcome.head} \u2014 the next pr land submits a new intent with no new head` : `pr land: refused to abandon the queue admission of PR #${outcome.pr} on ${repo} \u2014 ${outcome.reason}`);
+      if (outcome.status !== "abandoned") process.exitCode = 1;
+      return;
+    }
     if (opts.expectHead !== void 0) {
       if (!/^[0-9a-f]{40}$/i.test(opts.expectHead)) return fail("pr land: --expect-head needs the full 40-hex head SHA");
       if (numbers.length !== 1) return fail("pr land: --expect-head pins one PR head; land one PR per call");
@@ -64976,9 +65246,13 @@ function projectInfoOutcome(projectInfoSync) {
 }
 function buildReleaseVerdict(commandName, result, projectInfoSync) {
   const alignmentPending = result.devRollForward?.status === "pr-pending" || result.rcAlignment?.status === "pr-pending";
+  const deployOutcome = reduceFollowUpOutcomes([
+    deployFollowUpOutcome(result.deployStatus),
+    deployFollowUpOutcome(aggregateWorkflowRuns(result.workflowRuns ?? []))
+  ]);
   const followUpStatus = deriveTrainFollowUpStatus({
     projectInfo: projectInfoOutcome(projectInfoSync),
-    deploy: deployFollowUpOutcome(result.deployStatus),
+    deploy: deployOutcome,
     rcRetirement: result.rcRetirement === "failed" ? result.rcRetirementCategory === "wait-timeout" ? "unresolved" : "failure" : "ok",
     alignment: alignmentPending ? "unresolved" : "ok",
     foldPort: "ok"
@@ -64998,9 +65272,14 @@ function buildReleaseVerdict(commandName, result, projectInfoSync) {
 }
 function buildResumeReleaseVerdict(result, projectInfoSync) {
   const resumeStatus = resumeFollowUpOf(result.state);
+  const deployOutcome = reduceFollowUpOutcomes([
+    // No dispatch (e.g. an alignment-only resume) keeps the old 'ok' deploy dimension.
+    deployFollowUpOutcome(result.dispatch?.deployStatus ?? "success"),
+    deployFollowUpOutcome(aggregateWorkflowRuns(result.dispatch?.workflowRuns ?? []))
+  ]);
   const followUpStatus = deriveTrainFollowUpStatus({
     projectInfo: projectInfoOutcome(projectInfoSync),
-    deploy: "ok",
+    deploy: deployOutcome,
     rcRetirement: "ok",
     alignment: resumeStatus === "failed" ? "failure" : resumeStatus === "pending" ? "unresolved" : "ok",
     foldPort: "ok"
@@ -71440,6 +71719,54 @@ function renderTenantLogs(r) {
   return out.join("\n");
 }
 
+// src/tenant-status-wait.ts
+var TENANT_STATUS_WAIT_INTERVAL_MS = 12e3;
+var TENANT_STATUS_WAIT_TIMEOUT_DEFAULT_S = 660;
+var TENANT_STATUS_WAIT_TIMEOUT_MAX_S = 1800;
+var TENANT_STATUS_WAIT_MIN_SHA_LENGTH = 7;
+function parseWaitForSha(raw) {
+  const sha = raw.trim().toLowerCase();
+  if (!new RegExp(`^[0-9a-f]{${TENANT_STATUS_WAIT_MIN_SHA_LENGTH},40}$`).test(sha)) {
+    return { ok: false, reason: `--wait-for must be a commit SHA (${TENANT_STATUS_WAIT_MIN_SHA_LENGTH}-40 hex characters), got "${raw.trim()}"` };
+  }
+  return { ok: true, sha };
+}
+function parseWaitTimeoutSeconds(raw) {
+  if (raw === void 0) return { ok: true, seconds: TENANT_STATUS_WAIT_TIMEOUT_DEFAULT_S, clamped: false };
+  const seconds = Number(raw.trim());
+  if (!Number.isInteger(seconds) || seconds <= 0) {
+    return { ok: false, reason: `--timeout must be a positive whole number of seconds, got "${raw.trim()}"` };
+  }
+  if (seconds > TENANT_STATUS_WAIT_TIMEOUT_MAX_S) return { ok: true, seconds: TENANT_STATUS_WAIT_TIMEOUT_MAX_S, clamped: true };
+  return { ok: true, seconds, clamped: false };
+}
+function deployedTagReaches(tag, sha) {
+  const stamped = (tag ?? "").trim().toLowerCase();
+  const needle = sha.trim().toLowerCase();
+  if (!stamped || !needle) return false;
+  if (stamped === needle) return true;
+  const [shorter, longer] = stamped.length <= needle.length ? [stamped, needle] : [needle, stamped];
+  return shorter.length >= TENANT_STATUS_WAIT_MIN_SHA_LENGTH && longer.startsWith(shorter);
+}
+async function waitForDeployedTag(deps) {
+  const intervalMs = deps.intervalMs ?? TENANT_STATUS_WAIT_INTERVAL_MS;
+  const now = deps.now ?? Date.now;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const startedAt = now();
+  const deadline = startedAt + deps.timeoutMs;
+  let polls = 0;
+  for (; ; ) {
+    const status = await deps.readStatus();
+    polls += 1;
+    if (deployedTagReaches(deps.deployedTagOf(status), deps.sha)) {
+      return { matched: true, status, polls, elapsedMs: now() - startedAt };
+    }
+    const remaining = deadline - now();
+    if (remaining <= 0) return { matched: false, status, polls, elapsedMs: now() - startedAt };
+    await sleep2(Math.min(intervalMs, remaining));
+  }
+}
+
 // src/tenant-sweep.ts
 function isRcBearingTenant(p) {
   if ((p.deployModel ?? "") !== "tenant-container") return false;
@@ -73498,12 +73825,33 @@ tenant.command("reconcile <owner/repo> <stage>").description("re-render this ten
     return failGraceful(`runtime tenant reconcile: ${e.message}`);
   }
 });
-tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints; a root answering 401/403/404 is re-probed at /health and the `url` field names the endpoint that answered (#6137)").action(async (repo, stage) => {
+tenant.command("status <owner/repo> <stage>").description("read tenant runtime readiness without dispatching tenant-control: DEPLOY row, last deploy run, public URL probe, and TLS/Caddy/Cloudflare hints; a root answering 401/403/404 is re-probed at /health and the `url` field names the endpoint that answered (#6137); `--wait-for <sha>` polls the same read to a deadline (#9942)").option("--wait-for <sha>", "poll until DEPLOY#<stage> deployedTag reaches this commit SHA (7-40 hex, short form ok), then print the final status and exit 0; exits 1 on timeout \u2014 use this instead of a shell sleep loop (#9942)").option("--timeout <secs>", `with --wait-for: give up after this many seconds (default ${TENANT_STATUS_WAIT_TIMEOUT_DEFAULT_S}, max ${TENANT_STATUS_WAIT_TIMEOUT_MAX_S}, polled every ${TENANT_STATUS_WAIT_INTERVAL_MS / 1e3}s)`).action(async (repo, stage, o) => {
   if (!["dev", "rc", "main"].includes(stage)) return fail("runtime tenant status: <stage> must be dev, rc, or main");
+  let wait;
+  if (o.waitFor !== void 0) {
+    const sha = parseWaitForSha(o.waitFor);
+    if (!sha.ok) return fail(`runtime tenant status: ${sha.reason}`);
+    const timeout = parseWaitTimeoutSeconds(o.timeout);
+    if (!timeout.ok) return fail(`runtime tenant status: ${timeout.reason}`);
+    wait = { sha: sha.sha, seconds: timeout.seconds, clamped: timeout.clamped };
+  } else if (o.timeout !== void 0) {
+    return fail("runtime tenant status: --timeout only applies with --wait-for <sha>");
+  }
   const cfg = await loadConfig();
-  const result = await buildTenantRuntimeStatusFor(repo, stage, cfg);
+  const readStatus = () => buildTenantRuntimeStatusFor(repo, stage, cfg);
+  let result;
+  let waitMatched;
+  if (!wait) result = await readStatus();
+  else {
+    console.error(`runtime tenant status: waiting up to ${wait.seconds}s for ${repo} ${stage} deployedTag to reach ${wait.sha}${wait.clamped ? ` (--timeout clamped to the ${TENANT_STATUS_WAIT_TIMEOUT_MAX_S}s max)` : ""}`);
+    const waited = await waitForDeployedTag({ sha: wait.sha, timeoutMs: wait.seconds * 1e3, readStatus, deployedTagOf: (status) => status.deploy?.deployedTag });
+    result = waited.status;
+    waitMatched = waited.matched;
+    if (!waited.matched) console.error(`runtime tenant status: timed out after ${Math.round(waited.elapsedMs / 1e3)}s (limit ${wait.seconds}s, ${waited.polls} read(s)); deployedTag is ${waited.status.deploy?.deployedTag ?? "unset"}, not ${wait.sha}`);
+  }
   console.log(JSON.stringify(result, null, 2));
-  if (result.publicProbe?.ok === false || result.edgeCertificate?.missing) process.exitCode = 1;
+  if (waitMatched !== void 0) process.exitCode = waitMatched ? 0 : 1;
+  else if (result.publicProbe?.ok === false || result.edgeCertificate?.missing) process.exitCode = 1;
 });
 tenant.command("logs <owner/repo> <stage>").description("READ-ONLY: read a tenant stage's application journal (journald, so a deploy-recreated container still answers) \u2014 the unit namespace comes from the tenant's DEPLOY coords and the blue/green slot is chosen on the box, never from a flag; bounded and redacted (#9230)").option("--tail <n>", `lines to return (1-${TENANT_LOG_TAIL_MAX}, default ${TENANT_LOG_TAIL_DEFAULT}); the applied bound is printed`).option("--since <window>", "window start: a relative window like 15m, 6h or 2d, or a UTC time like 2026-10-07T13:10Z (default 1h)").option("--until <time>", "window end: same forms as --since (default: now) \u2014 the box returns the newest N lines OF the window, so end it earlier to reach older lines on a busy tenant (#9878)").option("--grep <needle>", "keep only returned lines containing this literal text (applied to the bounded tail, not the whole journal)").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   try {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.30",
+  "version": "4.6.32",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.30",
+  "version": "4.6.32",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -13,17 +13,23 @@ permission to take anything.
 
 ```bash
 mkdir -p .jerv/tmp
-mmi-cli oracle board read --json --out .jerv/tmp/board.json
+mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json
 ```
 
-One call; the JSON carries `viewer`, `repo` and the project title. Use `primary` for this repo and
-`secondary` for other repos on the Project. Without `--flat`, `board read --json` returns an object
+One call; `--flat` gives one array of rows to iterate. A routine read already excludes Done and closed
+items, so no status post-filter is needed. The detailed form (`--json` without `--flat`) carries `viewer`,
+`repo` and the project title; use its `primary` for this repo and `secondary` for other repos on the
+Project. Without `--flat`, `board read --json` returns an object
 `{project, viewer, repo, primary, secondary, warnings, partial}` whose `primary` and `secondary` are bucket
 objects `{userOwned, claimable, taken, unownedInFlight}` of item arrays (no top-level `items` array), so filter
-a bucket (e.g. `report.primary.claimable`) or pass `--json --flat`, never `(j.items||j).filter`. `--flat` rows
-are `{ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}` (`claim` is the parsed mmi-claim
-evidence object, null when unclaimed; `openPullRequests` lists the OPEN PRs whose closing-issue body links name
-the item — on the full JSON object that list lives at `report.pullRequests`, never `openPullRequests`). Partial reads
+a bucket (e.g. `report.primary.claimable`) or pass `--json --flat`, never `(j.items||j).filter`. Never sniff
+for the list (`j.items ?? j.rows ?? j`, `Object.values`, any generic "find the list" wrapper): it throws
+`items is not iterable` before any row is read. For a number|status|claim|title projection across non-Done
+rows, run `mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json` and filter that array locally.
+`--flat` rows are `{ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}` (`claim` is the
+parsed mmi-claim evidence object, null when unclaimed; `openPullRequests` lists the OPEN PRs whose
+closing-issue body links name the item — on the full JSON object that list lives at `report.pullRequests`,
+never `openPullRequests`). Partial reads
 exit nonzero; `--allow-partial` only when the dev accepts an incomplete board. The CLI partitions rows into
 **Yours**, **Free to claim** and **Taken**; stale stamps (4 hours without work) hold nothing. Recovery
 moves: a zero-byte or empty `.jerv/tmp/*.json` (`Unexpected end of JSON input`) means a shell-redirected
@@ -33,7 +39,7 @@ item is `mmi-cli oracle board move <status> <ref>`, never a hand-written `gh api
 lookup. Partition rules,
 stamp details and `--out` rationale: [reference.md](reference.md).
 
-**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run list --event`/`--jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`, `run list --event <event>`, or `MMI_ACTOR=app mmi-cli devops api get "repos/<owner>/<repo>/actions/runs?event=<event>&per_page=<n>"`); `--jq '<expr>'` on that typed read filters locally. A single issue or PR item (`repos/<owner>/<repo>/issues/<n>` and `pulls/<n>`) has no `devops api get` route — `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner>/<repo> --json <fields>` (and `pr view`) is the only read. Those typed reads take **one** number per call, exactly like native gh: a second number is refused as `too many arguments`, so read several issues by repeating the typed read once per number (one `--jq` each, joined `&&`). Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `mmi-cli oracle issue edit <ref> --body-file .jerv/tmp/issue-body.md`. When `node -e` reads saved JSON, pass an absolute path or use `JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))`: `require()` of a relative path (e.g. `tmp\board.json` from `cygpath -w`) throws MODULE_NOT_FOUND.
+**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run list --event`/`--jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`, `run list --event <event>`, or `MMI_ACTOR=app mmi-cli devops api get "repos/<owner>/<repo>/actions/runs?event=<event>&per_page=<n>"`); `--jq '<expr>'` on that typed read filters locally. A single issue or PR item (`repos/<owner>/<repo>/issues/<n>` and `pulls/<n>`) has no `devops api get` route — `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner>/<repo> --json <fields>` (and `pr view`) is the only read. Those typed reads take **one** number per call, exactly like native gh: a second number is refused as `too many arguments`, so read several issues by repeating the typed read once per number (one `--jq` each, joined `&&`). Filter in a pipe or save output (`--out`, or `>`; never `2>&1` into a JSON parser) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `mmi-cli oracle issue edit <ref> --body-file .jerv/tmp/issue-body.md`. When `node -e` reads saved JSON, pass an absolute path or use `JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))`: `require()` of a relative path (e.g. `tmp\board.json` from `cygpath -w`) throws MODULE_NOT_FOUND.
 
 ## Step 2 — render it
 

package/skills/board/reference.md

@@ -15,7 +15,10 @@ the gate again.
 Prefer `--out` for a shell-independent UTF-8 receipt. Windows PowerShell 5.1's `>` writes
 UTF-16LE with a BOM (#5802); Bash redirects preserve the CLI's UTF-8 output.
 
-One call. Its JSON carries `viewer`, `repo` and the project title — do not spend extra calls on
+The canonical read is `mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json`: one array of
+rows to iterate. A routine read already excludes Done and closed items, so no status post-filter is needed.
+
+One call. The detailed form (`--json` without `--flat`) carries `viewer`, `repo` and the project title — do not spend extra calls on
 `gh api user` or `gh repo view`. Use `primary` for this repo and `secondary` for other repos on the same
 Project. Without `--flat`, `board read --json` returns an object
 `{project, viewer, repo, primary, secondary, warnings, partial}` whose `primary` and `secondary` are bucket

package/skills/bootstrap/seeds/runbook-unaffected.json

@@ -1,7 +1,7 @@
 {
   ".github/workflows/agent-pr.yml": {
-    "blob": "dff394ae296224bc1d40f2ab4953d30a89bc5a91",
-    "reason": "runs-on only: the two seconds-long guard legs moved off the busy CI pool to the reserved journey/deploy pool with a 5-minute cap (#9211); job logic, steps, permissions and operator responsibilities unchanged"
+    "blob": "e85a80c65b26531a330917fb4b5d8f563a0f0d0c",
+    "reason": "sole-write-path guard reads retry transient GitHub API 5xx/429/transport failures up to 3 attempts, then fail closed with the same messages (#9911); permissions, refs, guarded paths and operator responsibilities unchanged"
   },
   "scripts/next-version.mjs": {
     "blob": "2c1985b59edc779695479559074e7654c1574a11",

package/skills/release/SKILL.md

@@ -11,7 +11,7 @@ Bare `minor|major|patch` (default `patch`), never a flag. A production release n
 
 ## Lane
 
-Read `mmi-cli oracle org project get {owner}/{repo} --json` and name the lane ([verification.md](verification.md) Lane rules); unreadable META → stop. [suite.md](suite.md) for MM-Work; [vercel.md](vercel.md) for Vercel.
+Read `mmi-cli oracle org project get {owner}/{repo} --json` and name the lane ([verification.md](verification.md) Lane rules); unreadable META → stop. On `releaseTrack: single` (MM-Work and its modules) or `trunk` there is no release lane. On single track a merge to development auto-deploys the `main` stage, and release, rcand and hotfix refuse. A merged single-track change is live once that deploy is green. A trunk repo follows its own declared publishing workflow. Never tell the owner a landed change waits on a release. [suite.md](suite.md) for suite cuts; [vercel.md](vercel.md) for Vercel.
 
 ## Preflight
 

package/skills/release/suite.md

@@ -1,3 +1,5 @@
+MM-Work and most of its modules are `releaseTrack: single` ([work-and-releases.md](../org-guide/references/work-and-releases.md)). A merge to development auto-deploys their `main` stage, so a landed change is live once that deploy is green. Never tell the owner such a change waits on a release. Read each repo's `releaseTrack` with `mmi-cli oracle org project get <owner/repo> --json` before naming any cut. A suite cut also cuts the MM-Work lead's rcand, which refuses while MM-Work is single track.
+
 In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 
 Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.