@mutmutco/codex-plugin 4.6.5 → 4.6.6

package/cli/dist/main.cjs

@@ -526,6 +526,8 @@ __export(github_client_exports, {
   createGitHubClient: () => createGitHubClient,
   defaultGitHubClient: () => defaultGitHubClient,
   githubKeyringTokenRead: () => githubKeyringTokenRead,
+  githubPersonalToken: () => githubPersonalToken,
+  githubPersonalTokenRead: () => githubPersonalTokenRead,
   githubToken: () => githubToken,
   githubTokenRead: () => githubTokenRead,
   rateLimitResetNote: () => rateLimitResetNote,
@@ -563,6 +565,23 @@ async function githubTokenRead() {
   if (process.env.GITHUB_TOKEN) return { state: "ok", token: process.env.GITHUB_TOKEN };
   return githubKeyringTokenRead();
 }
+async function githubPersonalTokenRead() {
+  const mmiPat = process.env.MMI_GH_PAT?.trim();
+  if (mmiPat) return { state: "ok", token: mmiPat };
+  if (process.env.MMI_GH_POOL !== "app" && process.env.GH_TOKEN) return { state: "ok", token: process.env.GH_TOKEN };
+  if (process.env.GITHUB_TOKEN) return { state: "ok", token: process.env.GITHUB_TOKEN };
+  return githubKeyringTokenRead();
+}
+async function githubPersonalToken() {
+  const read = await githubPersonalTokenRead();
+  if (read.state === "failed") {
+    throw new GitHubApiError(
+      `GitHub identity read FAILED: \`gh auth token\` ${read.detail} \u2014 this is NOT "no token", so the call is refused rather than sent anonymously (an anonymous 401/404 would read as a permission or missing-object answer). Retry, or set MMI_GH_PAT/GH_TOKEN/GITHUB_TOKEN for this process.`,
+      { status: 0 }
+    );
+  }
+  return read.state === "ok" ? read.token : void 0;
+}
 async function githubToken() {
   const read = await githubTokenRead();
   if (read.state === "failed") {
@@ -1448,7 +1467,7 @@ async function githubLogin() {
 }
 async function hubHeaders(extra = {}) {
   const cfg = await loadConfig();
-  const t = await hubAuthToken({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), githubToken });
+  const t = await hubAuthToken({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), githubToken: githubPersonalToken });
   const base = { ...clientVersionHeaders(), ...extra };
   return t ? { ...base, Authorization: `Bearer ${t}` } : base;
 }
@@ -16632,9 +16651,44 @@ var RUNNER_INFRA_PRESTART_CONCLUSIONS = /* @__PURE__ */ new Set([
   "startup_failure"
 ]);
 var TEST_FAILURE_LINE = /^(?:✖|not ok\b|FAIL\b|×)|\bAssertionError\b/;
+var logLine = (raw) => raw.replace(/^\uFEFF?\d{4}-\d\d-\d\dT[\d:.]+Z\s*/, "").replace(/\x1b\[[0-9;]*m/g, "").trim();
+function failingTestIds(log) {
+  const ids = /* @__PURE__ */ new Set();
+  let node = false, vitest = false, summary = false;
+  let at;
+  for (const raw of log.split(/\r?\n/)) {
+    const line = logLine(raw);
+    if (/^not ok\b/.test(line)) return void 0;
+    if (/^\u00D7/.test(line)) vitest = true;
+    const fail2 = /^FAIL\s+(\S+\.(?:test|spec)\.[cm]?[jt]sx?(?:\s+>\s+.+)?)$/.exec(line);
+    if (fail2) {
+      ids.add(fail2[1].replace(/\s+\d+(?:\.\d+)?m?s$/, "").trim());
+      continue;
+    }
+    if (/^FAIL\b/.test(line)) return void 0;
+    if (/^\u2716 failing tests:?$/.test(line)) {
+      summary = true;
+      at = void 0;
+      continue;
+    }
+    if (!/^\u2716/.test(line)) {
+      const loc = summary ? /^test at (\S+?):(\d+):\d+$/.exec(line) : null;
+      if (loc) at = `${loc[1]}:${loc[2]}`;
+      continue;
+    }
+    node = true;
+    if (!summary) continue;
+    const title = /^\u2716 (.+?)(?:\s+\(\d+(?:\.\d+)?m?s\))?$/.exec(line)?.[1];
+    if (!title || !at) return void 0;
+    ids.add(`${at} > ${title}`);
+    at = void 0;
+  }
+  if ((node || vitest || summary) && (!ids.size || node && !summary)) return void 0;
+  return [...ids];
+}
 function firstTestFailureLine(log) {
   for (const raw of log.split(/\r?\n/)) {
-    const line = raw.replace(/^\uFEFF?\d{4}-\d\d-\d\dT[\d:.]+Z\s*/, "").replace(/\x1b\[[0-9;]*m/g, "").trim();
+    const line = logLine(raw);
     if (TEST_FAILURE_LINE.test(line)) {
       return line.replace(/\b(?:gh[pousr]_|github_pat_|AKIA|sk-)[\w-]+/g, "[redacted]").slice(0, 200);
     }
@@ -17216,7 +17270,9 @@ function negatedClosingRefusalMessage(negated, context = "pr merge") {
 function commitClosingRefusalMessage(closing, context = "pr merge") {
   const named = closing.map((n) => `#${n}`).join(", ");
   const first = `#${closing[0] ?? "N"}`;
-  return `${context}: REFUSED \u2014 commit messages will close ${named} through the squash body, but GitHub omitted ${named} from closingIssuesReferences. Remove close/fix/resolve + ${first} from the commit message (if the issue must stay open, use "Part of ${first}" / "Refs ${first}" / "leaves ${first} open" \u2014 never "does not close ${first}"), edit the squash body at merge time (--squash-body-file), or re-run with --force to merge anyway and let ${named} close.`;
+  const isQueue = /queue/i.test(context);
+  const remedy = isQueue ? `GitHub's merge queue composes the squash message directly from the commits and accepts no squash-body override (--squash-body-file cannot be sent to the queue). If this PR is meant to close ${named}, register ${named} in the PR body (\`mmi-cli devops pr edit <pr> --body-file <path>\` with \`Closes ${first}\`) and rerun \`pr land\`; if ${named} must stay open, reword the commit message to use "Part of ${first}" / "Refs ${first}" / "leaves ${first} open" (never "does not close ${first}"), or re-run with --force to enqueue anyway and let ${named} close.` : `Remove close/fix/resolve + ${first} from the commit message (if the issue must stay open, use "Part of ${first}" / "Refs ${first}" / "leaves ${first} open" \u2014 never "does not close ${first}"), edit the squash body at merge time (--squash-body-file), or re-run with --force to merge anyway and let ${named} close.`;
+  return `${context}: REFUSED \u2014 commit messages will close ${named} through the squash body, but GitHub omitted ${named} from closingIssuesReferences. ${remedy}`;
 }
 function alreadyClosedCommitClosingMessage(closed, context = "pr merge") {
   const named = closed.map((n) => `#${n}`).join(", ");
@@ -21260,7 +21316,7 @@ async function repoSlug() {
   return "-";
 }
 function registryClientDeps(cfg) {
-  return { baseUrl: cfg.sagaApiUrl, token: () => hubAuthToken({ baseUrl: cfg.sagaApiUrl, githubToken }) };
+  return { baseUrl: cfg.sagaApiUrl, token: () => hubAuthToken({ baseUrl: cfg.sagaApiUrl, githubToken: githubPersonalToken }) };
 }
 async function isOrgRegisteredRepo(cfg, deps = {}) {
   const slug = await (deps.slug ?? repoSlug)();
@@ -27400,10 +27456,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.5",
-    tag: "v4.6.5",
-    commit: "cd6f8a959ed5",
-    npm: "@mutmutco/cli@4.6.5"
+    version: "4.6.6",
+    tag: "v4.6.6",
+    commit: "8431efc33b8c",
+    npm: "@mutmutco/cli@4.6.6"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27420,14 +27476,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.5"
+          v3Target: "v4.6.6"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.5 and redeploy the Hub Lambda from tag v4.6.5 (cd6f8a959ed5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.5 (@mutmutco/cli@4.6.5, tag commit cd6f8a959ed5 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.6 and redeploy the Hub Lambda from tag v4.6.6 (8431efc33b8c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.6 (@mutmutco/cli@4.6.6, tag commit 8431efc33b8c \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -41001,6 +41057,403 @@ var import_node_os17 = require("node:os");
 var import_node_path30 = require("node:path");
 init_cli_shared();
 
+// src/pr-land.ts
+var PR_LAND_QUEUE_TIMEOUT_MS = 75 * 6e4;
+var PR_LAND_QUEUE_BATCH_SIZE = 5;
+function prQueueReadHint(prNumber, repo) {
+  return `read the queue entry with \`mmi-cli devops read pr queue ${prNumber} --repo ${repo} --json\` (no queue-admission state file is meant to be inspected directly under %LOCALAPPDATA%/MMI Future/mmi-cli)`;
+}
+function prHeadBehindBase(input) {
+  if ((input.mergeStateStatus ?? "").toUpperCase() === "BEHIND") return true;
+  return /out[- ]of[- ]date|not up to date|up to date with the base|update (?:the|your) branch/i.test(input.message ?? "");
+}
+function prHeadUpdateRemedy(head, base) {
+  return `git fetch origin ${base} && git merge origin/${base} (on ${head}), resolve the conflicts, push, then rerun \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#head-behind-base`;
+}
+function prLandedBranchFinality(prNumber, base) {
+  return `PR #${prNumber} is merged, and that is final \u2014 stopping a local waiter or monitor does not unmerge it. The head branch is now landed; further commits pushed to it reach nothing. If more work is needed, run \`git fetch origin ${base} && git switch -c <new-branch> origin/${base}\`, then cherry-pick anything already committed \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#merged-pr-head-reuse`;
+}
+var PROTECTED_PR_HEAD_BRANCHES = ["main", "master", "development", "rc"];
+function isProtectedPrHead(head) {
+  return PROTECTED_PR_HEAD_BRANCHES.includes(head);
+}
+function protectedPrHeadRemedy(head, base) {
+  return `PR head \`${head}\` is a train branch \u2014 updating it from \`${base}\` would merge \`${base}\` into \`${head}\`, promoting every unreleased commit. Never do that and never hand-merge on \`${head}\`. This is the pre-#6288 alignment shape: close this PR and let the train rebuild the alignment on a \`${base}\`-based branch that merges \`${head}\` into it (\`mmi-cli devops release --resume\`), then land THAT with a true merge \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#head-behind-base`;
+}
+var PR_HEAD_UPDATE_API_READ_RETRIES = 5;
+var PR_HEAD_UPDATE_API_READ_DELAY_MS = 15e3;
+async function updatePrHeadFromBase(input) {
+  const remedy = prHeadUpdateRemedy(input.head, input.base);
+  if (isProtectedPrHead(input.head)) throw new Error(protectedPrHeadRemedy(input.head, input.base));
+  if (input.localCheckedOut) {
+    const from2 = (await input.git(["rev-parse", "HEAD"])).trim();
+    await input.git(["fetch", "origin", input.base]);
+    try {
+      await input.git(["merge", "--no-ff", "--no-edit", `origin/${input.base}`]);
+    } catch (e) {
+      await input.git(["merge", "--abort"]).catch(() => {
+      });
+      throw new Error(`updating ${input.head} from ${input.base} conflicted (${e.message.trim()}) \u2014 ${remedy}`);
+    }
+    await input.git(["push", "origin", input.head]);
+    const to = (await input.git(["rev-parse", "HEAD"])).trim();
+    return { from: from2, to, base: input.base, via: "local-merge" };
+  }
+  const pullPath = `repos/${input.repo}/pulls/${input.prNumber}`;
+  const readHead2 = async () => (await input.rest("GET", pullPath)).head?.sha ?? "";
+  const from = await readHead2();
+  try {
+    await input.rest("PUT", `${pullPath}/update-branch`, from ? { expected_head_sha: from } : void 0);
+  } catch (e) {
+    throw new Error(`GitHub could not update ${input.head} from ${input.base} (${e.message.trim()}) \u2014 ${remedy}`);
+  }
+  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  for (let attempt = 0; attempt < PR_HEAD_UPDATE_API_READ_RETRIES; attempt++) {
+    const to = await readHead2();
+    if (to && to !== from) return { from, to, base: input.base, via: "update-branch-api" };
+    await sleep2(PR_HEAD_UPDATE_API_READ_DELAY_MS);
+  }
+  throw new Error(`GitHub accepted the update of ${input.head} from ${input.base} but the head did not move \u2014 check the PR, then rerun`);
+}
+var PR_LAND_POLL_MS = 6e4;
+var PR_LAND_POLL_MAX_MS = 5 * 6e4;
+function prLandPollDelayMs(attempt, waiting) {
+  const load = Math.max(1, Math.ceil(waiting / PR_LAND_QUEUE_BATCH_SIZE));
+  const age = Math.min(2, 1 + Math.floor(attempt / 15) * 0.5);
+  return Math.min(PR_LAND_POLL_MAX_MS, Math.round(PR_LAND_POLL_MS * load * age));
+}
+var PR_LAND_EJECT_CONFIRM_MS = 2e4;
+var PR_LAND_ENQUEUE_TIMEOUT_MS = 10 * 6e4;
+var PR_LAND_STATE_READ_RETRIES = 3;
+var PR_LAND_STATE_READ_DELAY_MS = 15e3;
+var PR_LAND_MERGE_RETRY_DELAY_MS = 3e4;
+async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
+  const now = deps.now ?? (() => Date.now());
+  const deadline = now() + PR_LAND_ENQUEUE_TIMEOUT_MS;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const first = await deps.mergeAuto(prNumber, repo);
+  let result = first;
+  let transientRetried = false;
+  while (result.mergeStatus === "failed") {
+    if (result.retryable === false || result.outcomeUnknown || result.preparation) return result;
+    const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false, checksPending: false }));
+    if (ready.open && ready.checksPending) {
+      if (now() >= deadline) break;
+      await sleep2(Math.min(PR_LAND_POLL_MS, deadline - now()));
+      if (now() >= deadline) break;
+      const checks = await deps.waitForChecks(prNumber, repo, deadline - now());
+      if (checks.status !== "success" && checks.status !== "skipped") {
+        return { ...result, mergeStatus: "failed", error: `${result.error ?? "merge failed"}
+registration wait: checks-wait ${checks.status}: ${checks.detail ?? checks.reason ?? "unknown"}` };
+      }
+      if (now() >= deadline) break;
+    } else {
+      if (!ready.open || !ready.mergeable || !ready.checksPassing || transientRetried) return result;
+      transientRetried = true;
+      if (now() >= deadline) break;
+      await sleep2(Math.min(PR_LAND_MERGE_RETRY_DELAY_MS, deadline - now()));
+      if (now() >= deadline) break;
+    }
+    const retried = await deps.mergeAuto(prNumber, repo);
+    result = retried.mergeStatus !== "failed" ? retried : {
+      ...retried,
+      error: `merge retry after transient failure also failed: first attempt: ${first.error ?? "unknown error"}
+retry: ${retried.error ?? "unknown error"}`
+    };
+  }
+  return result.mergeStatus === "failed" ? { ...result, error: `${result.error ?? "merge failed"}
+required-check registration did not settle within the enqueue deadline` } : result;
+}
+var AUTO_MERGE_CONFIRM_RETRIES = 3;
+var AUTO_MERGE_CONFIRM_DELAY_MS = 15e3;
+async function confirmAutoMergeEnqueued(deps, options) {
+  const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
+  const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  for (let attempt = 0; attempt < retries; attempt++) {
+    if (await deps.readMerged().catch(() => false)) return "merged";
+    const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
+    if (stuck) return "enqueued";
+    if (attempt < retries - 1) {
+      await sleep2(delayMs);
+      await deps.reEnqueue().catch(() => {
+      });
+    }
+  }
+  if (await deps.readMerged().catch(() => false)) return "merged";
+  return "not-stuck";
+}
+async function readGhPrStateWithRetry(fetchState, options) {
+  const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
+  const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  let lastError = "empty state";
+  for (let attempt = 0; attempt < retries; attempt++) {
+    try {
+      const state = (await fetchState()).trim();
+      if (state) return { ok: true, state };
+      lastError = "empty state";
+    } catch (e) {
+      lastError = String(e.message || "gh pr view failed");
+    }
+    if (attempt < retries - 1) await sleep2(delayMs);
+  }
+  return { ok: false, error: lastError };
+}
+async function runPrLand(prNumber, options, deps) {
+  const resolved = await deps.resolveRepo(prNumber, options.repo);
+  const { repo } = resolved;
+  const base = { status: "failed", repo, pr: prNumber, base: resolved.base };
+  if (options.requireTrain !== false) {
+    const verdict = await deps.fetchTrainAuthority(repo);
+    if (!verdict.ok) {
+      return { ...base, error: `train authority unavailable: ${verdict.error}` };
+    }
+    base.train = { role: verdict.authority.role, train: verdict.authority.train };
+    if (!verdict.authority.train) {
+      return {
+        ...base,
+        error: `@${verdict.authority.login ?? "caller"} is ${verdict.authority.role} \u2014 train not authorized on ${repo}; cannot land PR`
+      };
+    }
+  }
+  const ciPolicy = await deps.resolveCiPolicy(repo);
+  base.ciPolicy = ciPolicy;
+  const pinned = options.expectHead;
+  if (pinned) base.pinnedHead = { expected: pinned };
+  const headDrift = async (stage) => {
+    if (!pinned) return void 0;
+    if (!deps.readHeadSha) throw new Error("pinned head reader unavailable");
+    const observed = await deps.readHeadSha(prNumber, repo);
+    base.pinnedHead = { expected: pinned, observed };
+    if (observed === pinned) return void 0;
+    return {
+      ...base,
+      pinnedHead: { ...base.pinnedHead, refused: "drift" },
+      error: `pr land #${prNumber}: head ${observed} is not the pinned ${pinned} (${stage}) \u2014 refusing to land a head that was not checked (--expect-head)`
+    };
+  };
+  const drift = await headDrift("before landing");
+  if (drift) return drift;
+  const hasQueue = await deps.hasMergeQueue?.(repo, resolved.base) ?? false;
+  let queueSnapshot;
+  const queued = { base: resolved.base, state: "queued" };
+  if (hasQueue) {
+    if (!deps.readMergeQueue) throw new Error("merge queue reader unavailable");
+    queueSnapshot = await deps.readMergeQueue(prNumber, repo);
+    if (queueSnapshot.isInMergeQueue || queueSnapshot.state === "MERGED") {
+      base.mergeQueue = queued;
+      base.mergeStatus = "auto-merge-enqueued";
+      return pollPrMergeQueue(prNumber, options, deps, base, queueSnapshot);
+    }
+  }
+  const checksWaitError = (checksWait) => {
+    if (checksWait.status === "conflicting") {
+      return `checks-wait conflicting: ${checksWait.reason ?? "PR is conflicting with the base branch"}`;
+    }
+    if (checksWait.status === "failure" || checksWait.status === "timeout" || checksWait.status === "rate-limited") {
+      return `checks-wait ${checksWait.status}${checksWait.detail ? `: ${checksWait.detail}` : ""}`;
+    }
+    return void 0;
+  };
+  base.checksWait = await deps.waitForChecks(prNumber, repo);
+  const waitError = checksWaitError(base.checksWait);
+  if (waitError) return { ...base, error: hasQueue ? `${waitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : waitError };
+  const driftAfterChecks = await headDrift("after checks");
+  if (driftAfterChecks) return driftAfterChecks;
+  let prState = await deps.readPrState(prNumber, repo);
+  if (!hasQueue && pinned && prState.mergeStateStatus === "BEHIND") {
+    return {
+      ...base,
+      pinnedHead: { ...base.pinnedHead, refused: "behind" },
+      error: `pr land #${prNumber}: head is BEHIND ${resolved.base} and pinned by --expect-head \u2014 refusing to update it. Update and re-check the head yourself, then land with the new SHA`
+    };
+  }
+  if (!hasQueue && prState.mergeStateStatus === "BEHIND" && deps.updateBranch) {
+    try {
+      base.branchUpdated = await deps.updateBranch(prNumber, repo);
+    } catch (e) {
+      return { ...base, error: `pr land #${prNumber}: ${e.message}` };
+    }
+    base.checksWait = await deps.waitForChecks(prNumber, repo);
+    const reWaitError = checksWaitError(base.checksWait);
+    if (reWaitError) return { ...base, error: hasQueue ? `${reWaitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : reWaitError };
+    prState = await deps.readPrState(prNumber, repo);
+  }
+  if (prState.mergeStateStatus === "DIRTY" || prState.mergeable === "CONFLICTING") {
+    return {
+      ...base,
+      error: `pr land #${prNumber}: branch conflicts with base \u2014 rebase/merge development, rebuild any checked-in artifacts, then re-push before landing${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`
+    };
+  }
+  if (hasQueue && !deps.enqueueQueue) throw new Error("queue-only enqueue adapter unavailable; no merge dispatched");
+  const merge = await mergeAutoWithTransientRetry(prNumber, repo, hasQueue ? { ...deps, mergeAuto: (pr, target) => deps.enqueueQueue(pr, target, pinned) } : deps);
+  base.mergeStatus = merge.mergeStatus;
+  if (merge.credential) base.credential = merge.credential;
+  if (merge.credentialRole) base.credentialRole = merge.credentialRole;
+  if (merge.mergeStatus === "queue-admission-pending") {
+    return { ...base, status: "queue-admission-pending", outcomeUnknown: true, queueAdmission: merge.queueAdmission, error: merge.error };
+  }
+  if (merge.mergeStatus === "failed") {
+    const rawError = merge.error ?? "merge failed";
+    const error = hasQueue && !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError;
+    return { ...base, ...merge.preparation ? { preparation: merge.preparation } : {}, ...merge.outcomeUnknown ? { outcomeUnknown: true } : {}, error };
+  }
+  if (hasQueue) {
+    base.mergeQueue = queued;
+    if (merge.mergeStatus === "merged") {
+      return queueMerged(base, deps);
+    }
+    const deadline = (deps.now ?? (() => Date.now()))() + (options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS);
+    let confirmed;
+    if (options.enqueueOnly) {
+      const read = await deps.readMergeQueue(prNumber, repo);
+      if (read.isInMergeQueue || read.state === "MERGED") confirmed = read;
+    }
+    if (!confirmed) {
+      await (deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(deps.pollDelayMs?.(0) ?? PR_LAND_POLL_MS);
+    }
+    return pollPrMergeQueue(prNumber, options, deps, base, confirmed, deadline);
+  }
+  if (merge.mergeStatus === "merged") {
+    return {
+      ...base,
+      status: "merged",
+      branchFinality: prLandedBranchFinality(prNumber, resolved.base)
+    };
+  }
+  const now = deps.now ?? (() => Date.now());
+  const merged = await deps.pollMerged(prNumber, repo, now() + PR_LAND_ENQUEUE_TIMEOUT_MS);
+  if (merged) {
+    return {
+      ...base,
+      status: "auto-merge-enqueued-then-merged",
+      mergeStatus: "merged",
+      branchFinality: prLandedBranchFinality(prNumber, resolved.base)
+    };
+  }
+  return {
+    ...base,
+    error: "auto-merge enqueued but PR did not reach MERGED within timeout \u2014 poll manually with gh pr view"
+  };
+}
+function queueMerged(base, deps) {
+  const result = {
+    ...base,
+    status: "merged-via-queue",
+    mergeStatus: "merged",
+    mergeQueue: { ...base.mergeQueue, state: "merged" },
+    branchFinality: prLandedBranchFinality(base.pr, base.base)
+  };
+  deps.queueProgress?.(result);
+  return result;
+}
+async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
+  const now = deps.now ?? (() => Date.now());
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  const timeoutMs = options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS;
+  const deadline = deadlineMs ?? now() + timeoutMs;
+  let attempt = 0;
+  let credentialMismatched = false;
+  const observe = (read) => {
+    const seen = deps.observeQueued?.(pr, base.repo, read);
+    if (seen?.mismatched) {
+      credentialMismatched = true;
+      delete base.credential;
+    }
+    if (!credentialMismatched && seen?.credential && !base.credential) base.credential = seen.credential;
+  };
+  while (now() < deadline) {
+    const read = snapshot ?? await deps.readMergeQueue(pr, base.repo);
+    snapshot = void 0;
+    if (read.isInMergeQueue || read.state === "MERGED") observe(read);
+    if (read.state === "MERGED") return queueMerged(base, deps);
+    if (read.isInMergeQueue) {
+      base.mergeQueue = {
+        base: base.base,
+        state: "queued",
+        ...read.mergeQueueEntry ? { position: read.mergeQueueEntry.position, entryState: read.mergeQueueEntry.state } : {}
+      };
+      deps.queueProgress?.(base);
+      if (options.enqueueOnly) return { ...base, status: "queued" };
+    } else if (read.state === "OPEN" && !read.autoMergeRequest) {
+      await sleep2(PR_LAND_EJECT_CONFIRM_MS);
+      const again = await deps.readMergeQueue(pr, base.repo);
+      if (again.state === "MERGED") {
+        observe(again);
+        return queueMerged(base, deps);
+      }
+      if (again.isInMergeQueue || again.autoMergeRequest) {
+        snapshot = again;
+        continue;
+      }
+      const run = await deps.findMergeGroupRun(pr, base.repo, base.base);
+      const result2 = {
+        ...base,
+        mergeQueue: { ...base.mergeQueue, state: "ejected", ...run ? { ejectedRun: run } : {} },
+        ...base.pinnedHead ? { pinnedHead: { ...base.pinnedHead, refused: "ejected" } } : {},
+        error: `merge queue ejected PR #${pr} \u2014 ${run ? `merge_group run ${run.id} ${run.conclusion} ${run.url}` : "merge_group run not found"}; ${prQueueReadHint(pr, base.repo)}`
+      };
+      deps.queueProgress?.(result2);
+      return result2;
+    }
+    await sleep2(deps.pollDelayMs?.(++attempt) ?? PR_LAND_POLL_MS);
+  }
+  const result = {
+    ...base,
+    mergeQueue: { ...base.mergeQueue, state: "timeout" },
+    error: `merge queue did not reach MERGED within ${Math.round(timeoutMs / 6e4)} minutes \u2014 ${prQueueReadHint(pr, base.repo)} and rerun pr land to resume polling`
+  };
+  deps.queueProgress?.(result);
+  return result;
+}
+function prLandOutcome(result) {
+  if (result.status === "queue-admission-pending") return "queue-admission-pending";
+  if (result.status !== "failed" && result.status !== "queued") return "merged";
+  if (result.status === "queued") return "queued";
+  const state = result.mergeQueue?.state;
+  return state === "ejected" || state === "timeout" ? state : "failed";
+}
+function failuresAllOnBase(prFailures, baseFailures) {
+  const base = new Set(baseFailures);
+  return prFailures.length > 0 && prFailures.every((f) => base.has(f));
+}
+async function landMany(prs, landOne, cleanup, hooks) {
+  const safe = async (pr) => landOne(pr).catch((e) => ({ status: "failed", repo: "", pr, base: "", error: e.message }));
+  return Promise.all(prs.map(async (pr) => {
+    let result = await safe(pr);
+    if (prLandOutcome(result) === "ejected" && !result.pinnedHead) {
+      const baseRed = await hooks?.baseRedCheck?.(pr, result).catch(() => void 0);
+      if (baseRed) {
+        result = { ...result, baseRed: { base: result.base, baseRunId: baseRed.baseRunId }, error: `base-red: failures already on ${result.base} (${baseRed.baseRunId})` };
+      } else {
+        hooks?.onRetry?.(pr, result);
+        result = { ...await safe(pr), retriedAfterEjection: true };
+      }
+    }
+    const outcome = prLandOutcome(result);
+    const cleaned = result.status === "merged-via-queue" ? await cleanup(result).catch((e) => `cleanup failed: ${e.message}`) : void 0;
+    hooks?.onDone?.();
+    return { pr, outcome, result, ...cleaned ? { cleanup: cleaned } : {} };
+  }));
+}
+function renderPrLandTable(entries) {
+  const rows = entries.map((e) => [
+    `#${e.pr}`,
+    e.outcome + (e.result.retriedAfterEjection ? " (after retry)" : ""),
+    [e.result.error, e.cleanup].filter(Boolean).join(" | ") || "-"
+  ]);
+  const width = (i) => Math.max(...rows.map((r) => r[i].length));
+  return rows.map((r) => `${r[0].padEnd(width(0))}  ${r[1].padEnd(width(1))}  ${r[2]}`).join("\n");
+}
+function landCredentials(results) {
+  const each = results.map((r) => r.credential ?? "unknown");
+  return { each, overall: each.length === 0 ? "unknown" : new Set(each).size === 1 ? each[0] : "mixed" };
+}
+
+// src/pr-merge-queue.ts
+var import_yaml3 = __toESM(require_dist(), 1);
+
 // src/test-policy-core.ts
 var import_node_child_process11 = require("node:child_process");
 var import_node_fs32 = require("node:fs");
@@ -41539,6 +41992,9 @@ function loadPolicy(root, readFile10 = readFileOrNull2) {
   if (raw == null) return { mandatory: [], declared: false };
   return parsePolicy(raw, POLICY_FILE);
 }
+function parseTestPolicy(raw) {
+  return parsePolicy(raw, POLICY_FILE);
+}
 function parsePolicy(raw, source) {
   try {
     const parsed = JSON.parse(raw);
@@ -41558,6 +42014,10 @@ function parsePolicy(raw, source) {
     ))) {
       throw new Error("protected must be an array of { path, why? } entries");
     }
+    const aggregateJobs = record2.aggregateJobs;
+    if (aggregateJobs !== void 0 && (!Array.isArray(aggregateJobs) || aggregateJobs.some((job) => typeof job !== "string" || !job.trim()))) {
+      throw new Error("aggregateJobs must be an array of workflow job keys");
+    }
     return { ...record2, declared: true };
   } catch (error) {
     throw new Error(`${source} is not valid JSON: ${error.message}`);
@@ -41975,7 +42435,7 @@ function admissionJournal(repo, pr, root) {
   const path2 = (number) => (0, import_node_path30.join)(directory, `${number}.jsonl`);
   const validate = (value, previous) => {
     const row = value;
-    if (!row || row.version !== 1 || row.repo !== repo.toLowerCase() || row.pr !== pr || !/^[a-f0-9]{40}$/i.test(row.head) || !UUID.test(row.intentId) || !Number.isSafeInteger(row.createdAt) || row.createdAt <= 0 || !Number.isSafeInteger(row.observedAt) || row.observedAt < row.createdAt || !["dispatching", "pending", "enqueued", "merged", "failed", "ejected"].includes(row.state) || row.credential !== void 0 && !["app_installation", "user"].includes(row.credential) || row.uuid !== void 0 && !UUID.test(row.uuid) || row.state === "pending" && !row.uuid || row.queueEntry !== void 0 && (!row.queueEntry || typeof row.queueEntry.headCommitOid !== "string" || !/^[a-f0-9]{40}$/i.test(row.queueEntry.headCommitOid) || typeof row.queueEntry.enqueuedAt !== "string" || !Number.isFinite(Date.parse(row.queueEntry.enqueuedAt)))) {
+    if (!row || row.version !== 1 || row.repo !== repo.toLowerCase() || row.pr !== pr || !/^[a-f0-9]{40}$/i.test(row.head) || !UUID.test(row.intentId) || !Number.isSafeInteger(row.createdAt) || row.createdAt <= 0 || !Number.isSafeInteger(row.observedAt) || row.observedAt < row.createdAt || !["dispatching", "pending", "enqueued", "merged", "failed", "ejected"].includes(row.state) || row.credential !== void 0 && !["app_installation", "user"].includes(row.credential) || row.queueWitnessed !== void 0 && typeof row.queueWitnessed !== "boolean" || row.uuid !== void 0 && !UUID.test(row.uuid) || row.state === "pending" && !row.uuid || row.queueEntry !== void 0 && (!row.queueEntry || typeof row.queueEntry.headCommitOid !== "string" || !/^[a-f0-9]{40}$/i.test(row.queueEntry.headCommitOid) || typeof row.queueEntry.enqueuedAt !== "string" || !Number.isFinite(Date.parse(row.queueEntry.enqueuedAt)))) {
       throw new Error("queue admission receipt is invalid; preserve it and reconcile the prior request");
     }
     if (!previous) {
@@ -42013,7 +42473,17 @@ function admissionJournal(repo, pr, root) {
     },
     save(state, uuid, queueEntry, credential) {
       const previous = load();
-      const receipt = validate({ ...previous, state, observedAt: Date.now(), ...uuid ? { uuid } : {}, ...queueEntry ? { queueEntry } : {}, ...credential && previous.credential === void 0 ? { credential } : {} }, previous);
+      const nextEntry = queueEntry ?? previous.queueEntry;
+      const queueWitnessed = nextEntry ? true : state === "enqueued" ? previous.queueWitnessed ?? false : previous.queueWitnessed;
+      const receipt = validate({
+        ...previous,
+        state,
+        observedAt: Date.now(),
+        ...uuid ? { uuid } : {},
+        ...nextEntry ? { queueEntry: nextEntry } : {},
+        ...queueWitnessed !== void 0 ? { queueWitnessed } : {},
+        ...credential && previous.credential === void 0 ? { credential } : {}
+      }, previous);
       (0, import_node_fs33.appendFileSync)(path2(attempt), JSON.stringify(receipt) + "\n", { flush: true });
       load();
     }
@@ -42036,19 +42506,20 @@ function admissionResponse(output) {
   }
   return { code: Number(response[1]), body: result };
 }
-function admissionRejected(reason) {
+function admissionRejected(reason, repo, pr) {
+  const queueHint = repo && pr ? ` Read the queue entry with \`mmi-cli devops read pr queue ${pr} --repo ${repo} --json\` (no queue-admission state file is meant to be inspected or edited directly under %LOCALAPPDATA%/MMI Future/mmi-cli).` : " Read the queue entry with `mmi-cli devops read pr queue <pr> --repo <owner/repo> --json` (no queue-admission state file is meant to be inspected or edited directly under %LOCALAPPDATA%/MMI Future/mmi-cli).";
   if (/enqueuer is not authorized to merge|not authorized to merge/i.test(reason)) {
     return {
       mergeStatus: "failed",
       retryable: false,
       admissionCause: "enqueuer-not-authorized",
-      error: `queue admission rejected (missing merge permission): ${reason}. The landing identity reported in \`credential\` may not merge into this base through the merge queue. Granting it (the GitHub App's merge permission, or a ruleset bypass) is a repository or organization setting only an admin can change; do not rerun pr land until that grant exists, and never fall back to a personal token.`
+      error: `queue admission rejected (missing merge permission): ${reason}. The landing identity reported in \`credential\` may not merge into this base through the merge queue. Granting it (the GitHub App's merge permission, or a ruleset bypass) is a repository or organization setting only an admin can change; do not rerun pr land until that grant exists, and never fall back to a personal token.${queueHint}`
     };
   }
   return {
     mergeStatus: "failed",
     retryable: false,
-    error: `queue admission rejected: ${reason}. Resolve the reported cause, then explicitly rerun pr land; it will repeat preflight before a new request.`
+    error: `queue admission rejected: ${reason}. Resolve the reported cause, then explicitly rerun pr land; it will repeat preflight before a new request.${queueHint}`
   };
 }
 async function submitQueueAdmission(pr, repo, head, read, write, options, resume = false) {
@@ -42056,10 +42527,10 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     mergeStatus: "failed",
     retryable: false,
     outcomeUnknown: true,
-    error: `queue submission outcome unknown: ${reason}. Preserve the receipt and rerun pr land to reconcile read-only; no new request was sent after this uncertainty.`
+    error: `queue submission outcome unknown: ${reason}. Never hand-edit files under the mmi-cli queue-admissions receipt store (%LOCALAPPDATA%/MMI Future/mmi-cli/queue-admissions); read the queue entry with \`mmi-cli devops read pr queue ${pr} --repo ${repo} --json\` and rerun \`mmi-cli devops pr land ${pr} --repo ${repo} --json\` to reconcile read-only \u2014 no new request was sent after this uncertainty.`
   });
-  const rejected = admissionRejected;
-  const reconcile = async (reason, recordEntry = false) => {
+  const rejected = (reason) => admissionRejected(reason, repo, pr);
+  const reconcile = async (reason, recordEntry = false, resumingSaved = false) => {
     try {
       const observed = await readPrMergeQueue(pr, repo, read);
       if (observed.state === "MERGED" && observed.headRefOid === head) return { mergeStatus: "merged" };
@@ -42071,15 +42542,15 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
         return { mergeStatus: "auto-merge-enqueued" };
       }
       const saved = recordEntry ? admissionJournal(repo, pr, options.receiptDirectory).receipt : void 0;
-      if (saved?.queueEntry && observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid === saved.head) {
-        const enqueuedAt = Date.parse(saved.queueEntry.enqueuedAt);
+      const boundMs = saved?.queueEntry ? Date.parse(saved.queueEntry.enqueuedAt) : resumingSaved && saved?.state === "enqueued" && saved.queueWitnessed === void 0 ? saved.observedAt : void 0;
+      if (saved && boundMs !== void 0 && Number.isFinite(boundMs) && observed.state === "OPEN" && !observed.isInMergeQueue && observed.headRefOid === saved.head) {
         const events = await readArrayPages(
           `repos/${repo}/issues/${pr}/timeline?per_page=100`,
           options.timelineRead ?? read,
           "queue ejection timeline unreadable"
         );
         const times = (name) => events.filter((event) => event.event === name).map((event) => Date.parse(event.created_at));
-        const adds = times("added_to_merge_queue").filter((at) => at >= enqueuedAt);
+        const adds = times("added_to_merge_queue").filter((at) => at >= boundMs);
         const removals = adds.length === 1 ? times("removed_from_merge_queue").filter((at) => at > adds[0]) : [];
         if (removals.length === 1) {
           journal.save("ejected");
@@ -42118,7 +42589,10 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       options.selection.selected = true;
       options.selection.intentId = receipt.intentId;
     }
-    if (receipt.state === "enqueued" || receipt.state === "merged") return reconcile(`reconcile-needed for ${repo}#${pr}, submitted head ${receipt.head}, operation ${receipt.uuid ?? "completed immediately"}: admission completed but current membership is absent; inspect the exact queue candidate/ejection before a new intent`, receipt.state === "enqueued");
+    if (options.enqueueOnly && options.force) {
+      return unknown(`refusing --enqueue-only --force for ${repo}#${pr} while receipt for head ${receipt.head} is in state '${receipt.state}' (operation ${receipt.uuid ?? "unconfirmed"}): drop --enqueue-only --force and run the read-only reconcile first`);
+    }
+    if (receipt.state === "enqueued" || receipt.state === "merged") return reconcile(`reconcile-needed for ${repo}#${pr}, submitted head ${receipt.head}, operation ${receipt.uuid ?? "completed immediately"}: admission completed but current membership is absent; inspect the exact queue candidate/ejection before a new intent`, receipt.state === "enqueued", true);
     if (!receipt.uuid) return reconcile(`the previous send for ${repo}#${pr}, submitted head ${receipt.head}, has no saved operation UUID`);
   } else {
     if (resume) return rejected("the previous operation failed; rerun after reviewing its cause");
@@ -42171,31 +42645,19 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
     const tryAutoMergeFallback = async (reason, uuid) => {
       const autoMerge = options.autoMerge ?? (write === writeApi ? autoMergeApi : void 0);
       if (!/enqueuer is not authorized to merge/i.test(reason) || !autoMerge) return void 0;
+      let fallback;
       try {
-        const fallback = await autoMerge(pr, repo, head);
-        const fallbackCredential = fallback?.credential ?? credential ?? receipt?.credential;
-        const observed = await readPrMergeQueue(pr, repo, read);
-        if (observed.state === "MERGED" && observed.headRefOid === head) {
-          try {
-            journal.save("merged", uuid, void 0, fallbackCredential);
-          } catch {
-            return reconcile("the completed auto-merge fallback could not be checkpointed");
-          }
-          return { mergeStatus: "merged" };
-        }
-        if (observed.isInMergeQueue && observed.headRefOid === head) {
-          const entry = observed.mergeQueueEntry;
-          const queueEntry = entry?.headCommit && entry.enqueuedAt ? { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt } : void 0;
-          try {
-            journal.save("enqueued", uuid, queueEntry, fallbackCredential);
-          } catch {
-            return reconcile("the enqueued auto-merge fallback could not be checkpointed");
-          }
-          return { mergeStatus: "auto-merge-enqueued" };
-        }
+        fallback = await autoMerge(pr, repo, head);
       } catch {
+        return void 0;
       }
-      return void 0;
+      const fallbackCredential = fallback?.credential ?? credential ?? receipt?.credential;
+      try {
+        journal.save("enqueued", uuid, void 0, fallbackCredential);
+      } catch {
+        return reconcile("the accepted auto-merge fallback could not be checkpointed");
+      }
+      return reconcile("the auto-merge fallback completed, but matching-head membership or merged state is unconfirmed", true);
     };
     if (code === 400 || code === 403 || code === 404 || code === 422) {
       const reason = body.details?.message ?? body.message ?? `HTTP ${code}`;
@@ -42241,29 +42703,21 @@ async function submitQueueAdmission(pr, repo, head, read, write, options, resume
       const reason = details?.message ?? "GitHub reported a failed operation";
       const autoMerge = options.autoMerge ?? (write === writeApi ? autoMergeApi : void 0);
       if (/enqueuer is not authorized to merge/i.test(reason) && autoMerge && receipt.head === head) {
+        let fallback = void 0;
+        let fallbackSucceeded = false;
         try {
-          const fallback = await autoMerge(pr, repo, head);
+          fallback = await autoMerge(pr, repo, head);
+          fallbackSucceeded = true;
+        } catch {
+        }
+        if (fallbackSucceeded) {
           const fallbackCredential = fallback?.credential ?? receipt?.credential;
-          const observed = await readPrMergeQueue(pr, repo, read);
-          if (observed.state === "MERGED" && observed.headRefOid === head) {
-            try {
-              journal.save("merged", receipt.uuid, void 0, fallbackCredential);
-            } catch {
-              return reconcile("the completed auto-merge fallback could not be checkpointed");
-            }
-            return { mergeStatus: "merged" };
-          }
-          if (observed.isInMergeQueue && observed.headRefOid === head) {
-            const entry = observed.mergeQueueEntry;
-            const queueEntry = entry?.headCommit && entry.enqueuedAt ? { headCommitOid: entry.headCommit.oid, enqueuedAt: entry.enqueuedAt } : void 0;
-            try {
-              journal.save("enqueued", receipt.uuid, queueEntry, fallbackCredential);
-            } catch {
-              return reconcile("the enqueued auto-merge fallback could not be checkpointed");
-            }
-            return { mergeStatus: "auto-merge-enqueued" };
+          try {
+            journal.save("enqueued", receipt.uuid, void 0, fallbackCredential);
+          } catch {
+            return reconcile("the accepted auto-merge fallback could not be checkpointed");
           }
-        } catch {
+          return reconcile("the auto-merge fallback completed, but matching-head membership or merged state is unconfirmed", true);
         }
       }
     }
@@ -42338,7 +42792,7 @@ async function enqueuePrMergeQueue(pr, repo, options = {}) {
       status: "preparation-needed",
       reason,
       issueTargets: targets.map((number) => `${repo}#${number}`),
-      nextAction: reason === "queue-message" ? "PR author: remove the closing phrases from the source commit or PR text using Part of #N / Refs #N, then re-run checks and pr land with the prepared head. A queue cannot accept --squash-body-file." : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged."
+      nextAction: reason === "queue-message" ? "PR author: if the PR is meant to close these issues, add `Closes #N` to the PR body (`mmi-cli devops pr edit <pr> --body-file <path>`) and rerun pr land without pushing a new head; if they must stay open, remove the closing phrases from the source commit or PR text using Part of #N / Refs #N, then re-run checks and pr land with the prepared head. A queue cannot accept --squash-body-file." : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged."
     },
     error: `queue preparation needed: ${detail}`
   });
@@ -42450,6 +42904,100 @@ async function findPrMergeGroupRun(pr, repo, base, gh2 = readApi) {
   const run = pages.flatMap((page) => page.workflow_runs).filter((run2) => run2.head_branch?.startsWith(prefix)).sort((a, b) => b.created_at.localeCompare(a.created_at) || b.id - a.id)[0];
   return run ? { id: run.id, url: run.html_url, conclusion: run.conclusion } : void 0;
 }
+function workflowNeeds(text) {
+  const doc = (0, import_yaml3.parse)(text);
+  const out = /* @__PURE__ */ new Map();
+  for (const [key, job] of Object.entries(doc?.jobs ?? {})) {
+    const raw = job?.needs;
+    const needs = typeof raw === "string" ? [raw] : Array.isArray(raw) ? raw.filter((n) => typeof n === "string") : [];
+    const name = typeof job?.name === "string" ? job.name : key;
+    out.set(key, { name, needs, matrix: job?.strategy?.matrix != null, dynamicName: name.includes("${{") });
+  }
+  return out;
+}
+function jobKey(name, jobs) {
+  const leg = name.replace(/ \([^()]*\)$/, "");
+  const matches = [...jobs].filter(([, job]) => job.name === name || job.matrix && leg !== name && job.name === leg).map(([key]) => key);
+  if (matches.length !== 1) return void 0;
+  const collides = [...jobs.keys()].some((key) => key !== matches[0] && (key === name || key === leg));
+  return collides ? void 0 : matches[0];
+}
+function aggregateKey(name, jobs, declared) {
+  const matches = [...jobs].filter(([, job]) => job.name === name).map(([key2]) => key2);
+  if (matches.length !== 1) return void 0;
+  const key = matches[0];
+  if ([...jobs.keys()].some((other) => other !== key && other === name)) return void 0;
+  return declared.has(key) && !jobs.get(key).matrix ? key : void 0;
+}
+var JOB_PAGES = 10;
+var JOBS_PER_PAGE = 100;
+async function attemptJobs(repo, run, gh2) {
+  if (!Number.isSafeInteger(run.run_attempt) || run.run_attempt < 1) return void 0;
+  const jobs = [];
+  let total;
+  for (let page = 1; page <= JOB_PAGES; page++) {
+    const body = JSON.parse(await gh2([`repos/${repo}/actions/runs/${run.id}/attempts/${run.run_attempt}/jobs?per_page=${JOBS_PER_PAGE}&page=${page}`]));
+    if (!Number.isSafeInteger(body.total_count) || !Array.isArray(body.jobs)) return void 0;
+    total ??= body.total_count;
+    if (body.total_count !== total) return void 0;
+    jobs.push(...body.jobs);
+    if (jobs.length >= total) return jobs.length === total && new Set(jobs.map((j) => j.id)).size === jobs.length ? jobs : void 0;
+    if (body.jobs.length !== JOBS_PER_PAGE) return void 0;
+  }
+  return void 0;
+}
+async function runFailingTests(repo, run, gh2, declared) {
+  const jobs = await attemptJobs(repo, run, gh2);
+  if (!jobs) return void 0;
+  const bad = jobs.filter((j) => !["success", "skipped", "neutral"].includes(j.conclusion ?? ""));
+  if (!bad.length || bad.some((j) => j.conclusion !== "failure")) return void 0;
+  const names = [];
+  const markerless = [];
+  for (const job of bad) {
+    const found = failingTestIds(await gh2([`repos/${repo}/actions/jobs/${job.id}/logs`]));
+    if (!found) return void 0;
+    if (found.length) names.push(...found);
+    else markerless.push(job);
+  }
+  if (!names.length) return void 0;
+  if (!markerless.length) return names;
+  const aggregates = await declared();
+  if (!aggregates.size || !run.path || !/^[a-f0-9]{40}$/i.test(run.head_sha ?? "")) return void 0;
+  const workflow = workflowNeeds(await gh2([`repos/${repo}/contents/${run.path}?ref=${run.head_sha}`, "-H", "Accept: application/vnd.github.raw"]));
+  if ([...workflow.values()].some((job) => job.dynamicName)) return void 0;
+  const failedKeys = new Set(bad.map((j) => jobKey(j.name ?? "", workflow)).filter((k) => !!k));
+  for (const job of markerless) {
+    const key = aggregateKey(job.name ?? "", workflow, aggregates);
+    if (!key || !workflow.get(key).needs.some((n) => failedKeys.has(n))) return void 0;
+  }
+  return names;
+}
+async function declaredAggregates(repo, sha, gh2) {
+  if (!/^[a-f0-9]{40}$/i.test(sha ?? "")) return /* @__PURE__ */ new Set();
+  try {
+    return new Set(parseTestPolicy(await gh2([`repos/${repo}/contents/test-policy.json?ref=${sha}`, "-H", "Accept: application/vnd.github.raw"])).aggregateJobs ?? []);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+var appOnlyReadApi = async (args) => {
+  const env = await ghReadEnv();
+  if (env?.MMI_GH_POOL !== "app") throw new Error("base-red: no App read environment; evidence unread");
+  return (await execFileP("gh", ["api", ...args], { timeout: 2e4, maxBuffer: 16 * 1024 * 1024, env })).stdout;
+};
+async function readBaseRedVerdict(result, gh2 = appOnlyReadApi) {
+  const run = result.mergeQueue?.ejectedRun;
+  if (run?.conclusion !== "failure") return void 0;
+  const ejected = JSON.parse(await gh2([`repos/${result.repo}/actions/runs/${run.id}`]));
+  const { workflow_runs } = JSON.parse(await gh2([`repos/${result.repo}/actions/workflows/${ejected.workflow_id}/runs?branch=${encodeURIComponent(result.base)}&event=push&per_page=1`]));
+  const baseRun = workflow_runs?.[0];
+  if (baseRun?.status !== "completed" || baseRun.conclusion !== "failure") return void 0;
+  let declared;
+  const aggregates = () => declared ??= declaredAggregates(result.repo, baseRun.head_sha, gh2);
+  const mine = await runFailingTests(result.repo, { ...ejected, id: run.id }, gh2, aggregates);
+  const base = mine && await runFailingTests(result.repo, baseRun, gh2, aggregates);
+  return mine && base && failuresAllOnBase(mine, base) ? { baseRunId: String(baseRun.id) } : void 0;
+}
 function prMergeQueueLine(result) {
   const queue = result.mergeQueue;
   if (!queue) return void 0;
@@ -42613,31 +43161,41 @@ async function cancelWorkflowRun(repo, id, deps, force = false) {
   if (!Number.isSafeInteger(runId)) throw new Error(`run cancel: <id> ${raw} is beyond the safe integer range; refusing to address a different run`);
   if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error(`run cancel: --repo must be owner/repo (received '${repo}')`);
   try {
-    if (force && deps.forceCancel) await deps.forceCancel(repo, runId);
-    else await deps.cancel(repo, runId);
+    if (force) {
+      if (!deps.forceCancel) throw new Error("force-cancel adapter unavailable");
+      await deps.forceCancel(repo, runId);
+    } else await deps.cancel(repo, runId);
   } catch (error) {
     const detail = String(error.stderr ?? error);
     throw new Error(/\b403\b/.test(detail) ? "run cancel: GitHub App denied (HTTP 403); actions:write permission is required; no personal-token fallback" : `run cancel: ${detail}`);
   }
-  return { ok: true, repo, runId, ...force ? { force: true } : {}, status: force ? RUN_FORCE_CANCEL_STATUS : RUN_CANCEL_STATUS };
+  const settledInfo = force && deps.read ? await settled(repo, runId, { read: deps.read, sleep: deps.sleep }).then((runStatus) => ({ settled: runStatus === "completed", runStatus })) : void 0;
+  return { ok: true, repo, runId, ...force ? { force: true } : {}, status: force ? RUN_FORCE_CANCEL_STATUS : RUN_CANCEL_STATUS, ...settledInfo };
 }
 function registerRunCancel(run, writeToken) {
   run.command("cancel <id>").description("cancel one queued or in-progress workflow run on the org App (actions:write); requests the cancel and prints a receipt").requiredOption("--repo <owner/repo>", "repository that owns the run").option("--force", "force-cancel the run so always() jobs stop too (#9512)").option("--json", "machine-readable receipt").action(async (id, options) => {
     let receipt;
+    let token;
+    const read = async (args) => (await execFileP("gh", ["api", ...args], {
+      timeout: 2e4,
+      maxBuffer: 16 * 1024 * 1024,
+      env: await ghReadEnv()
+    })).stdout;
     try {
       receipt = await cancelWorkflowRun(options.repo, id, {
+        read,
         cancel: async (repo, runId) => {
-          const token = await writeToken();
+          token ??= await writeToken();
           await execFileP("gh", ["api", `repos/${repo}/actions/runs/${runId}/cancel`, "--method", "POST"], {
             timeout: 2e4,
-            env: { ...process.env, GH_TOKEN: token }
+            env: { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" }
           });
         },
         forceCancel: async (repo, runId) => {
-          const token = await writeToken();
+          token ??= await writeToken();
           await execFileP("gh", ["api", `repos/${repo}/actions/runs/${runId}/force-cancel`, "--method", "POST"], {
             timeout: 2e4,
-            env: { ...process.env, GH_TOKEN: token }
+            env: { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" }
           });
         }
       }, options.force === true);
@@ -42645,7 +43203,7 @@ function registerRunCancel(run, writeToken) {
       return fail(error.message);
     }
     if (options.json) console.log(JSON.stringify(receipt));
-    else console.log(`run cancel: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.force ? "force-cancel" : "cancel"} requested (status: ${receipt.status})`);
+    else console.log(`run cancel: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.force ? "force-cancel" : "cancel"} requested (status: ${receipt.status}${receipt.runStatus ? `, runStatus: ${receipt.runStatus}` : ""})`);
   });
 }
 
@@ -45081,7 +45639,7 @@ function registerSecretsCommands(program3) {
       return;
     }
     const d = makeSecretsDeps(cfg);
-    const regDeps = { baseUrl: cfg.sagaApiUrl, token: () => hubAuthToken({ baseUrl: cfg.sagaApiUrl, githubToken }) };
+    const regDeps = { baseUrl: cfg.sagaApiUrl, token: () => hubAuthToken({ baseUrl: cfg.sagaApiUrl, githubToken: githubPersonalToken }) };
     const slug = (o.repo ? o.repo.split("/").pop() : await d.slug()).toLowerCase();
     const repo = o.repo ?? `mutmutco/${slug}`;
     const meta = await fetchProjectBySlug(slug, regDeps);
@@ -45136,7 +45694,7 @@ function registerSecretsCommands(program3) {
       return;
     }
     const d = makeSecretsDeps(cfg);
-    const regDeps = { baseUrl: cfg.sagaApiUrl, token: () => hubAuthToken({ baseUrl: cfg.sagaApiUrl, githubToken }) };
+    const regDeps = { baseUrl: cfg.sagaApiUrl, token: () => hubAuthToken({ baseUrl: cfg.sagaApiUrl, githubToken: githubPersonalToken }) };
     const slug = (o.repo ? o.repo.split("/").pop() : await d.slug()).toLowerCase();
     const repo = o.repo ?? `mutmutco/${slug}`;
     const meta = await fetchProjectBySlug(slug, regDeps);
@@ -52080,386 +52638,6 @@ function boardAdvanceFailureMessage(result) {
   return `pr merge: board advance incomplete for ${named} \u2014 the PR MERGED, but ${failures.length === 1 ? "this issue" : "these issues"} did not reach Done on the board.`;
 }
 
-// src/pr-land.ts
-var PR_LAND_QUEUE_TIMEOUT_MS = 75 * 6e4;
-var PR_LAND_QUEUE_BATCH_SIZE = 5;
-function prHeadBehindBase(input) {
-  if ((input.mergeStateStatus ?? "").toUpperCase() === "BEHIND") return true;
-  return /out[- ]of[- ]date|not up to date|up to date with the base|update (?:the|your) branch/i.test(input.message ?? "");
-}
-function prHeadUpdateRemedy(head, base) {
-  return `git fetch origin ${base} && git merge origin/${base} (on ${head}), resolve the conflicts, push, then rerun \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#head-behind-base`;
-}
-function prLandedBranchFinality(prNumber, base) {
-  return `PR #${prNumber} is merged, and that is final \u2014 stopping a local waiter or monitor does not unmerge it. The head branch is now landed; further commits pushed to it reach nothing. If more work is needed, run \`git fetch origin ${base} && git switch -c <new-branch> origin/${base}\`, then cherry-pick anything already committed \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#merged-pr-head-reuse`;
-}
-var PROTECTED_PR_HEAD_BRANCHES = ["main", "master", "development", "rc"];
-function isProtectedPrHead(head) {
-  return PROTECTED_PR_HEAD_BRANCHES.includes(head);
-}
-function protectedPrHeadRemedy(head, base) {
-  return `PR head \`${head}\` is a train branch \u2014 updating it from \`${base}\` would merge \`${base}\` into \`${head}\`, promoting every unreleased commit. Never do that and never hand-merge on \`${head}\`. This is the pre-#6288 alignment shape: close this PR and let the train rebuild the alignment on a \`${base}\`-based branch that merges \`${head}\` into it (\`mmi-cli devops release --resume\`), then land THAT with a true merge \u2014 https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#head-behind-base`;
-}
-var PR_HEAD_UPDATE_API_READ_RETRIES = 5;
-var PR_HEAD_UPDATE_API_READ_DELAY_MS = 15e3;
-async function updatePrHeadFromBase(input) {
-  const remedy = prHeadUpdateRemedy(input.head, input.base);
-  if (isProtectedPrHead(input.head)) throw new Error(protectedPrHeadRemedy(input.head, input.base));
-  if (input.localCheckedOut) {
-    const from2 = (await input.git(["rev-parse", "HEAD"])).trim();
-    await input.git(["fetch", "origin", input.base]);
-    try {
-      await input.git(["merge", "--no-ff", "--no-edit", `origin/${input.base}`]);
-    } catch (e) {
-      await input.git(["merge", "--abort"]).catch(() => {
-      });
-      throw new Error(`updating ${input.head} from ${input.base} conflicted (${e.message.trim()}) \u2014 ${remedy}`);
-    }
-    await input.git(["push", "origin", input.head]);
-    const to = (await input.git(["rev-parse", "HEAD"])).trim();
-    return { from: from2, to, base: input.base, via: "local-merge" };
-  }
-  const pullPath = `repos/${input.repo}/pulls/${input.prNumber}`;
-  const readHead2 = async () => (await input.rest("GET", pullPath)).head?.sha ?? "";
-  const from = await readHead2();
-  try {
-    await input.rest("PUT", `${pullPath}/update-branch`, from ? { expected_head_sha: from } : void 0);
-  } catch (e) {
-    throw new Error(`GitHub could not update ${input.head} from ${input.base} (${e.message.trim()}) \u2014 ${remedy}`);
-  }
-  const sleep2 = input.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  for (let attempt = 0; attempt < PR_HEAD_UPDATE_API_READ_RETRIES; attempt++) {
-    const to = await readHead2();
-    if (to && to !== from) return { from, to, base: input.base, via: "update-branch-api" };
-    await sleep2(PR_HEAD_UPDATE_API_READ_DELAY_MS);
-  }
-  throw new Error(`GitHub accepted the update of ${input.head} from ${input.base} but the head did not move \u2014 check the PR, then rerun`);
-}
-var PR_LAND_POLL_MS = 6e4;
-var PR_LAND_POLL_MAX_MS = 5 * 6e4;
-function prLandPollDelayMs(attempt, waiting) {
-  const load = Math.max(1, Math.ceil(waiting / PR_LAND_QUEUE_BATCH_SIZE));
-  const age = Math.min(2, 1 + Math.floor(attempt / 15) * 0.5);
-  return Math.min(PR_LAND_POLL_MAX_MS, Math.round(PR_LAND_POLL_MS * load * age));
-}
-var PR_LAND_EJECT_CONFIRM_MS = 2e4;
-var PR_LAND_ENQUEUE_TIMEOUT_MS = 10 * 6e4;
-var PR_LAND_STATE_READ_RETRIES = 3;
-var PR_LAND_STATE_READ_DELAY_MS = 15e3;
-var PR_LAND_MERGE_RETRY_DELAY_MS = 3e4;
-async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
-  const now = deps.now ?? (() => Date.now());
-  const deadline = now() + PR_LAND_ENQUEUE_TIMEOUT_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  const first = await deps.mergeAuto(prNumber, repo);
-  let result = first;
-  let transientRetried = false;
-  while (result.mergeStatus === "failed") {
-    if (result.retryable === false || result.outcomeUnknown || result.preparation) return result;
-    const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false, checksPending: false }));
-    if (ready.open && ready.checksPending) {
-      if (now() >= deadline) break;
-      await sleep2(Math.min(PR_LAND_POLL_MS, deadline - now()));
-      if (now() >= deadline) break;
-      const checks = await deps.waitForChecks(prNumber, repo, deadline - now());
-      if (checks.status !== "success" && checks.status !== "skipped") {
-        return { ...result, mergeStatus: "failed", error: `${result.error ?? "merge failed"}
-registration wait: checks-wait ${checks.status}: ${checks.detail ?? checks.reason ?? "unknown"}` };
-      }
-      if (now() >= deadline) break;
-    } else {
-      if (!ready.open || !ready.mergeable || !ready.checksPassing || transientRetried) return result;
-      transientRetried = true;
-      if (now() >= deadline) break;
-      await sleep2(Math.min(PR_LAND_MERGE_RETRY_DELAY_MS, deadline - now()));
-      if (now() >= deadline) break;
-    }
-    const retried = await deps.mergeAuto(prNumber, repo);
-    result = retried.mergeStatus !== "failed" ? retried : {
-      ...retried,
-      error: `merge retry after transient failure also failed: first attempt: ${first.error ?? "unknown error"}
-retry: ${retried.error ?? "unknown error"}`
-    };
-  }
-  return result.mergeStatus === "failed" ? { ...result, error: `${result.error ?? "merge failed"}
-required-check registration did not settle within the enqueue deadline` } : result;
-}
-var AUTO_MERGE_CONFIRM_RETRIES = 3;
-var AUTO_MERGE_CONFIRM_DELAY_MS = 15e3;
-async function confirmAutoMergeEnqueued(deps, options) {
-  const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
-  const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  for (let attempt = 0; attempt < retries; attempt++) {
-    if (await deps.readMerged().catch(() => false)) return "merged";
-    const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
-    if (stuck) return "enqueued";
-    if (attempt < retries - 1) {
-      await sleep2(delayMs);
-      await deps.reEnqueue().catch(() => {
-      });
-    }
-  }
-  if (await deps.readMerged().catch(() => false)) return "merged";
-  return "not-stuck";
-}
-async function readGhPrStateWithRetry(fetchState, options) {
-  const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
-  const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  let lastError = "empty state";
-  for (let attempt = 0; attempt < retries; attempt++) {
-    try {
-      const state = (await fetchState()).trim();
-      if (state) return { ok: true, state };
-      lastError = "empty state";
-    } catch (e) {
-      lastError = String(e.message || "gh pr view failed");
-    }
-    if (attempt < retries - 1) await sleep2(delayMs);
-  }
-  return { ok: false, error: lastError };
-}
-async function runPrLand(prNumber, options, deps) {
-  const resolved = await deps.resolveRepo(prNumber, options.repo);
-  const { repo } = resolved;
-  const base = { status: "failed", repo, pr: prNumber, base: resolved.base };
-  if (options.requireTrain !== false) {
-    const verdict = await deps.fetchTrainAuthority(repo);
-    if (!verdict.ok) {
-      return { ...base, error: `train authority unavailable: ${verdict.error}` };
-    }
-    base.train = { role: verdict.authority.role, train: verdict.authority.train };
-    if (!verdict.authority.train) {
-      return {
-        ...base,
-        error: `@${verdict.authority.login ?? "caller"} is ${verdict.authority.role} \u2014 train not authorized on ${repo}; cannot land PR`
-      };
-    }
-  }
-  const ciPolicy = await deps.resolveCiPolicy(repo);
-  base.ciPolicy = ciPolicy;
-  const pinned = options.expectHead;
-  if (pinned) base.pinnedHead = { expected: pinned };
-  const headDrift = async (stage) => {
-    if (!pinned) return void 0;
-    if (!deps.readHeadSha) throw new Error("pinned head reader unavailable");
-    const observed = await deps.readHeadSha(prNumber, repo);
-    base.pinnedHead = { expected: pinned, observed };
-    if (observed === pinned) return void 0;
-    return {
-      ...base,
-      pinnedHead: { ...base.pinnedHead, refused: "drift" },
-      error: `pr land #${prNumber}: head ${observed} is not the pinned ${pinned} (${stage}) \u2014 refusing to land a head that was not checked (--expect-head)`
-    };
-  };
-  const drift = await headDrift("before landing");
-  if (drift) return drift;
-  const hasQueue = await deps.hasMergeQueue?.(repo, resolved.base) ?? false;
-  let queueSnapshot;
-  const queued = { base: resolved.base, state: "queued" };
-  if (hasQueue) {
-    if (!deps.readMergeQueue) throw new Error("merge queue reader unavailable");
-    queueSnapshot = await deps.readMergeQueue(prNumber, repo);
-    if (queueSnapshot.isInMergeQueue || queueSnapshot.state === "MERGED") {
-      base.mergeQueue = queued;
-      base.mergeStatus = "auto-merge-enqueued";
-      return pollPrMergeQueue(prNumber, options, deps, base, queueSnapshot);
-    }
-  }
-  const checksWaitError = (checksWait) => {
-    if (checksWait.status === "conflicting") {
-      return `checks-wait conflicting: ${checksWait.reason ?? "PR is conflicting with the base branch"}`;
-    }
-    if (checksWait.status === "failure" || checksWait.status === "timeout" || checksWait.status === "rate-limited") {
-      return `checks-wait ${checksWait.status}${checksWait.detail ? `: ${checksWait.detail}` : ""}`;
-    }
-    return void 0;
-  };
-  base.checksWait = await deps.waitForChecks(prNumber, repo);
-  const waitError = checksWaitError(base.checksWait);
-  if (waitError) return { ...base, error: waitError };
-  const driftAfterChecks = await headDrift("after checks");
-  if (driftAfterChecks) return driftAfterChecks;
-  let prState = await deps.readPrState(prNumber, repo);
-  if (!hasQueue && pinned && prState.mergeStateStatus === "BEHIND") {
-    return {
-      ...base,
-      pinnedHead: { ...base.pinnedHead, refused: "behind" },
-      error: `pr land #${prNumber}: head is BEHIND ${resolved.base} and pinned by --expect-head \u2014 refusing to update it. Update and re-check the head yourself, then land with the new SHA`
-    };
-  }
-  if (!hasQueue && prState.mergeStateStatus === "BEHIND" && deps.updateBranch) {
-    try {
-      base.branchUpdated = await deps.updateBranch(prNumber, repo);
-    } catch (e) {
-      return { ...base, error: `pr land #${prNumber}: ${e.message}` };
-    }
-    base.checksWait = await deps.waitForChecks(prNumber, repo);
-    const reWaitError = checksWaitError(base.checksWait);
-    if (reWaitError) return { ...base, error: reWaitError };
-    prState = await deps.readPrState(prNumber, repo);
-  }
-  if (prState.mergeStateStatus === "DIRTY" || prState.mergeable === "CONFLICTING") {
-    return {
-      ...base,
-      error: `pr land #${prNumber}: branch conflicts with base \u2014 rebase/merge development, rebuild any checked-in artifacts, then re-push before landing`
-    };
-  }
-  if (hasQueue && !deps.enqueueQueue) throw new Error("queue-only enqueue adapter unavailable; no merge dispatched");
-  const merge = await mergeAutoWithTransientRetry(prNumber, repo, hasQueue ? { ...deps, mergeAuto: (pr, target) => deps.enqueueQueue(pr, target, pinned) } : deps);
-  base.mergeStatus = merge.mergeStatus;
-  if (merge.credential) base.credential = merge.credential;
-  if (merge.credentialRole) base.credentialRole = merge.credentialRole;
-  if (merge.mergeStatus === "queue-admission-pending") {
-    return { ...base, status: "queue-admission-pending", outcomeUnknown: true, queueAdmission: merge.queueAdmission, error: merge.error };
-  }
-  if (merge.mergeStatus === "failed") {
-    return { ...base, ...merge.preparation ? { preparation: merge.preparation } : {}, ...merge.outcomeUnknown ? { outcomeUnknown: true } : {}, error: merge.error ?? "merge failed" };
-  }
-  if (hasQueue) {
-    base.mergeQueue = queued;
-    if (merge.mergeStatus === "merged") {
-      return queueMerged(base, deps);
-    }
-    const deadline = (deps.now ?? (() => Date.now()))() + (options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS);
-    let confirmed;
-    if (options.enqueueOnly) {
-      const read = await deps.readMergeQueue(prNumber, repo);
-      if (read.isInMergeQueue || read.state === "MERGED") confirmed = read;
-    }
-    if (!confirmed) {
-      await (deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms))))(deps.pollDelayMs?.(0) ?? PR_LAND_POLL_MS);
-    }
-    return pollPrMergeQueue(prNumber, options, deps, base, confirmed, deadline);
-  }
-  if (merge.mergeStatus === "merged") {
-    return {
-      ...base,
-      status: "merged",
-      branchFinality: prLandedBranchFinality(prNumber, resolved.base)
-    };
-  }
-  const now = deps.now ?? (() => Date.now());
-  const merged = await deps.pollMerged(prNumber, repo, now() + PR_LAND_ENQUEUE_TIMEOUT_MS);
-  if (merged) {
-    return {
-      ...base,
-      status: "auto-merge-enqueued-then-merged",
-      mergeStatus: "merged",
-      branchFinality: prLandedBranchFinality(prNumber, resolved.base)
-    };
-  }
-  return {
-    ...base,
-    error: "auto-merge enqueued but PR did not reach MERGED within timeout \u2014 poll manually with gh pr view"
-  };
-}
-function queueMerged(base, deps) {
-  const result = {
-    ...base,
-    status: "merged-via-queue",
-    mergeStatus: "merged",
-    mergeQueue: { ...base.mergeQueue, state: "merged" },
-    branchFinality: prLandedBranchFinality(base.pr, base.base)
-  };
-  deps.queueProgress?.(result);
-  return result;
-}
-async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
-  const now = deps.now ?? (() => Date.now());
-  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
-  const timeoutMs = options.queueTimeoutMs ?? PR_LAND_QUEUE_TIMEOUT_MS;
-  const deadline = deadlineMs ?? now() + timeoutMs;
-  let attempt = 0;
-  let credentialMismatched = false;
-  const observe = (read) => {
-    const seen = deps.observeQueued?.(pr, base.repo, read);
-    if (seen?.mismatched) {
-      credentialMismatched = true;
-      delete base.credential;
-    }
-    if (!credentialMismatched && seen?.credential && !base.credential) base.credential = seen.credential;
-  };
-  while (now() < deadline) {
-    const read = snapshot ?? await deps.readMergeQueue(pr, base.repo);
-    snapshot = void 0;
-    if (read.isInMergeQueue || read.state === "MERGED") observe(read);
-    if (read.state === "MERGED") return queueMerged(base, deps);
-    if (read.isInMergeQueue) {
-      base.mergeQueue = {
-        base: base.base,
-        state: "queued",
-        ...read.mergeQueueEntry ? { position: read.mergeQueueEntry.position, entryState: read.mergeQueueEntry.state } : {}
-      };
-      deps.queueProgress?.(base);
-      if (options.enqueueOnly) return { ...base, status: "queued" };
-    } else if (read.state === "OPEN" && !read.autoMergeRequest) {
-      await sleep2(PR_LAND_EJECT_CONFIRM_MS);
-      const again = await deps.readMergeQueue(pr, base.repo);
-      if (again.state === "MERGED") {
-        observe(again);
-        return queueMerged(base, deps);
-      }
-      if (again.isInMergeQueue || again.autoMergeRequest) {
-        snapshot = again;
-        continue;
-      }
-      const run = await deps.findMergeGroupRun(pr, base.repo, base.base);
-      const result2 = {
-        ...base,
-        mergeQueue: { ...base.mergeQueue, state: "ejected", ...run ? { ejectedRun: run } : {} },
-        ...base.pinnedHead ? { pinnedHead: { ...base.pinnedHead, refused: "ejected" } } : {},
-        error: `merge queue ejected PR #${pr} \u2014 ${run ? `merge_group run ${run.id} ${run.conclusion} ${run.url}` : "merge_group run not found"}`
-      };
-      deps.queueProgress?.(result2);
-      return result2;
-    }
-    await sleep2(deps.pollDelayMs?.(++attempt) ?? PR_LAND_POLL_MS);
-  }
-  const result = {
-    ...base,
-    mergeQueue: { ...base.mergeQueue, state: "timeout" },
-    error: `merge queue did not reach MERGED within ${Math.round(timeoutMs / 6e4)} minutes \u2014 rerun pr land to resume polling`
-  };
-  deps.queueProgress?.(result);
-  return result;
-}
-function prLandOutcome(result) {
-  if (result.status === "queue-admission-pending") return "queue-admission-pending";
-  if (result.status !== "failed" && result.status !== "queued") return "merged";
-  if (result.status === "queued") return "queued";
-  const state = result.mergeQueue?.state;
-  return state === "ejected" || state === "timeout" ? state : "failed";
-}
-async function landMany(prs, landOne, cleanup, hooks) {
-  const safe = async (pr) => landOne(pr).catch((e) => ({ status: "failed", repo: "", pr, base: "", error: e.message }));
-  return Promise.all(prs.map(async (pr) => {
-    let result = await safe(pr);
-    if (prLandOutcome(result) === "ejected" && !result.pinnedHead) {
-      hooks?.onRetry?.(pr, result);
-      result = { ...await safe(pr), retriedAfterEjection: true };
-    }
-    const outcome = prLandOutcome(result);
-    const cleaned = result.status === "merged-via-queue" ? await cleanup(result).catch((e) => `cleanup failed: ${e.message}`) : void 0;
-    hooks?.onDone?.();
-    return { pr, outcome, result, ...cleaned ? { cleanup: cleaned } : {} };
-  }));
-}
-function renderPrLandTable(entries) {
-  const rows = entries.map((e) => [
-    `#${e.pr}`,
-    e.outcome + (e.result.retriedAfterEjection ? " (after retry)" : ""),
-    [e.result.error, e.cleanup].filter(Boolean).join(" | ") || "-"
-  ]);
-  const width = (i) => Math.max(...rows.map((r) => r[i].length));
-  return rows.map((r) => `${r[0].padEnd(width(0))}  ${r[1].padEnd(width(1))}  ${r[2]}`).join("\n");
-}
-function landCredentials(results) {
-  const each = results.map((r) => r.credential ?? "unknown");
-  return { each, overall: each.length === 0 ? "unknown" : new Set(each).size === 1 ? each[0] : "mixed" };
-}
-
 // src/git-worktree-observation.ts
 function parseGitWorktreePorcelain(text) {
   const rows = [];
@@ -59270,7 +59448,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
   }
   class PrHeadBehindBaseError extends Error {
   }
-  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "silence the leftover-scratch warning (scratch never blocks, #8785) and acknowledge a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 the queue's own check timeout is 60)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
+  pr.command("land <numbers...>").description("agent merge path (#1440): train probe \u2014 checks-wait \u2014 merge --auto \u2014 poll enqueued \u2014 development PRs only. Several PR numbers land together (#8322): all are enqueued, waited on together, a queue-ejected PR is updated and re-enqueued once, a queue merge is followed by worktree/branch cleanup and board Done, and one table (or --json) reports each outcome").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--enqueue-only", "return once queue membership is confirmed; without a merge queue, land normally").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--force", "silence the leftover-scratch warning (scratch never blocks, #8785) and acknowledge a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").option("--without-review <reason>", "compatibility option; shared merge helpers do not require a review verdict").option("--timeout <minutes>", `merge-queue wait per PR (default ${PR_LAND_QUEUE_TIMEOUT_MS / 6e4} minutes, one window per ${PR_LAND_QUEUE_BATCH_SIZE} PRs \u2014 per-repo ruleset check_response_timeout_minutes is 15 default with 30/45/60 overrides in .github/rulesets/mmi-development-merge-queue.json; agents never edit the ruleset to shorten a queue wait)`).option("--preserve-worktree", "after a queue merge keep the local worktree and branch (skips the post-merge cleanup)").option("--expect-head <sha>", "pin the PR head to this full 40-hex SHA (#8456): checked before landing, after checks and by GitHub at enqueue (--match-head-commit); never updates a BEHIND head and never retries an ejection \u2014 it stops with pinnedHead.refused instead. One PR only").action(async (numbers, opts) => {
     const timeoutMinutes = opts.timeout === void 0 ? void 0 : Number(opts.timeout);
     if (timeoutMinutes !== void 0 && !(timeoutMinutes > 0)) return fail("pr land: --timeout must be a positive number of minutes");
     if (opts.expectHead !== void 0) {
@@ -59316,7 +59494,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         pollDelayMs: (attempt) => prLandPollDelayMs(attempt, inFlight),
         hasMergeQueue: hasPrMergeQueue,
         enqueueQueue: async (prNumber, repo, expectedHeadOid) => {
-          const receipt = await enqueuePrMergeQueue(prNumber, repo, { expectedHeadOid, force: o.force });
+          const receipt = await enqueuePrMergeQueue(prNumber, repo, { expectedHeadOid, force: o.force, enqueueOnly: o.enqueueOnly });
           if (receipt.warning) console.warn(receipt.warning);
           return receipt;
         },
@@ -59505,6 +59683,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
       return `cleanup ${c.mergeStatus ?? "unknown"}: worktree ${part(c.worktree)}, branch ${part(c.localBranch)}`;
     };
     const entries = await landMany(numbers, landOne, cleanupMerged, {
+      baseRedCheck: (_pr, r) => readBaseRedVerdict(r),
       onRetry: (pr2, r) => console.warn(`pr land: queue ejected PR #${pr2} (${r.error}) \u2014 landing it once more (head updated from base if behind)`),
       onDone: () => {
         inFlight = Math.max(1, inFlight - 1);
@@ -62545,8 +62724,47 @@ function adoptExportProdDeps() {
     }
   };
 }
+var PACKAGE_ORG = "mutmutco";
+var PACKAGE_REGISTRY = "https://npm.pkg.github.com";
+function normalizeOrgPackageName(raw) {
+  const trimmed = raw.trim().replace(/^@mutmutco\//, "");
+  if (!/^[a-z0-9][a-z0-9._-]*$/i.test(trimmed)) {
+    throw new Error(`--package must be a @mutmutco/<name> or <name> package slug (received '${raw}')`);
+  }
+  return { short: trimmed, full: `@${PACKAGE_ORG}/${trimmed}` };
+}
+async function listPackageVersions(opts, deps) {
+  const { short: short3, full } = normalizeOrgPackageName(opts.package);
+  const limit = opts.limit ?? 5;
+  if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+    throw new Error(`--limit must be an integer from 1 to 100 (received '${String(opts.limit)}')`);
+  }
+  const raw = (await deps.ghApi(`orgs/${PACKAGE_ORG}/packages/npm/${encodeURIComponent(short3)}/versions?per_page=${limit}`)).toString("utf8");
+  const parsed = JSON.parse(raw);
+  if (!Array.isArray(parsed)) {
+    throw new Error(`unexpected GitHub Packages response for ${full}`);
+  }
+  const versions = parsed.slice(0, limit).map((entry) => ({
+    version: String(entry?.name ?? ""),
+    publishedAt: typeof entry?.created_at === "string" ? entry.created_at : typeof entry?.updated_at === "string" ? entry.updated_at : null
+  }));
+  return { package: full, registry: PACKAGE_REGISTRY, versions };
+}
 function registerPackagesCommands(program3) {
-  const packages = program3.command("packages").description("consumer adoption of verified package exports (#7833)");
+  const packages = program3.command("packages").description("GitHub Packages version lookup and consumer adoption of verified package exports (#7833, #9542)");
+  packages.command("versions").description("list newest-first published versions of a @mutmutco/* npm package from GitHub Packages (orgs/mutmutco/packages/npm/<pkg>/versions; never bare npm view)").option("--package <pkg>", "@mutmutco/<pkg> or <pkg> name on GitHub Packages", "mmwork-ds").option("--limit <n>", "maximum number of versions to return (1-100)", "5").option("--json", "machine-readable output").action(async (opts) => {
+    const limit = /^[1-9]\d*$/.test(opts.limit.trim()) ? Number(opts.limit.trim()) : NaN;
+    try {
+      const res = await listPackageVersions({ package: opts.package, limit }, adoptExportProdDeps());
+      if (opts.json) {
+        console.log(JSON.stringify(res, null, 2));
+      } else {
+        for (const v of res.versions) console.log(`${v.version}	${v.publishedAt ?? ""}`);
+      }
+    } catch (error) {
+      fail(`packages versions refused: ${error.message}`);
+    }
+  });
   packages.command("adopt-export").description("verify a package-export artifact and install its exact kit pair offline, keeping registry URLs and SRI in the lock").requiredOption("--run <id>", "package-export workflow run id").requiredOption("--artifact <id>", "artifact id from the run summary").requiredOption("--digest <sha256:hex>", "artifact digest from the run summary").requiredOption("--ds <version>", "exact @mutmutco/mmwork-ds version").requiredOption("--screens <version>", "exact @mutmutco/mmwork-screens version").option("--dir <path>", "npm project holding package.json and package-lock.json", ".").action(async (opts) => {
     const id = (value, flag) => {
       if (!/^[1-9][0-9]{0,15}$/.test(value)) fail(`${flag} must be a numeric id`);
@@ -65792,7 +66010,7 @@ var RELEASE_LIST_QUERY_VALUE = { per_page: RUNS_QUERY_VALUE.per_page, page: RUNS
 var RELEASE_LATEST_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/latest$`);
 var RELEASE_TAG_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/tags/(${NAME})$`);
 var RELEASE_ASSET_RE = new RegExp(`^repos/${NAME}/${NAME}/releases/assets/\\d+$`);
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/issues/comments/{id}, repos/{owner}/{repo}/issues/{n}/comments[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs, repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs, repos/{owner}/{repo}/actions/runs/{id}/artifacts, repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/issues/comments/{id}, repos/{owner}/{repo}/issues/{n}/comments[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs[?per_page=1-100&page=<n>&status=&branch=&event=&head_sha=<40-hex>&created=<date-range>&actor=, each key at most once], repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/attempts/{n}/jobs[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/runs/{id}/artifacts[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/actions/artifacts/{id}/zip (needs --out <file>), repos/{owner}/{repo}/actions/jobs/{id}/logs (needs --out <file>), repos/{owner}/{repo}/releases[?per_page=1-100&page=<n>, each key at most once], repos/{owner}/{repo}/releases/latest, repos/{owner}/{repo}/releases/tags/{tag}, repos/{owner}/{repo}/releases/assets/{id} (needs --out <file>)";
 var API_GET_RECOVERY = " No other GET read exists \u2014 do not retry path variants; use a dedicated mmi-cli subcommand or ask a human token holder. This refusal exits 1 on stderr with nothing on stdout: check the exit code and never merge stderr into stdout (2>&1) before JSON-parsing.";
 var TYPED_READ_ROUTE_RE = new RegExp(`^repos/(${NAME})/(${NAME})/(issues|pulls)(?:/(comments/\\d+|\\d+)(?:/([a-z_]+))?)?$`);
 function typedReadHint(path2) {
@@ -65829,7 +66047,7 @@ function orgScopedHint(path2) {
   if (!match) return "";
   const org = match[1];
   const runners = /^orgs\/[^/?#]+\/actions\/runners(?:\/|$)/.test(path2.split("?")[0]);
-  const surface = runners ? `Runner/lane state has no App-token read: a human token holder answers it with \`gh api orgs/${org}/actions/runners\` (docs/Guides/gh-runner-runbook.md).` : "It needs a human token holder with an org-scoped token, or a dedicated mmi-cli verb when one exists for this resource.";
+  const surface = runners ? `For which lane is busy in a repo, use the App-token reads \`mmi-cli devops read run list --repo <owner>/<repo> --status in_progress --json databaseId,workflowName\` followed by \`mmi-cli devops read run view <id> --repo <owner>/<repo> --json jobs\` (runner-name/status per job); fleet-wide runner online/offline state has no App-token read and a human token holder answers it with \`gh api orgs/${org}/actions/runners\` (docs/Guides/gh-runner-runbook.md).` : "It needs a human token holder with an org-scoped token, or a dedicated mmi-cli verb when one exists for this resource.";
   return ` This route is ORG-SCOPED (\`orgs/${org}/...\`) and is deliberately outside the allowlist \u2014 no App-token read exists for org-level resources, so retrying path variants cannot work and no \`repos/{owner}/{repo}/...\` respelling of it will be accepted. ${surface} A refusal writes nothing to stdout: check the exit code and never merge stderr into the JSON pipe (2>&1).`;
 }
 function tagsReadHint(path2) {
@@ -65861,8 +66079,8 @@ function parseApiGetPath(rawPath) {
   if (COMPARE_RE.test(path2)) return { kind: "compare", path: path2, paginate: false };
   if (ACTIONS_RUNS_RE.test(base) && (q === -1 || validRunsQuery(query))) return { kind: "actions-runs", path: path2, paginate: false };
   if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
-  if (ACTIONS_JOBS_RE.test(path2)) return { kind: "actions-jobs", path: path2, paginate: true };
-  if (ACTIONS_ARTIFACTS_RE.test(path2)) return { kind: "actions-artifacts", path: path2, paginate: true };
+  if (ACTIONS_JOBS_RE.test(base) && (q === -1 || validRunsQuery(query, RELEASE_LIST_QUERY_VALUE))) return { kind: "actions-jobs", path: path2, paginate: q === -1 };
+  if (ACTIONS_ARTIFACTS_RE.test(base) && (q === -1 || validRunsQuery(query, RELEASE_LIST_QUERY_VALUE))) return { kind: "actions-artifacts", path: path2, paginate: q === -1 };
   if (ACTIONS_ARTIFACT_ZIP_RE.test(path2)) return { kind: "actions-artifact-zip", path: path2, paginate: false };
   if (ACTIONS_JOB_LOGS_RE.test(path2)) return { kind: "actions-job-logs", path: path2, paginate: false };
   if (RELEASE_LIST_RE.test(base) && (q === -1 || validRunsQuery(query, RELEASE_LIST_QUERY_VALUE))) return { kind: "release-list", path: path2, paginate: false };
@@ -68716,7 +68934,7 @@ function registerDeveloperCommands(program3) {
   async function runWhoami(io = consoleIo) {
     const cfg = await loadConfig();
     const report = await resolveWhoami({
-      hubSession: () => hubAuthSession({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), githubToken }),
+      hubSession: () => hubAuthSession({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), githubToken: githubPersonalToken }),
       ghLogin: githubLogin
     });
     io.log(JSON.stringify(report));
@@ -68727,7 +68945,7 @@ function registerDeveloperCommands(program3) {
   });
   whoami.command("diagnose-hub").description("bounded cache-free Hub issuance diagnostic").action(async () => {
     const cfg = await loadConfig();
-    const report = await diagnoseHub({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), resolve: githubToken, fetch });
+    const report = await diagnoseHub({ baseUrl: cfg.sagaApiUrl ?? defaultHubUrl(), resolve: githubPersonalToken, fetch });
     consoleIo.log(JSON.stringify(report));
     if (report.category !== "issued") process.exitCode = 1;
   });