@mutmutco/codex-plugin 4.6.8 → 4.6.10

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.8",
+  "version": "4.6.10",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -1236,7 +1236,7 @@ var init_house_map = __esm({
       api: "devops",
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       run: "devops",
-      // #9479: one named workflow run — currently the bounded `run cancel <id>` write
+      // #9479: one named workflow run — the bounded `run cancel <id>` and `run rerun <id>` writes
       ci: "devops",
       // the CI/gate audit
       jev: "devops",
@@ -15347,7 +15347,12 @@ var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
   ["ci cancel-orphans", { metadata: "read", actions: "write" }],
   // #9479: one named run cancelled under the same actions:write profile as the orphan sweep.
   ["run cancel", { metadata: "read", actions: "write" }],
+  // #9587: one named run rerun (all or failed jobs) — same actions:write profile, nothing broader.
+  ["run rerun", { metadata: "read", actions: "write" }],
   ["issue comment", { metadata: "read", issues: "write", pull_requests: "write" }],
+  // #9614: closing an issue is an issue-state write — it rides the org App (mmi-github-app), so the close
+  // is attributed to the App instead of the personal account. Nothing broader than issues.
+  ["issue close", { metadata: "read", issues: "write" }],
   // #8401: the detached related-issue lookup (issue list/view reads + one marker comment) — no identity contract.
   ["issue discover-related", { metadata: "read", issues: "write" }]
 ]);
@@ -15736,6 +15741,13 @@ function decidePrMergeNoCiGuard(checks, policyReason = "registry META ci:none")
     ].join(" ")
   };
 }
+function pendingEvidenceItems(evidence) {
+  const items = evidence.checks.filter((check) => check.state === "pending").map((check) => `${check.name} (${check.status ?? "unknown"}${check.conclusion ? `/${check.conclusion}` : ""}, startedAt=${check.startedAt ?? "null"}, appId=${check.appId ?? "null"})`);
+  for (const run of evidence.workflows) {
+    if (run.status !== "completed") items.push(`${run.name}#${run.id} (${run.status})`);
+  }
+  return items;
+}
 async function waitForPrChecks(deps) {
   let { policy, reason } = await deps.resolvePolicy();
   const baseBranch = deps.baseBranch ?? "development";
@@ -15766,10 +15778,10 @@ async function waitForPrChecks(deps) {
   const timeoutMs = deps.timeoutMs ?? PR_CHECKS_TIMEOUT_MS;
   const started = now();
   const deadline = started + timeoutMs;
-  const report = (state) => {
+  const report = (state, detail) => {
     try {
       const elapsedMs = now() - started;
-      deps.progress?.({ state, elapsedMs, remainingMs: Math.max(0, deadline - now()) });
+      deps.progress?.({ state, elapsedMs, remainingMs: Math.max(0, deadline - now()), ...detail === void 0 ? {} : { detail } });
     } catch {
     }
   };
@@ -15779,6 +15791,10 @@ async function waitForPrChecks(deps) {
   let zeroRunsStreak = 0;
   let evidenceHeadSha;
   let lastEvidence;
+  const pendingWaitDetail = (evidence) => {
+    const items = pendingEvidenceItems(evidence);
+    return items.length ? `pending (${items.join(", ")})` : void 0;
+  };
   report("starting");
   while (now() < deadline) {
     if (deps.pollRateLimit) {
@@ -15843,7 +15859,7 @@ async function waitForPrChecks(deps) {
       await deps.sleep(waitMs);
       continue;
     }
-    report(state);
+    report(state, state === "pending" && lastEvidence ? pendingWaitDetail(lastEvidence) : void 0);
     if (state !== "success") successStreak = 0;
     if (state !== "failure") failureStreak = 0;
     if (state !== "no-checks-reported") zeroRunsStreak = 0;
@@ -15919,10 +15935,18 @@ async function waitForPrChecks(deps) {
       await deps.sleep(pollIntervalMs(now() - started));
       continue;
     }
-    lastDetail = state;
+    const pendingDetail = state === "pending" && lastEvidence ? pendingWaitDetail(lastEvidence) : void 0;
+    lastDetail = pendingDetail ?? state;
     await deps.sleep(pollIntervalMs(now() - started));
   }
-  return { policy, status: "timeout", reason, detail: lastDetail, waitedMs: now() - started };
+  return {
+    policy,
+    status: "timeout",
+    reason,
+    detail: lastDetail,
+    waitedMs: now() - started,
+    ...lastEvidence ? { headSha: lastEvidence.headSha, checks: lastEvidence.checks, workflowRuns: lastEvidence.workflows } : {}
+  };
 }
 
 // src/release-auxiliary-workflows.ts
@@ -16392,16 +16416,23 @@ async function fetchHeadCheckRuns(headSha, repo, gh2) {
   const runsOut = await gh2(["--paginate", `repos/${repo}/commits/${headSha}/check-runs?per_page=100`, "--jq", ".check_runs[] | {id, name, status, conclusion, app_id: .app.id, details_url, started_at, completed_at}"]);
   return dedupeLatestCheckRuns(parseNdjsonLines(runsOut));
 }
-async function fetchHeadCheckEntries(headSha, repo, gh2) {
+async function fetchHeadCheckEntriesWithRuns(headSha, repo, gh2) {
   const [runs2, statusesOut] = await Promise.all([
     fetchHeadCheckRuns(headSha, repo, gh2),
     gh2(["--paginate", `repos/${repo}/commits/${headSha}/status?per_page=100`, "--jq", ".statuses[] | {context, state, target_url, description}"])
   ]);
   const statuses = parseNdjsonLines(statusesOut);
-  return [
-    ...runs2.filter((run) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(run.name ?? "")).map((run) => ({ name: run.name ?? `check-run ${run.id ?? "unknown"}`, bucket: classifyCheckRun(run) })),
-    ...statuses.filter((s) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(s.context ?? "")).map((s) => ({ name: s.context ?? "unknown-status", bucket: classifyCommitStatus(s.state) }))
-  ];
+  return {
+    runs: runs2,
+    statuses,
+    entries: [
+      ...runs2.filter((run) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(run.name ?? "")).map((run) => ({ name: run.name ?? `check-run ${run.id ?? "unknown"}`, bucket: classifyCheckRun(run) })),
+      ...statuses.filter((s) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(s.context ?? "")).map((s) => ({ name: s.context ?? "unknown-status", bucket: classifyCommitStatus(s.state) }))
+    ]
+  };
+}
+async function fetchHeadCheckEntries(headSha, repo, gh2) {
+  return (await fetchHeadCheckEntriesWithRuns(headSha, repo, gh2)).entries;
 }
 async function pollRestPrChecks(prNumber, repo, gh2 = defaultGhApi, requiredContexts) {
   const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh2);
@@ -16409,38 +16440,68 @@ async function pollRestPrChecks(prNumber, repo, gh2 = defaultGhApi, requiredCont
   const { relevant } = partitionByRequired(entries, requiredContexts);
   return derivePollState(relevant);
 }
-async function pollRestPrChecksWithWorkflowEvidence(prNumber, repo, gh2 = defaultGhApi) {
-  const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh2);
-  const [entries, rawRuns] = await Promise.all([
-    fetchHeadCheckEntries(snapshot.headSha, repo, gh2),
-    gh2(["--paginate", `repos/${repo}/actions/runs?head_sha=${encodeURIComponent(snapshot.headSha)}&per_page=100`, "--jq", ".workflow_runs[] | {id, name, head_sha, status, conclusion, html_url}"])
+async function pollRestHeadChecksWithWorkflowEvidence(headSha, repo, gh2) {
+  const [{ runs: runs2, statuses }, rawRuns] = await Promise.all([
+    fetchHeadCheckEntriesWithRuns(headSha, repo, gh2),
+    gh2(["--paginate", `repos/${repo}/actions/runs?head_sha=${encodeURIComponent(headSha)}&per_page=100`, "--jq", ".workflow_runs[] | {id, name, head_sha, status, conclusion, html_url}"])
   ]);
-  const checks = entries.filter((entry) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(entry.name)).map((entry) => ({ name: entry.name, state: entry.bucket }));
   const workflows = parseNdjsonLines(rawRuns).flatMap((run) => {
-    if (run.head_sha !== snapshot.headSha || typeof run.id !== "number" || typeof run.name !== "string" || typeof run.status !== "string") return [];
+    if (run.head_sha !== headSha || typeof run.id !== "number" || typeof run.name !== "string" || typeof run.status !== "string") return [];
     if (AUXILIARY_RELEASE_CHECK_CONTEXTS.has(run.name)) return [];
     return [{
       id: run.id,
       name: run.name,
-      headSha: snapshot.headSha,
+      headSha,
       status: run.status,
       conclusion: typeof run.conclusion === "string" ? run.conclusion : null,
       ...typeof run.html_url === "string" ? { url: run.html_url } : {}
     }];
   });
-  const workflowBuckets = workflows.map((run) => {
+  const workflowById = new Map(workflows.map((run) => [run.id, run]));
+  const isStalePendingCheckRun = (run) => {
+    if (classifyCheckRun(run) !== "pending") return false;
+    const match = /\/actions\/runs\/(\d+)(?:\/|$)/.exec(run.details_url ?? "");
+    const owning = match ? workflowById.get(Number(match[1])) : void 0;
+    if (!owning) return false;
+    if (owning.status === "completed") return true;
+    return workflows.some((newer) => newer.id > owning.id && newer.name === owning.name && newer.status === "completed");
+  };
+  const checks = [
+    ...runs2.filter((run) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(run.name ?? "")).filter((run) => !isStalePendingCheckRun(run)).map((run) => ({
+      name: run.name ?? `check-run ${run.id ?? "unknown"}`,
+      state: classifyCheckRun(run),
+      ...run.status !== void 0 ? { status: run.status } : {},
+      conclusion: run.conclusion ?? null,
+      startedAt: run.started_at ?? null,
+      appId: run.app_id ?? null
+    })),
+    ...statuses.filter((s) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(s.context ?? "")).map((s) => ({ name: s.context ?? "unknown-status", state: classifyCommitStatus(s.state) }))
+  ];
+  const newestRunByName = /* @__PURE__ */ new Map();
+  for (const run of workflows) {
+    const current = newestRunByName.get(run.name);
+    if (!current || run.id > current.id) newestRunByName.set(run.name, run);
+  }
+  const workflowBuckets = [...newestRunByName.values()].map((run) => {
     if (run.status !== "completed") return "pending";
     return run.conclusion === "success" || run.conclusion === "neutral" || run.conclusion === "skipped" ? "pass" : "fail";
   });
   return {
     state: derivePollState([...checks.map((check) => check.state), ...workflowBuckets]),
-    headSha: snapshot.headSha,
+    headSha,
     checks,
     workflows
   };
 }
+async function pollRestPrChecksWithWorkflowEvidence(prNumber, repo, gh2 = defaultGhApi) {
+  const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh2);
+  return pollRestHeadChecksWithWorkflowEvidence(snapshot.headSha, repo, gh2);
+}
+async function pollRestCommitChecksWithWorkflowEvidence(sha, repo, gh2 = defaultGhApi) {
+  return pollRestHeadChecksWithWorkflowEvidence(sha, repo, gh2);
+}
 async function pollRestCommitChecks(sha, repo, gh2 = defaultGhApi) {
-  return derivePollState(partitionByRequired(await fetchHeadCheckEntries(sha, repo, gh2), null).relevant);
+  return (await pollRestCommitChecksWithWorkflowEvidence(sha, repo, gh2)).state;
 }
 var GH_ZERO_TIME = "0001-01-01T00:00:00Z";
 var GH_PR_CHECKS_JSON_FIELDS = ["bucket", "completedAt", "description", "link", "name", "startedAt", "state"];
@@ -21016,8 +21077,9 @@ function resolveSpawnTarget(command, args, platform2 = process.platform) {
   if (platform2 !== "win32") return { cmd: command, args };
   for (const t of [command, ...args]) {
     if (/[\r\n]/.test(t)) {
+      const preview = JSON.stringify(t.length > 80 ? `${t.slice(0, 77)}...` : t);
       throw new Error(
-        `cannot spawn safely on Windows: cmd.exe truncates at a newline, even quoted: ${JSON.stringify(t)}`
+        `cannot spawn safely on Windows: cmd.exe truncates at a newline, even quoted: ${preview} \u2014 write the multiline script to a git-ignored file and run \`mmi-cli vault secrets use <KEY> -- node .jerv/tmp/<script>.mjs\` (#6048)`
       );
     }
   }
@@ -22317,8 +22379,22 @@ function renderBoardItem(item) {
   }
   return lines2.join("\n");
 }
+function renderCachedBoardSource(report) {
+  if (typeof report.stale?.ageMs === "number") {
+    const ageSeconds = Math.floor(report.stale.ageMs / 1e3);
+    return `source: cache \xB7 built ${report.builtAt ? `${report.builtAt} (${ageSeconds}s old)` : `${ageSeconds}s ago`} \xB7 stale`;
+  }
+  if (report.builtAt) {
+    const builtMs = Date.parse(report.builtAt);
+    if (Number.isFinite(builtMs)) {
+      return `source: cache \xB7 built ${report.builtAt} (${Math.max(0, Math.floor((Date.now() - builtMs) / 1e3))}s old) \xB7 fresh`;
+    }
+    return `source: cache \xB7 built ${report.builtAt} \xB7 fresh`;
+  }
+  return "source: cache";
+}
 function renderBoardReport(report) {
-  const lines2 = [`Board \xB7 ${report.project.title} \xB7 @${report.viewer}`, report.source === "cache" ? "source: cache" : renderBoardSource()];
+  const lines2 = [`Board \xB7 ${report.project.title} \xB7 @${report.viewer}`, report.source === "cache" ? renderCachedBoardSource(report) : renderBoardSource()];
   if (report.github?.rateLimit) {
     const { limit, remaining, cost, resetAt } = report.github.rateLimit;
     lines2.push(`github: app installation \xB7 GraphQL ${remaining}/${limit} remaining \xB7 cost ${cost} \xB7 resets ${resetAt}`);
@@ -23574,7 +23650,7 @@ var contestedBoardReadCommand = (repo) => `mmi-cli oracle board read --json${rep
 function contestedClaimRecovery(ref) {
   const repo = /^([^/\s#]+\/[^/\s#]+)#\d+$/.exec(ref)?.[1];
   const boardRead = contestedBoardReadCommand(repo);
-  return `${CONTESTED_CLAIM_RECOVERY}; recovery order: refresh the board read (${boardRead}), then choose an item from its claimable list, or coordinate a handoff with the holder before using --force; list free items with: ${boardRead} and pick from its claimable list`;
+  return `${CONTESTED_CLAIM_RECOVERY}; recovery order: refresh the board read (${boardRead}), then choose an item from its claimable list, or coordinate a handoff with the holder before using --force`;
 }
 function laneContestMessage(ref, contest, verb) {
   const { holder, why } = laneContestParts(contest);
@@ -23592,6 +23668,7 @@ function ghError(e) {
 init_github_client();
 init_github_quota();
 var CLAIM_CONCURRENCY = 5;
+var VERIFIED_FREE_CANDIDATE_LIMIT = 5;
 function withGatedWriteChainHint(message2) {
   return `${message2}
 note: run refused writes separately or join dependent commands with '&&'; a ';' chain continues after failure`;
@@ -23852,9 +23929,16 @@ async function claimOneBoardItem(ctx, selector, options) {
         const { holder: holder2, why } = laneContestParts(contest);
         throw new Error(isUnknownHold(contest) ? `${item.ref} cannot be verified as free: ${holder2} (${why}); the liveness reads failed so the claim is refused fail-closed \u2014 ${CONTESTED_CLAIM_RECOVERY}` : `${item.ref} is already claimed by ${holder2} with live evidence of active work (${why}); ${CONTESTED_CLAIM_RECOVERY}`);
       }
-      const candidateRefs = [...report.primary.claimable, ...report.secondary.claimable].filter((candidate) => candidate.contentType === "Issue" && candidate.state === "OPEN" && !candidate.claim?.currentlyClaimed && !ctx.selectedRefs.has(candidate.ref.toLowerCase())).map((candidate) => candidate.ref);
-      const alternatives = candidateRefs.length ? `Board snapshot candidates (not guaranteed free): ${candidateRefs.join(", ")}` : "Board snapshot candidates: none in this read";
-      const refusal = `${laneContestMessage(item.ref, contest, "claim")}. ${alternatives}; refresh mmi-cli oracle board read before claiming.`;
+      const candidates = [...report.primary.claimable, ...report.secondary.claimable].filter((candidate) => candidate.contentType === "Issue" && candidate.state === "OPEN" && !candidate.claim?.currentlyClaimed && !ctx.selectedRefs.has(candidate.ref.toLowerCase())).slice(0, VERIFIED_FREE_CANDIDATE_LIMIT);
+      const verifiedFreeRefs = [];
+      for (const candidate of candidates) {
+        const candidateContest = await checkLaneContest(client, candidate, ctx.session, report.viewer, ctx.appClient, ctx.landing).catch(() => void 0);
+        if (candidateContest && !candidateContest.contested && candidateContest.unverifiable.length === 0) {
+          verifiedFreeRefs.push(candidate.ref);
+        }
+      }
+      const alternatives = verifiedFreeRefs.length ? `Next verified free item: \`mmi-cli oracle board claim ${verifiedFreeRefs[0]}\`${verifiedFreeRefs.length > 1 ? ` (also free: ${verifiedFreeRefs.slice(1).join(", ")})` : ""}` : `Verified free items in this read: none \u2014 refresh \`mmi-cli oracle board read --json --repo ${report.repo}\` or coordinate a handoff`;
+      const refusal = `${laneContestMessage(item.ref, contest, "claim")}. ${alternatives}`;
       throw new Error(withGatedWriteChainHint(refusal));
     }
     previousHolder = displaced();
@@ -25039,10 +25123,15 @@ function checkRunbookCoverage(docs, base, git3) {
       const heading = headings[i];
       const end = headings.slice(i + 1).find((h) => h.level <= heading.level)?.start ?? lines2.length + 1;
       const markerEnd = headings[i + 1]?.start ?? end;
-      const globs = lines2.slice(heading.start, markerEnd - 1).flatMap((text) => /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim()) ?? []);
+      const markers = lines2.slice(heading.start, markerEnd - 1).flatMap((text, j) => {
+        const found = /<!--\s*runbook-covers:\s*(.*?)\s*-->/.exec(text)?.[1].split(",").map((s) => s.trim());
+        return found ? [{ line: heading.start + 1 + j, globs: found }] : [];
+      });
+      const globs = markers.flatMap((m) => m.globs);
       const affected = changed.filter((path2) => globs.some((glob) => matches(glob, path2)) && !changesOnlyUses(path2));
       if (affected.length && !ranges.some((r) => r.count > 0 && r.start < end && r.start + r.count > heading.start)) {
-        findings.push({ kind: "runbook-section-stale", doc, line: heading.start, detail: `${heading.title} (lines ${heading.start}\u2013${end - 1}): changed ${affected.join(", ")}; update this section's text (lines ${heading.start}\u2013${end - 1}) or runbook-covers list, or add a \`Runbook-Unaffected: <reason>\` trailer to a commit message in this PR`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1, covers: globs }, sources: affected });
+        const markerLine = markers.find((m) => m.globs.some((glob) => affected.some((path2) => matches(glob, path2)))).line;
+        findings.push({ kind: "runbook-section-stale", doc, line: markerLine, detail: `${heading.title} (lines ${heading.start}\u2013${end - 1}, covers marker at line ${markerLine}): changed ${affected.join(", ")}; update this section's text (lines ${heading.start}\u2013${end - 1}) or runbook-covers list, or add a \`Runbook-Unaffected: <reason>\` trailer to a commit message in this PR`, section: { heading: heading.title, level: heading.level, startLine: heading.start, endLine: end - 1, covers: globs }, sources: affected });
       }
     }
   }
@@ -27506,10 +27595,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.8",
-    tag: "v4.6.8",
-    commit: "0dd075a0d2c1",
-    npm: "@mutmutco/cli@4.6.8"
+    version: "4.6.10",
+    tag: "v4.6.10",
+    commit: "a4bbe43232e9",
+    npm: "@mutmutco/cli@4.6.10"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27526,14 +27615,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.8"
+          v3Target: "v4.6.10"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.8 and redeploy the Hub Lambda from tag v4.6.8 (0dd075a0d2c1); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.8 (@mutmutco/cli@4.6.8, tag commit 0dd075a0d2c1 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.10 and redeploy the Hub Lambda from tag v4.6.10 (a4bbe43232e9); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.10 (@mutmutco/cli@4.6.10, tag commit a4bbe43232e9 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -32106,8 +32195,11 @@ function classifyRunnerCost(selector) {
 }
 var STANDARD_HOSTED_ALLOWLIST = [
   ["mutmutco/MMI-Hub", ".github/workflows/launcher-build.yml", "build", "windows-latest"],
-  ["mutmutco/Jerv-JervCode", ".github/workflows/release-archives.yml", "release-platform-arm64", "windows-11-arm"]
+  ["mutmutco/Jerv-JervCode", ".github/workflows/release-archives.yml", "release-platform-arm64", "windows-11-arm"],
+  // #9571 (MM-Work#8894 chooser): owned mmi-heavy first, included ubuntu-latest only on a deep backlog.
+  ["mutmutco/MMI-Hub", ".github/workflows/gate.yml", "cli-part", "hosted-spill"]
 ];
+var HOSTED_SPILL_RE = /^\$\{\{\s*(?:matrix\.[\w-]+\s*==\s*'[\w-]+'\s*&&\s*'([^']+)'\s*\|\|\s*)?fromJSON\(needs\.[\w-]+\.outputs\.heavy_runs_on\s*\|\|\s*('[^']+')\)\s*\}\}$/;
 function standardHostedLabelFor(repo, path2, jobId) {
   if (repo === "mutmutco/Jerv-Hub") return ["ubuntu-latest", "windows-latest", "macos-14"];
   return STANDARD_HOSTED_ALLOWLIST.find(([r, p, j]) => r === repo && p === path2 && j === jobId)?.[3];
@@ -32122,6 +32214,8 @@ function classifyJobRunnerCost(job, allowance2) {
   if (approved(raw) || allowance2 === "windows-11-arm" && raw === allowance2) return "standard-hosted";
   const fallback = /^\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'([^']+)'\s*\|\|\s*(fromJSON\('[^']+'\))\s*\}\}$/.exec(raw);
   if (fallback && approved(fallback[1]) && classifyRunnerCost("${{ " + fallback[2] + " }}") === "self-hosted") return "standard-hosted";
+  const spill = allowance2 === "hosted-spill" ? HOSTED_SPILL_RE.exec(raw) : null;
+  if (spill) return (!spill[1] || spill[1] === "ubuntu-latest") && classifyRunnerCost(`\${{ fromJSON(${spill[2]}) }}`) === "self-hosted" ? "standard-hosted" : "unknown";
   const direct = classifyRunnerCost(raw);
   const matrix = /^\$\{\{\s*matrix\.([\w-]+)(?:\.([\w-]+))?\s*\}\}$/.exec(raw);
   if (!matrix || direct === "hosted") return direct;
@@ -38643,7 +38737,7 @@ function runsOnLabelSets(job) {
   if (plainRecord(selector)) selector = selector.labels;
   if (typeof selector !== "string" || !selector.includes("${{")) return [toSet(selector)].filter((s) => Boolean(s));
   const sets = [];
-  for (const m of selector.matchAll(/fromJSON\('([^']+)'\)/g)) {
+  for (const m of selector.matchAll(/fromJSON\((?:needs\.[\w-]+\.outputs\.[\w-]+\s*\|\|\s*)?'([^']+)'\)/g)) {
     try {
       const parsed = toSet(JSON.parse(m[1]));
       if (parsed) sets.push(parsed);
@@ -41250,7 +41344,18 @@ async function readGhPrStateWithRetry(fetchState, options) {
   }
   return { ok: false, error: lastError };
 }
+function isNoFailedCheckQueueEjection(run) {
+  return !run || run.conclusion === null || run.conclusion === "cancelled" || run.conclusion === "neutral" || run.conclusion === "skipped";
+}
 async function runPrLand(prNumber, options, deps) {
+  const first = await runPrLandOnce(prNumber, options, deps);
+  if (options.enqueueOnly || options.expectHead || first.status !== "failed") return first;
+  const queue = first.mergeQueue;
+  const nothingFailed = queue?.state === "timeout" || queue?.state === "ejected" && isNoFailedCheckQueueEjection(queue.ejectedRun);
+  if (!nothingFailed) return first;
+  return { ...await runPrLandOnce(prNumber, options, deps), retriedAfterEjection: true };
+}
+async function runPrLandOnce(prNumber, options, deps) {
   const resolved = await deps.resolveRepo(prNumber, options.repo);
   const { repo } = resolved;
   const base = { status: "failed", repo, pr: prNumber, base: resolved.base };
@@ -41296,6 +41401,18 @@ async function runPrLand(prNumber, options, deps) {
       base.mergeStatus = "auto-merge-enqueued";
       return pollPrMergeQueue(prNumber, options, deps, base, queueSnapshot);
     }
+    if (deps.preflightQueue) {
+      const preflight2 = await deps.preflightQueue(prNumber, repo, pinned);
+      if (preflight2 && preflight2.mergeStatus === "failed") {
+        const rawError = preflight2.error ?? "queue preparation needed";
+        return {
+          ...base,
+          mergeStatus: "failed",
+          ...preflight2.preparation ? { preparation: preflight2.preparation } : {},
+          error: !rawError.includes("read pr queue") ? `${rawError} \u2014 ${prQueueReadHint(prNumber, repo)}` : rawError
+        };
+      }
+    }
   }
   const checksWaitError = (checksWait) => {
     if (checksWait.status === "conflicting") {
@@ -41456,7 +41573,7 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
         ...base,
         mergeQueue: { ...base.mergeQueue, state: "ejected", ...run ? { ejectedRun: run } : {} },
         ...base.pinnedHead ? { pinnedHead: { ...base.pinnedHead, refused: "ejected" } } : {},
-        error: `merge queue ejected PR #${pr} \u2014 ${run ? `merge_group run ${run.id} ${run.conclusion} ${run.url}` : "merge_group run not found"}; ${prQueueReadHint(pr, base.repo)}`
+        error: `merge queue ejected PR #${pr} \u2014 ${run ? `merge_group run ${run.id} ${run.conclusion} ${run.url}` : "merge_group run not found"}; ${prQueueReadHint(pr, base.repo)}${isNoFailedCheckQueueEjection(run) ? `; no check failed \u2014 re-run \`mmi-cli devops pr land ${pr} --repo ${base.repo}\` once to re-enqueue, and if a land is refused again report the exact refusal verbatim (never fall back to a direct/admin merge or an \`MMI_ACTOR=personal\` landing workaround)` : ""}`
       };
       deps.queueProgress?.(result2);
       return result2;
@@ -41466,7 +41583,7 @@ async function pollPrMergeQueue(pr, options, deps, base, snapshot, deadlineMs) {
   const result = {
     ...base,
     mergeQueue: { ...base.mergeQueue, state: "timeout" },
-    error: `merge queue did not reach MERGED within ${Math.round(timeoutMs / 6e4)} minutes \u2014 ${prQueueReadHint(pr, base.repo)} and rerun pr land to resume polling`
+    error: `merge queue did not reach MERGED within ${Math.round(timeoutMs / 6e4)} minutes \u2014 ${prQueueReadHint(pr, base.repo)} and rerun \`mmi-cli devops pr land ${pr} --repo ${base.repo}\` once to resume/re-enqueue; if it still does not land, report the exact refusal verbatim (never bypass the ruleset or fall back to a direct/admin or \`MMI_ACTOR=personal\` merge)`
   };
   deps.queueProgress?.(result);
   return result;
@@ -41486,7 +41603,7 @@ async function landMany(prs, landOne, cleanup, hooks) {
   const safe = async (pr) => landOne(pr).catch((e) => ({ status: "failed", repo: "", pr, base: "", error: e.message }));
   return Promise.all(prs.map(async (pr) => {
     let result = await safe(pr);
-    if (prLandOutcome(result) === "ejected" && !result.pinnedHead) {
+    if (prLandOutcome(result) === "ejected" && !result.pinnedHead && !result.retriedAfterEjection) {
       const baseRed = await hooks?.baseRedCheck?.(pr, result).catch(() => void 0);
       if (baseRed) {
         result = { ...result, baseRed: { base: result.base, baseRunId: baseRed.baseRunId }, error: `base-red: failures already on ${result.base} (${baseRed.baseRunId})` };
@@ -41658,10 +41775,16 @@ function trailerBlockBreak(body, line) {
   const lines2 = String(body ?? "").split(/\r?\n/);
   const at = lines2.findIndex((candidate) => candidate.trim() === line);
   if (at === -1) return { after: "", before: "" };
+  let sawBlank = false;
   for (let i = at + 1; i < lines2.length; i += 1) {
     const next = lines2[i];
-    if (!next.trim()) continue;
-    if (/^[A-Za-z][A-Za-z0-9-]*:\s/.test(next)) return { after: "", before: "" };
+    if (!next.trim()) {
+      sawBlank = true;
+      continue;
+    }
+    if (/^[A-Za-z][A-Za-z0-9-]*:\s/.test(next)) {
+      return sawBlank ? { after: "", before: "", splitByBlankBefore: next.trim() } : { after: "", before: "" };
+    }
     return { after: next.trim(), before: "" };
   }
   let paraStart = at;
@@ -41681,7 +41804,10 @@ function clipParagraph(line) {
 }
 function invisibleTrailer(sha, line, body = "") {
   const broken = trailerBlockBreak(body, line);
-  const brokenDiagnostic = broken.after ? `  Broken by the paragraph after the trailer-shaped line, which ends git's final block:
+  const brokenDiagnostic = broken.splitByBlankBefore ? `  Broken by a blank line before the final trailer paragraph, so git only read the last paragraph as the trailer block:
+    ${clipParagraph(broken.splitByBlankBefore)}
+  Keep every Key: value trailer (e.g. ${TRAILER_KEY} and Runbook-Unaffected) in one contiguous final paragraph with no blank line between them.
+` : broken.after ? `  Broken by the paragraph after the trailer-shaped line, which ends git's final block:
     ${clipParagraph(broken.after)}
 ` : broken.before ? `  Broken by the non-trailer line before the trailer-shaped line, which prevents git from recognizing the final block:
     ${clipParagraph(broken.before)}
@@ -41701,9 +41827,11 @@ function invisibleTrailer(sha, line, body = "") {
   The nearest waiver wins, and it supersedes this one \u2014 no force-push, no re-filed branch.
   Diagnosis: git parsed no ${TRAILER_KEY} trailer for ${sha.slice(0, 8)} at all \u2014 read its own view first:
     git log -1 --format='%(trailers)' ${sha.slice(0, 8)}
-` + brokenDiagnostic + `  Forward fix, no hand-reformatting \u2014 let git build the block from one message:
+` + brokenDiagnostic + `  Forward fix, no hand-reformatting \u2014 let git build the block from one message. Run this
+  yourself, right now, in this worktree; it is not a blocker to report and it needs no human:
     git commit --allow-empty --trailer "${TRAILER_KEY}: <reason>"
-  That commit's message IS a valid final trailer block, so it is the nearest (winning) waiver.`
+  That commit's message IS a valid final trailer block, so it is the nearest (winning) waiver.
+  Re-run the policy receipt and the focused test command immediately after it.`
   };
 }
 function unknownScope(sha, unknown) {
@@ -42834,9 +42962,7 @@ ${list}
 Co-authored-by: GitHub <noreply@github.com>
 `;
 }
-async function enqueuePrMergeQueue(pr, repo, options = {}) {
-  if (!/^\d+$/.test(pr)) throw new Error("merge queue enqueue requires a PR number");
-  pr = pr.replace(/^0+(?=\d)/, "");
+async function inspectQueuePreparation(pr, repo, options) {
   const read = options.read ?? readApi;
   const queueRead = options.read ?? actorReadApi;
   const write = options.write ?? writeApi;
@@ -42848,14 +42974,14 @@ async function enqueuePrMergeQueue(pr, repo, options = {}) {
   const pull = metadata.pullRequest;
   if (!pull || !pull.id || !/^[a-f0-9]{40}$/i.test(pull.headRefOid)) throw new Error(`merge queue PR #${pr} identity unreadable`);
   const head = options.expectedHeadOid ?? pull.headRefOid;
-  if (head !== pull.headRefOid) return { mergeStatus: "failed", retryable: false, error: `merge queue head changed: expected ${head}, observed ${pull.headRefOid}` };
-  const stamp = (result2, selected = false, intentId) => {
+  if (head !== pull.headRefOid) return { kind: "settled", result: { mergeStatus: "failed", retryable: false, error: `merge queue head changed: expected ${head}, observed ${pull.headRefOid}` } };
+  const stamp = (result, selected = false, intentId) => {
     const credential = admissionCredential(repo, pr, head, options.receiptDirectory, selected, intentId);
-    return credential === "unknown" ? result2 : { ...result2, credential };
+    return credential === "unknown" ? result : { ...result, credential };
   };
-  if (pull.state === "MERGED") return stamp({ mergeStatus: "merged" });
-  if (pull.isInMergeQueue) return stamp({ mergeStatus: "auto-merge-enqueued" });
-  if (pull.state !== "OPEN") return { mergeStatus: "failed", error: `PR #${pr} is ${pull.state}; no queue submission` };
+  if (pull.state === "MERGED") return { kind: "settled", result: stamp({ mergeStatus: "merged" }) };
+  if (pull.isInMergeQueue) return { kind: "settled", result: stamp({ mergeStatus: "auto-merge-enqueued" }) };
+  if (pull.state !== "OPEN") return { kind: "settled", result: { mergeStatus: "failed", error: `PR #${pr} is ${pull.state}; no queue submission` } };
   const closing = [...pull.closingIssuesReferences.nodes.map((node) => node.number)];
   let page = pull.closingIssuesReferences.pageInfo;
   while (page.hasNextPage) {
@@ -42888,7 +43014,7 @@ async function enqueuePrMergeQueue(pr, repo, options = {}) {
       status: "preparation-needed",
       reason,
       issueTargets: targets.map((number) => `${repo}#${number}`),
-      nextAction: reason === "queue-message" ? "PR author: if the PR is meant to close these issues, add `Closes #N` to the PR body (`mmi-cli devops pr edit <pr> --body-file <path>`) and rerun pr land without pushing a new head; if they must stay open, remove the closing phrases from the source commit or PR text using Part of #N / Refs #N, then re-run checks and pr land with the prepared head. A queue cannot accept --squash-body-file." : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged."
+      nextAction: reason === "queue-message" ? `PR author: if PR #${pr} is meant to close ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"}, add ${targets.length ? targets.map((number) => `\`Closes #${number}\``).join(", ") : "`Closes #N`"} to the PR body (\`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) and rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\` without pushing a new head; if ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"} must stay open, remove the closing phrases from the source commit or PR text using ${targets.length ? targets.map((number) => `\`Part of #${number}\``).join(", ") : "`Part of #N`"} / ${targets.length ? targets.map((number) => `\`Refs #${number}\``).join(", ") : "`Refs #N`"}, then re-run checks and \`pr land\` with the prepared head. A queue cannot accept --squash-body-file.` : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged."
     },
     error: `queue preparation needed: ${detail}`
   });
@@ -42906,9 +43032,9 @@ async function enqueuePrMergeQueue(pr, repo, options = {}) {
     );
     method = legacy.mergeQueue?.configuration?.mergeMethod;
   }
-  if (!["SQUASH", "MERGE", "REBASE"].includes(method ?? "")) return preparation("queue-message-policy", [], "the effective queue merge method is unknown; no submission occurred");
+  if (!["SQUASH", "MERGE", "REBASE"].includes(method ?? "")) return { kind: "refused", result: preparation("queue-message-policy", [], "the effective queue merge method is unknown; no submission occurred") };
   if (method === "SQUASH" && (!["PR_TITLE", "COMMIT_OR_PR_TITLE"].includes(policy.title ?? "") || !["PR_BODY", "COMMIT_MESSAGES", "BLANK"].includes(policy.body ?? ""))) {
-    return preparation("queue-message-policy", [], "the repository squash-message policy is unreadable; no submission occurred");
+    return { kind: "refused", result: preparation("queue-message-policy", [], "the repository squash-message policy is unreadable; no submission occurred") };
   }
   const messages = parsed.commits;
   const headline = policy.title === "COMMIT_OR_PR_TITLE" && messages.length === 1 ? messages[0].headline : pull.title;
@@ -42925,7 +43051,7 @@ ${body}`;
 ${message2.body}`).join("\n\n");
     if (method === "MERGE") {
       if (!["PR_TITLE", "MERGE_MESSAGE"].includes(repository.merge_commit_title ?? "") || !["PR_TITLE", "PR_BODY", "BLANK"].includes(repository.merge_commit_message ?? "")) {
-        return preparation("queue-message-policy", [], "the repository merge-message policy is unreadable; no submission occurred");
+        return { kind: "refused", result: preparation("queue-message-policy", [], "the repository merge-message policy is unreadable; no submission occurred") };
       }
       if (repository.merge_commit_title === "PR_TITLE" || repository.merge_commit_message === "PR_TITLE") actualMessage += `
 
@@ -42947,19 +43073,22 @@ ${pull.body}`;
       ...findNegatedClosings(input.text, closing),
       ...findCrossRepoAmbiguousClosings(input.text, closing, repo)
     ])];
-    return preparation("queue-message", targets, `GitHub's unchanged ${policy.body} message is unsafe for ${targets.map((number) => `${repo}#${number}`).join(", ")}. ${verdict.message}`);
+    return { kind: "refused", result: preparation("queue-message", targets, `GitHub's unchanged ${policy.body} message is unsafe for ${targets.map((number) => `${repo}#${number}`).join(", ")}. ${closingGuardDiagnostic(verdict.message)} See preparation.nextAction for the exact \`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\` remedy.`) };
   }
   if (method === "SQUASH" && policy.body === "COMMIT_MESSAGES" && messages.length > 1 && options.bodyText == null && messages.some((message2) => /^\s*Test-Policy-Override\s*:/im.test(`${message2.headline}
 ${message2.body}`)) && !readMessageOverride2(githubQueueSquashMessage(pull.title, pr, messages), process.cwd())) {
     return {
-      mergeStatus: "failed",
-      preparation: {
-        status: "preparation-needed",
-        reason: "queue-message-override",
-        issueTargets: [],
-        nextAction: "PR author: this repository squashes with COMMIT_MESSAGES, and GitHub composes a multi-commit squash as a list of every commit message followed by its own co-author block, so this Test-Policy-Override trailer would not be in the final trailer block the queue check reads. Put the change in ONE commit whose message ends with a trailer block carrying the waiver (no force-push: push a new branch whose single commit has the same tree, parented on the PR base; open it as a new PR and close this one), or make the waiver the final trailer block of the LAST commit, then rerun pr land. Keep repository settings unchanged."
-      },
-      error: "queue preparation needed: the multi-commit COMMIT_MESSAGES squash would bury the Test-Policy-Override waiver mid-message, so the queue check would fail malformed-override-trailer"
+      kind: "refused",
+      result: {
+        mergeStatus: "failed",
+        preparation: {
+          status: "preparation-needed",
+          reason: "queue-message-override",
+          issueTargets: [],
+          nextAction: "PR author: this repository squashes with COMMIT_MESSAGES, and GitHub composes a multi-commit squash as a list of every commit message followed by its own co-author block, so this Test-Policy-Override trailer would not be in the final trailer block the queue check reads. Put the change in ONE commit whose message ends with a trailer block carrying the waiver (no force-push: push a new branch whose single commit has the same tree, parented on the PR base; open it as a new PR and close this one), or make the waiver the final trailer block of the LAST commit, then rerun pr land. Keep repository settings unchanged."
+        },
+        error: "queue preparation needed: the multi-commit COMMIT_MESSAGES squash would bury the Test-Policy-Override waiver mid-message, so the queue check would fail malformed-override-trailer"
+      }
     };
   }
   const requiredBody = options.bodyText ?? composedBody;
@@ -42967,18 +43096,38 @@ ${message2.body}`)) && !readMessageOverride2(githubQueueSquashMessage(pull.title
   if (requiredBody && !prBodyPreservesOverrides && (method !== "SQUASH" || requiredBody.trim() !== body.trim())) {
     if (method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null) {
       return {
-        mergeStatus: "failed",
-        preparation: {
-          status: "preparation-needed",
-          reason: "queue-message-override",
-          issueTargets: [],
-          nextAction: "PR author: this repository squashes with PR_BODY, so place the required Test-Policy-Override trailer(s) in the PR body final trailer block (e.g. mmi-cli devops pr edit <n> --body-file <path>) without a body override, then rerun pr land. Keep repository settings unchanged."
-        },
-        error: "queue preparation needed: repository squash policy is PR_BODY, and the PR body does not carry the required Test-Policy-Override trailer(s) in its final Git-recognized trailer block"
+        kind: "refused",
+        result: {
+          mergeStatus: "failed",
+          preparation: {
+            status: "preparation-needed",
+            reason: "queue-message-override",
+            issueTargets: [],
+            nextAction: `PR author: this repository squashes with PR_BODY, so place the required Test-Policy-Override trailer(s) in the PR body final trailer block (e.g. \`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) without a body override, then rerun \`pr land\`. Keep repository settings unchanged.`
+          },
+          error: "queue preparation needed: repository squash policy is PR_BODY, and the PR body does not carry the required Test-Policy-Override trailer(s) in its final Git-recognized trailer block"
+        }
       };
     }
-    return preparation("queue-message-override", [], "the requested sanitized body or trailer arrangement cannot be sent to queue admission");
+    return { kind: "refused", result: preparation("queue-message-override", [], "the requested sanitized body or trailer arrangement cannot be sent to queue admission") };
   }
+  return { kind: "ready", head, pull, read, queueRead, write, ...verdict.message ? { warning: verdict.message } : {} };
+}
+async function preflightPrMergeQueue(prNumber, repo, options = {}) {
+  if (!/^\d+$/.test(prNumber)) return void 0;
+  const inspected = await inspectQueuePreparation(prNumber.replace(/^0+(?=\d)/, ""), repo, options);
+  return inspected.kind === "refused" ? inspected.result : void 0;
+}
+async function enqueuePrMergeQueue(pr, repo, options = {}) {
+  if (!/^\d+$/.test(pr)) throw new Error("merge queue enqueue requires a PR number");
+  pr = pr.replace(/^0+(?=\d)/, "");
+  const inspected = await inspectQueuePreparation(pr, repo, options);
+  if (inspected.kind !== "ready") return inspected.result;
+  const { head, pull, read, queueRead, write } = inspected;
+  const stamp = (result2, selected = false, intentId) => {
+    const credential = admissionCredential(repo, pr, head, options.receiptDirectory, selected, intentId);
+    return credential === "unknown" ? result2 : { ...result2, credential };
+  };
   const current = await queueGraphql(
     repo,
     `pullRequest(number:${pr}) { headRefOid title body }`,
@@ -42989,7 +43138,12 @@ ${message2.body}`)) && !readMessageOverride2(githubQueueSquashMessage(pull.title
   }
   const selection = { selected: false };
   const result = await submitQueueAdmission(pr, repo, head, queueRead, write, { ...options, timelineRead: read, selection });
-  return { ...stamp(result, selection.selected, selection.intentId), ...verdict.message ? { warning: verdict.message } : {} };
+  return { ...stamp(result, selection.selected, selection.intentId), ...inspected.warning ? { warning: inspected.warning } : {} };
+}
+function closingGuardDiagnostic(message2) {
+  if (!message2) return "";
+  const remedy = message2.search(/GitHub's merge queue composes|If this PR is meant to close/);
+  return (remedy === -1 ? message2 : message2.slice(0, remedy)).trim();
 }
 function decideQueueMergeRoute(hasQueue, method, headRef) {
   if (!hasQueue) return "normal";
@@ -43166,8 +43320,10 @@ function prMergeQueueLine(result) {
       return `pr land: PR #${result.pr} queued on ${queue.base}${queue.position === void 0 ? "" : ` (position ${queue.position})`}`;
     case "merged":
       return `pr land: PR #${result.pr} merged via merge queue`;
-    case "ejected":
-      return `pr land: PR #${result.pr} ejected from merge queue \u2014 ${queue.ejectedRun ? `merge_group run ${queue.ejectedRun.id} ${queue.ejectedRun.conclusion} ${queue.ejectedRun.url}` : "merge_group run not found"}`;
+    case "ejected": {
+      const line = `pr land: PR #${result.pr} ejected from merge queue \u2014 ${queue.ejectedRun ? `merge_group run ${queue.ejectedRun.id} ${queue.ejectedRun.conclusion} ${queue.ejectedRun.url}` : "merge_group run not found"}`;
+      return isNoFailedCheckQueueEjection(queue.ejectedRun) ? `${line} \u2014 no check failed; re-run \`mmi-cli devops pr land ${result.pr}${result.repo ? ` --repo ${result.repo}` : ""}\` once to re-enqueue, and report any further refusal verbatim (never fall back to a direct/admin merge or \`MMI_ACTOR=personal\` workaround)` : line;
+    }
     case "timeout":
       return `pr land: PR #${result.pr} merge queue timeout on ${queue.base}`;
   }
@@ -43366,6 +43522,57 @@ function registerRunCancel(run, writeToken) {
     else console.log(`run cancel: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.force ? "force-cancel" : "cancel"} requested (status: ${receipt.status}${receipt.runStatus ? `, runStatus: ${receipt.runStatus}` : ""})`);
   });
 }
+var RUN_RERUN_STATUS = "rerun-requested";
+async function rerunWorkflowRun(repo, id, deps, failed2 = false) {
+  const raw = String(id).trim();
+  if (!/^[1-9]\d*$/.test(raw)) throw new Error(`run rerun: <id> must be a positive workflow run id (received '${String(id)}')`);
+  const runId = Number(raw);
+  if (!Number.isSafeInteger(runId)) throw new Error(`run rerun: <id> ${raw} is beyond the safe integer range; refusing to address a different run`);
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error(`run rerun: --repo must be owner/repo (received '${repo}')`);
+  const projects = await deps.projects();
+  if (!projects) throw new Error("run rerun: the Hub project registry is unreadable; refusing to rerun on a repo this command cannot prove registered");
+  const key = registryRepoKey(repo);
+  if (!projects.some((p) => (p.repos ?? []).some((r) => typeof r === "string" && registryRepoKey(qualifyRegistryRepo(r)) === key))) {
+    throw new Error(`run rerun: ${repo} is not a registered org repo; App writes are limited to repos in the Hub registry`);
+  }
+  const mode = failed2 ? "failed" : "all";
+  let httpStatus;
+  try {
+    httpStatus = await deps.post(`repos/${repo}/actions/runs/${runId}/${failed2 ? "rerun-failed-jobs" : "rerun"}`);
+  } catch (error) {
+    const e = error;
+    const detail = String(e.stderr ?? error);
+    const code = /\bHTTP(?:\/[\d.]+)? (\d{3})\b/.exec(`${detail} ${e.stdout ?? ""}`)?.[1];
+    if (code === "403") throw new Error(`run rerun: GitHub App denied (HTTP 403) on ${repo}; actions:write permission is required; no personal-token fallback`);
+    if (code === "404") throw new Error(`run rerun: run ${runId} not found on ${repo} (HTTP 404), or the App cannot see that repo`);
+    if (code === "409" || code === "422") throw new Error(`run rerun: run ${runId} is not rerunnable (HTTP ${code}); it may still be in progress, or be past GitHub's rerun window`);
+    throw new Error(`run rerun: ${detail}`);
+  }
+  return { ok: true, repo, runId, mode, httpStatus, credential: "app_installation", status: RUN_RERUN_STATUS };
+}
+function appRunPost(writeToken, exec3 = execFileP) {
+  let token;
+  return async (path2) => {
+    token ??= await writeToken();
+    const { stdout } = await exec3("gh", ["api", "--include", "--method", "POST", path2], {
+      timeout: 2e4,
+      env: { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" }
+    });
+    return Number(/^HTTP\/[\d.]+ (\d{3})/.exec(stdout)?.[1] ?? 0);
+  };
+}
+function registerRunRerun(run, writeToken, projects) {
+  run.command("rerun <id>").description("rerun one workflow run on the org App (actions:write), registered repos only; --failed reruns only the failed jobs; prints a receipt").requiredOption("--repo <owner/repo>", "registered repository that owns the run").option("--failed", "rerun only the failed jobs (POST .../rerun-failed-jobs)").option("--json", "machine-readable receipt").action(async (id, options) => {
+    let receipt;
+    try {
+      receipt = await rerunWorkflowRun(options.repo, id, { projects, post: appRunPost(writeToken) }, options.failed === true);
+    } catch (error) {
+      return fail(error.message);
+    }
+    if (options.json) console.log(JSON.stringify(receipt));
+    else console.log(`run rerun: ${receipt.repo} run ${receipt.runId} \u2014 ${receipt.mode === "failed" ? "failed jobs" : "all jobs"} rerun requested (HTTP ${receipt.httpStatus}, credential: ${receipt.credential})`);
+  });
+}
 
 // src/board-commands.ts
 init_cli_shared();
@@ -43634,9 +43841,27 @@ function refuseNotClaimable(e, json) {
   process.exitCode = 1;
   return true;
 }
-var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,title,status,assignees,labels,bucket}.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n";
+var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n";
 function flattenBoardReport(report) {
-  return [report.primary, report.secondary].flatMap((scope) => ["userOwned", "claimable", "taken", "unownedInFlight"].flatMap((bucket) => scope[bucket].map(({ ref, title, status, assignees, labels }) => ({ ref, title, status, assignees, labels, bucket }))));
+  const closingByRef = /* @__PURE__ */ new Map();
+  for (const pull of report.pullRequests ?? []) {
+    for (const closes of pull.closesIssues) {
+      const rows = closingByRef.get(closes) ?? [];
+      rows.push({ number: pull.number, url: pull.url });
+      closingByRef.set(closes, rows);
+    }
+  }
+  return [report.primary, report.secondary].flatMap((scope) => ["userOwned", "claimable", "taken", "unownedInFlight"].flatMap((bucket) => scope[bucket].map(({ ref, number, title, status, assignees, labels, claim }) => ({
+    ref,
+    number,
+    title,
+    status,
+    assignees,
+    labels,
+    bucket,
+    claim: claim ?? null,
+    openPullRequests: closingByRef.get(ref) ?? []
+  }))));
 }
 function registerBoardCommands(program3) {
   function withDiscoverMissDetail(message2) {
@@ -54891,23 +55116,24 @@ async function closeIssue(client, options, deps = {}) {
   if (options.evidence !== void 0) {
     await verifyCloseEvidence(client, options.evidence, repo, parsed.number, reason === "duplicate-of" ? options.duplicateOf : void 0);
   }
+  const appWriter = await selectClaimWriteClient(client, deps.appClient);
   if (reason === "completed" && options.evidence !== void 0) {
     const ensureLabels = deps.ensureLabels ?? ensureLabelsExist;
     await ensureLabels([CLOSED_MERGED_LOOP_STATE_LABEL], repo);
-    await client.rest("POST", `repos/${repo}/issues/${parsed.number}/labels`, {
+    await appWriter.rest("POST", `repos/${repo}/issues/${parsed.number}/labels`, {
       body: { labels: [CLOSED_MERGED_LOOP_STATE_LABEL] }
     });
   }
-  await client.rest("PATCH", `repos/${repo}/issues/${parsed.number}`, {
+  await appWriter.rest("PATCH", `repos/${repo}/issues/${parsed.number}`, {
     body: { state: "closed", state_reason: stateReason }
   });
   if (reason === "duplicate-of" && options.duplicateOf) {
-    await client.rest("POST", `repos/${repo}/issues/${parsed.number}/comments`, {
+    await appWriter.rest("POST", `repos/${repo}/issues/${parsed.number}/comments`, {
       body: { body: `Duplicate of #${options.duplicateOf}` }
     });
   }
   if (options.comment) {
-    await client.rest("POST", `repos/${repo}/issues/${parsed.number}/comments`, {
+    await appWriter.rest("POST", `repos/${repo}/issues/${parsed.number}/comments`, {
       body: { body: options.comment }
     });
   }
@@ -59546,7 +59772,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
       timeoutMs: Math.max(1, budgetMs - (Date.now() - waitStarted)),
       // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
       // an agent harness kills it on its own (shorter) deadline before the verdict ever prints (#2940).
-      progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+      progress: ({ state, elapsedMs, remainingMs, detail }) => console.warn(`pr checks-wait: ${detail && detail.startsWith("pending (") ? detail : state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
     });
     printChecksWaitResult("pr checks-wait", result, o.json);
   });
@@ -59653,6 +59879,8 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         readHeadSha: (prNumber, repo) => readPrLandPinnedHeadSha(prNumber, repo),
         pollDelayMs: (attempt) => prLandPollDelayMs(attempt, inFlight),
         hasMergeQueue: hasPrMergeQueue,
+        // #9611: read-only preparation verdict BEFORE the check wait; the enqueue then re-reads and submits.
+        preflightQueue: (prNumber, repo, expectedHeadOid) => preflightPrMergeQueue(prNumber, repo, { expectedHeadOid, force: o.force, enqueueOnly: o.enqueueOnly }),
         enqueueQueue: async (prNumber, repo, expectedHeadOid) => {
           const receipt = await enqueuePrMergeQueue(prNumber, repo, { expectedHeadOid, force: o.force, enqueueOnly: o.enqueueOnly });
           if (receipt.warning) console.warn(receipt.warning);
@@ -60318,6 +60546,9 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
       const result = await waitForPrChecks({
         resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
         pollChecks: () => pollRestCommitChecks(sha, repo),
+        // #9589: the evidence-bearing read lets the wait name the rows holding it open and carry the
+        // full check/workflow evidence on the timeout receipt.
+        pollChecksWithEvidence: () => pollRestCommitChecksWithWorkflowEvidence(sha, repo),
         pollRateLimit: () => waitLoopCorePool("ci checks-wait"),
         checksUrl: `https://github.com/${repo}/commit/${sha}/checks`,
         checksDiagnosticCommand: `gh api repos/${repo}/commits/${sha}/check-runs`,
@@ -60330,7 +60561,7 @@ ${preparation.findings.map((finding) => `[${finding.check}/${finding.state}] ${f
         sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)),
         log: (message2) => console.warn(message2),
         timeoutMs: timeoutMs ?? PR_CHECKS_TIMEOUT_MS,
-        progress: ({ state, elapsedMs, remainingMs }) => console.warn(`ci checks-wait: ${state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
+        progress: ({ state, elapsedMs, remainingMs, detail }) => console.warn(`ci checks-wait: ${detail && detail.startsWith("pending (") ? detail : state} \u2014 ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
       });
       printChecksWaitResult("ci checks-wait", result, o.json);
     });
@@ -66182,7 +66413,7 @@ function typedReadHint(path2) {
   if (!match) return "";
   const [, owner, repo, kind, item, sub] = match;
   const slug = `${owner}/${repo}`;
-  const say = (command, note = "") => ` Typed read for this route: \`${command}\`${note}.`;
+  const say = (command, note = "") => ` Typed read for this route: \`MMI_ACTOR=app ${command}\`${note}.`;
   if (kind === "issues") {
     if (!item) return say(`mmi-cli devops read issue list --repo ${slug} --json number,title,state,labels`);
     if (item.startsWith("comments/")) {
@@ -69965,7 +70196,7 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
   appActorCommand = commandPath4;
   setAuditCommand(commandPath4);
   if (commandPath4 !== "whoami diagnose-hub") emitCliCallTelemetry(commandPath4);
-  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel") return;
+  if (commandPath4 === "ci cancel-orphans" || commandPath4 === "run cancel" || commandPath4 === "run rerun") return;
   try {
     await activateAppActor(commandPath4, process.env, () => APP_WRITE_COMMANDS.has(commandPath4) ? mintCommandWriteToken(appActorDeps(), commandPath4) : mintInstallationToken(appActorDeps()));
   } catch (e) {
@@ -70800,9 +71031,12 @@ ci.command("audit").description("read-only fleet scan: gate workflow, ruleset co
 });
 registerCiChecksWait(ci);
 registerCancelOrphans(ci, async () => (await mintCommandWriteToken(appActorDeps(), "ci cancel-orphans")).token);
-registerRunCancel(
-  program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` is the only one, and it rides the org App actions:write profile"),
-  async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token
+var runRoot = program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` and `run rerun <id> [--failed]`, both on the org App actions:write profile");
+registerRunCancel(runRoot, async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token);
+registerRunRerun(
+  runRoot,
+  async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run rerun")).token,
+  async () => fetchProjectsList(registryClientDeps(await loadConfig()))
 );
 ci.command("reconcile").description("audit + optionally apply merge settings and product ruleset activation (master-admin)").option("--json", "machine-readable output").option("--repo <owner/repo>", "reconcile one repo instead of the full registry").option("--apply", "PATCH merge settings + activate product ruleset when missing (master role required); activation is skipped while the repo's gate has never passed (#3694)").option("--park-ruleset", "stop the product ruleset enforcing without deleting it \u2014 keeps its required contexts (master role required)").action(async (o) => {
   if (o.apply && o.parkRuleset) {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.8",
+  "version": "4.6.10",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.8",
+  "version": "4.6.10",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -20,7 +20,10 @@ One call; the JSON carries `viewer`, `repo` and the project title. Use `primary`
 `secondary` for other repos on the Project. Without `--flat`, `board read --json` returns an object
 `{project, viewer, repo, primary, secondary, warnings, partial}` whose `primary` and `secondary` are bucket
 objects `{userOwned, claimable, taken, unownedInFlight}` of item arrays (no top-level `items` array), so filter
-a bucket (e.g. `report.primary.claimable`) or pass `--json --flat`, never `(j.items||j).filter`. Partial reads
+a bucket (e.g. `report.primary.claimable`) or pass `--json --flat`, never `(j.items||j).filter`. `--flat` rows
+are `{ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}` (`claim` is the parsed mmi-claim
+evidence object, null when unclaimed; `openPullRequests` lists the OPEN PRs whose closing-issue body links name
+the item — on the full JSON object that list lives at `report.pullRequests`, never `openPullRequests`). Partial reads
 exit nonzero; `--allow-partial` only when the dev accepts an incomplete board. The CLI partitions rows into
 **Yours**, **Free to claim** and **Taken**; stale stamps (4 hours without work) hold nothing. Partition rules,
 stamp details and `--out` rationale: [reference.md](reference.md).
@@ -62,7 +65,7 @@ Present the plan — batch count, issue count, one line per batch naming its sha
 mmi-cli oracle board claim <ref> <ref> <ref> --json
 ```
 
-Announce issue/PR counts; refresh `mmi-cli oracle board read` immediately before each claim (a list read earlier in the session may already be stale) and select ordinary claims from **Free to claim**. Read every result: failures exit nonzero. On conflict, do not blindly retry: stop that batch, never retry the same ref, refresh and reselect from the fresh **Free to claim** list, or coordinate a handoff; `--force` only for an owner-authorized intentional takeover. Run writes separately, never `;`; dependent follow-ups use `&&`.
+Announce issue/PR counts; refresh `mmi-cli oracle board read` immediately before each claim (a list read earlier in the session may already be stale) and select ordinary claims from **Free to claim**. A cached read states its provenance — the render prints `source: cache · built <timestamp> · fresh|stale` and `--json` carries `builtAt` — so if a read in the same turn/window already returned a fresh snapshot and no board write has intervened since, re-reading the same `builtAt` snapshot buys no new information: reuse it instead of re-reading. Read every result: failures exit nonzero. On conflict, do not blindly retry: stop that batch, never retry the same ref, refresh and reselect from the fresh **Free to claim** list, or coordinate a handoff; `--force` only for an owner-authorized intentional takeover. Run writes separately, never `;`; dependent follow-ups use `&&`.
 
 Run each `mmi-cli oracle issue create` as its own simple command. Any command whose text must carry quote
 characters — an issue body, an inline `node -e` / `bash -c` one-liner — is written to a file, never spliced: a

package/skills/release/train-common.md

@@ -12,7 +12,7 @@ Every refusal and every doctor blocker names its `code` and `anchor`: open the f
 
 ## Merge floor
 
-- **Ordinary development PRs land with `mmi-cli devops pr land <number>`.** The rules below are for the train's own merges.
+- **Ordinary development PRs land with `mmi-cli devops pr land <number>`.** If a merge-queue group leaves the queue with no failed check, `pr land` re-queues once (or rerun `mmi-cli devops pr land <number>` once); a refused land is a stop to report verbatim — never fall back to a hand/admin merge, actor override (`MMI_ACTOR=personal`), or interim workaround. The rules below are for the train's own merges.
 - **Never squash-merge a tagged commit (#3167).** A squash re-mints the SHA and orphans the tag, so tag-anchored checks mis-read. Any merge that carries an already-tagged commit — the `main → development` roll-forward, an alignment PR, a hotfix fold PR — lands as a true merge: `mmi-cli devops pr merge <number> --auto --merge` (or `--wait --merge`); `--wait` alone still squashes. The hotfix main-base PR itself may squash: its tag lands after, on the merged `main` HEAD, and the `-x` trailer must survive the squash message.
 - **A refused train is a stop, never a license to finish by hand.** Every fail-closed halt — doctor blocker, authority probe, coverage guard, untolerated conflict, required checks, stray tag, ledger — ends the run. Fix the cause on `development` through a normal PR and rerun the train; never hand-resolve on `main`, hand-cherry-pick, bare-push a train branch, ack to save time, or bypass a check.
 - **Probe the latest Release tag, not branches or stale local tags (#2734).** Queue: `mmi-cli devops read pr queue <number> --repo <owner/repo> --json`; gh rejects `mergeQueueEntry`.