@open-mercato/cli 0.10.1-develop.8004.1.a8a79ee43f → 0.10.1-develop.8022.1.b6753de892

package/dist/agentic/guides/modules/staff/index.md

@@ -1,5 +1,5 @@
 # staff — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/staff
 
 ## Sections

package/dist/agentic/guides/modules/storage_s3/index.md

@@ -1,5 +1,5 @@
 # storage_s3 — module facts (generated, do not edit)
-<!-- generated from @open-mercato/storage-s3 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/storage-s3 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/storage-s3/src/modules/storage_s3
 
 ## Sections

package/dist/agentic/guides/modules/sync_akeneo/index.md

@@ -1,5 +1,5 @@
 # sync_akeneo — module facts (generated, do not edit)
-<!-- generated from @open-mercato/sync-akeneo 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/sync-akeneo 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/sync-akeneo/src/modules/sync_akeneo
 
 ## Sections

package/dist/agentic/guides/modules/sync_excel/index.md

@@ -1,5 +1,5 @@
 # sync_excel — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/sync_excel
 
 ## Sections

package/dist/agentic/guides/modules/system_status_overlays/index.md

@@ -1,5 +1,5 @@
 # system_status_overlays — module facts (generated, do not edit)
-<!-- generated from @open-mercato/enterprise 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/enterprise 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/enterprise/src/modules/system_status_overlays
 
 ## Sections

package/dist/agentic/guides/modules/telemetry/index.md

@@ -1,5 +1,5 @@
 # telemetry — module facts (generated, do not edit)
-<!-- generated from @open-mercato/telemetry 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/telemetry 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/telemetry/src/modules/telemetry
 
 ## Sections

package/dist/agentic/guides/modules/tillio/index.md

@@ -1,5 +1,5 @@
 # tillio — module facts (generated, do not edit)
-<!-- generated from @open-mercato/tillio 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/tillio 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/tillio/src/modules/tillio
 
 ## Sections

package/dist/agentic/guides/modules/translations/index.md

@@ -1,5 +1,5 @@
 # translations — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/translations
 
 ## Sections

package/dist/agentic/guides/modules/warranty_claims/index.md

@@ -1,5 +1,5 @@
 # warranty_claims — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/warranty_claims
 
 ## Sections

package/dist/agentic/guides/modules/webhooks/index.md

@@ -1,5 +1,5 @@
 # webhooks — module facts (generated, do not edit)
-<!-- generated from @open-mercato/webhooks 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/webhooks 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/webhooks/src/modules/webhooks
 
 ## Sections

package/dist/agentic/guides/modules/wms/index.md

@@ -1,5 +1,5 @@
 # wms — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/wms
 
 ## Sections

package/dist/agentic/guides/modules/workflows/index.md

@@ -1,5 +1,5 @@
 # workflows — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.8004.1.a8a79ee43f; core 0.10.1-develop.8004.1.a8a79ee43f — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.8022.1.b6753de892; core 0.10.1-develop.8022.1.b6753de892 — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/workflows
 
 ## Sections

package/dist/agentic/guides/reference-module-facts.json

@@ -1185,7 +1185,7 @@
     "facts": {
       "title": "Example Module",
       "description": "Demonstrates pages, APIs, entities and DI.",
-      "coreVersion": "0.10.1-develop.8004.1.a8a79ee43f",
+      "coreVersion": "0.10.1-develop.8022.1.b6753de892",
       "sourcePackage": null,
       "sourceVersion": null,
       "sourceRoot": "src/modules/example",

package/dist/agentic/guides/upstream/BACKWARD_COMPATIBILITY.md

@@ -635,6 +635,10 @@ STABLE tools/execute writes bypass approval; no bridge. [Migrate](UPGRADE_NOTES.
 
 SCIM adds 429/503 before credentials; honor Retry-After. Optional `beforeAuth: ApiRouteBeforeAuth` is additive. See [contract and migration](.ai/specs/enterprise/implemented/SPEC-ENT-004-2026-02-19-sso-directory-sync.md#migration--backward-compatibility).
 
+## Encryption maintenance safety gates (2026-11-02, #6767)
+
+CLI safety confirmations changed; stop writers and restart replicas. [Flags, migration and stable formats](UPGRADE_NOTES.md#encryption-maintenance-safety-confirmations-6767).
+
 ## Staff Logout Uses Post/Redirect/Get (2026-11-05)
 
 `POST /api/auth/logout` now returns `303 See Other` instead of `307`, including the cookieless branch ([#7383](https://github.com/open-mercato/open-mercato/issues/7383)). Browsers follow `Location: /login` with GET rather than repeating the logout POST. This intentionally corrects the status documented in the 2026-10-13 entry above; shared redirect helper defaults remain 307.

package/dist/agentic/guides/upstream/manifest.json

@@ -1,8 +1,8 @@
 {
   "version": 1,
-  "generator": "@open-mercato/cli@0.10.1-develop.8004.1.a8a79ee43f",
+  "generator": "@open-mercato/cli@0.10.1-develop.8022.1.b6753de892",
   "files": {
     "AGENTS.md": "35c948a32e06ca64b4706970c55ec60946412b410938b22478233a2c5c43df56",
-    "BACKWARD_COMPATIBILITY.md": "1b75c2ca2f16f3f6fe8bab25e059e49369bb75270b6cb7c8f4070f1e2a95169b"
+    "BACKWARD_COMPATIBILITY.md": "4e85dfc08b0e9542c78415e25a020e06e4ec3c3bb664b278b5aa3faa3523d873"
   }
 }

package/dist/agentic/shared/ai/harness/cases.json

@@ -520,7 +520,7 @@
     ],
     "maxContextFiles": 8,
     "maxInitialContextBytes": 65536,
-    "maxTotalContextBytes": 122880,
+    "maxTotalContextBytes": 126976,
     "relatedCases": [
       "OMH-008"
     ]
@@ -5145,7 +5145,7 @@
     ],
     "maxContextFiles": 8,
     "maxInitialContextBytes": 65536,
-    "maxTotalContextBytes": 122880,
+    "maxTotalContextBytes": 126976,
     "relatedCases": [
       "OMH-065"
     ]

package/dist/agentic/shared/ai/trackers/github.md

@@ -14,7 +14,7 @@ At runtime: `om-setup-agent-pipeline` copies this file into the repository at `.
 - Issue and PR identifiers are numbers; in text they are written `#123`.
 - A PR is linked to the issue it resolves with `Fixes #{issueId}` (or `Closes #{issueId}`) in the PR body; GitHub then closes the issue on merge. To reference without auto-closing, use a plain issue link.
 - PRs open as **drafts** when a skill says so; a human (or **mark-pr-ready**) promotes them.
-- Claim/lock signals on an issue or PR are: assignee set to the automation user, the `in-progress` label, and a `🤖`-prefixed claim comment. All three are set on claim; the label is guarded (below). The `ci-monitoring` label is **not** a claim/lock signal: it marks a PR whose work is finished and already reported while an agent watches CI, so a PR carrying `ci-monitoring` without any of the three signals above MUST be treated as unclaimed and is free to claim.
+- GitHub claim ownership uses the create-only `refs/om-locks/{kind}-{number}` ref through **get-lock**, **acquire-lock**, and exact-SHA **release-lock**. Acquire first, retain run/comment ids and lock SHA, then assign when supported and verify guarded `in-progress`. For confirmed unassignable bot accounts, retain the atomic lock, timestamped claim comment and verified label without self-assignment. Foreign assignees and live or uncertain claims remain blockers. The `ci-monitoring` label is **not** a claim/lock signal: it marks a PR whose work is finished and already reported while an agent watches CI, so a PR carrying `ci-monitoring` without any of the three signals above MUST be treated as unclaimed and is free to claim.
 - Long, multi-line comment bodies are posted with `--body-file` (or a heredoc via process substitution) so formatting is preserved.
 - CI status truth comes from **get-pr-checks**; the set of *required* checks comes from **get-required-checks** (branch protection). When branch protection is not readable (404), treat every reported check as required.
 
@@ -234,7 +234,7 @@ gh api repos/{owner}/{repo}/issues/comments/{commentId} --jq '{body,user:.user.l
 #### list-issue-comments
 `{issueId or prNumber}` → conversation comments (PR conversation comments are issue comments on GitHub).
 ```bash
-gh api repos/{owner}/{repo}/issues/{number}/comments --jq '.[] | {id,user:.user.login,body}'
+gh api --paginate repos/{owner}/{repo}/issues/{number}/comments --jq '.[] | {id,user:.user.login,body,createdAt:.created_at,updatedAt:.updated_at}'
 ```
 
 #### update-comment
@@ -243,6 +243,219 @@ gh api repos/{owner}/{repo}/issues/{number}/comments --jq '.[] | {id,user:.user.
 gh api -X PATCH repos/{owner}/{repo}/issues/comments/{commentId} -F body=@<path>
 ```
 
+```bash
+tracker_repo() {
+  if [ -n "${REPO:-}" ]; then printf '%s\n' "$REPO";
+  else gh repo view --json nameWithOwner --jq .nameWithOwner; fi
+}
+```
+
+#### get-lock
+
+`{kind}` (`issue` or `pr`), `{item}` → `null` for an absent exact lock, or
+`{ref,sha,repo,kind,item,runId,actor,createdAt}`. The authoritative GitHub lock is
+`refs/om-locks/{kind}-{item}`. Its SHA points to an otherwise empty metadata
+commit using the configured base's existing tree, with no branch/history edits.
+The commit message binds the unique run id and actor; a base SHA alone cannot
+identify two runs sharing a bot login. `createdAt` comes from the server commit
+metadata, not a comment timestamp. Unknown/malformed refs and failed reads block.
+Load these helpers before **acquire-lock** or **release-lock**:
+
+```bash
+gh_lock_target() {
+  case "$1" in issue|pr) ;; *) return 1 ;; esac
+  case "$2" in ''|*[!0-9]*) return 1 ;; esac
+  LOCK_REPO=$(tracker_repo) || return 1
+  LOCK_REF="refs/om-locks/$1-$2"
+}
+gh_get_lock() {
+  gh_lock_target "$1" "$2" || return 1
+  lock_refs=$(gh api "repos/$LOCK_REPO/git/matching-refs/om-locks/$1-$2") || return 1
+  lock_entry=$(printf '%s' "$lock_refs" | jq -c --arg ref "$LOCK_REF" '
+    if type != "array" then error("Invalid ref list") else
+    [.[] | select(.ref == $ref)] | if length == 0 then null
+    elif length == 1 and .[0].object.type == "commit" then .[0]
+    else error("Ambiguous lock ref") end end') || return 1
+  if [ "$lock_entry" = "null" ]; then printf 'null\n'; return 0; fi
+  lock_sha=$(printf '%s' "$lock_entry" | jq -er '.object.sha | select(test("^[0-9a-f]{40}$"))') || return 1
+  lock_commit=$(gh api "repos/$LOCK_REPO/git/commits/$lock_sha") || return 1
+  printf '%s' "$lock_commit" | jq -ce --arg repo "$LOCK_REPO" --arg kind "$1" --arg item "$2" --arg ref "$LOCK_REF" --arg sha "$lock_sha" '
+    .committer.date as $created |
+    .message | select(startswith("om-claim-v1\n")) | ltrimstr("om-claim-v1\n") | fromjson |
+    select(.repo == $repo and .kind == $kind and .item == $item and
+      (.runId | type == "string" and length > 0) and
+      (.actor | type == "string" and length > 0) and ($created | type == "string")) |
+    . + {ref:$ref,sha:$sha,createdAt:$created}'
+}
+gh_get_lock "{kind}" "{number}"
+```
+
+#### acquire-lock
+
+`{kind}`, `{item}`, unique run id, authenticated actor, resolved base SHA →
+`{status: acquired|owned|conflict, lock: <get-lock result>}`. On GitHub this is
+mandatory, including for unassignable bots and PRs in split-provider setups.
+Requires contents-write and authenticated Git transport for eventual release.
+Never switch to comments on 403/422/transport errors: an existing ref is a
+conflict only after an exact successful read proves its owner. Reconcile an
+uncertain POST through **get-lock** before retrying. No labels/assignment/comment
+candidate or work is produced by a losing fresh run.
+
+```bash
+gh_acquire_lock() {
+  # kind, item, run id, authenticated actor, configured base SHA
+  gh_lock_target "$1" "$2" || return 1
+  case "$3" in ''|*[!A-Za-z0-9._-]*) return 1 ;; esac
+  [ -n "$4" ] || return 1
+  printf '%s' "$5" | grep -Eq '^[0-9a-f]{40}$' || return 1
+  lock_before=$(gh_get_lock "$1" "$2") || return 1
+  if [ "$lock_before" != "null" ]; then
+    printf '%s' "$lock_before" | jq --arg run "$3" --arg actor "$4" '
+      {status:(if .runId == $run and .actor == $actor then "owned" else "conflict" end),lock:.}'
+    return 0
+  fi
+  lock_tree=$(gh api "repos/$LOCK_REPO/git/commits/$5" --jq '.tree.sha') || return 1
+  lock_message=$(jq -cn --arg repo "$LOCK_REPO" --arg kind "$1" --arg item "$2" --arg run "$3" --arg actor "$4" '
+    "om-claim-v1\n" + ({repo:$repo,kind:$kind,item:$item,runId:$run,actor:$actor}|tojson)') || return 1
+  lock_created=$(jq -n --argjson message "$lock_message" --arg tree "$lock_tree" --arg parent "$5" '
+    {message:$message,tree:$tree,parents:[$parent]}' |
+    gh api -X POST "repos/$LOCK_REPO/git/commits" --input -) || return 1
+  lock_proposed=$(printf '%s' "$lock_created" | jq -er '.sha | select(test("^[0-9a-f]{40}$"))') || return 1
+  # Create-only POST is the ownership decision; never PATCH/update an existing ref.
+  if gh api -X POST "repos/$LOCK_REPO/git/refs" -f "ref=$LOCK_REF" -f "sha=$lock_proposed" >/dev/null 2>&1; then
+    lock_posted=true
+  else
+    lock_posted=false
+  fi
+  lock_after=$(gh_get_lock "$1" "$2") || return 1
+  [ "$lock_after" != "null" ] || return 1
+  printf '%s' "$lock_after" | jq --arg run "$3" --arg actor "$4" --arg sha "$lock_proposed" --arg posted "$lock_posted" '
+    {status:(if .sha == $sha and .runId == $run and .actor == $actor then "acquired"
+      elif .runId == $run and .actor == $actor then "owned"
+      elif $posted == "false" then "conflict" else error("Lock replaced after creation") end),lock:.}'
+}
+gh_acquire_lock "{kind}" "{number}" "$CLAIM_RUN_ID" "$CURRENT_USER" "$BASE_SHA"
+```
+
+Persist the returned lock SHA plus run id before comment/label writes; reconcile
+the same run on resume. A metadata commit created by a losing contender may be
+unreferenced and garbage-collected; it contains no secrets or new project content.
+
+#### release-lock
+
+`{kind}`, `{item}`, exact expected lock SHA, expected owner run id/actor → delete
+only that exact ref. Normal callers pass their own verified identity; recovery
+passes the observed previous owner only after the shared stale/force/UI recovery
+authorization checks. Keep the lock while cleaning up owned labels and marking
+the comment released; delete the ref last. A loser never calls this operation.
+
+```bash
+gh_release_lock() {
+  # kind, item, expected SHA, expected owner's run id and actor
+  gh_lock_target "$1" "$2" || return 1
+  printf '%s' "$3" | grep -Eq '^[0-9a-f]{40}$' || return 1
+  lock_current=$(gh_get_lock "$1" "$2") || return 1
+  [ "$lock_current" != "null" ] || { printf 'absent\n'; return 0; }
+  printf '%s' "$lock_current" | jq -e --arg sha "$3" --arg run "$4" --arg actor "$5" '
+    .sha == $sha and .runId == $run and .actor == $actor' >/dev/null || return 1
+  lock_url=$(gh repo view "$LOCK_REPO" --json url --jq .url) || return 1
+  # Git's explicit expected-SHA lease is atomic compare-and-delete. REST DELETE
+  # has no expected-SHA condition and can remove a successor during recovery.
+  git push --porcelain --force-with-lease="$LOCK_REF:$3" "$lock_url.git" ":$LOCK_REF" || return 1
+  lock_remaining=$(gh_get_lock "$1" "$2") || return 1
+  if [ "$lock_remaining" = "null" ]; then printf 'released\n'
+  elif printf '%s' "$lock_remaining" | jq -e --arg sha "$3" '.sha != $sha' >/dev/null; then
+    printf 'released; successor retained\n'
+  else return 1; fi
+}
+gh_release_lock "{kind}" "{number}" "$CLAIM_LOCK_SHA" "$CLAIM_RUN_ID" "$CURRENT_USER"
+```
+
+This narrowly scoped lease-deletion is authorized lock housekeeping, never a
+force-push of project branches. Resolve the target repository's GitHub URL as
+above rather than assuming `origin` is the target. Do not change credentials,
+remove hooks or retry with an unconditional REST DELETE when Git transport fails.
+Absent is idempotent; a changed SHA/owner blocks and preserves the successor.
+
+#### get-claim-reset
+
+`{kind}`, `{item}` → latest tracker-audited human `claim-reset` label application
+as `{id,createdAt,actor}`, or `null` if none. Read every event page, including past
+applications after label removal. Verify the event actor is a human permitted to
+manage item labels; bot applications and comment/body text never authorize reset.
+A failed/unsupported audit read is not `null`: stop recovery and report the gap.
+This cutoff permanently retires claim comments created strictly before it;
+same-second/unknown timestamps are uncertain and remain blocking. It does not
+relax QA, merge, scheduler reservations or command/process isolation.
+
+```bash
+gh_get_claim_reset() {
+  case "$1" in ''|*[!0-9]*) return 1 ;; esac
+  reset_pages=$(gh api --paginate --slurp "repos/$(tracker_repo)/issues/$1/events?per_page=100") || return 1
+  printf '%s' "$reset_pages" | jq -e 'type == "array" and all(.[]; type == "array")' >/dev/null || return 1
+  reset_event=$(printf '%s' "$reset_pages" | jq '
+    [ .[][] | select(.event == "labeled" and .label.name == "claim-reset" and .actor.type == "User") ]
+    | sort_by(.created_at, .id) | .[-1] // null') || return 1
+  if [ "$reset_event" = "null" ]; then printf 'null\n'; return 0; fi
+  reset_actor=$(printf '%s' "$reset_event" | jq -r '.actor.login') || return 1
+  case "$reset_actor" in ''|*[!A-Za-z0-9-]*) return 1 ;; esac
+  reset_permission=$(gh api "repos/$(tracker_repo)/collaborators/$reset_actor/permission") || return 1
+  printf '%s' "$reset_permission" | jq -e '
+    (.permission == "admin" or .permission == "write" or .permission == "maintain" or .permission == "triage")
+    or (.user.permissions | .admin == true or .maintain == true or .push == true or .triage == true)' >/dev/null || return 1
+  printf '%s' "$reset_event" | jq '{id: (.id | tostring), createdAt: .created_at, actor: .actor.login}'
+}
+gh_get_claim_reset "{number}"
+```
+
+The platform event plus repository-permission read proves human label authority.
+A label still present is an operator-visible recovery breadcrumb, not a permanent
+bypass. Removing it does not revive retired claims; remove and reapply to request
+a later reset. Never apply this label automatically.
+
+#### claim-winner
+
+`{kind}`, `{item}`, `LIVE_CLAIM_IDS` (JSON array of comment handles from a complete
+fresh **list-issue-comments** read, selected by the skill's live/stale policy) →
+`{id,user,body}` for the lowest server creation-order candidate, or `null` when
+none is visible. Missing/unreadable/incomplete data is an error, never an empty
+success. Require the caller's own id in the fresh candidate set before proceeding.
+Ignore explicitly `released`/`withdrawn` comments even if passed as live. Do not
+filter by actor: two contenders may share one bot account. Numeric ids compare
+numerically; opaque ids use creation time then stable id. The caller repeats the
+read/election and performs the post-label ownership check; this is not atomic.
+
+```bash
+gh_claim_winner() {
+  # $1 = item number; $2 = LIVE_CLAIM_IDS as JSON string handles.
+  case "$1" in ''|*[!0-9]*) return 1 ;; esac
+  printf '%s' "$2" | jq -e 'type == "array" and all(.[]; type == "string")' >/dev/null || return 1
+  claim_pages=$(gh api --paginate --slurp "repos/$(tracker_repo)/issues/$1/comments?per_page=100") || return 1
+  printf '%s' "$claim_pages" | jq -e 'type == "array" and all(.[]; type == "array")' >/dev/null || return 1
+  printf '%s' "$claim_pages" | jq --argjson live "$2" '
+    [ .[][] | select((.id | tostring) as $id | $live | index($id))
+      | select((.body | test("(?m)^Claim-State: (released|withdrawn)\\r?$")) | not)
+      | {id: (.id | tostring), user: .user.login, body} ]
+    | sort_by(.id | [length, .]) | .[0] // null'
+}
+gh_claim_winner "{number}" "$LIVE_CLAIM_IDS"
+```
+
+All comment pages are read before ranking. Preserve REST numeric ids as string
+handles at the operation boundary (do not substitute GraphQL node ids).
+
+#### withdraw-claim
+
+`{kind}`, `{item}`, `{commentId}`, full terminal body file, expected authenticated
+actor and `Claim-Run` → rewrite only that run's original candidate through **update-comment**,
+then read it back through **list-issue-comments**. Retain its legacy first line,
+marker and run id; change `Claim-State: active` to `withdrawn` (loser) or `released`
+(owner after cleanup), with the reason/winner. Before writing, verify exact item,
+comment id, authenticated author and run id; a mismatch stops cleanup. Do not
+edit a foreign candidate or delete its label. Return the same id and verified
+terminal state; failed update/read-back is a blocker. Never fall back to a new
+comment leaving the old active candidate in place.
+
 ### Pull requests
 
 #### get-pr
@@ -478,3 +691,45 @@ gh label create risk-low          --color 0e8a16 --description "Isolated, low bl
 gh label create risk-medium       --color fbca04 --description "Ordinary change with tests"
 gh label create risk-high         --color b60205 --description "Wide blast radius, review deeply"
 ```
+
+#### list-review-comments
+`{prNumber}` → every inline review comment on the diff (the conversation comments come from **list-issue-comments**; these are the ones anchored to a file and line).
+```bash
+gh api --paginate repos/{owner}/{repo}/pulls/{prNumber}/comments \
+  --jq '.[] | {id,user:.user.login,path,line:(.line // .original_line),body,url:.html_url,reply_to:.in_reply_to_id}'
+```
+REST does not expose a thread's resolved state (that lives in GraphQL's review threads), so treat every returned comment as potentially open and judge it against the current diff. `reply_to` is non-null on replies, which is what lets you reconstruct a thread. Consumers treat an unavailable operation as "inline feedback out of reach", not as a failure: they fall back to review bodies plus conversation comments and state the gap in their report.
+
+
+#### approve-pending-runs
+Head SHA → approve every workflow run on that commit that is waiting for maintainer approval (`conclusion` `action_required` — GitHub holds runs from first-time or outside contributors until a maintainer approves them). Prints the approved run ids; an empty result means nothing was waiting. Approving lets the contributor's workflow code run with this repository's CI, so callers approve only on a PR a human has authorized for automation (e.g. an `automerge` label) and read the diff's workflow changes first.
+```bash
+gh api "repos/{owner}/{repo}/actions/runs?head_sha={headSha}&status=action_required&per_page=100" \
+  --jq '.workflow_runs[].id' | while read -r run; do
+  gh api -X POST "repos/{owner}/{repo}/actions/runs/$run/approve" >/dev/null && echo "$run"
+done
+```
+
+
+#### get-pr-author-association
+`{prNumber}` → `{login, association}`, normalized from GitHub's `author_association`. GitHub reports `COLLABORATOR` for anyone with explicit repository access who is not an organization member, so on an organization-owned repository that is an `outside-collaborator`. `FIRST_TIMER` (first PR anywhere on GitHub) folds into `first-time-contributor`, and `MANNEQUIN` folds into `none`.
+```bash
+gh api "repos/{owner}/{repo}/pulls/{prNumber}" --jq '{login: .user.login, association: (
+  .author_association as $a | .base.repo.owner.type as $t |
+  if $a == "OWNER" then "owner"
+  elif $a == "MEMBER" then "member"
+  elif $a == "COLLABORATOR" then (if $t == "Organization" then "outside-collaborator" else "collaborator" end)
+  elif $a == "CONTRIBUTOR" then "contributor"
+  elif $a == "FIRST_TIME_CONTRIBUTOR" or $a == "FIRST_TIMER" then "first-time-contributor"
+  else "none" end)}'
+```
+
+
+#### close-pr
+`{prNumber}` → close without merging; preserve the head branch, linked issues,
+title and body. Post/update the caller's evidence note before calling. A fresh
+**get-pr** must confirm `CLOSED` and no merge before reporting success; an
+already merged PR is never reported as closed-obsolete.
+```bash
+gh api -X PATCH repos/{owner}/{repo}/pulls/{prNumber} -f state=closed
+```

package/dist/agentic/shared/scripts/execution-sandbox.mjs

@@ -307,6 +307,7 @@ function linuxInvocation({ command, args, cwd, writableRoots, readOnlyRoots, net
     sandboxArgs.push('--ro-bind', root, root)
   }
   for (const file of networkReadable) sandboxArgs.push('--ro-bind', file, file)
+  sandboxArgs.push('--remount-ro', '/', '--remount-ro', '/tmp')
   const realCwd = regularDirectory(cwd, 'sandbox cwd')
   sandboxArgs.push('--chdir', realCwd, '--', resolveExecutable(command, env), ...args)
   return { command: bubblewrap, args: sandboxArgs, cwd: realCwd, env }

package/dist/lib/generators/openapi.js

@@ -1,4 +1,5 @@
 import * as fs from "node:fs";
+import { randomBytes } from "node:crypto";
 import * as path from "node:path";
 import { getEnabledModuleIdentities } from "../module-identity.js";
 import { isModuleRouteFile } from "./scanner.js";
@@ -208,7 +209,7 @@ async function generateOpenApiViaBundle(routes, resolver, quiet) {
   }
   const cacheDir = path.join(rootDir, "node_modules", ".cache");
   if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
-  const bundlePath = path.join(cacheDir, "_openapi-bundle.mjs");
+  const bundlePath = path.join(cacheDir, `_openapi-bundle-${process.pid}-${randomBytes(6).toString("hex")}.mjs`);
   let inputPaths = [];
   const importLines = [
     `import { buildOpenApiDocument } from ${JSON.stringify(generatorPath)};`
@@ -471,7 +472,11 @@ process.stdout.write(JSON.stringify(deepClone(doc), (_, v) =>
       await esbuild.stop();
     } catch {
     }
-    for (const file of ["_openapi-register.mjs", "_openapi-loader.mjs", "_next-stub.cjs"]) {
+    try {
+      fs.unlinkSync(bundlePath);
+    } catch {
+    }
+    for (const file of ["_openapi-bundle.mjs", "_openapi-register.mjs", "_openapi-loader.mjs", "_next-stub.cjs"]) {
       try {
         fs.unlinkSync(path.join(cacheDir, file));
       } catch {