@plot-pm/board 0.13.0 → 0.14.1

package/plot-host.sh

@@ -46,6 +46,15 @@
 #                                 deciding whether to REMOVE something and
 #                                 silence is never permission. A call that
 #                                 failed outright still exits 3.
+#   pr-merge-commit <branch>       the merge commit sha of a merged PR for this
+#                                 branch, or EMPTY (exit 0) where none merged.
+#                                 The same query `pr-merged` runs, reading a
+#                                 second field of the one response. A separate
+#                                 subcommand because `pr-merged` prints one word
+#                                 and its callers read one word.
+#                                 EXIT 3 is the question failing, and it is not
+#                                 the same as an empty answer: a diff that could
+#                                 not be read is not a diff that was empty.
 #   pr-create --title T [--body B] [--base BR] [--head BR] [--draft]
 #                                 create a PR, print its URL
 #   pr-merge <number> [--squash] [--delete-branch]
@@ -96,13 +105,25 @@
 #                                 and a real failure presents identically.
 #                                 Nothing here compares runs or concludes.
 #                                 METERED: ask only for a branch already known
-#                                 to be failing. Empty on bitbucket (bb has no
-#                                 run listing) — unavailable, never "never
-#                                 failed".
+#                                 to be failing.
+#                                 DISPATCHED ON THE `CI` KEY, never on the git
+#                                 host: a build is the CI system's fact, and the
+#                                 two keys are independent. A repository that
+#                                 declared no CI, or one Plot has no connector
+#                                 for, EXITS 4 — not being able to ask is not an
+#                                 empty history.
+#                                 On jenkins it reports ONE current state as a
+#                                 history of one, with `startedAt` and `url`
+#                                 empty: `jen job list` carries no history and
+#                                 no timestamps, and inventing them would be a
+#                                 collector reaching a verdict.
 #   run-for-sha <branch> <sha>    the run for ONE sha — else the branch's newest
 #                                 run, with `sha` saying which it is — as a
 #                                 single JSON object, or nothing when the branch
-#                                 has no runs at all:
+#                                 has no runs at all. Dispatched on the `CI` key
+#                                 like `runs`, and EXITS 4 on jenkins: `jen job
+#                                 list` names no commit, so there is nothing to
+#                                 match a sha against. Output:
 #                                   {"sha":"…","status":"queued|in_progress|
 #                                    completed|waiting|requested",
 #                                    "conclusion":"success|failure|…|null",
@@ -138,7 +159,26 @@
 #                                 unavailable, never "no run".
 #   issue-list [--limit N]        open tracker issues as JSON lines:
 #                                 {"number":N,"title":"…","url":"…",
-#                                  "createdAt":"…"}
+#                                  "createdAt":"…","status":"…",
+#                                  "statusCategory":"…"}
+#                                 `status` is the tracker's OWN word for the
+#                                 stage — per-workflow, possibly localised
+#                                 (*Internal Approving*). `statusCategory` is
+#                                 the stable three-value vocabulary (To Do /
+#                                 In Progress / Done) a board may group on.
+#                                 BOTH, because neither substitutes for the
+#                                 other: the name is what a person reads, the
+#                                 category is what a board decides on. EVERY
+#                                 backend answers both — GitHub derives them
+#                                 from the `--state` this op asks for, jira
+#                                 reads .fields.status, and bitbucket maps the
+#                                 state badge it already parses. A Jira-only
+#                                 field is what this adapter exists to prevent.
+#                                 `statusCategory` is "" where the tracker's
+#                                 vocabulary has no word for it — bitbucket's
+#                                 ON HOLD/INVALID/DUPLICATE/WONTFIX. Empty is
+#                                 an honest answer; an invented category files
+#                                 abandoned work beside finished work.
 #                                 READ-ONLY. Plot writes no label, no assignee
 #                                 and no close-on-merge, because a copy of
 #                                 tracker state ages into a lie. The one write
@@ -519,17 +559,141 @@ pr_list_call() { # "$@"=the host command → payload on stdout, or dies
 # per row rather than blanking the entire list, and exit 3 is reserved for
 # when the operation itself cannot proceed.
 
-# Resolve CI backend: $PLOT_CI (for tests), then `CI` key, default "".
-# Non-jenkins values (github-actions, none, "") mean "no separate CI fetch".
-# The CI system this repo runs its builds on: `jenkins`, `github-actions`, or
-# `none`. Independent of the Git host — a Bitbucket repo can build on Jenkins,
-# and this key is what pairs the two. `PLOT_CI` overrides for tests.
-ci_backend() {
+# The raw `CI` declaration: `$PLOT_CI`, then the `CI` key, else empty.
+#
+# `PLOT_CI` IS A PRODUCTION CONTRACT, not a test override. The function this
+# replaced called it *"overrides for tests"*, and that had been false since
+# the build connectors landed: `build-actions.ts:39` passes
+# `buildReads({ context, system: SYSTEM }, { PLOT_CI: SYSTEM })` as the dispatch
+# contract the arm reads. It keeps its precedence and is split the same way, so
+# a connector's bare `SYSTEM` word and a person's prose reach one comparison.
+ci_raw() {
   if [ -n "${PLOT_CI:-}" ]; then
-    printf '%s\n' "$PLOT_CI" | tr '[:upper:]' '[:lower:]'
+    printf '%s\n' "$PLOT_CI"
+    return
+  fi
+  bash "$here/plot-config.sh" get "CI" ""
+}
+
+# The CI system this repository declares — the FIRST token, lowercased.
+#
+# THE ONE READER OF THE `CI` KEY'S SCHEME, and every arm that dispatches on the
+# CI system compares this. The function it replaced returned the WHOLE value
+# while its four callers each matched a bare word (`jenkins`,
+# `github-actions`), so a repository declaring
+# `` CI: Jenkins at `jenkins-ci-ewz…` `` missed every arm and read
+# `basis: unknown` where the Jenkins connector had `predicted: 60` ready.
+# Measured 2026-09-09 against a reachable instance: only the bare word matched,
+# and no repository on the estate writes it.
+#
+# THE PAYLOAD WAS THE SECOND HALF OF THAT COST. `ci-limit` reported the prose
+# value as its `connector`, and `build-shell.ts` filters readings by equality
+# against the connector's bare system word — so the reading was discarded before
+# any caller saw it, and a metered Jenkins reported as metering nothing.
+#
+# Shaped after `tracker_scheme()` (`:1340`) — the same key packing a scheme
+# ahead of its detail, split the same way. Empty when nothing is declared, and
+# ABSENT IS NOT FALSE: `ci_unaskable()` reads an empty scheme as *this
+# repository named no CI system*, which is a different answer from *this system
+# has no connector*.
+ci_scheme() {
+  ci_raw | awk '{print tolower($1)}'
+}
+
+# Whether a candidate token is a host `jen -I` could be given.
+#
+# A URL passes whole. Otherwise it must be dot-separated labels ending in an
+# alphabetic TLD, carrying no path separator and no `@`.
+#
+# THE FINAL FILTER IS THE FILE EXTENSION, and that is a measurement rather than
+# a preference. `ci.yml` and `package.json` both match the dotted-label pattern,
+# while `.ch` and `.io` are real two-letter TLDs — so TLD LENGTH cannot separate
+# a host from a filename in either direction, and a `CI:` value naming a
+# workflow file (`github-actions (see .github/workflows/ci.yml)`) is the
+# measured case that would otherwise be read as a server.
+ci_looks_like_host() {
+  case "$1" in
+    https://*|http://*) return 0 ;;
+    */*|*@*) return 1 ;;
+  esac
+  printf '%s\n' "$1" \
+    | grep -qE '^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*\.[a-z]{2,}$' || return 1
+  case "$1" in
+    *.yml|*.yaml|*.json|*.md|*.sh|*.js|*.ts|*.mjs|*.cjs|*.toml|*.xml|*.txt|*.lock|*.gradle) return 1 ;;
+  esac
+  return 0
+}
+
+# Where this repository's CI lives: the `Jenkins instance` key, then
+# `$JENKINS_INSTANCE`, then a host read out of the `CI` value. Empty when none
+# of the three names one.
+#
+# THE ORDER IS NOT THE TRACKER'S, and the reason is information content.
+# `tracker_base_url()` lets `$PLOT_JIRA_BASE_URL` win over its config value
+# because both carry the same shape — a URL. Here the key carries MORE than the
+# prose can express: `jenkins_instance()` (`:665`) returns `<slug>/<job/path>`,
+# and the container path is a fact no file in a repository states
+# (`stack.ts:98` calls the host *"the SLUG half"*). A prose-derived slug alone
+# degrades `jenkins_build_map()` to root-scope listing, where its own comment
+# says *"every branch reads `none`"* — and `quaweb` is nested
+# (`job/quaweb/job/release`), so that renders an empty board for the exact
+# repository this serves. So the explicit key is the primary and the prose is
+# the fallback, never the other way round.
+#
+# IT EXTRACTS A HOST, NOT A REMAINDER. "Everything after the first token" was
+# measured against all three real values and fails on every one:
+# `at jenkins-ci-ewz… (Bitbucket PRs…`, `pipelines in .build/pipelines/ …`,
+# `(e.g. continuous-build…)`. None is a host, and handing `jen -I` a sentence
+# is worse than handing it nothing. `Tracker:` gets away with the naive split
+# because its value is a scheme and a URL; `CI:` is prose in every repository
+# that declares it.
+#
+# A BACKTICKED SPAN IS PREFERRED because the backticks are a deliberate act —
+# the writer pointed at the value. It must still look like a host: one real
+# repository marks up a PATH (`` `.build/pipelines/` ``), which is not a server.
+#
+# BACKTICKS ARE STRIPPED AND NO SCHEME IS NORMALISED ON. `ewz` writes a bare
+# host in backticks and the probe used a full `https://` URL; `jen -I` accepts
+# either, so inventing a canonical form would break whichever caller passes the
+# other one.
+#
+# EMPTY IS AN ANSWER, not a failure: `Jenkins (e.g. continuous-build, …)` names
+# no instance. Read the exit code, never the emptiness.
+ci_instance() {
+  local instance candidate
+  instance=$(bash "$here/plot-config.sh" get "Jenkins instance" "" 2>/dev/null || echo "")
+  [ -n "$instance" ] || instance="${JENKINS_INSTANCE:-}"
+  if [ -n "$instance" ]; then
+    printf '%s' "$instance"
     return
   fi
-  bash "$here/plot-config.sh" get "CI" "" | tr '[:upper:]' '[:lower:]'
+
+  local value
+  value="$(ci_raw)"
+
+  # The backticked spans, in order: `tr` puts each on its own line, so the
+  # even-numbered lines are what sat between a pair of backticks.
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    if ci_looks_like_host "$candidate"; then
+      printf '%s' "$candidate"
+      return
+    fi
+  done <<EOF
+$(printf '%s\n' "$value" | tr '\`' '\n' | awk 'NR % 2 == 0')
+EOF
+
+  # Otherwise the first bare token that looks like a host. Punctuation that
+  # ends a clause is split off so `(jenkins.acme.dev)` reads as the host.
+  while IFS= read -r candidate; do
+    [ -n "$candidate" ] || continue
+    if ci_looks_like_host "$candidate"; then
+      printf '%s' "$candidate"
+      return
+    fi
+  done <<EOF
+$(printf '%s\n' "$value" | tr -d '\`' | tr ' \t,()[]<>"'"'" '\n')
+EOF
 }
 
 # Fetch Jenkins build statuses for every branch in a multibranch job, in ONE
@@ -634,6 +798,97 @@ jenkins_build_map() {
   '
 }
 
+# Where this repository's Jenkins lives — the `Jenkins instance` key, else
+# `JENKINS_INSTANCE`. Prints nothing when neither is set.
+#
+# Read through ONE function because three ops now ask it. `pr-list --rich` read
+# it inline first; `runs` and `run-for-sha` ask the same question and must get
+# the same answer and the same refusal, or a repository would be configured for
+# one op and not the others.
+jenkins_instance() {
+  local instance
+  instance=$(bash "$here/plot-config.sh" get "Jenkins instance" "" 2>/dev/null || echo "")
+  [ -n "$instance" ] || instance="${JENKINS_INSTANCE:-}"
+  printf '%s' "$instance"
+}
+
+# The refusal a Jenkins op prints when it has no instance to ask, naming the
+# three repairs. Exit 3 — the op itself cannot proceed, which is a config error
+# only a person can fix, and deliberately NOT exit 4: a `CI: jenkins` repository
+# CAN be asked about builds, it just has not said where.
+jenkins_no_instance() {
+  echo "plot-host: CI is jenkins but no Jenkins instance is configured" >&2
+  echo "  Add a 'Jenkins instance' key to the ## Plot Config section of CLAUDE.md," >&2
+  echo "  naming the instance \`jen\` knows, or set JENKINS_INSTANCE." >&2
+  echo "  Or drop the 'CI: jenkins' key to read build status from the git host." >&2
+  exit 3
+}
+
+# NOT BEING ABLE TO ASK IS NOT AN EMPTY ANSWER, and exit 4 is where the two are
+# kept apart. An empty run list means *this branch has no runs*; a repository
+# that declared no CI system has nothing that could hold one, and a caller
+# reading `[]` for that would report *nothing has ever failed here* about a
+# question nobody asked.
+#
+# `ci-limit`'s `*)` arm already draws this line for a connector nobody wrote an
+# estimate for. This draws it one step earlier, for a connector that does not
+# exist at all — and `resultOf` (`adapters/run-script.ts:211`) maps exit 4 onto
+# `unaskable`, which is the word the build port already answers with.
+# The Jenkins REST credential, read from where `jen` already stores it.
+#
+# NOT THE KEYCLOAK BEARER. `jen auth token` prints one and Jenkins answers it
+# with an HTML login redirect — measured 2026-09-10, and it is the trap that
+# made an earlier reading conclude the sha was unreachable. Jenkins' own API
+# takes BASIC auth with a user and an API token, which `jen` keeps in the login
+# keychain under service `jen`, accounts `jenkins-user:<host>` and
+# `jenkins-token:<host>`.
+#
+# IT PRINTS `user:token` AND NOTHING ELSE, or nothing at all. The caller passes
+# it straight to `curl -u`; no branch echoes it, and no failure path names it.
+#
+# EMPTY IS THE HONEST ANSWER on a machine with no `security` (Linux, CI), with
+# no keychain entry, or with either half missing — a half credential is not a
+# credential. The caller turns that into exit 4, which is *cannot be asked*.
+jenkins_rest_credential() { # $1 = the bare host
+  command -v security >/dev/null 2>&1 || return 1
+  local u t
+  u=$(security find-generic-password -s jen -a "jenkins-user:$1" -w 2>/dev/null) || return 1
+  t=$(security find-generic-password -s jen -a "jenkins-token:$1" -w 2>/dev/null) || return 1
+  [ -n "$u" ] && [ -n "$t" ] || return 1
+  printf '%s:%s' "$u" "$t"
+}
+
+# A job path as Jenkins' REST API spells it: every segment under `job/`.
+#
+# `quaweb/release` is the path a person writes and `job/quaweb/job/release` is
+# the URL, because a Jenkins folder is itself a job. A multibranch branch adds
+# one more segment, PERCENT-ENCODED — `bug/foo` is `bug%2Ffoo`, the same
+# encoding `jenkins_build_map` already decodes on the way back.
+jenkins_job_url_path() { # $1 = job path, $2 = branch or ""
+  local out="" seg
+  local IFS=/
+  for seg in $1; do [ -n "$seg" ] && out="$out/job/$seg"; done
+  unset IFS
+  if [ -n "${2:-}" ]; then
+    out="$out/job/$(printf '%s' "$2" | sed 's|/|%2F|g')"
+  fi
+  printf '%s' "$out"
+}
+
+ci_unaskable() { # $1 = the op's name, $2 = the CI word (may be empty)
+  local ci_word="${2:-}"
+  if [ -z "$ci_word" ] || [ "$ci_word" = none ]; then
+    echo "plot-host: $1 — this repository declares no CI system, so there is nothing to ask" >&2
+    echo "  Add a 'CI' key to the ## Plot Config section of CLAUDE.md naming the" >&2
+    echo "  system that builds this repository — \`github-actions\` or \`jenkins\`." >&2
+  else
+    echo "plot-host: $1 — no connector for CI system '$ci_word'" >&2
+    echo "  Plot answers this op for \`github-actions\` and \`jenkins\`. An unknown" >&2
+    echo "  system cannot be asked, which is not the same as having no runs." >&2
+  fi
+  exit 4
+}
+
 # A LOOKUP MISS AND A TRANSPORT FAILURE ARE TWO ANSWERS, AND THE CLI GIVES ONE
 # EXIT CODE FOR BOTH.
 #
@@ -1280,6 +1535,60 @@ tracker_base_url() {
   tracker_raw | awk '{print $2}' | sed 's:/*$::'
 }
 
+# The Jira projects this repository's work lives in, one per line, or nothing.
+#
+# WHY A KEY AND NOT A QUERY. The inbox's default JQL scopes by PERSON
+# (`assignee = currentUser()`) and by STATE (`resolution = EMPTY`), and by
+# nothing else. On a shared Jira instance that is instance-wide: one reporter's
+# board showed twelve issues, of which one belonged to a different customer
+# entirely. Jira has no notion of the repository a board serves — no
+# `currentProject()` function exists — and that mapping lives only here, in this
+# repository's own config. Asking Jira which projects the user can see answers
+# the wrong question: that list is instance-wide too, and is what produced the
+# bug.
+#
+# IT HOLDS A LIST, and the single prefix adoption seeds only STARTS it.
+# `plot-detect-repo.sh` takes `head -1`, so a freshly adopted repo declares one
+# project. Filtering on that alone would be a second defect wearing the fix's
+# clothes — on the reported repository it shows 3 of 12 issues and hides the
+# other two projects' work under a heading claiming nobody had planned it. A
+# repository mapping to several Jira projects is the normal case.
+#
+# NAMED `Ticket prefixes`, not `Jira projects` (which puts a vendor in a config
+# key and severs the word the probe already uses) and not `Tracker projects`
+# (which generalises over a set of one). It sits next to `Branch prefixes` in
+# every adopting repo's config — an unrelated structural key holding `idea/`,
+# `feature/`, `bug/` — and only this docstring keeps the two apart.
+#
+# EMPTY IS THE ANSWER FOR AN UNDECLARED KEY, and callers must keep it meaning
+# *do not scope*: the absent case has to leave today's query untouched, or an
+# upgrade empties every existing board's inbox — a worse failure than the one
+# being fixed, because it looks like *no tickets* rather than the wrong ones.
+#
+# PARSING IS STATED HERE, not inherited: this is the estate's first list-valued
+# key with a consumer (`Implementation home` is documented as taking a list and
+# nothing splits one). Commas separate, surrounding whitespace is not part of a
+# value, and an empty element is dropped rather than emitted — a join over a
+# stray comma would otherwise produce `IN (PROJ-A,)`, which Jira rejects. A
+# value that is punctuation alone therefore reads as *undeclared*: it restores
+# the unscoped query rather than sending a query no instance would accept.
+#
+# `PLOT_TICKET_PREFIXES` overrides, the shape `PLOT_TRACKER` already sets. It
+# cannot express ABSENCE — an empty override falls through to the config — so
+# the absent case is tested with a repository that declares nothing.
+tracker_projects() {
+  local raw
+  if [ -n "${PLOT_TICKET_PREFIXES:-}" ]; then
+    raw="$PLOT_TICKET_PREFIXES"
+  else
+    raw="$(bash "$here/plot-config.sh" get "Ticket prefixes" "")"
+  fi
+  # One per line, trimmed, empties dropped. `plot-config.sh` already normalises
+  # `A,B` to `A, B`, but an override arrives unnormalised and a hand-edited
+  # value can carry a stray comma — so the split is done here regardless.
+  printf '%s' "$raw" | tr ',' '\n' | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//' | grep -v '^$' || true
+}
+
 # The env var scheme for Jira auth. The plan left the EXACT names open, to be
 # confirmed against a real instance; these follow Jira Cloud's documented Basic
 # scheme (email + API token, base64'd into an Authorization header):
@@ -1454,12 +1763,47 @@ backend_declared() {
     return
   fi
   local v
-  v="$(bash "$here/plot-config.sh" get "Git host" "github" | tr '[:upper:]' '[:lower:]')"
+  v="$(bash "$here/plot-config.sh" get "Git host" "" | tr '[:upper:]' '[:lower:]')"
   case "$v" in
-    bb) echo "bitbucket" ;;
-    "") echo "github" ;;
-    *) printf '%s\n' "$v" ;;
+    bb) echo "bitbucket"; return ;;
+    "") : ;;
+    *) printf '%s\n' "$v"; return ;;
+  esac
+
+  # NOTHING DECLARED — INFER FROM THE REMOTE, AND REFUSE WHERE THERE IS NONE.
+  # This answered `github` unconditionally until 2026-09-11, which is the
+  # reassuring direction: a Bitbucket repo that forgot the key got GitHub's
+  # answer, and a repo with no remote at all got one too. Measured on a fresh
+  # `git init` with no remote: `backend` printed `github` and exited 0.
+  #
+  # THE REMOTE IS EVIDENCE AND THE KEY IS A DECLARATION, so the key still wins
+  # above. What changes is only the case where nobody said: a hostname in the
+  # remote is a reading, and no remote is no reading.
+  local url
+  url="$(git config --get remote.origin.url 2>/dev/null || true)"
+  case "$url" in
+    *github.com*)    echo "github";    return ;;
+    *bitbucket.org*) echo "bitbucket"; return ;;
   esac
+
+  # NOTHING NAMES A HOST, AND THAT IS REPORTED RATHER THAN REFUSED. An earlier
+  # version of this returned exit 4 here, and five contract tests went red:
+  # a sandbox repository with no remote is a legitimate, common shape — six
+  # suites build one — and every op that needs a host in one was relying on
+  # this default. Refusing at the resolver punishes them for a question they
+  # never asked.
+  #
+  # SO THE GUESS SURVIVES AND STOPS BEING SILENT — AND IT SIGNALS THROUGH THE
+  # EXIT CODE, NEVER A VARIABLE. This set a `BACKEND_UNNAMED` global first, and
+  # the caller reads it as `v="$(backend_declared)"` — a COMMAND SUBSTITUTION,
+  # which runs in a subshell, so the assignment died with the child and the
+  # parent always read 0. The warning never printed, and a direct call looked
+  # correct because its stdout was right.
+  #
+  # Exit 9 is arbitrary and deliberately outside the contract's 0/1/3/4: it
+  # never leaves this file, and `backend` maps it back to a successful answer.
+  echo "github"
+  return 9
 }
 
 # The resolved backend, refused where this script has no arm for it.
@@ -1472,12 +1816,27 @@ backend_declared() {
 # person must fix. `host-shell.ts` reads that code as `unaskable` and reads the
 # sentence below for the name.
 backend() {
-  local v
-  v="$(backend_declared)" || return 1
+  local v rc unnamed=0
+  # THE DECLARED-HOST REFUSAL IS PASSED THROUGH, NOT FLATTENED. `|| return 1`
+  # collapsed exit 4 into 1 here, and 4 is the one code every caller reads as
+  # *this cannot be asked at all* rather than *retry*. Measured 2026-09-11: a
+  # repository with no remote exited 1, which tells a caller to try again.
+  v="$(backend_declared)"; rc=$?
+  # 9 is the resolver's private word for *answered, but nothing named it*.
+  if [ "$rc" -eq 9 ]; then unnamed=1; rc=0; fi
+  [ "$rc" -eq 0 ] || return "$rc"
   if ! host_drivable "$v"; then
     echo "plot-host: cannot drive '$v' — this script drives ${HOST_DRIVES// /, }; set the 'Git host' key in CLAUDE.md (or \$PLOT_HOST) to one of them" >&2
     return 4
   fi
+  # THE ANSWER IS PRINTED EITHER WAY, AND A GUESS SAYS SO. `backend` is a
+  # reading, not a gate: a caller that needs a host still gets one, and a
+  # person asking which host this is learns the answer was inferred from
+  # nothing. Exit stays 0 — the value is usable, its provenance is not certain.
+  if [ "$unnamed" = 1 ]; then
+    echo "plot-host: no 'Git host' key and no remote names one — assuming '$v'" >&2
+    echo "  Set the 'Git host' key in ## Plot Config (or \$PLOT_HOST) to be sure." >&2
+  fi
   printf '%s\n' "$v"
 }
 
@@ -2163,6 +2522,73 @@ case "$op" in
     fi
     ;;
 
+  pr-merge-commit)
+    # THE MERGE COMMIT OF A BRANCH'S MERGED PR, and nothing else.
+    #
+    # A SECOND SUBCOMMAND RATHER THAN A FIELD ON `pr-merged`, because that one
+    # prints ONE WORD and eleven callers read it as one — `plot-reap.sh`,
+    # `plot-release-refs.sh` and `plot-dispatch.sh` among them, each deciding
+    # whether to remove something. Widening its output to carry a sha would
+    # rewrite a contract those callers depend on, to serve a question none of
+    # them asks.
+    #
+    # THE QUERY IS `pr-merged`'s, so a caller asking both spends TWO calls where
+    # one would do — and that is a cost this path does not pay: delivery asks
+    # this only for a branch it has already been told merged, and the plan it
+    # serves budgets one host call per branch either way.
+    #
+    # `--state all` and `--limit 100` for `pr-merged`'s own two reasons: a
+    # merged PR reports CLOSED, and the newest PR is not the merge.
+    #
+    # PRINTS NOTHING AND EXITS 0 where no PR merged — an ANSWER, the same shape
+    # `pr-state` gives for a missing PR. Exit 3 is the question failing.
+    ref="${1:?pr-merge-commit needs a branch}"; shift || true
+    repo_args=()
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        --repo) repo_args=(-R "${2:?}"); shift 2 ;;
+        *) die "pr-merge-commit: unknown arg $1" ;;
+      esac
+    done
+    if [ "$be" = "github" ]; then
+      if out="$(gh ${repo_args[@]+"${repo_args[@]}"} pr list --head "$ref" --state all --limit 100 --json mergedAt,mergeCommit 2>/tmp/plot-host-err.$$)"; then
+        rm -f "/tmp/plot-host-err.$$"
+        # The FIRST merged PR carrying a sha. A branch may hold several merged
+        # PRs; each names its own merge commit, and any of them is a commit that
+        # landed this branch's work.
+        jq -r 'map(select(.mergedAt != null and .mergeCommit != null))
+               | map(.mergeCommit.oid) | first // empty' <<<"$out"
+      else
+        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        # A lookup miss is an answer: no PR, so no merge commit. Anything else
+        # is the question failing, and silence must not read as "carried
+        # nothing" — the caller distinguishes the two by the exit code.
+        if [ -z "$err" ] || is_lookup_miss "$err"; then
+          :
+        else
+          echo "plot-host: $err" >&2
+          exit 3
+        fi
+      fi
+    else
+      bb_require_json
+      # Bitbucket names the merge commit `merge_commit.hash` on a merged PR.
+      if out="$(bb ${repo_args[@]+"${repo_args[@]}"} pr list --state merged --json 2>/tmp/plot-host-err.$$)"; then
+        rm -f "/tmp/plot-host-err.$$"
+        jq -r --arg b "$ref" 'map(select(.source.branch.name==$b))
+               | map(.merge_commit.hash // empty) | first // empty' <<<"$out"
+      else
+        err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
+        if [ -z "$err" ] || is_lookup_miss "$err"; then
+          :
+        else
+          echo "plot-host: $err" >&2
+          exit 3
+        fi
+      fi
+    fi
+    ;;
+
   pr-create)
     title=""; body=""; base=""; head=""; draft=0
     while [ $# -gt 0 ]; do
@@ -2276,19 +2702,12 @@ case "$op" in
     #     the board rejects a non-zero pr-list and keeps its last good map; one
     #     dead Jenkins must not darken every row. This reconciles Done-when 4's
     #     "exits 3" with the brief's "prefer unknown on the affected rows".
-    ci="$(ci_backend)"
+    ci="$(ci_scheme)"
     jen_map=""
     jen_status=""
     if [ "$ci" = "jenkins" ] && [ "$rich" = 1 ]; then
-      jen_instance=$(bash "$here/plot-config.sh" get "Jenkins instance" "" 2>/dev/null || echo "")
-      [ -n "$jen_instance" ] || jen_instance="${JENKINS_INSTANCE:-}"
-      if [ -z "$jen_instance" ]; then
-        echo "plot-host: CI is jenkins but no Jenkins instance is configured" >&2
-        echo "  Add a 'Jenkins instance' key to the ## Plot Config section of CLAUDE.md," >&2
-        echo "  naming the instance \`jen\` knows, or set JENKINS_INSTANCE." >&2
-        echo "  Or drop the 'CI: jenkins' key to read build status from the git host." >&2
-        exit 3
-      fi
+      jen_instance="$(jenkins_instance)"
+      [ -n "$jen_instance" ] || jenkins_no_instance
       jen_payload=$(jenkins_build_map "$jen_instance")
       jen_status=$(printf '%s' "$jen_payload" | jq -r '.status // "failed"' 2>/dev/null || echo "failed")
       jen_map=$(printf '%s' "$jen_payload" | jq -c '.map // {}' 2>/dev/null || echo "{}")
@@ -2543,9 +2962,13 @@ case "$op" in
     # and failing branches are rare by construction; a caller that asked for
     # every branch would spend a budget the board has already exhausted once.
     #
-    # Bitbucket reports nothing here rather than something invented. `bb` has no
-    # run listing, and an empty history renders as "unavailable" — never as
-    # "this branch has never failed before".
+    # IT DISPATCHES ON THE CI SYSTEM, NEVER ON THE GIT HOST. This arm gated on
+    # `be` until 2026-09-08, which made this repository's accident — GitHub is
+    # both — the shape of the op: a Bitbucket team building on Jenkins got
+    # silence, and a GitHub team building on Jenkins got GitHub Actions runs
+    # for a repository whose CI is not GitHub Actions. `CI` and `Git host` are
+    # independent `## Plot Config` keys, and this is the op that reads the
+    # first of them.
     branch="${1:?runs needs a branch}"; shift
     limit=10
     while [ $# -gt 0 ]; do
@@ -2554,13 +2977,61 @@ case "$op" in
         *) die "runs: unknown arg $1" ;;
       esac
     done
-    if [ "$be" = "github" ]; then
-      gh run list --branch "$branch" --limit "$limit" \
-        --json workflowName,conclusion,status,startedAt,url 2>/dev/null \
-        | jq -c '.[] | {workflow:.workflowName,
-                        conclusion:(if (.conclusion // "") == "" then .status else .conclusion end),
-                        startedAt:.startedAt, url:.url}' 2>/dev/null || true
-    fi
+    _ci="$(ci_scheme)"
+    case "$_ci" in
+      github-actions)
+        # THE GIT HOST STILL HAS TO BE GITHUB, and that is a second condition
+        # rather than the same one. `gh run list` reads the runs of the
+        # repository the CWD's remote names, so a repository declaring
+        # `CI: github-actions` on a Bitbucket remote has declared something
+        # `gh` cannot reach — an unaskable configuration, not an empty history.
+        if [ "$be" != "github" ]; then
+          echo "plot-host: runs — CI is github-actions but the git host is '$be'" >&2
+          echo "  \`gh run list\` reads the runs of the repository its remote names," >&2
+          echo "  so there is no GitHub repository here to ask about." >&2
+          exit 4
+        fi
+        gh run list --branch "$branch" --limit "$limit" \
+          --json workflowName,conclusion,status,startedAt,url 2>/dev/null \
+          | jq -c '.[] | {workflow:.workflowName,
+                          conclusion:(if (.conclusion // "") == "" then .status else .conclusion end),
+                          startedAt:.startedAt, url:.url}' 2>/dev/null || true
+        ;;
+      jenkins)
+        # ONE STATE PER BRANCH, REPORTED AS A HISTORY OF ONE — and the PR says
+        # so, because it is the honest limit of the transport this arm has.
+        # `jenkins_build_map` answers `{color, checks, job}` for every branch in
+        # one call: a CURRENT state, with no timestamps, no URL and no earlier
+        # runs. A history is what Jenkins holds and what its REST API answers;
+        # reading it is `the-ci-connector-is-jenkins`'s own slice, and inventing
+        # entries here to fill the shape would be the collector reaching a
+        # verdict (Principle 3).
+        #
+        # SO THE FIELDS THIS CANNOT MEASURE ARE EMPTY, never guessed. `workflow`
+        # names the Jenkins job, which is the one thing the map does carry and
+        # the detail a reader opens; `conclusion` is the `checks` word the
+        # colour table already settled; `startedAt` and `url` are empty,
+        # because a timestamp this arm invented would read as measurement.
+        _jen_instance="$(jenkins_instance)"
+        [ -n "$_jen_instance" ] || jenkins_no_instance
+        _jen_payload=$(jenkins_build_map "$_jen_instance")
+        _jen_status=$(printf '%s' "$_jen_payload" | jq -r '.status // "failed"' 2>/dev/null || echo "failed")
+        if [ "$_jen_status" != "ok" ]; then
+          # UNREACHABLE IS NOT EMPTY EITHER. `pr-list --rich` can mark its rows
+          # `unknown` and keep them; this op has no row to carry the word, so
+          # the only way to say *cannot verify* is the exit code. Printing
+          # nothing at exit 0 would read as *this branch has never run*.
+          echo "plot-host: runs — jenkins unreachable ($_jen_status)" >&2
+          exit 4
+        fi
+        printf '%s' "$_jen_payload" | jq -c --arg branch "$branch" \
+          '.map[$branch] // empty
+           | {workflow:(.job // ""), conclusion:(.checks // ""), startedAt:"", url:""}' 2>/dev/null || true
+        ;;
+      *)
+        ci_unaskable runs "$_ci"
+        ;;
+    esac
     ;;
 
   run-for-sha)
@@ -2606,39 +3077,151 @@ case "$op" in
         *) die "run-for-sha: unknown arg $1" ;;
       esac
     done
-    if [ "$be" = "github" ]; then
-      # `headSha` is the field that makes this answerable at all; `runs` omits
-      # it, which is why that op cannot be reused here.
-      #
-      # NEWEST FIRST, then the FIRST match is taken: `gh run list` returns runs
-      # newest-first, and a sha can carry several (a rerun, or several
-      # workflows). The newest is the live answer; older ones for the same sha
-      # are superseded by the same argument that superseded runs for older shas.
-      # THE SHA ASKED ABOUT IF THERE IS ONE, ELSE THE NEWEST RUN ON THE BRANCH —
-      # and `sha` in the output says WHICH, because a caller that could not tell
-      # the two apart would be back to the branch-scoped guessing this op exists
-      # to end.
-      #
-      # WHY IT FALLS BACK AT ALL, rather than reporting nothing. Filtering to
-      # the asked-for sha and stopping makes the most important case invisible:
-      # a run IN FLIGHT for a commit the branch has already moved past reports
-      # identically to no run at all, so a caller cannot distinguish *CI has not
-      # started yet* from *CI is busy answering about the past*. The second is
-      # the state that had two merge waiters reporting on superseded runs on
-      # 2026-08-30, and it is exactly what a caller needs to see.
-      #
-      # IT STILL DECIDES NOTHING (Principle 3). It reports the run it found and
-      # the sha that run is for; whether that sha being different from the one
-      # asked about means "superseded" is the caller's rule. This collects.
-      gh run list --branch "$branch" --limit "$limit" \
-        --json headSha,conclusion,status,startedAt,url 2>/dev/null \
-        | jq -c --arg sha "$sha" \
-            '(map(select(.headSha == $sha)) | .[0]) // .[0]
-             | select(. != null)
-             | {sha:.headSha, status:.status,
-                conclusion:(if (.conclusion // "") == "" then null else .conclusion end),
-                url:.url, startedAt:.startedAt}' 2>/dev/null || true
+    # DISPATCHED ON THE CI SYSTEM, for the reason `runs` above states: the git
+    # host is a separate key, and a build is the CI system's fact.
+    _ci="$(ci_scheme)"
+    case "$_ci" in
+      jenkins)
+        # THE SHA IS IN JENKINS AND `jen` IS NOT THE TRANSPORT. Measured
+        # 2026-09-10 against a live instance: a build entry from `jen build
+        # list --json` carries `id`, `status`, timings and stages, and a search
+        # of the whole payload for `sha|commit|revision|scm` matches nothing.
+        # `jen` has no changesets subcommand and no raw-API passthrough.
+        #
+        # JENKINS' OWN REST API ANSWERS IT, at
+        # `actions[].lastBuiltRevision.SHA1`, paired with the branch. One
+        # `tree=` query returns a whole history — 4855 bytes for five builds —
+        # so this costs one round trip like the GitHub arm does.
+        #
+        # THIS ARM EXITED 4 UNTIL 2026-09-11, and the refusal was honest for
+        # the transport it had. What changed is the transport, not the rule.
+        _jen_instance="$(jenkins_instance)"
+        [ -n "$_jen_instance" ] || jenkins_no_instance
+        _jen_host="${_jen_instance%%/*}"
+        _jen_job="${_jen_instance#*/}"
+        [ "$_jen_job" = "$_jen_instance" ] && _jen_job=""
+        [ -n "${PLOT_JENKINS_JOB:-}" ] && _jen_job="$PLOT_JENKINS_JOB"
+        if [ -z "$_jen_job" ]; then
+          # A bare-host instance names no job, and a sha lives in a job's
+          # builds. `runs` degrades to an empty map here; this op has no row to
+          # carry that, so the only way to say *cannot be asked* is exit 4.
+          echo "plot-host: run-for-sha — the Jenkins instance names no job path" >&2
+          echo "  A sha is a fact about a job's builds, so the instance must be" >&2
+          echo "  <slug>/<job/path> rather than a bare host." >&2
+          exit 4
+        fi
+        _jen_cred="$(jenkins_rest_credential "$_jen_host")" || {
+          # NO CREDENTIAL IS *CANNOT BE ASKED*, never *no run*. The keychain is
+          # macOS-only and a Linux agent legitimately has none; saying nothing
+          # at exit 0 would read as a branch that never built.
+          echo "plot-host: run-for-sha — no Jenkins API credential for '$_jen_host'" >&2
+          echo "  Jenkins' REST API takes basic auth with an API token, which" >&2
+          echo "  \`jen auth login\` stores in the login keychain. The Keycloak" >&2
+          echo "  bearer from \`jen auth token\` is NOT it — Jenkins answers that" >&2
+          echo "  with a login redirect." >&2
+          exit 4
+        }
+        # A BRANCH IS A JOB SEGMENT ON A MULTIBRANCH JOB AND NOT ON A PLAIN
+        # ONE, and no reading of the configured path says which this is. So the
+        # multibranch URL is tried first and the plain one is the fallback:
+        # `job/quaweb/job/continuous-build/job/content%2Fctas` against
+        # `job/quaweb/job/release`. Measured 2026-09-11 — asking the plain job
+        # for a branch segment answers 404, which is why guessing one shape
+        # cost a run.
+        #
+        # THE PLAIN JOB REPORTS ITS OWN BUILDS whatever branch was asked about,
+        # and that is honest rather than wrong: a pipeline job builds one
+        # thing, and the `sha` in the answer says which commit it built.
+        _jen_tree="tree=builds%5Bnumber,result,building,timestamp,url,actions%5BlastBuiltRevision%5BSHA1%5D%5D%5D%7B0,$limit%7D"
+        _jen_body=""
+        for _jen_path in \
+          "$(jenkins_job_url_path "$_jen_job" "$branch")" \
+          "$(jenkins_job_url_path "$_jen_job" "")"; do
+          host_slot_take jenkins ''
+          _jen_try=$(curl -sg --max-time 30 -u "$_jen_cred" \
+            "https://$_jen_host$_jen_path/api/json?$_jen_tree" 2>/dev/null) || true
+          host_slot_give
+          budget_record_call jenkins ''
+          if printf '%s' "$_jen_try" | jq -e 'has("builds")' >/dev/null 2>&1; then
+            _jen_body="$_jen_try"; break
+          fi
+        done
+        _jen_cred=""
+        if [ -z "$_jen_body" ] || ! printf '%s' "$_jen_body" | jq -e 'has("builds")' >/dev/null 2>&1; then
+          # AN UNREACHABLE INSTANCE IS NOT AN EMPTY HISTORY. A refused or
+          # redirected request answers HTML, which fails the `builds` test.
+          echo "plot-host: run-for-sha — Jenkins did not answer for '$_jen_host'" >&2
+          exit 4
+        fi
+        # THE SAME FALLBACK RULE AS THE GITHUB ARM, and it is inherited rather
+        # than invented: the asked-for sha if a build carries it, else the
+        # newest build, and `sha` says WHICH. A caller that could not tell the
+        # two apart would be back to the branch-scoped guessing this op ends.
+        #
+        # `result` is null while a build runs, which is Jenkins' own word for
+        # *in flight* — mapped to the `status`/`conclusion` split the contract
+        # already uses, so the shape does not fork per connector.
+        printf '%s' "$_jen_body" | jq -c --arg sha "$sha" '
+          [ .builds[]
+            | { sha: ([ .actions[]? | select(.lastBuiltRevision) | .lastBuiltRevision.SHA1 ] | first // ""),
+                status: (if .building then "in_progress" else "completed" end),
+                conclusion: (if .building then null else (.result // null) end),
+                url: (.url // ""),
+                startedAt: (if .timestamp then (.timestamp / 1000 | todate) else "" end) } ]
+          | ((map(select(.sha == $sha)) | .[0]) // .[0])
+          | select(. != null)' 2>/dev/null || true
+        # THIS ARM ANSWERS AND THE OP IS OVER. Everything below the `esac` is
+        # the GitHub path — the old jenkins arm reached it only because it
+        # ended in `exit 4`. Measured 2026-09-11: without this the answer was
+        # printed and then a `CI is github-actions but the git host is
+        # 'bitbucket'` refusal followed it on stderr.
+        exit 0
+        ;;
+      github-actions) : ;;
+      *) ci_unaskable run-for-sha "$_ci" ;;
+    esac
+    if [ "$be" != "github" ]; then
+      # SAME SECOND CONDITION AS `runs`: `gh run list` reads the repository its
+      # remote names, so `CI: github-actions` on a non-GitHub remote names runs
+      # that cannot be reached from here.
+      echo "plot-host: run-for-sha — CI is github-actions but the git host is '$be'" >&2
+      echo "  \`gh run list\` reads the runs of the repository its remote names," >&2
+      echo "  so there is no GitHub repository here to ask about." >&2
+      exit 4
     fi
+    # From here the CI system is `github-actions` and the git host is GitHub;
+    # both were established above, so nothing guards the call.
+    # `headSha` is the field that makes this answerable at all; `runs` omits
+    # it, which is why that op cannot be reused here.
+    #
+    # NEWEST FIRST, then the FIRST match is taken: `gh run list` returns runs
+    # newest-first, and a sha can carry several (a rerun, or several
+    # workflows). The newest is the live answer; older ones for the same sha
+    # are superseded by the same argument that superseded runs for older shas.
+    # THE SHA ASKED ABOUT IF THERE IS ONE, ELSE THE NEWEST RUN ON THE BRANCH —
+    # and `sha` in the output says WHICH, because a caller that could not tell
+    # the two apart would be back to the branch-scoped guessing this op exists
+    # to end.
+    #
+    # WHY IT FALLS BACK AT ALL, rather than reporting nothing. Filtering to
+    # the asked-for sha and stopping makes the most important case invisible:
+    # a run IN FLIGHT for a commit the branch has already moved past reports
+    # identically to no run at all, so a caller cannot distinguish *CI has not
+    # started yet* from *CI is busy answering about the past*. The second is
+    # the state that had two merge waiters reporting on superseded runs on
+    # 2026-08-30, and it is exactly what a caller needs to see.
+    #
+    # IT STILL DECIDES NOTHING (Principle 3). It reports the run it found and
+    # the sha that run is for; whether that sha being different from the one
+    # asked about means "superseded" is the caller's rule. This collects.
+    gh run list --branch "$branch" --limit "$limit" \
+      --json headSha,conclusion,status,startedAt,url 2>/dev/null \
+      | jq -c --arg sha "$sha" \
+          '(map(select(.headSha == $sha)) | .[0]) // .[0]
+           | select(. != null)
+           | {sha:.headSha, status:.status,
+              conclusion:(if (.conclusion // "") == "" then null else .conclusion end),
+              url:.url, startedAt:.startedAt}' 2>/dev/null || true
     ;;
 
   issue-list)
@@ -2674,7 +3257,29 @@ case "$op" in
       # narrower inbox. ORDER BY created DESC so the newest ticket is first, the
       # same order `createdAt` gives the GitHub arm.
       jira_require_config
-      jql="${PLOT_JIRA_JQL:-assignee = currentUser() AND resolution = EMPTY ORDER BY created DESC}"
+      # `Ticket prefixes` SCOPES THE DEFAULT to this repository's projects. The
+      # default alone scopes by person and by state, so on a shared instance it
+      # is instance-wide: it returned another customer's ticket to a reporter's
+      # board (see `tracker_projects` for the measurement and the naming).
+      #
+      # THE CLAUSE IS SPLICED, NOT APPENDED, and the split below is why: JQL
+      # requires ORDER BY to close the query, so a clause added to the end of
+      # the default string makes a query Jira rejects.
+      #
+      # AN UNDECLARED KEY LEAVES THE QUERY BYTE-IDENTICAL. `$scope` is empty,
+      # the two halves rejoin exactly as they were written, and an upgrade
+      # changes nothing for a repository that never set the key.
+      scope=""
+      if projects="$(tracker_projects)" && [ -n "$projects" ]; then
+        # `IN (A, B)`, never a trailing comma: paste joins N-1 separators over N
+        # elements, so a one-element list — what adoption's seed writes — yields
+        # `IN (A)` rather than `IN (A,)`.
+        scope=" AND project IN ($(printf '%s' "$projects" | paste -sd, - | sed 's/,/, /g'))"
+      fi
+      # PLOT_JIRA_JQL STILL WINS OVER BOTH. Teams worked around this bug with
+      # their own JQL; an override that stopped overriding would break exactly
+      # the people who noticed the problem first.
+      jql="${PLOT_JIRA_JQL:-assignee = currentUser() AND resolution = EMPTY${scope} ORDER BY created DESC}"
       # maxResults bounds ONE page. The inbox is small by construction (a
       # person's open tickets), so no nextPageToken loop is needed; the caller's
       # --limit caps it, else Jira's default page. v2 `search/jql` takes the same
@@ -2686,7 +3291,7 @@ case "$op" in
       raw="$(jira_curl "/rest/api/2/search/jql" \
                -G \
                --data-urlencode "jql=$jql" \
-               --data-urlencode "fields=summary,created" \
+               --data-urlencode "fields=summary,created,status" \
                --data-urlencode "maxResults=$max")"; curl_rc=$?
       body="$(jira_check "$raw" "$curl_rc")" || exit $?
       # `number` is the Jira KEY (PROJ-123), a string — #447 taught the parser to
@@ -2694,21 +3299,39 @@ case "$op" in
       # search payload carries no browse URL, and the base is ours to know
       # (Principle 3: this script is the one place that knows a host URL's shape).
       base="$(tracker_base_url)"
+      # `status` is the workflow's own word (*Internal Approving*) and may be
+      # localised; `statusCategory` is Jira's stable three-value vocabulary
+      # (To Do / In Progress / Done). BOTH are carried because neither
+      # substitutes for the other: the name is what a person reads, the
+      # category is what a board groups on. A board grouping on the name
+      # fragments across projects that spell the same stage differently.
       printf '%s' "$body" | jq -c --arg base "$base" '.issues[]? | {
           number: .key,
           title: (.fields.summary // ""),
           url: ($base + "/browse/" + .key),
-          createdAt: (.fields.created // "")
+          createdAt: (.fields.created // ""),
+          status: (.fields.status.name // ""),
+          statusCategory: (.fields.status.statusCategory.name // "")
         }'
     elif [ "$be" = "github" ]; then
       # `gh issue list` — not `gh api /issues`. On GitHub every PR IS an issue,
       # so the REST endpoint returns both, and every open PR would arrive here
       # as a signal nobody had planned. The `gh` subcommand filters PRs out;
       # this note exists because that trap is invisible while it works.
-      if out="$(gh issue list --state open ${limit_args[@]+"${limit_args[@]}"} \
+      # `status` is DERIVED from the state this call asks for, never written
+      # twice. GitHub has no workflow states: an issue is open or closed, and
+      # this op asks for open ones only. So the state passed to `gh` is the
+      # answer, and `$gh_state` is read by both the flag and the projection —
+      # a second literal would be a copy that a widened filter silently
+      # outdates. `To Do` is the category because an open GitHub issue is
+      # unstarted by the only vocabulary GitHub has.
+      gh_state="open"
+      if out="$(gh issue list --state "$gh_state" ${limit_args[@]+"${limit_args[@]}"} \
                   --json number,title,url,createdAt 2>/tmp/plot-host-err.$$)"; then
         rm -f "/tmp/plot-host-err.$$"
-        jq -c '.[] | {number:.number,title:.title,url:(.url // ""),createdAt:(.createdAt // "")}' <<<"$out"
+        jq -c --arg status "$gh_state" \
+          '.[] | {number:.number,title:.title,url:(.url // ""),createdAt:(.createdAt // ""),
+                  status:$status,statusCategory:(if $status == "open" then "To Do" else "Done" end)}' <<<"$out"
       else
         err="$(cat "/tmp/plot-host-err.$$" 2>/dev/null)"; rm -f "/tmp/plot-host-err.$$"
         # NO empty-list fallback. `host_miss_or_fail` exists for a lookup whose
@@ -2748,15 +3371,37 @@ case "$op" in
         [[ "$line" =~ ^#0*([0-9]+)[[:space:]]+(.*)$ ]] || continue
         num="${BASH_REMATCH[1]}"
         rest="${BASH_REMATCH[2]}"
-        # Strip the leading state badge word (NEW/OPEN/RESOLVED/…) and its
-        # padding; the title starts after it.
-        rest="$(sed -E 's/^(NEW|OPEN|ON HOLD|INVALID|RESOLVED|DUPLICATE|WONTFIX|CLOSED)[[:space:]]+//' <<<"$rest")"
+        # Lift the leading state badge word (NEW/OPEN/RESOLVED/…), then strip
+        # it and its padding; the title starts after it. The badge was parsed
+        # here before and THROWN AWAY to recover the title — it is captured
+        # now rather than fetched, so this costs no extra call. ONE
+        # vocabulary, matched once: a second copy in a mapping table is a list
+        # that drifts from the one that strips.
+        state=""
+        if [[ "$rest" =~ ^(NEW|OPEN|ON\ HOLD|INVALID|RESOLVED|DUPLICATE|WONTFIX|CLOSED)[[:space:]]+(.*)$ ]]; then
+          state="${BASH_REMATCH[1]}"
+          rest="${BASH_REMATCH[2]}"
+        fi
+        # Map the badge onto the three-value category the board groups on.
+        # NEW/OPEN are unstarted; RESOLVED/CLOSED are finished. The rest —
+        # ON HOLD, INVALID, DUPLICATE, WONTFIX — get "" DELIBERATELY: they are
+        # terminal-without-being-done or started-without-progressing, and
+        # neither is a Jira category. Empty says *this vocabulary has no word
+        # for it*, which a board can render; inventing `Done` for WONTFIX
+        # would file abandoned work beside finished work.
+        case "$state" in
+          NEW|OPEN) category="To Do" ;;
+          RESOLVED|CLOSED) category="Done" ;;
+          *) category="" ;;
+        esac
         # Drop the trailing reporter: bb prints three spaces then `by <name>`.
         title="$(sed -E 's/[[:space:]]{2,}by [^[:space:]].*$//' <<<"$rest")"
         # `url` is "" — bb issue list prints none; a consumer renders the number
         # as plain text, the rule the header states.
         jq -cn --argjson number "$num" --arg title "$title" \
-          '{number:$number,title:$title,url:"",createdAt:""}'
+          --arg status "$state" --arg category "$category" \
+          '{number:$number,title:$title,url:"",createdAt:"",
+            status:$status,statusCategory:$category}'
         count=$((count + 1))
         # Honour the caller's --limit HERE: bb has no --limit, so a bound the
         # caller asked for is enforced by the adapter after parsing (Done-when 7).
@@ -3102,14 +3747,14 @@ case "$op" in
   ci-limit)
     # The CI connector's limit, which is a THIRD axis and does not follow the
     # git host. This repo runs GitHub Actions on a GitHub remote; `ekzweb` runs
-    # Jenkins against Bitbucket. `ci_backend()` already resolves it separately.
+    # Jenkins against Bitbucket. `ci_scheme()` already resolves it separately.
     #
     # JENKINS IS THE `predicted` CASE THE DESIGN NAMES. A Jenkins instance
     # reports no rate limit — there is no header and no endpoint to ask — so the
     # ceiling is this adapter's estimate of what a shared controller tolerates,
     # tagged for what it is. It is NOT unlimited: a Jenkins that is hammered
     # refuses, and the refusal is what corrects the estimate.
-    _ci="$(ci_backend)"
+    _ci="$(ci_scheme)"
     case "$_ci" in
       jenkins)
         echo '{"connector":"jenkins","bucket":"","limit":60,"remaining":null,"reset":null,"basis":"predicted"}'
@@ -3119,9 +3764,15 @@ case "$op" in
         # answer, not a limit of zero.
         ;;
       *)
-        # `ci_backend()` validates nothing, and neither does this — the list is
+        # `ci_scheme()` validates nothing, and neither does this — the list is
         # open, and GitLab and Trello are named as next. A connector nobody has
         # written an estimate for answers `unknown`, which is the honest word.
+        #
+        # IT REPORTS THE SCHEME, never the whole `CI:` value. `build-shell.ts`
+        # filters readings by `reading.connector === shell.system`, and the
+        # system is a bare word — so a prose connector here is discarded before
+        # any caller sees it, and the port defines that empty answer as *a
+        # connector that meters nothing*.
         echo "{\"connector\":\"$_ci\",\"bucket\":\"\",\"limit\":null,\"remaining\":null,\"reset\":null,\"basis\":\"unknown\"}"
         ;;
     esac