omakit 0.6.2 → 0.6.4

package/README.md

@@ -6,7 +6,26 @@
 
 The three parts are the Run and Store blocks a plugin copies into its own tree, the marketplace's own checks run locally, and repository suites run in a disposable guest. Behind the first are M13's 1,001 security blocker comments from one measured week: 587 raise a Run line, 527 a Store line, and runner plus store handle 777 of 1,001 when read as an upper bound, not as a result for any plugin ([M13](docs/MEASUREMENTS.md#m13-what-the-review-blocks-on-over-one-week-of-comments-and-which-of-it-a-block-can-own)). No reviewer has seen a ported plugin yet.
 
-[![Built for Omarchy: App](https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-app.svg)](https://github.com/tcballard/omarchy-badges) [![npm version](https://img.shields.io/npm/v/omakit)](https://www.npmjs.com/package/omakit) [![CI status](https://img.shields.io/github/actions/workflow/status/mtolhuys/omakit/ci.yml?branch=main)](https://github.com/mtolhuys/omakit/actions/workflows/ci.yml) [![Socket package report](https://socket.dev/api/badge/npm/package/omakit)](https://socket.dev/npm/package/omakit)
+[![Built for Omarchy: App](https://raw.githubusercontent.com/tcballard/omarchy-badges/75975e5b5bf75e7ede3764bcd2950046f7abfe2c/badges/v1/omarchy-app.svg)](https://github.com/tcballard/omarchy-badges) [![npm version](https://img.shields.io/npm/v/omakit)](https://www.npmjs.com/package/omakit) [![CI status](https://img.shields.io/github/actions/workflow/status/mtolhuys/omakit/ci.yml?branch=main)](https://github.com/mtolhuys/omakit/actions/workflows/ci.yml)
+
+<!-- TODO(socket-badge): Restore the live Socket package-report badge when its endpoint reliably returns image/svg+xml without a Cloudflare challenge. Last checked 2026-09-19. -->
+
+## What it delivers
+
+| Command | What you get | Documentation |
+| --- | --- | --- |
+| `omakit add <block> [<plugin-dir>]` | Copy the Run or Store block into a plugin. The plugin owns the files, and an edited copy is never overwritten. | [Blocks](docs/BLOCKS.md) |
+| `omakit inspect <plugin-dir>` | See what the tree does and what deserves attention, with the file and line for each observation. | [Inspect](docs/INSPECT.md) |
+| `omakit verify <plugin-repo>` | Get the marketplace's security result for your commit, exactly as it would see it. | [Verify](docs/COMMANDS.md#omakit-verify) |
+| `omakit submit <plugin-repo>` | Run every submission check and get the issue title and body ready to paste. Nothing is posted. | [Submit](docs/SUBMIT.md) |
+| `omakit watch ...` | See whether the marketplace-validated commit is still current and what to do when it is not. | [Watch](docs/VALIDATION_WATCH.md) |
+| `omakit audit [<plugin>]` | Find installed plugins running commits the marketplace never validated. | [Audit](docs/AUDIT.md) |
+| `omakit lab <command>` | Set up, inspect, prove in or prune the disposable Omarchy guest. | [Lab](docs/LAB.md) |
+| `omakit weigh <plugin>` | Measure a plugin's CPU and child processes against the shell's own baseline, then restore the shell config. | [Weigh](docs/WEIGH.md) |
+| `omakit setup`, `omakit doctor` | Prepare or check the pin, completion, tools and disposable lab. | [Install](docs/INSTALL.md) |
+| `omakit pin`, `omakit upgrade`, `omakit parity`, `omakit help --agent` | Maintain Omakit or inspect its own contract and parity proof. | [All commands](docs/COMMANDS.md) |
+
+The complete syntax, options, exit codes and JSON/output contract are in the [command reference](docs/COMMANDS.md).
 
 ## Install
 
@@ -19,7 +38,7 @@ Omakit needs [Node 22+](package.json) and Git. `omakit setup` prepares the pinne
 
 ## Build
 
-`omakit add run <plugin-dir>` and `omakit add store <plugin-dir>` copy versioned process and private-state plumbing into the plugin's `omakit/` directory; the plugin owns those files, and an edited copy is never overwritten. Commit the copied files before checking, because check reads committed `HEAD` unless you pass `--allow-dirty`.
+`omakit add run <plugin-dir>` and `omakit add store <plugin-dir>` copy versioned process and private-state plumbing into the plugin's `omakit/` directory; the plugin owns those files, and an edited copy is never overwritten. Commit the copied files before checking, because check reads committed `HEAD` unless you pass `--allow-dirty`. Why that plumbing is worth taking from somewhere else is [in one page](docs/WHY.md).
 
 ![Recorded terminal showing inspect before omakit add run, the copied Run files, and inspect after the fixture is ported](https://raw.githubusercontent.com/mtolhuys/omakit/main/docs/media/add-run.gif)
 
@@ -65,7 +84,11 @@ After one `omakit lab setup`, `omakit lab prove <suite>` boots a fresh overlay f
 
 ## Documentation
 
-- [Blocks](docs/BLOCKS.md) and [their design spike](docs/BLOCKS_SPIKE.md)
+Every page, and which question each one answers: [the documentation
+index](docs/README.md).
+
+- [The path from a plugin to a listing](docs/WALKTHROUGH.md) and [when a command stops](docs/FAILURES.md)
+- [Why the blocks exist](docs/WHY.md), [the blocks themselves](docs/BLOCKS.md) and [their design spike](docs/BLOCKS_SPIKE.md)
 - [Commands](docs/COMMANDS.md), [inspect](docs/INSPECT.md), [submit](docs/SUBMIT.md), [watch](docs/VALIDATION_WATCH.md), [audit](docs/AUDIT.md) and [weigh](docs/WEIGH.md)
 - [The disposable lab](docs/LAB.md) and [every measurement](docs/MEASUREMENTS.md)
 - [Installation](docs/INSTALL.md), [media recipes](docs/media/README.md) and [repository rules](AGENTS.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omakit",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "Tested plumbing, the marketplace's own checks, and a disposable Omarchy to test in.",
   "license": "MIT",
   "author": "Maarten Tolhuijs",

package/skills/omarchy-plugin-build/SKILL.md

@@ -8,6 +8,9 @@ description: Build the process and state plumbing of an Omarchy Quattro plugin w
 This is the build job: copy the measured process and private-state plumbing
 into the plugin before checking, tracking or proving anything around it.
 
+The argument behind the blocks, for a reader who wants it, is
+`docs/WHY.md` in the omakit repository.
+
 ## Start every process through Run
 
 Whenever plugin code starts a program, it goes through the Run block, never

package/skills/omarchy-plugin-submit/SKILL.md

@@ -162,5 +162,41 @@ words, and so should you.
 Tell the owner the one thing nobody tells them: the marketplace validated one
 exact commit, and **editing the issue body** is the only action that makes it
 validate a newer one. Pushing a fix does nothing. Commenting "fixed in `abc123`" does nothing.
-Then use `omakit watch <issue-url>` to check it later, and see
-`skills/omarchy-plugin-validation-watch/SKILL.md`.
+Then use `omakit watch <issue-url> <path-to-the-plugin-repo>` to check it
+later, and see `skills/omarchy-plugin-validation-watch/SKILL.md`.
+
+When the issue has to be edited, whether to retry after a push or because the
+marketplace refused it, follow the protocol below. It is the same protocol
+the validation-watch skill names, under the same name.
+
+## Retry edit protocol
+
+A retry edit is never typed. It is the body `omakit submit` renders, and
+`omakit watch` verifies afterwards that the issue says what `origin` says.
+The reason is omacom/omarchy-plugin-marketplace#7787, 2026-09-20: an agent
+following a skill retyped the whole body for a retry, the Repository URL
+came out as `mtolhuijs/omacrunch` where origin says `mtolhuys/omacrunch`,
+the Maintainer notes were wiped, and the marketplace refused the issue as
+`repository-unreachable` 40 seconds after the edit.
+
+1. Re-run `omakit submit` with the same `--category`, `--tags` and `--notes`
+   as the original submission, plus `--body-out <file>`. The Repository URL
+   in that body comes from `origin`; you never type it.
+2. Read the current issue body (`gh issue view <url> --json body`). Diff it
+   against the new body. The only lines allowed to differ are under
+   "### Maintainer notes". Any other difference means you are about to change
+   the submission; stop and show the owner the diff.
+3. With the owner's explicit approval: `gh issue edit <url> --body-file <file>`.
+4. Run `omakit watch <url> <path-to-the-plugin-repo>`. Expect `current` within
+   two minutes. `wrong-repository` or `refused` means step 2 was skipped; fix
+   it now, by the same steps.
+
+Never retype the body. Never write the Repository URL by hand. Never edit a
+`current` issue to bump it: a fresh validation clears the reviewer's human
+decision and costs a complete re-read of the plugin.
+
+`submission.issue-repository-url` is the check that catches the typo before
+the next run: when you have an open submission issue for this plugin and its
+Repository URL is not `origin`, `submit` is refused and the remedy names the
+issue and the URL to put back. Put it back with the protocol above, not by
+editing the field by hand.

package/skills/omarchy-plugin-validation-watch/SKILL.md

@@ -29,11 +29,22 @@ not a measurement of all 464 issues in the queue.
 ## Run the check
 
 ```bash
-omakit watch https://github.com/omacom/omarchy-plugin-marketplace/issues/<number>
+omakit watch https://github.com/omacom/omarchy-plugin-marketplace/issues/<number> <path-to-the-plugin-repo>
 omakit watch --all --json
 omakit watch --list --json
 ```
 
+Give the plugin's checkout (or its github.com URL) as the second argument
+whenever you have it; without one, the current directory is the subject
+when it is such a checkout and its `manifest.json` is the plugin the issue
+names. A directory that is another plugin is not compared, and the report
+says so (`plugin.subjectSkipped` in `--json`): pass the plugin then, do not
+read the origin it prints as the one to put in the issue. With a subject,
+the issue's Repository URL is compared with the plugin's `origin`, and the
+verdict `wrong-repository` names a mismatch before anything else is
+compared. `--json` carries it as `plugin.origin` and
+`plugin.repositoryMatches` (`null` when there is no subject, as in `--all`).
+
 If `omakit` is not installed: `npm install --global omakit` (Omarchy ships Node
 and npm through mise), then `omakit doctor`; if the command is not found after
 the install, `"$(npm prefix --global)/bin/omakit" setup` prints the one line
@@ -64,9 +75,8 @@ and publish a newer upstream commit", read from the pin.
 **`stale`.** The validated commit is behind the repository. Tell the owner plainly: the marketplace has not
 seen the newer commit, and the fix is to **edit the issue body** (any edit
 re-triggers validation and the baseline against the new commit). Do not advise
-them to push again, and do not advise them to comment. If you are asked to do it,
-that is an edit to their issue: get their explicit approval and do it yourself,
-outside this tool.
+them to push again, and do not advise them to comment. The edit is made by the
+retry edit protocol below, never by retyping the body.
 
 **`current`.** The validated commit is the current HEAD. The submission is genuinely waiting
 on a person, or on a fix the reviewer asked for that has not been made. Read the
@@ -74,10 +84,51 @@ review comments and address the substance. Do not edit the issue to "bump" it: a
 fresh validation clears the reviewer's human decision and costs him a complete
 re-read of the plugin.
 
+**`wrong-repository`.** The issue's Repository URL is not the plugin's
+`origin`, so the marketplace is validating another repository, or none. The
+output prints both URLs. Tell the owner which one the issue says and which one
+origin says, and fix it by the retry edit protocol below: the body `omakit
+submit` renders carries the origin, and nothing else on the issue changes. Do
+not correct the field by hand.
+
+**`refused`.** The marketplace's last validation of this issue failed, and
+that refusal is newer than the last baseline marker. The output prints the
+marketplace's own code, reason and action, read from the pinned feedback
+table; an unmatched reason is printed verbatim as `unrecognised`. Fix what
+the code names in the repository first when it is the repository
+(`readme-missing`, `manifest-invalid`), and when it is the issue itself
+(`repository-unreachable`, `submission-fields-invalid`) the fix is the retry
+edit protocol below. Never report `refused` as waiting on the reviewer.
+
 **`unknown`.** There is no validated commit to compare, the last baseline did not
 complete, or the repository's HEAD could not be read. The output says which. Never
 report this as `current`.
 
+## Retry edit protocol
+
+A retry edit is never typed. It is the body `omakit submit` renders, and
+`omakit watch` verifies afterwards that the issue says what `origin` says.
+The reason is omacom/omarchy-plugin-marketplace#7787, 2026-09-20: an agent
+following this skill retyped the whole body for a retry, the Repository URL
+came out as `mtolhuijs/omacrunch` where origin says `mtolhuys/omacrunch`,
+the Maintainer notes were wiped, and the marketplace refused the issue as
+`repository-unreachable` 40 seconds after the edit.
+
+1. Re-run `omakit submit` with the same `--category`, `--tags` and `--notes`
+   as the original submission, plus `--body-out <file>`. The Repository URL
+   in that body comes from `origin`; you never type it.
+2. Read the current issue body (`gh issue view <url> --json body`). Diff it
+   against the new body. The only lines allowed to differ are under
+   "### Maintainer notes". Any other difference means you are about to change
+   the submission; stop and show the owner the diff.
+3. With the owner's explicit approval: `gh issue edit <url> --body-file <file>`.
+4. Run `omakit watch <url> <path-to-the-plugin-repo>`. Expect `current` within
+   two minutes. `wrong-repository` or `refused` means step 2 was skipped; fix
+   it now, by the same steps.
+
+Never retype the body. Never write the Repository URL by hand. Never edit a
+`current` issue to bump it.
+
 ## Before you conclude that the reviewer is behind
 
 Check the assumption. The maintainer's own queue is a median half a day old, and

package/tools/blocks/commit.json

@@ -1,5 +1,5 @@
 {
-  "commit": "2a3b95629518dfbdaa880bf528ce2ce495b27b45",
-  "recordedAt": "2026-09-19T16:57:20.050Z",
+  "commit": "a0f946e1e900fda2b6d9c7004da3b8684958ec1a",
+  "recordedAt": "2026-09-21T06:04:50.384Z",
   "how": "Written by `node tools/blocks/record-commit.mjs` in the release workflow before `npm pack`, so a packaged omakit, which has no Git checkout, still names the commit its block files come from. In a checkout this file is null and `git rev-parse HEAD` is the source; a package with null here was packed without the release step, and `omakit add` refuses to stamp a header it cannot name."
 }

package/tools/marketplace/cli.mjs

@@ -19,7 +19,7 @@
 // `add` is the one command that writes into a plugin tree: the block's own
 // files under omakit/, never over a modified copy; docs/BLOCKS.md says what.
 
-import { readdirSync, readFileSync } from "node:fs"
+import { readdirSync, readFileSync, writeFileSync } from "node:fs"
 import { dirname, resolve } from "node:path"
 import { fileURLToPath } from "node:url"
 import { ensurePin, requirePin } from "./pin.mjs"
@@ -27,7 +27,7 @@ import { marketplaceBaselineSection } from "./verify.mjs"
 import { resolveSubject, SubjectError } from "../subject/resolve.mjs"
 import { submitPreflight } from "./submit.mjs"
 import { askChoices, askWatchIssues } from "./ask.mjs"
-import { validationWatch, discoverWatchIssues, validationWatchAll } from "./watch.mjs"
+import { validationWatch, discoverWatchIssues, validationWatchAll, resolveWatchSubject } from "./watch.mjs"
 import { renderSubmit, renderWatch, renderWatchList, renderWatchAll, renderDoctor, renderVerify } from "./report.mjs"
 import { consequence } from "./preflight.mjs"
 import { doctor } from "./doctor.mjs"
@@ -83,6 +83,8 @@ const REMEDY = Object.freeze({
   "interrupted": "shell.json was restored; run it again when the desktop is yours to restart.",
   "refused": "Fix what the report names, then run it again.",
   "unknown": "Read what could not be compared in the report above; each row says why.",
+  "wrong-repository": "Edit the issue and set the Repository URL field to the plugin's origin, printed in the report. Change nothing else.",
+  "no-origin": "Give the checkout a github.com origin remote, or pass the repository URL as the subject.",
   "drift": "Return each plugin to its validated commit with the git checkout printed beside it, or validate the newer commit through the form the report names.",
   "not-compared": "Run it in the desktop session whose shell runs these plugins: omarchy-plugin-catalog named no readable source directory for them.",
   "problems": "omakit setup",
@@ -195,6 +197,20 @@ function refuse(args, document, human, error) {
   return conclude({ command: CONTEXT.command, args, exit: 1, document, human, error: failure({ ...error, table: REMEDY }) })
 }
 
+/**
+ * `--body-out`: the rendered issue body, byte for byte and nothing else,
+ * so a retry edit is the body `submit` renders and never a body retyped.
+ * On #7787 (2026-09-20) the retry was typed, and the Repository URL came
+ * out as another account. A person passes the file to `gh`'s
+ * `issue edit --body-file`; this tool writes a local file and posts
+ * nothing. A body that was not rendered (a refusal, a
+ * listing) writes no file and says so.
+ */
+function writeBodyOut(out, body) {
+  writeFileSync(resolve(out), body)
+  return resolve(out)
+}
+
 async function cmdSubmit(args) {
   const target = positionals(args)[0]
   if (!target) fail("usage", "submit needs a target: `omakit submit <target> --category <c> --tags <a,b>`", 2)
@@ -242,7 +258,22 @@ async function cmdSubmit(args) {
     failFrom(error)
   }
   spinner.done()
-  const human = (colour) => renderSubmit(result, { colour })
+  const bodyOut = option(args, "--body-out")
+  if (bodyOut && result.issue?.body) {
+    try {
+      result.bodyFile = writeBodyOut(bodyOut, result.issue.body)
+    } catch (error) {
+      failFrom(Object.assign(error, { message: `--body-out ${resolve(bodyOut)} could not be written: ${error.message}` }))
+    }
+  } else if (bodyOut) {
+    result.bodyFile = null
+  }
+  const human = (colour) => {
+    const text = renderSubmit(result, { colour })
+    if (!bodyOut) return text
+    const c = styler(colour)
+    return `${text.replace(/\n+$/, "")}\n${result.bodyFile ? `${mark("pass", c)}wrote the body to ${withHomeAbbreviated(result.bodyFile)}` : `${mark("skipped", c)}no body was rendered, so --body-out wrote nothing`}\n`
+  }
   // Three outcomes, two exit codes: `ready` and `listed` are both healthy
   // states, and only a refusal is a 1.
   if (result.outcome === "refused") {
@@ -254,7 +285,7 @@ async function cmdSubmit(args) {
 }
 
 async function cmdWatch(args) {
-  const issueUrl = positionals(args)[0]
+  const [issueUrl, subjectTarget] = positionals(args)
   const all = args.includes("--all")
   const list = args.includes("--list")
   const user = option(args, "--user")
@@ -265,11 +296,18 @@ async function cmdWatch(args) {
   if (!issueUrl && !all && !list && !interactive) {
     fail("usage", "watch needs an issue or a mode: `omakit watch <issue-url>`, `omakit watch --all`, or `omakit watch --list`. A terminal can pick issues with `omakit watch`.", 2)
   }
+  if (subjectTarget !== undefined && !issueUrl) {
+    fail("usage", "a subject belongs to one issue: `omakit watch <issue-url> <subject>`.", 2)
+  }
   const spinner = spinnerFor(args)
   let result
   try {
     if (issueUrl) {
-      result = await validationWatch({ repoRoot: ROOT, issueUrl, onPhase: spinner.phase })
+      // The subject is the plugin's own origin: a path or a github.com URL
+      // given after the issue, or the current directory when it is a
+      // checkout with one. The issue's Repository URL is compared with it.
+      const subject = resolveWatchSubject(subjectTarget)
+      result = await validationWatch({ repoRoot: ROOT, issueUrl, subject, onPhase: spinner.phase })
     } else {
       const discovery = await discoverWatchIssues({ user, onPhase: spinner.phase })
       if (list) {
@@ -292,13 +330,17 @@ async function cmdWatch(args) {
   // A comparison that could not be made is a refusal the tool means, exit
   // 1: the validated commit is not known to be current. Stale is a fact
   // about the marketplace, not a failure, and exits 0. Measured on
-  // 2026-09-19: an unknown verdict exited 2, the usage status.
-  if (result.verdict?.state === "unknown") {
-    refuse(args, result, human, { code: "unknown", message: result.verdict.summary, remedy: result.verdict.action || REMEDY.unknown })
+  // 2026-09-19: an unknown verdict exited 2, the usage status. An issue
+  // that names the wrong repository, or one the marketplace refused, is
+  // the same kind of refusal: nothing on it is being validated, and the
+  // verdict's own action is the remedy.
+  if (["unknown", "wrong-repository", "refused"].includes(result.verdict?.state)) {
+    refuse(args, result, human, { code: result.verdict.state, message: result.verdict.summary, remedy: result.verdict.action || REMEDY[result.verdict.state] })
     return
   }
-  if (result.summary?.unknown > 0) {
-    refuse(args, result, human, { code: "unknown", message: `${result.summary.unknown} of ${result.summary.total} comparison${result.summary.total === 1 ? "" : "s"} could not be made` })
+  if (result.summary?.unknown > 0 || result.summary?.refused > 0) {
+    const counts = [result.summary.unknown > 0 && `${result.summary.unknown} could not be compared`, result.summary.refused > 0 && `${result.summary.refused} refused by the marketplace`].filter(Boolean).join(", ")
+    refuse(args, result, human, { code: result.summary.unknown > 0 ? "unknown" : "refused", message: `${counts} of ${result.summary.total} issue${result.summary.total === 1 ? "" : "s"}`, remedy: result.summary.unknown > 0 ? REMEDY.unknown : "Read each refused row: the marketplace's own reason and action are printed beside it." })
     return
   }
   succeed(args, result, human)

package/tools/marketplace/measure-repository-owner.mjs

@@ -0,0 +1,56 @@
+// M15 reproduction: open submission issues whose Repository URL names an
+// owner other than the issue's author. All remote reads use the existing
+// GET-only client; an issue whose body yields no repository is counted as
+// unreadable, never as a match or a mismatch.
+//
+// The case behind it: omacom/omarchy-plugin-marketplace#7787, 2026-09-20. A
+// retry edit typed by an agent put `mtolhuijs` where origin says `mtolhuys`,
+// and the marketplace refused it as `repository-unreachable` 40 seconds after
+// the edit event. A URL whose owner is not the author is not wrong by itself
+// (organisations, forks and co-maintainers exist), so the count is the size
+// of the population this check has to tell a typo apart from, not a count of
+// typos.
+import { resolve } from "node:path"
+import { pathToFileURL } from "node:url"
+import { MARKETPLACE_PIN, requirePin } from "./pin.mjs"
+import { repositoryIssues } from "./github.mjs"
+import { repositoryFor } from "./watch.mjs"
+import { parseGitHubUrl } from "../subject/resolve.mjs"
+
+export function ownerCounts(rows) {
+  const readable = rows.filter((row) => row.owner !== null)
+  const differs = readable.filter((row) => row.ownerDiffers).length
+  return { total: rows.length, readable: readable.length, unreadable: rows.length - readable.length,
+    ownerDiffers: differs, ownerMatches: readable.length - differs,
+    differsShareOfReadable: readable.length ? differs / readable.length : null }
+}
+
+export async function measureRepositoryOwner(repoRoot, { discover = repositoryIssues, label = "submission" } = {}) {
+  const openedAt = new Date().toISOString()
+  const { dir: pinDir } = requirePin(repoRoot)
+  const [owner, repository] = new URL(MARKETPLACE_PIN.repository).pathname.slice(1).split("/")
+  const subjects = (await discover(owner, repository, undefined, { labels: label }))
+    .filter((subject) => subject.state === "open" && !subject.pull_request)
+    .sort((a, b) => a.number - b.number)
+  const rows = []
+  for (const subject of subjects) {
+    const author = String(subject.user?.login || "")
+    const parsed = await repositoryFor(pinDir, subject)
+    const gh = parsed.url ? parseGitHubUrl(parsed.url) : null
+    rows.push({ issue: subject.number, issueUrl: `${MARKETPLACE_PIN.repository}/issues/${subject.number}`, author,
+      labels: (subject.labels || []).map((entry) => (typeof entry === "string" ? entry : entry?.name)).filter(Boolean),
+      repository: gh?.url || null, owner: gh?.owner || null,
+      ownerDiffers: gh ? gh.owner.toLowerCase() !== author.toLowerCase() : null,
+      reason: gh ? null : parsed.error || "no github.com repository URL in the body" })
+  }
+  return { measurement: "M15", date: openedAt.slice(0, 10), openedAt, completedAt: new Date().toISOString(),
+    marketplace: MARKETPLACE_PIN.repository, marketplacePin: MARKETPLACE_PIN.commit,
+    command: "node tools/marketplace/measure-repository-owner.mjs", sample: false,
+    population: `All open non-PR marketplace issues labelled ${label} at discovery`,
+    method: "Repository URL read from each issue body with the pinned submission parser; its owner compared case-insensitively with the issue author's login; a body without a readable github.com URL is unreadable",
+    ...ownerCounts(rows), rows }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  process.stdout.write(`${JSON.stringify(await measureRepositoryOwner(resolve(process.cwd())), null, 2)}\n`)
+}

package/tools/marketplace/options.mjs

@@ -20,8 +20,8 @@
 export const ACCEPTED = Object.freeze({
   setup: Object.freeze({ valued: [], flags: ["--yes", "--completion"], positionals: 0 }),
   pin: Object.freeze({ valued: [], flags: [], positionals: 0 }),
-  submit: Object.freeze({ valued: ["--category", "--tags", "--notes", "--suggest-tag", "--name", "--out"], flags: ["--offline", "--allow-dirty", "--json"], positionals: 1 }),
-  watch: Object.freeze({ valued: ["--out", "--user"], flags: ["--json", "--all", "--list"], positionals: 1 }),
+  submit: Object.freeze({ valued: ["--category", "--tags", "--notes", "--suggest-tag", "--name", "--out", "--body-out"], flags: ["--offline", "--allow-dirty", "--json"], positionals: 1 }),
+  watch: Object.freeze({ valued: ["--out", "--user"], flags: ["--json", "--all", "--list"], positionals: 2 }),
   verify: Object.freeze({ valued: ["--out"], flags: ["--allow-dirty", "--json"], positionals: 1 }),
   help: Object.freeze({ valued: [], flags: ["--agent"], positionals: 0 }),
   upgrade: Object.freeze({ valued: [], flags: ["--dry-run"], positionals: 0 }),
@@ -37,7 +37,7 @@ export const ACCEPTED = Object.freeze({
 /** The accepted options of a command in the words a refusal prints: `--runs N, --all, ...`. */
 export function acceptedWords(name) {
   const spec = ACCEPTED[name]
-  const value = (option) => ({ "--out": "FILE", "--runs": "N", "--count": "N", "--offset": "N", "--window": "S", "--settle": "S", "--category": "C", "--tags": "A,B", "--from": "FILE", "--toolchain": "DIR" }[option] || "TEXT")
+  const value = (option) => ({ "--out": "FILE", "--body-out": "FILE", "--runs": "N", "--count": "N", "--offset": "N", "--window": "S", "--settle": "S", "--category": "C", "--tags": "A,B", "--from": "FILE", "--toolchain": "DIR" }[option] || "TEXT")
   return [...spec.valued.map((option) => `${option} ${value(option)}`), ...spec.flags].join(", ")
 }
 

package/tools/marketplace/report.mjs

@@ -178,9 +178,13 @@ export function renderSubmit(result, { colour = colourEnabled() } = {}) {
     : `${result.validationCommit.local} is the local commit; the marketplace validates the default-branch HEAD it resolves when the issue is opened.`
   // A skipped check is said on the READY line itself, so the one line an
   // agent quotes does not read as "everything passed" when one check never
-  // ran. The count is the whole `skipped` list; today only --offline skips.
+  // ran. The count is the whole `skipped` list; --offline skips, and the
+  // open-issue check also skips without a credential or an open issue, and
+  // then the reason is on its own row.
+  const skippedChecks = (result.checks || []).filter((entry) => entry.verdict === "skipped")
   const skipped = (result.skipped || []).length
-  const skippedNote = skipped ? ` ${skipped === 1 ? "1 check" : `${skipped} checks`} skipped (--offline).` : ""
+  const offlineOnly = skippedChecks.length > 0 && skippedChecks.every((entry) => /\(--offline\)/.test(entry.detail))
+  const skippedNote = skipped ? ` ${skipped === 1 ? "1 check" : `${skipped} checks`} skipped (${offlineOnly ? "--offline" : "each says why"}).` : ""
   out.push(...verdict("pass", "READY", `every blocking check passed.${skippedNote} ${validation}`, c))
   out.push("")
   out.push(...section("issue title", c))
@@ -214,6 +218,14 @@ export function renderWatch(result, { colour = colourEnabled() } = {}) {
   out.push(...field("state", `${result.read.state}${result.read.labels.length ? `; labels ${result.read.labels.join(", ")}` : ""}`, c))
   out.push(...field("title", result.read.title, c))
   out.push(...field("plugin repo", result.plugin.repository || `unreadable: ${result.plugin.repositoryError}`, c, { wrapValue: false }))
+  if (result.plugin.origin) {
+    const origin = result.plugin.repositoryMatches === false ? c("fail", result.plugin.origin) : result.plugin.origin
+    out.push(...field("origin", origin, c, { wrapValue: false }))
+    out.push(...continuation(result.plugin.repositoryMatches === false ? "the issue names a different repository" : result.plugin.repositoryMatches ? "the issue names this repository" : "not compared: the issue names no repository", c))
+  } else if (result.plugin.subjectSkipped) {
+    out.push(...field("origin", "not compared", c))
+    out.push(...continuation(result.plugin.subjectSkipped.reason, c))
+  }
   if (result.plugin.form === "verify" || result.plugin.form === "verify-legacy") {
     out.push(...field("form", "plugin update request, read with the marketplace's verification parser", c))
   }
@@ -233,8 +245,12 @@ export function renderWatch(result, { colour = colourEnabled() } = {}) {
   } else if (result.headError) {
     out.push(...field("current HEAD", `unreadable: ${result.headError.message}`, c))
   }
+  if (result.refusal) {
+    out.push(...field("refused", `${result.refusal.code} at ${result.refusal.at || "an unrecorded time"}`, c))
+    out.push(...continuation(result.refusal.reason, c))
+  }
   out.push("")
-  const state = { current: "pass", stale: "fail", unknown: "unknown" }[result.verdict.state] || "unknown"
+  const state = { current: "pass", stale: "fail", refused: "fail", "wrong-repository": "fail", unknown: "unknown" }[result.verdict.state] || "unknown"
   out.push(...verdict(state, `VALIDATION ${result.verdict.state.toUpperCase()}`, result.verdict.summary, c))
   if (result.verdict.action) {
     out.push("")
@@ -266,7 +282,7 @@ export function renderWatchList(result, { colour = colourEnabled() } = {}) {
 /** Compact batch report; exact commits and full discussion remain in JSON. */
 export function renderWatchAll(result, { colour = colourEnabled() } = {}) {
   const c = styler(colour)
-  const out = [...field("account", result.account, c), ...field("issues", `${result.summary.total} checked; ${result.summary.current} current, ${result.summary.stale} stale, ${result.summary.unknown} unknown`, c)]
+  const out = [...field("account", result.account, c), ...field("issues", `${result.summary.total} checked; ${result.summary.current} current, ${result.summary.stale} stale, ${result.summary.refused || 0} refused, ${result.summary.unknown} unknown`, c)]
   if (result.reviewCostSummary) {
     const cost = result.reviewCostSummary
     const skipped = cost.skipped.length ? `; ${cost.skipped.length} diff(s) skipped (reasons on issue rows)` : ""
@@ -275,7 +291,7 @@ export function renderWatchAll(result, { colour = colourEnabled() } = {}) {
   out.push("")
   for (const row of result.issues) {
     const state = row.report?.verdict.state || "unknown"
-    const style = { current: "pass", stale: "fail", unknown: "unknown" }[state]
+    const style = { current: "pass", stale: "fail", refused: "fail", "wrong-repository": "fail", unknown: "unknown" }[state] || "unknown"
     out.push(...verdict(style, state.toUpperCase(), `#${row.issue.number} ${watchIssueTitle(row.report?.read.title || row.issue.title)}`, c))
     out.push(...field("issue", row.issue.url, c, { wrapValue: false }))
     if (row.documentationDiff?.docsOnly === null) out.push(...field("diff skipped", watchIssueTitle(row.documentationDiff.reason), c))

package/tools/marketplace/review-cost.mjs

@@ -6,6 +6,7 @@ import { requirePin } from "./pin.mjs"
 import { token, issue, parseIssueUrl, compareCommits } from "./github.mjs"
 import { discoverWatchIssues, repositoryFor } from "./watch.mjs"
 import { repositorySlug } from "./registry.mjs"
+import { submissionContract } from "./form.mjs"
 
 /** Outcome and update label names come from the pin, rather than a second policy. */
 export async function reviewPolicy(repoRoot) {
@@ -18,26 +19,52 @@ export async function reviewPolicy(repoRoot) {
   return { automated: policy.securityBaselineOutcome([], []), manual, updateLabel, reviewLabel: `security-${manual}` }
 }
 
-/** The same discovery as watch --all; no credential or incomplete reads are not zero issues. */
-export async function openIssuesForRepository({ repoRoot, repository, offline = false, github = {} }) {
+/**
+ * The same discovery as watch --all; no credential or incomplete reads are
+ * not zero issues. An issue is the author's for this plugin when its
+ * Repository URL is the repository, or, for a `[Plugin]:` submission whose
+ * URL is another repository, when its title carries the manifest's name or
+ * its body names the manifest's id: on #7787 (2026-09-20) the retyped URL
+ * made the author's own issue invisible to a match on the URL alone, and
+ * the one check that could have named the typo had nothing to look at.
+ * Each matched issue is returned with `sameRepository`, so a caller can
+ * tell the two apart.
+ *
+ * @returns {{ count: number|null, reason: string, account?: string, issues?: { number: number, url: string, repositoryUrl: string|null, sameRepository: boolean, matchedBy: "repository"|"name"|"id" }[] }}
+ */
+export async function openIssuesForRepository({ repoRoot, repository, pluginName = "", pluginId = "", offline = false, github = {} }) {
   if (offline) return { count: null, reason: "not checked (--offline)" }
   if (!(github.token || token)()) return { count: null, reason: "not checked: no GitHub credential" }
   try {
     const discovery = await discoverWatchIssues({ github })
     const { dir } = requirePin(repoRoot)
-    let count = 0
+    const { titleTemplate } = await submissionContract({ pinDir: dir })
+    const name = String(pluginName || "").trim().toLowerCase()
+    const id = String(pluginId || "").trim()
+    const matched = []
     let next = 0
     async function worker() {
       while (next < discovery.issues.length) {
-        const target = parseIssueUrl(discovery.issues[next++].url)
+        const entry = discovery.issues[next++]
+        const target = parseIssueUrl(entry.url)
         const subject = await (github.issue || issue)(target.owner, target.repository, target.number)
         const parsed = await repositoryFor(dir, subject)
         if (!parsed.url) throw new Error(`repository unknown on issue #${target.number}: ${parsed.error}`)
-        if (repositorySlug(parsed.url) === repositorySlug(repository)) count += 1
+        const row = { number: target.number, url: entry.url, repositoryUrl: parsed.url, sameRepository: repositorySlug(parsed.url) === repositorySlug(repository), matchedBy: null }
+        if (row.sameRepository) row.matchedBy = "repository"
+        else if (parsed.kind === "submission" && titleTemplate && String(subject.title || "").startsWith(titleTemplate)) {
+          const titled = String(subject.title).slice(titleTemplate.length).trim().toLowerCase()
+          if (name && titled === name) row.matchedBy = "name"
+          else if (id && String(subject.body || "").includes(id)) row.matchedBy = "id"
+        }
+        if (row.matchedBy) matched.push(row)
       }
     }
     await Promise.all(Array.from({ length: Math.min(4, discovery.issues.length) }, worker))
-    return { count, reason: `watch --all discovery: ${count} open issue(s) for this repository` }
+    matched.sort((a, b) => a.number - b.number)
+    const other = matched.filter((row) => !row.sameRepository).length
+    return { count: matched.length, account: discovery.account, issues: matched,
+      reason: `watch --all discovery: ${matched.length} open issue(s) for this plugin${other ? `, ${other} of them naming another repository` : ""}` }
   } catch (error) {
     return { count: null, reason: `not checked (${error.code || "issue-discovery-unavailable"}): ${error.message}` }
   }

package/tools/marketplace/submit.mjs

@@ -437,6 +437,33 @@ export async function submitPreflight(options) {
         : null,
   }))
 
+  // --- the author's own open issue --------------------------------------------
+  // Discovered once, here, for two readers: the check below, and review.cost.
+  // On the subject's own listing the check is omitted with the other body
+  // checks: there is no submission to retry.
+
+  if (!options.offline) phase("reading your open marketplace issues")
+  const openIssues = await openIssuesForRepository({ repoRoot, repository: subject.repository.url, pluginName, pluginId: tree.pluginId,
+    offline: options.offline === true, github: options.github })
+  const ownIssues = openIssues.issues || []
+  const mismatched = ownIssues.filter((row) => !row.sameRepository)
+  const originForIssue = subject.repository.url || "the plugin's origin"
+  if (!listing) checks.push(check("submission.issue-repository-url", {
+    source: "omakit",
+    why: "The marketplace validates the Repository URL in the issue, and a retry is an edit to that issue. On omacom/omarchy-plugin-marketplace#7787 (2026-09-20, 19:18 UTC) a retry edit typed by hand put mtolhuijs where origin says mtolhuys, and the marketplace refused it as repository-unreachable 40 seconds after the edit event. M15, measured 2026-09-20 over all 651 open submission issues: 27 of the 646 with a readable URL name an owner other than the issue's author, so the URL is compared with the plugin's own origin, never with the author's login. Not a marketplace rule; an Omakit check that the issue says what origin says.",
+    severity: "blocking",
+    skipped: openIssues.count === null || ownIssues.length === 0,
+    verdict: mismatched.length === 0,
+    detail: openIssues.count === null
+      ? openIssues.reason
+      : ownIssues.length === 0
+        ? `no open submission issue by ${openIssues.account} for this plugin`
+        : mismatched.length
+          ? mismatched.map((row) => `issue #${row.number} says ${row.repositoryUrl}, origin says ${originForIssue}`).join("; ")
+          : ownIssues.map((row) => `issue #${row.number} matches origin`).join("; "),
+    remedy: mismatched.length ? mismatched.map((row) => `Edit issue #${row.number} and set the Repository URL field to ${originForIssue}. Change nothing else.`) : null,
+  }))
+
   // --- the baseline preflight ----------------------------------------------
 
   phase("running the official security baseline over a local snapshot")
@@ -470,8 +497,7 @@ export async function submitPreflight(options) {
 
   const policy = await reviewPolicy(repoRoot)
   const review = reviewCostVerdict({ baseline: consequence, policy,
-    openIssues: consequence?.outcome === policy.manual ? await openIssuesForRepository({ repoRoot, repository: subject.repository.url,
-      offline: options.offline === true, github: options.github }) : { count: null, reason: consequence?.outcome === policy.automated ? "open issue count not checked: automated baseline" : preflight.skipReason || preflight.refusal?.message || "baseline outcome needs findings resolved" },
+    openIssues: consequence?.outcome === policy.manual ? openIssues : { count: null, reason: consequence?.outcome === policy.automated ? "open issue count not checked: automated baseline" : preflight.skipReason || preflight.refusal?.message || "baseline outcome needs findings resolved" },
     why: `MEASUREMENTS.md M4: ${figure(figures.outcomes[policy.manual] || 0)} of ${figure(figures.withBaseline)} recorded listing baselines required review at the pin. M9: on 2026-09-15, 140 of 307 open update issues carried the manual-review label; 4 of 139 compared validated diffs were docs-only, with 1 unavailable. The baseline scans the whole snapshot, not the update diff, so unchanged capabilities also require another review. Sources and exact marketplace HEAD are recorded in MEASUREMENTS.md.`,
   })
   checks.push(review.check)

package/tools/marketplace/usage.mjs

@@ -74,10 +74,13 @@ export const COMMANDS = Object.freeze([
       "omakit submit <target> --category <c> --tags <a,b> [--notes <text>]",
       "                      [--suggest-tag <t>] [--name <n>] [--offline]",
       "                      [--allow-dirty] [--json] [--out <file>]",
+      "                      [--body-out <file>]",
     ],
     lines: [
       "Every check that is knowable before submitting, the resolved commit, and",
       "the exact issue title and body. Prints them. Never posts anything.",
+      "--body-out writes the rendered body, and nothing else, to a file, for a",
+      "retry edit a person makes with `gh`'s `issue edit --body-file`.",
       "Three outcomes: READY (exit 0, the body), REFUSED (exit 1, no body), and",
       "LISTED (exit 0): the plugin is already listed by its own repository, so",
       "the submission form is not the route and nothing is asked. An id taken",
@@ -89,13 +92,17 @@ export const COMMANDS = Object.freeze([
   },
   {
     signature: [
-      "omakit watch <issue-url> [--json] [--out <file>]",
+      "omakit watch <issue-url> [<subject>] [--json] [--out <file>]",
       "omakit watch [--all | --list] [--user <login>] [--json] [--out <file>]",
     ],
     lines: [
       "Compare the commit the marketplace validated on a submission issue with",
       "the plugin repository's current default-branch HEAD, and say what makes",
-      "it validate a newer one. Read-only.",
+      "it validate a newer one. Read-only. <subject> is the plugin's checkout",
+      "or its github.com URL (default: the current directory when it is one",
+      "and its manifest is the issue's plugin): the issue's Repository URL is",
+      "compared with that origin, and a failed",
+      "validation is read back as the marketplace's own code.",
       "--all checks your open marketplace issues; --list lists them first.",
       "Without a URL or either flag, a terminal asks which issues to check.",
       "Uses your gh account, or --user to read another public account. JSON",

package/tools/marketplace/watch.mjs

@@ -20,10 +20,14 @@
 
 import { join } from "node:path"
 import { pathToFileURL } from "node:url"
+import { readFileSync } from "node:fs"
 import { MARKETPLACE_PIN, requirePin } from "./pin.mjs"
 import { authenticatedUser, repositoryIssues, defaultBranchHead, issue, issueComments, parseIssueUrl, token, GitHubError } from "./github.mjs"
 import { liveRegistry } from "./registry.mjs"
 import { reviewPolicy, validatedDocumentationDiff } from "./review-cost.mjs"
+import { parseGitHubUrl, resolveSubject, SubjectError } from "../subject/resolve.mjs"
+import { omakitCacheDir } from "./paths.mjs"
+import { submissionContract } from "./form.mjs"
 
 export class WatchError extends Error {
   constructor(code, message) {
@@ -97,7 +101,9 @@ export async function validationWatchAll({ repoRoot, discovery, github = {}, rea
     }
   }
   await Promise.all(Array.from({ length: Math.min(4, discovery.issues.length) }, worker))
-  const summary = { total: results.length, current: 0, stale: 0, unknown: 0 }
+  // No subject in a batch, so no row can be wrong-repository; a refused
+  // row is one the marketplace answered with a failure, and is counted.
+  const summary = { total: results.length, current: 0, stale: 0, refused: 0, unknown: 0 }
   for (const result of results) summary[result.report?.verdict.state || "unknown"] += 1
   // M9: count labels on the listed issues, then compare only updates in the manual queue.
   const manual = results.filter((row) => {
@@ -187,24 +193,167 @@ export async function repositoryFor(pinDir, subject) {
   return { url: null, kind: null, error: errors.join("; ") }
 }
 
+/** The last marketplace validation comment on the issue, or null. */
+function lastValidationComment(comments) {
+  return (comments || [])
+    .filter((comment) => String(comment.body || "").includes("<!-- marketplace-validation -->"))
+    .at(-1) || null
+}
+
 /** The short commit the validation comment reports, as a fallback when no baseline marker exists. */
 export function validationCommentCommit(comments) {
-  const validation = (comments || [])
-    .filter((comment) => String(comment.body || "").includes("<!-- marketplace-validation -->"))
-    .at(-1)
+  const validation = lastValidationComment(comments)
   if (!validation) return null
   const short = String(validation.body).match(/passed at commit `([0-9a-f]{7,40})`/i)?.[1]
   return short ? { short: short.toLowerCase(), createdAt: validation.created_at || null } : null
 }
 
+/**
+ * The marketplace's own failure table, read from the pin: every code
+ * `publicSubmissionFailure` can answer with, and the reason and action it
+ * prints for each. The table itself is not exported by the pinned module,
+ * so the codes are read out of its text and each is put through the
+ * exported function, which is the same path the failure comment took.
+ */
+export async function submissionFeedback(pinDir) {
+  const path = join(pinDir, "scripts/submission-feedback.mjs")
+  const { publicSubmissionFailure } = await import(pathToFileURL(path).href)
+  const codes = [...readFileSync(path, "utf8").matchAll(/^  "([a-z][a-z0-9-]*)": \{$/gm)].map((match) => match[1])
+  return codes.map((code) => ({ code, ...publicSubmissionFailure({ code }) }))
+}
+
+/**
+ * What the last validation comment says: `passed` with the short commit, or
+ * `failed` with the reason mapped back to the marketplace's code through
+ * the pinned feedback table. The marketplace edits its validation comment
+ * in place on every run (measured on #7787: the comment created at
+ * 13:38:35 carried `updated_at` 19:41:00 after three validations), so the
+ * time of a refusal is the comment's `updated_at`, not its `created_at`.
+ *
+ * @param {object[]} comments
+ * @param {{ code: string, reason: string, action: string }[]} feedback from submissionFeedback()
+ */
+export function validationComment(comments, feedback = []) {
+  const validation = lastValidationComment(comments)
+  if (!validation) return null
+  const body = String(validation.body)
+  const at = validation.updated_at || validation.created_at || null
+  const passed = body.match(/passed at commit `([0-9a-f]{7,40})`/i)?.[1]
+  if (passed) return { kind: "passed", short: passed.toLowerCase(), at, createdAt: validation.created_at || null }
+  // `❌ **Validation failed:** <reason>` then a blank line and the action;
+  // the bold markers are the marketplace's Markdown and are not part of
+  // the reason. A comment that is neither is reported as it is.
+  const failed = body.match(/Validation failed:\*{0,2}\s*(.+)/)
+  if (!failed) return { kind: "unrecognised", at, createdAt: validation.created_at || null, text: body.replace(/<!--.*?-->/gs, "").trim().slice(0, 500) }
+  const reason = failed[1].replace(/\*+/g, "").trim()
+  const rest = body.slice(failed.index + failed[0].length).replace(/\*+/g, "").trim()
+  const known = feedback.find((entry) => entry.reason === reason || entry.reason.replace(/\.$/, "") === reason.replace(/\.$/, ""))
+  return {
+    kind: "failed",
+    code: known ? known.code : "unrecognised",
+    reason,
+    action: known ? known.action : rest.split(/\n\s*\n/)[0] || null,
+    at,
+    createdAt: validation.created_at || null,
+  }
+}
+
+/**
+ * The labels the marketplace puts on a submission, read from the pin: the
+ * two blocking labels from the baseline policy, `validated` from the label
+ * set the approval script requires, and the manual-review label from the
+ * review policy.
+ */
+export async function marketplaceLabels(pinDir) {
+  const policy = await import(pathToFileURL(join(pinDir, "scripts/security-baseline-policy.mjs")).href)
+  const approval = readFileSync(join(pinDir, "scripts/approve-submission.mjs"), "utf8")
+  const validated = approval.match(/for \(const required of \["submission", "([^"]+)"/)?.[1]
+  if (!validated) throw new Error("cannot read the validated label from the pin")
+  const manual = policy.currentSecurityBaselinePolicy.maintainerVerificationOutcome
+  return { blocking: [...policy.securityBaselineBlockingLabels], validated, reviewRequired: `security-${manual}` }
+}
+
+/**
+ * The origin a watch compares the issue with. A github.com URL is taken as
+ * given; a path is a Git checkout whose `origin` is read the way `submit`
+ * reads it, and the working tree may be dirty, since only the remote is
+ * read. With no argument the current directory is the subject when it is
+ * such a checkout, and there is no subject otherwise. A cwd subject also
+ * carries its root manifest's name and id, because it was not asserted by
+ * anyone: validationWatch() compares it only when the issue is that plugin.
+ *
+ * @returns {{ origin: string, source: "url"|"path"|"cwd", manifest?: { name: string, id: string }|null }|null}
+ */
+export function resolveWatchSubject(target, { cwd = process.cwd(), cacheRoot = omakitCacheDir() } = {}) {
+  if (target !== undefined) {
+    const gh = /^(?:https:\/\/|git@)/.test(String(target)) ? parseGitHubUrl(target) : null
+    if (gh) return { origin: gh.url, source: "url" }
+    if (/^https?:\/\//.test(String(target))) throw new WatchError("usage", `the subject is a github.com repository URL or a local checkout, got ${target}`)
+    const subject = resolveSubject(target, { cacheRoot, allowDirty: true })
+    if (!subject.repository.url) throw new SubjectError("no-origin", `${subject.dir} has no github.com origin remote, so there is no repository to compare the issue with`)
+    return { origin: subject.repository.url, source: "path" }
+  }
+  try {
+    const subject = resolveSubject(cwd, { cacheRoot, allowDirty: true })
+    return subject.repository.url ? { origin: subject.repository.url, source: "cwd", manifest: rootManifest(subject.dir) } : null
+  } catch {
+    return null
+  }
+}
+
+/** The name and id of the root manifest.json, or null when there is none or it does not parse. */
+function rootManifest(dir) {
+  try {
+    const manifest = JSON.parse(readFileSync(join(dir, "manifest.json"), "utf8"))
+    return { name: String(manifest?.name || "").trim(), id: String(manifest?.id || "").trim() }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Whether an implicit (cwd) subject is the plugin the issue is about: the
+ * issue title carries the manifest's name after the pinned title template,
+ * or the body names the manifest's id. An explicit subject is the caller's
+ * assertion and always applies. Reviewed on the branch before release: run
+ * from the omakit checkout itself, `omakit watch <omacrunch issue>` compared
+ * the issue with omakit's origin, reported wrong-repository, and printed an
+ * action to put omakit's URL into omacrunch's issue; the #7787 mistake with
+ * the tool's authority behind it.
+ *
+ * @returns {boolean}
+ */
+export function subjectApplies(watchSubject, issue, titleTemplate) {
+  if (!watchSubject) return false
+  if (watchSubject.source !== "cwd") return true
+  const manifest = watchSubject.manifest
+  if (!manifest) return false
+  const title = String(issue?.title || "")
+  if (manifest.name && titleTemplate && title.startsWith(titleTemplate)) {
+    if (title.slice(titleTemplate.length).trim().toLowerCase() === manifest.name.toLowerCase()) return true
+  }
+  return Boolean(manifest.id) && String(issue?.body || "").includes(manifest.id)
+}
+
+/** Two github.com repository URLs name the same repository: https, no `.git`, no trailing slash, owner and name case-insensitively. */
+export function sameRepository(a, b) {
+  const left = parseGitHubUrl(a)
+  const right = parseGitHubUrl(b)
+  if (!left || !right) return null
+  return left.owner.toLowerCase() === right.owner.toLowerCase() && left.repository.toLowerCase() === right.repository.toLowerCase()
+}
+
 /**
  * @param {{ repoRoot: string, issueUrl: string, onPhase?: (name: string) => void,
+ *           subject?: { origin: string, source?: string }|null,
  *           github?: { issue?: typeof issue, issueComments?: typeof issueComments, defaultBranchHead?: typeof defaultBranchHead } }} options
  *   `github` is injectable for tests, so the whole path from an issue body to
  *   a verdict can be run on data that never left the machine; the default is
- *   the read-only GitHub access in `github.mjs`.
+ *   the read-only GitHub access in `github.mjs`. `subject` is the plugin's
+ *   own origin, from resolveWatchSubject(); with one, the issue's Repository
+ *   URL is compared with it, and without one (`watch --all`) it is not.
  */
-export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {} }) {
+export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}, subject: watchSubject = null }) {
   // Optional: told the name of the step about to run, so a terminal can say
   // what is happening while the network answers. Never affects the result.
   const phase = onPhase || (() => {})
@@ -229,6 +378,22 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
   const repositoryUrl = repository.url
   const repositoryError = repository.error
   const issueKind = repository.kind
+  // #7787, 2026-09-20 19:18 UTC: a retry edit typed the Repository URL as
+  // mtolhuijs/omacrunch on an issue whose plugin lives at mtolhuys/omacrunch.
+  // The marketplace validates the URL in the issue, so it validated a
+  // repository that does not exist and refused within 40 seconds. The issue
+  // is compared with origin here, so the typo is named as what it is rather
+  // than reported as a HEAD that could not be read.
+  // A subject nobody named (the current directory) is compared only when
+  // it is this plugin; otherwise it is reported as not compared, with the
+  // directory's origin, so a person sees why and can pass the plugin.
+  const titleTemplate = watchSubject?.source === "cwd" ? (await submissionContract({ pinDir })).titleTemplate : ""
+  const applies = subjectApplies(watchSubject, subject, titleTemplate)
+  const origin = applies ? watchSubject.origin : null
+  const subjectSkipped = watchSubject && !applies
+    ? { origin: watchSubject.origin, reason: `the current directory is ${watchSubject.origin}, not this plugin; pass the plugin checkout or URL as the second argument` }
+    : null
+  const repositoryMatches = origin && repositoryUrl ? sameRepository(repositoryUrl, origin) : null
 
   let validated = null
   let baselineError = null
@@ -249,6 +414,18 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
     baselineError = { code: error.code || "baseline-unreadable", message: error.message }
   }
   const fallback = validated ? null : validationCommentCommit(comments)
+  const validation = validationComment(comments, await submissionFeedback(pinDir))
+  const labelNames = await marketplaceLabels(pinDir)
+  // A refusal is the current state when it is newer than the baseline
+  // marker, and the marker wins when it is newer. On #7787 the marker said
+  // checkedAt 16:12 (the hand-edited retry that still validated) and the
+  // validation comment said "Validation failed" with updated_at 19:19:13
+  // (the typed retry); the marker was three hours stale and the refusal
+  // was the state of the issue. The next validation at 19:34 wrote a newer
+  // marker, and from then on the marker was the state again.
+  const refusal = validation?.kind === "failed" && (!validated || Date.parse(validation.at || "") > Date.parse(validated.checkedAt || ""))
+    ? { code: validation.code, reason: validation.reason, action: validation.action, at: validation.at }
+    : null
   let previousValidated = null
   if (validated) {
     // Revalidation on an existing issue may precede the latest marker. Ignore
@@ -265,6 +442,11 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
   }
 
   const labels = (subject.labels || []).map((label) => (typeof label === "string" ? label : label?.name)).filter(Boolean)
+  const labelState = {
+    blocking: labels.filter((label) => labelNames.blocking.includes(label)),
+    validated: labels.includes(labelNames.validated),
+    reviewRequired: labels.includes(labelNames.reviewRequired),
+  }
   const authorComments = comments.filter((comment) => comment?.user?.login === subject.user?.login)
   // The discussion is a person's: the marketplace's own bot and any other
   // automation (GitHub marks an app's account `type: "Bot"`, and names it
@@ -311,10 +493,13 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
       lastMaintainerCommentAt: maintainerComments.at(-1)?.created_at || null,
       authenticated: Boolean(token()),
     },
-    plugin: { repository: repositoryUrl, repositoryError, form: issueKind },
+    plugin: { repository: repositoryUrl, repositoryError, form: issueKind, origin, repositoryMatches, subjectSkipped },
     validated,
     previousValidated,
+    validationComment: validation,
     validationCommentFallback: fallback,
+    refusal,
+    labelState,
     baselineError,
     head,
     headError,
@@ -324,7 +509,7 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
       createdAt: maintainerComments.at(-1).created_at || null,
       authorAssociation: maintainerComments.at(-1).author_association || null,
     } : null,
-    verdict: validationVerdict({ comparable, stale, validated, head, fallback, baselineError, headError, pushedAfterReview, repositoryUrl }),
+    verdict: validationVerdict({ comparable, stale, validated, head, fallback, baselineError, headError, pushedAfterReview, repositoryUrl, origin, repositoryMatches, refusal }),
   }
 }
 
@@ -333,7 +518,24 @@ export async function validationWatch({ repoRoot, issueUrl, onPhase, github = {}
 // truthy string "unknown", so an issue whose body named no repository was
 // reported as a HEAD that could not be read, and the branch below that names
 // the real cause was reachable from the unit test alone.
-export function validationVerdict({ comparable, stale, validated, head, fallback, baselineError, headError, pushedAfterReview, repositoryUrl }) {
+export function validationVerdict({ comparable, stale, validated, head, fallback, baselineError, headError, pushedAfterReview, repositoryUrl, origin = null, repositoryMatches = null, refusal = null }) {
+  // The two states that say the issue itself is wrong come first: a
+  // comparison of commits on the wrong repository, or after a refusal,
+  // describes nothing the marketplace is looking at.
+  if (repositoryMatches === false) {
+    return {
+      state: "wrong-repository",
+      summary: `The issue's Repository URL is ${repositoryUrl}, the plugin's origin is ${origin}. The marketplace validates the URL in the issue, so it is validating the wrong repository, or none.`,
+      action: `Edit the issue and set the Repository URL field to ${origin}. Change nothing else.`,
+    }
+  }
+  if (refusal) {
+    return {
+      state: "refused",
+      summary: `The marketplace refused this issue at ${refusal.at || "an unrecorded time"}: ${refusal.code}, ${refusal.reason}${refusal.action ? ` ${refusal.action}` : ""}`,
+      action: refusal.action || REFRESH_ACTION,
+    }
+  }
   if (baselineError) {
     return {
       state: "unknown",