Item 1 (highest severity): GitHub Actions invokes run: steps as `bash -e {0}`, so errexit is inherited — `set -uo pipefail` does NOT clear it, only an explicit `set +e` does. The KEY extraction pipeline (grep exits 1 on branches without ENG-nnn) therefore killed the "never fails" JIRA step before its no_ticket fallback could run, hard-failing the agent job for every non-ENG-branch PR (observed in run 32017183079 on PR #152). Fix: explicit `set +e` in the JIRA and lint steps with a comment citing the run, `|| true` on the grep pipeline as belt-and-braces, and an audit of all pre-steps (the resolve and skill-move steps stay deliberately strict). Reproduced locally under `bash -e`: main's version exits 1, this version exits 0 and writes the marker. Item 2: the two-URL rule is now empirically confirmed (scoped API tokens are ignored entirely on *.atlassian.net — anonymous and authenticated requests return identical status codes). Replace the accessible-resources probe (OAuth-Bearer-only; returns 401 uniformly for no-auth/bogus-basic/bogus-bearer, so its 401 says nothing about credentials) with the public, unauthenticated GET <site>/_edge/tenant_info for cloudId discovery, and auto-retry via https://api.atlassian.com/ex/jira/<cloudId>. Remove the now unused .github/scripts/jira_sites.py. Item 3: carry forward the hedged diagnostics from orphaned commit c75b882 (pushed after the #152 squash-merge), now decisive where the evidence allows: when the configured host is *.atlassian.net, the marker recommends the ex/jira form outright; arms stay hedged only where JIRA's 404-for-unviewable behaviour makes causes genuinely indistinguishable. README: add the _edge/tenant_info cloudId discovery command. Recompiled with gh-aw v0.86.2 (0 errors, 0 warnings). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>