@@ -10,8 +10,10 @@ Use the Git-backed work queue when independently running dispatchers and workers
 
 - Enable `tools.work-queue: true` to read the queue snapshot captured at activation. Call `work_queue_read` without arguments to see available Work (oldest first), `next_work`, and claim states; pass `work` to inspect one Work identity. `next_work` is a recommendation from a possibly stale snapshot, **not** an acquired Claim.
 - Select work with stable identities and make processing idempotent. Claimed Work does not block newer available Work; oldest-first selection is best effort, not strict FIFO.
-- Dispatch workers only through an explicitly configured, trusted path. `safe-outputs.dispatch-workflow` runs allowed `workflow_dispatch` workers asynchronously; `safe-outputs.call-workflow` selects an allowed `workflow_call` worker in the same run. Neither output by itself creates a work-queue Claim or supplies a trusted worker assignment. Do not pass agent-chosen Work/Claim identifiers as though they establish ownership.
-- Do not write queue transactions from an agent or assume the snapshot is current. Queue mutations and version-checked publication belong to trusted processing; if that integration is not configured, use the operator CLI for manual queue management rather than claiming the workflow automatically dispatches queue items.
+- To dispatch a queue worker, configure `safe-outputs.dispatch-workflow` with an allowed same-repository `workflow_dispatch` worker that declares an `aw_context` input and enables `tools.work-queue: true`. Pass `work_queue: {work_id: "<id from work_queue_read>"}` to that worker's safe-output tool. This selector is **not** a worker input: trusted safe-output processing refreshes the queue, checks availability, publishes a Claim, and injects `aw_context.work_queue` with the selected identity, generated Claim ID, and `{id: work_id}` payload. The worker must look up any additional task details by that identity. Dispatch failure attempts to cancel the Claim; a concurrent dispatch can supersede it, so the worker must still pass activation and completion checks.
+- `safe-outputs.dispatch-workflow` without `work_queue` remains a normal dispatch and does not create a Claim. Cross-repository queue dispatch, workers lacking either required opt-in, and staged dispatches cannot create a Claim. `safe-outputs.call-workflow` does not create a Claim. Do not pass agent-chosen Claim identifiers as though they establish ownership.
+- If the safe-output log warns that Claim cancellation failed, use its work and claim IDs to investigate and reconcile the runtime `work-queue` branch. The `gh aw work-queue` operator CLI manages a separate branch and transaction format and cannot cancel runtime Claims.
+- Do not write queue transactions from an agent or assume the snapshot is current. Queue mutations and version-checked publication belong to trusted processing; if dispatch-workflow is not configured, use the operator CLI for manual queue management.
 
 ## Worker workflows
 
 
@@ -47,7 +47,9 @@ Closing a summary as **completed** suppresses its unchanged source findings.
 Newer source activity makes those findings eligible again. Workflow retirement
 uses **not planned**, so reorganizing the queue does not mark its sources fixed.
 There are never more than ten open owned summaries; assigned work counts toward
-that limit. The discussion provides the current rank even for frozen assignments.
+that limit. The discussion provides the current rank even for frozen assignments. If GitHub
+rejects editing its existing bot-authored body, the publisher posts the current
+queue as a new comment on that discussion instead.
 
 The publisher independently refetches GitHub evidence rather than trusting
 agent-editable snapshot files. It validates the full plan before writing, checks
 
@@ -11,7 +11,7 @@
 import re
 
 from aw_issue_clustering import (
-    CLUSTER_LABEL, END, OWNER_MARKER, PREFIX, START, build_corpus, collect_discussions,
+    CLUSTER_LABEL, END, GitHubAPIError, OWNER_MARKER, PREFIX, START, build_corpus, collect_discussions,
     collect_issues, gh_json, graphql, managed, metadata, run_cutoff,
 )
 
@@ -320,11 +320,21 @@ def publish_dashboard(repo, body, staged=False):
         replacement = body.split(START, 1)[1].split(END, 1)[0]
         updated = replace_island(dashboards[0]["body"], START + replacement + END)
         if dashboards[0]["body"] != updated:
-            graphql("""
-              mutation($id:ID!, $body:String!) {
-                updateDiscussion(input:{discussionId:$id, body:$body}) { discussion { id } }
-              }
-            """, id=dashboards[0]["id"], body=updated)
+            try:
+                graphql("""
+                  mutation($id:ID!, $body:String!) {
+                    updateDiscussion(input:{discussionId:$id, body:$body}) { discussion { id } }
+                  }
+                """, id=dashboards[0]["id"], body=updated)
+            except GitHubAPIError as error:
+                if "Resource not accessible by integration" not in str(error):
+                    raise
+                graphql("""
+                  mutation($id:ID!, $body:String!) {
+                    addDiscussionComment(input:{discussionId:$id, body:$body}) { comment { id } }
+                  }
+                """, id=dashboards[0]["id"], body=body)
+                print("Dashboard edit denied; published the current queue as a discussion comment")
     else:
         data = graphql("""
           query($owner:String!, $name:String!) {
 
@@ -352,6 +352,52 @@ def test_dashboard_updates_only_owned_bot_discussion(self, api):
         self.assertEqual("owned", api.call_args.kwargs["id"])
         self.assertTrue(api.call_args.kwargs["body"].startswith("Operator note."))
 
+    @patch.object(publish, "graphql")
+    def test_dashboard_comments_when_existing_discussion_cannot_be_edited(self, api):
+        old_body = collect.START + "\nOld table\n" + collect.END + collect.OWNER_MARKER
+        api.side_effect = [
+            {"search": {"pageInfo": {"hasNextPage": False}, "nodes": [
+                {"id": "owned", "title": "AW Essential 10", "body": old_body,
+                 "author": {"__typename": "Bot"}, "closed": False},
+            ]}},
+            collect.GitHubAPIError("GitHub API request failed: Resource not accessible by integration", []),
+            {"addDiscussionComment": {"comment": {"id": "new"}}},
+        ]
+        body = collect.START + "\nUpdated ranked queue\n" + collect.END + collect.OWNER_MARKER
+        publish.publish_dashboard(REPO, body)
+        self.assertEqual(3, api.call_count)
+        self.assertIn("Updated ranked queue", api.call_args.kwargs["body"])
+        self.assertEqual("owned", api.call_args.kwargs["id"])
+        self.assertIn("addDiscussionComment", api.call_args.args[0])
+
+    @patch.object(publish, "graphql")
+    def test_dashboard_does_not_hide_other_update_errors(self, api):
+        api.side_effect = [
+            {"search": {"pageInfo": {"hasNextPage": False}, "nodes": [
+                {"id": "owned", "title": "AW Essential 10",
+                 "body": collect.START + "\nOld table\n" + collect.END + collect.OWNER_MARKER,
+                 "author": {"__typename": "Bot"}, "closed": False},
+            ]}},
+            collect.GitHubAPIError("GitHub API request failed: rate limit exceeded", []),
+        ]
+        with self.assertRaisesRegex(collect.GitHubAPIError, "rate limit exceeded"):
+            publish.publish_dashboard(REPO, collect.START + "\nNew table\n" + collect.END)
+        self.assertEqual(2, api.call_count)
+
+    @patch.object(publish, "graphql")
+    def test_dashboard_comment_failure_is_not_hidden(self, api):
+        api.side_effect = [
+            {"search": {"pageInfo": {"hasNextPage": False}, "nodes": [
+                {"id": "owned", "title": "AW Essential 10",
+                 "body": collect.START + "\nOld table\n" + collect.END + collect.OWNER_MARKER,
+                 "author": {"__typename": "Bot"}, "closed": False},
+            ]}},
+            collect.GitHubAPIError("Resource not accessible by integration", []),
+            collect.GitHubAPIError("comment failed", []),
+        ]
+        with self.assertRaisesRegex(collect.GitHubAPIError, "comment failed"):
+            publish.publish_dashboard(REPO, collect.START + "\nNew table\n" + collect.END)
+
     @patch.object(publish, "run_cutoff", return_value="2026-10-03T00:00:00Z")
     @patch.object(publish, "collect_discussions", return_value=[])
     @patch.object(publish, "collect_issues")