diff --git a/packages/mosaic/framework/tools/git/lane-brief.sh b/packages/mosaic/framework/tools/git/lane-brief.sh
index 167dd98..b1ff7b7 100755
--- a/packages/mosaic/framework/tools/git/lane-brief.sh
+++ b/packages/mosaic/framework/tools/git/lane-brief.sh
@@ -76,11 +76,14 @@ echo "LANE BRIEF — $filt · $ts (login=$LOGIN)"
 echo "(open issues only; closed are excluded by definition — that's the point)"
 echo
 
+# Label match is exact-token against tea's space-separated labels string (so -l
+# "security" does NOT match label "domain/6-security"). Caveat: label names that
+# themselves contain spaces aren't distinguishable in tea's string form.
 printf '%s' "$ISSUES_JSON" | jq -r --arg ms "$MILESTONE" --arg lb "$LABEL" --arg prs "$PR_ISSUE_REFS" '
   ($prs | split("\n") | map(select(length>0))) as $prrefs
   | map(
       select( ($ms=="" or .milestone==$ms)
-          and ($lb=="" or ((.labels//"") | contains($lb))) )
+          and ($lb=="" or ((.labels//"") | split(" ") | index($lb) != null)) )
       | . + { assigned: ((.assignees//"")|length>0),
               haspr: (.index as $ix | ($prrefs | index($ix)) != null) }
     )
diff --git a/packages/mosaic/framework/tools/woodpecker/ci-wait.sh b/packages/mosaic/framework/tools/woodpecker/ci-wait.sh
index 412721a..34c38cf 100755
--- a/packages/mosaic/framework/tools/woodpecker/ci-wait.sh
+++ b/packages/mosaic/framework/tools/woodpecker/ci-wait.sh
@@ -49,7 +49,7 @@ if [[ -z "$INSTANCE" ]]; then
   case "${REPO%%/*}" in
     usc|USC) INSTANCE=usc ;;
     mosaicstack|mosaic) INSTANCE=mosaic ;;
-    *) INSTANCE=usc ;;
+    *) echo "FATAL: cannot infer Woodpecker instance for owner '${REPO%%/*}' — pass -a <instance>" >&2; exit 2 ;;
   esac
 fi