fix(skills): fall back to cross-team action discovery

contrib/skills/shared/oo/SKILL.md

@@ -130,8 +130,11 @@ These rules override every local heuristic.
    destination, or timing choices.
 9. Stop at real blockers. Stop and report clearly on auth, billing, catalog
    miss, unsupported input shape, missing required values, terminal task
-   failure, or an unsafe side effect. Connector authorization blockers are
-   terminal for the current turn: when evidence shows the selected connector is
+   failure, or an unsafe side effect. Before treating a discovery result as an
+   auth or catalog blocker, apply the one-time cross-team search fallback in
+   [references/search-and-selection.md](references/search-and-selection.md#team-scope)
+   when eligible. After discovery, connector authorization blockers are terminal
+   for the current turn: when evidence shows the selected connector is
    not connected, not authorized, missing scopes, expired, or otherwise blocked
    by connector authentication, return only a short blocker summary, the direct
    connection or re-authorization URL, and one concise next step. Do not inspect
@@ -168,8 +171,7 @@ proves its output.
    activate only the current unresolved external step.
 3. Discover
    Read [references/search-and-selection.md](references/search-and-selection.md)
-   before the first search. Preserve the current team; use `--all-teams` only
-   under the reference's explicit cross-team discovery rules.
+   before the first search. Follow its team scope and cross-team fallback rules.
    Run `oo search "<goal>" --json` unless a complete
    capability contract is already known from current evidence.
    A complete contract means connector schema already proves the callable id,

contrib/skills/shared/oo/references/search-and-selection.md

@@ -108,8 +108,22 @@ Use `oo search "<text>" --all-teams --json` when the user asks to search across
 teams, or current evidence establishes that no team has been selected and the
 task calls for finding a connection across memberships. This is hosted-only,
 ignores saved/env team selections, and conflicts with `--team`. For a known
-team, use `oo search "<text>" --team "<name>" --json`. Do not automatically
-broaden scope after a current-team authorization failure.
+team, use `oo search "<text>" --team "<name>" --json`.
+
+In Hosted mode, if a successful current-team search returns no matching,
+available action, repeat the same query once with `--all-teams --json` before
+reporting an auth or catalog blocker. This includes empty or irrelevant results
+and matching actions whose discovery status indicates an unavailable connection
+or authorization. Do not fall back when a matching action is available, when
+the user explicitly scoped the task to a team, or when the search command itself
+fails (including network, service, or authentication errors). A saved or
+environment-selected team alone does not prohibit this discovery fallback.
+Do not repeat an already cross-team search or use this fallback after connector
+execution fails. If no usable match is found, report the applicable blocker.
+
+When fallback finds a match, identify its team and connection. For a discovery
+request, report the results; for execution in another team, establish the user's
+intended team and connection before running. Do not change the saved team.
 
 Cross-team results preserve `teamId`, `teamName`, and `appId`. Keep the selected
 triple together; do not deduplicate different connections solely by action ID.
@@ -157,6 +171,9 @@ Representative JSON example:
 
 ## Rank the first result set
 
+Apply the discovery fallback under [Team scope](#team-scope) before reporting
+unavailable connections or missing candidates under the rules below.
+
 Inspect the first result set before trying alternative searches. Usually keep
 one primary candidate and at most one materially different fallback.