forgedock 1.29.1 → 1.31.0

package/bin/lean/precheck.test.mjs

@@ -0,0 +1,205 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpDir } from "../tests/_tmp.mjs";
+import { formatFirstPassSummary } from "./fixround.mjs";
+import { runChecks, formatPrecheckSummary, planPrecheck, selfCheck, selfCheckState, formatCheckTable, worktreeFingerprint, quietFailure } from "./precheck.mjs";
+import { execFileSync } from "node:child_process";
+import { readPrecheckBudget } from "../engine-cli.mjs";
+import { orchestrate } from "./orchestrate.mjs";
+
+/** A fake run: each call takes `cost[command]` ms of the shared clock (default 1000) and returns rc[command] (default 0). */
+function harness({ cost = {}, rc = {} } = {}) {
+  const h = { t: 0, live: 0, peak: 0, calls: [] };
+  h.now = () => h.t;
+  h.run = async ({ command, timeoutMs }) => {
+    h.calls.push([command, timeoutMs]); h.peak = Math.max(h.peak, ++h.live);
+    await new Promise((r) => setImmediate(r));
+    const c = cost[command] ?? 1000;
+    h.t += Math.min(c, timeoutMs); h.live--;
+    return c > timeoutMs ? { rc: 124, output: "timed out" } : { rc: rc[command] ?? 0, output: `${command} out` };
+  };
+  return h;
+}
+
+describe("runChecks (#4331)", () => {
+  it("runs up to `parallelism` commands at once and returns results in input order with ms", async () => {
+    const h = harness();
+    const r = await runChecks({ commands: ["a", "b", "c", "d", "e"], parallelism: 3, budgetMs: 600000, perCommandMs: 300000, now: h.now, run: h.run });
+    assert.equal(h.peak, 3);
+    assert.deepEqual(r.results.map((x) => x.command), ["a", "b", "c", "d", "e"]);
+    assert.ok(r.results.every((x) => x.rc === 0 && Number.isFinite(x.ms) && x.ms >= 0));
+    assert.deepEqual(r.deferred, []);
+    assert.ok(r.ms > 0);
+  });
+
+  it("parallelism 1 is serial; 0, NaN or missing fall back to 1", async () => {
+    for (const p of [1, 0, NaN, undefined, "x"]) {
+      const h = harness();
+      await runChecks({ commands: ["a", "b", "c"], parallelism: p, budgetMs: 600000, perCommandMs: 300000, now: h.now, run: h.run });
+      assert.equal(h.peak, 1, String(p));
+    }
+  });
+
+  it("past the budget the remaining commands are deferred to CI, not failed; a running one gets what is left", async () => {
+    const h = harness();
+    const r = await runChecks({ commands: ["a", "b", "c"], parallelism: 1, budgetMs: 1500, perCommandMs: 300000, now: h.now, run: h.run });
+    assert.deepEqual(h.calls, [["a", 1500], ["b", 500]]);
+    assert.deepEqual(r.results.map((x) => [x.command, x.rc]), [["a", 0]], "b was cut by the budget (rc 124): deferred, not a failure");
+    assert.deepEqual(r.deferred, ["b", "c"]);
+  });
+
+  it("a command's own timeout (not the budget) stays a failure; a throw is rc 127", async () => {
+    const h = harness({ cost: { slow: 5000 } });
+    const r = await runChecks({ commands: ["slow", "boom", "bad"], parallelism: 2, budgetMs: 600000, perCommandMs: 2000, now: h.now,
+      run: (a) => (a.command === "boom" ? Promise.reject(new Error("spawn failed")) : a.command === "bad" ? Promise.resolve({ rc: 2, output: "lint" }) : h.run(a)) });
+    assert.deepEqual(r.results.map((x) => [x.command, x.rc]), [["slow", 124], ["boom", 127], ["bad", 2]]);
+    assert.match(r.results[1].output, /spawn failed/);
+    assert.deepEqual(r.deferred, []);
+  });
+
+  it("no commands: nothing runs", async () => {
+    let n = 0;
+    const r = await runChecks({ commands: [], parallelism: 4, budgetMs: 1000, perCommandMs: 1000, now: () => 0, run: async () => { n++; return { rc: 0 }; } });
+    assert.deepEqual([n, r.results, r.deferred, r.ms], [0, [], [], 0]);
+  });
+});
+
+describe("runChecks (#4344)", () => {
+  /** A fake heavy semaphore: counts live slots, their peak and releases; `wait` ms of the shared clock per acquire. */
+  const sem = (h, wait = 0) => { const s = { live: 0, peak: 0, acquired: 0, released: 0 };
+    s.acquire = async () => { s.acquired++; s.peak = Math.max(s.peak, ++s.live); h.t += wait; return { release: () => { s.live--; s.released++; } }; }; return s; };
+
+  it("#4344 divides the worker budget across concurrent commands and takes one heavy slot per running command", async () => {
+    for (const [n, cmds, share, peak] of [[8, ["a", "b", "c", "d", "e", "f", "g", "h"], 1, 8], [8, ["a", "b"], 4, 2], [6, ["a", "b", "c", "d"], 1, 4], [5, ["a", "b"], 2, 2], [4, ["a"], 4, 1]]) {
+      const h = harness(), s = sem(h), seen = [];
+      await runChecks({ commands: cmds, parallelism: n, budgetMs: 600000, perCommandMs: 300000, now: h.now, acquire: s.acquire, run: (a) => { seen.push(a.workers); return h.run(a); } });
+      assert.ok(seen.every((w) => w === share), `N=${n} k=${cmds.length}: ${seen}`);
+      assert.ok(share * h.peak <= n, `round total ${share * h.peak} workers > N=${n}`);
+      assert.deepEqual([s.peak, s.acquired, s.released, s.live], [peak, cmds.length, cmds.length, 0], `N=${n} slots`);
+    }
+  });
+
+  it("#4344 FORGE_HOST_PARALLELISM=1: one command at a time, one worker, one slot", async () => {
+    const h = harness(), s = sem(h), seen = [];
+    await runChecks({ commands: ["a", "b", "c"], parallelism: 1, budgetMs: 600000, perCommandMs: 300000, now: h.now, acquire: s.acquire, run: (a) => { seen.push(a.workers); return h.run(a); } });
+    assert.deepEqual([h.peak, s.peak, seen], [1, 1, [1, 1, 1]]);
+  });
+
+  it("#4344 the slot wait counts against the budget: a command whose wait exhausts it is deferred, its slot released", async () => {
+    const h = harness(), s = sem(h, 1000);
+    const r = await runChecks({ commands: ["a", "b"], parallelism: 1, budgetMs: 2500, perCommandMs: 300000, now: h.now, acquire: s.acquire, run: h.run });
+    assert.deepEqual(h.calls, [["a", 1500]]);
+    assert.deepEqual([r.results.map((x) => x.command), r.deferred], [["a"], ["b"]]);
+    assert.deepEqual([s.acquired, s.released], [2, 2]);
+  });
+
+  it("#4344 a throwing acquire runs the command ungated; a throwing release is ignored", async () => {
+    const h = harness();
+    const r1 = await runChecks({ commands: ["a"], parallelism: 2, budgetMs: 600000, perCommandMs: 300000, now: h.now, acquire: async () => { throw new Error("registry"); }, run: h.run });
+    const r2 = await runChecks({ commands: ["b"], parallelism: 2, budgetMs: 600000, perCommandMs: 300000, now: h.now, acquire: async () => ({ release: () => { throw new Error("x"); } }), run: h.run });
+    assert.deepEqual([...r1.results, ...r2.results].map((x) => [x.command, x.rc]), [["a", 0], ["b", 0]]);
+  });
+});
+
+describe("formatPrecheckSummary (#4331)", () => {
+  it("sums precheck_ms over the lanes that ran checks and counts deferrals; null when none did", () => {
+    assert.equal(formatPrecheckSummary([{ precheck_ms: 90000 }, { precheck_ms: 30000, precheck_deferred: 2 }, { issue: 3 }]), "precheck: 2.0m total over 2 lanes, 2 deferred to CI");
+    assert.equal(formatPrecheckSummary([{ precheck_ms: 6000 }]), "precheck: 0.1m total over 1 lane");
+    assert.equal(formatPrecheckSummary([{ issue: 1 }]), null);
+    assert.equal(formatPrecheckSummary(undefined), null);
+  });
+  it("orchestrate rows carry the lane's precheckMs/precheckDeferred as precheck_ms/precheck_deferred for the report line", async () => {
+    const rows = await orchestrate({ issues: [1, 2, 3], parallel: 1, readBody: async () => "",
+      runOne: async (n) => ({ terminalReason: "merged", ...({ 1: { precheckMs: 90000, precheckDeferred: 1 }, 2: { precheckMs: 30000, precheckDeferred: 0 } })[n] }) });
+    assert.deepEqual(rows.map((r) => [r.issue, r.precheck_ms, r.precheck_deferred]), [[1, 90000, 1], [2, 30000, undefined], [3, undefined, undefined]]);
+    assert.equal(formatPrecheckSummary(rows), "precheck: 2.0m total over 2 lanes, 1 deferred to CI");
+  });
+  it("#4362: orchestrate rows carry the lane's firstPass as first_pass for the batch first-pass line", async () => {
+    const rows = await orchestrate({ issues: [1, 2, 3], parallel: 1, readBody: async () => "",
+      runOne: async (n) => ({ terminalReason: "merged", ...({ 1: { firstPass: true }, 2: { firstPass: false } })[n] }) });
+    assert.deepEqual(rows.map((r) => [r.issue, r.first_pass]), [[1, true], [2, false], [3, undefined]]);
+    assert.equal(formatFirstPassSummary(rows), "first-pass: 50% (1/2 lanes that reached the build)");
+  });
+});
+
+describe("readPrecheckBudget: forge.yaml lean.precheck.max_minutes (#4331)", () => {
+  const withYaml = (text, fn) => { const d = tmpDir("precheck-"); writeFileSync(join(d, "forge.yaml"), text); return fn(d); };
+  it("reads the nested block and the flat key; invalid or absent is undefined", () => {
+    assert.equal(withYaml("lean:\n  precheck:\n    max_minutes: 7\n", readPrecheckBudget), 7);
+    assert.equal(withYaml("lean:\n  precheck_max_minutes: 15\n  repro_test: off\n", readPrecheckBudget), 15);
+    for (const bad of ["0", "-1", "abc", "121"]) assert.equal(withYaml(`lean:\n  precheck_max_minutes: ${bad}\n`, readPrecheckBudget), undefined, bad);
+    assert.equal(withYaml("verify:\n  mode: local\n", readPrecheckBudget), undefined);
+    assert.equal(readPrecheckBudget(tmpDir("precheck-")), undefined);
+  });
+});
+
+describe("forgedock check core (#4364)", () => {
+  const MAP = { version: 1, entries: [{ globs: ["src/**"], command: "npm test", cwd: "." }, { globs: ["docs/**"], command: "make docs", cwd: "." }] };
+
+  it("planPrecheck: the engine's selection and budget rule (max_minutes wins, else precheck_total_seconds, else 600 s)", () => {
+    const p = planPrecheck({ testMap: MAP, files: ["src/a.js"], learned: [" make lint ", "", "make docs"], verify: { precheckTotalSeconds: 120, precheckTimeoutSeconds: 30 } });
+    assert.deepEqual(p.commands, ["make lint", "npm test"]); assert.deepEqual(p.dropped, ["make docs"]);
+    assert.equal(p.selected, 1); assert.equal(p.budgetMs, 120000); assert.equal(p.perCommandMs, 30000);
+    assert.equal(planPrecheck({ learned: ["x"], maxMinutes: 2, verify: { precheckTotalSeconds: 999 } }).budgetMs, 120000);
+    assert.equal(planPrecheck({ learned: ["x"], maxMinutes: 3, verify: {} }).budgetMs, 180000);
+    assert.deepEqual(planPrecheck({ learned: ["x"], verify: {} }), { commands: ["x"], added: 0, dropped: [], source: "learned", selected: 0, budgetMs: 600000, perCommandMs: 300000 });
+  });
+
+  it("selfCheck runs validates then pre-PR commands; ok only when every run exits 0; ci mode leaves validates to CI", async () => {
+    const h = harness({ rc: { "make lint": 2 } });
+    const contract = { validate: [{ id: "V1", command: "node --test a" }, { id: "V2", command: " " }] };
+    const plan = { mode: "local", commands: ["npm test", "make lint"], budgetMs: 600000, perCommandMs: 300000 };
+    const r = await selfCheck({ contract, plan, now: h.now, run: h.run });
+    assert.deepEqual(h.calls.map((c) => c[0]), ["node --test a", "npm test", "make lint"]);
+    assert.deepEqual(r.validate.map((x) => [x.id, x.rc]), [["V1", 0]]); assert.deepEqual(r.commands.map((x) => x.rc), [0, 2]); assert.equal(r.ok, false);
+    const h2 = harness();
+    const r2 = await selfCheck({ contract, plan: { ...plan, mode: "ci" }, now: h2.now, run: h2.run });
+    assert.deepEqual(h2.calls.map((c) => c[0]), ["npm test", "make lint"]); assert.deepEqual(r2.validate, [{ id: "V1", command: "node --test a", status: "ci" }]); assert.equal(r2.ok, true);
+    const h3 = harness({ cost: { "npm test": 5000 } });
+    const r3 = await selfCheck({ contract: {}, plan: { commands: ["npm test", "make lint"], budgetMs: 4000, perCommandMs: 300000 }, now: h3.now, run: h3.run });
+    assert.deepEqual(r3.deferred, ["npm test", "make lint"]); assert.equal(r3.ok, true, "deferred to CI is not a failure, as in the engine");
+  });
+
+  it("selfCheckState and formatCheckTable", () => {
+    assert.equal(selfCheckState(null, "f"), "skipped"); assert.equal(selfCheckState({ fingerprint: "g", ok: true }, "f"), "stale");
+    assert.equal(selfCheckState({ fingerprint: "f", ok: false }, "f"), "red"); assert.equal(selfCheckState({ fingerprint: "f", ok: true }, "f"), "green");
+    const t = formatCheckTable({ ok: false, validate: [{ id: "V1", command: "v", rc: 0, ms: 1200 }], commands: [{ command: "make lint", rc: 2, ms: 10, output: `${"x".repeat(5000)}TAIL` }], deferred: ["slow"] }, 1000);
+    assert.match(t, /^PASS +1\.2s {2}V1 v$/m); assert.match(t, /^FAIL exit 2 .* make lint$/m); assert.match(t, /^DEFERRED .* slow$/m);
+    assert.match(t, /--- make lint \(exit 2\)\n…x+TAIL/); assert.ok(t.length < 1400, "failure output capped"); assert.match(t, /check: FAIL \(1 failing\)$/);
+  });
+
+  it("#4390 quietFailure: last 40 lines, failing ids across ecosystems, log pointer; short output unchanged", () => {
+    const out = ["FAILED tests/test_x.py::test_a - assert 1 == 2", "not ok 3 - parses dates", " FAIL  src/a.test.ts > adds", "--- FAIL: TestSum (0.00s)", "test parser::empty ... FAILED", "  ✕ renders header (5 ms)",
+      ...Array.from({ length: 100 }, (_, i) => `line ${i}`)].join("\n");
+    const q = quietFailure(out, { logPath: ".forge-lean/logs/check-V1.log" });
+    assert.match(q, /^…line 60\n/); assert.match(q, /line 99\nfailing tests:\n/);
+    for (const id of ["FAILED tests/test_x.py::test_a", "not ok 3 - parses dates", "FAIL  src/a.test.ts > adds", "--- FAIL: TestSum", "test parser::empty ... FAILED", "✕ renders header"]) assert.ok(q.includes(`  ${id}`), id);
+    assert.match(q, /\nfull log: \.forge-lean\/logs\/check-V1\.log$/);
+    assert.equal(quietFailure("ok\nall good\n"), "ok\nall good");
+    assert.equal(quietFailure(""), "(no output)");
+    assert.equal(quietFailure("x".repeat(50), { maxChars: 10 }), `…${"x".repeat(10)}`);
+  });
+
+  it("worktreeFingerprint: the same content committed or not is the same tree; an edit or new file changes it; .forge-lean is ignored", async () => {
+    const dir = tmpDir("selfcheck-fp-");
+    const env = { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@example.invalid", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@example.invalid", GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_NOSYSTEM: "1" };
+    const g = (a) => execFileSync("git", a, { cwd: dir, encoding: "utf8", env });
+    g(["init", "-q", "-b", "main"]); writeFileSync(join(dir, "a.js"), "1\n"); writeFileSync(join(dir, "gone.js"), "x\n"); g(["add", "-A"]); g(["commit", "-q", "-m", "base"]);
+    g(["branch", "base"]);
+    const fp = () => worktreeFingerprint({ git: async (a) => g(a), base: "base" });
+    const clean = await fp();
+    writeFileSync(join(dir, "a.js"), "2\n"); writeFileSync(join(dir, "new.js"), "n\n"); g(["rm", "-q", "gone.js"]);
+    const dirty = await fp(); assert.notEqual(dirty, clean);
+    execFileSync("mkdir", ["-p", join(dir, ".forge-lean")]); writeFileSync(join(dir, ".forge-lean", "result.json"), "{}");
+    g(["add", "-A"]); g(["reset", "-q", "--", ".forge-lean"]);
+    writeFileSync(join(dir, ".git", "info", "exclude"), ".forge-lean/\n");
+    g(["commit", "-q", "-m", "work"]);
+    assert.equal(await fp(), dirty, "committing the checked tree does not make the check stale");
+    writeFileSync(join(dir, "a.js"), "3\n");
+    assert.notEqual(await fp(), dirty);
+  });
+});

package/bin/lean/prefilter.mjs

@@ -10,12 +10,17 @@
  *   3. every repo path the issue names is gone from origin/<lane> -> candidate
  * A candidate gets ONE read-only, single-turn validation on a small model in the main checkout (no worktree). Only an
  * ALREADY-FIXED/INVALID verdict with evidence closes the issue; everything else, and every error, goes to the normal lane.
- * All effects are injected (gh, git, runner, transitionLabel, projector?) so it is unit-testable.
+ * Post-deploy gate (#4389), with `defaultBranch`: a `FORGE:DEFERRED_FROM: #P` follow-up whose checklist items are all
+ * post-deploy is parked (`parked: true`, label `awaiting-promotion`, no lane) while a merge SHA of #P is not an ancestor
+ * of origin/<default>, or while forge.yaml `post_deploy.precondition_cmd` exits 1. Anything unresolvable fails open.
+ * All effects are injected (gh, git, runner, transitionLabel, projector?, execCode?) so it is unit-testable.
  */
+import { execFile } from "node:child_process";
 import { capComment, sanitizeMd, noComments } from "./render.mjs";
 import { PREFILTER_SYSTEM, prefilterPrompt, parsePrefilterVerdict } from "./prompts.mjs";
 import { isTrustedComment } from "../engine/phases.mjs";
 import { APP_SLUG } from "../init-repo.mjs";
+import { probeResultOf } from "./probe.mjs";
 
 export const DEFAULT_PREFILTER_MODEL = "claude-haiku-5-5";
 export const PREFILTER_MARKER = "FORGE:PREFILTER";
@@ -54,9 +59,20 @@ const isMarked = (c) => String(c?.body ?? "").trimStart().startsWith(`<!-- ${PRE
  * CONTRIBUTOR, never `[bot]`) plus the token's own user (`gh api user`; an App installation token cannot read it).
  */
 export async function ownLogins(gh) {
+  return (await resolveOwnLogins(gh)).logins;
+}
+/**
+ * #4318: {logins, resolved}. When `gh api user` fails (an App installation token), the App's own slug from `gh api app`
+ * (a differently named App); `resolved` is false when neither lookup answered, so the batch memo may ask once more.
+ */
+export async function resolveOwnLogins(gh) {
   const out = new Set([bareLogin(APP_SLUG)]);
-  try { const me = bareLogin(await gh(["api", "user", "--jq", ".login"])); if (me) out.add(me); } catch { /* installation token: the App slug only */ }
-  return [...out];
+  let resolved = false;
+  try { const me = bareLogin(await gh(["api", "user", "--jq", ".login"])); if (me) { out.add(me); resolved = true; } } catch { /* installation token */ }
+  if (!resolved) {
+    try { const slug = bareLogin(await gh(["api", "app", "--jq", ".slug"])); if (slug) { out.add(slug); resolved = true; } } catch { /* the App slug only */ }
+  }
+  return { logins: [...out], resolved };
 }
 /**
  * #4305: why one green run is no proof for this issue, without an API call: flaky wording or a `flaky` label, or an
@@ -67,11 +83,15 @@ export function flakyReason(iss, own = [bareLogin(APP_SLUG)]) {
   if (FLAKY_RE.test(`${iss.title ?? ""}\n${noComments(String(iss.body ?? ""), " ")}`)) return { reason: "flaky", why: "issue says the failure is intermittent" };
   if ((iss.labels ?? []).some((l) => String(l?.name ?? l).toLowerCase() === "flaky")) return { reason: "flaky", why: "flaky label" };
   const mine = new Set((own ?? []).map(bareLogin));
+  // #4399: the latest pipeline FORGE:PROBE result is a fail: the fix did not hold in production, so no already-fixed close
+  const probe = (iss.comments ?? []).filter((c) => probeResultOf(c?.body) && (trusted(c) || mine.has(bareLogin(loginOf(c))))).at(-1);
+  if (probe && probeResultOf(probe.body).result === "fail") return { reason: "probe-failed", why: "acceptance probe failed after promotion" };
   if ((iss.comments ?? []).some((c) => isMarked(c) && (trusted(c) || mine.has(bareLogin(loginOf(c)))))) return { reason: "reopened", why: "reopened after a pre-filter close" };
   return null;
 }
 /** The own logins, looked up only when an otherwise-untrusted marker comment needs them (no call for most issues). */
-const ownFor = async (iss, resolve) => ((iss.comments ?? []).some((c) => isMarked(c) && !trusted(c)) ? resolve() : undefined);
+const ownFor = async (iss, resolve) => ((iss.comments ?? []).some((c) => (isMarked(c) || probeResultOf(c?.body)) && !trusted(c)) ? resolve() : undefined);
+const selfResolver = (selfLogins, gh) => (typeof selfLogins === "function" ? selfLogins : selfLogins ? async () => selfLogins : () => ownLogins(gh));
 
 const PATH_RE = /(?:^|[\s`'"(\[])((?:\.{0,2}\/)?(?:[\w@.-]+\/)+[\w@.-]+\.[A-Za-z0-9]{1,8})(?::\d+(?:-\d+)?)?(?=$|[\s`'"),.:;\]])/gm;
 /** Repo-relative file paths the issue names (`dir/file.ext`, optionally `:line`); URLs and HTML comments are ignored. */
@@ -104,7 +124,7 @@ export async function collectSignals({ iss, repo, lane, io, cwd, selfLogins = nu
         const sha = latest.head_sha ?? "";
         // #4305: a workflow that failed and passed at the same SHA is flaky; the lookup is any branch (PR run vs push)
         // and only made when the issue itself gave no reason. An unreadable lookup throws: no CI signal.
-        const own = await ownFor(iss, typeof selfLogins === "function" ? selfLogins : selfLogins ? async () => selfLogins : () => ownLogins(io.gh));
+        const own = await ownFor(iss, selfResolver(selfLogins, io.gh));
         let skip = flakyReason(iss, own);
         const same = { reason: "same-sha", why: `failed and passed at ${sha.slice(0, 12)}` };
         if (!skip && sha && failed.head_sha === sha) skip = same;
@@ -128,21 +148,166 @@ export async function collectSignals({ iss, repo, lane, io, cwd, selfLogins = nu
   return sig;
 }
 
+// #4389: post-deploy precondition gate. A follow-up filed by scripts/file-deferred-followups.sh whose items are all
+// post-deploy checks cannot be done before its parent's fix is on the default branch: a git fact, so no lane learns it.
+export const PRECONDITION_MARKER = "FORGE:PRECONDITION";
+export const AWAITING_PROMOTION_LABEL = "awaiting-promotion";
+const DEFERRED_FROM_RE = /<!--\s*FORGE:DEFERRED_FROM:\s*#(\d+)\s*-->/;
+/** The parent #P of a deferred follow-up (`<!-- FORGE:DEFERRED_FROM: #P -->`), or null. */
+export function deferredFrom(body) {
+  const m = DEFERRED_FROM_RE.exec(String(body ?? ""));
+  return m ? Number(m[1]) : null;
+}
+const CHECK_RE = /^\s*[-*]\s+\[[ xX]\]\s+(.*)$/;
+/** True when the body has checklist items and every one is a ``- [ ] `R#: …` — post-deploy: why`` line (conformance followupItems). */
+export function postDeployOnly(body) {
+  const items = noComments(String(body ?? ""), " ").split("\n").map((l) => CHECK_RE.exec(l)?.[1]).filter((x) => x != null);
+  return items.length > 0 && items.every((t) => /^`[^`]*`\s+(?:\*\*known-flaw\*\*\s+)?[—-]+\s*post-deploy:/.test(t));
+}
+const SHA_RE = /^[0-9a-f]{7,40}$/i;
+/**
+ * #4467: an issue comment the engine may trust, in REST shape (`user.type`) or `gh issue view` shape (`author.login`,
+ * `authorAssociation`): what isTrustedComment trusts, or the ForgeDock App, which `gh issue view` reports as a bare
+ * `rapiercraft-forgedock` CONTRIBUTOR with no type and no `[bot]` suffix (#4315).
+ */
+export const isTrustedIssueComment = (c) => Boolean(c) && (trusted(c) || bareLogin(loginOf(c)) === bareLogin(APP_SLUG));
+/** Merge commits of the merged PRs that claim to fix #parent; else the `merged at <sha>` of its trusted FORGE:TRAJECTORY. */
+export async function parentMergeShas({ parent, repo, io }) {
+  const shas = new Set();
+  try {
+    const prs = JSON.parse(String(await io.gh(["pr", "list", "-R", repo, "--state", "merged", "--search", `#${parent}`, "--json", "number,title,body,mergeCommit", "--limit", "20"])) || "[]");
+    for (const p of prs) if ((claimsFix(p.title, parent) || claimsFix(p.body, parent)) && SHA_RE.test(p.mergeCommit?.oid ?? "")) shas.add(p.mergeCommit.oid);
+  } catch { /* unreadable: try the trajectory */ }
+  if (!shas.size) {
+    try {
+      const v = JSON.parse(String(await io.gh(["issue", "view", String(parent), "-R", repo, "--json", "comments"])));
+      for (const c of v.comments ?? []) {
+        const b = String(c?.body ?? "");
+        const m = b.includes("FORGE:TRAJECTORY") && isTrustedIssueComment(c) ? /merged at `?([0-9a-f]{7,40})\b/i.exec(b) : null;
+        if (m) shas.add(m[1]);
+      }
+    } catch { /* unreadable: no SHA */ }
+  }
+  return [...shas];
+}
+/** Default `io.execCode`: the exit code of an argv-only child (-1 when it could not run or timed out). */
+function execCode(cmd, args, opts) {
+  return new Promise((res) => {
+    try { execFile(cmd, args, opts, (err) => res(err ? (typeof err.code === "number" ? err.code : -1) : 0)); } catch { res(-1); }
+  });
+}
+/**
+ * #4389: never throws, no model call. `defaultBranch` is a name or an (async) function resolving it (and fetching it).
+ * @returns {Promise<{state:"not-applicable"|"unresolved"|"awaiting-promotion"|"awaiting-precondition"|"ready", parent:?number, shas:string[], default?:string, detail:string}>}
+ * Fail-open: no merge SHA, a git answer other than yes/no, an unknown default branch or a hook error give "unresolved".
+ */
+export async function postDeployGate({ iss, repo, lane, defaultBranch, cwd, io, preconditionCmd = null }) {
+  const parent = deferredFrom(iss?.body);
+  const res = (state, detail, extra = {}) => ({ state, parent, shas: [], detail, ...extra });
+  if (!parent || !postDeployOnly(iss.body)) return res("not-applicable", "");
+  try {
+    const def = typeof defaultBranch === "function" ? await defaultBranch() : defaultBranch;
+    if (!def) return res("unresolved", "default branch unknown");
+    const shas = await parentMergeShas({ parent, repo, io });
+    if (!shas.length) return res("unresolved", `no merge SHA found for #${parent}`);
+    const off = [];
+    for (const sha of shas) {
+      let on;
+      try { await io.git(["merge-base", "--is-ancestor", sha, `origin/${def}`], { cwd }); on = true; } catch (e) { on = e?.code === 1 ? false : null; }
+      if (on === null) return res("unresolved", `${sha.slice(0, 12)} unknown to git`, { shas, default: def });
+      if (!on) off.push(sha);
+    }
+    if (off.length) return res("awaiting-promotion", `fix ${off.map((s) => s.slice(0, 12)).join(", ")} of #${parent} is not on ${def}${lane ? ` (lane ${lane})` : ""}`, { shas, default: def });
+    if (preconditionCmd) {
+      const code = await (io.execCode ?? execCode)("sh", ["-c", preconditionCmd, "precondition", String(iss.number)],
+        { cwd, timeout: 60000, env: { ...process.env, FORGE_ISSUE: String(iss.number) } });
+      if (code === 1) return res("awaiting-precondition", `fix of #${parent} is on ${def}; post_deploy.precondition_cmd says not ready`, { shas, default: def });
+      if (code !== 0) return res("unresolved", `post_deploy.precondition_cmd exited ${code}`, { shas, default: def });
+    }
+    return res("ready", `fix of #${parent} is on ${def}`, { shas, default: def });
+  } catch (e) {
+    return res("unresolved", `gate error (${String(e?.message ?? e).slice(0, 120)})`);
+  }
+}
+/**
+ * #4389: the default branch for the gate, resolved and fetched once, only when a gated issue asks: forge.yaml
+ * `branches.default`, else GitHub's default branch. Null when neither answers (the gate then fails open).
+ */
+export function lazyDefaultBranch({ io, repo, cwd, configured = null }) {
+  let p = null;
+  return () => (p ??= (async () => {
+    let name = configured;
+    if (!name) { try { name = String(await io.gh(["repo", "view", repo, "--json", "defaultBranchRef", "-q", ".defaultBranchRef.name"])).trim() || null; } catch { name = null; } }
+    if (name) { try { await io.git(["fetch", "origin", name], { cwd }); } catch { /* offline: use the local ref */ } }
+    return name;
+  })());
+}
+/** #4389: label and explain a parked issue once (the comment only when the label was not there yet); best effort. */
+async function markParked({ issue, repo, io, had, gate }) {
+  const edit = () => io.gh(["issue", "edit", String(issue), "-R", repo, "--add-label", AWAITING_PROMOTION_LABEL]);
+  try { await edit(); } catch {
+    try {
+      await io.gh(["label", "create", AWAITING_PROMOTION_LABEL, "-R", repo, "--force", "--color", "C5DEF5", "--description", "Post-deploy follow-up parked until its parent fix reaches the default branch. Managed by ForgeDock."]);
+      await edit();
+    } catch { /* the comment and the report still show it */ }
+  }
+  if (had) return;
+  const what = gate.state === "awaiting-promotion" ? "awaiting promotion" : "awaiting its post-deploy precondition";
+  const body = `<!-- ${PRECONDITION_MARKER} -->\n## Parked: ${what}\n${sanitizeMd(gate.detail)}.\n\nEvery item here is a post-deploy check, so no lane was started. The next orchestrate or triage run checks again and launches this issue once the precondition holds.`;
+  try { await io.gh(["issue", "comment", String(issue), "-R", repo, "--body", capComment(body)]); } catch { /* the label still shows it */ }
+}
+
+/** #4389 batch-report lines: one `awaiting promotion:` line (and one `awaiting precondition:` line) for the parked rows, or "". */
+export function formatParkedLine(rows) {
+  const parked = (rows ?? []).filter((r) => r?.prefilter?.parked);
+  const uniq = (xs) => [...new Set(xs.filter(Boolean))];
+  const out = [];
+  const promo = parked.filter((r) => r.prefilter.kind === "awaiting-promotion");
+  if (promo.length) {
+    const lanes = uniq(promo.map((r) => r.prefilter.lane)), defs = uniq(promo.map((r) => r.prefilter.default));
+    out.push(`awaiting promotion: ${promo.map((r) => `#${r.issue}`).join(" ")} (fixes on ${lanes.join(", ") || "the lane"}, not on ${defs.join(", ") || "the default branch"})`);
+  }
+  const pre = parked.filter((r) => r.prefilter.kind === "awaiting-precondition");
+  if (pre.length) out.push(`awaiting precondition: ${pre.map((r) => `#${r.issue}`).join(" ")} (post_deploy.precondition_cmd not ready)`);
+  return out.join("\n");
+}
+
 /**
  * Pre-filter one issue. Never throws.
  * @returns {Promise<{issue:number, closed:boolean, kind:?string, candidate:boolean, verdict:?string, cost_usd:number, detail:string}>}
  */
-export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAULT_PREFILTER_MODEL, dryRun = false, agentId = null, maxMinutes = 5, selfLogins = null }) {
+export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAULT_PREFILTER_MODEL, dryRun = false, agentId = null, maxMinutes = 5, selfLogins = null, defaultBranch = null, preconditionCmd = null }) {
   const out = { issue, closed: false, kind: null, candidate: false, verdict: null, cost_usd: 0, detail: "" };
   try {
     const iss = JSON.parse(String(await io.gh(["issue", "view", String(issue), "-R", repo, "--json", "number,title,body,state,labels,comments"])));
     if (String(iss.state).toUpperCase() !== "OPEN") return { ...out, detail: "not open" };
-    if ((iss.labels ?? []).some((l) => ["needs-human", "workflow:merged"].includes(l?.name ?? l))) return { ...out, detail: "labelled, left to the lane" };
+    const names = (iss.labels ?? []).map((l) => l?.name ?? l);
+    const labelled = names.some((l) => ["needs-human", "workflow:merged"].includes(l));
+    // #4389: a post-deploy follow-up is gated even when an earlier lane escalated it (needs-human); nothing else changes.
+    const gated = !!defaultBranch && !names.includes("workflow:merged") && deferredFrom(iss.body) != null && postDeployOnly(iss.body);
+    if (labelled && !gated) return { ...out, detail: "labelled, left to the lane" };
     if (io.projector) {
       let st = null;
       try { st = await io.projector.readState(issue); } catch { /* unreadable: proceed */ }
       if (st?.lease && st.lease.until > Date.now() && st.lease.by !== agentId) return { ...out, detail: `leased by ${st.lease.by}` };
     }
+    if (gated) {
+      const gate = await postDeployGate({ iss, repo, lane, defaultBranch, cwd, io, preconditionCmd });
+      const had = names.includes(AWAITING_PROMOTION_LABEL);
+      if (gate.state === "awaiting-promotion" || gate.state === "awaiting-precondition") {
+        if (!dryRun) await markParked({ issue, repo, io, had, gate });
+        return { ...out, parked: true, kind: gate.state, parent: gate.parent, lane, default: gate.default, detail: gate.detail };
+      }
+      if (gate.state === "ready" && had && !dryRun) {
+        try { await io.gh(["issue", "edit", String(issue), "-R", repo, "--remove-label", AWAITING_PROMOTION_LABEL]); } catch { /* best effort */ }
+      }
+      if (labelled) return { ...out, detail: `labelled, left to the lane (post-deploy gate: ${gate.state}${gate.detail ? `, ${gate.detail}` : ""})` };
+    }
+    // #4399: an issue reopened by a failed acceptance probe goes to a lane, never back to an already-fixed close
+    if ((iss.comments ?? []).some((c) => probeResultOf(c?.body)?.result === "fail")
+      && flakyReason({ comments: iss.comments }, await ownFor(iss, selfResolver(selfLogins, io.gh)))?.reason === "probe-failed") {
+      return { ...out, detail: "acceptance probe failed after promotion (FORGE:PROBE): no already-fixed close; lane" };
+    }
     const sig = await collectSignals({ iss, repo, lane, io, cwd, selfLogins });
     const close = async (kind, body, detail) => {
       let note = "";
@@ -195,8 +360,14 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
 
 /** Per-issue hook for `orchestrate({ prefilter })`; `lane` is the issue's own resolved lane (#4125). */
 export function makePrefilter(opts) {
-  let own = null; // #4315: one `gh api user` per batch, and only when a marker comment needs it
-  const selfLogins = opts.selfLogins ?? (() => (own ??= ownLogins(opts.io.gh)));
+  // #4315: one identity lookup per batch, and only when a marker comment needs it; #4318: an unresolved one is retried once
+  let own = null, tries = 0;
+  const selfLogins = opts.selfLogins ?? (() => (own ??= (async () => {
+    tries++;
+    const r = await resolveOwnLogins(opts.io.gh);
+    if (!r.resolved && tries < 2) own = null;
+    return r.logins;
+  })()));
   return (issue, lane) => prefilterIssue({ ...opts, selfLogins, issue, ...(lane ? { lane } : {}) });
 }