forgedock 1.32.0 → 1.32.1

package/bin/engine/phases.mjs

@@ -309,19 +309,40 @@ async function readIssueRecord(n, io) {
 }
 
 // A declaration line: optional list marker, optional bold, "Depends on" or "Blocked by" (any case), optional colon
-// inside or after the bold, then one or more `#N` separated by commas, "and", "&" or spaces (#4121).
-const DEPENDS_ON_RE = /^[ \t]*(?:[-*+][ \t]+)?(?:\*\*|__)?(?:depends on|blocked by)[ \t]*:?(?:\*\*|__)?[ \t]*:?[ \t]*(#\d+\b(?:[ \t]*(?:,|&|\band\b)?[ \t]*#\d+\b)*)/gim;
+// inside or after the bold, then a list of `#N` (#4121, #4506). The list is `#N` items joined by `,` `&` `and` `or`
+// (each item may carry a parenthetical note, whose own `#N` are prose); any other text ends it, so a trailing
+// "see #99", "Fixes #12", a code span or a sentence never adds an edge (release review #4515).
+const DEPENDS_ON_RE = /^[ \t]*(?:[-*+][ \t]+)?(?:\*\*|__)?(?:depends on|blocked by)[ \t]*:?(?:\*\*|__)?[ \t]*:?[ \t]*(#\d+\b[^\n]*)/gim;
+const DEP_ITEM_RE = /^(?<![\w/])#(\d+)\b(?:[ \t]*\([^()\n]*\))?/;
+const DEP_JOIN_RE = /^[ \t]*(?:,[ \t]*(?:(?:and|or)\b[ \t]*)?|&[ \t]*|(?:and|or)\b[ \t]*)/i;
+
+/** The `#N` list at the start of a declaration's tail: items and joiners only, stopping at the first other text. */
+function dependsOnList(tail) {
+  const out = [];
+  let rest = tail;
+  for (;;) {
+    const item = DEP_ITEM_RE.exec(rest);
+    if (!item) break;
+    out.push(Number(item[1]));
+    rest = rest.slice(item[0].length);
+    const join = DEP_JOIN_RE.exec(rest);
+    if (!join || !/^#\d/.test(rest.slice(join[0].length))) break;
+    rest = rest.slice(join[0].length);
+  }
+  return out;
+}
 
 /**
  * Issue numbers an issue body declares it waits on: `**Depends on**: #X`, `**Depends on** #X, #Y`, `Depends on #X`,
- * `- Depends on: #X and #Y`, `Blocked by #X`. Only declaration lines count; a mid-line mention is prose. Shared by the
- * engine's admission (`openDependency`) and `forgedock orchestrate` so both agree on what blocks what.
+ * `- Depends on: #X and #Y`, `Depends on #X (why) and #Y (why)`, `Blocked by #X`. Only declaration lines count, and on
+ * them only the leading `#N` list; a mid-line or trailing mention is prose. Shared by the engine's admission
+ * (`openDependency`) and `forgedock orchestrate` so both agree on what blocks what.
  * @returns {number[]} unique, positive, never `issue` itself
  */
 export function parseDependsOn(body, issue = null) {
   const out = new Set();
   for (const m of String(body ?? "").replace(/\r\n/g, "\n").matchAll(DEPENDS_ON_RE)) {
-    for (const r of m[1].matchAll(/#(\d+)/g)) out.add(Number(r[1]));
+    for (const n of dependsOnList(m[1])) out.add(n);
   }
   return [...out].filter((n) => Number.isSafeInteger(n) && n > 0 && n !== Number(issue));
 }
@@ -329,8 +350,8 @@ export function parseDependsOn(body, issue = null) {
 /**
  * forge#3932: does the issue declare a `Depends on` / `Blocked by` dependency that is still OPEN?
  * Honoured only when the issue BODY's author is trusted (`isTrustedComment`: OWNER/MEMBER/COLLABORATOR,
- * Bot, or FORGE_TRAIL_TRUSTED_LOGINS) and only for a declaration line `parseDependsOn` accepts (mid-line
- * prose is ignored). A self-reference is ignored. Returns `null` (nothing blocking), `{ open: [N, ...] }`, or `{ unreadable: true, detail }`
+ * Bot, or FORGE_TRAIL_TRUSTED_LOGINS) and only for a declaration line's leading `#N` list as `parseDependsOn` reads it (mid-line
+ * and trailing prose is ignored). A self-reference is ignored. Returns `null` (nothing blocking), `{ open: [N, ...] }`, or `{ unreadable: true, detail }`
  * when the issue or a declared dependency cannot be read (fail closed: the caller refuses the run).
  * An empty read of the issue itself means "no body to trust" and yields `null`.
  */

package/bin/engine-cli.mjs

@@ -1199,19 +1199,34 @@ async function orchestrateClient(argv, deps = {}) {
     }
     msg = { op: "submit", argv: sub, cwd: process.cwd(), env: schedd.batchEnv(process.env) };
   }
-  const sock = await connect();
+  let sock = await connect(), req = msg, reattached = false, losses = 0;
   let id = resumeId;
-  try {
-    const done = await schedd.request(sock, msg, (m) => {
-      if (m.type === "batch") id = m.id;
-      else if (m.type === "row") console.log(formatRowLine(m.row));
-      else if (m.type === "line") console.log(m.text);
-      else if (m.type === "done" && m.replay && m.report) console.log(m.report);
-    });
-    return done.result;
-  } catch (e) {
-    if (id && /closed the connection/.test(e?.message ?? "")) throw new Error(`${e.message}; the batch keeps its state: forgedock orchestrate --resume ${id}`);
-    throw e;
+  const onMsg = (m) => {
+    if (m.type === "batch") id = m.id;
+    else if (m.type === "row") { if (!(reattached && m.replay)) console.log(formatRowLine(m.row)); }
+    else if (m.type === "line") console.log(m.text);
+    else if (m.type === "done" && m.replay && m.report) console.log(m.report);
+  };
+  // #4503: when the daemon dies mid-batch, reconnect (spawning one unless `spawnDaemon: null`) and re-attach, within `reconnectMs`.
+  const reconnectMs = deps.reconnectMs ?? 60_000, sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  for (;;) {
+    try {
+      return (await schedd.request(sock, req, onMsg)).result;
+    } catch (e) {
+      if (!id || !(/closed the connection/.test(e?.message ?? "") || ["ECONNRESET", "EPIPE"].includes(e?.code))) throw e;
+      const giveUp = () => new Error(`${e.message}; the batch keeps its state: forgedock orchestrate --resume ${id}`);
+      if (++losses > 10) throw giveUp();
+      console.log(`schedd connection lost; reconnecting to batch ${id}`);
+      const end = Date.now() + reconnectMs;
+      for (sock = null; !sock;) {
+        try { sock = await connect(); } catch {
+          if (Date.now() >= end) throw giveUp();
+          await sleep(250);
+        }
+      }
+      req = { op: "attach", id };
+      reattached = true;
+    }
   }
 }
 
@@ -1350,7 +1365,7 @@ export async function runBatch({ argv, cwd: callerCwd = process.cwd(), env: call
         const local = batchMod.detachedLanes({ batch, cwd, env, script: laneScript, bin: deps.laneBin, pollMs: deps.pollMs, laneArgs });
         lanes = withPlacement({
           runOne: (n, ln, ctx = {}) => (ctx.remote ? remoteLanes : local).runOne(n, ln, ctx),
-          adopt: (n, rec) => (rec?.remote || rec?.handle ? remoteLanes : local).adopt(n, rec),
+          adopt: (n, rec, ctx) => (rec?.remote || rec?.handle ? remoteLanes : local).adopt(n, rec, ctx),
         });
       }
       // #4255: hard execution budget per batch and per host UTC day; every settled sandbox is recorded and reported.

package/bin/lean/batch.mjs

@@ -181,7 +181,10 @@ export async function waitLane({ batch, issue, pid, alive = isLaneAlive, sleep =
   }
 }
 
-/** Lane seams for `orchestrate()`: `runOne` launches a detached lane, `adopt` re-attaches to a live one (else null). */
+/**
+ * Lane seams for `orchestrate()`: `runOne` launches a detached lane, `adopt` re-attaches to a live one (else null). A lane
+ * that already ended resolves at once with its result file; a live one calls `ctx.onLive()` before it is awaited (#4504).
+ */
 export function detachedLanes({ batch, laneArgs, script, cwd, env, bin, alive = isLaneAlive, pollMs, spawnFn }) {
   return {
     runOne: async (n, lane, ctx = {}) => {
@@ -189,9 +192,12 @@ export function detachedLanes({ batch, laneArgs, script, cwd, env, bin, alive =
       ctx.onStart?.({ pid });
       return waitLane({ batch, issue: n, pid, alive, pollMs });
     },
-    adopt: async (n, rec) => {
+    adopt: async (n, rec, ctx = {}) => {
       const rf = batch.resultFile(n);
-      if (!existsSync(rf) && !alive(rec.pid, rf)) return null;
+      if (!existsSync(rf)) {
+        if (!alive(rec.pid, rf)) return null;
+        ctx.onLive?.();
+      }
       return waitLane({ batch, issue: n, pid: rec.pid, alive, pollMs });
     },
   };

package/bin/lean/batch.test.mjs

@@ -7,7 +7,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { orchestrate, deferPolicy, DEFER_BACKOFF_S } from "./orchestrate.mjs";
-import { openBatch, fsTypeOf, assertDiskPath, isLaneAlive, writeAtomic, launchLane } from "./batch.mjs";
+import { openBatch, fsTypeOf, assertDiskPath, isLaneAlive, writeAtomic, launchLane, detachedLanes } from "./batch.mjs";
 import { orchestrateFromCli, runFromCli, readOrchestration, makeRelabelNeedsHuman, makeDispatchCheck } from "../engine-cli.mjs";
 
 // orchestrateFromCli opens the host lane registry (#4191): keep it in a temp dir, also for spawned dispatchers.
@@ -629,3 +629,33 @@ describe("#4481: a closed issue or a merged lane PR is skipped at dispatch", ()
     assert.equal(await mk(new Error("x"), new Error("y"))(9), null);
   });
 });
+
+describe("#4504: a resume settles lanes that ended while no dispatcher ran", () => {
+  it("#4504: a resume settles a dead lane's result and requeues a dead lane without one before scheduling, while an earlier live lane still runs", async () => {
+    const dir = tmpDir("batch-4504-");
+    const batch = { resultFile: (n) => join(dir, `${n}.json`), logFile: (n) => join(dir, `${n}.log`) };
+    writeFileSync(batch.resultFile(2), JSON.stringify({ terminalReason: "merged", pr: 102 }));
+    const { adopt } = detachedLanes({ batch, laneArgs: () => [], script: "x", alive: (pid) => pid === 11, pollMs: 5 });
+    let saved = { v: 1, order: [1, 2, 3, 4], deps: { 1: [], 2: [], 3: [], 4: [] }, lanes: {}, crossSeen: [], results: {},
+      running: { 1: { startedAt: 1, pid: 11 }, 2: { startedAt: 1, pid: 22 }, 3: { startedAt: 1, pid: 33 } }, pending: [4],
+      notBefore: {}, requeues: {}, deferrals: {}, engineErrors: {}, prefilter: {}, errorTimes: [], breaker: null };
+    const store = { load: () => saved, save: (s) => { saved = s; }, log: () => {} };
+    const launched = [];
+    const done = orchestrate({ issues: [], parallel: 3, pollMs: 5, readBody: async () => "", store, adopt,
+      runOne: async (n) => { launched.push(n); return { terminalReason: "merged", pr: 100 + n }; } });
+    let rows;
+    try {
+      await until(() => launched.includes(3) && launched.includes(4) && saved.results?.["2"], 3000);
+      assert.equal(saved.results["2"].outcome, "merged", "the dead lane's result is settled");
+      assert.equal(saved.results["2"].pr, 102);
+      assert.ok(saved.running["1"], "the live lane is still running");
+      assert.equal(saved.running["2"], undefined, "the settled lane left running");
+      assert.ok(!launched.includes(1) && !launched.includes(2), "neither adopted lane is relaunched");
+    } finally {
+      writeFileSync(batch.resultFile(1), JSON.stringify({ terminalReason: "merged", pr: 101 })); // the live lane ends
+      rows = await done;
+    }
+    assert.deepEqual(rows.map((r) => [r.issue, r.outcome, r.pr]), [[1, "merged", 101], [2, "merged", 102], [3, "merged", 103], [4, "merged", 104]]);
+    assert.deepEqual(launched.sort(), [3, 4], "the dead lane without a result is requeued and run once");
+  });
+});

package/bin/lean/effects.mjs

@@ -3,7 +3,7 @@
 /** Core work-on: the real effects behind runCore's injected `io`. Argv only, no shell. */
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import { readFileSync, appendFileSync, mkdirSync, statSync, existsSync, rmSync, writeFileSync, renameSync, readdirSync, lstatSync, readlinkSync, realpathSync } from "node:fs";
+import { readFileSync, appendFileSync, mkdirSync, mkdtempSync, statSync, existsSync, rmSync, writeFileSync, renameSync, readdirSync, lstatSync, readlinkSync, realpathSync } from "node:fs";
 import { homedir, hostname, freemem, loadavg, cpus, tmpdir } from "node:os";
 import { promises as fsp } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
@@ -234,10 +234,36 @@ export function runCheckCommand({ command, cwd, timeoutMs = 300000, env = null }
   });
 }
 
+/**
+ * #4507: a per-run gh HTTP cache (XDG_CACHE_HOME on the gh child only), so concurrent lanes never share a cache entry.
+ * `reset()` drops the current dir (only one this cache created) and switches to a fresh one; with no `root` the dirs
+ * are mkdtemp dirs under `tmp`, removed by `dispose()`.
+ */
+export function makeGhCache({ root = null, tmp = tmpdir() } = {}) {
+  let n = 0, dir = root ? join(root, "gh-cache") : null, disposed = false;
+  const made = new Set();
+  const drop = (d) => { if (d && made.has(d)) { try { rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } made.delete(d); } };
+  return {
+    env() {
+      if (!dir || disposed) return undefined; // after dispose (run teardown) gh falls back to its default cache
+      if (!made.has(dir)) { try { mkdirSync(dir, { recursive: true, mode: 0o700 }); made.add(dir); } catch { return undefined; } }
+      return { XDG_CACHE_HOME: dir };
+    },
+    reset() {
+      drop(dir);
+      if (disposed) return;
+      if (root) { dir = join(root, `gh-cache-${++n}`); return; }
+      try { dir = mkdtempSync(join(tmp, "forge-gh-cache-")); made.add(dir); } catch { dir = null; }
+    },
+    dispose() { disposed = true; for (const d of [...made]) drop(d); },
+  };
+}
+
 export function makeLeanIo({ repo }) {
   const base = makeIo();
-  const run = (bin) => async (args, opts = {}) => (await pexec(bin, args, { cwd: opts.cwd, maxBuffer: 100 * 1024 * 1024, timeout: 120000 })).stdout;
+  const run = (bin) => async (args, opts = {}) => (await pexec(bin, args, { cwd: opts.cwd, maxBuffer: 100 * 1024 * 1024, timeout: 120000, ...(opts.env ? { env: { ...process.env, ...opts.env } } : {}) })).stdout;
   return {
+    ghCache: (root) => makeGhCache({ root }),
     gh: run("gh"), git: run("git"), docker: run("docker"), killGroup: async (pid, marker) => killLedgerPid(pid, marker), ledger: (opts) => makeLedger(opts), runTmp: makeRunTmp(), host: makeHostProbe(), heavy: makeHeavyIo({ host: makeHostProbe() }), projector: makeProjector({ gh: base.gh }), runner: makeLeanRunner(), waitCiGreen: base.waitCiGreen,
     /** Shared dependency cache (#4220): the repo's own package manager, argv only, bounded by the cache's timeout. */
     deps: makeDepCache({ exec: async (cmd, args, { cwd, env, timeoutMs } = {}) => String((await pexec(cmd, args, { cwd, env: { ...process.env, ...(env ?? {}) }, timeout: timeoutMs ?? 0, maxBuffer: 100 * 1024 * 1024 })).stdout) }),

package/bin/lean/execution.mjs

@@ -411,7 +411,7 @@ export function providerLanes({ provider, laneArgs, ledgerFor, env = process.env
       await tear(led, h); // every path, after the result is in (tear never throws)
       return started ? withUsage(r, h) : r; // a sandbox that never started used nothing
     },
-    adopt: async (n, rec) => {
+    adopt: async (n, rec, ctx = {}) => {
       const saved = rec?.handle;
       if (!saved?.id || saved.provider !== provider.name) return null;
       // Usage runs from the sandbox's real start (persisted on the handle), not from this adopt.
@@ -420,7 +420,9 @@ export function providerLanes({ provider, laneArgs, ledgerFor, env = process.env
       led?.register("sandbox", h.id, { provider: provider.name, handle: { provider: h.provider, id: h.id, issue: h.issue, ...(Number.isFinite(h.startedAt) ? { startedAt: h.startedAt } : {}) } }); // now owned by this dispatcher
       let r;
       try {
-        r = !(await provider.fetchResult(h)) && (await provider.status(h)) !== "running" ? null : await wait(h); // null: relaunched
+        const ended = await provider.fetchResult(h);
+        if (!ended && (await provider.status(h)) !== "running") r = null; // relaunched
+        else { if (!ended) ctx.onLive?.(); r = await wait(h); } // #4504: a live sandbox is awaited in the background
       } catch (e) {
         r = { terminalReason: "engine-error", detail: `sandbox ${h.id}: ${errText(e)}` };
       }

package/bin/lean/lean.mjs

@@ -25,7 +25,7 @@ import { prepareToolchain } from "./toolchain.mjs";
 import { toolStats } from "./toolstats.mjs";
 import { readTestMap, readTestMapAtRef, factsPath, TEST_MAP_FILE } from "./testmap.mjs";
 import { runChecks, planPrecheck, worktreeFingerprint, selfCheckState, quietFailure, CHECK_PLAN_FILE, SELF_CHECK_FILE, CHECK_LOG_DIR } from "./precheck.mjs";
-import { retrying, PUSH_TRANSIENT_RE, PUSH_PERMANENT_RE, GH_TRANSIENT_RE, MERGE_TRANSIENT_RE, MERGE_CONFLICT_RE } from "./retry.mjs";
+import { retrying, ghCacheRetry, PUSH_TRANSIENT_RE, PUSH_PERMANENT_RE, GH_TRANSIENT_RE, MERGE_TRANSIENT_RE, MERGE_CONFLICT_RE } from "./retry.mjs";
 import { renderInvestigation, renderImplementation, renderReview, renderPrBody, renderTrajectory, renderContract, renderAmendments, renderShadowReview, parseContractComment, contractJson, capComment, sanitizeMd, MAX_COMMENT_CHARS, recoveryEvidence } from "./render.mjs";
 import { parseVerifierConfig, pickVerifierModel, changedSymbols, callersOf, verifierBudget, verifierPrompt, parseVerifierFindings, findingsToFailures, renderVerifierNote, VERIFIER_SYSTEM } from "./verifier.mjs";
 import { computeTrigger, riskPathHits, TRIGGER_MODES } from "./review-trigger.mjs";
@@ -216,10 +216,11 @@ export async function runCore(o) {
 
   const ev = (e) => appendEvent(dir, issue, e, { repo }); // #4432: the run log is keyed by repo + issue
   const emit = async (rec) => { try { await emitTelemetry?.({ ...rec, issue }); } catch { /* never fails a run */ } };
-  const ghc = (args) => io.gh(args);
+  let ghCache = null; // #4507: the run's own gh HTTP cache (set once the run tmp dir exists)
+  const ghc = (args) => ghCacheRetry((env) => io.gh(args, env ? { env } : undefined), ghCache);
   const sleepFn = io.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   /** gh writes (comment, pr create, issue edit/close): retried for 5xx and secondary rate limits (#4114). */
-  const ghw = (args) => retrying(() => io.gh(args), { transient: GH_TRANSIENT_RE, attempts: 4, sleep: sleepFn, random });
+  const ghw = (args) => retrying(() => ghc(args), { transient: GH_TRANSIENT_RE, attempts: 4, sleep: sleepFn, random });
   const git = (args) => io.git(args, { cwd: wt });
 
   const builderTriggers = []; // #4362: implement-attempt triggers in order, for the lane's first-pass flag
@@ -327,6 +328,7 @@ export async function runCore(o) {
     }
     // Never discard work silently: an unmerged lane commits and pushes what is left before its worktree goes.
     const saved = !wtCreated || reason === "merged" || (await checkpoint(`exit (${reason})`));
+    try { ghCache?.dispose?.(); } catch { /* best effort */ }
     if (runTmp) {
       try { if ((await io.runTmp.remove(runTmp)) !== false) ledgerDo((l) => l.release("tmp", runTmp)); } catch { /* best effort */ }
       runTmp = null;
@@ -890,6 +892,7 @@ export async function runCore(o) {
     try { runTmp = await io.runTmp.make(issue, runId); } catch { runTmp = null; }
     if (runTmp && runTmp !== planned) ledgerDo((l) => l.register("tmp", runTmp));
   }
+  ghCache = io.ghCache?.(runTmp) ?? null;
   ev({ event: "RUN_START", run: `core_${issue}_${t0}`, issue, lane, path: "core", version: ENGINE_VERSION, forge_version: ENGINE_VERSION, repo });
   try {
     iss = JSON.parse(await ghc(["issue", "view", String(issue), "-R", repo, "--json", "number,title,body,state,comments,labels,updatedAt"]));
@@ -2133,6 +2136,10 @@ export async function runCore(o) {
       }
       return "unknown";
     };
+    /** #4507: true only when the PR reads MERGED; unreadable counts as not merged. */
+    const prMerged = async () => {
+      try { return String(JSON.parse(String(await ghc(["pr", "view", String(pr), "-R", repo, "--json", "state"])) || "{}").state ?? "").toUpperCase() === "MERGED"; } catch { return false; }
+    };
     /** #4158: MERGEABLE but BLOCKED is a base branch policy block (ruleset / required checks pending), not a conflict. */
     const policyBlocked = async () => {
       let j;
@@ -2424,6 +2431,12 @@ export async function runCore(o) {
         break;
       } catch (e) {
         const msg = `${e?.stderr ?? ""}${e?.message ?? ""}`;
+        if (await prMerged()) { // #4507: the merge went through despite the error
+          T.decisions.push(`gh pr merge errored but PR #${pr} is MERGED: recorded merged (${msg.split("\n")[0].slice(0, 120)})`);
+          try { seqLease?.release(); } catch { /* fail-open */ }
+          seqLease = null;
+          break;
+        }
         if (MERGE_TRANSIENT_RE.test(msg) && !/not mergeable|merge conflict/i.test(msg)) {
           // "Base branch was modified", GraphQL and 5xx are transient: back off, then the loop top re-reads mergeable and the head.
           if (++mergeRetries > maxMergeRetries) return await finish("deferred", `gh pr merge kept failing transiently (${mergeRetries - 1} retries): ${msg.slice(0, 300)}`, { pr, code: OUTCOME_CODES.MERGE_TRANSIENT }, OUTCOME_CODES.MERGE_TRANSIENT);

package/bin/lean/lean.test.mjs

@@ -19,8 +19,8 @@ import { mapRecord } from "../engine/telemetry-seam.mjs";
 import { readLog as readRepoLog } from "../engine/runlog.mjs";
 // #4432: the run log is keyed by repo + issue; every lane in this file runs in repo o/r.
 const readLog = (dir, issue, repo = "o/r") => readRepoLog(dir, issue, { repo });
-import { makeRunTmp, wrapLaneLimits, systemdRunAvailable, makeLeanRunner, requiredChecksFor, procsInDir, makeLeanIo } from "./effects.mjs";
-import { retrying, PUSH_TRANSIENT_RE } from "./retry.mjs";
+import { makeRunTmp, wrapLaneLimits, systemdRunAvailable, makeLeanRunner, requiredChecksFor, procsInDir, makeLeanIo, makeGhCache } from "./effects.mjs";
+import { retrying, ghCacheRetry, PUSH_TRANSIENT_RE } from "./retry.mjs";
 import { checkAdmission, hostParallelism } from "./admission.mjs";
 import { OUTCOME_CODES, classifyNeedsHuman } from "../engine/outcome-codes.mjs";
 import * as refactorMod from "./refactor.mjs";
@@ -73,8 +73,10 @@ function world(o = {}) {
   w.writeStages = writeStages;
   w.io = {
     now: () => w.clock, sleep: async (ms) => { w.clock += ms; },
-    gh: async (a) => {
+    gh: async (a, opts) => {
       const k = a.slice(0, 2).join(" ");
+      if (opts?.env) (w.ghEnvs ??= []).push(opts.env);
+      if (k === "pr view" && a.at(-1) === "state" && a.at(-2) === "--json") return JSON.stringify({ state: o.prState ?? "OPEN" });
       if (a[0] === "api" && a.includes("PATCH")) { w.patches.push(a); return "{}"; }
       if (a[0] === "api") return a.some((x) => /\/comments$/.test(x)) ? (w.issueComments ?? []).map((c) => JSON.stringify(c)).join("\n") : "";
       if (k === "pr list") return JSON.stringify(w.prList);
@@ -2146,6 +2148,17 @@ describe("orchestrate", () => {
     assert.deepEqual(parseDeps("This is blocked by #2 and depends on #4\nsee **Depends on**: #5", 1), []);
   });
 
+  it("#4506 parseDeps reads every #N to the end of a declaration line", () => {
+    assert.deepEqual(parseDeps("Depends on #36648 (action results must reach …) and #36649 (the included action budget …)", 1), [36648, 36649]);
+    assert.deepEqual(parseDeps("Depends on #36651 (executor test harness) and #36648.", 1), [36651, 36648]);
+    assert.deepEqual(parseDeps("**Depends on** #2, #3 and #4", 1), [2, 3, 4]);
+    assert.deepEqual(parseDeps("__Depends on__: #5 (x) and #6", 1), [5, 6]);
+    assert.deepEqual(parseDeps("**Blocked by:** #7 (why) & #8", 1), [7, 8]);
+    assert.deepEqual(parseDeps("- depends on: #9 (a), #10", 1), [9, 10]);
+    assert.deepEqual(parseDeps("Depends on #11 and other/repo#12", 1), [11]);
+    assert.deepEqual(parseDeps("This is blocked by #2 and depends on #4", 1), []);
+  });
+
   it("runs at most K at once", async () => {
     const h = harness({});
     const rows = await orchestrate({ issues: [1, 2, 3, 4, 5, 6], parallel: 2, ...h });
@@ -3222,6 +3235,78 @@ describe("batch robustness (#4112-#4115)", () => {
     assert.ok(w.comments.some((c) => c.includes("FORGE:BASE_SYNC")));
   });
 
+  // ---- #4507 ----
+  const CORRUPT = "invalid character '{' looking for beginning of object key string";
+  it("#4507 a gh JSON parse error at merge (corrupt gh cache) is retried and ends merged", async () => {
+    const w = world({ mergeErrors: [CORRUPT] });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "merged");
+    assert.equal(w.mergeAttempts, 2);
+    assert.equal(w.merges.length, 1);
+  });
+
+  it("#4507 a merge error on a PR that is already MERGED records merged, not engine-error", async () => {
+    const w = world({ mergeErrors: ["GraphQL: validation failed (422)"], prState: "MERGED" });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "merged");
+    assert.equal(w.mergeAttempts, 1);
+    assert.equal(w.closed.length, 1);
+    assert.ok(traj(w)[0].includes("is MERGED: recorded merged"));
+  });
+
+  it("#4507 a persistent gh parse error at merge ends deferred merge.transient, never engine-error", async () => {
+    const w = world({ mergeErrors: Array(40).fill(CORRUPT) });
+    const r = await run(w, { maxMergeRetries: 2 });
+    assert.equal(r.terminalReason, "deferred"); assert.equal(r.code, "merge.transient");
+    assert.equal(w.mergeAttempts, 6, "each merge attempt is retried once with a fresh cache");
+  });
+
+  it("#4507 with io.ghCache every engine gh call carries the run's own XDG_CACHE_HOME", async () => {
+    const w = world();
+    w.io.runTmp = { prune: async () => {}, make: async (_i, id) => `/rt/${id}`, remove: async () => true };
+    let made = null, disposed = 0;
+    w.io.ghCache = (root) => { made = root; return { env: () => ({ XDG_CACHE_HOME: `${root}/gh-cache` }), reset() {}, dispose() { disposed++; } }; };
+    assert.equal((await run(w)).terminalReason, "merged");
+    assert.match(made, /^\/rt\//);
+    assert.ok(w.ghEnvs.length > 0 && w.ghEnvs.every((e) => e.XDG_CACHE_HOME === `${made}/gh-cache`));
+    assert.equal(disposed, 1);
+  });
+
+  it("#4507 ghCacheRetry retries exactly once on a parse error and rethrows other errors untouched", async () => {
+    let n = 0, resets = 0;
+    const cache = { env: () => ({ XDG_CACHE_HOME: `/c${resets}` }), reset: () => { resets++; } };
+    const seen = [];
+    assert.equal(await ghCacheRetry(async (env) => { seen.push(env.XDG_CACHE_HOME); if (n++ === 0) throw new Error(CORRUPT); return "ok"; }, cache), "ok");
+    assert.deepEqual(seen, ["/c0", "/c1"]); assert.equal(resets, 1);
+    n = 0;
+    await assert.rejects(ghCacheRetry(async () => { n++; throw new Error(CORRUPT); }, null), /invalid character/);
+    assert.equal(n, 2);
+    n = 0;
+    const other = new Error("HTTP 404: Not Found");
+    await assert.rejects(ghCacheRetry(async () => { n++; throw other; }, cache), (e) => e === other);
+    assert.equal(n, 1);
+  });
+
+  it("#4507 makeGhCache: a per-root cache dir, reset swaps in a fresh dir, the no-root fallback is disposed", () => {
+    const root = tmpDir("ghcache-");
+    const c = makeGhCache({ root });
+    const first = c.env().XDG_CACHE_HOME;
+    assert.equal(first, join(root, "gh-cache")); assert.ok(existsSync(first));
+    c.reset();
+    const second = c.env().XDG_CACHE_HOME;
+    assert.notEqual(second, first); assert.ok(existsSync(second)); assert.ok(!existsSync(first));
+    const tmp = tmpDir("ghcache-tmp-");
+    const f = makeGhCache({ tmp });
+    assert.equal(f.env(), undefined);
+    f.reset();
+    const fb = f.env().XDG_CACHE_HOME;
+    assert.ok(fb.startsWith(join(tmp, "forge-gh-cache-")) && existsSync(fb));
+    f.dispose();
+    assert.ok(!existsSync(fb));
+    c.dispose();
+    assert.ok(!existsSync(second)); assert.equal(c.env(), undefined, "no dir is re-created after the run tears down");
+  });
+
   // ---- #4114 ----
   it("#4114 a push failing once with 'remote unpack failed' then succeeding completes the run", async () => {
     const w = world({ pushErrors: ["error: remote unpack failed: unable to create temporary object directory"] });

package/bin/lean/orchestrate.mjs

@@ -14,7 +14,9 @@
  * lane is refused ends `lane-refused` without a run, and a dependency edge between two lanes goes to `onCrossLane`.
  *
  * Durable batch runner (#4121): with a `store` every transition is persisted, so a restarted dispatcher continues the
- * batch; lanes it launched that are still alive are re-attached through `adopt(issue, rec)` instead of relaunched.
+ * batch; lanes it launched that are still alive are re-attached through `adopt(issue, rec, {onLive})` instead of relaunched.
+ * A seam calls `onLive()` before it waits on a live lane (#4504); an adopt that resolves first is settled (or requeued on null)
+ * before scheduling, so a live lane does not hold up the others.
  * `deferred` is a scheduling fact, not an end: each typed code is requeued with its retry-at (`deferPolicy`), a usage
  * limit holds admissions for that account until its reset, and non-host deferrals stop after `maxDeferrals`.
  * Usage-limit holds (#4190) are keyed by backend identity in `limits` (the host store, shared by every batch on the
@@ -666,15 +668,34 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   };
 
   // Lanes launched by an earlier dispatcher: re-attach to the live ones, queue the rest again (no result was recorded).
-  for (const [n, rec] of [...runRecs]) {
-    let p = null;
-    if (adopt && (rec?.pid || rec?.handle)) { try { p = await adopt(n, rec); } catch { p = null; } }
-    if (p && rec.remote) { remoteRun.add(n); track(n, Promise.resolve(p).then((r) => settle(n, r, rec, checked.get(n) ?? null))); }
-    else if (p) {
-      if (reg) { reg.adoptSlot(keyOf(n), { ...entryOf(n), lanePid: rec.pid }); slotted.add(n); }
-      track(n, Promise.resolve(p).then((r) => settle(n, r, rec, checked.get(n) ?? null)));
+  // #4504: every adopt starts at once and races its `onLive` signal, so a live lane never holds up the others: one that
+  // already ended is settled from its result (or requeued without one) before scheduling; a live one is awaited in the background.
+  const requeueLost = (n) => { runRecs.delete(n); if (!pending.includes(n) && !results.has(n)) { pending.unshift(n); enqueued.set(n, now()); } };
+  const adopting = [...runRecs].map(([n, rec]) => {
+    if (!adopt || !(rec?.pid || rec?.handle)) return { n, rec, live: false, p: Promise.resolve(null) };
+    let onLive;
+    const isLive = new Promise((r) => { onLive = () => r(true); });
+    const p = Promise.resolve().then(() => adopt(n, rec, { onLive })).catch(() => null);
+    return { n, rec, p, first: Promise.race([p.then(() => false), isLive]) };
+  });
+  for (const a of adopting) a.live = a.first ? await a.first : false;
+  for (const { n, rec, p, live } of adopting) {
+    if (live) {
+      if (rec.remote) remoteRun.add(n);
+      else if (reg) { reg.adoptSlot(keyOf(n), { ...entryOf(n), lanePid: rec.pid }); slotted.add(n); }
+      track(n, p.then((r) => {
+        if (r) return settle(n, r, rec, checked.get(n) ?? null);
+        if (halted) return; // #4454: kept for the next resume
+        running.delete(n); releaseSlot(n); remoteRun.delete(n); requeueLost(n); save(); // ended without a result after all
+      }));
+      continue;
     }
-    else { runRecs.delete(n); if (!pending.includes(n) && !results.has(n)) { pending.unshift(n); enqueued.set(n, now()); } }
+    const r = await p;
+    if (!r) { requeueLost(n); continue; }
+    if (rec.remote) remoteRun.add(n);
+    else if (reg) { reg.adoptSlot(keyOf(n), { ...entryOf(n), lanePid: rec.pid }); slotted.add(n); } // released by the settle
+    track(n, Promise.resolve(r).then((x) => settle(n, x, rec, checked.get(n) ?? null)));
+    await running.get(n); // settled before scheduling
   }
   // A resume re-derives each unfinished issue's lane from its current milestone (#4153): a re-milestone takes effect.
   if (saved && resolveLane) {

package/bin/lean/retry.mjs

@@ -5,7 +5,9 @@
 export const PUSH_TRANSIENT_RE = /remote unpack failed|index-pack failed|RPC failed|unexpected disconnect|early EOF|the remote end hung up|HTTP\/?\s?5\d\d|returned error: 5\d\d|\b50[0234]\b|internal server error|bad gateway|service unavailable|gateway time-?out|connection (?:reset|timed out|refused)|timed out|could not resolve host|broken pipe|ETIMEDOUT|ECONNRESET|temporarily unavailable|\[remote rejected\][^\n]*\(failed\)|unable to write file|unable to create temporary object|unpacker error|failed to write object/i;
 export const PUSH_PERMANENT_RE = /protected branch|GH006|GH013|repository rule violations|permission (?:denied|to .* denied)|denied to|\b403\b|authentication failed|not allowed|hook declined|pre-receive hook declined|\[rejected\]|non-fast-forward|fetch first/i;
 export const GH_TRANSIENT_RE = /HTTP 5\d\d|\b50[0234]\b|secondary rate limit|rate limit exceeded|abuse detection|something went wrong|internal server error|bad gateway|service unavailable|ETIMEDOUT|ECONNRESET|connection reset|timed out|\bEOF\b|temporarily unavailable/i;
-export const MERGE_TRANSIENT_RE = new RegExp(`${GH_TRANSIENT_RE.source}|base branch was modified|head branch was modified|mergeability.*unknown|try again`, "i");
+/** #4507: gh failing to parse its own input: a torn HTTP cache entry (JSON) or a half-written config (YAML). */
+export const GH_PARSE_RE = /invalid character .{0,40}looking for|unexpected end of JSON input|cannot unmarshal|yaml: line \d+|yaml: unmarshal/i;
+export const MERGE_TRANSIENT_RE = new RegExp(`${GH_TRANSIENT_RE.source}|${GH_PARSE_RE.source}|base branch was modified|head branch was modified|mergeability.*unknown|try again`, "i");
 export const MERGE_CONFLICT_RE = /not mergeable|merge conflict|conflict/i;
 
 export const errText = (e) => `${e?.stderr ?? ""}\n${e?.message ?? ""}\n${e?.stdout ?? ""}`;
@@ -29,3 +31,15 @@ export async function retrying(fn, { transient, permanent = null, attempts = 4,
   last.transientExhausted = true;
   throw last;
 }
+
+/**
+ * #4507: run `call(env)` with the lane's gh cache env; on a gh parse error (corrupt cache) reset the cache and run it
+ * once more. Without a cache it still retries once. Any other error is rethrown unchanged.
+ */
+export async function ghCacheRetry(call, cache) {
+  try { return await call(cache?.env?.()); } catch (e) {
+    if (!GH_PARSE_RE.test(errText(e))) throw e;
+    try { await cache?.reset?.(); } catch { /* retry on the old dir */ }
+    return await call(cache?.env?.());
+  }
+}

package/bin/lean/schedd.mjs

@@ -24,6 +24,9 @@
  * Shutdown (#4454): `close()` aborts every hosted batch's `signal` (its loop admits nothing more and leaves, lanes keep
  * running, no report is written), waits for them up to `stopMs`, and only then releases `schedd.lock` and the socket, so a
  * daemon started next never resumes a batch this one still dispatches. `exitOnSignals` exits 128+signo after that.
+ * Exit reasons (#4503): every exit logs a line: `idle, exiting`, `exiting (<signal>|uncaught: …)`, `lost lock|socket …,
+ * exiting` (checked every `lockCheckMs`: the lock no longer holds this pid, or the socket is gone; nothing it does not own
+ * is removed), then `exited (code N)`. Taking over a dead owner's lock is logged, so a SIGKILLed daemon leaves a trace.
  * `runBatch({argv, cwd, env, sink, keepBreaker, signal})` is injected (engine-cli `runBatch`); `sink` gets `batch(b)`, `row(r)`, `line(text)`.
  */
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, writeSync } from "node:fs";
@@ -35,6 +38,7 @@ import { batchRoot, listBatches, openBatch } from "./batch.mjs";
 
 export const IDLE_MS = 10 * 60 * 1000;
 export const STOP_MS = 10 * 1000;
+export const LOCK_CHECK_MS = 5 * 1000;
 
 export function scheddPaths(dir = schedDir()) {
   return { dir, sock: join(dir, "schedd.sock"), lock: join(dir, "schedd.lock"), log: join(dir, "schedd.log") };
@@ -54,17 +58,19 @@ export function mergeEnv(base, kept) {
   return { ...out, ...kept };
 }
 
-/** Take the daemon lock; null when another live daemon holds it. */
+/** Take the daemon lock: `{took}` (the dead owner's pid it replaced, or null); null when another live daemon holds it. */
 function takeLock(lock, pid, alive) {
+  let took = null;
   for (let i = 0; i < 5; i++) {
     try {
       const fd = openSync(lock, "wx");
       try { writeSync(fd, String(pid)); } finally { closeSync(fd); }
-      return true;
+      return { took };
     } catch (e) { if (e?.code !== "EEXIST") throw e; }
     let owner = NaN;
     try { owner = parseInt(readFileSync(lock, "utf8"), 10); } catch { continue; }
     if (Number.isInteger(owner) && owner !== pid && alive(owner)) return null;
+    if (Number.isInteger(owner) && owner !== pid) took = owner;
     rmSync(lock, { force: true });
   }
   return null;
@@ -74,10 +80,13 @@ function takeLock(lock, pid, alive) {
  * Start the daemon. @returns {Promise<{running:true, pid, close, closed:Promise} | {running:false, owner:number}>}
  */
 export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(process.env.FORGEDOCK_SCHEDD_IDLE_MS) || IDLE_MS,
-  root = batchRoot(), log = (m) => console.log(m), pid = process.pid, alive = pidAlive, resumeOnStart = true, stopMs = STOP_MS } = {}) {
+  root = batchRoot(), log = (m) => console.log(m), pid = process.pid, alive = pidAlive, resumeOnStart = true, stopMs = STOP_MS,
+  lockCheckMs = LOCK_CHECK_MS } = {}) {
   const p = scheddPaths(dir);
   mkdirSync(dir, { recursive: true });
-  if (!takeLock(p.lock, pid, alive)) {
+  const lock = takeLock(p.lock, pid, alive);
+  if (lock?.took) log(`schedd: took over the lock of dead pid ${lock.took} (it exited without a clean shutdown)`);
+  if (!lock) {
     let owner = NaN;
     try { owner = parseInt(readFileSync(p.lock, "utf8"), 10); } catch { /* gone */ }
     log(`schedd: already running (pid ${owner})`);
@@ -88,7 +97,8 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
   const hosted = new Map(); // batch id -> {id, dir, subs:Set<fn>}
   const conns = new Set();
   const runs = new Map(); // every runBatch in flight (hosted or not yet started) -> its AbortController (#4454)
-  let closing = null, resolveClosed;
+  const starting = new Map(); // batch id -> host() promise of a start-up resume not yet hosted (#4503: an attach waits for it)
+  let closing = null, resolveClosed, keepSock = false;
   let lastActive = Date.now();
   const touch = () => { lastActive = Date.now(); };
 
@@ -143,6 +153,7 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
       return send({ type: "batch", id: ent.id, dir: ent.dir });
     }
     if (req.op === "attach") {
+      if (!hosted.has(req.id) && starting.has(req.id)) await starting.get(req.id).catch(() => {});
       const live = hosted.get(req.id);
       if (live) {
         // Synchronous read + subscribe: no row is lost or doubled between the replay and the live stream.
@@ -191,6 +202,7 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
   const close = () => {
     if (closing) return closing;
     clearInterval(idleTimer);
+    clearInterval(lockTimer);
     for (const c of conns) c.destroy();
     const stopping = [...runs.keys()];
     for (const ac of runs.values()) ac.abort();
@@ -198,9 +210,11 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
     // #4454: the lock goes only once every hosted batch loop has stopped (or `stopMs` passed: the caller exits regardless)
     const stopped = stopping.length ? Promise.race([Promise.allSettled(stopping).then(() => true), new Promise((r) => { timer = setTimeout(() => r(false), stopMs); })])
       .then((ok) => { clearTimeout(timer); if (!ok) log(`schedd: ${runs.size} batch(es) did not stop within ${stopMs} ms`); }) : Promise.resolve();
-    closing = Promise.all([new Promise((r) => server.close(() => r())), stopped]).then(() => {
+    // A lost lock: the socket path may be the successor's, and closing the server unlinks it (libuv), so leave it unref'd.
+    const serverClosed = keepSock ? Promise.resolve(server.unref()) : new Promise((r) => server.close(() => r()));
+    closing = Promise.all([serverClosed, stopped]).then(() => {
       try { if (parseInt(readFileSync(p.lock, "utf8"), 10) === pid) rmSync(p.lock, { force: true }); } catch { /* gone */ }
-      rmSync(p.sock, { force: true });
+      if (!keepSock) rmSync(p.sock, { force: true });
       resolveClosed();
     });
     return closing;
@@ -209,6 +223,15 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
     if (!hosted.size && !conns.size && Date.now() - lastActive >= idleMs) { log("schedd: idle, exiting"); close(); }
   }, Math.min(idleMs, 30_000));
   idleTimer.unref?.();
+  // #4503: a daemon whose lock or socket was taken stops (its batches stay resumable) instead of running unreachable.
+  const lockTimer = setInterval(() => {
+    if (closing) return;
+    let owner = NaN;
+    try { owner = parseInt(readFileSync(p.lock, "utf8"), 10); } catch { /* gone */ }
+    if (owner !== pid) { keepSock = true; log(`schedd: lost lock (owner ${Number.isInteger(owner) ? `pid ${owner}` : "none"}), exiting`); close(); }
+    else if (!existsSync(p.sock)) { log(`schedd: lost socket ${p.sock}, exiting`); close(); }
+  }, lockCheckMs);
+  lockTimer.unref?.();
 
   // Daemon restart: resume every daemon-hosted batch that never wrote its report; live lanes are re-adopted.
   if (resumeOnStart) {
@@ -216,22 +239,35 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
       const b = openBatch(root, id);
       if (!b.readPlan()?.daemon || b.readReport()) continue;
       log(`schedd: resuming batch ${id}`);
-      host({ argv: ["--resume", id], cwd: process.cwd(), env: {}, keepBreaker: true }).catch((e) => log(`schedd: resume ${id} failed: ${e?.message ?? e}`));
+      const started = host({ argv: ["--resume", id], cwd: process.cwd(), env: {}, keepBreaker: true });
+      starting.set(id, started);
+      started.catch((e) => log(`schedd: resume ${id} failed: ${e?.message ?? e}`)).finally(() => starting.delete(id));
     }
   }
   return { running: true, pid, sock: p.sock, close, closed };
 }
 
-/** #4454: on SIGTERM/SIGINT stop the daemon (`close()`: batch loops first, then lock and socket), then exit 128+signo, once. */
-export function exitOnSignals(d, { on = (s, f) => process.once(s, f), exit = (c) => process.exit(c), signals = ["SIGTERM", "SIGINT"] } = {}) {
-  const SIGNO = { SIGINT: 2, SIGTERM: 15 };
+/**
+ * #4454: on SIGTERM/SIGINT/SIGHUP stop the daemon (`close()`: batch loops first, then lock and socket), then exit 128+signo,
+ * once; an uncaught exception or unhandled rejection does the same and exits 1. #4503: each logs its reason first, and the
+ * process `exit` logs `schedd: exited (code N)`.
+ */
+export function exitOnSignals(d, { on = (s, f) => (s.startsWith("SIG") || s === "exit" ? process.once(s, f) : process.on(s, f)),
+  exit = (c) => process.exit(c), log = (m) => console.log(m), signals = ["SIGTERM", "SIGINT", "SIGHUP"] } = {}) {
+  const SIGNO = { SIGHUP: 1, SIGINT: 2, SIGTERM: 15 };
   let fired = false;
-  for (const sig of signals) on(sig, async () => {
+  const stop = async (reason, code, detail = null) => {
     if (fired) return;
     fired = true;
+    log(`schedd: exiting (${reason})`);
+    if (detail) log(detail);
     try { await d.close(); } catch { /* exit anyway */ }
-    exit(128 + (SIGNO[sig] ?? 0));
-  });
+    exit(code);
+  };
+  for (const sig of signals) on(sig, () => stop(sig, 128 + (SIGNO[sig] ?? 0)));
+  on("uncaughtException", (e) => stop(`uncaught: ${String(e?.message ?? e).split("\n")[0]}`, 1, e?.stack ?? null));
+  on("unhandledRejection", (e) => stop(`unhandled rejection: ${String(e?.message ?? e).split("\n")[0]}`, 1, e?.stack ?? null));
+  on("exit", (code) => log(`schedd: exited (code ${code})`));
 }
 
 /** Connect to the daemon, spawning it (`spawnDaemon()`) when nobody listens. @returns {Promise<import("node:net").Socket>} */

package/bin/lean/schedd.test.mjs

@@ -3,14 +3,23 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { openBatch, isLaneAlive, listBatches } from "./batch.mjs";
-import { startDaemon, scheddPaths, connectDaemon, request, mergeEnv, batchEnv } from "./schedd.mjs";
+import { startDaemon, scheddPaths, connectDaemon, request, mergeEnv, batchEnv, exitOnSignals } from "./schedd.mjs";
+import { schedDir } from "./sched.mjs";
 import { formatTable, orchestrate } from "./orchestrate.mjs";
 import { orchestrateFromCli } from "../engine-cli.mjs";
 
+// #4503: this process, and the env its clients submit for their lanes, never resolve the host's `~/.forge/sched`.
+process.env.FORGEDOCK_SCHED_DIR = tmpDir("schedd-home-");
+// Stub lanes run detached: a host whose test never reached its `finally` still has them reaped when the file ends.
+const hosts = [];
+process.on("exit", () => { for (const h of hosts) h.reap(); });
+const LANE_MAX_MS = 120_000;
+
 const until = async (cond, ms = 15000) => {
   const end = Date.now() + ms;
   while (!cond()) { if (Date.now() > end) throw new Error("timed out waiting"); await new Promise((r) => setTimeout(r, 25)); }
@@ -24,13 +33,20 @@ const capture = async (fn) => {
 /** A host: sched + batch dirs, a stub lane that waits for `release`, and a daemon script with injected lanes. */
 function host() {
   const work = tmpDir("schedd-");
-  const h = { work, sched: join(work, "s"), root: join(work, "batches"), launches: join(work, "launches"), release: join(work, "release"), procs: [] };
+  const h = { work, sched: join(work, "s"), root: join(work, "batches"), launches: join(work, "launches"), release: join(work, "release"), procs: [],
+    lanePidFile: join(work, "lane-pids"), log: join(work, "schedd.log") };
   writeFileSync(h.launches, "");
+  writeFileSync(h.lanePidFile, "");
+  hosts.push(h);
   const stub = join(work, "stub-lane.mjs");
   writeFileSync(stub, `import { appendFileSync, existsSync, writeFileSync, renameSync } from "node:fs";
 const a = process.argv.slice(2); const n = Number(a[1]); const rf = a[a.indexOf("--result-file") + 1];
 appendFileSync(${JSON.stringify(h.launches)}, n + "\\n");
-const t = setInterval(() => { if (!existsSync(${JSON.stringify(h.release)})) return; clearInterval(t);
+appendFileSync(${JSON.stringify(h.lanePidFile)}, process.pid + "\\n");
+// #4503: a stub whose test run is gone (work dir removed) or that outlived its bound exits instead of polling forever.
+const born = Date.now();
+const t = setInterval(() => { if (!existsSync(${JSON.stringify(work)}) || Date.now() - born > ${LANE_MAX_MS}) process.exit(0);
+  if (!existsSync(${JSON.stringify(h.release)})) return; clearInterval(t);
   writeFileSync(rf + ".tmp", JSON.stringify({ terminalReason: "merged", pr: 100 + n, cost_usd: 0 })); renameSync(rf + ".tmp", rf); }, 20);
 // Like run-issue's #4179 teardown: SIGTERM reports deferred run.interrupted.
 process.once("SIGTERM", () => { writeFileSync(rf + ".tmp", JSON.stringify({ terminalReason: "deferred", code: "run.interrupted", detail: "interrupted by SIGTERM" })); renameSync(rf + ".tmp", rf); process.exit(143); });
@@ -49,7 +65,9 @@ await d.closed;
   h.env = { ...process.env, FORGEDOCK_SCHED_DIR: h.sched, FORGEDOCK_BATCH_DIR: h.root, FORGEDOCK_LIMITS_FILE: join(work, "limits.json") };
   h.daemon = async () => {
     const before = existsSync(scheddPaths(h.sched).lock) ? readFileSync(scheddPaths(h.sched).lock, "utf8") : null;
-    const child = spawn(process.execPath, [h.daemonScript], { env: h.env, stdio: "ignore" });
+    const out = openSync(h.log, "a");
+    let child;
+    try { child = spawn(process.execPath, [h.daemonScript], { env: h.env, stdio: ["ignore", out, out] }); } finally { closeSync(out); }
     h.procs.push(child);
     await until(() => existsSync(scheddPaths(h.sched).sock) && existsSync(scheddPaths(h.sched).lock) && readFileSync(scheddPaths(h.sched).lock, "utf8") === String(child.pid) && readFileSync(scheddPaths(h.sched).lock, "utf8") !== before);
     // Wait for the socket to accept.
@@ -59,9 +77,15 @@ await d.closed;
   h.client = { scheddDir: h.sched, spawnDaemon: null };
   h.launched = () => readFileSync(h.launches, "utf8").trim().split("\n").filter(Boolean).map(Number).sort();
   h.lanePids = () => listBatches(h.root).flatMap((id) => Object.values(openBatch(h.root, id).store.load()?.running ?? {}).map((r) => r.pid).filter(Boolean));
-  h.cleanup = () => {
-    writeFileSync(h.release, "");
+  h.stubPids = () => (existsSync(h.lanePidFile) ? readFileSync(h.lanePidFile, "utf8").trim().split("\n").filter(Boolean).map(Number) : []);
+  h.reap = () => {
     for (const p of h.procs) { try { p.kill("SIGKILL"); } catch { /* gone */ } }
+    for (const pid of h.stubPids()) { try { process.kill(pid, "SIGKILL"); } catch { /* gone */ } }
+  };
+  h.cleanup = async () => {
+    if (existsSync(h.work)) writeFileSync(h.release, "");
+    h.reap();
+    await until(() => h.stubPids().every((pid) => !isLaneAlive(pid, null)), 5000).catch(() => {});
   };
   return h;
 }
@@ -98,7 +122,7 @@ describe("schedd host scheduler (#4192)", () => {
       const id = done[0].batch;
       await withRoot(h, () => capture(() => orchestrateFromCli(["--set-parallel", id, "5"], h.client)));
       assert.equal(openBatch(h.root, id).readParallel(), 5);
-    } finally { h.cleanup(); }
+    } finally { await h.cleanup(); }
   });
 
   it("a client that disconnects does not stop the batch; --resume reattaches, and replays the report once done", async () => {
@@ -127,7 +151,7 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
       assert.deepEqual(again.res.rows, res.rows);
       assert.ok(again.lines.join("\n").includes(formatTable(res.rows)));
       assert.deepEqual(h.launched(), [1, 2]);
-    } finally { h.cleanup(); }
+    } finally { await h.cleanup(); }
   });
 
   it("a daemon restart resumes the batch from state and re-adopts its live lanes without duplicate launches", async () => {
@@ -150,7 +174,7 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
       assert.deepEqual(res.rows.map((r) => [r.issue, r.outcome, r.pr]), [[1, "merged", 101], [2, "merged", 102], [3, "merged", 103]]);
       assert.deepEqual(h.launched(), [1, 2, 3], "adopted, not relaunched");
       assert.deepEqual(openBatch(h.root, id).store.load().running, {});
-    } finally { h.cleanup(); }
+    } finally { await h.cleanup(); }
   });
 
   it("#4408: --add and --resume <id> N add issues to the live batch (no second batch); an unhosted finished batch runs its adds on --resume", async () => {
@@ -181,7 +205,7 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
       }));
       assert.equal(res.rows.length, 3);
       assert.deepEqual(h.launched(), [1, 2, 4, 6], "each issue launched once");
-    } finally { h.cleanup(); }
+    } finally { await h.cleanup(); }
   });
 
   it("#4376: --cancel stops one batch (its lane torn down, the rest held, report written); the other batch and the daemon run on", async () => {
@@ -211,7 +235,7 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
         assert.equal(again.cancelled, false, "a finished batch is left alone");
         await assert.rejects(orchestrateFromCli(["--cancel", "nope"], h.client), /no batch nope/);
       }));
-    } finally { h.cleanup(); }
+    } finally { await h.cleanup(); }
   });
 
   it("#4481: a batch cancelled through the daemon is not resumed by a schedd restart", async () => {
@@ -232,7 +256,7 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
         assert.deepEqual(await statusIds(), [], "the restarted daemon hosts no cancelled batch");
         assert.deepEqual(h.launched(), [1]);
       }));
-    } finally { h.cleanup(); }
+    } finally { await h.cleanup(); }
   });
 
   it("single instance: a live daemon keeps its lock; a dead owner's lock and socket are taken over", async () => {
@@ -252,7 +276,7 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
         assert.equal(st.pid, process.pid);
       } finally { await third.close(); }
       assert.equal(existsSync(scheddPaths(h.sched).lock), false, "lock released on close");
-    } finally { h.cleanup(); }
+    } finally { await h.cleanup(); }
   });
 
   it("#4454: close() stops every hosted batch loop before releasing the lock; no batch admits a lane after close()", async () => {
@@ -309,11 +333,12 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
     const h = host();
     try {
       const d1 = await h.daemon();
-      await withRoot(h, () => capture(async () => {
-        const a = orchestrateFromCli(["1", "2", "--parallel", "1", "--repo", "o/r", "--no-prefilter"], h.client).then(() => null, (e) => e);
+      const { lines } = await withRoot(h, () => capture(async () => {
+        // #4503: a gives up at once (reconnectMs 0) with the resume hint; b re-attaches to the next daemon on its own.
+        const a = orchestrateFromCli(["1", "2", "--parallel", "1", "--repo", "o/r", "--no-prefilter"], { ...h.client, reconnectMs: 0 }).then(() => null, (e) => e);
         await until(() => h.launched().length === 1 && h.lanePids().length === 1);
         const [idA] = listBatches(h.root);
-        const b = orchestrateFromCli(["5", "--parallel", "1", "--repo", "o/r", "--no-prefilter"], h.client).then(() => null, (e) => e);
+        const b = orchestrateFromCli(["5", "--parallel", "1", "--repo", "o/r", "--no-prefilter"], h.client);
         await until(() => h.launched().includes(5) && h.lanePids().length === 2);
         const idB = listBatches(h.root).find((x) => x !== idA);
         const lanes = h.lanePids();
@@ -327,15 +352,102 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
         assert.equal(openBatch(h.root, idA).readReport(), null, "a stopped batch writes no report");
         assert.equal(openBatch(h.root, idB).readReport(), null);
         assert.match(String((await a)?.message), /--resume/);
-        await b;
         await h.daemon(); // resumes both batches
-        const ra = orchestrateFromCli(["--resume", idA], h.client), rb = orchestrateFromCli(["--resume", idB], h.client);
+        const ra = orchestrateFromCli(["--resume", idA], h.client);
         setTimeout(() => writeFileSync(h.release, ""), 200);
         assert.deepEqual((await ra).rows.map((r) => [r.issue, r.outcome]), [[1, "merged"], [2, "merged"]]);
-        assert.deepEqual((await rb).rows.map((r) => [r.issue, r.outcome]), [[5, "merged"]]);
+        assert.deepEqual((await b).rows.map((r) => [r.issue, r.outcome]), [[5, "merged"]], "b re-attached and finished");
         assert.deepEqual(h.launched(), [1, 2, 5], "adopted, not relaunched");
       }));
-    } finally { h.cleanup(); }
+      assert.ok(lines.some((l) => l.startsWith("schedd connection lost; reconnecting to batch ")), "the client said it reconnects");
+      const log = readFileSync(h.log, "utf8");
+      assert.match(log, /^schedd: exiting \(SIGTERM\)$/m);
+      assert.match(log, /^schedd: exited \(code 143\)$/m);
+    } finally { await h.cleanup(); }
+  });
+
+  it("#4503: every schedd exit writes a reason line", async () => {
+    for (const [ev, arg, code, re] of [["SIGTERM", undefined, 143, /^schedd: exiting \(SIGTERM\)$/], ["SIGINT", undefined, 130, /^schedd: exiting \(SIGINT\)$/],
+      ["SIGHUP", undefined, 129, /^schedd: exiting \(SIGHUP\)$/], ["uncaughtException", new Error("boom\nmore"), 1, /^schedd: exiting \(uncaught: boom\)$/],
+      ["unhandledRejection", new Error("nope"), 1, /^schedd: exiting \(unhandled rejection: nope\)$/]]) {
+      const handlers = {}, lines = [], exits = [];
+      exitOnSignals({ close: async () => { lines.push("closed"); } }, { on: (s, f) => { handlers[s] = f; }, exit: (c) => exits.push(c), log: (m) => lines.push(m) });
+      await handlers[ev](arg);
+      assert.match(lines[0], re, `${ev}: the reason is logged before close()`);
+      assert.equal(lines.at(-1), "closed");
+      assert.deepEqual(exits, [code]);
+      handlers.exit(code);
+      assert.equal(lines.at(-1), `schedd: exited (code ${code})`);
+    }
+    const dir = tmpDir("schedd-idle-"), lines = [];
+    const d = await startDaemon({ dir, root: join(dir, "batches"), runBatch: async () => ({}), log: (m) => lines.push(m), resumeOnStart: false, idleMs: 50 });
+    await d.closed;
+    assert.ok(lines.includes("schedd: idle, exiting"));
+  });
+
+  it("#4503: a daemon that lost its lock or socket logs it and stops its batches resumable, never removing the successor's lock or socket; a dead owner's takeover is logged", async () => {
+    const dir = tmpDir("schedd-lost-"), p = scheddPaths(dir), root = join(dir, "batches"), lines = [];
+    let stopped = false;
+    const d = await startDaemon({ dir, root, log: (m) => lines.push(m), resumeOnStart: false, lockCheckMs: 30,
+      runBatch: ({ sink, signal }) => { sink.batch({ id: "x", dir }); return new Promise((_, rej) => signal.addEventListener("abort", () => { stopped = true; rej(Object.assign(new Error("stopped"), { code: "batch.stopped" })); })); } });
+    request(await connectDaemon({ dir, spawnDaemon: null }), { op: "submit", argv: ["x"], cwd: dir, env: {} }).catch(() => {});
+    await until(() => lines.some((l) => l.includes("listening")));
+    await new Promise((r) => setTimeout(r, 50));
+    writeFileSync(p.lock, "999999999"); // a successor (now dead) took the lock
+    await d.closed;
+    assert.ok(lines.includes("schedd: lost lock (owner pid 999999999), exiting"), lines.join("\n"));
+    assert.equal(stopped, true, "the hosted batch loop was stopped (no report: the next daemon resumes it)");
+    assert.equal(readFileSync(p.lock, "utf8"), "999999999", "the successor's lock is left alone");
+    assert.equal(existsSync(p.sock), true, "the successor's socket is left alone");
+
+    const lines2 = [];
+    const d2 = await startDaemon({ dir, root, runBatch: async () => ({}), log: (m) => lines2.push(m), resumeOnStart: false, lockCheckMs: 30 });
+    assert.ok(lines2.includes("schedd: took over the lock of dead pid 999999999 (it exited without a clean shutdown)"), lines2.join("\n"));
+    rmSync(p.sock);
+    await d2.closed;
+    assert.ok(lines2.includes(`schedd: lost socket ${p.sock}, exiting`), lines2.join("\n"));
+    assert.equal(existsSync(p.lock), false, "its own lock is released");
+  });
+
+  it("#4503: a client whose daemon is SIGKILLed re-attaches to the next daemon and finishes, without relaunching a lane", async () => {
+    const h = host();
+    try {
+      const d1 = await h.daemon();
+      await withRoot(h, () => capture(async () => {
+        const a = orchestrateFromCli(["1", "--parallel", "1", "--repo", "o/r", "--no-prefilter"], h.client);
+        await until(() => h.launched().length === 1 && h.lanePids().length === 1);
+        const gone = new Promise((r) => d1.on("exit", r));
+        d1.kill("SIGKILL");
+        await gone;
+        await new Promise((r) => setTimeout(r, 300)); // the client is retrying against the dead socket
+        await h.daemon();
+        setTimeout(() => writeFileSync(h.release, ""), 200);
+        assert.deepEqual((await a).rows.map((r) => [r.issue, r.outcome]), [[1, "merged"]]);
+        assert.deepEqual(h.launched(), [1], "adopted, not relaunched");
+      }));
+      assert.match(readFileSync(h.log, "utf8"), /^schedd: took over the lock of dead pid \d+ \(it exited without a clean shutdown\)$/m);
+    } finally { await h.cleanup(); }
+  });
+
+  it("#4503: test runs never resolve ~/.forge/sched, and teardown leaves no live stub lane", async () => {
+    assert.notEqual(schedDir(), join(homedir(), ".forge", "sched"));
+    assert.ok(schedDir().startsWith(tmpdir()), schedDir());
+    const h = host();
+    let pids = [], a;
+    try {
+      await h.daemon();
+      await withRoot(h, async () => {
+        a = capture(() => orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-prefilter"], { ...h.client, reconnectMs: 0 })).catch((e) => e);
+        await until(() => h.stubPids().length === 2 && h.lanePids().length === 2);
+      });
+      pids = h.stubPids();
+      for (const pid of pids) assert.equal(isLaneAlive(pid, null), true);
+      const [id] = listBatches(h.root);
+      assert.equal(openBatch(h.root, id).readPlan().env.FORGEDOCK_SCHED_DIR, schedDir(), "the lanes' env pins the test sched dir");
+    } finally { await h.cleanup(); }
+    await a;
+    assert.equal(pids.length, 2);
+    for (const pid of pids) assert.equal(isLaneAlive(pid, null), false, `stub lane ${pid} reaped`);
   });
 
   it("lane env: allowlisted keys come from the client only, the rest from the daemon", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.32.0",
+  "version": "1.32.1",
   "description": "Autonomous development pipeline for coding agents. GitHub as institutional memory, with native Claude Code and OpenCode entrypoints.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/refresh-bot-token.test.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Fixtures for scripts/refresh-bot-token.sh (#4507): hosts.yml is replaced by rename, never rewritten in place.
+# Run: bash scripts/refresh-bot-token.test.sh (bash 3.2 compatible). Stubs `node` and `gh`; no network.
+
+set -u
+DIR=$(cd "$(dirname "$0")" && pwd)
+S="$DIR/refresh-bot-token.sh"
+T=$(mktemp -d "${TMPDIR:-/tmp}/refresh-bot-token-test.XXXXXX")
+trap 'rm -rf "$T"' EXIT
+pass=0; fail=0
+ok() { pass=$((pass+1)); }
+no() { fail=$((fail+1)); echo "FAIL: $1"; }
+
+mkdir -p "$T/bin" "$T/cfg"
+echo key > "$T/key.pem"
+cat > "$T/bin/node" <<'STUB'
+#!/usr/bin/env bash
+printf 'tok-new'
+STUB
+cat > "$T/bin/gh" <<'STUB'
+#!/usr/bin/env bash
+echo "$GH_CONFIG_DIR $*" >> "$GH_LOG"
+case "$1 $2" in
+  "auth login") [ -n "${GH_FAIL:-}" ] && exit 1; cat > /dev/null; printf 'github.com:\n    oauth_token: tok-new\n' > "$GH_CONFIG_DIR/hosts.yml" ;;
+  "auth status") echo "Logged in to github.com account rapiercraft-forgedock[bot]" ;;
+esac
+exit 0
+STUB
+chmod +x "$T/bin/node" "$T/bin/gh"
+inode() { ls -i "$1" | awk '{print $1}'; }
+
+# (a) success: gh writes in a staging dir; hosts.yml is renamed into place
+printf 'github.com:\n    oauth_token: tok-old\n' > "$T/cfg/hosts.yml"
+before=$(inode "$T/cfg/hosts.yml")
+OUT=$(PATH="$T/bin:$PATH" GH_CONFIG_DIR="$T/cfg" GH_LOG="$T/log" bash "$S" --pem "$T/key.pem" 2>&1); RC=$?
+[ "$RC" = 0 ] && ok || no "(a) exit $RC: $OUT"
+grep -q 'tok-new' "$T/cfg/hosts.yml" && ok || no "(a) hosts.yml not updated"
+[ "$(inode "$T/cfg/hosts.yml")" != "$before" ] && ok || no "(a) hosts.yml rewritten in place (same inode)"
+if awk '{print $1}' "$T/log" | grep -qx "$T/cfg"; then no "(a) gh ran against the live config dir"; else ok; fi
+grep -q "auth login" "$T/log" && ok || no "(a) gh auth login not run"
+ls -a "$T/cfg" | grep -q '^\.hosts-stage\.' && no "(a) staging dir left behind" || ok
+case "$OUT" in *"token refreshed"*) ok ;; *) no "(a) success message missing: $OUT" ;; esac
+
+# (b) failed login: the live hosts.yml stays byte-identical, exit != 0
+printf 'github.com:\n    oauth_token: tok-keep\n' > "$T/cfg/hosts.yml"
+cp "$T/cfg/hosts.yml" "$T/expect"
+PATH="$T/bin:$PATH" GH_CONFIG_DIR="$T/cfg" GH_LOG="$T/log" GH_FAIL=1 bash "$S" --pem "$T/key.pem" >/dev/null 2>&1; RC=$?
+[ "$RC" != 0 ] && ok || no "(b) failed login exited 0"
+cmp -s "$T/expect" "$T/cfg/hosts.yml" && ok || no "(b) hosts.yml changed after a failed login"
+ls -a "$T/cfg" | grep -q '^\.hosts-stage\.' && no "(b) staging dir left behind" || ok
+
+echo "refresh-bot-token: $pass passed, $fail failed"
+[ "$fail" = 0 ]