forgedock 1.32.1 → 1.33.0

package/bin/lean/lean.test.mjs

@@ -648,6 +648,13 @@ describe("core work-on", () => {
     };
     assert.equal(await code(world({ result: { status: "blocked", summary: "need creds", block: { kind: "human", why: "credentials" } } })), "builder.blocked");
     assert.equal(await code(world({ result: { status: "blocked", summary: "need creds" } })), "builder.block_untyped");
+    // #4542: a remote lane that names only a declared host capability is the recoverable env code; anything else stays human.
+    const rb = (summary, extra) => code(world({ result: { status: "blocked", summary, block: { kind: "human", why: "credentials" } } }), extra);
+    const remote = { placement: { where: "remote", reason: "mode remote" }, hostCaps: { hostCapabilities: ["sops"] } };
+    assert.equal(await rb("this lane has no sops/age key", remote), "env.capability_remote");
+    assert.equal(await rb("owner must create a third-party account", remote), "builder.blocked");
+    assert.equal(await rb("this lane has no sops/age key", { ...remote, hostCaps: undefined }), "builder.blocked");
+    assert.equal(await rb("this lane has no sops/age key", { ...remote, placement: { where: "local", reason: "x" } }), "builder.blocked");
     assert.equal(await code(world({ changed: [] })), "builder.no_commit");
     assert.equal(await code(world({ waits: [{ rc: 1, text: "lint failed" }] }), { mergeWait: "all" }), "ci.red");
   });
@@ -1616,6 +1623,20 @@ describe("hotspot prevention (forge#4195): plan facts, build rule, unexempted gr
     assert.ok(approxTokens(builderImplementPrompt() + hotspotBuildRule(facts([]))) <= 1500);
   });
 
+  it("#4519 generated_paths: both prompts name the globs (even with the gate off), and an amendment adding one blocks", async () => {
+    const G = ["web/public/openapi*.json"];
+    for (const f of [facts([], { generated_paths: G }), facts([HOT], { enabled: false, generated_paths: G })]) {
+      assert.match(hotspotPlanNote(f), /Generated paths \(forge\.yaml maintenance\.generated_paths, owned by the repo's generator\): web\/public\/openapi\*\.json\. Never list or amend them in/);
+      assert.match(hotspotBuildRule(f), /Generated paths .*web\/public\/openapi\*\.json/);
+    }
+    assert.equal(hotspotPlanNote(facts([], { generated_paths: [] })), "", "no generated_paths: unchanged");
+    const w = hworld(facts([], { generated_paths: G }), [facts([])], { amendments: [{ kind: "add-deliverable", path: "web/public/openapi.json", why: "sync the spec" }] });
+    const r = await run(w);
+    assert.equal(r.code, "conformance.unimplemented"); assert.equal(w.merges.length, 0);
+    assert.match(builders(w)[0][4], /Generated paths .*openapi/);
+    assert.match(nh(w), /add-deliverable web\/public\/openapi\.json: generated path/);
+  });
+
   it("the plan prompt carries the facts, the implement prompt the configured rule; growth within the limit merges; no extra runner calls", async () => {
     const w = hworld(facts([HOT, COLD], { file_lines: 2000, growth_lines: 150 }), [facts([SMALL])]);
     assert.equal((await run(w)).terminalReason, "merged");
@@ -3490,6 +3511,28 @@ describe("batch robustness (#4112-#4115)", () => {
     }
   });
 
+  it("#4518 a builder paused for longer than maxMs still gets its full ceiling of active time", async () => {
+    const { runCliBackendAsync } = await import("../runner.mjs");
+    const { d, bin } = await fakeCli("paused", `${TOOL}\nsleep 1\n${RESULT}`);
+    const control = {};
+    const call = runCliBackendAsync({ spec: { name: "t" }, userMessage: "go", args: ["1"], cwd: d, bin, logger: { log() {} }, stream: true, idleMs: 0, maxMs: 1200, control });
+    await new Promise((res) => setTimeout(res, 100)); control.pause();
+    await new Promise((res) => setTimeout(res, 2200)); control.resume();
+    assert.equal((await call).text, "all done");
+  });
+
+  it("#4518 external SIGTERM (status 143) restarts the builder once, then ends deferred cli.host_killed, never engine-error", async () => {
+    const kill = () => Object.assign(new Error("claude CLI exited with status 143. No output was captured"), { code: "CLI_BACKEND_FAILED", status: 143, signal: null });
+    const w = world({ dirty: true }); const orig = w.io.runner; let n = 0;
+    w.io.runner = async (c) => { if (c.role === "builder" && n++ === 1) throw kill(); return orig(c); };
+    assert.equal((await run(w)).terminalReason, "merged");
+    const w2 = world({ dirty: true });
+    w2.io.runner = async (c) => { if (c.role === "builder") throw kill(); return { text: "" }; };
+    const r = await run(w2);
+    assert.equal(r.terminalReason, "deferred"); assert.equal(r.code, "cli.host_killed");
+    assert.equal(w2.edits.some((e) => e.includes("needs-human")), false);
+  });
+
   // ---- #4405 ----
   const HEAVY_CHILD = (d) => `printf '#!/bin/sh\\nsleep 1.5\\n' > ${d}/vitest; chmod +x ${d}/vitest`;
   it("#4405 a silent session with a running heavy-step child is not idle-killed within the extended window", async () => {
@@ -3873,6 +3916,17 @@ describe("verify-by-CI (#4167): ci mode runs the heavy checks on CI and feeds fa
     assert.equal(r.terminalReason, "needs-human"); assert.equal(w.merges.length, 0);
   });
 
+  it("#4527 base-sync re-review FAIL: the fix round's head is CI-verified before the retry review, which accepts validates left to CI and notes them", async () => {
+    const CONFLICTING = { mergeable: "CONFLICTING", mergeStateStatus: "DIRTY" }, OKSTATE = { mergeable: "MERGEABLE", mergeStateStatus: "CLEAN" };
+    const w = withCi(world({ validation: ciValidation, prView: [CONFLICTING, OKSTATE], mergeResults: ["conflict"], reviews: [ok(), bad("src/foo.js:4 lost base change"), ok()] }));
+    const r = await run(w, { verify: CI });
+    assert.equal(r.terminalReason, "merged", r.reason);
+    assert.equal(reviewers(w).length, 3);
+    assert.equal(new Set(w.ci.runs.map((x) => x.headSha)).size, w.ci.runs.length, "every reviewed head was verified once");
+    assert.equal(w.ci.runs[0].headSha, w.head, "the retry head is CI-verified");
+    assert.match(traj(w)[0], /Validate V1 verified by CI at [0-9a-f]{0,12}/);
+  });
+
   it("docs-only lane: no push for CI, no dispatch; the decision is recorded", async () => {
     const w = withCi(world({ changed: ["README.md", "docs/guide.md"], validation: ciValidation }));
     const r = await run(w, { verify: CI, conformance: "shadow" });
@@ -5106,6 +5160,20 @@ describe("enumerating tests + sequence numbers at hand-off (#4322)", () => {
       assert.match(traj(w).at(-1), /renumbered deterministically \(no builder\): db\/0007_usage\.sql → db\/0008_usage\.sql/);
     });
 
+    it("#4526: the renumber gets a reserve hook bound to (repo, lane, issue), and the run's reservations are dropped at finish", async () => {
+      const w = dworld({ seq: [COLL, []] }), reserved = [], unreserved = [];
+      w.io.sequenceLease.reserve = async (x) => { reserved.push(x); return { numbers: [9] }; };
+      w.io.sequenceLease.unreserve = async (x) => { unreserved.push(x); };
+      assert.equal((await run(w)).terminalReason, "merged");
+      assert.equal(typeof w.renumbers[0].reserve, "function");
+      assert.deepEqual(await w.renumbers[0].reserve({ dir: "db", floor: 7, count: 1 }), { numbers: [9] });
+      assert.equal(reserved[0].dir, "db");
+      assert.equal(reserved[0].floor, 7);
+      assert.ok(reserved[0].repo && reserved[0].lane && reserved[0].issue, JSON.stringify(reserved[0]));
+      assert.equal(unreserved.length, 1);
+      assert.deepEqual(unreserved[0], { repo: reserved[0].repo, lane: reserved[0].lane, issue: reserved[0].issue });
+    });
+
     it("base-sync with conflicts only in sequence files: base side taken and renumbered by the engine, zero builder sessions, zero re-reviews", async () => {
       const w = dworld({ seq: [[], COLL, []], prView: [CONFLICTING, OKSTATE], mergeResults: ["conflict"], conflictFiles: ["db/meta/_journal.json", "db/meta/0007_snapshot.json"] });
       assert.equal((await run(w)).terminalReason, "merged");
@@ -5400,10 +5468,10 @@ describe("#4392: implement turn budget", () => {
   const TB = { S: 25, M: 60, L: 100 }; // the CLI defaults (readCoreLimits); runCore alone is unbudgeted
   const stopWith = (digest) => (w) => { w.files[`${WT}/.forge-lean/result.json`] = JSON.stringify({ status: "budget-exceeded", summary: "too big", digest }); };
 
-  it("an overrun ends needs-human budget.exceeded with the builder's digest, checkpointed, recoverable once", async () => {
+  it("an overrun ends budget-exceeded (#4505) with the builder's digest, checkpointed, recoverable once", async () => {
     const w = budgetWorld(stopWith("done: parser. remaining: 3 adapters. recommend split")); const dir = tmpDir("core-tb-");
     const r = await run(w, { dir, turnBudgets: TB });
-    assert.equal(r.terminalReason, "needs-human"); assert.equal(r.code, OUTCOME_CODES.BUDGET_EXCEEDED);
+    assert.equal(r.terminalReason, "budget-exceeded"); assert.equal(r.code, OUTCOME_CODES.BUDGET_EXCEEDED);
     assert.match(r.detail, /size S, 25 turns/); assert.match(r.detail, /remaining: 3 adapters/);
     assert.equal(classifyNeedsHuman({ outcome: r.terminalReason, code: r.code }), "recoverable");
     assert.deepEqual(r.turns, { size: "S", budget: 25, build: 28, total: 31, exceeded: true });
@@ -5411,7 +5479,7 @@ describe("#4392: implement turn budget", () => {
     assert.equal(w.seen[2].resume, null, "the wrap-up is a fresh session");
     assert.match(w.seen[2].prompt, /The engine froze \.forge-lean\/contract\.json/); assert.match(w.seen[2].prompt, /at most 5 turns/);
     assert.ok(w.calls.some((c) => c[0] === "git" && c[1] === "commit" && c.some((x) => /checkpoint after turn budget/.test(x))), "work checkpointed");
-    assert.ok(w.comments.some((c) => c.includes("FORGE:NEEDS_HUMAN") && c.includes("remaining: 3 adapters")));
+    assert.ok(!w.comments.some((c) => c.includes("FORGE:NEEDS_HUMAN")), "#4505: no human escalation");
     const log = readLog(dir, 7);
     assert.ok(log.some((e) => e.event === "TURN_BUDGET_EXCEEDED" && e.size === "S" && e.budget === 25 && e.turns === 25 && e.grant === 5));
     assert.deepEqual(log.find((e) => e.event === "RUN_TERMINAL").turns, r.turns);
@@ -5427,6 +5495,35 @@ describe("#4392: implement turn budget", () => {
     assert.equal(o2.code, OUTCOME_CODES.BUDGET_EXCEEDED); assert.match(o2.detail, /No builder digest; changes so far/);
   });
 
+  const addNH = (w) => w.edits.filter((e) => e.join(" ") === "issue edit 7 -R o/r --add-label needs-human").length;
+  it("#4505 a turn overrun ends budget-exceeded, not needs-human: no label, no NEEDS_HUMAN comment, recoverable", async () => {
+    const w = budgetWorld(stopWith("done: parser. remaining: tests")); const dir = tmpDir("core-tb-");
+    const r = await run(w, { dir, turnBudgets: TB });
+    assert.equal(r.terminalReason, "budget-exceeded"); assert.equal(r.code, OUTCOME_CODES.BUDGET_EXCEEDED);
+    assert.equal(r.branch, "feat/issue-7-lean", "the checkpoint branch rides on the result"); assert.match(r.detail, /remaining: tests/);
+    assert.equal(addNH(w), 0, "no needs-human label"); assert.ok(!w.comments.some((c) => c.includes("FORGE:NEEDS_HUMAN")), "no Needs human comment");
+    assert.equal(classifyNeedsHuman({ outcome: r.terminalReason, code: r.code }), "recoverable");
+    const term = readLog(dir, 7).find((e) => e.event === "RUN_TERMINAL");
+    assert.equal(term.reason, "budget-exceeded"); assert.equal(term.code, OUTCOME_CODES.BUDGET_EXCEEDED);
+    assert.ok(w.comments.some((c) => c.includes("FORGE:TRAJECTORY") && /recoverable budget\.exceeded/.test(c)), "the trajectory records the recoverable end");
+  });
+
+  it("#4505 a budget.exceeded recovery lane runs at the next size budget; non-final stays unlabelled, a final overrun is needs-human", async () => {
+    const nonFinal = budgetWorld(stopWith("still more"));
+    const r1 = await run(nonFinal, { dir: tmpDir("core-tb-"), turnBudgets: TB, recover: { code: OUTCOME_CODES.BUDGET_EXCEEDED, attempt: 1, final: false } });
+    assert.deepEqual(nonFinal.seen.map((x) => x.turnMax), [0, 60, 12], "S lane retried at M: 60 turns, wrap-up grant 12");
+    assert.equal(r1.turns.size, "M"); assert.equal(r1.terminalReason, "budget-exceeded"); assert.equal(r1.recovery, true);
+    assert.equal(addNH(nonFinal), 0);
+    assert.ok(builders(nonFinal).some((b) => /Recovery pass \(budget\.exceeded\): .*Continue from the checkpoint/.test(b[4])));
+    const fin = budgetWorld(stopWith("still more"));
+    const r2 = await run(fin, { dir: tmpDir("core-tb-"), turnBudgets: TB, recover: { code: OUTCOME_CODES.BUDGET_EXCEEDED, attempt: 1, final: true } });
+    assert.equal(r2.terminalReason, "needs-human"); assert.equal(r2.code, OUTCOME_CODES.BUDGET_EXCEEDED);
+    assert.equal(addNH(fin), 1, "the failed recovery is a human escalation"); assert.ok(fin.comments.some((c) => c.includes("FORGE:NEEDS_HUMAN")));
+    const other = budgetWorld(stopWith("still more")); // another code's recovery keeps the lane's size
+    const r3 = await run(other, { dir: tmpDir("core-tb-"), turnBudgets: TB, recover: { code: "ci.red", attempt: 1, final: false } });
+    assert.equal(r3.turns.size, "S"); assert.equal(r3.terminalReason, "budget-exceeded");
+  });
+
   it("size comes from a size: label over the contract; 0 disables the budget and nothing is capped", async () => {
     const w = world({ labels: [{ name: "size:L" }] }); const caps = []; const orig = w.io.runner;
     w.io.runner = async (c) => { if (c.role === "builder") caps.push(c.turnMax ?? 0); return orig(c); };
@@ -5981,6 +6078,36 @@ describe("#4450 light lane: one builder session, derived contract, upgrade to th
     assert.equal(typeof events(dir, "LIGHT_DONE")[0].cost_usd, "number");
   });
 
+  it("#4502 a light lane that adds an undeclared package edge gets the structure gate: one builder resume, then merges", async () => {
+    const EDGE = { from: "@s/db", to: "@s/core", kind: "dependencies", manifest: "packages/db/package.json" };
+    const quiet = { package_edges_added: [], package_edges_removed: [], import_pairs: [], boundary_config_changed: { changed: false, files: [], loosens: false, tightens: false } };
+    const w = lworld(), dir = tmpDir("light-struct-"); const q = [{ ...quiet, package_edges_added: [EDGE] }, quiet];
+    w.io.structureDelta = async () => (q.length > 1 ? q.shift() : q[0]);
+    const r = await run(w, { dir, ...ON });
+    assert.equal(r.terminalReason, "merged");
+    assert.equal(events(dir, "LIGHT_DONE").length, 1, "stayed light");
+    assert.equal(builders(w).length, 2, "the light session plus one structure resume");
+    assert.match(builders(w)[1][4], /@s\/db -> @s\/core/);
+    assert.equal(events(dir, "STRUCTURE_DELTA").length >= 1, true);
+  });
+
+  it("#4502 a typed budget error in the light step ends as in the full lane: no second builder session, no upgrade", async () => {
+    const w = lworld(), dir = tmpDir("light-typed-"); const orig = w.io.runner;
+    let tries = 0;
+    w.io.runner = async (c) => { if (c.role === "builder") { tries++; throw Object.assign(new Error("turn budget spent"), { laneCode: OUTCOME_CODES.BUDGET_EXCEEDED }); } return orig(c); };
+    const r = await run(w, { dir, ...ON });
+    assert.equal(r.code, OUTCOME_CODES.BUDGET_EXCEEDED);
+    assert.equal(tries, 1, "no upgrade session");
+    assert.equal(events(dir, "LIGHT_UPGRADE").length, 0);
+  });
+
+  it("#4502 the targeted light tests run with the configured precheck timeout", async () => {
+    const w = lworld(), dir = tmpDir("light-timeout-"); const seen = [];
+    w.io.runCommand = async (a) => { seen.push(a.timeoutMs); return { rc: 0, output: "" }; };
+    await run(w, { dir, ...ON });
+    assert.ok(seen.length && seen.every((t) => Number.isFinite(t) && t > 0 && t < 2 ** 40), `timeouts: ${seen}`);
+  });
+
   for (const [name, code, o] of [
     ["oversized diff", "diff_lines", { numstat: "80\t3\tsrc/foo.js\n20\t0\ttest/foo.test.js\n" }],
     ["non-red repro", "repro_not_red", { repro: { base: "PASSED", head: "RAN" } }],
@@ -6039,15 +6166,14 @@ describe("#4450 light lane: one builder session, derived contract, upgrade to th
     w.io.structureDelta = async () => { w.over.structure.push(w.calls.length); return { package_edges_added: [], package_edges_removed: [], import_pairs: [] }; };
     return w;
   };
-  it("#4451 a light lane that is not upgraded makes no context-pack, structure or hotspot calls", async () => {
+  it("#4451/#4502 a light lane that is not upgraded makes no context-pack call but runs the structure and hotspot gates", async () => {
     const w = overhead(), dir = tmpDir("light-over-");
     const r = await run(w, { dir, ...ON, contextPack: { mode: "on" } });
     assert.equal(r.terminalReason, "merged");
     assert.equal(events(dir, "LIGHT_DONE").length, 1);
-    assert.deepEqual(w.over, { pack: [], hot: [], structure: [] });
+    assert.deepEqual(w.over.pack, []);
+    assert.ok(w.over.hot.length >= 1 && w.over.structure.length >= 1, "#4502: the full lane's gates run");
     assert.equal(events(dir, "CONTEXT_PACK").length, 0);
-    // only the merge-time record (local numstat, no structure-delta call) remains; no implement-time delta
-    assert.deepEqual(events(dir, "STRUCTURE_DELTA").map((e) => e.phase), ["merge"]);
     assert.equal(events(dir, "RUN_TERMINAL")[0].light, true);
   });
   it("#4451 an upgraded light lane computes the hotspots and the context pack before the plan call and runs the structure delta", async () => {

package/bin/lean/lightlane.mjs

@@ -23,14 +23,14 @@ const one = (s, max = DETAIL_MAX) => {
 
 /** The one builder session of a light lane: failing test, fix, targeted tests, result.json with what the contract is derived from. */
 export function lightBuildPrompt(n, opts = {}) {
-  return `Resolve issue #${n} (read it with gh issue view ${n} --comments) in ONE session; this is a light lane for a small, well-specified issue. There is no plan step and no frozen contract: the engine derives the contract from your diff and your test.
+  return `Resolve issue #${n} (read it with gh issue view ${n} --comments) in ONE session; this is a light lane for a small, well-specified issue. There is no plan step and no frozen contract: the engine derives the contract from the files the issue names and your test.
 
 ${hostRules(opts)}
 
 1. Write the failing regression test first and run it: it must fail on the current code for the reason the issue describes.
 2. Make the smallest fix that makes it pass. Keep the public API shape unchanged (signatures, sync/async, generator/function, exported names); the engine checks it.
 3. Run the targeted tests (the new test plus the existing tests of the files you changed), run the repo's formatter on the files you changed, and commit. Do not push or touch GitHub.
-4. Run \`node ${FORGEDOCK_CLI} check\` in the worktree and fix until it passes.
+4. Re-run the targeted tests once more on the committed tree and make sure \`git status\` is clean (the engine runs its own gates afterwards; there is no contract file to check yet).
 
 When done and committed, write ${IMPLEMENTATION_FILE} (markdown, no HTML comments):
 ### Approach
@@ -79,19 +79,22 @@ export function apiShapeReasons(r) {
  * issue sentence, else the issue title; deliverables: the changed non-test files; validate: the repro command plus each
  * targeted test command; repro_test: the builder's, else "none" with a reason. validateContract judges it like any other.
  */
-export function deriveLightContract({ title = "", issueText = "", result = null, files = [] } = {}) {
+export function deriveLightContract({ title = "", issueText = "", result = null, files = [], predictedFiles = null } = {}) {
   const r = result && typeof result === "object" ? result : {};
   const said = typeof r.requirement === "string" ? r.requirement.trim() : "";
   const quote = said && inIssue(said, issueText) ? said : String(title ?? "").trim();
   const paths = [...new Set((Array.isArray(files) ? files : []).map((f) => String(f ?? "").trim()).filter((f) => f && f !== LEAN_DIR && !f.startsWith(`${LEAN_DIR}/`)))];
-  const code = paths.filter((f) => classifyPath(f) !== "test");
+  const changed = paths.filter((f) => classifyPath(f) !== "test");
+  // #4502: deliverables are what the issue names (the diff cannot fail its own scope check); no named files: the diff, as before
+  const named = Array.isArray(predictedFiles) ? new Set(predictedFiles.map((f) => String(f ?? "").trim())) : null;
+  const code = named ? changed.filter((f) => named.has(f)) : changed;
   const t = r.repro_test;
   const repro = t && typeof t === "object" && !Array.isArray(t) && String(t.path ?? "").trim() && String(t.command ?? "").trim()
     ? { path: String(t.path).trim(), id: String(t.id ?? "").trim(), command: String(t.command).trim() } : null;
   const commands = [...new Set([repro?.command, ...(Array.isArray(r.tests) ? r.tests : []).map((x) => (x && typeof x === "object" ? String(x.command ?? "").trim() : ""))].filter(Boolean))];
   return {
     requirements: [{ id: "R1", quote, disposition: "deliver" }],
-    deliverables: code.map((path, i) => ({ id: `D${i + 1}`, path, change: "light-lane fix (derived from the diff)", requirements: ["R1"] })),
+    deliverables: code.map((path, i) => ({ id: `D${i + 1}`, path, change: "light-lane fix (issue-named file)", requirements: ["R1"] })),
     validate: commands.map((command, i) => ({ id: `V${i + 1}`, command })),
     ...(repro ? { repro_test: repro } : { repro_test: "none", repro_test_reason: "the light-lane builder named no repro test" }),
   };
@@ -109,14 +112,28 @@ export function upgradeNote(reasons) {
 /**
  * #4451: the light targeted tests, concurrently through precheck.mjs runChecks (one heavy slot per running command, the
  * worker cap `parallelism` divided among them) with no round budget: every command runs, none is deferred to CI.
- * run({command, workers}) -> {rc, output}. Returns [{command, rc, output}] in input order.
+ * run({command, timeoutMs, workers}) -> {rc, output}. Returns [{command, rc, output}] in input order.
  */
-export async function runLightTests({ commands, parallelism = 1, run, acquire, now = () => Date.now() }) {
-  // the per-command limit stays far below the budget, so runChecks never sees a budget cut: a timeout (rc 124) stays a failure
-  const { results } = await runChecks({ commands, parallelism, budgetMs: Number.MAX_SAFE_INTEGER, perCommandMs: 2 ** 40, now, acquire, run: ({ command, workers }) => run({ command, workers }) });
+export async function runLightTests({ commands, parallelism = 1, run, acquire, now = () => Date.now(), timeoutMs }) {
+  // #4502: the configured per-command timeout reaches the runner (else io.runCommand's 300 s default applies); the budget stays far above it,
+  // so runChecks never sees a budget cut: a timeout (rc 124) stays a failure
+  const per = Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 2 ** 40;
+  const { results } = await runChecks({ commands, parallelism, budgetMs: Number.MAX_SAFE_INTEGER, perCommandMs: per, now, acquire, run: ({ command, timeoutMs: t, workers }) => run({ command, timeoutMs: t, workers }) });
   return results.map(({ command, rc, output }) => ({ command, rc, output }));
 }
 
+/** Non-test changed files (engine dir skipped) that the issue does not name. */
+function scopeCreep(files, predicted) {
+  const named = new Set(predicted.map((f) => String(f ?? "").trim()));
+  return (files ?? []).map((f) => String(f ?? "").trim()).filter((f) => f && f !== LEAN_DIR && !f.startsWith(`${LEAN_DIR}/`) && classifyPath(f) !== "test" && !named.has(f));
+}
+
+/** #4502: a typed builder error (budget, idle/timeout deferral, spawn failure, usage limit) belongs to the lane's own catch, not to an upgrade. */
+export function isTypedBuilderError(e) {
+  if (!e || typeof e !== "object") return false;
+  return Boolean(e.laneCode || e.deferCode || e.spawnDeterministic === true || e.usageLimit || /^CLI_/.test(String(e.code ?? "")) || /usage limit/i.test(String(e.message ?? "")));
+}
+
 /**
  * One light lane step. ctx callbacks (all async unless noted): build() runs the one builder session; readResult();
  * checkpoint() commits uncommitted work; changedFiles(); numstat() -> `git diff --numstat` text; runTests(commands) ->
@@ -124,7 +141,7 @@ export async function runLightTests({ commands, parallelism = 1, run, acquire, n
  * or null; apiShape() -> detectApiShape output or null; validate(contract) -> {ok, problems} (sync). Plus title, issueText,
  * riskPaths, cfg. Returns {upgrade:false, contract, files, repro, testFailures} or {upgrade:true, reasons, files, ...}, plus the
  * gate inputs of the FORGE:LITE receipt (#4452): diff (parseNumstat), apiShape (apiShapeReasons), testCommands, testRuns.
- * Never throws: an internal error is the upgrade reason light_error.
+ * An internal error is the upgrade reason light_error; a typed builder error (isTypedBuilderError) is rethrown.
  */
 export async function runLightStep(ctx) {
   const up = (reasons, extra = {}) => ({ upgrade: true, reasons, contract: null, files: [], repro: null, testFailures: 0, diff: null, apiShape: null, testCommands: [], testRuns: null, ...extra });
@@ -135,8 +152,13 @@ export async function runLightStep(ctx) {
     const files = await ctx.changedFiles();
     if (!files.length) return up([{ code: "no_commit", detail: `the light builder made no commit (status ${one(result?.status ?? "none", 40)})` }]);
     if (result?.status !== "fixed") return up([{ code: "not_fixed", detail: `light builder status ${one(result?.status ?? "none", 40)}${result?.summary ? `: ${one(result.summary)}` : ""}` }], { files });
-    const contract = deriveLightContract({ title: ctx.title, issueText: ctx.issueText, result, files });
+    const predicted = Array.isArray(ctx.predictedFiles) ? ctx.predictedFiles : null;
+    const contract = deriveLightContract({ title: ctx.title, issueText: ctx.issueText, result, files, predictedFiles: predicted });
     const vc = ctx.validate(contract);
+    if (!vc?.ok && predicted && scopeCreep(files, predicted).length) { // the issue-named deliverables are empty: the diff left the issue's scope
+      const t = upgradeTriggers({ diff: parseNumstat(await ctx.numstat()), repro: null, testFailures: 0, riskPaths: ctx.riskPaths ?? [], apiShape: [], cfg: ctx.cfg ?? {} });
+      return up([{ code: "scope_creep", detail: `changed file(s) the issue does not name: ${one(scopeCreep(files, predicted).slice(0, 5).join(", "))}` }, ...t.reasons], { files });
+    }
     if (!vc?.ok) return up([{ code: "contract_invalid", detail: `derived contract: ${one((vc?.problems ?? [])[0] ?? "invalid")}` }], { files });
 
     let testFailures = 0;
@@ -155,10 +177,13 @@ export async function runLightStep(ctx) {
     const [repro, numstat, shape] = await Promise.all([ctx.reproOf(contract), ctx.numstat(), ctx.apiShape()]);
     const diff = parseNumstat(numstat), apiShape = apiShapeReasons(shape);
     const t = upgradeTriggers({ diff, repro, testFailures, riskPaths: ctx.riskPaths ?? [], apiShape, cfg: ctx.cfg ?? {} });
-    const latest = deriveLightContract({ title: ctx.title, issueText: ctx.issueText, result: (await ctx.readResult()) ?? result, files: now });
-    return { upgrade: t.upgrade, reasons: t.reasons, contract: t.upgrade ? null : (ctx.validate(latest)?.ok ? latest : contract), files: now, repro, testFailures,
+    const outside = predicted ? scopeCreep(now, predicted) : [];
+    const reasons = outside.length ? [...t.reasons, { code: "scope_creep", detail: `changed file(s) the issue does not name: ${one(outside.slice(0, 5).join(", "))}` }] : t.reasons;
+    const latest = deriveLightContract({ title: ctx.title, issueText: ctx.issueText, result: (await ctx.readResult()) ?? result, files: now, predictedFiles: predicted });
+    return { upgrade: t.upgrade || outside.length > 0, reasons, contract: t.upgrade || outside.length ? null : (ctx.validate(latest)?.ok ? latest : contract), files: now, repro, testFailures,
       diff, apiShape, testCommands: commands, testRuns: runs == null ? null : (runs ?? []).length };
   } catch (e) {
+    if (isTypedBuilderError(e)) throw e; // #4502: the lane's own catch ends it as in the full lane, no second builder session
     return up([{ code: "light_error", detail: one(e?.message ?? e) }]);
   }
 }

package/bin/lean/lightlane.test.mjs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { deriveLightContract, runLightStep, runLightTests, parseNumstat, apiShapeReasons, upgradeNote, lightBuildPrompt, renderLiteReceipt } from "./lightlane.mjs";
+import { isTypedBuilderError, deriveLightContract, runLightStep, runLightTests, parseNumstat, apiShapeReasons, upgradeNote, lightBuildPrompt, renderLiteReceipt } from "./lightlane.mjs";
 import { validateContract } from "./conformance.mjs";
 
 const TITLE = "foo crashes on null input";
@@ -235,3 +235,37 @@ describe("renderLiteReceipt (#4452)", () => {
     for (const k of ["upgrade", "reasons", "contract", "files", "repro", "testFailures"]) assert.ok(k in r, k);
   });
 });
+
+describe("#4502 light lane fixes", () => {
+  it("runLightStep rethrows typed builder errors; internal errors stay light_error", async () => {
+    for (const e of [{ laneCode: "budget.exceeded" }, { deferCode: "cli.idle" }, { code: "CLI_SPAWN_FAILED" }, { code: "CLI_TIMEOUT" }, { spawnDeterministic: true }, { usageLimit: true }]) {
+      const { ctx } = step({ ctx: { build: async () => { throw Object.assign(new Error("typed"), e); } } });
+      await assert.rejects(runLightStep(ctx), (x) => isTypedBuilderError(x) && x.message === "typed");
+    }
+    const { ctx } = step({ ctx: { build: async () => { throw new Error("git broke"); } } });
+    assert.deepEqual(codes(await runLightStep(ctx)), ["light_error"]);
+    assert.equal(isTypedBuilderError(null), false);
+  });
+  it("the light prompt no longer asks for a check that cannot pass", () => {
+    const p = lightBuildPrompt(7);
+    assert.doesNotMatch(p, /forgedock[^\n]* check/);
+    assert.doesNotMatch(p, /\bcheck\b[^\n]*until it passes/);
+    assert.match(p, /git status/);
+  });
+  it("deliverables come from the issue-named files; a diff file outside them upgrades with scope_creep", () => {
+    const c = deriveLightContract({ title: TITLE, issueText: ISSUE, result: RESULT, files: ["src/foo.js", "src/other.js", "test/foo.test.js"], predictedFiles: ["src/foo.js"] });
+    assert.deepEqual(c.deliverables.map((d) => d.path), ["src/foo.js"]);
+  });
+  it("scope_creep: a changed non-test file the issue does not name is an upgrade reason", async () => {
+    const { ctx } = step({ files: ["src/foo.js", "src/other.js", "test/foo.test.js"], numstat: "5\t1\tsrc/foo.js\n2\t0\tsrc/other.js\n20\t0\ttest/foo.test.js\n", ctx: { predictedFiles: ["src/foo.js"] } });
+    const r = await runLightStep(ctx);
+    assert.equal(r.upgrade, true); assert.ok(codes(r).includes("scope_creep"), JSON.stringify(r.reasons));
+    const ok = await runLightStep(step({ ctx: { predictedFiles: ["src/foo.js"] } }).ctx);
+    assert.equal(ok.upgrade, false, JSON.stringify(ok.reasons));
+  });
+  it("runLightTests forwards the configured timeout to the runner", async () => {
+    const seen = [];
+    await runLightTests({ commands: ["a", "b"], timeoutMs: 900000, run: async (x) => { seen.push(x.timeoutMs); return { rc: 0, output: "" }; } });
+    assert.deepEqual(seen, [900000, 900000]);
+  });
+});

package/bin/lean/orchestrate.mjs

@@ -18,7 +18,8 @@
  * A seam calls `onLive()` before it waits on a live lane (#4504); an adopt that resolves first is settled (or requeued on null)
  * before scheduling, so a live lane does not hold up the others.
  * `deferred` is a scheduling fact, not an end: each typed code is requeued with its retry-at (`deferPolicy`), a usage
- * limit holds admissions for that account until its reset, and non-host deferrals stop after `maxDeferrals`.
+ * limit holds admissions for that account until its reset, and deferrals other than a busy resource (`host.busy`,
+ * `sandbox.capacity`, #4528) stop after `maxDeferrals`.
  * Usage-limit holds (#4190) are keyed by backend identity in `limits` (the host store, shared by every batch on the
  * host; in memory when absent): admission checks the hold of `identity()`, the account the next lane would use. While held, the
  * batch re-reads the store every `pollMs` (#4446), so `forgedock limits clear` admits on the next poll, not at the reset. An `engine-error` is
@@ -70,10 +71,12 @@
  * In-batch recovery (#4267), on by default: this module recovers only when `recovery: {maxAttempts}` is passed, and the
  * CLI always passes it (forge.yaml `orchestration.recovery.max_attempts`, default 1; 0 disables): a row `classifyNeedsHuman` calls
  * recoverable (needs-human `ci.red` / `base.conflict` / `builder.block_untyped`, `contract.invalid` after a mid-run issue
- * edit, `ci-pending` whose PR `conflicting(issue, pr)` says conflicts) is not final while its persisted `recoveries` stay
+ * edit, `ci-pending` whose PR `conflicting(issue, pr)` says conflicts, the non-human `budget-exceeded` turn overrun of #4505,
+ * recovered at the next size budget) is not final while its persisted `recoveries` stay
  * under `maxAttempts`: it is requeued as a recovery lane (`ctx.recover = {code, attempt, final}`, `final` when attempt ==
  * `maxAttempts`) under the same admission as any lane, so its dependents stay queued. Only a final lane relabels needs-human
- * itself; a non-final attempt that ends needs-human/ci-pending without a successor is relabelled here, once (#4302). A recovery
+ * itself; a non-final attempt that ends needs-human/ci-pending/budget-exceeded without a successor is relabelled here, once (#4302),
+ * as is a first-run budget-exceeded the batch does not recover (#4505: the lane never labels it). A recovery
  * still queued when the batch exits (breaker, budget, hold, or a resume that does not relaunch it) is relabelled once with the
  * full persisted lane reason (#4315); also when the loop throws, and through `onExit(fn)` (the caller's signal handler
  * awaits `fn(cause)`), each once (#4318). `relabelNeedsHuman` may return `false`/"failed" (not recorded, a resume retries)
@@ -93,7 +96,7 @@
  * the queue order except that decomposed sub-issues go first. A settled row carries `est_minutes` (estimated vs. actual).
  */
 import { parseDependsOn } from "../engine/phases.mjs";
-import { classifyNeedsHuman, recoveryCodeOf } from "../engine/outcome-codes.mjs";
+import { classifyNeedsHuman, recoveryCodeOf, OUTCOME_CODES } from "../engine/outcome-codes.mjs";
 import { recoveryEvidence } from "./render.mjs";
 import { renderAlerts } from "../stats/render.mjs";
 import { formatParkedLine, postDeployOnly } from "./prefilter.mjs";
@@ -103,11 +106,13 @@ import { laneSize, SIZES } from "./budget.mjs";
 const SATISFIED = new Set(["merged", "invalid"]);
 // Times one issue may be requeued behind a dependency before its dependency-open row is final.
 export const MAX_REQUEUES = 2;
-// Non-host deferrals (anything but host.busy) one issue may take before its deferred row is final.
+// Deferrals other than a busy resource (UNCAPPED_DEFERRALS) one issue may take before its deferred row is final.
 export const DEFAULT_MAX_DEFERRALS = 3;
 // Relaunches of an issue whose lane ended engine-error.
 export const ENGINE_ERROR_RELAUNCHES = 1;
 export const HOST_BUSY_RETRY_S = 60;
+// #4528: a busy host or a full sandbox pool is a wait, not a failure: requeued after its retry-in, never capped.
+const UNCAPPED_DEFERRALS = new Set(["host.busy", "sandbox.capacity"]);
 export const RATE_LIMIT_FALLBACK_S = 15 * 60;
 export const DEFER_BACKOFF_S = 120;
 export const DEFER_BACKOFF_MAX_S = 30 * 60;
@@ -156,12 +161,12 @@ export function parseDeps(body, issue) {
 const posNum = (v) => { const n = Number(v); return Number.isFinite(n) && n > 0 ? n : null; };
 
 /**
- * When to run a `deferred` issue again. `deferrals` counts this issue's earlier non-host deferrals.
+ * When to run a `deferred` issue again. `deferrals` counts this issue's earlier capped deferrals (not UNCAPPED_DEFERRALS).
  * @returns {{delayMs:number, host?:true, hold?:true} | {capped:true}}
  */
 export function deferPolicy(r, { now, deferrals = 0, maxDeferrals = DEFAULT_MAX_DEFERRALS }) {
   const code = r?.code ?? null;
-  if (code === "host.busy") return { delayMs: (posNum(r?.retryInSeconds) ?? HOST_BUSY_RETRY_S) * 1000, host: true };
+  if (UNCAPPED_DEFERRALS.has(code)) return { delayMs: (posNum(r?.retryInSeconds) ?? HOST_BUSY_RETRY_S) * 1000, host: true };
   const k = deferrals + 1;
   if (k > maxDeferrals) return { capped: true };
   if (code === "rate_limited") {
@@ -217,6 +222,8 @@ export function pickNext(ready, { classes, share, whenIdle = false, started = 0,
 }
 
 const toObj = (m) => Object.fromEntries([...m].map(([k, v]) => [String(k), v]));
+/** #4525: how often a parked needs-human PR is re-synced with its base while the batch runs. */
+export const DEFAULT_SYNC_EVERY_MS = 10 * 60 * 1000;
 const toMap = (o) => new Map(Object.entries(o ?? {}).map(([k, v]) => [Number(k), v]));
 
 /**
@@ -226,7 +233,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   store = null, adopt = null, getParallel = null, getAdded = null, breaker = null, maxDeferrals = DEFAULT_MAX_DEFERRALS, sleep = cancellableSleep, pollMs = 5000,
   classify = null, maintenance = null, limits = null, identity = () => "default", batchId = null, drift = null, sched = null, priorityOf = null, remote = null, beforeAdmit = null,
   recovery = null, decide = () => {}, conflicting = null, relabelNeedsHuman = null, onExit = null, issueLabels = null, getCancelled = null, stopLane = null,
-  estimate = null, starveMs = DEFAULT_STARVE_MS, signal = null, dispatchCheck = null }) {
+  estimate = null, starveMs = DEFAULT_STARVE_MS, signal = null, dispatchCheck = null, syncParked = null, syncEveryMs = DEFAULT_SYNC_EVERY_MS }) {
   const saved = store?.load?.() ?? null;
   const order = saved ? [...saved.order] : [];
   const set = new Set(order);
@@ -256,16 +263,21 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   const classes = toMap(saved?.classes); // issue -> {maintenance, priority}; only with a maintenance budget
   const dispatch = { started: saved?.dispatch?.started ?? 0, maint: saved?.dispatch?.maint ?? 0 };
   let budgetHeld = false;
+  const parkedBase = new Map(); // #4525: issue -> base sha its parked PR was last synced (or reported conflicting) against
+  let lastParkedSync = null;
   const bodies = new Map(); // issue -> body, kept in memory for drift.holds only
   const driftHeld = new Map(); // issue -> flagged package dir holding it this pass
   const reg = sched?.registry ?? null;
   const priorities = toMap(saved?.priorities); // issue -> priority number; only with the registry
   const remoteMax = remote && Number.isInteger(remote.max) && remote.max >= 0 ? remote.max : 0;
+  let capAt, capAdmits = 0; // #4540: provider capacity sample and the remote admissions made since it
   const remoteRun = new Set(); // remote lanes running now (#4253): admitted against remoteMax, never the host cap
   let budgetLocal = false; // the execution budget refused a remote lane under on_budget local: the rest run on the host
   // #4256: where a lane goes before capacity: `remote.place` (hybrid) or `remote.isRemote` (remote mode).
   const placeOf = (n) => {
     if (!remote) return null;
+    // #4542: a lane recovering from a remote capability block runs on the host, which has the capability.
+    if (recovering.get(n)?.code === OUTCOME_CODES.ENV_CAPABILITY_REMOTE) return { where: "local", reason: "host capability: recovering env.capability_remote" };
     if (budgetLocal) return { where: "local", reason: `fallback to local: execution budget: ${budgetHit ?? "cap reached"}` };
     try {
       if (typeof remote.place === "function") {
@@ -441,9 +453,19 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     if (p?.where === "remote") {
       const adm = admitRemote();
       if (adm.ok) {
-        if (remoteRun.size < remoteMax) { remoteRun.add(n); placed.set(n, p); return true; }
-        if (!remote.fallbackLocal) return false;
-        p = { where: "local", reason: `fallback to local: max_remote ${remoteMax} reached (${p.reason})` }; // #4256: hybrid runs it on the host
+        // #4540: the provider's free slots (`remote.capacity() -> {free, at}`, sync, null = unknown) cap admissions per sample `at`; the issue queues here instead of a 503.
+        let cap = null;
+        try { cap = remote.capacity?.() ?? null; } catch { cap = null; }
+        // #4547: opt-in (`execution.fallback_local`): every pool agent offline or asleep (sampled online 0) runs the lane on the host.
+        if (remote.offlineFallback && cap && cap.online === 0) {
+          p = { where: "local", reason: `fallback to local: no pool agent online (${p.reason})` };
+        } else if (cap && Number.isInteger(cap.free)) {
+          if (cap.at !== capAt) { capAt = cap.at; capAdmits = 0; }
+          if (capAdmits >= cap.free && remoteRun.size < remoteMax) { notBefore.set(n, now() + Math.max(pollMs, 1)); return false; }
+        }
+        if (p.where === "remote" && remoteRun.size < remoteMax) { remoteRun.add(n); capAdmits++; placed.set(n, p); return true; }
+        if (p.where === "remote" && !remote.fallbackLocal) return false;
+        if (p.where === "remote") p = { where: "local", reason: `fallback to local: max_remote ${remoteMax} reached (${p.reason})` }; // #4256: hybrid runs it on the host
       } else {
         noteBudget(adm.reason);
         if (remote.onBudget !== "local" && !remote.fallbackLocal) { budgetStop = adm.reason; return false; }
@@ -493,16 +515,18 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     if (r?.sandbox && typeof r.sandbox === "object") {
       const prev = sandboxUse.get(n) ?? { minutes: 0, cost_usd: 0, attempts: 0 };
       const m = Number(r.sandbox.minutes) >= 0 ? Number(r.sandbox.minutes) : 0, c = Number(r.sandbox.cost_usd) >= 0 ? Number(r.sandbox.cost_usd) : 0;
-      sandboxUse.set(n, { minutes: Math.round((prev.minutes + m) * 10) / 10, cost_usd: Math.round((prev.cost_usd + c) * 1e6) / 1e6, attempts: prev.attempts + 1 });
+      const by = { ...(prev.by_agent ?? {}) }; // #4549: minutes per pool agent, over attempts
+      if (typeof r.sandbox.agent === "string" && r.sandbox.agent) by[r.sandbox.agent] = Math.round(((by[r.sandbox.agent] ?? 0) + m) * 10) / 10;
+      sandboxUse.set(n, { minutes: Math.round((prev.minutes + m) * 10) / 10, cost_usd: Math.round((prev.cost_usd + c) * 1e6) / 1e6, attempts: prev.attempts + 1, ...(Object.keys(by).length ? { by_agent: by } : {}) });
       try { remote?.onUsage?.(n, r.sandbox, rec); } catch { /* the batch total still counts it */ }
     }
-    if (sandboxUse.has(n)) row.sandbox = { ...sandboxUse.get(n) };
+    if (sandboxUse.has(n)) row.sandbox = { ...sandboxUse.get(n), ...(sandboxUse.get(n).by_agent ? { by_agent: { ...sandboxUse.get(n).by_agent } } : {}) };
     const done = () => { running.delete(n); runRecs.delete(n); releaseSlot(n); remoteRun.delete(n); };
     if (row.outcome === "dependency-open" && depList.length) {
       // #4387: a parked dependency is not pulled in again (fail-open on an unreadable label).
       let parked;
       for (const d of depList) {
-        if (results.get(d)?.outcome === "needs-human") { parked = d; break; }
+        if (["needs-human", "budget-exceeded"].includes(results.get(d)?.outcome)) { parked = d; break; } // #4505: an unrecovered overrun parks too
         if (set.has(d) || typeof issueLabels !== "function") continue;
         let names = [];
         try { names = (await issueLabels(d)) ?? []; } catch { names = []; }
@@ -587,7 +611,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
         try { await relabelNeedsHuman({ issue: n, evidence: evidence() }); } catch { /* best effort */ }
       }
     }
-    if (recoveryMax && (row.outcome === "needs-human" || row.outcome === "ci-pending")) {
+    if (recoveryMax && ["needs-human", "ci-pending", "budget-exceeded"].includes(row.outcome)) {
       let isConflicting = false;
       if (row.outcome === "ci-pending" && typeof conflicting === "function" && Number.isInteger(row.pr)) {
         try { isConflicting = (await conflicting(n, row.pr)) === true; } catch { isConflicting = false; }
@@ -607,9 +631,13 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       }
     }
     // #4302: a non-final recovery attempt left needs-human/ci-pending unlabelled for its successor; none is launched, so relabel once.
-    if (prior && prior.attempt < recoveryMax && ["needs-human", "ci-pending"].includes(row.outcome) && typeof relabelNeedsHuman === "function") {
+    if (prior && prior.attempt < recoveryMax && ["needs-human", "ci-pending", "budget-exceeded"].includes(row.outcome) && typeof relabelNeedsHuman === "function") {
       try { await relabelNeedsHuman({ issue: n, evidence: evidence() }); } catch { /* best effort */ }
     }
+    // #4505: a first-run turn overrun is unlabelled by its lane; no recovery follows (off or cap used), so the runner labels it once.
+    if (!prior && row.outcome === "budget-exceeded" && typeof relabelNeedsHuman === "function") {
+      try { await relabelNeedsHuman({ issue: n, evidence: `Implement turn budget overrun (\`budget.exceeded\`) not recovered in this batch:\n${String(row.detail ?? "")}` }); } catch { /* best effort */ }
+    }
     results.set(n, row);
     if (row.outcome === "merged" && drift?.onMerged && r?.structure && String(rec?.lane ?? r?.lane ?? "").startsWith("milestone/")) {
       save(); update(row);
@@ -851,6 +879,20 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       if (tripped && !running.size) { await drainAdds(); break; } // breaker: let running lanes finish, keep the rest pending for a resume
       if (cancelled && !running.size) { await drainAdds(); break; } // #4376: cancel: the rest end held for a resume
       if (budgetStop && !running.size) { await drainAdds(); break; } // execution budget (stop): the same, the rest end held
+      // #4525: a parked needs-human PR is merged with its moved base (seam `syncParked`); non-union conflicts are commented once per base sha.
+      const parkedPrs = () => (syncParked ? [...results].filter(([, x]) => x?.outcome === "needs-human" && Number.isInteger(x.pr)) : []);
+      if (syncParked && !signal?.aborted && (lastParkedSync === null || t - lastParkedSync >= syncEveryMs)) {
+        const rows = parkedPrs();
+        if (rows.length) lastParkedSync = t;
+        for (const [n, x] of rows) {
+          let r = null;
+          try { r = await syncParked({ issue: n, pr: x.pr, last: parkedBase.get(n) ?? null }); } catch { r = null; }
+          if (!r?.base || r.status === "error" || r.status === "unchanged") continue;
+          parkedBase.set(n, r.base);
+          if (r.status === "conflict") decided({ issue: n, what: `parked PR #${x.pr} conflicts with its base (${String(r.base).slice(0, 12)}) in ${(r.paths ?? []).join(", ")}`,
+            why: "base-sync of a parked needs-human PR merges only clean or pure list-addition conflicts", alternative: "resolve these paths by hand or rerun the issue on the new base" });
+        }
+      }
       // Wake for a delayed issue, the end of a usage-limit hold, or (with a live K) a poll.
       const waits = pending.map((n) => notBefore.get(n) ?? 0).filter((x) => x > t);
       if (holdUntil) waits.push(holdUntil);
@@ -859,6 +901,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       if (getParallel && pending.length) wake = Math.min(wake ?? pollMs, pollMs);
       if (offered.size && pending.length) wake = Math.min(wake ?? pollMs, pollMs); // a slot another batch frees
       if (getAdded && running.size) wake = Math.min(wake ?? pollMs, pollMs); // #4408: an add while only lanes run
+      if (syncParked && running.size && parkedPrs().length) wake = Math.min(wake ?? syncEveryMs, Math.max(0, syncEveryMs - (t - (lastParkedSync ?? t)))); // #4525
       if (tripped) wake = null;
       if (getCancelled && running.size && !cancelled) wake = Math.min(wake ?? pollMs, pollMs); // #4376: notice a cancel while lanes run
       if (running.size) {
@@ -916,7 +959,7 @@ export function formatOutcomeLists(rows) {
   for (const r of rows ?? []) {
     if (!r || r.recovered) continue;
     const human = r.outcome === "needs-human" && classifyNeedsHuman(r) === "human";
-    if (!human && (r.outcome === "needs-human" || r.recovery)) out.push(`unrecovered: #${r.issue} (${r.code ?? r.recovery?.code ?? "unclassified"}: ${one(r.recovery ? `recovery ${r.recovery.code} ended ${r.recovery.outcome}: ${r.recovery.detail}` : r.detail)})`);
+    if (!human && (r.outcome === "needs-human" || r.outcome === "budget-exceeded" || r.recovery)) out.push(`unrecovered: #${r.issue} (${r.code ?? r.recovery?.code ?? "unclassified"}: ${one(r.recovery ? `recovery ${r.recovery.code} ended ${r.recovery.outcome}: ${r.recovery.detail}` : r.detail)})`);
   }
   const esc = (rows ?? []).filter((r) => r?.outcome === "needs-human" && classifyNeedsHuman(r) === "human");
   const parked = formatParkedLine(rows); // #4389: one line for every parked post-deploy follow-up, never an escalation
@@ -964,6 +1007,9 @@ export function formatSandboxSummary(rows, { budget = null, day = null } = {}) {
   if (!sb.length) return null;
   const sum = (f) => sb.reduce((a, r) => a + (Number(f(r)) || 0), 0);
   const parts = [`sandbox: ${sb.length} lane${sb.length === 1 ? "" : "s"}, ${sum((r) => r.sandbox.minutes).toFixed(1)} min, $${sum((r) => r.sandbox.cost_usd).toFixed(2)} (token cost $${sum((r) => r.cost_usd).toFixed(2)})`];
+  const agents = {}; // #4549: remote lane minutes per pool agent
+  for (const r of sb) for (const [a, m] of Object.entries(r.sandbox.by_agent ?? {})) agents[a] = (agents[a] ?? 0) + (Number(m) || 0);
+  if (Object.keys(agents).length) parts.push(`by agent: ${Object.entries(agents).sort((x, y) => y[1] - x[1] || x[0].localeCompare(y[0])).map(([a, m]) => `${a} ${m.toFixed(1)} min`).join(", ")}`);
   const caps = [];
   if (budget?.batchMinutes != null) caps.push(`batch ${budget.batchMinutes} min`);
   if (budget?.batchUsd != null) caps.push(`batch $${budget.batchUsd}`);