forgedock 1.32.1 → 1.34.0

package/scripts/hotspots.test.sh

@@ -27,7 +27,7 @@ echo y >> big.py; lines small.py 10; commit c2
 OUT="$(bash "$S" big.py ./small.py missing/gone.py)"; rc=$?
 eq "rc" "$rc" 0
 eq "defaults" "$(q '[.enabled,.file_lines,.growth_lines]')" '[true,2000,150]'
-eq "big facts" "$(q '.files[0]')" '{"path":"big.py","lines":2102,"commits_90d":2,"hotspot":4204,"over":true,"excluded":false,"base_lines":null,"growth":null}'
+eq "big facts" "$(q '.files[0]')" '{"path":"big.py","lines":2102,"commits_90d":2,"hotspot":4204,"over":true,"generated":false,"excluded":false,"base_lines":null,"growth":null}'
 eq "small facts (./ stripped)" "$(q '.files[1] | [.path,.lines,.commits_90d,.over]')" '["small.py",10,1,false]'
 eq "missing file" "$(q '.files[2] | [.path,.lines,.commits_90d,.over]')" '["missing/gone.py",0,0,false]'
 OUT="$(bash "$S")"; eq "no paths" "$(q '.files')" '[]'
@@ -49,6 +49,13 @@ printf 'gen/** linguist-generated\nvendor/** linguist-vendored=true\n' > .gitatt
 commit gen
 OUT="$(bash "$S" gen/api.py vendor/lib/x.js dist/bundle.js big.py)"
 eq "attr exclusions" "$(q '[.files[] | .excluded]')" '[true,true,false,false]'
+eq "attr generated" "$(q '[.files[] | .generated]')" '[true,false,false,false]'
+# forge#4519: a generated-file header in the first 5 lines marks the file generated
+{ echo '# @generated'; i=0; while [ $i -lt 2500 ]; do echo "l$i"; i=$((i+1)); done; } > hdr.py
+{ i=0; while [ $i -lt 2500 ]; do echo "l$i"; i=$((i+1)); done; echo '# DO NOT EDIT'; } > late.py
+OUT="$(bash "$S" hdr.py late.py)"
+rm -f hdr.py late.py
+eq "header generated" "$(q '[.files[] | [.generated,.excluded]]')" '[[true,true],[false,false]]'
 if [ "$HAVE_YQ" = 1 ]; then
   printf 'maintenance:\n  hotspot:\n    file_lines: 100\n    growth_lines: 5\n    exclude_globs: ["dist/*", "*.lock"]\n' > forge.yaml
   OUT="$(bash "$S" dist/bundle.js small.py big.py)"
@@ -60,7 +67,19 @@ if [ "$HAVE_YQ" = 1 ]; then
   eq "opt-out" "$(q '[.enabled,.files]')" '[false,[]]'
   printf 'maintenance:\n  hotspot:\n    file_lines: nope\n' > forge.yaml
   OUT="$(bash "$S" big.py)"; eq "bad value falls back" "$(q '.file_lines')" 2000
-  rm -f forge.yaml
+  # forge#4519: maintenance.generated_paths marks bot-owned files generated (and so excluded), even over the threshold
+  mkdir -p web/public/openapi-versions
+  lines web/public/openapi.json 2500; lines web/public/openapi-versions/3.29.2.json 2500
+  printf 'maintenance:\n  generated_paths: ["web/public/openapi*.json", "web/public/openapi-versions/*"]\n' > forge.yaml
+  OUT="$(bash "$S" web/public/openapi.json web/public/openapi-versions/3.29.2.json big.py gen/api.py)"
+  eq "generated_paths reported" "$(q '.generated_paths')" '["web/public/openapi*.json","web/public/openapi-versions/*"]'
+  eq "generated_paths: generated" "$(q '[.files[] | .generated]')" '[true,true,false,true]'
+  eq "generated_paths: excluded" "$(q '[.files[] | .excluded]')" '[true,true,false,true]'
+  printf 'maintenance:\n  generated_paths: ["*.json"]\n  hotspot:\n    enabled: false\n' > forge.yaml
+  OUT="$(bash "$S" big.py)"; eq "generated_paths with the gate off" "$(q '[.enabled,.generated_paths,.files]')" '[false,["*.json"],[]]'
+  printf 'maintenance:\n  generated_paths: nope\n' > forge.yaml
+  OUT="$(bash "$S" big.py)"; eq "bad generated_paths falls back" "$(q '.generated_paths')" '[]'
+  rm -rf forge.yaml web
 else
   echo "SKIP: forge.yaml cases need mikefarah yq v4"
 fi
@@ -93,7 +112,7 @@ done
 eq "30k exact commits" "$(q '[.files[] | .commits_90d]')" '[300,60,60,60]'
 eq "30k exact lines" "$(q '[.files[] | .lines]')" '[1,1,1,1]'
 if [ "$best" -lt 1000 ]; then ok; else bad "30k-commit run took ${best} ms (limit 1000)"; fi
-grep -q '"rev-list"' "$TMP/trace.json" && ok || bad "git trace not captured"
+if grep -q '"rev-list"' "$TMP/trace.json"; then ok; else bad "git trace not captured"; fi
 if grep -qE '"(cat-file|show)"' "$TMP/trace.json"; then bad "blob read without --base"; else ok; fi
 if [ -e "$TMP/net.log" ]; then bad "network tool invoked: $(tr '\n' ' ' < "$TMP/net.log")"; else ok; fi
 

package/scripts/review-finalize.sh

@@ -942,10 +942,12 @@ do_file_prepare() {
         # Title (defense in depth: strip command substitution so the raw title stays readable if it round-trips through an eval-based consumer).
         ISSUE_TITLE="fix: ${F_TITLE} (review finding — PR #${PR_NUMBER})"
         ISSUE_TITLE=$(printf '%s' "$ISSUE_TITLE" | tr '\t\n`' "  '" | sed 's/\$(/$ (/g')
+        # The title is passed WITHOUT the constant "(review finding — PR #N)" suffix: its tokens (review, finding, the PR number) would make
+        # any two findings of one PR a >=3-token match and map a finding to its neighbour's issue (#4569).
         # Step 0: deterministic title dedup (scripts/issue-dedup.sh; also excludes the issue this PR fixes: it is about to be closed, so a
         # finding matched to it is tracked nowhere). Unresolved helper: "not deduped"; NEVER exit 1 (which means "duplicate, skip").
         if [ -n "$DEDUP_SCRIPT" ]; then
-            DEDUP_RESULT=$(bash "$DEDUP_SCRIPT" "$ISSUE_TITLE" "-R $REPO" ${MERGE_ISSUE:+--exclude "$MERGE_ISSUE"} 2>&1); DEDUP_EXIT=$?
+            DEDUP_RESULT=$(bash "$DEDUP_SCRIPT" "fix: ${F_TITLE}" "-R $REPO" ${MERGE_ISSUE:+--exclude "$MERGE_ISSUE"} 2>&1); DEDUP_EXIT=$?
         else
             DEDUP_RESULT=""; DEDUP_EXIT=0
         fi
@@ -965,6 +967,20 @@ do_file_prepare() {
             else
                 # A CLOSED review-finding at the same location +-5 lines is a regression: create with a warning and elevate to priority:P1.
                 [ -n "$F_FILE" ] && REGRESSION=$(line_match "$CLOSED_JSON" "$F_FILE" "$F_LINE" "$F_TITLE" 0)
+                # DELTA: the earlier pass's finding is credited and its own issue is closed (fixed): resolved, never re-filed (#4569).
+                # Only an issue this PR's review filed counts (title suffix `PR #N)` or a `**Source**: PR #N` line); a closed finding of
+                # another PR at the same location stays a regression, or any closed issue nearby could drop a new blocker from the verdict.
+                OWN_CLOSED=""
+                if [ -n "$REGRESSION" ] && [ "$REVIEW_MODE" = "DELTA" ]; then
+                    OWN_CLOSED=$(printf '%s' "$CLOSED_JSON" | jq -r --argjson n "$REGRESSION" --arg pr "$PR_NUMBER" '
+                        .[] | select(.number == $n)
+                        | select((.title // "" | endswith("PR #" + $pr + ")")) or ((.body // "") | test("(^|\\n)\\*\\*Source\\*\\*: PR #" + $pr + "([^0-9]|$)")))
+                        | .number' 2>/dev/null | head -1)
+                fi
+                if [ -n "$OWN_CLOSED" ]; then
+                    ACTION="skip-resolved"; DEDUP_OF="$REGRESSION"; REGRESSION=""
+                    echo "RESOLVED: ${F_FILE}:${F_LINE} was fixed in closed issue #${DEDUP_OF} (delta pass)"
+                fi
                 [ -z "$REGRESSION" ] || echo "REGRESSION: Previously fixed in #${REGRESSION} — elevating priority"
             fi
         fi

package/scripts/review-finalize.test.sh

@@ -738,6 +738,47 @@ mkfind G-1 CONFIRMED MEDIUM a.py 10 "Duplicate of the linked issue"; putfind 1
 jq '.findings |= map(. + {class: "ISSUE", disposition: "ISSUE x"})' "$WORK/out/findings.json" > "$WORK/out/classified.json"
 run "$GOOD" file-prepare; want "linked issue excluded" '.items[0].action' worklist.json "file"
 
+# #4569: the title suffix never makes two findings of one PR dedup to each other; a DELTA closed match is resolved, a FULL one a regression
+fp_setup
+echo '[{"number":60,"title":"fix: credential helper hands token to any host (review finding — PR #7)","body":"see z.py:90"}]' > "$FIX/issues-open.json"
+echo '[{"number":61,"title":"fix: DCO exemption only on staging (review finding — PR #7)","body":"see c.py:5"}]' > "$FIX/issues-closed.json"
+mkfind K-1 CONFIRMED HIGH c.py 5 "DCO exemption only on staging"
+putfind 1
+jq '.findings |= map(. + {class: "ISSUE", disposition: "ISSUE x"})' "$WORK/out/findings.json" > "$WORK/out/classified.json"
+run "$GOOD" file-prepare
+want "full mode: closed own issue is a regression, not skipped" '.items[0] | [.action, (.regression_of | tostring)] | join(",")' worklist.json "file,61"
+fp_setup; mkctx 1 DELTA "$OLD_SHA" 12
+echo '[{"number":60,"title":"fix: credential helper hands token to any host (review finding — PR #7)","body":"see z.py:90"}]' > "$FIX/issues-open.json"
+echo '[{"number":61,"title":"fix: DCO exemption only on staging (review finding — PR #7)","body":"see c.py:5"}]' > "$FIX/issues-closed.json"
+mkfind K-1 CONFIRMED HIGH c.py 5 "DCO exemption only on staging"; putfind 1
+jq '.findings |= map(. + {class: "ISSUE", disposition: "ISSUE x"})' "$WORK/out/findings.json" > "$WORK/out/classified.json"
+run "$GOOD" file-prepare
+want "delta mode: closed own issue is resolved by that issue" '.items[0] | [.action, (.dedup_of | tostring), (.regression_of | tostring)] | join(",")' worklist.json "skip-resolved,61,null"
+# a closed finding of ANOTHER PR at the same location is no proof this finding was fixed: it stays a regression and blocks
+fp_setup; mkctx 1 DELTA "$OLD_SHA" 12
+echo '[]' > "$FIX/issues-open.json"
+echo '[{"number":62,"title":"fix: unrelated old defect (review finding — PR #3)","body":"see c.py:7"}]' > "$FIX/issues-closed.json"
+mkfind K-3 CONFIRMED HIGH c.py 5 "Brand new defect"; putfind 1
+jq '.findings |= map(. + {class: "ISSUE", disposition: "ISSUE x"})' "$WORK/out/findings.json" > "$WORK/out/classified.json"
+run "$GOOD" file-prepare
+want "delta mode: another PR's closed issue is a regression, never resolved" '.items[0] | [.action, (.regression_of | tostring)] | join(",")' worklist.json "file,62"
+# a **Source**: PR #N line marks the issue as this PR's own
+fp_setup; mkctx 1 DELTA "$OLD_SHA" 12
+echo '[]' > "$FIX/issues-open.json"
+printf '[{"number":63,"title":"fix: renamed title","body":"**Source**: PR #7 — x\\nsee c.py:5"}]' > "$FIX/issues-closed.json"
+mkfind K-4 CONFIRMED HIGH c.py 5 "Renamed defect"; putfind 1
+jq '.findings |= map(. + {class: "ISSUE", disposition: "ISSUE x"})' "$WORK/out/findings.json" > "$WORK/out/classified.json"
+run "$GOOD" file-prepare
+want "delta mode: Source line marks own closed issue" '.items[0] | [.action, (.dedup_of | tostring)] | join(",")' worklist.json "skip-resolved,63"
+# the dedup helper receives the title without the shared suffix
+DEDUP_LOG="$WORK/dedup-args"; : > "$DEDUP_LOG"
+printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$1" >> "%s"\nexit 0\n' "$DEDUP_LOG" > "$GOOD/scripts/issue-dedup.sh"
+fp_setup; mkfind K-2 CONFIRMED MEDIUM d.py 7 "Some other defect"; putfind 1
+jq '.findings |= map(. + {class: "ISSUE", disposition: "ISSUE x"})' "$WORK/out/findings.json" > "$WORK/out/classified.json"
+run "$GOOD" file-prepare
+[ "$(cat "$DEDUP_LOG")" = "fix: Some other defect" ] && ok || bad "dedup helper gets the suffix-less title: '$(cat "$DEDUP_LOG")'"
+mkroot "$GOOD"
+
 # pattern recurrence: exempt severities skip, a prior instance in the same subsystem consolidates
 fp_setup
 echo '[{"number":50,"body":"x commands/work-on/z.md <!-- FORGE:PATTERN: slug-one -->","labels":[],"stateReason":"COMPLETED"}]' > "$FIX/issues-all.json"

package/scripts/review-pr-domain-map.test.sh

@@ -93,7 +93,7 @@ done
 if grep -qF 'marker domain' "$PERSONAS/protocols.md"; then ok; else bad "protocols.md does not define the marker domain"; fi
 
 # Test 7: the roster regexes in delta_roster must equal the per-domain file regexes of the diff slices (both in scripts/review-prepare.sh since #3841),
-# and the slice function must fall back to the full file list and full diff for a domain with no hit
+# and the slice function must NOT fall back to the full file list or full diff for a domain with no hit (#4573)
 for pair in auth:auth billing:billing concurrency:concurrency database:database infra:infra scraper:scraper frontend:frontend api:api; do
   var=${pair%%:*}; dom=${pair#*:}
   a=$(grep -E "^    slice $var " "$PREPARE" | head -n 1 | sed -n 's/.* "\([^"]*\)"$/\1/p')
@@ -101,7 +101,7 @@ for pair in auth:auth billing:billing concurrency:concurrency database:database
   if [ -z "$a" ] || [ -z "$b" ]; then bad "could not extract $var pattern (slice='$a' delta_roster='$b')"
   elif [ "$a" = "$b" ]; then ok; else bad "$var regex drifted: slice='$a' delta_roster='$b'"; fi
 done
-if grep -qF '[ -n "$paths" ] || paths="$SLICE_FILES_SRC"' "$PREPARE" && grep -qF '[ -n "$body" ] || body="$FULL_DIFF"' "$PREPARE"; then ok; else bad "prepare slice() lacks the empty-slice fallback"; fi
+if grep -qF '[ -n "$paths" ] || paths="$SLICE_FILES_SRC"' "$PREPARE"; then bad "prepare slice() must not fall back to the full file list"; elif grep -qF '[ -n "$body" ] || body="$FULL_DIFF"' "$PREPARE"; then bad "prepare slice() must not fall back to the full diff"; elif grep -qF '[ -n "$body" ] || body="# No diff blocks' "$PREPARE"; then ok; else bad "prepare slice() lacks the empty-slice note"; fi
 
 echo "review-pr-domain-map: $pass passed, $fail failed"
 [ "$fail" -eq 0 ]

package/scripts/review-pr-staging-scope.test.sh

@@ -287,14 +287,16 @@ gh11() {
   esac
 }
 [ "$(grep -c '^# BEGIN bundle-pr-kind$' "$PRE")" -eq 2 ] && [ "$(awk '/^# BEGIN bundle-pr-kind$/{f=1;n++} f{print > ("'"$TMP"'/kind" n ".sh")} /^# END bundle-pr-kind$/{f=0}' "$PRE"; cmp -s "$TMP/kind1.sh" "$TMP/kind2.sh" && echo same)" = same ] && ok || bad "0A and 0B.1 must carry identical bundle_pr_kind blocks"
+awk '/^# BEGIN gh-retry$/{f=1;next} /^# END gh-retry$/{f=0} f' "$PRE" > "$TMP/ghretry.sh"   # bundle_pr_kind calls gh_retry (forge#4572)
+[ -s "$TMP/ghretry.sh" ] && ok || bad "gh-retry block not found"
 awk '/^# BEGIN bundle-pr-set$/{f=1;next} /^# END bundle-pr-set$/{f=0} f' "$PRE" | sed 's/{GH_REPO}/o\/r/g' > "$TMP/prset.sh"
 [ -s "$TMP/prset.sh" ] && ok || bad "bundle-pr-set block not found in Phase 0A"
-OUT11=$( gh() { gh11 "$@"; }; GH_REPO=o/r; BUNDLE_PRS="5 6 28668 77 90"; MERGE_PRS="90"; . "$TMP/prset.sh"; echo $ALL_PR_NUMBERS "|$SKIPPED_ISSUES" )
+OUT11=$( gh() { gh11 "$@"; }; GH_REPO=o/r; BUNDLE_PRS="5 6 28668 77 90"; MERGE_PRS="90"; FORGE_GH_RETRY_SLEEP=0; . "$TMP/ghretry.sh"; . "$TMP/prset.sh"; echo $ALL_PR_NUMBERS "|$SKIPPED_ISSUES" )
 [ "$OUT11" = "5 6 77 90 | 28668" ] && ok || bad "0A must drop the confirmed issue and keep PRs, merge PRs and unclassifiable numbers (got '$OUT11')"
 awk '/^# BEGIN bundle-scope-loop$/{f=1;next} /^# END bundle-scope-loop$/{f=0} f' "$PRE" > "$TMP/loop.sh"
 [ -s "$TMP/loop.sh" ] && ok || bad "bundle-scope-loop block not found in 0B.1"
 scope11() { # $1 = ALL_PR_NUMBERS; prints "<SCOPE_MODE> <REVIEWED_PR_COUNT>" then the loop output
-  ( gh() { gh11 "$@"; }; bundle_delta_credit() { DELTA_COMMITS=""; DELTA_FULL=0; }; . "$TMP/kind1.sh"
+  ( gh() { gh11 "$@"; }; bundle_delta_credit() { DELTA_COMMITS=""; DELTA_FULL=0; }; FORGE_GH_RETRY_SLEEP=0; . "$TMP/ghretry.sh"; . "$TMP/kind1.sh"
     SCOPE_MODE=full; REVIEWED_COMMITS=""; REVIEWED_MERGES=""; REVIEWED_PR_COUNT=0; _PF="$TMP/pf11"; : > "$_PF"
     TRUSTED_SCRIPT="$TC" ALL_PR_NUMBERS="$1" PR_NUMBER=9 GH_REPO=o/r _SD="$TMP" REVIEW_DELTA_SCRIPT=""
     LOG11=$(. "$TMP/loop.sh"; echo "@@$SCOPE_MODE $REVIEWED_PR_COUNT"); echo "${LOG11##*@@}"; echo "${LOG11%@@*}" )

package/scripts/review-prepare.sh

@@ -473,9 +473,18 @@ if [ -n "$DELTA_FROM_OPT" ]; then
         # an agent body with a findings block for <from>, a post-panel-guard proof naming <from> (staging summary, synthesized
         # block, or a # PR Review Summary whose Agents count matches) and no degraded marker after its first agent body.
         _dv="error"
+        # forge#4573: a panel that delivered every launched domain at <from> but was never finalized (the head moved) is complete too.
+        # The launched list is the PR-keyed file the dispatch persisted; empty or unreadable means no such proof. It counts only when
+        # its .head sidecar names <from>: a later dispatch at another head rewrites the list, so it no longer describes the panel at <from>.
+        _dlf="${FORGE_SCRATCHPAD:-$PWD/.forge-scratch}/${PR_NUMBER}_launched_review_agents"
+        _dl="[]"
+        if [ "$(sed -n 1p "${_dlf}.head" 2>/dev/null)" = "$DELTA_FROM_OPT" ]; then
+            _dl=$(grep -E '^[a-z0-9-]+$' "$_dlf" 2>/dev/null | sort -u | jq -R -s -c 'split("\n") | map(select(length > 0))' 2>/dev/null) || _dl="[]"
+            [ -n "$_dl" ] || _dl="[]"
+        fi
         if [ -n "$TRUSTED_SCRIPT" ] && [ -n "$COMMENTS_JSON" ]; then
             _db=$(printf '%s' "$COMMENTS_JSON" | bash "$TRUSTED_SCRIPT" bodies '^<!-- FORGE:REVIEW-AGENT:[a-z0-9-]+ -->|^<!-- REVIEW-FINDINGS-SYNTHESIZED-START -->|# PR Review Summary|^<!-- FORGE:GATE_(PASS|FAILURE) -->|<!-- FORGE:GATE_FAILURE:TYPE=review-panel-integrity|<!-- FORGE:REVIEW_DEGRADED|<!-- FORGE:REVIEW_BLOCKED' 2>/dev/null) \
-                && _dv=$(printf '%s\n' "$_db" | jq -s -r --arg f "$DELTA_FROM_OPT" '
+                && _dv=$(printf '%s\n' "$_db" | jq -s -r --arg f "$DELTA_FROM_OPT" --argjson L "$_dl" '
                     def shas($t; $re): [ $t | scan($re) | .[0] ];
                     def one($a): if ($a | length) == 1 then $a[0] else null end;
                     def rsha: "(?:^|\\n)Reviewed-SHA: ([0-9a-f]{40}|[0-9a-f]{64})\\r?(?:\\n|$)";
@@ -494,13 +503,15 @@ if [ -n "$DELTA_FROM_OPT" ]; then
                                 and one(shas($t; "\\*\\*Agents\\*\\*: ([0-9]+)")) == ($nd | tostring))) ] | length) as $proof
                         | ([ $E[] | select(.key > $first)
                              | select(.value | test("<!-- FORGE:GATE_FAILURE:TYPE=review-panel-integrity|<!-- FORGE:REVIEW_DEGRADED|<!-- FORGE:REVIEW_BLOCKED")) ] | length) as $deg
-                        | if $deg > 0 then "degraded" elif $proof == 0 then "no-proof" else "ok" end
+                        | if $deg > 0 then "degraded" elif $proof > 0 then "ok"
+                          elif ($L | length) > 0 and ([ $L[] | . as $d | select($AG | any(.d == $d)) ] | length) == ($L | length) then "ok"
+                          else "no-proof" end
                       end' 2>/dev/null) || _dv="error"
         fi
         case "$_dv" in
             ok) REVIEW_MODE="DELTA"; DELTA_FROM="$DELTA_FROM_OPT" ;;
             no-agent) block "--delta-from ${DELTA_FROM_OPT}: no trusted FORGE:REVIEW-AGENT comment with a findings block for that head, no earlier pass to credit: run a full review" ;;
-            no-proof) block "--delta-from ${DELTA_FROM_OPT}: no trusted proof that the earlier panel completed (staging summary, synthesized block or PR Review Summary for that head): run a full review" ;;
+            no-proof) block "--delta-from ${DELTA_FROM_OPT}: no trusted proof that the earlier panel completed (staging summary, synthesized block or PR Review Summary for that head, nor every launched domain delivered at it): run a full review" ;;
             degraded) block "--delta-from ${DELTA_FROM_OPT}: the earlier pass is degraded (review-panel-integrity / REVIEW_DEGRADED / REVIEW_BLOCKED after its agents): run a full review" ;;
             *) block "--delta-from ${DELTA_FROM_OPT}: could not read the trusted review comments, no earlier pass to credit: run a full review" ;;
         esac
@@ -587,19 +598,31 @@ if [ "$REVIEW_MODE" != "BASE_SYNC_ONLY" ]; then
     # slice <domain> <diff-header regex|ALL> <file-path regex|ALL>
     slice() {
         local dom="$1" dre="$2" fre="$3" body paths tmp df="$OUT_DIR/slice-${REVIEW_SHA_SHORT:-unresolved}-$1.diff"
-        if [ "$dre" = "ALL" ]; then body="$FULL_DIFF"
-        else
-            body=$(printf '%s\n' "$FULL_DIFF" | awk -v re="$dre" '/^diff --git/ { in_block=0 } $0 ~ re { in_block=1 } in_block { print }')
-            [ -n "$body" ] || body="$FULL_DIFF"
-        fi
+        # forge#4573: whole `diff --git` blocks only. A block over the per-file cap, or one that would push the slice over the total
+        # cap, is listed as omitted (never cut mid-file). No fallback to the full diff: an unmatched domain gets a note, not a copy.
+        # The security slice (ALL) lists .github/ blocks last so CI files cannot crowd out source.
+        body=$(printf '%s\n' "$FULL_DIFF" | awk -v re="$dre" -v cap="${REVIEW_SLICE_CAP:-102400}" -v fcap="${REVIEW_SLICE_FILE_CAP:-20000}" '
+            /^diff --git/ { n++; hdr[n] = $0; blk[n] = "" }
+            n { blk[n] = blk[n] $0 "\n" }
+            END {
+                for (pass = 1; pass <= 2; pass++) for (i = 1; i <= n; i++) {
+                    ci = (hdr[i] ~ /^diff --git a\/\.github\//) ? 2 : 1
+                    if (re == "ALL" ? ci != pass : (pass == 2 || hdr[i] !~ re)) continue
+                    l = length(blk[i])
+                    if (l > fcap || used + l > cap) { split(hdr[i], h, " "); om = om "# OMITTED (too large for this slice, read it from the head checkout): " substr(h[3], 3) "\n"; continue }
+                    out = out blk[i]; used += l
+                }
+                printf "%s%s", om, out
+            }')
+        [ -n "$body" ] || body="# No diff blocks for this domain in the review range."
         if [ "$fre" = "ALL" ]; then paths="$SLICE_FILES_SRC"
-        else paths=$(printf '%s\n' "$SLICE_FILES_SRC" | grep -iE "$fre" || echo ""); [ -n "$paths" ] || paths="$SLICE_FILES_SRC"; fi
-        # 100K-char cap, same as the runner's tool-result cap
-        if [ "${#body}" -gt 102400 ]; then body="$(printf '%s' "$body" | head -c 102400)"$'\n'"... [TRUNCATED — diff exceeded 100K chars; focus on the files listed]"; fi
+        else paths=$(printf '%s\n' "$SLICE_FILES_SRC" | grep -iE "$fre" || echo ""); fi
         # Publish atomically: temp file in $OUT_DIR (same filesystem) then rename, so a concurrent reader sees nothing or the whole file.
         tmp=$(mktemp "$OUT_DIR/.slice-XXXXXX") || { echo "review-prepare: cannot create temp slice in $OUT_DIR" >&2; exit 2; }
         if printf '%s\n' "$body" > "$tmp" && chmod 644 "$tmp"; then mv -f "$tmp" "$df"; else rm -f "$tmp"; echo "review-prepare: cannot write slice $df" >&2; exit 2; fi
-        SLICES_JSON=$(printf '%s' "$SLICES_JSON" | jq -c --arg d "$dom" --arg df "$df" --arg p "$paths" '. + {($d): {paths: ($p | split("\n") | map(select(length > 0))), diff_file: $df}}')
+        # paths can exceed the 128 KiB per-argument limit on a huge PR: pass it as a file, not argv
+        printf '%s' "$paths" > "$TMP_DIR/slice-paths" || { echo "review-prepare: cannot write $TMP_DIR/slice-paths" >&2; exit 2; }
+        SLICES_JSON=$(printf '%s' "$SLICES_JSON" | jq -c --arg d "$dom" --arg df "$df" --rawfile p "$TMP_DIR/slice-paths" '. + {($d): {paths: ($p | split("\n") | map(select(length > 0))), diff_file: $df}}')
     }
     slice security ALL ALL
     slice auth '^diff --git.*/(auth|session|jwt|oauth|permission|middleware|login|token)' "auth|session|login|logout|jwt|oauth|token|user|permission|middleware"
@@ -617,43 +640,55 @@ fi
 STATUS="OK"; [ -n "$BLOCKERS" ] && STATUS="BLOCKED"
 j_lines() { printf '%s' "${1}" | jq -R -s -c 'split("\n") | map(select(length > 0))'; }
 j_words() { printf '%s' "${1}" | jq -R -s -c 'split(" ") | map(select(length > 0))'; }
+# Everything that scales with the PR goes to the final jq through a file (--slurpfile/--rawfile): argv caps one argument at 128 KiB.
+jf_lines() { j_lines "$2" > "$TMP_DIR/$1.json"; }
+jf_words() { j_words "$2" > "$TMP_DIR/$1.json"; }
+jf_raw() { printf '%s' "$2" > "$TMP_DIR/$1.txt"; }
+{ jf_lines blockers "$BLOCKERS" && jf_lines p2 "$P2_FINDINGS" && jf_lines asm "$ASSUMPTIONS" && jf_lines dfiles "$DELTA_FILES" && jf_lines full_files "$FILES" \
+    && printf '%s' "$SLICES_JSON" > "$TMP_DIR/slices.json" \
+    && jf_raw churn "$CHURN_CONTEXT" && jf_raw pctx "$PROJECT_CONTEXT" && jf_raw tmono "$MONOLITHIC_CATALOG" \
+    && jf_raw d_auth "$DOMAIN_CONTEXT_AUTH" && jf_raw d_billing "$DOMAIN_CONTEXT_BILLING" && jf_raw d_conc "$DOMAIN_CONTEXT_CONCURRENCY" \
+    && jf_raw d_infra "$DOMAIN_CONTEXT_INFRA" && jf_raw d_db "$DOMAIN_CONTEXT_DATABASE" && jf_raw d_fe "$DOMAIN_CONTEXT_FRONTEND" \
+    && jf_raw d_sec "$DOMAIN_CONTEXT_SECURITY" && jf_raw d_api "$DOMAIN_CONTEXT_API" && jf_raw d_scr "$DOMAIN_CONTEXT_SCRAPING" \
+    && jf_raw i_auth "$IDX_AUTH" && jf_raw i_billing "$IDX_BILLING" && jf_raw i_db "$IDX_DATABASE" && jf_raw i_api "$IDX_API" \
+    && jf_raw i_fe "$IDX_FRONTEND" && jf_raw i_infra "$IDX_INFRA"; } || { echo "review-prepare: cannot write context inputs under $TMP_DIR" >&2; exit 2; }
 CTX=$(jq -n \
-    --arg status "$STATUS" --argjson blockers "$(j_lines "$BLOCKERS")" \
+    --arg status "$STATUS" --slurpfile blockers "$TMP_DIR/blockers.json" \
     --argjson pr_number "$PR_NUMBER" --arg repo "$REPO" --arg title "$TITLE" --arg author "$PR_AUTHOR" --arg head "$HEAD" --arg base "$BASE" \
     --arg sha "$REVIEW_SHA" --arg sha7 "$REVIEW_SHA_SHORT" --argjson adds "$ADDITIONS" --argjson dels "$DELETIONS" --arg nfiles "${NFILES:-}" --arg first "$IS_FIRST_TIME_CONTRIBUTOR" \
     --arg s2m "$IS_STAGING_TO_MAIN" --arg m2s "$IS_MILESTONE_TO_STAGING" --arg rfb "$REQUIRES_FULL_BUILD" --arg thorough "$THOROUGH" \
     --arg mh "$MERGE_HEALTH" --arg mhs "$MERGE_HEALTH_STATE" --argjson mhr "$MERGE_RETRY" \
     --argjson services "$(j_words "$SERVICES")" --argjson domains "$(j_words "$DOMAINS")" \
-    --arg tsb "$TS_BUILD" --arg pyf "$PY_FORMAT" --arg bcs "$BUILD_CONFIG_STATUS" --argjson p2 "$(j_lines "$P2_FINDINGS")" \
-    --argjson asm "$(j_lines "$ASSUMPTIONS")" --argjson risk "$(j_words "$RISK")" --arg churn "$CHURN_CONTEXT" --arg churn_esc "$CHURN_ESCALATION" --arg danger "$DANGER" \
+    --arg tsb "$TS_BUILD" --arg pyf "$PY_FORMAT" --arg bcs "$BUILD_CONFIG_STATUS" --slurpfile p2 "$TMP_DIR/p2.json" \
+    --slurpfile asm "$TMP_DIR/asm.json" --argjson risk "$(j_words "$RISK")" --rawfile churn "$TMP_DIR/churn.txt" --arg churn_esc "$CHURN_ESCALATION" --arg danger "$DANGER" \
     --argjson sa "$SCORE_AUTH" --argjson sb "$SCORE_BILLING" --argjson sc "$SCORE_CONCURRENCY" --argjson sd "$SCORE_DATABASE" --argjson si "$SCORE_INFRA" \
     --argjson ss "$SCORE_SECURITY" --argjson ssc "$SCORE_SCRAPING" --argjson sf "$SCORE_FRONTEND" --argjson sap "$SCORE_API" \
     --arg cissue "$ISSUE_NUM" --arg cflags "$CONTRACT_RISK_FLAGS" \
     --arg rdepth "$REVIEW_DEPTH" --arg rweight "$REVIEW_WEIGHT" --arg rtier "$ROSTER_TIER" --arg rreason "$ROSTER_REASON" --argjson agents "$(j_words "$SELECTED_AGENTS")" \
-    --arg dmode "$REVIEW_MODE" --arg dfrom "$DELTA_FROM" --arg dcarried "$CARRIED_FROM" --argjson drounds "$FULL_ROUNDS" --argjson dfiles "$(j_lines "$DELTA_FILES")" \
-    --arg pname "$PROJECT_NAME" --arg pctx "$PROJECT_CONTEXT" --arg scraping_on "$SCRAPING_ON" --arg rpath "$REPO_PATH" \
-    --arg d_auth "$DOMAIN_CONTEXT_AUTH" --arg d_billing "$DOMAIN_CONTEXT_BILLING" --arg d_conc "$DOMAIN_CONTEXT_CONCURRENCY" --arg d_infra "$DOMAIN_CONTEXT_INFRA" \
-    --arg d_db "$DOMAIN_CONTEXT_DATABASE" --arg d_fe "$DOMAIN_CONTEXT_FRONTEND" --arg d_sec "$DOMAIN_CONTEXT_SECURITY" --arg d_api "$DOMAIN_CONTEXT_API" --arg d_scr "$DOMAIN_CONTEXT_SCRAPING" \
-    --arg tsrc "$TEMPLATE_SOURCE" --arg tbase "$TEMPLATE_BASE" --arg tmono "$MONOLITHIC_CATALOG" \
-    --arg i_auth "$IDX_AUTH" --arg i_billing "$IDX_BILLING" --arg i_db "$IDX_DATABASE" --arg i_api "$IDX_API" --arg i_fe "$IDX_FRONTEND" --arg i_infra "$IDX_INFRA" \
-    --argjson slices "$SLICES_JSON" --argjson full_files "$(j_lines "$FILES")" '
-    {schema_version: 1, status: $status, blockers: $blockers,
+    --arg dmode "$REVIEW_MODE" --arg dfrom "$DELTA_FROM" --arg dcarried "$CARRIED_FROM" --argjson drounds "$FULL_ROUNDS" --slurpfile dfiles "$TMP_DIR/dfiles.json" \
+    --arg pname "$PROJECT_NAME" --rawfile pctx "$TMP_DIR/pctx.txt" --arg scraping_on "$SCRAPING_ON" --arg rpath "$REPO_PATH" \
+    --rawfile d_auth "$TMP_DIR/d_auth.txt" --rawfile d_billing "$TMP_DIR/d_billing.txt" --rawfile d_conc "$TMP_DIR/d_conc.txt" --rawfile d_infra "$TMP_DIR/d_infra.txt" \
+    --rawfile d_db "$TMP_DIR/d_db.txt" --rawfile d_fe "$TMP_DIR/d_fe.txt" --rawfile d_sec "$TMP_DIR/d_sec.txt" --rawfile d_api "$TMP_DIR/d_api.txt" --rawfile d_scr "$TMP_DIR/d_scr.txt" \
+    --arg tsrc "$TEMPLATE_SOURCE" --arg tbase "$TEMPLATE_BASE" --rawfile tmono "$TMP_DIR/tmono.txt" \
+    --rawfile i_auth "$TMP_DIR/i_auth.txt" --rawfile i_billing "$TMP_DIR/i_billing.txt" --rawfile i_db "$TMP_DIR/i_db.txt" --rawfile i_api "$TMP_DIR/i_api.txt" --rawfile i_fe "$TMP_DIR/i_fe.txt" --rawfile i_infra "$TMP_DIR/i_infra.txt" \
+    --slurpfile slices "$TMP_DIR/slices.json" --slurpfile full_files "$TMP_DIR/full_files.json" '
+    {schema_version: 1, status: $status, blockers: $blockers[0],
      pr: {number: $pr_number, repo: $repo, title: $title, author: $author, head_ref: $head, base_ref: $base, review_sha: $sha, review_sha_short: $sha7,
           additions: $adds, deletions: $dels, changed_files: ($nfiles | tonumber? // null), first_time_contributor: ($first == "true")},
      lane: {is_staging_to_main: ($s2m == "true"), is_milestone_to_staging: ($m2s == "true"), requires_full_build: ($rfb == "true"), thorough: ($thorough == "true")},
      merge_health: {mergeable: $mh, state: $mhs, retries: $mhr},
      classification: {services: $services, domains: $domains},
-     phase2: {build_config: {typescript_build: $tsb, python_format: $pyf, status: $bcs}, findings: $p2},
-     broken_assumptions: $asm, risk_signals: $risk, churn_context: $churn, churn_escalation: ($churn_esc == "true"), danger_zone: ($danger == "true"),
+     phase2: {build_config: {typescript_build: $tsb, python_format: $pyf, status: $bcs}, findings: $p2[0]},
+     broken_assumptions: $asm[0], risk_signals: $risk, churn_context: $churn, churn_escalation: ($churn_esc == "true"), danger_zone: ($danger == "true"),
      scores: {AUTH: $sa, BILLING: $sb, CONCURRENCY: $sc, DATABASE: $sd, INFRA: $si, SECURITY: $ss, SCRAPING: $ssc, FRONTEND: $sf, API: $sap},
      contract: {issue: ($cissue | tonumber? // null), flags: $cflags},
      roster: {tier: $rtier, review_depth: $rdepth, review_weight: $rweight, reason: $rreason, agents: $agents},
-     delta: {mode: $dmode, from: $dfrom, carried_from: $dcarried, full_rounds: $drounds, files: $dfiles},
+     delta: {mode: $dmode, from: $dfrom, carried_from: $dcarried, full_rounds: $drounds, files: $dfiles[0]},
      config: {project_name: $pname, project_context: $pctx, scraping_configured: ($scraping_on == "true"), repo_path: $rpath,
               domains: {auth: $d_auth, billing: $d_billing, concurrency: $d_conc, infra: $d_infra, database: $d_db, frontend: $d_fe, security: $d_sec, api: $d_api, scraping: $d_scr}},
      templates: {source: $tsrc, base: $tbase, monolithic_catalog: $tmono},
      index_slices: {auth: $i_auth, billing: $i_billing, database: $i_db, api: $i_api, frontend: $i_fe, infrastructure: $i_infra},
-     slices: $slices, full_files: $full_files}') || { echo "review-prepare: could not assemble the context JSON" >&2; exit 2; }
+     slices: $slices[0], full_files: $full_files[0]}') || { echo "review-prepare: could not assemble the context JSON" >&2; exit 2; }
 if [ -n "$OUT" ]; then printf '%s\n' "$CTX" > "$OUT" || { echo "review-prepare: cannot write $OUT" >&2; exit 2; }; else printf '%s\n' "$CTX"; fi
 [ "$STATUS" = "OK" ] && exit 0
 exit 3

package/scripts/review-prepare.test.sh

@@ -116,6 +116,28 @@ prep "$ROOT"; eq "garbage state normalized" .merge_health.state UNKNOWN
 setup feat/x staging "README.md" "$DIFF_PLAIN"; echo 0 > "$FIX/prior"
 prep "$ROOT"; eq "first-time contributor" .pr.first_time_contributor true
 
+# --- 2b. slices are whole-file blocks, bounded, never the full-diff fallback (#4573) ---
+BIG_LINES=$(awk 'BEGIN { for (i = 0; i < 1500; i++) print "-old line " i " of the huge generated file" }')
+DIFF_BIG="diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
++ci: 1
+diff --git a/services/api/big_scrape.py b/services/api/big_scrape.py
+$BIG_LINES
+diff --git a/services/api/auth.py b/services/api/auth.py
++def f(): jwt = 1"
+setup feat/x staging "services/api/big_scrape.py
+services/api/auth.py
+.github/workflows/ci.yml" "$DIFF_BIG"
+prep "$ROOT"
+SEC_SLICE=$(jqv '.slices.security.diff_file')
+if grep -q '^# OMITTED.*services/api/big_scrape.py' "$SEC_SLICE" && ! grep -q 'huge generated file' "$SEC_SLICE"; then ok; else bad "oversize file must be listed as omitted, not cut into the slice"; fi
+if grep -q '^+def f(): jwt = 1' "$SEC_SLICE"; then ok; else bad "small blocks stay whole next to an omitted one"; fi
+if [ "$(grep -n 'services/api/auth.py b/' "$SEC_SLICE" | head -1 | cut -d: -f1)" -lt "$(grep -n '\.github/workflows/ci.yml b/' "$SEC_SLICE" | head -1 | cut -d: -f1)" ]; then ok; else bad "security slice lists .github blocks last"; fi
+BILL_SLICE=$(jqv '.slices.billing.diff_file')
+if grep -q 'auth.py\|big_scrape' "$BILL_SLICE"; then bad "unmatched domain must not fall back to the full diff"; else ok; fi
+eq "unmatched domain has no paths" '.slices.billing.paths | length' 0
+REVIEW_SLICE_CAP=100 prep "$ROOT"
+if [ "$(wc -c < "$(jqv '.slices.security.diff_file')")" -lt 600 ]; then ok; else bad "total cap bounds the slice"; fi
+
 # --- 3. classification + scores ---
 setup feat/x staging "services/api/auth.py
 services/api/billing.py" "$DIFF_AUTH_BILL"
@@ -252,6 +274,26 @@ prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "degraded mark
 { cmt "$(agent_body "$SHA_A")"; } | comments_of
 prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "partial earlier pass (no post-guard proof) blocks" 3
 eq "partial earlier pass blocker" '.blockers | join(" ") | test("no trusted proof that the earlier panel completed")' true
+# forge#4573: an unfinalized panel is complete when every launched domain delivered findings at <from> and nothing is degraded
+export FORGE_SCRATCHPAD="$WORK/sd"; mkdir -p "$FORGE_SCRATCHPAD"
+printf 'security\n' > "$FORGE_SCRATCHPAD/7_launched_review_agents"
+printf '%s\n' "$SHA_A" > "$FORGE_SCRATCHPAD/7_launched_review_agents.head"
+{ cmt "$(agent_body "$SHA_A")"; } | comments_of
+prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "complete but unfinalized panel is accepted (#4573)" 0; eq "unfinalized panel mode" .delta.mode DELTA
+printf '%s\n' "$SHA_B" > "$FORGE_SCRATCHPAD/7_launched_review_agents.head"
+prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "a launched list written for another head is no proof" 3
+rm -f "$FORGE_SCRATCHPAD/7_launched_review_agents.head"
+prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "a launched list with no head sidecar is no proof" 3
+printf '%s\n' "$SHA_A" > "$FORGE_SCRATCHPAD/7_launched_review_agents.head"
+printf 'security\nauth\n' > "$FORGE_SCRATCHPAD/7_launched_review_agents"
+prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "a launched domain with no findings keeps the delta blocked" 3
+printf 'security\n' > "$FORGE_SCRATCHPAD/7_launched_review_agents"
+{ cmt "$(agent_body "$SHA_A")"; cmt "<!-- FORGE:REVIEW_DEGRADED -->"; } | comments_of
+prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "degraded unfinalized panel stays blocked" 3
+rm -f "$FORGE_SCRATCHPAD/7_launched_review_agents"
+{ cmt "$(agent_body "$SHA_A")"; } | comments_of
+prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "no launched list: unfinalized panel stays blocked" 3
+unset FORGE_SCRATCHPAD
 { cmt "$(agent_body "$SHA_A")"; cmt "$(staging_summary "$SHA_A")" NONE; } | comments_of
 prep "$WORK/root-nodelta" --no-delta --delta-from "$SHA_A"; rc_is "untrusted staging summary is no proof" 3
 { cmt "$(staging_summary "$SHA_B")"; cmt "$(agent_body "$SHA_A")"; } | comments_of
@@ -435,5 +477,16 @@ if command -v timeout >/dev/null 2>&1 || command -v gtimeout >/dev/null 2>&1; th
     if grep -q "code index timed out after 1s" "$WORK/stderr"; then ok; else bad "index timeout must be reported on stderr"; fi
 fi
 
+# --- 12. oversized slices JSON (>128 KiB, argv per-argument limit) still assembles ---
+BIG_FILES=$(awk 'BEGIN{for(i=1;i<=1100;i++) printf "services/api/auth/very/long/directory/name/to/pad/the/path/out/for/the/test/module_%05d_handler.py\n", i}')
+BIG_DIFF='diff --git a/services/api/auth/x.py b/services/api/auth/x.py
++jwt = 1'
+setup feat/x staging "$BIG_FILES" "$BIG_DIFF"
+prep "$ROOT"
+rc_is "oversized slices JSON" 0
+eq "oversized slices JSON is over 128 KiB" '.slices | tojson | length > 131072' true
+eq "oversized security slice keeps every path" '.slices.security.paths | length' 1100
+eq "oversized full_files keeps every path" '.full_files | length' 1100
+
 echo "review-prepare tests: $pass passed, $fail failed"
 [ "$fail" -eq 0 ]

package/scripts/review-staging-pre.sh

@@ -50,6 +50,31 @@ if [ "$CMD" != gate ]; then
   export FORGE_SCRATCHPAD="$SD"
 fi
 _SD="${SD:-${FORGE_SCRATCHPAD:-$PWD/.forge-scratch}}"
+
+# BEGIN gh-retry
+# gh_retry [--search] CMD...: run CMD up to FORGE_GH_RETRY_ATTEMPTS (default 6) times with exponential backoff from
+# FORGE_GH_RETRY_SLEEP seconds (default 2, capped at 16 per wait; --search triples the base for the 30 req/min search API).
+# Prints stdout of the first success and returns 0; returns 1 once every attempt failed, so callers still fail closed/open as before (forge#4572).
+gh_retry() {
+  local mult=1 n=0 max="${FORGE_GH_RETRY_ATTEMPTS:-6}" base="${FORGE_GH_RETRY_SLEEP:-2}" w out
+  [ "${1:-}" = --search ] && { mult=3; shift; }
+  case "$max" in ''|*[!0-9]*|0) max=6 ;; esac
+  case "$base" in ''|*[!0-9]*) base=2 ;; esac
+  while :; do
+    out=$("$@") && { printf '%s' "$out"; return 0; }
+    n=$((n+1)); [ "$n" -ge "$max" ] && return 1
+    w=$((base * mult * (1 << (n-1)))); [ "$w" -gt $((16*mult)) ] && w=$((16*mult))
+    [ "$w" -gt 0 ] && sleep "$w"
+  done
+}
+# END gh-retry
+# One review-finding search fetch; fails (so gh_retry retries) on a gh error or non-array output.
+fetch_findings() {
+  local raw
+  raw=$(gh issue list -R "$GH_REPO" --label "review-finding" --state open --search "PR #${1}" --limit 20 --json number,title,body 2>/dev/null) || return 1
+  printf '%s' "$raw" | jq -e 'type == "array"' >/dev/null 2>&1 || return 1
+  printf '%s' "$raw"
+}
 ALL_PR_NUMBERS=""
 if [ "$CMD" != bundle ]; then
   [ -n "$PRS_FILE" ] || { echo "review-staging-pre: --prs-file is required" >&2; exit 2; }
@@ -81,7 +106,7 @@ MERGE_PRS=$(git log origin/$DEFAULT_BRANCH..origin/$STAGING_BRANCH --merges --on
 # Merge-subject numbers are PRs by construction; an unclassifiable number is kept (fail open: it may be a PR). forge#4127
 # BEGIN bundle-pr-kind
 # Prints "pr" or "issue" for issue number ${2} in repo ${1}; prints nothing and returns 1 when the read fails or is malformed.
-bundle_pr_kind() { local k; k=$(gh api "repos/${1}/issues/${2}" --jq 'if .pull_request then "pr" else "issue" end' 2>/dev/null) || return 1; case "$k" in pr|issue) printf '%s' "$k" ;; *) return 1 ;; esac; }
+bundle_pr_kind() { local k; k=$(gh_retry gh api "repos/${1}/issues/${2}" --jq 'if .pull_request then "pr" else "issue" end' 2>/dev/null) || return 1; case "$k" in pr|issue) printf '%s' "$k" ;; *) return 1 ;; esac; }
 # END bundle-pr-kind
 SUBJECT_PRS=""; SKIPPED_ISSUES=""
 for n in $BUNDLE_PRS; do
@@ -115,7 +140,7 @@ DEGRADED_REVIEWS=""
 READ_FAILURES=""
 for pr_num in $ALL_PR_NUMBERS; do
   # Capture each gh read and test its own status (as the scope step does): a failed read is never "not degraded" / "no findings".
-  IS_REVIEW_DEGRADED=$(gh pr view "$pr_num" -R $GH_REPO --json labels \
+  IS_REVIEW_DEGRADED=$(gh_retry gh pr view "$pr_num" -R $GH_REPO --json labels \
     --jq '[.labels[].name] | any(. == "review-degraded")' 2>/dev/null) || IS_REVIEW_DEGRADED=unreadable
   case "$IS_REVIEW_DEGRADED" in true|false) ;; *) READ_FAILURES="$READ_FAILURES #${pr_num}(labels)" ;; esac
   if [ "$IS_REVIEW_DEGRADED" = "true" ]; then
@@ -128,12 +153,7 @@ for pr_num in $ALL_PR_NUMBERS; do
   # narrow it with the anchored FINDING_PR_FILTER: title suffix `PR #N)` or a `**Source**: PR #N` line.
   FINDING_PR_FILTER='[.[] | select((.title | endswith("PR #" + $n + ")")) or ((.body // "") | test("(^|\\n)\\*\\*Source\\*\\*: PR #" + $n + "([^0-9]|$)")))] | .[] | "  - #\(.number): \(.title)"'  # FINDING_PR_FILTER
   OPEN_FINDINGS=""
-  if _RAW=$(gh issue list -R $GH_REPO \
-    --label "review-finding" \
-    --state open \
-    --search "PR #${pr_num}" \
-    --limit 20 \
-    --json number,title,body 2>/dev/null) && printf '%s' "$_RAW" | jq -e 'type == "array"' >/dev/null 2>&1; then
+  if _RAW=$(gh_retry --search fetch_findings "$pr_num"); then
     OPEN_FINDINGS=$(printf '%s' "$_RAW" | jq -r --arg n "${pr_num}" "$FINDING_PR_FILTER" 2>/dev/null) || READ_FAILURES="$READ_FAILURES #${pr_num}(findings)"  # uses FINDING_PR_FILTER
   else
     READ_FAILURES="$READ_FAILURES #${pr_num}(findings)"
@@ -312,7 +332,7 @@ bundle_delta_credit() {
 # END bundle-delta-credit
 # BEGIN bundle-pr-kind
 # Prints "pr" or "issue" for issue number ${2} in repo ${1}; prints nothing and returns 1 when the read fails or is malformed.
-bundle_pr_kind() { local k; k=$(gh api "repos/${1}/issues/${2}" --jq 'if .pull_request then "pr" else "issue" end' 2>/dev/null) || return 1; case "$k" in pr|issue) printf '%s' "$k" ;; *) return 1 ;; esac; }
+bundle_pr_kind() { local k; k=$(gh_retry gh api "repos/${1}/issues/${2}" --jq 'if .pull_request then "pr" else "issue" end' 2>/dev/null) || return 1; case "$k" in pr|issue) printf '%s' "$k" ;; *) return 1 ;; esac; }
 # END bundle-pr-kind
 # BEGIN bundle-scope-loop
 _WHY=""

package/scripts/review-staging-pre.test.sh

@@ -13,6 +13,7 @@ bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
 command -v jq >/dev/null 2>&1 || { echo "review-staging-pre.test.sh: jq missing, skipped"; exit 0; }
 command -v git >/dev/null 2>&1 || { echo "review-staging-pre.test.sh: git missing, skipped"; exit 0; }
 TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+export FORGE_GH_RETRY_SLEEP=0   # no real backoff in tests
 export FORGEDOCK_HOME="$ROOT"   # resolve helpers from this checkout, not an ambient install
 
 # (1) the blocks live only here: present in the script, absent from the spec
@@ -34,6 +35,9 @@ cat > "$TMP/bin/gh" <<'STUB'
 F="$FIX"; a="$*"
 # fail-labels / fail-issues: the degraded-label / review-finding read fails (rate limit, 5xx, expired auth)
 case "$a" in "pr view"*"--json labels"*) [ -f "$F/fail-labels" ] && exit 1 ;; "issue list"*) [ -f "$F/fail-issues" ] && exit 1 ;; esac
+# flaky-<kind>: fail the first N reads of that kind (N = file content), then succeed (transient error)
+flaky() { [ -f "$F/flaky-$1" ] || return 0; local c; c=$(cat "$F/count-$1" 2>/dev/null || echo 0); echo $((c+1)) > "$F/count-$1"; [ "$c" -lt "$(cat "$F/flaky-$1")" ] && exit 1; return 0; }
+case "$a" in "pr view"*"--json labels"*) flaky labels ;; "issue list"*) flaky issues ;; "api repos/o/r/issues/"*) case "$a" in *"/comments"*) ;; *) flaky kind ;; esac ;; esac
 case "$1 $2" in
   "pr comment") while [ $# -gt 0 ]; do [ "$1" = --body ] && { printf '%s\n@@\n' "$2" >> "$F/posted"; }; shift; done; exit 0 ;;
   "pr diff") [ -f "$F/files-$3" ] && { cat "$F/files-$3"; exit 0; }; exit 1 ;;
@@ -70,6 +74,10 @@ run() { (cd "$TMP/work" && bash "$PRE" "$@"); }
 
 # (3) bundle: the merge-subject PR is kept, the issue cited in a subject is skipped, the list is persisted
 newfix bundle; : > "$FIX/issue-77"
+newfix bundleflaky; : > "$FIX/issue-77"; echo 2 > "$FIX/flaky-kind"
+OUT=$(run bundle --repo o/r --default main --staging staging --pr 9 --sd "$TMP/sd" 2>&1); RC=$?
+case "$OUT" in *"skipped):"*"77"*) ok ;; *) bad "a transient bundle_pr_kind failure must be retried so issue #77 is still skipped (got '$OUT')" ;; esac
+newfix bundle; : > "$FIX/issue-77"
 OUT=$(run bundle --repo o/r --default main --staging staging --pr 9 --sd "$TMP/sd" 2>&1); RC=$?
 [ "$RC" -eq 0 ] && ok || bad "bundle must exit 0 (got $RC: $OUT)"
 [ "$(cat "$TMP/sd/9_bundle-prs.txt" 2>/dev/null)" = 5 ] && ok || bad "bundle must persist exactly PR 5 (got '$(cat "$TMP/sd/9_bundle-prs.txt" 2>/dev/null)')"
@@ -106,6 +114,16 @@ OUT=$(run gate --repo o/r --pr 9 --prs-file "$TMP/prs2" 2>&1); RC=$?
 case "$OUT" in *"RESULT: BLOCK DEPLOY"*) ok ;; *) bad "gh read failure blocks: must print RESULT: BLOCK DEPLOY (got '$OUT')" ;; esac
 ! grep -q 'FORGE:GATE_PASS' "$FIX/posted" 2>/dev/null && ok || bad "gh read failure blocks: must not post GATE_PASS"
 grep -q 'FORGE:GATE_FAILURE:TYPE=gate-read-failure' "$FIX/posted" 2>/dev/null && ok || bad "gh read failure blocks: must post TYPE=gate-read-failure"
+# forge#4572: a transient read failure is retried and does not block; a persistent one (above) still blocks.
+newfix flaky; echo 2 > "$FIX/flaky-labels"; echo 3 > "$FIX/flaky-issues"
+OUT=$(run gate --repo o/r --pr 9 --prs-file "$TMP/prs2" 2>&1); RC=$?
+[ "$RC" -eq 0 ] && grep -q 'FORGE:GATE_PASS' "$FIX/posted" 2>/dev/null && ok || bad "transient label/finding read failures must be retried, not block (rc $RC: $OUT)"
+newfix flakyfew; echo 5 > "$FIX/flaky-issues"
+run gate --repo o/r --pr 9 --prs-file "$TMP/prs2" >/dev/null 2>&1; RC=$?
+[ "$RC" -eq 0 ] && ok || bad "5 transient failures fit inside the default 6 attempts (rc $RC)"
+newfix flakymany; echo 6 > "$FIX/flaky-issues"
+run gate --repo o/r --pr 9 --prs-file "$TMP/prs" >/dev/null 2>&1; RC=$?
+[ "$RC" -eq 1 ] && ! grep -q 'FORGE:GATE_PASS' "$FIX/posted" 2>/dev/null && ok || bad "failures beyond the attempt budget must still block (rc $RC)"
 newfix issuefail; : > "$FIX/fail-issues"
 run gate --repo o/r --pr 9 --prs-file "$TMP/prs" >/dev/null 2>&1; RC=$?
 [ "$RC" -eq 1 ] && ! grep -q 'FORGE:GATE_PASS' "$FIX/posted" 2>/dev/null && ok || bad "a failed review-finding read alone must block without GATE_PASS (rc $RC)"