forgedock 1.33.0 → 1.35.0

package/bin/lean/precheck.test.mjs

@@ -6,7 +6,7 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { formatFirstPassSummary } from "./fixround.mjs";
-import { runChecks, formatPrecheckSummary, planPrecheck, selfCheck, selfCheckState, formatCheckTable, worktreeFingerprint, quietFailure } from "./precheck.mjs";
+import { runChecks, retryTimeoutMs, runWithTimeoutRetry, formatPrecheckSummary, planPrecheck, selfCheck, selfCheckState, formatCheckTable, worktreeFingerprint, quietFailure } from "./precheck.mjs";
 import { execFileSync } from "node:child_process";
 import { readPrecheckBudget } from "../engine-cli.mjs";
 import { orchestrate } from "./orchestrate.mjs";
@@ -52,9 +52,9 @@ describe("runChecks (#4331)", () => {
     assert.deepEqual(r.deferred, ["b", "c"]);
   });
 
-  it("a command's own timeout (not the budget) stays a failure; a throw is rc 127", async () => {
+  it("a command's own timeout (not the budget) stays a failure once the retry also times out; a throw is rc 127", async () => {
     const h = harness({ cost: { slow: 5000 } });
-    const r = await runChecks({ commands: ["slow", "boom", "bad"], parallelism: 2, budgetMs: 600000, perCommandMs: 2000, now: h.now,
+    const r = await runChecks({ commands: ["slow", "boom", "bad"], parallelism: 2, budgetMs: 600000, perCommandMs: 2000, now: h.now, load: () => ({ load1: 0, cores: 4 }),
       run: (a) => (a.command === "boom" ? Promise.reject(new Error("spawn failed")) : a.command === "bad" ? Promise.resolve({ rc: 2, output: "lint" }) : h.run(a)) });
     assert.deepEqual(r.results.map((x) => [x.command, x.rc]), [["slow", 124], ["boom", 127], ["bad", 2]]);
     assert.match(r.results[1].output, /spawn failed/);
@@ -145,6 +145,16 @@ describe("readPrecheckBudget: forge.yaml lean.precheck.max_minutes (#4331)", ()
 describe("forgedock check core (#4364)", () => {
   const MAP = { version: 1, entries: [{ globs: ["src/**"], command: "npm test", cwd: "." }, { globs: ["docs/**"], command: "make docs", cwd: "." }] };
 
+  it("planPrecheck #4585: invariants are appended unscoped, deduped, and kept when the map matches nothing", () => {
+    const p = planPrecheck({ testMap: MAP, files: ["README.md"], learned: ["make lint"], verify: { invariants: ["bash scripts/inv.sh", " make lint ", ""] } });
+    assert.deepEqual(p.commands.at(-1), "bash scripts/inv.sh");
+    assert.equal(p.commands.filter((c) => c === "make lint").length, 1);
+    assert.equal(p.invariants, 2);
+    const only = planPrecheck({ files: [], learned: [], verify: { invariants: ["bash scripts/inv.sh"] } });
+    assert.deepEqual(only.commands, ["bash scripts/inv.sh"]);
+    assert.deepEqual(planPrecheck({ testMap: MAP, files: ["README.md"], learned: ["make lint"] }).commands, ["make lint"], "no invariants: unchanged");
+  });
+
   it("planPrecheck: the engine's selection and budget rule (max_minutes wins, else precheck_total_seconds, else 600 s)", () => {
     const p = planPrecheck({ testMap: MAP, files: ["src/a.js"], learned: [" make lint ", "", "make docs"], verify: { precheckTotalSeconds: 120, precheckTimeoutSeconds: 30 } });
     assert.deepEqual(p.commands, ["make lint", "npm test"]); assert.deepEqual(p.dropped, ["make docs"]);
@@ -208,3 +218,52 @@ describe("forgedock check core (#4364)", () => {
     assert.notEqual(await fp(), dirty);
   });
 });
+
+describe("check timeout is infrastructure (#4589)", () => {
+  const idle = () => ({ load1: 0, cores: 4 });
+  it("retryTimeoutMs doubles at least, scales with load per core, caps at 3600 s and never shrinks", () => {
+    assert.equal(retryTimeoutMs({ perMs: 300000, load1: 0, cores: 4 }), 600000);
+    assert.equal(retryTimeoutMs({ perMs: 300000, load1: 13, cores: 4 }), 1200000);
+    assert.equal(retryTimeoutMs({ perMs: 2000000, load1: 40, cores: 4 }), 3600000);
+    assert.equal(retryTimeoutMs({ perMs: 4000000, load1: 0, cores: 4 }), 4000000);
+  });
+  it("runChecks retries a command's own timeout once with a longer one and passes", async () => {
+    const h = harness({ cost: { slow: 400000 } });
+    const r = await runChecks({ commands: ["slow"], budgetMs: Infinity, perCommandMs: 300000, now: h.now, run: h.run, load: idle });
+    assert.deepEqual(h.calls, [["slow", 300000], ["slow", 600000]]);
+    assert.equal(r.results[0].rc, 0);
+    assert.deepEqual(r.deferred, []);
+  });
+  it("a repeated timeout stays rc 124 and is labelled infrastructure", async () => {
+    const h = harness({ cost: { slow: 9e9 } });
+    const r = await runChecks({ commands: ["slow"], budgetMs: Infinity, perCommandMs: 1000, now: h.now, run: h.run, load: idle });
+    assert.equal(h.calls.length, 2);
+    assert.equal(r.results[0].rc, 124);
+    assert.match(r.results[0].output, /infra timeout/);
+  });
+  it("selfCheck is ok when the retry passes", async () => {
+    const h = harness({ cost: { slow: 5000 } });
+    const r = await selfCheck({ contract: { validate: [{ id: "V1", command: "slow" }] }, plan: { commands: [], budgetMs: 0, perCommandMs: 3000 }, now: h.now, run: h.run });
+    assert.equal(r.ok, true);
+  });
+  it("a budget-cut timeout is still deferred, never retried; a non-124 failure is never retried", async () => {
+    const h = harness({ cost: { slow: 9e9 }, rc: { bad: 1 } });
+    const r = await runChecks({ commands: ["slow"], budgetMs: 2000, perCommandMs: 300000, now: h.now, run: h.run, load: idle });
+    assert.equal(h.calls.length, 1);
+    assert.deepEqual(r.deferred, ["slow"]);
+    const h2 = harness({ rc: { bad: 1 } });
+    const r2 = await runChecks({ commands: ["bad"], budgetMs: Infinity, perCommandMs: 1000, now: h2.now, run: h2.run, load: idle });
+    assert.equal(h2.calls.length, 1);
+    assert.equal(r2.results[0].rc, 1);
+  });
+  it("a retry the budget cuts short is deferred", async () => {
+    const h = harness({ cost: { slow: 9e9 } });
+    const r = await runChecks({ commands: ["slow"], budgetMs: 1500, perCommandMs: 1000, now: h.now, run: h.run, load: idle });
+    assert.deepEqual(r.deferred, ["slow"]);
+  });
+  it("runWithTimeoutRetry reports retried", async () => {
+    let n = 0;
+    const x = await runWithTimeoutRetry(async (ms) => (++n === 1 ? { rc: 124, output: "t" } : { rc: 0, output: String(ms) }), 1000, { load: idle });
+    assert.deepEqual([x.retried, x.r.rc, x.r.output], [true, 0, "2000"]);
+  });
+});

package/bin/lean/prompts.mjs

@@ -63,6 +63,12 @@ export function duplicateExportsPrompt(findings, mode = "local") {
   return `This change exports names that another module of the same app or package already exports:\n${rows}\n\nRename the new export or reuse the existing one, and update every reference and any registry, map or test keyed by the name (same-named entries collide or leave one unprobed). ${rerun(mode)}, commit, and update ${IMPLEMENTATION_FILE} and ${RESULT_FILE}. Do not push or touch GitHub.`;
 }
 
+/** #4591: lane-added migrations the repo's generator did not produce. */
+export function migrationGeneratorPrompt(problems, mode = "local") {
+  const rows = problems.slice(0, 30).map((p) => `- ${p}`).join("\n");
+  return `These migration files were named by hand, not produced by the repo's migration generator:\n${rows}\n\nA made-up name or timestamp collides with another lane's migration. Delete each such file, then recreate it with the generator (hand-written SQL: the generator's \`--custom\` mode, e.g. \`drizzle-kit generate --custom --name=<name>\`, then put your SQL in the file it wrote), so the journal entry and snapshot come from it. Never name or number migration files by hand. ${rerun(mode)}, commit, and update ${IMPLEMENTATION_FILE} and ${RESULT_FILE}. Do not push or touch GitHub.`;
+}
+
 /** #4390: byte cap of the diff hunks a context-ceiling restart carries (the stat is always kept). */
 export const RESTART_DIFF_MAX_BYTES = 40 * 1024;
 
@@ -171,13 +177,15 @@ export function builderImplementPrompt(mode = "local", { toolchain = null, spars
 
 ${HOST_RULES}${toolchainRule(toolchain)}${sparseRule(sparse)}${factsRule(facts)}${remote ? `\n\n${VERIFY_RULES[mode]}` : ""}
 
-The contract changes only through typed amendments in ${RESULT_FILE}, each with a why, which the engine posts on the issue:
-- {"kind":"add-deliverable","path":"<file>","why":""}: a file you must change that the contract did not list.
+The contract changes only through typed amendments in ${RESULT_FILE}, each with a why:
+- {"kind":"add-deliverable","path":"<file>","why":""}: a file the contract did not list.
 - {"kind":"add-requirement","requirement":{"id":"R9","quote":"<verbatim from the issue>","disposition":"deliver|defer|post-deploy"},"why":""}: an issue requirement the contract missed.
-- {"kind":"defer|post-deploy","requirement":"R#","why":""}: a contracted requirement that becomes separate work or a post-deploy check. The engine files it as a tracked follow-up.
+- {"kind":"defer|post-deploy","requirement":"R#","why":""}: a requirement that becomes separate work or a post-deploy check. Filed as a tracked follow-up. Not "type"; other kinds are rejected.
+- {"kind":"amend-requirement","requirement":"R#","text":"<revised wording>","why":""}: reworded; judged against text.
 Never report a deliver requirement as "deferred" or "follow-up" without an amendment.
-A new dependency between workspace packages in a package.json that no deliverable names is blocked by the engine: add it through add-deliverable with a why naming the package, or do not add it.
-If the repository has scripts/check-devdocs-freshness.sh, a behaviour change under the paths it checks must update the matching dossier (devdocs/modules/*.md, per devdocs/index.yaml) in the same change. Run it against the base before writing the result; the engine runs it too.
+Never name or number migration files by hand; use the generator.
+A new workspace-package dependency in a package.json no deliverable names is blocked by the engine: add it through add-deliverable with a why naming the package, or do not add it.
+If the repository has scripts/check-devdocs-freshness.sh, a behaviour change under the paths it checks must update the matching dossier (devdocs/modules/*.md, per devdocs/index.yaml) in the same change. Run it against the base first; the engine runs it too.
 
 Before writing ${RESULT_FILE}, after your last edit, run \`node ${FORGEDOCK_CLI} check\` in the worktree and fix until it passes; if it cannot pass, report the problem as blocked.
 
@@ -244,6 +252,18 @@ export function enumeratingPlanNote(list) {
   return `\n\nEnumerating tests (found by the engine): these tests list every member of a module or directory this issue names, so a new export, table, job, action, namespace or file there must join their list or CI goes red. List each one you will touch under Affected Files in ${INVESTIGATION_FILE}, and add a validate command that runs only those tests.\n${list.slice(0, 40).map((e) => `- ${e.module} -> ${e.test}:${e.line} (${e.why})`).join("\n")}`;
 }
 
+/** #4585: the repo's verify.invariants as a checklist for the plan; "" when none. */
+export function invariantsPlanNote(list) {
+  if (!Array.isArray(list) || !list.length) return "";
+  return `\n\nRepo-wide invariants (verify.invariants): these commands run before every push whichever tests you choose, and each lists every table, export, key, namespace or file of its kind. A new one needs an entry in every such registry (e.g. registry, export, purge order, seeder, translation status, boundary or placeholder lists). Name each registry you will touch under Affected Files in ${INVESTIGATION_FILE}.\n${list.slice(0, 20).map((c) => `- \`${c}\``).join("\n")}`;
+}
+
+/** #4585: the builder rule for verify.invariants; "" when none. */
+export function invariantsBuildRule(list) {
+  if (!Array.isArray(list) || !list.length) return "";
+  return `\n\nInvariants checklist: for each new table, export, key, namespace, page or file, add its entry to every registry or coverage list that enumerates its kind (e.g. a new table needs registry, export, purge and seeder entries; a new i18n key needs every locale). Then run each command below and fix any failure before you finish.\n${list.slice(0, 20).map((c) => `- \`${c}\``).join("\n")}`;
+}
+
 const NOT_MEMBER = `or, when the symbol is not a member of that list, record {"symbol":"<name>","test":"<test path>","why":"<why it is not a member>"} in ${RESULT_FILE} "not_members"`;
 
 /** #4322: the builder rule citing the plan's enumerating tests; "" when none. */
@@ -280,7 +300,7 @@ export function conformanceResumePrompt(failures, mode = "local", lane = "") {
   const baseMoved = lane && failures.some((f) => f?.kind === "validate_failed")
     ? `\n\nIf a validate command fails only because origin/${lane} moved on after this branch started (the change itself is fine), bring the branch up to date with \`git merge --no-edit origin/${lane}\` (already fetched; never rebase or force), resolve any conflicts, then re-run every validate command and record the results.`
     : "";
-  return `The change does not conform to the frozen contract and the issue:\n${failures.slice(0, 30).map((f) => `- ${f.code}: ${String(f.detail).slice(0, 500)}`).join("\n")}${baseMoved}\n\nFix each item in the code, or record a typed amendment with a why in ${RESULT_FILE}. ${rerun(mode)}, commit, and update ${IMPLEMENTATION_FILE} and ${RESULT_FILE}. Do not push or touch GitHub.`;
+  return `The change does not conform to the frozen contract and the issue:\n${failures.slice(0, 30).map((f) => `- ${f.code}: ${String(f.detail).slice(0, 900)}`).join("\n")}${baseMoved}\n\nFix each item in the code, or record a typed amendment with a why in ${RESULT_FILE}. ${rerun(mode)}, commit, and update ${IMPLEMENTATION_FILE} and ${RESULT_FILE}. Do not push or touch GitHub.`;
 }
 
 /** forge#4159: the one resume for package.json edges between workspace packages the contract does not name. */
@@ -311,6 +331,7 @@ const BLOCK_RULES = `"blocked" needs a typed "block" in ${RESULT_FILE}, one of:
 - {"kind":"split-required","subissues":[{"title":"","body":"","depends_on":[0],"files":["<path>"]}],"size":{"files":N,"lines":N}}: too big for one change. The engine files the sub-issues (depends_on = indexes of earlier sub-issues; files = the files or dirs each will edit, also accepted as "paths") only when every sub-issue's files are disjoint from the others' or the whole change's size estimate exceeds ${SPLIT_MIN_FILES} files or ${SPLIT_MIN_LINES} lines; otherwise keep one lane: an ordered checklist in the contract with a validate per item. In an admitted split, when siblings would edit the same hub (a barrel or index export list, a union type, a shared test fixture, an index doc), pre-stage its slots in the earliest sub-issue and make the others depend on it, or give each sibling its own per-feature file; the engine serialises sub-issues that still share a file.
 - {"kind":"human","why":"${HUMAN_BLOCK_REASONS.join("|")}"}: only an external action agents cannot take, or a product decision too critical for agents.
 "An upstream issue must land first", "needs a split" and "needs prod data that read-only monitoring can read" are never "human".
+A check that times out (rc 124) is host load, never a block or "human" product-decision: run the narrowest targeted command for your changed files and say the full one could not finish in time.
 Remote sandbox lacking a host-only capability (sops, prod_monitor, ops_credentials): name it in the summary; the host reruns the lane.`;
 
 export function blockCorrectionPrompt(problem) {
@@ -342,6 +363,7 @@ export const REVIEWER_SYSTEM = `You are an independent conformance reviewer of o
 
 You receive the GitHub issue with its comments, the frozen contract (requirements quoted from the issue, deliverables, preserve constraints, validate commands) with typed amendments, the builder's result with validation output, the changed files, the diff, and a row skeleton with one row per contract id and changed file. The engine computes the verdict from your rows; a reply without rows is rejected, so fill the skeleton rather than composing rows: fill EVERY row (set each empty status, evidence and validated_by, and each null deferral_ok; keep the ids and files as given):
 - issue_coverage: one row per requirement or acceptance criterion in the issue, quoted verbatim, saying whether the contract covers it, narrows it, or misses it. The skeleton lists the contract's quotes; add a row for any issue requirement the contract does not quote.
+- amendment: a requirement with an \`amendment\` is judged against amendment.text and its why, not the quote; its issue_coverage row is covered when the amendment follows from its why. If it does not hold, mark the row partial with note "amendment: <what to change>".
 - requirements: one row per contract requirement id: implemented|partial|missing|deferred|post-deploy|not-applicable, with evidence as a backtick-quoted repo-relative path:line copied verbatim from the changed files, including (group), [slug] and [...slug] folders (e.g. \`apps/web/app/(console)/layout.tsx:12\`, not route.ts:12) and the validate id or test that proves it (validated_by). For a defer or post-deploy requirement add deferral_ok: true only if it is genuinely separate work or only checkable after a deploy, false if it belongs in this change. For a verify out_of_band row (measured by the named job, not in this lane) set instrumented: true only when its budget test or bench is committed and that job is configured, with that path:line as evidence; false otherwise. Do not judge the measured result.
 - scope: one row per changed file, pre-filled with the engine's authorization: the deliverable id that authorizes it (deliverables may be directories or globs), "test", "incidental" (changelog, lockfile), or "none" with what it changes. Change it only if the diff shows the file does something its deliverable does not cover.
 - preserve: one row per preserve id: intact|violated|unverified, with path:line. The skeleton starts each at "unverified"; set intact only after checking it.

package/bin/lean/schedd.mjs

@@ -8,7 +8,7 @@
  *
  * Protocol: newline-delimited JSON, one request per connection.
  *   {op:"submit", argv, cwd, env} → {type:"batch", id, dir}, {type:"row", row}…, {type:"line", text}…, {type:"done", result, report}
- *   {op:"attach", id}             → log.jsonl rows replayed, then live rows/lines and done; a finished batch replays report.json
+ *   {op:"attach", id, resume?}    → (`resume` also clears a pending cancel, #4592) log.jsonl rows replayed, then live rows/lines and done; a finished batch replays report.json
  *                                   ({type:"done", replay:true}) unless it has unrun added issues; a batch nobody hosts is resumed here
  *   {op:"set-parallel", id, k}    → {type:"ok", parallel}
  *   {op:"add", id, issues}        → {type:"ok", added, skipped, hosted} (#4408): merged into the batch's `add` file, which a
@@ -17,6 +17,8 @@
  *                                   admits nothing more, its running local lanes get SIGTERM (their teardown saves the work)
  *                                   and the rest end held; no other batch and not the daemon. A finished, unhosted batch:
  *                                   {type:"ok", cancelled:false, finished:true}, nothing written
+ *   {op:"hold"|"release", id, issues} → {type:"ok", changed, hosted} (#4592): merges into / removes from the batch's `hold` file; a hosted
+ *                                   runner admits no held issue from its next pass (running lanes are not stopped)
  *   {op:"status"}                 → {type:"status", pid, batches:[{id, running}]}
  * Failures answer {type:"error", message}. A client closing its connection never cancels a batch (only `cancel` stops one), and stopping the daemon
  * never stops a lane (lanes are detached sessions). On start the daemon resumes every daemon-hosted batch without a
@@ -140,6 +142,12 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
       const { added, skipped } = b.addIssues(req.issues ?? []);
       return send({ type: "ok", added, skipped, hosted: hosted.has(req.id) }, true);
     }
+    if (req.op === "hold" || req.op === "release") {
+      const b = openBatch(root, req.id);
+      if (!b.exists()) throw new Error(`no batch ${req.id} in ${root}`);
+      const changed = req.op === "hold" ? b.holdIssues(req.issues ?? []) : b.releaseIssues(req.issues ?? []);
+      return send({ type: "ok", changed, hosted: hosted.has(req.id) }, true);
+    }
     if (req.op === "cancel") {
       const b = openBatch(root, req.id);
       if (!b.exists()) throw new Error(`no batch ${req.id} in ${root}`);
@@ -153,6 +161,7 @@ export async function startDaemon({ dir = schedDir(), runBatch, idleMs = Number(
       return send({ type: "batch", id: ent.id, dir: ent.dir });
     }
     if (req.op === "attach") {
+      if (req.resume) { const rb = openBatch(root, req.id); if (rb.exists()) rb.clearCancel(); } // #4592: the operator's resume continues a cancelled batch the daemon still hosts
       if (!hosted.has(req.id) && starting.has(req.id)) await starting.get(req.id).catch(() => {});
       const live = hosted.get(req.id);
       if (live) {

package/bin/lean/schedd.test.mjs

@@ -238,6 +238,36 @@ await orchestrateFromCli(["1", "2", "--parallel", "2", "--repo", "o/r", "--no-pr
     } finally { await h.cleanup(); }
   });
 
+  it("#4592: --hold keeps #2 from running on a live batch; --resume <id> 2 after a cancel re-admits it", async () => {
+    const h = host();
+    try {
+      await h.daemon();
+      await withRoot(h, () => capture(async () => {
+        const first = orchestrateFromCli(["1", "2", "--parallel", "1", "--repo", "o/r", "--no-prefilter"], h.client);
+        await until(() => h.launched().length === 1 && h.lanePids().length === 1);
+        const [id] = listBatches(h.root);
+        const b = openBatch(h.root, id);
+        const held = await orchestrateFromCli(["--hold", id, "2", "x"], h.client);
+        assert.deepEqual(held.changed, [2]);
+        assert.deepEqual(b.readHeld(), [2]);
+        await assert.rejects(orchestrateFromCli(["--hold", id], h.client), /usage/);
+        await assert.rejects(orchestrateFromCli(["--release", "nope", "2"], h.client), /no batch nope/);
+        const res = await orchestrateFromCli(["--cancel", id], h.client);
+        assert.equal(res.cancelled, true);
+        const cancelled = await first;
+        assert.deepEqual(cancelled.rows.map((r) => [r.issue, r.outcome]), [[1, "held"], [2, "held"]]);
+        assert.deepEqual(b.readHeld(), [2], "the hold survives the cancel");
+        // The issue's case: a resume naming the issue re-admits it (it used to print `skipped #2 (already in batch)`).
+        const io = { gh: async (x) => (x[0] === "issue" ? JSON.stringify({ state: "OPEN" }) : "o/r\n") };
+        const resumed = orchestrateFromCli(["--resume", id, "2"], { ...h.client, io });
+        await until(() => b.readCancel() === null && b.readHeld().length === 0);
+        setTimeout(() => writeFileSync(h.release, ""), 300);
+        const done = await resumed;
+        assert.deepEqual(done.rows.map((r) => [r.issue, r.outcome]), [[1, "merged"], [2, "merged"]]);
+      }));
+    } finally { await h.cleanup(); }
+  });
+
   it("#4481: a batch cancelled through the daemon is not resumed by a schedd restart", async () => {
     const h = host();
     try {

package/bin/lean/sequence.mjs

@@ -431,3 +431,29 @@ export async function renumberLane({ git, base, cwd, laneRef = "HEAD", regenerat
     return { ok: true, moves: moves.map(({ from, to }) => ({ from, to })), commit: (await g(["rev-parse", "HEAD"])).trim() || null };
   } catch (e) { return await fail(`deterministic renumber failed: ${String(e?.message ?? e).split("\n")[0]}`); }
 }
+
+/**
+ * #4591: hand-named migrations. In a drizzle-style dir (`<dir>/meta/_journal.json` at `ref`) a lane-added `<tag>.sql` the
+ * generator wrote always has a journal entry the lane added and a `<dir>/meta/<prefix>_snapshot.json` the lane added
+ * (`generate --custom` too); a file named by hand has neither, and its made-up timestamp collides with a sibling lane's.
+ * No journal dir: []. @returns {Promise<string[]>} one problem per file
+ */
+export async function generatorProblems({ git, base, ref = "HEAD" }) {
+  const g = out(git), problems = [];
+  const added = lines(await g(["-c", "core.quotepath=off", "diff", "--name-only", "--diff-filter=A", `${base}...${ref}`])).filter((f) => !SKIP_RE.test(f));
+  const tagsAt = async (r, jp) => { try { return new Set((JSON.parse(await g(["show", `${r}:${jp}`])).entries ?? []).map((e) => e?.tag)); } catch { return new Set(); } };
+  for (const dir of [...new Set(added.filter((f) => f.endsWith(".sql")).map((f) => dirname(f)))]) {
+    const jp = posix.join(dir, "meta", "_journal.json");
+    if (!(await g(["show", `${ref}:${jp}`])).trim()) continue;
+    const [was, now] = [await tagsAt(base, jp), await tagsAt(ref, jp)];
+    for (const f of added.filter((x) => dirname(x) === dir && x.endsWith(".sql"))) {
+      const tag = basename(f, ".sql"), prefix = /^(\d+)[_-]/.exec(tag)?.[1];
+      if (!prefix) continue;
+      const why = [];
+      if (!now.has(tag) || was.has(tag)) why.push("no journal entry added for it");
+      if (!added.includes(posix.join(dir, "meta", `${prefix}_snapshot.json`))) why.push(`no meta/${prefix}_snapshot.json added`);
+      if (why.length) problems.push(`${f}: not produced by the migration generator (${why.join("; ")})`);
+    }
+  }
+  return problems;
+}

package/bin/lean/sequence.test.mjs

@@ -8,9 +8,9 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { sequenceCollisions, journalProblems, snapshotLane, verifyRenumber, numberOnlyChange, headerOnlyChange, renumberLane, resolveSequenceConflicts } from "./sequence.mjs";
+import { sequenceCollisions, journalProblems, snapshotLane, verifyRenumber, numberOnlyChange, headerOnlyChange, renumberLane, resolveSequenceConflicts, generatorProblems } from "./sequence.mjs";
 import { makeSequenceLeaseIo } from "./seqlease.mjs";
-import { sequencePrompt, sequenceSyncNote } from "./prompts.mjs";
+import { sequencePrompt, sequenceSyncNote, migrationGeneratorPrompt, builderImplementPrompt } from "./prompts.mjs";
 
 const sh = (cwd, ...a) => execFileSync("git", a, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@t", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@t" } });
 const gitIn = (cwd) => async (a) => sh(cwd, ...a);
@@ -453,3 +453,42 @@ describe("sequence-numbered documents: two siblings each add an ADR (#4385)", ()
     assert.match(p, /series index/);
   });
 });
+
+describe("hand-named migrations (#4591)", () => {
+  const T1 = "20261025020000_sso_domain_verification", T2 = "20261025020100_next";
+  function base() {
+    const d = tmpDir("gen-");
+    sh(d, "init", "-q", "-b", "main");
+    put(d, { "db/meta/_journal.json": journal("20261024000000_init"), "db/meta/20261024000000_snapshot.json": "{}\n", "db/20261024000000_init.sql": "x;\n" });
+    commit(d, "init");
+    sh(d, "checkout", "-qb", "lane");
+    return d;
+  }
+  it("flags a hand-named file with no journal entry and no snapshot, naming both gaps", async () => {
+    const d = base();
+    put(d, { [`db/${T1}.sql`]: "y;\n" });
+    commit(d, "hand");
+    const p = await generatorProblems({ git: gitIn(d), base: "main" });
+    assert.equal(p.length, 1);
+    assert.match(p[0], /20261025020000_sso_domain_verification\.sql: not produced by the migration generator \(no journal entry added for it; no meta\/20261025020000_snapshot\.json added\)/);
+  });
+  it("accepts generator output (journal entry + snapshot, also --custom) and dirs without a journal", async () => {
+    const d = base();
+    put(d, { [`db/${T1}.sql`]: "y;\n", [`db/${T2}.sql`]: "z;\n", "db/meta/_journal.json": journal("20261024000000_init", T1, T2), "db/meta/20261025020000_snapshot.json": "{}\n", "db/meta/20261025020100_snapshot.json": "{}\n", "plain/0001_a.sql": "a;\n" });
+    commit(d, "generated");
+    assert.deepEqual(await generatorProblems({ git: gitIn(d), base: "main" }), []);
+  });
+  it("flags an entry without a snapshot, and accepts an engine renumber (P3)", async () => {
+    const d = base();
+    put(d, { [`db/${T1}.sql`]: "y;\n", "db/meta/_journal.json": journal("20261024000000_init", T1) });
+    commit(d, "journal only");
+    assert.match((await generatorProblems({ git: gitIn(d), base: "main" }))[0], /\(no meta\/20261025020000_snapshot\.json added\)/);
+    const f = fixture();
+    renumber(f);
+    assert.deepEqual(await generatorProblems({ git: gitIn(f), base: "main" }), []);
+  });
+  it("the fix prompt and the builder rule forbid naming migrations by hand", () => {
+    assert.match(migrationGeneratorPrompt(["db/x.sql: not produced by the migration generator (no journal entry added for it)"]), /drizzle-kit generate --custom[\s\S]*Never name or number migration files by hand/);
+    assert.match(builderImplementPrompt("local"), /Never name or number migration files by hand/);
+  });
+});

package/bin/lean/toolstate.mjs

@@ -0,0 +1,77 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * #4590: tool state that must never ride a lane branch: the engine's own scratch (.forge-lean/) and tool caches
+ * (.eslintcache, *.tsbuildinfo, and a generated next-env.d.ts when the repo ignores it). `info/exclude` only hides untracked
+ * files, so a force-added or checkpoint-staged one gets committed and then conflicts in every base merge. This is the
+ * deterministic gate: before a push, files the branch ADDED against the merge base are removed from the index (a file the
+ * base itself tracks is the repo's own choice and is never touched). Git is injected: `git(args) -> stdout`, throws on failure.
+ */
+export const LEAN_SCRATCH = ".forge-lean/";
+const CACHE_BASENAMES = [/^\.eslintcache$/, /\.tsbuildinfo$/];
+const NEXT_ENV = "next-env.d.ts";
+
+/** Lines `forgedock init` adds to a repo's .gitignore (next-env.d.ts only for Next.js repos). */
+export const GITIGNORE_LINES = [".forge-lean/", ".eslintcache", "*.tsbuildinfo"];
+export const GITIGNORE_NEXT_LINE = NEXT_ENV;
+
+const base = (p) => p.slice(p.lastIndexOf("/") + 1);
+/** Deny-listed path? `nextEnvIgnored`: the repo's own .gitignore ignores next-env.d.ts, so a tracked copy is stray. */
+export function isToolState(path, { nextEnvIgnored = false } = {}) {
+  const p = String(path ?? "").replace(/^\.\//, "");
+  if (!p) return false;
+  if (p.startsWith(LEAN_SCRATCH) || p === LEAN_SCRATCH.slice(0, -1)) return true;
+  const b = base(p);
+  return CACHE_BASENAMES.some((re) => re.test(b)) || (nextEnvIgnored && b === NEXT_ENV);
+}
+export const denied = (paths, opts) => paths.filter((p) => isToolState(p, opts));
+
+const zlist = (out) => String(out ?? "").split("\0").filter(Boolean);
+const quiet = async (git, args) => { try { await git(args); return true; } catch { return false; } };
+
+/** The subset of `paths` the repo's .gitignore ignores (`--no-index`: tracked copies count). */
+async function ignoredNextEnv(git, paths) {
+  const out = [];
+  for (const p of paths) if (base(p) === NEXT_ENV && await quiet(git, ["check-ignore", "-q", "--no-index", "--", p])) out.push(p);
+  return out;
+}
+
+/** Deny-listed paths among `paths`, including next-env.d.ts copies the repo ignores. */
+export async function strayPaths(git, paths) {
+  const plain = denied(paths);
+  const nexts = await ignoredNextEnv(git, paths.filter((p) => !plain.includes(p)));
+  return [...plain, ...nexts];
+}
+
+/** After `git add -A`: unstage deny-listed paths so a checkpoint never commits them. Returns true when something else is staged. */
+export async function unstageToolState(git) {
+  const staged = zlist(await git(["diff", "--cached", "--name-only", "-z"]));
+  const stray = await strayPaths(git, staged);
+  if (stray.length) await git(["reset", "-q", "--", ...stray]);
+  return stray.length ? (await git(["diff", "--cached", "--name-only"])).trim() !== "" : staged.length > 0;
+}
+
+/**
+ * Remove from the index (and commit) the deny-listed files this branch added against `base`. Returns the removed paths ([]
+ * when the branch is clean). Never throws: a failure leaves the branch as it was and the push proceeds.
+ */
+export async function untrackToolState({ git, base: ref, ev = () => {} }) {
+  try {
+    const added = zlist(await git(["diff", "--diff-filter=A", "--name-only", "-z", `${ref}...HEAD`]));
+    const stray = await strayPaths(git, added);
+    if (!stray.length) return [];
+    await git(["rm", "--cached", "-r", "-q", "--ignore-unmatch", "--", ...stray]);
+    await git(["commit", "--no-verify", "-m", "chore: untrack lane tool state (#4590)", "-m", stray.slice(0, 20).join("\n")]);
+    ev({ event: "TOOLSTATE_UNTRACKED", files: stray.slice(0, 20), count: stray.length });
+    return stray;
+  } catch (e) {
+    ev({ event: "TOOLSTATE_UNTRACK_FAILED", error: String(e?.message ?? e).slice(0, 200) });
+    return [];
+  }
+}
+
+/** The deny-list lines a repo's .gitignore text lacks (append-only; `next`: also next-env.d.ts, for Next.js repos). */
+export function gitignoreAdditions(text, { next = false } = {}) {
+  const have = new Set(String(text ?? "").split(/\r?\n/).map((l) => l.trim().replace(/^\//, "")));
+  return [...GITIGNORE_LINES, ...(next ? [GITIGNORE_NEXT_LINE] : [])].filter((l) => !have.has(l));
+}

package/bin/lean/toolstate.test.mjs

@@ -0,0 +1,83 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { tmpDir } from "../tests/_tmp.mjs";
+import { isToolState, denied, untrackToolState, unstageToolState, gitignoreAdditions } from "./toolstate.mjs";
+
+const sh = (cwd, ...a) => execFileSync("git", a, { cwd, encoding: "utf8" });
+const put = (cwd, f, t = "x\n") => { mkdirSync(dirname(join(cwd, f)), { recursive: true }); writeFileSync(join(cwd, f), t); };
+const repo = () => {
+  const d = tmpDir("toolstate-repo-");
+  sh(d, "init", "-q", "-b", "main"); sh(d, "config", "user.email", "t@t"); sh(d, "config", "user.name", "t");
+  put(d, "src/a.js"); put(d, ".gitignore", "next-env.d.ts\n"); sh(d, "add", "-A"); sh(d, "commit", "-q", "-m", "base");
+  sh(d, "checkout", "-q", "-b", "lane");
+  return d;
+};
+const gitIn = (d) => async (args) => execFileSync("git", args, { cwd: d, encoding: "utf8" });
+
+describe("isToolState (#4590)", () => {
+  it("matches scratch and caches at any depth, nothing else", () => {
+    for (const p of [".forge-lean/result.json", ".forge-lean/logs/x", "apps/worker/.eslintcache", ".eslintcache", "a/b/tsconfig.tsbuildinfo"]) assert.ok(isToolState(p), p);
+    for (const p of ["src/eslintcache.ts", "src/.eslintcache.md", "forge-lean/x", "docs/.forge-lean.md", "apps/web/next-env.d.ts", "x.tsbuildinfo.json"]) assert.ok(!isToolState(p), p);
+  });
+  it("next-env.d.ts only when the repo ignores it", () => {
+    assert.ok(isToolState("apps/web/next-env.d.ts", { nextEnvIgnored: true }));
+    assert.deepEqual(denied(["a", ".eslintcache"]), [".eslintcache"]);
+  });
+});
+
+describe("untrackToolState on a real repo (#4590)", () => {
+  it("removes what the lane added, keeps product files and files the base tracks, then a second run is a no-op", async () => {
+    const d = repo();
+    put(d, "src/b.js"); put(d, ".forge-lean/result.json"); put(d, "apps/worker/.eslintcache"); put(d, "apps/web/next-env.d.ts");
+    sh(d, "add", "-f", "-A");
+    sh(d, "commit", "-q", "-m", "lane");
+    const events = [];
+    const removed = await untrackToolState({ git: gitIn(d), base: "main", ev: (e) => events.push(e) });
+    assert.deepEqual(removed.sort(), [".forge-lean/result.json", "apps/web/next-env.d.ts", "apps/worker/.eslintcache"]);
+    assert.equal(events[0].event, "TOOLSTATE_UNTRACKED");
+    assert.deepEqual(sh(d, "diff", "--name-only", "main...HEAD").trim().split("\n"), ["src/b.js"]);
+    assert.ok(sh(d, "status", "--porcelain").includes("?? .forge-lean/") || sh(d, "ls-files", "--others").includes(".forge-lean"), "files stay on disk");
+    assert.deepEqual(await untrackToolState({ git: gitIn(d), base: "main" }), []);
+  });
+
+  it("a cache the base already tracks is the repo's own choice and stays", async () => {
+    const d = repo(); sh(d, "checkout", "-q", "main");
+    put(d, "pkg/.eslintcache"); sh(d, "add", "-A"); sh(d, "commit", "-q", "-m", "base cache"); sh(d, "checkout", "-q", "lane"); sh(d, "merge", "-q", "main");
+    put(d, "src/c.js"); sh(d, "add", "-A"); sh(d, "commit", "-q", "-m", "lane");
+    assert.deepEqual(await untrackToolState({ git: gitIn(d), base: "main" }), []);
+    assert.ok(sh(d, "ls-files").includes("pkg/.eslintcache"));
+  });
+
+  it("a git failure never throws", async () => {
+    const events = [];
+    assert.deepEqual(await untrackToolState({ git: async () => { throw new Error("boom"); }, base: "main", ev: (e) => events.push(e) }), []);
+    assert.equal(events[0].event, "TOOLSTATE_UNTRACK_FAILED");
+  });
+});
+
+describe("unstageToolState (#4590)", () => {
+  it("a checkpoint's add -A stages the work but not the scratch or caches", async () => {
+    const d = repo(); put(d, "src/b.js"); put(d, ".eslintcache"); put(d, ".forge-lean/x");
+    sh(d, "add", "-A", "-f");
+    assert.equal(await unstageToolState(gitIn(d)), true);
+    assert.equal(sh(d, "diff", "--cached", "--name-only").trim(), "src/b.js");
+  });
+  it("only tool state staged: nothing to commit", async () => {
+    const d = repo(); put(d, ".eslintcache"); sh(d, "add", "-f", ".eslintcache");
+    assert.equal(await unstageToolState(gitIn(d)), false);
+  });
+});
+
+describe("gitignoreAdditions (#4590)", () => {
+  it("adds only the missing lines, and next-env.d.ts only for Next.js", () => {
+    assert.deepEqual(gitignoreAdditions(""), [".forge-lean/", ".eslintcache", "*.tsbuildinfo"]);
+    assert.deepEqual(gitignoreAdditions("node_modules\n/.eslintcache\n.forge-lean/\n"), ["*.tsbuildinfo"]);
+    assert.deepEqual(gitignoreAdditions(".forge-lean/\n.eslintcache\n*.tsbuildinfo\n"), []);
+    assert.deepEqual(gitignoreAdditions(".forge-lean/\n.eslintcache\n*.tsbuildinfo\n", { next: true }), ["next-env.d.ts"]);
+  });
+});

package/bin/lean/verify.mjs

@@ -33,7 +33,8 @@ const OK = ["success", "neutral", "skipped"];
  * maxRounds, precheckTimeoutSeconds, precheckTotalSeconds, checkRun, checks, postMerge, duplicateExports, e2e}. Invalid values fall back to the defaults; mode defaults to local (today's
  * behaviour); checkRun (`check_run`, #4270) is true only for the literal `true`; checks (#4387) is the optional allow-list
  * of check names that gate CI verification, or null; e2e is the e2e merge gate (#4403, e2e.mjs parseE2e). #4406: postMerge (`post_merge`) is the command run on
- * the merged tree at base-sync before the push (null: the lane's scoped typecheck); duplicateExports is false only for the literal `false`.
+ * the merged tree at base-sync before the push (null: the lane's scoped typecheck); duplicateExports is false only for the literal `false`. #4585: invariants (`invariants`, a block list read by engine-cli
+ * readVerify) are repo-wide check commands that run in every pre-PR round whichever tests were selected; [] when none.
  */
 export function parseVerify(sec = {}) {
   const s = sec && typeof sec === "object" ? sec : {};
@@ -54,8 +55,12 @@ export function parseVerify(sec = {}) {
   const names = rawChecks.map((x) => String(x ?? "").trim()).filter(Boolean);
   const checks = names.length ? [...new Set(names)] : null;
   const postMerge = str(s.post_merge) || null;
+  // a flow list (`[a, "b c"]`) arrives as one scalar from the one-level reader: strip the brackets and quotes
+  const rawFlaky = Array.isArray(s.flaky) ? s.flaky : str(s.flaky).trim().replace(/^\[(.*)\]$/s, "$1").split(",");
+  const flaky = [...new Set(rawFlaky.map((x) => String(x ?? "").trim().replace(/^(["'])(.*)\1$/s, "$2").trim()).filter(Boolean))];
   const duplicateExports = str(s.duplicate_exports).toLowerCase() !== "false";
-  return { mode, workflow, pathsInput, skipPaths, maxRounds, precheckTimeoutSeconds, precheckTotalSeconds, checkRun, checks, postMerge, duplicateExports, e2e: parseE2e(s) };
+  const invariants = [...new Set((Array.isArray(s.invariants) ? s.invariants : []).map((x) => String(x ?? "").trim()).filter(Boolean))];
+  return { mode, workflow, pathsInput, skipPaths, maxRounds, precheckTimeoutSeconds, precheckTotalSeconds, checkRun, checks, postMerge, flaky, duplicateExports, invariants, e2e: parseE2e(s) };
 }
 
 const globRe = (g) => new RegExp(`^${g.split("**").map((p) => p.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")).join(".*")}$`);
@@ -91,6 +96,17 @@ export async function collectFailedLogs(io, failedChecks) {
   }
   return capLogs(out);
 }
+/**
+ * #4586: split failures [{job, log}] by `verify.flaky` ids: a failure is flaky when its job name equals an id. Flaky
+ * failures are reported only; `own` is what may block or reach the builder. Never by log text: a job whose log names a
+ * flaky test can also hold a real failure, and an Actions run attaches its failed logs to its first failed check (#4614).
+ */
+export function splitFlaky(failures, flaky = []) {
+  const ids = (flaky ?? []).filter(Boolean);
+  const own = [], known = [];
+  for (const f of failures ?? []) (ids.includes(f?.job) ? known : own).push(f);
+  return { own, flaky: known };
+}
 const RANK = { failure: 2, pending: 1, success: 0 };
 /**
  * #4387: one check per name at its latest attempt: the highest check-run id (ids grow monotonically, so a rerun or a later

package/bin/lean/verify.test.mjs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { parseVerify, matchesGlob, skipsCi, capLogs, runCiVerify, collectFailedLogs, verifyReport, DEFAULT_SKIP_PATHS, LOG_CAP, VERIFY_CHECK_NAME, VERIFY_TEXT_CAP, latestPerName, ciGate, rerunFailedOnce, rerunTarget } from "./verify.mjs";
+import { splitFlaky, parseVerify, matchesGlob, skipsCi, capLogs, runCiVerify, collectFailedLogs, verifyReport, DEFAULT_SKIP_PATHS, LOG_CAP, VERIFY_CHECK_NAME, VERIFY_TEXT_CAP, latestPerName, ciGate, rerunFailedOnce, rerunTarget } from "./verify.mjs";
 import { precheck } from "./conformance.mjs";
 import { parseE2e } from "./e2e.mjs";
 
@@ -23,9 +23,9 @@ function fake(o = {}) {
 
 describe("verify-by-CI config (#4167)", () => {
   it("parseVerify defaults to local and rejects invalid values", () => {
-    assert.deepEqual(parseVerify({}), { mode: "local", workflow: null, pathsInput: null, skipPaths: [...DEFAULT_SKIP_PATHS], maxRounds: 2, precheckTimeoutSeconds: 300, precheckTotalSeconds: 600, checkRun: false, checks: null, postMerge: null, duplicateExports: true, e2e: parseE2e({}) });
+    assert.deepEqual(parseVerify({}), { mode: "local", workflow: null, pathsInput: null, skipPaths: [...DEFAULT_SKIP_PATHS], maxRounds: 2, precheckTimeoutSeconds: 300, precheckTotalSeconds: 600, checkRun: false, checks: null, postMerge: null, flaky: [], duplicateExports: true, invariants: [], e2e: parseE2e({}) });
     const v = parseVerify({ mode: "ci", workflow: ".github/workflows/verify.yml", paths_input: "changed_paths", skip_paths: "*.md, docs/** ,", max_rounds: "3" });
-    assert.deepEqual(v, { mode: "ci", workflow: ".github/workflows/verify.yml", pathsInput: "changed_paths", skipPaths: ["*.md", "docs/**"], maxRounds: 3, precheckTimeoutSeconds: 300, precheckTotalSeconds: 600, checkRun: false, checks: null, postMerge: null, duplicateExports: true, e2e: parseE2e({}) });
+    assert.deepEqual(v, { mode: "ci", workflow: ".github/workflows/verify.yml", pathsInput: "changed_paths", skipPaths: ["*.md", "docs/**"], maxRounds: 3, precheckTimeoutSeconds: 300, precheckTotalSeconds: 600, checkRun: false, checks: null, postMerge: null, flaky: [], duplicateExports: true, invariants: [], e2e: parseE2e({}) });
     assert.equal(parseVerify({ mode: "remote" }).mode, "local");
     assert.equal(parseVerify({ workflow: "x; rm -rf /" }).workflow, null);
     assert.equal(parseVerify({ max_rounds: "-1" }).maxRounds, 2);
@@ -64,6 +64,14 @@ describe("verify-by-CI config (#4167)", () => {
   });
 });
 
+describe("verify.invariants (#4585)", () => {
+  it("parseVerify keeps a trimmed, unique, non-empty invariants list; default []", () => {
+    assert.deepEqual(parseVerify({}).invariants, []);
+    assert.deepEqual(parseVerify({ invariants: [" a ", "a", "", "b c"] }).invariants, ["a", "b c"]);
+    assert.deepEqual(parseVerify({ invariants: "a,b" }).invariants, [], "only a block list counts");
+  });
+});
+
 describe("runCiVerify (#4167)", () => {
   it("docs-only: skipped without a push or any CI call", async () => {
     const f = fake();
@@ -159,6 +167,24 @@ describe("CI verification gate, latest attempt and flake rerun (#4387)", () => {
   });
 });
 
+describe("verify.flaky (#4586)", () => {
+  it("parses an array or comma list, trimmed and deduped; default empty", () => {
+    assert.deepEqual(parseVerify({}).flaky, []);
+    assert.deepEqual(parseVerify({ flaky: " a, b ,a," }).flaky, ["a", "b"]);
+    assert.deepEqual(parseVerify({ flaky: ["x", " y"] }).flaky, ["x", "y"]);
+  });
+  it("parses a flow list scalar, quotes stripped", () => {
+    assert.deepEqual(parseVerify({ flaky: "[a, \"b c\", 'd']" }).flaky, ["a", "b c", "d"]);
+  });
+  it("splitFlaky matches by exact job name only, never log text (#4614)", () => {
+    const fs = [{ job: "memory-erasure", log: "" }, { job: "test", log: "FAIL pdf timing\nFAIL real regression" }, { job: "lint", log: "boom" }];
+    const r = splitFlaky(fs, ["memory-erasure", "pdf timing"]);
+    assert.deepEqual(r.flaky.map((f) => f.job), ["memory-erasure"]);
+    assert.deepEqual(r.own.map((f) => f.job), ["test", "lint"]);
+    assert.equal(splitFlaky(fs, []).own.length, 3);
+  });
+});
+
 describe("merge-time fix rounds and declared check commands (#4240)", () => {
   it("collectFailedLogs fetches one log per Actions run and caps the total", async () => {
     const fetched = [];