forgedock 1.35.0 → 1.36.0

package/bin/lean/postdeploy-check.test.mjs

@@ -0,0 +1,146 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { parseChecks, itemCheckIds, measureFollowup, monitorRecord, CHECK_ID_RE } from "./postdeploy-check.mjs";
+import { postDeployOnly } from "./prefilter.mjs";
+import { validateContract, applyAmendments, precheck, followupItems } from "./conformance.mjs";
+import { PROBE_MARKER } from "./probe.mjs";
+
+const item = (id, why) => `- [ ] \`${id}: some quote here\` — post-deploy: ${why}`;
+const body = (items) => `## Acceptance Criteria\n\n${items.join("\n")}\n\n<!-- FORGE:DEFERRED_FROM: #40 -->\n`;
+const CHECKS = JSON.stringify({ smoke: { run: "echo ok", timeout: 5 }, bad: "echo nope", "bad id!": "x", rx: { run: "echo up", pass: "/up/" }, norun: {} });
+
+function world({ file = CHECKS, spawn } = {}) {
+  const w = { gh: [], git: [], spawned: [] };
+  w.io = {
+    gh: async (a) => { w.gh.push(a); return ""; },
+    git: async (a) => { w.git.push(a); if (a[0] === "show") { if (file == null) throw new Error("missing"); return file; } return "deadbeef\n"; },
+  };
+  w.spawn = async (o) => { w.spawned.push(o.run); return spawn ? spawn(o) : { code: o.run === "echo nope" ? 1 : 0, stdout: o.run === "echo nope" ? "boom" : "ok", stderr: "" }; };
+  return w;
+}
+const run = (w, bodyText, extra = {}) => measureFollowup({ iss: { number: 41, body: bodyText, comments: [] }, repo: "o/r", parent: 40, def: "main", shas: ["abc"], cwd: "/repo", io: w.io, config: { env: [], timeoutS: 5 }, env: {}, spawn: w.spawn, ...extra });
+
+describe("post-deploy named checks (#4626)", () => {
+  it("parses the checks file; malformed entries are dropped", () => {
+    const c = parseChecks(CHECKS);
+    assert.deepEqual(Object.keys(c).sort(), ["bad", "rx", "smoke"]);
+    assert.equal(c.smoke.timeoutS, 5); assert.equal(c.rx.pass.kind, "regex");
+    assert.deepEqual(parseChecks("not json"), {});
+    assert.ok(CHECK_ID_RE.test("login-smoke") && !CHECK_ID_RE.test("Bad Id"));
+  });
+
+  it("postDeployOnly still matches items with and without a [check:id] token", () => {
+    assert.ok(postDeployOnly(body([item("R1", "[check:smoke] soak"), item("R2", "only in prod")])));
+  });
+  it("extracts [check:id] per item; an item without one yields null", () => {
+    assert.deepEqual(itemCheckIds(body([item("R1", "[check:smoke] soak"), item("R2", "only in prod")])), ["smoke", null]);
+  });
+
+  it("pass: runs the default-branch command, records FORGE:PROBE, closes the follow-up, no reopen", async () => {
+    const w = world();
+    const r = await run(w, body([item("R1", "[check:smoke] x")]));
+    assert.equal(r.state, "pass");
+    assert.deepEqual(w.spawned, ["echo ok"]);
+    assert.ok(w.git.some((a) => a.join(" ") === "show origin/main:.forge/post-deploy-checks.json"));
+    const cm = w.gh.find((a) => a[1] === "comment");
+    assert.match(cm[cm.indexOf("--body") + 1], new RegExp(PROBE_MARKER));
+    assert.ok(w.gh.some((a) => a[1] === "close" && a[2] === "41"));
+    assert.ok(!w.gh.some((a) => a[1] === "reopen"));
+  });
+
+  it("fail: reopens the parent with the output and does not close", async () => {
+    const w = world();
+    const r = await run(w, body([item("R1", "[check:bad] x")]));
+    assert.equal(r.state, "fail");
+    assert.ok(w.gh.some((a) => a[1] === "reopen" && a[2] === "40"));
+    assert.ok(w.gh.some((a) => a[1] === "comment" && a[2] === "40" && a[a.indexOf("--body") + 1].includes("boom")));
+    assert.ok(!w.gh.some((a) => a[1] === "close"));
+  });
+
+  it("no runnable check: awaiting-measurement, nothing runs, no model call", async () => {
+    for (const [file, b] of [[CHECKS, body([item("R1", "[check:ghost] x")])], [null, body([item("R1", "[check:smoke] x")])], [CHECKS, body([item("R1", "x"), item("R2", "[check:smoke] y")])]]) {
+      const w = world({ file });
+      assert.equal((await run(w, b)).state, "awaiting-measurement");
+      assert.deepEqual(w.spawned, []); assert.deepEqual(w.gh, []);
+    }
+  });
+
+  it("a command declared in the issue body never runs", async () => {
+    const w = world();
+    const b = body([item("R1", "[check:ghost] x")]) + "\n```forge-probe\nrun: rm -rf /\n```\n";
+    assert.equal((await run(w, b)).state, "awaiting-measurement");
+    assert.deepEqual(w.spawned, []);
+  });
+
+  it("migration: the six open follow-up shapes (no check id) all park awaiting-measurement", async () => {
+    for (const n of [4415, 4421, 4438, 4488, 4495, 4498]) {
+      const w = world();
+      const r = await run(w, body([item(`R${n % 7}`, "only checkable after the next deploy")]));
+      assert.equal(r.state, "awaiting-measurement", `#${n}`);
+      assert.deepEqual(w.spawned, []);
+    }
+  });
+
+  it("a recorded fail for the same fix is not re-run", async () => {
+    const w = world();
+    const c = { body: `<!-- ${PROBE_MARKER} -->\n${JSON.stringify({ fix: "abc", result: "fail" })}` };
+    const r = await run(w, body([item("R1", "[check:smoke] x")]), { iss: { number: 41, body: body([item("R1", "[check:smoke] x")]), comments: [c] }, isTrusted: () => true });
+    assert.equal(r.state, "recorded-fail"); assert.deepEqual(w.spawned, []);
+  });
+
+  it("contract: post-deploy needs a check id; amendment too; precheck rejects an unknown id; followup item names it", () => {
+    const Q = "The deploy-time health row must exist after promotion.";
+    const c = { requirements: [{ id: "R1", quote: Q, disposition: "post-deploy", why: "w" }], deliverables: [], preserve: [], validate: [{ id: "V1", command: "true" }] };
+    assert.ok(validateContract(c, Q).problems.some((p) => /needs a check id/.test(p)));
+    assert.ok(!validateContract({ ...c, requirements: [{ ...c.requirements[0], check: "smoke" }] }, Q).problems.some((p) => /check id/.test(p)));
+    const frozen = { ...c, requirements: [{ id: "R1", quote: Q, disposition: "deliver" }] };
+    assert.ok(applyAmendments(frozen, [{ kind: "post-deploy", requirement: "R1", why: "w" }], Q).problems.some((p) => /check id/.test(p)));
+    const ok = applyAmendments(frozen, [{ kind: "post-deploy", requirement: "R1", why: "w", check: "smoke" }], Q);
+    assert.equal(ok.contract.requirements[0].check, "smoke");
+    const pc = precheck({ contract: { ...c, requirements: [{ ...c.requirements[0], check: "ghost" }] }, result: { requirements: [] }, changedFiles: [], checkIds: new Set(["smoke"]) });
+    assert.ok(pc.failures.some((f) => f.kind === "check_unknown"));
+    assert.match(followupItems([{ ...c.requirements[0], check: "smoke" }])[0].why, /^post-deploy: \[check:smoke\] w/);
+  });
+});
+
+describe("windowed post-deploy checks (#4627)", () => {
+  const WIN = JSON.stringify({ soak: { run: "echo ok", for: "7d", every: "6h" }, soakd: { run: "echo ok", for: "2d" }, noFor: { run: "echo ok", every: "6h" }, badFor: { run: "echo ok", for: "soon" }, zero: { run: "echo ok", for: "0" }, plain: "echo ok" });
+  const NOW = Date.parse("2026-10-26T00:00:00Z");
+  it("parses for/every; every defaults to 6h; every without for or a bad duration drops the entry", () => {
+    const c = parseChecks(WIN);
+    assert.deepEqual(Object.keys(c).sort(), ["plain", "soak", "soakd"]);
+    assert.equal(c.soak.forMs, 7 * 86400e3); assert.equal(c.soak.everyMs, 6 * 3600e3);
+    assert.equal(c.soakd.everyMs, 6 * 3600e3);
+    assert.equal(c.plain.forMs, undefined);
+  });
+  it("first pass records the release and window, labels, and keeps the follow-up open", async () => {
+    const w = world({ file: WIN });
+    const r = await run(w, body([item("R1", "[check:soak] x")]), { now: () => NOW });
+    assert.equal(r.state, "monitoring");
+    assert.ok(!w.gh.some((a) => a[1] === "close") && !w.gh.some((a) => a[1] === "reopen"));
+    assert.ok(w.gh.some((a) => a[1] === "edit" && a.includes("post-deploy-monitoring")));
+    const cm = w.gh.find((a) => a[1] === "comment");
+    const rec = monitorRecord(cm[cm.indexOf("--body") + 1]);
+    assert.equal(rec.result, "pass"); assert.equal(rec.until, NOW + 7 * 86400e3); assert.equal(rec.everyMs, 6 * 3600e3); assert.equal(rec.defaultSha, "deadbeef");
+  });
+  it("a recorded windowed pass is not re-measured by the pre-filter path", async () => {
+    const w = world({ file: WIN });
+    const rec = { body: `<!-- ${PROBE_MARKER} -->\n${JSON.stringify({ fix: "abc", result: "pass", at: new Date(NOW).toISOString(), window_until: new Date(NOW + 1e9).toISOString() })}` };
+    const b = body([item("R1", "[check:soak] x")]);
+    const r = await run(w, b, { iss: { number: 41, body: b, comments: [rec] }, isTrusted: () => true });
+    assert.equal(r.state, "monitoring"); assert.deepEqual(w.spawned, []);
+  });
+  it("a non-windowed check still closes on pass (part 1 unchanged)", async () => {
+    const w = world({ file: WIN });
+    assert.equal((await run(w, body([item("R1", "[check:plain] x")]))).state, "pass");
+    assert.ok(w.gh.some((a) => a[1] === "close"));
+  });
+  it("a first-run fail of a windowed check reopens the parent as before", async () => {
+    const w = world({ file: JSON.stringify({ soak: { run: "echo nope", for: "7d" } }), spawn: () => ({ code: 1, stdout: "boom", stderr: "" }) });
+    assert.equal((await run(w, body([item("R1", "[check:soak] x")]))).state, "fail");
+    assert.ok(w.gh.some((a) => a[1] === "reopen" && a[2] === "40"));
+  });
+});
+

package/bin/lean/postdeploy-monitor.mjs

@@ -0,0 +1,87 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * Windowed post-deploy monitoring (#4627). A follow-up whose checks declare `for` (and `every`) stays open with the
+ * `post-deploy-monitoring` label after its first pass. `sweepDue` (run by schedd's timer and `forgedock probe --due`) re-runs
+ * each one when its cadence elapsed or `origin/<default>` moved (a release), with the command read from the default branch
+ * (never an issue). A pass is a FORGE:PROBE record; the window end closes the follow-up; a fail after a pass files one
+ * regression issue naming the fix commit and the last-passing and breaking release, then closes the follow-up. No model call.
+ */
+import { readProbeConfig, resolveDefaultBranch, PROBE_MARKER, OUTPUT_TAIL } from "./probe.mjs";
+import { MONITORING_LABEL, checksAt, itemCheckIds, monitorRecord, runNamedChecks, CHECKS_FILE } from "./postdeploy-check.mjs";
+import { deferredFrom, isTrustedIssueComment } from "./prefilter.mjs";
+
+export const REGRESSION_MARKER = "FORGE:REGRESSION";
+const fenced = (s) => { const f = "`".repeat(Math.max(3, ...[...String(s).matchAll(/`+/g)].map((m) => m[0].length + 1))); return `${f}\n${String(s).trim() || "(no output)"}\n${f}`; };
+const short = (s) => String(s ?? "unknown").slice(0, 12);
+
+/** One monitored follow-up. Outcomes: skipped | unrunnable | not-due | due (dry run) | pass | window-ended | fail. */
+export async function monitorOne({ issue, repo, def, defaultSha, cwd, io, now, dryRun, config, env, spawn }) {
+  const row = (outcome, detail = "", extra = {}) => ({ issue, outcome, detail, ...extra });
+  const iss = JSON.parse(String(await io.gh(["issue", "view", String(issue), "-R", repo, "--json", "number,title,body,state,labels,comments"])));
+  if (String(iss.state).toUpperCase() !== "OPEN") return row("skipped", "not open");
+  const recs = (iss.comments ?? []).filter((c) => isTrustedIssueComment(c)).map((c) => monitorRecord(c?.body)).filter(Boolean);
+  const last = recs[recs.length - 1];
+  const finish = async (comment) => {
+    if (comment) await io.gh(["issue", "comment", String(issue), "-R", repo, "--body", comment]);
+    await io.gh(["issue", "close", String(issue), "-R", repo, "--reason", "completed"]);
+    try { await io.gh(["issue", "edit", String(issue), "-R", repo, "--remove-label", MONITORING_LABEL]); } catch { /* label already gone */ }
+  };
+  if (!last || last.result !== "pass" || !last.until) return row("skipped", last?.result === "fail" ? "already failed (FORGE:PROBE)" : "no windowed pass record");
+  if (now >= last.until) {
+    if (!dryRun) await finish(`<!-- FORGE:MONITOR -->\nPost-deploy monitoring window ended ${new Date(last.until).toISOString()} with no failure; closed.`);
+    return row("window-ended", dryRun ? "dry run: not closed" : "closed", { fix: last.fix });
+  }
+  if (now - last.at < last.everyMs && defaultSha && defaultSha === last.defaultSha) return row("not-due", `next run after ${new Date(last.at + last.everyMs).toISOString()} or a new release`);
+  const ids = itemCheckIds(iss.body);
+  const checks = await checksAt(io.git, [`origin/${def}`], cwd);
+  if (!ids.length || ids.some((id) => !id || !checks[id])) return row("unrunnable", `no runnable check on ${def} (${CHECKS_FILE})`);
+  if (dryRun) return row("due", "dry run: not run", { fix: last.fix });
+  const rows = await runNamedChecks({ ids, checks, cwd, config, env, spawn });
+  const ok = rows.every((r) => r.result === "pass");
+  const rec = { fix: last.fix, default_sha: defaultSha, result: ok ? "pass" : "fail", at: new Date(now).toISOString(), ...(ok ? { window_until: new Date(last.until).toISOString(), every_ms: last.everyMs } : {}) };
+  const sum = rows.map((r) => ({ id: r.id, result: r.result, exit: r.exit, ms: r.ms }));
+  if (ok) {
+    await io.gh(["issue", "comment", String(issue), "-R", repo, "--body", `<!-- ${PROBE_MARKER} -->\n## Post-deploy check: pass\n${JSON.stringify({ ...rec, checks: sum })}\n\nRe-run on \`${def}\` at \`${short(defaultSha)}\`.`]);
+    return row("pass", `checks ${[...new Set(ids)].join(", ")} passed at ${short(defaultSha)}`, { fix: last.fix });
+  }
+  const bad = rows.filter((r) => r.result === "fail");
+  const parent = deferredFrom(iss.body);
+  const title = `Regression: post-deploy check ${bad.map((r) => r.id).join(", ")} failed on ${def}${parent ? ` (fix of #${parent})` : ""}`;
+  const body = [
+    `<!-- ${REGRESSION_MARKER} -->`, `Post-deploy check ${bad.map((r) => `\`${r.id}\``).join(", ")} passed after the fix and now fails.`, "",
+    `- Fix commit: \`${last.fix}\``, `- Last passing release (\`${def}\`): \`${last.defaultSha ?? "unknown"}\``, `- Breaking release (\`${def}\`): \`${defaultSha ?? "unknown"}\``,
+    `- Monitored follow-up: #${issue}${parent ? `; parent: #${parent}` : ""}`, "", ...bad.flatMap((r) => [`**${r.id}** (exit ${r.exit ?? "timeout"})`, fenced(r.output), ""]),
+  ].join("\n").slice(0, OUTPUT_TAIL * 4);
+  const created = String(await io.gh(["issue", "create", "-R", repo, "--title", title, "--body", body]));
+  const num = /\/issues\/(\d+)/.exec(created)?.[1] ?? null;
+  await finish(`<!-- ${PROBE_MARKER} -->\n## Post-deploy check: fail\n${JSON.stringify({ ...rec, regression: num ? Number(num) : null, checks: sum })}\n\nRegression issue ${num ? `#${num}` : "filed"}; monitoring stops.`);
+  return row("fail", `regression ${num ? `#${num}` : "filed"}: ${bad.map((r) => r.id).join(", ")} broke at ${short(defaultSha)} (fix ${short(last.fix)})`, { fix: last.fix, regression: num });
+}
+
+/** Re-run every due monitored follow-up of the repo. Sequential; an error is an `error` row, never a throw. */
+export async function sweepDue({ repo, cwd = process.cwd(), io, dryRun = false, now = () => Date.now(), config = readProbeConfig(cwd), env = process.env, spawn, onResult = null } = {}) {
+  const def = await resolveDefaultBranch({ repo, io, cwd });
+  if (!def) throw new Error("no default branch");
+  const found = JSON.parse(String(await io.gh(["issue", "list", "-R", repo, "--state", "open", "--label", MONITORING_LABEL, "--limit", "100", "--json", "number"])));
+  const list = (Array.isArray(found) ? found : []).map((i) => i.number).filter(Number.isInteger);
+  if (!list.length) return [];
+  try { await io.git(["fetch", "origin", def], { cwd }); } catch { /* offline: the local ref */ }
+  let defaultSha = null;
+  try { defaultSha = String(await io.git(["rev-parse", `origin/${def}`], { cwd })).trim() || null; } catch { /* unknown release */ }
+  const rows = [];
+  for (const issue of list) {
+    try { rows.push(await monitorOne({ issue, repo, def, defaultSha, cwd, io, now: now(), dryRun, config, env, spawn })); } catch (e) {
+      rows.push({ issue, outcome: "error", detail: String(e?.message ?? e).slice(0, 160) });
+    }
+    try { if (!dryRun) await onResult?.(rows[rows.length - 1]); } catch { /* an event sink never fails the sweep */ }
+  }
+  return rows;
+}
+
+/** One line, e.g. `monitoring: pass #1; regression #2; closed #3`; "" when nothing is monitored. */
+export function formatDueSummary(rows) {
+  const g = [["pass", "pass"], ["fail", "regression"], ["window-ended", "window ended"], ["due", "due"], ["not-due", "not due"], ["unrunnable", "unrunnable"], ["error", "error"]];
+  const parts = g.map(([k, l]) => [l, (rows ?? []).filter((r) => r.outcome === k).map((r) => `#${r.issue}`)]).filter(([, a]) => a.length).map(([l, a]) => `${l} ${a.join(" ")}`);
+  return parts.length ? `monitoring: ${parts.join("; ")}` : "";
+}

package/bin/lean/postdeploy-monitor.test.mjs

@@ -0,0 +1,121 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { sweepDue, formatDueSummary } from "./postdeploy-monitor.mjs";
+import { PROBE_MARKER } from "./probe.mjs";
+import { isTrustedIssueComment } from "./prefilter.mjs";
+
+const T0 = Date.parse("2026-10-26T00:00:00Z");
+const H = 3600e3;
+const CHECKS = JSON.stringify({ soak: { run: "echo ok", for: "7d", every: "6h" } });
+const BODY = "## Acceptance Criteria\n\n- [ ] `R1: health row exists` — post-deploy: [check:soak] soak\n\n<!-- FORGE:DEFERRED_FROM: #40 -->\n";
+const rec = (o) => ({ authorAssociation: "OWNER", author: { login: "bot" }, body: `<!-- ${PROBE_MARKER} -->\n${JSON.stringify({ fix: "fix1234567890", default_sha: "rel1", result: "pass", at: new Date(T0).toISOString(), window_until: new Date(T0 + 7 * 24 * H).toISOString(), every_ms: 6 * H, ...o })}` });
+
+function world({ comments = [rec({})], head = "rel1", file = CHECKS, code = 0, state = "OPEN" } = {}) {
+  const w = { gh: [], git: [], spawned: [] };
+  w.io = {
+    gh: async (a) => {
+      w.gh.push(a);
+      const k = a.slice(0, 2).join(" ");
+      if (k === "repo view") return "main\n";
+      if (k === "issue list") return JSON.stringify([{ number: 41 }]);
+      if (k === "issue view") return JSON.stringify({ number: 41, state, title: "", body: BODY, labels: [{ name: "post-deploy-monitoring" }], comments });
+      if (k === "issue create") return "https://github.com/o/r/issues/77\n";
+      return "";
+    },
+    git: async (a) => { w.git.push(a); if (a[0] === "show") { if (file == null) throw new Error("missing"); return file; } if (a[0] === "rev-parse") return `${head}\n`; return ""; },
+  };
+  w.spawn = async (o) => { w.spawned.push(o.run); return { code, stdout: code ? "broke" : "ok", stderr: "" }; };
+  return w;
+}
+const sweep = (w, o = {}) => sweepDue({ repo: "o/r", cwd: "/repo", io: w.io, now: () => T0 + H, config: { env: [], timeoutS: 5 }, env: {}, spawn: w.spawn, ...o });
+const calls = (w, k) => w.gh.filter((a) => a.slice(0, 2).join(" ") === k);
+
+const trustedOk = isTrustedIssueComment(rec({}));
+
+describe("post-deploy windowed monitoring (#4627)", () => {
+  it("fixture comments count as trusted", () => assert.ok(trustedOk));
+
+  it("not due: cadence not elapsed and no new release", async () => {
+    const w = world();
+    const rows = await sweep(w);
+    assert.equal(rows[0].outcome, "not-due"); assert.deepEqual(w.spawned, []);
+  });
+
+  it("due by cadence: re-runs the default-branch command and records a pass; the follow-up stays open", async () => {
+    const w = world();
+    const rows = await sweep(w, { now: () => T0 + 7 * H });
+    assert.equal(rows[0].outcome, "pass"); assert.deepEqual(w.spawned, ["echo ok"]);
+    assert.ok(w.git.some((a) => a.join(" ") === "show origin/main:.forge/post-deploy-checks.json"));
+    assert.equal(calls(w, "issue comment").length, 1);
+    assert.equal(calls(w, "issue close").length, 0); assert.equal(calls(w, "issue create").length, 0);
+  });
+
+  it("due by a new release (origin/main moved) well before the cadence", async () => {
+    const w = world({ head: "rel2" });
+    const rows = await sweep(w);
+    assert.equal(rows[0].outcome, "pass"); assert.deepEqual(w.spawned, ["echo ok"]);
+  });
+
+  it("window end closes the follow-up and drops the label without running", async () => {
+    const w = world();
+    const rows = await sweep(w, { now: () => T0 + 8 * 24 * H });
+    assert.equal(rows[0].outcome, "window-ended"); assert.deepEqual(w.spawned, []);
+    assert.equal(calls(w, "issue close").length, 1);
+    assert.ok(calls(w, "issue edit").some((a) => a.includes("--remove-label")));
+  });
+
+  it("pass then fail files one regression naming the fix commit and both releases, then closes the follow-up", async () => {
+    const w = world({ head: "rel2", code: 1 });
+    const rows = await sweep(w);
+    assert.equal(rows[0].outcome, "fail"); assert.equal(rows[0].regression, "77");
+    const [create] = calls(w, "issue create");
+    const text = create[create.indexOf("--body") + 1];
+    assert.match(create[create.indexOf("--title") + 1], /Regression: post-deploy check soak failed on main \(fix of #40\)/);
+    assert.match(text, /FORGE:REGRESSION/); assert.match(text, /fix1234567890/); assert.match(text, /`rel1`/); assert.match(text, /`rel2`/); assert.match(text, /broke/);
+    assert.equal(calls(w, "issue close").length, 1);
+    assert.ok(!w.gh.some((a) => a[1] === "reopen"));
+    const cm = calls(w, "issue comment")[0];
+    assert.match(cm[cm.indexOf("--body") + 1], /"result":"fail".*"regression":77/s);
+  });
+
+  it("a follow-up whose latest record is a fail is never re-run or re-filed", async () => {
+    const w = world({ head: "rel3", code: 1, comments: [rec({}), rec({ result: "fail", default_sha: "rel2", regression: 77 })] });
+    const rows = await sweep(w);
+    assert.equal(rows[0].outcome, "skipped"); assert.deepEqual(w.spawned, []); assert.equal(calls(w, "issue create").length, 0);
+  });
+
+  it("an untrusted record never counts", async () => {
+    const w = world({ comments: [{ authorAssociation: "NONE", author: { login: "rando" }, body: rec({}).body }] });
+    assert.equal((await sweep(w, { now: () => T0 + 9 * H }))[0].outcome, "skipped");
+    assert.deepEqual(w.spawned, []);
+  });
+
+  it("a check missing on the default branch is unrunnable and never run", async () => {
+    for (const file of [null, JSON.stringify({ other: "echo hi" })]) {
+      const w = world({ file, head: "rel2" });
+      assert.equal((await sweep(w))[0].outcome, "unrunnable"); assert.deepEqual(w.spawned, []);
+    }
+  });
+
+  it("dry run runs nothing and writes nothing", async () => {
+    const w = world({ head: "rel2" });
+    assert.equal((await sweep(w, { dryRun: true }))[0].outcome, "due");
+    assert.deepEqual(w.spawned, []);
+    assert.equal(calls(w, "issue comment").length + calls(w, "issue close").length + calls(w, "issue create").length, 0);
+  });
+
+  it("no monitored follow-up: no git, no run; the summary names outcomes", async () => {
+    const w = world();
+    w.io.gh = async (a) => (a[0] === "repo" ? "main\n" : "[]");
+    assert.deepEqual(await sweep(w), []); assert.equal(w.git.length, 0);
+    assert.equal(formatDueSummary([{ issue: 1, outcome: "pass" }, { issue: 2, outcome: "fail" }]), "monitoring: pass #1; regression #2");
+  });
+
+  it("reports sink rows for pass and fail only when not a dry run", async () => {
+    const seen = [];
+    await sweep(world({ head: "rel2", code: 1 }), { onResult: (r) => seen.push(r.outcome) });
+    assert.deepEqual(seen, ["fail"]);
+  });
+});

package/bin/lean/precheck.mjs

@@ -42,8 +42,8 @@ export function retryTimeoutMs({ perMs, load1, cores }) {
 
 /**
  * #4589: a check timeout (rc 124) is a busy host, not a failing command: run `run(timeoutMs)`, and when it timed out on its
- * own, once more with `retryTimeoutMs`. `left` (ms still available in a round budget) caps the retry; a retry the budget cut
- * short is `cut` (left to CI). A repeated timeout keeps rc 124 and says it was infrastructure. Other rcs are never retried.
+ * own, once more with `retryTimeoutMs`. `left` (ms still available in a round budget) caps the retry; an exhausted budget, or a retry the budget cut
+ * short, is `cut` (left to CI); a budget with room for no longer retry leaves the first rc 124 a failure (#4620). A repeated timeout keeps rc 124 and says it was infrastructure. Other rcs are never retried.
  * @param {(timeoutMs:number) => Promise<{rc:number, output?:string}>} run
  * @returns {Promise<{r:{rc:number, output?:string}, retried:boolean, cut:boolean}>}
  */
@@ -52,8 +52,10 @@ export async function runWithTimeoutRetry(run, timeoutMs, { left = () => Infinit
   if (r?.rc !== TIMEOUT_RC || !(timeoutMs > 0) || !Number.isFinite(timeoutMs)) return { r, retried: false, cut: false };
   let want = timeoutMs;
   try { want = retryTimeoutMs({ perMs: timeoutMs, ...load() }); } catch { /* no load reading: the minimum factor */ want = timeoutMs * 2; }
-  const t2 = Math.min(want, left());
-  if (!(t2 > timeoutMs)) return { r, retried: false, cut: t2 < want }; // no budget left to retry in: CI runs it
+  const room = left();
+  if (!(room > 0)) return { r, retried: false, cut: true }; // the budget is spent: CI runs it
+  const t2 = Math.min(want, room);
+  if (!(t2 > timeoutMs)) return { r, retried: false, cut: false }; // #4620: no room for a longer retry; its own timeout stays a failure
   const r2 = await run(t2);
   const cut = r2?.rc === TIMEOUT_RC && t2 < want;
   if (r2?.rc === TIMEOUT_RC && !cut) return { r: { ...r2, output: `${String(r2.output ?? "")}\n(infra timeout: host load, not a code failure; retried once with ${Math.round(t2 / 1000)}s)` }, retried: true, cut };

package/bin/lean/precheck.test.mjs

@@ -256,11 +256,26 @@ describe("check timeout is infrastructure (#4589)", () => {
     assert.equal(h2.calls.length, 1);
     assert.equal(r2.results[0].rc, 1);
   });
-  it("a retry the budget cuts short is deferred", async () => {
+  it("an exhausted budget defers a command that hit its own timeout", async () => {
     const h = harness({ cost: { slow: 9e9 } });
-    const r = await runChecks({ commands: ["slow"], budgetMs: 1500, perCommandMs: 1000, now: h.now, run: h.run, load: idle });
+    const r = await runChecks({ commands: ["slow"], budgetMs: 1000, perCommandMs: 1000, now: h.now, run: h.run, load: idle });
+    assert.equal(h.calls.length, 1);
     assert.deepEqual(r.deferred, ["slow"]);
   });
+  it("default budget: a check hitting its own timeout is reported, not deferred (#4620)", async () => {
+    const plan = planPrecheck({ verify: {}, learned: ["npm test"] });
+    const h = harness({ cost: { "npm test": 9e9 } });
+    const r = await runChecks({ commands: plan.commands, budgetMs: plan.budgetMs, perCommandMs: plan.perCommandMs, now: h.now, run: h.run, load: idle });
+    assert.equal(r.results.length, 1);
+    assert.equal(r.results[0].rc, 124);
+    assert.deepEqual(r.deferred, []);
+  });
+  it("a budget with room left but no longer retry reports the timeout as a failure", async () => {
+    const h = harness({ cost: { slow: 9e9 } });
+    const r = await runChecks({ commands: ["slow"], budgetMs: 1500, perCommandMs: 1000, now: h.now, run: h.run, load: idle });
+    assert.equal(h.calls.length, 1);
+    assert.deepEqual([r.results.map((x) => x.rc), r.deferred], [[124], []]);
+  });
   it("runWithTimeoutRetry reports retried", async () => {
     let n = 0;
     const x = await runWithTimeoutRetry(async (ms) => (++n === 1 ? { rc: 124, output: "t" } : { rc: 0, output: String(ms) }), 1000, { load: idle });

package/bin/lean/prefilter.mjs

@@ -15,6 +15,8 @@
  * of origin/<default>, or while forge.yaml `post_deploy.precondition_cmd` exits 1. With `post_deploy.min_age` (#4425) it also
  * stays parked (`awaiting-min-age`) until that long (or the longest window an item's why states) after the fix landed on
  * the default branch. Anything unresolvable fails open.
+ * Named checks (#4626): once ready, the items' `[check:<id>]` checks run from the default branch's checks file (no model
+ * call): pass closes the follow-up, fail reopens the parent. An item without a runnable check parks `awaiting-measurement`.
  * All effects are injected (gh, git, runner, transitionLabel, projector?, execCode?) so it is unit-testable.
  */
 import { execFile } from "node:child_process";
@@ -23,6 +25,7 @@ import { PREFILTER_SYSTEM, prefilterPrompt, parsePrefilterVerdict } from "./prom
 import { isTrustedComment } from "../engine/phases.mjs";
 import { APP_SLUG } from "../init-repo.mjs";
 import { probeResultOf } from "./probe.mjs";
+import { AWAITING_MEASUREMENT_LABEL, MONITORING_LABEL, itemCheckIds, measureFollowup } from "./postdeploy-check.mjs";
 
 export const DEFAULT_PREFILTER_MODEL = "claude-haiku-5-5";
 export const PREFILTER_MARKER = "FORGE:PREFILTER";
@@ -300,16 +303,20 @@ export function lazyDefaultBranch({ io, repo, cwd, configured = null }) {
 }
 /** #4389: label and explain a parked issue once (the comment only when the label was not there yet); best effort. */
 async function markParked({ issue, repo, io, had, gate }) {
-  const edit = () => io.gh(["issue", "edit", String(issue), "-R", repo, "--add-label", AWAITING_PROMOTION_LABEL]);
+  const measure = gate.state === "awaiting-measurement"; // #4626
+  const label = measure ? AWAITING_MEASUREMENT_LABEL : AWAITING_PROMOTION_LABEL;
+  const edit = () => io.gh(["issue", "edit", String(issue), "-R", repo, "--add-label", label]);
   try { await edit(); } catch {
     try {
-      await io.gh(["label", "create", AWAITING_PROMOTION_LABEL, "-R", repo, "--force", "--color", "C5DEF5", "--description", "Post-deploy follow-up parked until its parent fix reaches the default branch. Managed by ForgeDock."]);
+      await io.gh(["label", "create", label, "-R", repo, "--force", "--color", "C5DEF5", "--description", measure ? "Post-deploy follow-up with no runnable default-branch check; never given a lane. Managed by ForgeDock." : "Post-deploy follow-up parked until its parent fix reaches the default branch. Managed by ForgeDock."]);
       await edit();
     } catch { /* the comment and the report still show it */ }
   }
   if (had) return;
-  const what = gate.state === "awaiting-promotion" ? "awaiting promotion" : gate.state === "awaiting-min-age" ? "awaiting its post-deploy soak window" : "awaiting its post-deploy precondition";
-  const body = `<!-- ${PRECONDITION_MARKER} -->\n## Parked: ${what}\n${sanitizeMd(gate.detail)}.\n\nEvery item here is a post-deploy check, so no lane was started. The next orchestrate or triage run checks again and launches this issue once the precondition holds.`;
+  const what = measure ? "awaiting measurement" : gate.state === "awaiting-promotion" ? "awaiting promotion" : gate.state === "awaiting-min-age" ? "awaiting its post-deploy soak window" : "awaiting its post-deploy precondition";
+  const tail = measure ? "Every item here is a post-deploy check, and at least one names no runnable check, so no lane was started and none will be. Name each one with `[check:<id>]` and add `<id>` to the checks file on the default branch, or measure it by hand."
+    : "Every item here is a post-deploy check, so no lane was started. The next orchestrate or triage run checks again and launches this issue once the precondition holds.";
+  const body = `<!-- ${PRECONDITION_MARKER} -->\n## Parked: ${what}\n${sanitizeMd(gate.detail)}.\n\n${tail}`;
   try { await io.gh(["issue", "comment", String(issue), "-R", repo, "--body", capComment(body)]); } catch { /* the label still shows it */ }
 }
 
@@ -328,6 +335,12 @@ export function formatParkedLine(rows) {
     const defs = uniq(soak.map((r) => r.prefilter.default));
     out.push(`awaiting min age: ${soak.map((r) => `#${r.issue}`).join(" ")} (fix on ${defs.join(", ") || "the default branch"}, soak window not elapsed)`);
   }
+  const meas = parked.filter((r) => r.prefilter.kind === "awaiting-measurement"); // #4626
+  if (meas.length) out.push(`awaiting measurement: ${meas.map((r) => `#${r.issue}`).join(" ")} (no runnable default-branch check; no lane)`);
+  const failed = parked.filter((r) => r.prefilter.kind === "check-failed");
+  if (failed.length) out.push(`check failed: ${failed.map((r) => `#${r.issue}`).join(" ")} (parent reopened; waiting for a new fix)`);
+  const mon = parked.filter((r) => r.prefilter.kind === "monitoring"); // #4627
+  if (mon.length) out.push(`monitoring: ${mon.map((r) => `#${r.issue}`).join(" ")} (windowed post-deploy checks re-run on later releases)`);
   const pre = parked.filter((r) => r.prefilter.kind === "awaiting-precondition");
   if (pre.length) out.push(`awaiting precondition: ${pre.map((r) => `#${r.issue}`).join(" ")} (post_deploy.precondition_cmd not ready)`);
   return out.join("\n");
@@ -346,6 +359,8 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
     const labelled = names.some((l) => ["needs-human", "workflow:merged"].includes(l));
     // #4389: a post-deploy follow-up is gated even when an earlier lane escalated it (needs-human); nothing else changes.
     const gated = !!defaultBranch && !names.includes("workflow:merged") && deferredFrom(iss.body) != null && postDeployOnly(iss.body);
+    // #4627: a follow-up under windowed monitoring belongs to `sweepDue`, never to a lane or a second measurement
+    if (names.includes(MONITORING_LABEL)) return { ...out, parked: true, kind: "monitoring", detail: "windowed post-deploy checks re-run on later releases" };
     if (labelled && !gated) return { ...out, detail: "labelled, left to the lane" };
     if (io.projector) {
       let st = null;
@@ -362,6 +377,16 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
       if (gate.state === "ready" && had && !dryRun) {
         try { await io.gh(["issue", "edit", String(issue), "-R", repo, "--remove-label", AWAITING_PROMOTION_LABEL]); } catch { /* best effort */ }
       }
+      if (gate.state === "ready") {
+        const m = await measureFollowup({ iss, repo, parent: gate.parent, def: gate.default, shas: gate.shas, cwd, io, dryRun, isTrusted: isTrustedIssueComment, ...(io.spawnCheck ? { spawn: io.spawnCheck } : {}) });
+        if (m.state === "awaiting-measurement") {
+          if (!dryRun) await markParked({ issue, repo, io, had: names.includes(AWAITING_MEASUREMENT_LABEL), gate: { ...gate, state: m.state, detail: m.detail } });
+          return { ...out, parked: true, kind: m.state, parent: gate.parent, lane, default: gate.default, detail: m.detail };
+        }
+        if (m.state === "monitoring") return { ...out, parked: true, kind: "monitoring", parent: gate.parent, lane, default: gate.default, detail: m.detail };
+        if (m.state === "pass") return { ...out, closed: !dryRun, kind: "post-deploy-check", parent: gate.parent, lane, default: gate.default, detail: m.detail };
+        if (m.state === "fail" || m.state === "recorded-fail") return { ...out, parked: true, kind: "check-failed", parent: gate.parent, lane, default: gate.default, detail: m.detail };
+      }
       if (labelled) return { ...out, detail: `labelled, left to the lane (post-deploy gate: ${gate.state}${gate.detail ? `, ${gate.detail}` : ""})` };
     }
     // #4399: an issue reopened by a failed acceptance probe goes to a lane, never back to an already-fixed close

package/bin/lean/prefilter.test.mjs

@@ -397,14 +397,22 @@ describe("post-deploy precondition gate (#4389)", () => {
     assert.deepEqual(w.edits, []); assert.deepEqual(w.comments, []);
   });
 
-  it("an ancestor (after promotion): not parked, the label is removed, and the issue goes on as before", async () => {
+  it("an ancestor (after promotion): the promotion label is removed; with no runnable check it parks awaiting-measurement, never a lane (#4626)", async () => {
     const w = world({ issues: { 41: { body: followup(40, [item("R2", "post-deploy")]), labels: [{ name: "awaiting-promotion" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
     const r = await gated(w, 41);
-    assert.ok(!r.parked); assert.equal(r.detail, "no already-fixed signal");
-    assert.deepEqual(w.edits, [[41, "--remove-label", "awaiting-promotion"]]);
+    assert.equal(r.parked, true); assert.equal(r.kind, "awaiting-measurement");
+    assert.deepEqual(w.edits, [[41, "--remove-label", "awaiting-promotion"], [41, "--add-label", "awaiting-measurement"]]);
+    assert.equal(w.runner.length, 0);
     const rows = await orchestrate({ issues: [41], readBody: async () => "", prefilter: makePrefilter({ repo: "o/r", cwd: "/repo", io: w.io, defaultBranch: "main" }),
-      runOne: async () => ({ terminalReason: "merged", pr: 7, cost_usd: 1 }) });
-    assert.deepEqual(rows.map((x) => x.outcome), ["merged"]);
+      runOne: async () => { throw new Error("no lane"); } });
+    assert.deepEqual(rows.map((x) => x.outcome), ["awaiting-measurement"]);
+  });
+
+  it("a follow-up under windowed monitoring is parked, never a lane or a second measurement (#4627)", async () => {
+    const w = world({ issues: { 41: { body: followup(40, [item("R2", "[check:smoke] post-deploy")]), labels: [{ name: "post-deploy-monitoring" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
+    const r = await gated(w, 41);
+    assert.equal(r.parked, true); assert.equal(r.kind, "monitoring"); assert.equal(r.closed, false);
+    assert.deepEqual(w.edits, []); assert.deepEqual(w.comments, []); assert.equal(w.runner.length, 0);
   });
 
   it("an unresolvable parent (no merged PR, no trajectory) or an unknown SHA falls through to the lane", async () => {

package/bin/lean/probe.mjs

@@ -267,7 +267,7 @@ export async function resolveDefaultBranch({ repo, io, cwd = process.cwd() }) {
  * Probe `issues`, or (none given) the issues closed within `sweepDays` that mention `forge-probe`, capped at `limit`.
  * Sequential: probes hit production. Never throws per issue: an error is an `error` row.
  */
-export async function sweepProbes({ repo, cwd = process.cwd(), io, issues = null, limit = 50, sinceDays = null, dryRun = false, config = readProbeConfig(cwd), now = () => Date.now(), env = process.env, spawn } = {}) {
+export async function sweepProbes({ repo, cwd = process.cwd(), io, issues = null, limit = 50, sinceDays = null, dryRun = false, config = readProbeConfig(cwd), now = () => Date.now(), env = process.env, spawn, onResult = null } = {}) {
   if (!config.enabled && !issues?.length) return [];
   const defaultBranch = await resolveDefaultBranch({ repo, io, cwd });
   if (!defaultBranch) throw new Error("no default branch");
@@ -284,6 +284,7 @@ export async function sweepProbes({ repo, cwd = process.cwd(), io, issues = null
     try { rows.push(await probeIssue({ issue, repo, cwd, io, defaultBranch, dryRun, config, env, spawn })); } catch (e) {
       rows.push({ issue, outcome: "error", detail: String(e?.message ?? e).slice(0, 160) });
     }
+    try { if (!dryRun) await onResult?.(rows[rows.length - 1]); } catch { /* an event sink never fails the sweep (#4630) */ }
   }
   return rows;
 }

package/bin/lean/prompts.mjs

@@ -63,6 +63,12 @@ export function duplicateExportsPrompt(findings, mode = "local") {
   return `This change exports names that another module of the same app or package already exports:\n${rows}\n\nRename the new export or reuse the existing one, and update every reference and any registry, map or test keyed by the name (same-named entries collide or leave one unprobed). ${rerun(mode)}, commit, and update ${IMPLEMENTATION_FILE} and ${RESULT_FILE}. Do not push or touch GitHub.`;
 }
 
+/** #4596: new keys the lane copied from the source-locale catalog into another locale's catalog. */
+export function i18nCopiesPrompt(findings, mode = "local") {
+  const rows = findings.slice(0, 30).map((d) => `- ${d.path}: ${d.key} = ${JSON.stringify(d.value)} (same as ${d.source})`).join("\n");
+  return `This change adds keys to locale catalogs as English copies of the source locale:\n${rows}\n\nTranslate each into that catalog's language (keep placeholders), and add any translation-status entry the repo tracks as a minimal diff: insert in place, never re-sort or reformat the file. ${rerun(mode)}, commit, and update ${IMPLEMENTATION_FILE} and ${RESULT_FILE}. Do not push or touch GitHub.`;
+}
+
 /** #4591: lane-added migrations the repo's generator did not produce. */
 export function migrationGeneratorPrompt(problems, mode = "local") {
   const rows = problems.slice(0, 30).map((p) => `- ${p}`).join("\n");
@@ -148,7 +154,7 @@ ${HOST_RULES}${toolchainRule(toolchain)}${sparseRule(sparse)}${factsRule(facts)}
 If the issue is already fixed or invalid, write ${RESULT_FILE} {"status":"already-fixed|invalid","summary":"one line","evidence":["file:line ..."]} and stop. If it is blocked, write {"status":"blocked","summary":"",...} with a typed "block" (rules below) and stop.
 
 2. Otherwise write ${CONTRACT_FILE}, the frozen hand-off: a developer who never saw the issue must be able to implement and verify it from this file alone.
-{"requirements":[{"id":"R1","quote":"<verbatim sentence or checklist item from the issue>","disposition":"deliver|defer|post-deploy|not-applicable","why":"<required for defer and post-deploy>","evidence":"<file:line, required for not-applicable>","verify":"<optional: in_lane|out_of_band>"}],
+{"requirements":[{"id":"R1","quote":"<verbatim sentence or checklist item from the issue>","disposition":"deliver|defer|post-deploy|not-applicable","why":"<defer, post-deploy>","check":"<post-deploy: id in .forge/post-deploy-checks.json>","evidence":"<file:line, required for not-applicable>","verify":"<optional: in_lane|out_of_band>"}],
  "deliverables":[{"id":"D1","path":"<file to change>","change":"<what>","requirements":["R1"]}],
  "preserve":[{"id":"P1","what":"<caller, contract or behaviour that must not change, with its path>"}],
  "validate":[{"id":"V1","command":"<exact command: the new regression test plus the existing tests that reference the files you change; a git diff compares against the merge base (origin/<lane>...HEAD), never the moving origin/<lane> tip>"}],
@@ -180,8 +186,9 @@ ${HOST_RULES}${toolchainRule(toolchain)}${sparseRule(sparse)}${factsRule(facts)}
 The contract changes only through typed amendments in ${RESULT_FILE}, each with a why:
 - {"kind":"add-deliverable","path":"<file>","why":""}: a file the contract did not list.
 - {"kind":"add-requirement","requirement":{"id":"R9","quote":"<verbatim from the issue>","disposition":"deliver|defer|post-deploy"},"why":""}: an issue requirement the contract missed.
-- {"kind":"defer|post-deploy","requirement":"R#","why":""}: a requirement that becomes separate work or a post-deploy check. Filed as a tracked follow-up. Not "type"; other kinds are rejected.
+- {"kind":"defer|post-deploy","requirement":"R#","why":"","check":"<id>"}: a requirement that becomes separate work or a post-deploy check. Filed as a tracked follow-up. Not "type"; other kinds are rejected.
 - {"kind":"amend-requirement","requirement":"R#","text":"<revised wording>","why":""}: reworded; judged against text.
+New keys: translate, never copy English; status entries in place.
 Never report a deliver requirement as "deferred" or "follow-up" without an amendment.
 Never name or number migration files by hand; use the generator.
 A new workspace-package dependency in a package.json no deliverable names is blocked by the engine: add it through add-deliverable with a why naming the package, or do not add it.
@@ -365,6 +372,7 @@ You receive the GitHub issue with its comments, the frozen contract (requirement
 - issue_coverage: one row per requirement or acceptance criterion in the issue, quoted verbatim, saying whether the contract covers it, narrows it, or misses it. The skeleton lists the contract's quotes; add a row for any issue requirement the contract does not quote.
 - amendment: a requirement with an \`amendment\` is judged against amendment.text and its why, not the quote; its issue_coverage row is covered when the amendment follows from its why. If it does not hold, mark the row partial with note "amendment: <what to change>".
 - requirements: one row per contract requirement id: implemented|partial|missing|deferred|post-deploy|not-applicable, with evidence as a backtick-quoted repo-relative path:line copied verbatim from the changed files, including (group), [slug] and [...slug] folders (e.g. \`apps/web/app/(console)/layout.tsx:12\`, not route.ts:12) and the validate id or test that proves it (validated_by). For a defer or post-deploy requirement add deferral_ok: true only if it is genuinely separate work or only checkable after a deploy, false if it belongs in this change. For a verify out_of_band row (measured by the named job, not in this lane) set instrumented: true only when its budget test or bench is committed and that job is configured, with that path:line as evidence; false otherwise. Do not judge the measured result.
+- post-deploy requirements: deferral_ok is false when the requirement has no \`check\` id, or its check is neither in .forge/post-deploy-checks.json on the default branch nor added by this change (the commands run from that file only).
 - scope: one row per changed file, pre-filled with the engine's authorization: the deliverable id that authorizes it (deliverables may be directories or globs), "test", "incidental" (changelog, lockfile), or "none" with what it changes. Change it only if the diff shows the file does something its deliverable does not cover.
 - preserve: one row per preserve id: intact|violated|unverified, with path:line. The skeleton starts each at "unverified"; set intact only after checking it.
 - regressions: concrete breakages only, each with path:line.