forgedock 1.36.0 → 1.37.0

package/bin/lean/orchestrate.mjs

@@ -37,6 +37,8 @@
  * issue while maintenance starts stay within `share` of all lane starts (`dispatch: {started, maint}`, persisted), then
  * P2+ features, then (`whenIdle`) maintenance once no feature is pending. Maintenance the budget never admits ends `held`.
  *
+ * Milestone lifecycle (#4657), off unless `lifecycle` is passed (`bin/lean/lifecycle.mjs` makeLifecycle): at batch end
+ * `lifecycle.onBatchEnd(titles)` advances/closes each milestone a `merged` row's result named. Errors never change an outcome.
  * Milestone drift (#4161), off unless `drift` is passed (`bin/lean/drift.mjs` makeDrift): a `merged` milestone-lane run
  * whose result carries `structure` awaits `drift.onMerged(issue, row, result)` before its slot frees. A drift error is
  * reported as a `drift` row and never changes the outcome. With `drift.holds(issue, {body, lane})` (block_dispatch), a
@@ -100,6 +102,7 @@
  */
 import { parseDependsOn } from "../engine/phases.mjs";
 import { classifyNeedsHuman, recoveryCodeOf, OUTCOME_CODES } from "../engine/outcome-codes.mjs";
+import { detectGateDeadlock, formatGateDeadlock } from "./gatewatch.mjs";
 import { recoveryEvidence } from "./render.mjs";
 import { renderAlerts } from "../stats/render.mjs";
 import { formatParkedLine, postDeployOnly } from "./prefilter.mjs";
@@ -236,9 +239,9 @@ const toMap = (o) => new Map(Object.entries(o ?? {}).map(([k, v]) => [Number(k),
  */
 export async function orchestrate({ issues, parallel = 3, runOne, readBody, prefilter = null, resolveLane = null, now = () => Date.now(), onUpdate = () => {}, onCrossLane = () => {},
   store = null, adopt = null, getParallel = null, getAdded = null, getRequeued = null, breaker = null, maxDeferrals = DEFAULT_MAX_DEFERRALS, sleep = cancellableSleep, pollMs = 5000,
-  classify = null, maintenance = null, limits = null, identity = () => "default", batchId = null, drift = null, sched = null, priorityOf = null, remote = null, beforeAdmit = null,
-  recovery = null, decide = () => {}, conflicting = null, relabelNeedsHuman = null, onExit = null, issueLabels = null, getCancelled = null, getHeld = null, stopLane = null,
-  estimate = null, starveMs = DEFAULT_STARVE_MS, signal = null, dispatchCheck = null, syncParked = null, syncEveryMs = DEFAULT_SYNC_EVERY_MS }) {
+  classify = null, maintenance = null, limits = null, identity = () => "default", batchId = null, drift = null, integration = null, sched = null, priorityOf = null, remote = null, beforeAdmit = null,
+  recovery = null, decide = () => {}, conflicting = null, relabelNeedsHuman = null, onExit = null, issueLabels = null, getCancelled = null, getHeld = null, getGates = null, stopLane = null,
+  estimate = null, starveMs = DEFAULT_STARVE_MS, signal = null, dispatchCheck = null, syncParked = null, syncEveryMs = DEFAULT_SYNC_EVERY_MS, lifecycle = null }) {
   const saved = store?.load?.() ?? null;
   const order = saved ? [...saved.order] : [];
   const set = new Set(order);
@@ -273,7 +276,9 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   const parkedBase = new Map(); // #4525: issue -> base sha its parked PR was last synced (or reported conflicting) against
   let lastParkedSync = null;
   const bodies = new Map(); // issue -> body, kept in memory for drift.holds only
+  const lifecycleTitles = new Set(); // #4657: milestones this batch merged into, re-evaluated at batch end
   const driftHeld = new Map(); // issue -> flagged package dir holding it this pass
+  const integHeld = new Map(); // issue -> reason (red integration streak on its milestone lane, #4667) holding it this pass
   const reg = sched?.registry ?? null;
   const priorities = toMap(saved?.priorities); // issue -> priority number; only with the registry
   const remoteMax = remote && Number.isInteger(remote.max) && remote.max >= 0 ? remote.max : 0;
@@ -304,6 +309,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   const recovering = toMap(saved?.recovering); // issue -> {code, attempt, detail, outcome, ...} of the recovery lane queued or running
   const requeueApplied = new Set(saved?.requeueApplied ?? []); // #4550: `--requeue` entries already applied (batch `requeue` file)
   const requeuedInfo = toMap(saved?.requeued); // #4550: issue -> {reason, by, at, prior: [earlier rows]}
+  const everRelabelled = new Set(saved?.relabelled ?? []); // #4656: issues the runner already relabelled; never parked on top
   const relabelled = new Set(saved?.relabelled ?? []); // #4315: queued recoveries relabelled needs-human when a batch stopped
   // #4267: decisions are recorded, never awaited: a failing or slow recorder cannot block the batch.
   const decided = (d) => { try { Promise.resolve(decide?.(d)).catch(() => {}); } catch { /* best effort */ } };
@@ -493,14 +499,23 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     return true;
   };
 
-  const skip = (n, detail) => { results.set(n, { issue: n, outcome: "skipped", pr: null, cost_usd: 0, minutes: 0, detail }); update(results.get(n)); };
+  // #4687: a dependency skip is a waiting state while a blocker re-check can still re-admit it (`waiting`, cleared when the batch ends);
+  // the log row names the triggering issue.
+  const skip = (n, detail, trigger = null) => {
+    results.set(n, { issue: n, outcome: "skipped", pr: null, cost_usd: 0, minutes: 0, detail, ...(trigger !== null && dispatchCheck ? { waiting: true } : {}) });
+    update({ ...results.get(n), ...(trigger !== null ? { trigger } : {}) });
+  };
   const requeue = (n, delayMs) => { pending.push(n); enqueued.set(n, now()); if (delayMs > 0) notBefore.set(n, now() + delayMs); else notBefore.delete(n); };
-  const noteEngineError = () => {
+  const TRANSPORT_TEXT = /fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|socket hang up|HTTP 50[234]/i;
+  const TRANSPORT_COOLDOWN_MS = 5 * 60000;
+  let transportErrors = 0; // #4685: engine-errors in the current window that were link failures
+  const noteEngineError = (detail = "") => {
     if (!breaker) return;
     const t = now(), windowMs = breaker.window_min * 60000;
     errorTimes = [...errorTimes.filter((x) => t - x < windowMs), t];
+    transportErrors = TRANSPORT_TEXT.test(String(detail)) ? Math.min(transportErrors + 1, errorTimes.length) : 0;
     if (!tripped && errorTimes.length >= breaker.errors) {
-      tripped = { at: t, detail: `circuit breaker: ${errorTimes.length} engine-errors within ${breaker.window_min} min; admissions stopped` };
+      tripped = { at: t, ...(transportErrors >= errorTimes.length ? { transport: true } : {}), detail: `circuit breaker: ${errorTimes.length} engine-errors within ${breaker.window_min} min; admissions stopped` };
       update({ issue: null, outcome: "breaker", detail: tripped.detail });
     }
   };
@@ -544,11 +559,11 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       }
       if (parked !== undefined) {
         done();
-        const final = { ...row, outcome: "skipped", detail: `dependency #${parked} needs-human` };
+        const final = { ...row, outcome: "skipped", detail: `dependency #${parked} needs-human`, ...(dispatchCheck ? { waiting: true } : {}) };
         results.set(n, final); save();
         decided({ issue: n, what: `skipped: dependency #${parked} needs-human (not pulled into the batch)`, why: firstLine(row.detail) || "the lane reported an open dependency",
           alternative: `pull #${parked} in and run it again` });
-        update(final);
+        update({ ...final, trigger: parked });
         return;
       }
     }
@@ -588,7 +603,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       row.detail = `gave up after ${deferrals.get(n) ?? 0} deferrals: ${r?.detail ?? r?.code ?? ""}`;
     }
     if (row.outcome === "engine-error") {
-      noteEngineError();
+      noteEngineError(r?.detail);
       if ((engineErrors.get(n) ?? 0) < ENGINE_ERROR_RELAUNCHES) {
         engineErrors.set(n, (engineErrors.get(n) ?? 0) + 1);
         requeue(n, 0); done(); save();
@@ -648,7 +663,16 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     if (!prior && row.outcome === "budget-exceeded" && typeof relabelNeedsHuman === "function") {
       try { await relabelNeedsHuman({ issue: n, evidence: `Implement turn budget overrun (\`budget.exceeded\`) not recovered in this batch:\n${String(row.detail ?? "")}` }); } catch { /* best effort */ }
     }
+    // #4656: a mechanical terminal park (recovery spent or none applies) moves to the remediation queue, not the human queue.
+    if (row.outcome === "needs-human" && !row.parkedQueued && !everRelabelled.has(n) && typeof relabelNeedsHuman === "function" && (cls => cls === "parked" || (cls === "recoverable" && prior))(classifyNeedsHuman({ ...row, issueEdited: r?.issueEdited === true }, { parked: true }))) { // a recoverable row with a finished recovery has used its attempts
+      try { const res = await relabelNeedsHuman({ issue: n, parked: { code: row.code, pr: Number.isInteger(row.pr) ? row.pr : null }, evidence: `Mechanical park \`${row.code}\`${Number.isInteger(row.pr) ? ` (PR #${row.pr})` : ""}:\n${String(row.detail ?? "")}` }); if (res !== false && res !== "failed" && res !== "skipped") row.parkedQueued = true; } catch { /* best effort */ }
+    }
     results.set(n, row);
+    if (row.outcome === "merged" && lifecycle && r?.milestone) lifecycleTitles.add(String(r.milestone)); // #4657
+    if (row.outcome === "merged" && integration?.onMerged && String(rec?.lane ?? r?.lane ?? "").startsWith("milestone/")) {
+      // #4667: counts the merge toward the milestone's integration run; an error is a row, never the outcome.
+      try { await integration.onMerged(n, { ...row, lane: rec?.lane ?? r?.lane }, r); } catch (e) { update({ issue: n, outcome: "integration", detail: `integration check failed: ${String(e?.message ?? e).slice(0, 300)}` }); }
+    }
     if (row.outcome === "merged" && drift?.onMerged && r?.structure && String(rec?.lane ?? r?.lane ?? "").startsWith("milestone/")) {
       save(); update(row);
       // Before the slot frees: the batch never ends with a fold pending, and block_dispatch sees the new flags.
@@ -746,7 +770,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   }
   save();
 
-  const heldDetail = (n) => cancelled ? "cancelled by operator" : opHeld.has(n) ? "held by operator" : tripped?.detail ?? (driftHeld.has(n) ? `drift: ${driftHeld.get(n)} flagged` : budgetStop ? `execution budget: ${budgetStop}` : budgetHeld ? "maintenance share" : "not run");
+  const heldDetail = (n) => cancelled ? "cancelled by operator" : opHeld.has(n) ? "held by operator" : tripped?.detail ?? (integHeld.has(n) ? `integration: ${integHeld.get(n)}` : (driftHeld.has(n) ? `drift: ${driftHeld.get(n)} flagged` : budgetStop ? `execution budget: ${budgetStop}` : budgetHeld ? "maintenance share" : "not run"));
   // #4315: a recovery queued but never launched (the batch stopped: breaker, budget, hold; or a resume that did not relaunch a
   // lost run) left the issue without needs-human, since a non-final attempt does not relabel. Relabel it once, with the full reason.
   // #4318: also on a throw out of the loop and on a signal (`onExit`); `cause` overrides the held reason. Runs once per process.
@@ -759,7 +783,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
         queued: q.attempt, cause: why, recoveryMax });
       let res;
       try { res = await relabelNeedsHuman({ issue: n, evidence }); } catch { res = "failed"; }
-      if (res !== false && res !== "failed") relabelled.add(n); // a failed label add is retried by a resume
+      if (res !== false && res !== "failed") { relabelled.add(n); everRelabelled.add(n); } // a failed label add is retried by a resume
     }
     save();
   })());
@@ -817,6 +841,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       decided({ issue: e.issue, what: `requeued by ${e.by ?? "operator"} (forgedock orchestrate --requeue); prior outcome ${row.outcome}${list.length ? `; dependents back to pending: ${list.join(", ")}` : ""}`,
         why: e.reason || "operator decision", alternative: "start a second batch" });
       update({ issue: e.issue, outcome: "requeued", detail: `${e.reason || "operator decision"} (was ${row.outcome})` });
+      for (const m of moved) if (m !== e.issue) update({ issue: m, outcome: "requeued", detail: `dependency #${e.issue} requeued`, trigger: e.issue }); // #4687
       n++;
     }
     if (fresh.length) save();
@@ -847,6 +872,22 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       update({ issue: null, outcome: "release", detail: fmt(freed) });
     }
   };
+  // #4656: a gate (hold list, settle, ship pre-flight) waiting on an issue the scheduler will not admit: one decision and row per (gate, issue).
+  const gateSeen = new Map(), gateReported = new Set();
+  const checkGates = () => {
+    const gates = [];
+    if (opHeld.size) gates.push({ name: "hold", waitsOn: [...opHeld] });
+    if (getGates) { try { gates.push(...(getGates() ?? [])); } catch { /* best effort */ } }
+    if (!gates.length) return;
+    const unadmittable = (n) => { const x = results.get(n); return !(x && (x.outcome === "needs-human" || x.parkedQueued)); };
+    for (const d of detectGateDeadlock({ gates, admissible: unadmittable, now: now(), firstSeen: gateSeen })) {
+      const key = `${d.gate}#${d.issue}`;
+      if (gateReported.has(key)) continue;
+      gateReported.add(key);
+      decided({ issue: d.issue, what: formatGateDeadlock(d), why: "the gate waits on a parked issue the scheduler will not admit", alternative: "/work-on:remediate the parked issue or release the gate" });
+      update({ issue: d.issue, outcome: "GATE_DEADLOCK", detail: formatGateDeadlock(d) });
+    }
+  };
   const checkCancel = () => {
     if (!getCancelled) return;
     let c = null;
@@ -878,6 +919,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   // #4595: a skipped row whose blocker (`dependency #B ...`) was finished outside the lane is re-admitted: B is re-checked
   // through `dispatchCheck` (at most every WATCH_EVERY_MS, and once before the batch would end); fail-open.
   let lastWatch = null;
+  const settled = new Set(); // #4687: blockers whose close is final (not planned): their dependents stay skipped, no more re-checks
   const readmitted = new Set(); // "n:b": re-admit n on blocker b once; a lane that re-skips on b stays skipped
   const blockerOf = (n) => { const r = results.get(n); const m = r?.outcome === "skipped" ? /^dependency #(\d+) /.exec(r.detail ?? "") : null; return m ? Number(m[1]) : null; };
   const watchable = () => !!dispatchCheck && [...results.keys()].some((n) => blockerOf(n) !== null);
@@ -887,10 +929,18 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     if (!final && lastWatch !== null && t0 - lastWatch < WATCH_EVERY_MS) return;
     lastWatch = t0;
     const resolved = new Set();
-    const roots = new Set([...results.keys()].filter((n) => !readmitted.has(`${n}:${blockerOf(n)}`)).map(blockerOf).filter((b) => b !== null && blockerOf(b) === null));
+    const roots = new Set([...results.keys()].filter((n) => !readmitted.has(`${n}:${blockerOf(n)}`)).map(blockerOf).filter((b) => b !== null && blockerOf(b) === null && !settled.has(b)));
     for (const b of roots) {
       let g = null;
       try { g = (await dispatchCheck(b)) ?? null; } catch { g = null; }
+      if (g?.final) { // #4687: closed as not planned: terminal for its dependents
+        settled.add(b);
+        for (const n of results.keys()) {
+          const r = results.get(n);
+          if (blockerOf(n) === b && r.waiting) { const { waiting, ...rest } = r; results.set(n, rest); update({ ...rest, trigger: b }); }
+        }
+        continue;
+      }
       if (!g || !SATISFIED.has(g.outcome)) continue;
       resolved.add(b);
       const row = results.get(b);
@@ -909,6 +959,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       readmitted.add(`${n}:${b}`);
       results.delete(n);
       pending.push(n);
+      update({ issue: n, outcome: "readmitted", detail: `dependency #${b} merged or closed`, trigger: b }); // #4687
       decided({ issue: n, what: `re-admitted: dependency #${b} merged or closed after this issue was skipped`, why: "the blocker was finished outside this batch lane",
         alternative: "leave it skipped until the next batch" });
     }
@@ -930,18 +981,25 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
           const n = pending[i];
           if (results.has(n)) { pending.splice(i, 1); continue; }
           const bad = edges(n).find((d) => results.has(d) && !SATISFIED.has(results.get(d).outcome));
-          if (bad !== undefined) { pending.splice(i, 1); skip(n, `dependency #${bad} ended ${results.get(bad).outcome}`); again = true; }
+          if (bad !== undefined) { pending.splice(i, 1); skip(n, `dependency #${bad} ended ${results.get(bad).outcome}`, bad); again = true; }
         }
       }
       const t = now();
       const holdUntil = heldUntil();
       let started = 0;
       driftHeld.clear();
+      integHeld.clear();
       opHeldHit.clear();
       refreshHeld();
+      checkGates();
       const isReady = (n) => {
         if (opHeld.has(n)) { opHeldHit.add(n); return false; }
         if (!((notBefore.get(n) ?? 0) <= t && edges(n).every((d) => results.has(d) && SATISFIED.has(results.get(d).outcome)))) return false;
+        if (integration?.holds) {
+          let why = null;
+          try { why = integration.holds(n, { lane: lanes.get(n)?.lane ?? null }); } catch { why = null; }
+          if (why) { integHeld.set(n, why); return false; }
+        }
         if (!drift?.holds) return true;
         let pkg = null;
         try { pkg = drift.holds(n, { body: bodies.get(n) ?? "", lane: lanes.get(n)?.lane ?? null }); } catch { pkg = null; }
@@ -987,6 +1045,8 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
         }
       }
       if (reg) withdrawExcept(wanted);
+      // #4685: a breaker tripped only by link failures (a router restart) closes itself after a cooldown
+      if (tripped?.transport && now() - tripped.at >= TRANSPORT_COOLDOWN_MS) { tripped = null; errorTimes = []; transportErrors = 0; save(); }
       if (tripped && !running.size) { await drainAdds(); break; } // breaker: let running lanes finish, keep the rest pending for a resume
       if (cancelled && !running.size) { await drainAdds(); break; } // #4376: cancel: the rest end held for a resume
       if (budgetStop && !running.size) { await drainAdds(); break; } // execution budget (stop): the same, the rest end held
@@ -1025,7 +1085,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       else if (pending.length && waits.length) await nap(Math.min(wake, getCancelled ? pollMs : Infinity)); // wake is poll-capped by a hold or a live K; #4454: nap wakes on a stop
       else if (pending.length && budgetHeld) { if (await drainAdds()) continue; break; } // maintenance the budget does not admit now: held for a later batch
       else if (pending.length && opHeldHit.size && !pending.some((n) => !opHeldHit.has(n) && isReady(n))) { if (await drainAdds()) continue; break; } // #4592: held by the operator: pending for a --resume
-      else if (pending.length && driftHeld.size) { if (await drainAdds()) continue; break; } // held by a drift flag (block_dispatch): pending for a later batch
+      else if (pending.length && (driftHeld.size || integHeld.size)) { if (await drainAdds()) continue; break; } // held by a drift flag (block_dispatch) or a red integration streak (#4667): pending for a later batch
       else if (pending.length) { // nothing runnable, nothing running, nothing waiting on time: a dependency cycle
         for (const n of pending.splice(0)) skip(n, "dependency cycle");
         save();
@@ -1038,6 +1098,11 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   }
   if (reg) withdrawExcept(new Set());
   await relabelQueued();
+  // #4657: a milestone whose `close_on` state is reached closes here; a failure is a row, never an outcome change.
+  if (lifecycle?.onBatchEnd && lifecycleTitles.size && !halted) {
+    try { await lifecycle.onBatchEnd([...lifecycleTitles]); } catch (e) { onUpdate({ issue: 0, outcome: "lifecycle", detail: `lifecycle check failed: ${String(e?.message ?? e).slice(0, 300)}` }); }
+  }
+  for (const [n, r] of results) if (r?.waiting) { const { waiting, ...rest } = r; results.set(n, rest); } // #4687: the batch ended: skipped for good
   save();
   const withRequeue = (r) => (r && requeuedInfo.has(r.issue) ? { ...r, requeued: { reason: requeuedInfo.get(r.issue).reason, by: requeuedInfo.get(r.issue).by, prior: requeuedInfo.get(r.issue).prior.map((p) => ({ outcome: p.outcome, detail: p.detail ?? null, pr: p.pr ?? null })) } } : r);
   return order.map((n) => withRequeue(results.get(n)) ?? { issue: n, outcome: "held", pr: null, cost_usd: 0, minutes: 0, detail: heldDetail(n),
@@ -1076,9 +1141,12 @@ export function formatOutcomeLists(rows) {
   for (const r of rows ?? []) {
     if (!r || r.recovered) continue;
     const human = r.outcome === "needs-human" && classifyNeedsHuman(r) === "human";
+    if (r.parkedQueued && r.outcome === "needs-human") continue; // #4656: listed on the remediation line below, not as unrecovered
     if (!human && (r.outcome === "needs-human" || r.outcome === "budget-exceeded" || r.recovery)) out.push(`unrecovered: #${r.issue} (${r.code ?? r.recovery?.code ?? "unclassified"}: ${one(r.recovery ? `recovery ${r.recovery.code} ended ${r.recovery.outcome}: ${r.recovery.detail}` : r.detail)})`);
   }
   const esc = (rows ?? []).filter((r) => r?.outcome === "needs-human" && classifyNeedsHuman(r) === "human");
+  const rq = (rows ?? []).filter((r) => r?.outcome === "needs-human" && r.parkedQueued); // #4656: parked past recovery: the single remediation queue, not escalation
+  if (rq.length) out.push(`remediation queue (/work-on:remediate): ${rq.map((r) => `#${r.issue} (parked:${r.code}${r.pr ? ` PR #${r.pr}` : ""})`).join(" ")}`);
   const parked = formatParkedLine(rows); // #4389: one line for every parked post-deploy follow-up, never an escalation
   if (parked) out.push(parked);
   if (esc.length) out.push(["escalations (human decisions, asked once):", ...esc.map((r) => `- #${r.issue} (${r.code}): ${one(r.detail)}`)].join("\n"));
@@ -1089,7 +1157,7 @@ export function formatTable(rows) {
   // #4255: sandbox minutes and cost next to the token cost, only when some lane ran in a sandbox.
   const sbx = rows.some((r) => r?.sandbox);
   const head = ["issue", "outcome", "PR", "cost", ...(sbx ? ["sbx-min", "sbx-$"] : []), "min"];
-  const body = rows.map((r) => [`#${r.issue}`, r.outcome + (["skipped", "held"].includes(r.outcome) && r.detail ? ` (${r.detail})` : r.prefilter?.closed || r.prefilter?.parked ? " (pre-filter)" : ""), r.pr ? `#${r.pr}` : "-", `$${(r.cost_usd ?? 0).toFixed(2)}`,
+  const body = rows.map((r) => [`#${r.issue}`, (r.waiting && /^dependency #(\d+) /.test(r.detail ?? "") ? `waiting on #${/^dependency #(\d+) /.exec(r.detail)[1]}` : r.outcome) + (["skipped", "held"].includes(r.outcome) && r.detail ? ` (${r.detail})` : r.prefilter?.closed || r.prefilter?.parked ? " (pre-filter)" : ""), r.pr ? `#${r.pr}` : "-", `$${(r.cost_usd ?? 0).toFixed(2)}`,
     ...(sbx ? (r.sandbox ? [(Number(r.sandbox.minutes) || 0).toFixed(1), `$${(Number(r.sandbox.cost_usd) || 0).toFixed(2)}`] : ["-", "-"]) : []), String(r.minutes ?? 0)]);
   const w = head.map((h, i) => Math.max(h.length, ...body.map((b) => b[i].length)));
   const line = (c) => c.map((x, i) => x.padEnd(w[i])).join("  ").trimEnd();

package/bin/lean/parked-sweep.mjs

@@ -0,0 +1,45 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * Parked post-deploy follow-up sweep (#4689). A follow-up parked by the #4389 gate (`awaiting-promotion`, `awaiting-due`,
+ * `awaiting-measurement`) is re-evaluated on the daemon timer, next to `sweepDue`, instead of waiting for the next batch:
+ * `prefilterIssue` with `gateOnly` re-runs the same deterministic gate (git ancestry, due date, soak window, precondition,
+ * named checks; no model call, no lane). A released issue loses its wait labels and is picked up by the next scheduler pass;
+ * one that is still waiting is left as it is.
+ */
+import { prefilterIssue, lazyDefaultBranch, AWAITING_PROMOTION_LABEL, AWAITING_DUE_LABEL } from "./prefilter.mjs";
+import { AWAITING_MEASUREMENT_LABEL } from "./postdeploy-check.mjs";
+
+export const PARKED_LABELS = [AWAITING_PROMOTION_LABEL, AWAITING_DUE_LABEL, AWAITING_MEASUREMENT_LABEL];
+
+/**
+ * Re-evaluate every parked follow-up of the repo. Sequential; an error is an `error` row, never a throw.
+ * Outcomes: released | closed | still-parked | skipped | error.
+ */
+export async function sweepParked({ repo, cwd = process.cwd(), io, defaultBranch = null, preconditionCmd = null, minAge = null, dryRun = false, onResult = null } = {}) {
+  const found = new Set();
+  for (const label of PARKED_LABELS) {
+    try {
+      const list = JSON.parse(String(await io.gh(["issue", "list", "-R", repo, "--state", "open", "--label", label, "--limit", "100", "--json", "number"])));
+      for (const i of Array.isArray(list) ? list : []) if (Number.isInteger(i?.number)) found.add(i.number);
+    } catch { /* one unreadable label list: the others still run */ }
+  }
+  const resolve = defaultBranch ?? lazyDefaultBranch({ io, repo, cwd });
+  const rows = [];
+  for (const issue of [...found].sort((a, b) => a - b)) {
+    let row;
+    try {
+      const r = await prefilterIssue({ issue, repo, cwd, io, dryRun, defaultBranch: resolve, preconditionCmd, minAge, gateOnly: true });
+      row = { issue, outcome: /^pre-filter error/.test(r.detail) ? "error" : r.closed ? "closed" : r.parked ? "still-parked" : /^released/.test(r.detail) ? "released" : "skipped", detail: r.detail, kind: r.kind ?? null };
+    } catch (e) { row = { issue, outcome: "error", detail: String(e?.message ?? e).slice(0, 160) }; }
+    rows.push(row);
+    try { if (!dryRun) await onResult?.(row); } catch { /* an event sink never fails the sweep */ }
+  }
+  return rows;
+}
+
+/** One line, e.g. `parked: released #4 #5; closed #6`; "" when nothing changed. */
+export function formatParkedSweepSummary(rows) {
+  const parts = [["released", "released"], ["closed", "closed"], ["error", "error"]].map(([k, l]) => [l, (rows ?? []).filter((r) => r.outcome === k).map((r) => `#${r.issue}`)]).filter(([, a]) => a.length).map(([l, a]) => `${l} ${a.join(" ")}`);
+  return parts.length ? `parked: ${parts.join("; ")}` : "";
+}

package/bin/lean/parked-sweep.test.mjs

@@ -0,0 +1,71 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { sweepParked, formatParkedSweepSummary } from "./parked-sweep.mjs";
+
+const MERGE = "a".repeat(40);
+const item = (extra = "") => `- [ ] \`R2: the window shows a row\` — post-deploy: [check:smoke] ${extra} after promotion`;
+const bodyOf = (extra) => `## AC\n\n${item(extra)}\n\n<!-- FORGE:DEFERRED_FROM: #40 -->\n`;
+const CHECKS = JSON.stringify({ smoke: "echo ok" });
+
+/** Fake repo: `parked` maps issue -> {labels, body}; `promoted` says whether the parent's merge SHA is on origin/main. */
+function world({ parked, promoted, now = Date.parse("2026-11-04T00:00:00Z") }) {
+  const w = { edits: [], closed: [], comments: [], commits: [] };
+  w.io = {
+    now: () => now,
+    gh: async (a) => {
+      const k = a.slice(0, 2).join(" ");
+      if (k === "issue list") { const l = a[a.indexOf("--label") + 1]; return JSON.stringify(Object.entries(parked).filter(([, v]) => v.labels.includes(l)).map(([n]) => ({ number: Number(n) }))); }
+      if (k === "issue view") { const n = Number(a[2]); return JSON.stringify({ number: n, state: "OPEN", title: "", comments: [], ...parked[n], labels: parked[n].labels.map((name) => ({ name })) }); }
+      if (k === "pr list") return JSON.stringify([{ number: 90, title: "fix (#40)", body: "", mergeCommit: { oid: MERGE } }]);
+      if (k === "issue edit") { w.edits.push(a); return ""; }
+      if (k === "issue comment") { w.comments.push(a); return ""; }
+      if (k === "issue close") { w.closed.push(Number(a[2])); return ""; }
+      throw new Error(`unexpected gh ${a.join(" ")}`);
+    },
+    git: async (a) => {
+      if (a[0] === "fetch") return "";
+      if (a[0] === "rev-parse") return "deadbeef\n";
+      if (a[0] === "show") return CHECKS;
+      if (a[0] === "merge-base") { if (promoted) return ""; throw Object.assign(new Error("exit 1"), { code: 1 }); }
+      throw new Error(`unexpected git ${a.join(" ")}`);
+    },
+    spawnCheck: async () => ({ code: 0, stdout: "ok", stderr: "" }),
+  };
+  return w;
+}
+const sweep = (w, extra = {}) => sweepParked({ repo: "o/r", cwd: "/repo", io: w.io, defaultBranch: "main", ...extra });
+
+describe("parked follow-up sweep (#4689)", () => {
+  it("one pass after the parent's commit reaches the default branch removes awaiting-promotion and measures; before it nothing changes", async () => {
+    const parked = { 41: { labels: ["awaiting-promotion"], body: bodyOf() } };
+    const before = world({ parked, promoted: false });
+    const rows0 = await sweep(before);
+    assert.deepEqual(rows0.map((r) => [r.issue, r.outcome, r.kind]), [[41, "still-parked", "awaiting-promotion"]]);
+    assert.deepEqual(before.closed, []);
+    const after = world({ parked, promoted: true });
+    const rows = await sweep(after, { dryRun: false });
+    assert.ok(after.edits.some((a) => a.includes("--remove-label") && a.includes("awaiting-promotion")), "label removed");
+    assert.equal(rows[0].issue, 41); assert.notEqual(rows[0].outcome, "still-parked");
+    assert.equal(formatParkedSweepSummary([{ issue: 41, outcome: "released" }, { issue: 5, outcome: "error" }]), "parked: released #41; error #5");
+  });
+
+  it("a due date in the past is released, a future one stays parked", async () => {
+    const parked = { 50: { labels: ["awaiting-due", "due:2026-11-03"], body: bodyOf("due:2026-11-03") }, 51: { labels: ["awaiting-due"], body: bodyOf("due:2026-12-01") } };
+    const w = world({ parked, promoted: true });
+    const rows = await sweep(w);
+    assert.equal(rows.find((r) => r.issue === 51).outcome, "still-parked");
+    assert.notEqual(rows.find((r) => r.issue === 50).outcome, "still-parked");
+    assert.ok(w.edits.some((a) => a[2] === "50" && a.includes("--remove-label") && /awaiting-due,due:2026-11-03/.test(a.join(" "))));
+  });
+
+  it("an unreadable issue is an error row, never a throw; a dry run changes nothing", async () => {
+    const w = world({ parked: { 60: { labels: ["awaiting-promotion"], body: bodyOf() } }, promoted: true });
+    const g = w.io.gh; w.io.gh = async (a) => { if (a[1] === "view") throw new Error("boom"); return g(a); };
+    assert.equal((await sweep(w))[0].outcome, "error");
+    const w2 = world({ parked: { 61: { labels: ["awaiting-promotion"], body: bodyOf() } }, promoted: true });
+    await sweep(w2, { dryRun: true });
+    assert.deepEqual(w2.edits, []); assert.deepEqual(w2.closed, []);
+  });
+});

package/bin/lean/postdeploy-check.mjs

@@ -17,6 +17,7 @@ export const CHECKS_FILE = ".forge/post-deploy-checks.json";
 export const CHECK_ID_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 export const AWAITING_MEASUREMENT_LABEL = "awaiting-measurement";
 export const MONITORING_LABEL = "post-deploy-monitoring";
+export const OWNER_ASK_MARKER = "FORGE:OWNER_ASK"; // #4689
 export const DEFAULT_EVERY_MS = 6 * 3600e3;
 const ITEM_RE = /^\s*[-*]\s+\[[ xX]\]\s+(.*)$/;
 const CHECK_TOKEN_RE = /^`[^`]*`\s+(?:\*\*known-flaw\*\*\s+)?[—-]+\s*post-deploy:\s*\[check:\s*([^\]\s]*)\s*\]/;
@@ -97,6 +98,26 @@ export async function addMonitoringLabel({ io, repo, issue }) {
   }
 }
 
+/** #4689: tick every unticked post-deploy checklist item of a follow-up body (the evidence is in the FORGE:PROBE comment). */
+export const tickItems = (body) => String(body ?? "").replace(/^(\s*[-*]\s+)\[ \](\s+`[^`]*`\s+(?:\*\*known-flaw\*\*\s+)?[—-]+\s*post-deploy:)/gm, "$1[x]$2");
+
+/** #4689: one typed `FORGE:OWNER_ASK` comment for the items with no runnable check, posted once; best effort, nothing in a dry run. */
+async function postOwnerAsk({ iss, repo, io, dryRun, isTrusted, ids, missing, def }) {
+  if (dryRun || (iss.comments ?? []).some((c) => isTrusted(c) && String(c?.body ?? "").includes(OWNER_ASK_MARKER))) return;
+  const what = ids.length ? missing.map((m) => (m ? `add \`${m}\` to ${CHECKS_FILE} on ${def}` : "name an item's check with `[check:<id>]`")).join("; ") : "name each item's check with `[check:<id>]` and add it to the checks file";
+  try { await io.gh(["issue", "comment", String(iss.number), "-R", repo, "--body", `<!-- ${OWNER_ASK_MARKER} -->\n## Owner ask\nNo lane was started and none will be. Needed from the owner: ${what}, or measure the item by hand.`]); } catch { /* the label still shows it */ }
+}
+
+/** #4689: one engineering issue per failing check (never a lane): the output, the fix and the follow-up. Best effort. */
+async function fileFailureIssues({ bad, iss, repo, io, parent, def, fix }) {
+  for (const r of bad) {
+    const title = `Post-deploy check ${r.id} fails on ${def}${parent ? ` (fix of #${parent})` : ""}`;
+    const body = `Post-deploy check \`${r.id}\` failed (exit ${r.exit ?? "timeout"}) for fix \`${fix.slice(0, 12)}\` on \`${def}\`. Follow-up: #${iss.number}.\n\n${fenced(r.output)}`.slice(0, OUTPUT_TAIL * 2);
+    const create = (extra) => io.gh(["issue", "create", "-R", repo, "--title", title, "--body", body, ...extra]);
+    try { await create(["--label", "followup:engineering"]); } catch { try { await create([]); } catch { /* the follow-up comment carries the output */ } }
+  }
+}
+
 /**
  * Measure a ready post-deploy follow-up. Never runs a command that is not in the default branch's checks file.
  * @returns {Promise<{state:"awaiting-measurement"|"pass"|"fail"|"recorded-fail"|"dry-run"|"monitoring", detail:string}>}
@@ -107,13 +128,19 @@ export async function measureFollowup({ iss, repo, parent, def, shas = [], cwd,
   const ids = itemCheckIds(iss.body);
   const checks = await checksAt(io.git, [`origin/${def}`], cwd);
   const missing = ids.filter((id) => !id || !checks[id]);
-  if (!ids.length || missing.length) return { state: "awaiting-measurement", detail: `no runnable check on ${def} for ${ids.length ? `${missing.map((m) => m ?? "an item without a check id").join(", ")}` : "any item"} (${CHECKS_FILE})` };
+  if (!ids.length || missing.length) {
+    await postOwnerAsk({ iss, repo, io, dryRun, isTrusted, ids, missing, def });
+    return { state: "awaiting-measurement", detail: `no runnable check on ${def} for ${ids.length ? `${missing.map((m) => m ?? "an item without a check id").join(", ")}` : "any item"} (${CHECKS_FILE})` };
+  }
   const fix = [...shas].sort().join(",");
   const prior = (iss.comments ?? []).filter((c) => isTrusted(c)).map((c) => probeResultOf(c?.body)).filter(Boolean).reverse().find((p) => p.fix === fix);
   if (prior?.result === "fail") return { state: "recorded-fail", detail: `check failed for ${fix.slice(0, 12)} (FORGE:PROBE); waiting for a new fix of #${parent}` };
   const windowed = ids.every((id) => checks[id].forMs);
   const monitored = (iss.comments ?? []).filter((c) => isTrusted(c)).map((c) => monitorRecord(c?.body)).filter(Boolean).find((p) => p.fix === fix && p.result === "pass" && p.until);
-  if (windowed && monitored) return { state: "monitoring", detail: `windowed checks ${[...new Set(ids)].join(", ")} monitored until ${new Date(monitored.until).toISOString()}` };
+  if (windowed && monitored) {
+    await addMonitoringLabel({ io, repo, issue: iss.number }); // retry a label that failed on the first pass; sweepDue selects by it
+    return { state: "monitoring", detail: `windowed checks ${[...new Set(ids)].join(", ")} monitored until ${new Date(monitored.until).toISOString()}` };
+  }
   if (dryRun) return { state: "dry-run", detail: `checks ${[...new Set(ids)].join(", ")} not run (dry run)` };
   let defaultSha = null;
   try { defaultSha = String(await io.git(["rev-parse", `origin/${def}`], { cwd })).trim() || null; } catch { /* recorded as null */ }
@@ -129,16 +156,21 @@ export async function measureFollowup({ iss, repo, parent, def, shas = [], cwd,
       `Ran after the fix of #${parent} reached \`${def}\`; commands come from \`${CHECKS_FILE}\` on \`${def}\`.${ok ? (win.at ? ` Monitored until \`${win.window_until}\`, re-run on later releases.` : " The follow-up is closed.") : " The parent is reopened."}`,
       ...rows.filter((r) => r.result === "fail").flatMap((r) => ["", `**${r.id}** (exit ${r.exit ?? "timeout"})`, fenced(r.output)]),
     ].join("\n").slice(0, OUTPUT_TAIL * 4);
-    await io.gh(["issue", "comment", String(iss.number), "-R", repo, "--body", body]);
     if (!ok) {
       const bad = rows.filter((r) => r.result === "fail");
-      let note = "";
-      try { await io.gh(["issue", "reopen", String(parent), "-R", repo]); } catch (e) { note = ` (reopen failed: ${String(e?.message ?? e).slice(0, 120)})`; }
+      // Reopen before recording: the FORGE:PROBE fail record parks later passes (recorded-fail), so it must only exist once the parent is open.
+      try { await io.gh(["issue", "reopen", String(parent), "-R", repo]); } catch (e) {
+        return { state: "fail", detail: `check ${bad.map((r) => r.id).join(", ")} failed; reopen of #${parent} failed, no record posted so the next pass retries (${String(e?.message ?? e).slice(0, 120)})` };
+      }
+      await io.gh(["issue", "comment", String(iss.number), "-R", repo, "--body", body]);
+      await fileFailureIssues({ bad, iss, repo, io, parent, def, fix }); // #4689
       try {
         await io.gh(["issue", "comment", String(parent), "-R", repo, "--body", `Post-deploy check ${bad.map((r) => `\`${r.id}\``).join(", ")} failed for the fix on \`${def}\` (follow-up #${iss.number}); reopened.\n\n${bad.map((r) => fenced(r.output)).join("\n\n")}`.slice(0, OUTPUT_TAIL * 4)]);
       } catch { /* the follow-up comment carries the output */ }
-      return { state: "fail", detail: `check ${bad.map((r) => r.id).join(", ")} failed; #${parent} reopened${note}` };
+      return { state: "fail", detail: `check ${bad.map((r) => r.id).join(", ")} failed; #${parent} reopened` };
     }
+    await io.gh(["issue", "comment", String(iss.number), "-R", repo, "--body", body]);
+    if (tickItems(iss.body) !== iss.body) { try { await io.gh(["issue", "edit", String(iss.number), "-R", repo, "--body", tickItems(iss.body)]); } catch { /* the PROBE record is the evidence */ } } // #4689
   }
   if (windowed) {
     await addMonitoringLabel({ io, repo, issue: iss.number });

package/bin/lean/postdeploy-check.test.mjs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { parseChecks, itemCheckIds, measureFollowup, monitorRecord, CHECK_ID_RE } from "./postdeploy-check.mjs";
+import { parseChecks, itemCheckIds, measureFollowup, monitorRecord, CHECK_ID_RE, tickItems } from "./postdeploy-check.mjs";
 import { postDeployOnly } from "./prefilter.mjs";
 import { validateContract, applyAmendments, precheck, followupItems } from "./conformance.mjs";
 import { PROBE_MARKER } from "./probe.mjs";
@@ -63,7 +63,7 @@ describe("post-deploy named checks (#4626)", () => {
     for (const [file, b] of [[CHECKS, body([item("R1", "[check:ghost] x")])], [null, body([item("R1", "[check:smoke] x")])], [CHECKS, body([item("R1", "x"), item("R2", "[check:smoke] y")])]]) {
       const w = world({ file });
       assert.equal((await run(w, b)).state, "awaiting-measurement");
-      assert.deepEqual(w.spawned, []); assert.deepEqual(w.gh, []);
+      assert.deepEqual(w.spawned, []); assert.ok(w.gh.every((a) => a[1] === "comment" && /FORGE:OWNER_ASK/.test(a[a.indexOf("--body") + 1])), "only the typed owner ask (#4689)");
     }
   });
 
@@ -142,5 +142,65 @@ describe("windowed post-deploy checks (#4627)", () => {
     assert.equal((await run(w, body([item("R1", "[check:soak] x")]))).state, "fail");
     assert.ok(w.gh.some((a) => a[1] === "reopen" && a[2] === "40"));
   });
+  it("a failed parent reopen posts no fail record, so the next pass re-runs and retries", async () => {
+    const w = world();
+    const gh = w.io.gh;
+    let failReopen = true;
+    w.io.gh = async (a) => { if (a[1] === "reopen" && failReopen) { w.gh.push(a); throw new Error("api down"); } return gh(a); };
+    const b = body([item("R1", "[check:bad] x")]);
+    const r = await run(w, b);
+    assert.equal(r.state, "fail"); assert.match(r.detail, /reopen of #40 failed/);
+    assert.ok(!w.gh.some((a) => a[1] === "comment"));
+    failReopen = false;
+    const r2 = await run(w, b);
+    assert.ok(w.gh.filter((a) => a[1] === "reopen").length === 2 && /#40 reopened/.test(r2.detail));
+    const order = w.gh.map((a) => a[1] === "comment" ? `c${a[2]}` : a[1]);
+    assert.ok(order.indexOf("reopen", 1) < order.indexOf("c41"));
+  });
+  it("a recorded windowed pass retries the monitoring label", async () => {
+    const w = world({ file: WIN });
+    const rec = { body: `<!-- ${PROBE_MARKER} -->\n${JSON.stringify({ fix: "abc", result: "pass", at: new Date(NOW).toISOString(), window_until: new Date(NOW + 1e9).toISOString() })}` };
+    const b = body([item("R1", "[check:soak] x")]);
+    await run(w, b, { iss: { number: 41, body: b, comments: [rec] }, isTrusted: () => true });
+    assert.ok(w.gh.some((a) => a[1] === "edit" && a.includes("post-deploy-monitoring")));
+  });
 });
 
+
+describe("verification outcome (#4689)", () => {
+  it("a pass ticks the post-deploy items with the evidence in the PROBE record, and writes no code", async () => {
+    const w = world();
+    const r = await run(w, body([item("R1", "[check:smoke] x")]));
+    assert.equal(r.state, "pass");
+    const edit = w.gh.find((a) => a[0] === "issue" && a[1] === "edit");
+    const text = edit[edit.indexOf("--body") + 1];
+    assert.match(text, /- \[x\] `R1: some quote here`/);
+    assert.equal(tickItems("- [ ] `R9: other` — defer: code"), "- [ ] `R9: other` — defer: code");
+    const probe = w.gh.find((a) => a[1] === "comment" && /FORGE:PROBE/.test(a[a.indexOf("--body") + 1]));
+    assert.match(probe[probe.indexOf("--body") + 1], /"id":"smoke","result":"pass"/);
+    assert.ok(w.git.every((a) => ["show", "rev-parse"].includes(a[0])), "no git write: " + JSON.stringify(w.git));
+    assert.equal(tickItems("no items"), "no items");
+  });
+
+  it("a fail files one engineering issue per failing check and ticks nothing", async () => {
+    const w = world({ file: JSON.stringify({ bad: "echo nope", worse: "echo nope", smoke: "echo ok" }) });
+    const r = await run(w, body([item("R1", "[check:bad] x"), item("R2", "[check:worse] x"), item("R3", "[check:smoke] x")]));
+    assert.equal(r.state, "fail");
+    const created = w.gh.filter((a) => a[0] === "issue" && a[1] === "create");
+    assert.equal(created.length, 2);
+    assert.ok(created.every((a) => a.includes("followup:engineering")));
+    assert.ok(created[0][created[0].indexOf("--title") + 1].includes("bad"));
+    assert.ok(!w.gh.some((a) => a[1] === "edit" && a.includes("--body")));
+  });
+
+  it("an item with no runnable check posts one typed owner ask, once", async () => {
+    const w = world({ file: null });
+    assert.equal((await run(w, body([item("R1", "[check:smoke] x")]))).state, "awaiting-measurement");
+    const asks = w.gh.filter((a) => a[1] === "comment" && /FORGE:OWNER_ASK/.test(a[a.indexOf("--body") + 1]));
+    assert.equal(asks.length, 1);
+    const seen = { number: 41, body: body([item("R1", "[check:smoke] x")]), comments: [{ body: "<!-- FORGE:OWNER_ASK -->\nask", author: { login: "rapiercraft-forgedock" }, authorAssociation: "CONTRIBUTOR" }] };
+    const w2 = world({ file: null });
+    await run(w2, seen.body, { iss: seen, isTrusted: () => true });
+    assert.equal(w2.gh.filter((a) => a[1] === "comment").length, 0);
+  });
+});

package/bin/lean/postdeploy-monitor.mjs

@@ -13,6 +13,15 @@ import { deferredFrom, isTrustedIssueComment } from "./prefilter.mjs";
 
 export const REGRESSION_MARKER = "FORGE:REGRESSION";
 const fenced = (s) => { const f = "`".repeat(Math.max(3, ...[...String(s).matchAll(/`+/g)].map((m) => m[0].length + 1))); return `${f}\n${String(s).trim() || "(no output)"}\n${f}`; };
+/** An existing regression issue (any state) for this follow-up and fix commit, so a retry after a failed finish() reuses it (#4653). */
+export async function findRegression(io, repo, issue, fix) {
+  const found = JSON.parse(String(await io.gh(["issue", "list", "-R", repo, "--state", "all", "--search", `"${REGRESSION_MARKER}" "Monitored follow-up: #${issue}" in:body`, "--limit", "30", "--json", "number,body"])));
+  const hit = (Array.isArray(found) ? found : []).find((i) => {
+    const b = String(i?.body ?? "");
+    return b.includes(`<!-- ${REGRESSION_MARKER} -->`) && new RegExp(`Monitored follow-up: #${issue}(?!\\d)`).test(b) && b.includes(`Fix commit: \`${fix}\``);
+  });
+  return hit ? String(hit.number) : null;
+}
 const short = (s) => String(s ?? "unknown").slice(0, 12);
 
 /** One monitored follow-up. Outcomes: skipped | unrunnable | not-due | due (dry run) | pass | window-ended | fail. */
@@ -53,8 +62,9 @@ export async function monitorOne({ issue, repo, def, defaultSha, cwd, io, now, d
     `- Fix commit: \`${last.fix}\``, `- Last passing release (\`${def}\`): \`${last.defaultSha ?? "unknown"}\``, `- Breaking release (\`${def}\`): \`${defaultSha ?? "unknown"}\``,
     `- Monitored follow-up: #${issue}${parent ? `; parent: #${parent}` : ""}`, "", ...bad.flatMap((r) => [`**${r.id}** (exit ${r.exit ?? "timeout"})`, fenced(r.output), ""]),
   ].join("\n").slice(0, OUTPUT_TAIL * 4);
-  const created = String(await io.gh(["issue", "create", "-R", repo, "--title", title, "--body", body]));
-  const num = /\/issues\/(\d+)/.exec(created)?.[1] ?? null;
+  const existing = await findRegression(io, repo, issue, last.fix);
+  const created = existing ? "" : String(await io.gh(["issue", "create", "-R", repo, "--title", title, "--body", body]));
+  const num = existing ?? /\/issues\/(\d+)/.exec(created)?.[1] ?? null;
   await finish(`<!-- ${PROBE_MARKER} -->\n## Post-deploy check: fail\n${JSON.stringify({ ...rec, regression: num ? Number(num) : null, checks: sum })}\n\nRegression issue ${num ? `#${num}` : "filed"}; monitoring stops.`);
   return row("fail", `regression ${num ? `#${num}` : "filed"}: ${bad.map((r) => r.id).join(", ")} broke at ${short(defaultSha)} (fix ${short(last.fix)})`, { fix: last.fix, regression: num });
 }