forgedock 1.36.0 → 1.37.0

package/bin/lean/postdeploy-monitor.test.mjs

@@ -12,13 +12,15 @@ const CHECKS = JSON.stringify({ soak: { run: "echo ok", for: "7d", every: "6h" }
 const BODY = "## Acceptance Criteria\n\n- [ ] `R1: health row exists` — post-deploy: [check:soak] soak\n\n<!-- FORGE:DEFERRED_FROM: #40 -->\n";
 const rec = (o) => ({ authorAssociation: "OWNER", author: { login: "bot" }, body: `<!-- ${PROBE_MARKER} -->\n${JSON.stringify({ fix: "fix1234567890", default_sha: "rel1", result: "pass", at: new Date(T0).toISOString(), window_until: new Date(T0 + 7 * 24 * H).toISOString(), every_ms: 6 * H, ...o })}` });
 
-function world({ comments = [rec({})], head = "rel1", file = CHECKS, code = 0, state = "OPEN" } = {}) {
+function world({ comments = [rec({})], head = "rel1", file = CHECKS, code = 0, state = "OPEN", regressions = [], failClose = false } = {}) {
   const w = { gh: [], git: [], spawned: [] };
   w.io = {
     gh: async (a) => {
       w.gh.push(a);
       const k = a.slice(0, 2).join(" ");
       if (k === "repo view") return "main\n";
+      if (k === "issue list" && a.includes("--search")) return JSON.stringify(regressions);
+      if (failClose && k === "issue close") throw new Error("rate limit");
       if (k === "issue list") return JSON.stringify([{ number: 41 }]);
       if (k === "issue view") return JSON.stringify({ number: 41, state, title: "", body: BODY, labels: [{ name: "post-deploy-monitoring" }], comments });
       if (k === "issue create") return "https://github.com/o/r/issues/77\n";
@@ -80,6 +82,30 @@ describe("post-deploy windowed monitoring (#4627)", () => {
     assert.match(cm[cm.indexOf("--body") + 1], /"result":"fail".*"regression":77/s);
   });
 
+  const reg = (n, o = {}) => ({ number: n, body: `<!-- FORGE:REGRESSION -->\n- Fix commit: \`${o.fix ?? "fix1234567890"}\`\n- Monitored follow-up: #${o.issue ?? 41}\n` });
+
+  it("#4653: a regression already filed for this follow-up and fix is reused, not duplicated", async () => {
+    const w = world({ head: "rel2", code: 1, regressions: [reg(90)] });
+    const rows = await sweep(w);
+    assert.equal(rows[0].outcome, "fail"); assert.equal(rows[0].regression, "90");
+    assert.equal(calls(w, "issue create").length, 0); assert.equal(calls(w, "issue close").length, 1);
+    const cm = calls(w, "issue comment")[0];
+    assert.match(cm[cm.indexOf("--body") + 1], /"regression":90/);
+  });
+
+  it("#4653: finish() failing after create does not file a second regression on the next sweep", async () => {
+    const w = world({ head: "rel2", code: 1, failClose: true });
+    assert.equal((await sweep(w))[0].outcome, "error"); assert.equal(calls(w, "issue create").length, 1);
+    const w2 = world({ head: "rel2", code: 1, regressions: [reg(77)] });
+    assert.equal((await sweep(w2))[0].regression, "77"); assert.equal(calls(w2, "issue create").length, 0);
+  });
+
+  it("#4653: a regression for another follow-up, fix commit or issue number prefix is not reused", async () => {
+    const w = world({ head: "rel2", code: 1, regressions: [reg(5, { issue: 4 }), reg(6, { issue: 410 }), reg(7, { fix: "other" })] });
+    const rows = await sweep(w);
+    assert.equal(rows[0].regression, "77"); assert.equal(calls(w, "issue create").length, 1);
+  });
+
   it("a follow-up whose latest record is a fail is never re-run or re-filed", async () => {
     const w = world({ head: "rel3", code: 1, comments: [rec({}), rec({ result: "fail", default_sha: "rel2", regression: 77 })] });
     const rows = await sweep(w);

package/bin/lean/prefilter.mjs

@@ -25,7 +25,7 @@ import { PREFILTER_SYSTEM, prefilterPrompt, parsePrefilterVerdict } from "./prom
 import { isTrustedComment } from "../engine/phases.mjs";
 import { APP_SLUG } from "../init-repo.mjs";
 import { probeResultOf } from "./probe.mjs";
-import { AWAITING_MEASUREMENT_LABEL, MONITORING_LABEL, itemCheckIds, measureFollowup } from "./postdeploy-check.mjs";
+import { AWAITING_MEASUREMENT_LABEL, MONITORING_LABEL, OWNER_ASK_MARKER, itemCheckIds, measureFollowup } from "./postdeploy-check.mjs";
 
 export const DEFAULT_PREFILTER_MODEL = "claude-haiku-5-5";
 export const PREFILTER_MARKER = "FORGE:PREFILTER";
@@ -157,17 +157,38 @@ export async function collectSignals({ iss, repo, lane, io, cwd, selfLogins = nu
 // post-deploy checks cannot be done before its parent's fix is on the default branch: a git fact, so no lane learns it.
 export const PRECONDITION_MARKER = "FORGE:PRECONDITION";
 export const AWAITING_PROMOTION_LABEL = "awaiting-promotion";
+export const AWAITING_DUE_LABEL = "awaiting-due"; // #4689
 const DEFERRED_FROM_RE = /<!--\s*FORGE:DEFERRED_FROM:\s*#(\d+)\s*-->/;
 /** The parent #P of a deferred follow-up (`<!-- FORGE:DEFERRED_FROM: #P -->`), or null. */
 export function deferredFrom(body) {
   const m = DEFERRED_FROM_RE.exec(String(body ?? ""));
   return m ? Number(m[1]) : null;
 }
+const DEFERRED_FROM_ALL_RE = new RegExp(DEFERRED_FROM_RE.source, "g");
+/** #4724: every parent #P of a post-deploy rollup (one `<!-- FORGE:DEFERRED_FROM: #P -->` per `### #P` section), in order, unique; [] when none. */
+export const deferredFromAll = (body) => [...new Set([...String(body ?? "").matchAll(DEFERRED_FROM_ALL_RE)].map((m) => Number(m[1])))];
 const CHECK_RE = /^\s*[-*]\s+\[[ xX]\]\s+(.*)$/;
-/** True when the body has checklist items and every one is a ``- [ ] `R#: …` — post-deploy: why`` line (conformance followupItems). */
+const checkItems = (body) => noComments(String(body ?? ""), " ").split("\n").map((l) => CHECK_RE.exec(l)?.[1]).filter((x) => x != null);
+const DECISION_ITEM_RE = /^`[^`]*`\s+[—-]+\s*decision:/; // #4689: an item only its owner can decide
+/** True when the body has checklist items and every one is a ``- [ ] `R#: …` — post-deploy: why`` line (conformance followupItems), or a `decision:` item (#4689). */
 export function postDeployOnly(body) {
-  const items = noComments(String(body ?? ""), " ").split("\n").map((l) => CHECK_RE.exec(l)?.[1]).filter((x) => x != null);
-  return items.length > 0 && items.every((t) => /^`[^`]*`\s+(?:\*\*known-flaw\*\*\s+)?[—-]+\s*post-deploy:/.test(t));
+  const items = checkItems(body);
+  return items.length > 0 && items.every((t) => /^`[^`]*`\s+(?:\*\*known-flaw\*\*\s+)?[—-]+\s*post-deploy:/.test(t) || DECISION_ITEM_RE.test(t));
+}
+/** #4689: true when a checklist item is a `decision:` item (owner ask, never a lane). */
+export const hasDecisionItem = (body) => checkItems(body).some((t) => DECISION_ITEM_RE.test(t));
+const DUE_RE = /\bdue:(\d{4})-(\d{2})-(\d{2})\b/;
+/** #4689: the latest `due:YYYY-MM-DD` of the post-deploy items (ms, UTC midnight), or null when none states one. */
+export function itemDueMs(body) {
+  const ds = checkItems(body).map((t) => POST_DEPLOY_ITEM_RE.exec(t)?.[1]).filter((t) => t != null).map((t) => DUE_RE.exec(t)).filter(Boolean)
+    .map((m) => Date.UTC(+m[1], +m[2] - 1, +m[3])).filter(Number.isFinite);
+  return ds.length ? Math.max(...ds) : null;
+}
+const ANCHOR_RE = /\bfrom:(\d{4})-(\d{2})-(\d{2})\b/;
+/** #4724: the items' `due:` dates with their contract-time `from:` anchor (ms, UTC midnight; null when absent). */
+export function itemDueAnchors(body) {
+  return checkItems(body).map((t) => POST_DEPLOY_ITEM_RE.exec(t)?.[1]).filter((t) => t != null).map((t) => [DUE_RE.exec(t), ANCHOR_RE.exec(t)]).filter(([d]) => d)
+    .map(([d, a]) => ({ dueMs: Date.UTC(+d[1], +d[2] - 1, +d[3]), fromMs: a ? Date.UTC(+a[1], +a[2] - 1, +a[3]) : null })).filter((x) => Number.isFinite(x.dueMs));
 }
 const SHA_RE = /^[0-9a-f]{7,40}$/i;
 /**
@@ -243,18 +264,23 @@ const fmtAge = (ms) => (ms % UNIT_MS.d === 0 && ms ? `${ms / UNIT_MS.d}d` : ms %
 /**
  * #4389: never throws, no model call. `defaultBranch` is a name or an (async) function resolving it (and fetching it).
  * #4425: `minAge` (ms, opt-in) parks `awaiting-min-age` until max(item window ?? minAge) after the fix landed on <default>.
- * @returns {Promise<{state:"not-applicable"|"unresolved"|"awaiting-promotion"|"awaiting-min-age"|"awaiting-precondition"|"ready", parent:?number, shas:string[], default?:string, eligibleAt?:string, detail:string}>}
+ * @returns {Promise<{state:"not-applicable"|"unresolved"|"awaiting-promotion"|"awaiting-due"|"awaiting-min-age"|"awaiting-precondition"|"ready", parent:?number, shas:string[], default?:string, eligibleAt?:string, detail:string}>}
  * Fail-open: no merge SHA, a git answer other than yes/no, an unknown default branch or a hook error give "unresolved".
  */
 export async function postDeployGate({ iss, repo, lane, defaultBranch, cwd, io, preconditionCmd = null, minAge = null, now = null }) {
-  const parent = deferredFrom(iss?.body);
+  const parents = deferredFromAll(iss?.body), parent = parents[0] ?? null; // #4724: a rollup has one parent per section
+  const ps = parents.map((p) => `#${p}`).join(", ");
   const res = (state, detail, extra = {}) => ({ state, parent, shas: [], detail, ...extra });
   if (!parent || !postDeployOnly(iss.body)) return res("not-applicable", "");
   try {
     const def = typeof defaultBranch === "function" ? await defaultBranch() : defaultBranch;
     if (!def) return res("unresolved", "default branch unknown");
-    const shas = await parentMergeShas({ parent, repo, io });
-    if (!shas.length) return res("unresolved", `no merge SHA found for #${parent}`);
+    const shas = [];
+    for (const p of parents) {
+      const found = await parentMergeShas({ parent: p, repo, io });
+      if (!found.length) return res("unresolved", `no merge SHA found for #${p}`);
+      shas.push(...found);
+    }
     const off = [];
     for (const sha of shas) {
       let on;
@@ -262,7 +288,22 @@ export async function postDeployGate({ iss, repo, lane, defaultBranch, cwd, io,
       if (on === null) return res("unresolved", `${sha.slice(0, 12)} unknown to git`, { shas, default: def });
       if (!on) off.push(sha);
     }
-    if (off.length) return res("awaiting-promotion", `fix ${off.map((s) => s.slice(0, 12)).join(", ")} of #${parent} is not on ${def}${lane ? ` (lane ${lane})` : ""}`, { shas, default: def });
+    if (off.length) return res("awaiting-promotion", `fix ${off.map((s) => s.slice(0, 12)).join(", ")} of ${ps} is not on ${def}${lane ? ` (lane ${lane})` : ""}`, { shas, default: def });
+    let dueMs = itemDueMs(iss.body); // #4689: an explicit due date (UTC midnight)
+    if (dueMs != null) {
+      // #4724: re-anchor a date item to when its fix actually landed on <def>: due + (landed - the contract-time anchor)
+      let landedMs = null;
+      for (const a of itemDueAnchors(iss.body)) {
+        if (a.fromMs == null) continue;
+        if (landedMs == null) { landedMs = 0; for (const sha of shas) landedMs = Math.max(landedMs, ((await landedAt({ sha, def, io, cwd })) ?? 0) * 1000); }
+        if (landedMs > a.fromMs) dueMs = Math.max(dueMs, a.dueMs + (landedMs - a.fromMs));
+      }
+      const at = now ?? io.now?.() ?? Date.now();
+      if (at < dueMs) {
+        const eligibleAt = new Date(dueMs).toISOString();
+        return res("awaiting-due", `fix of ${ps} is on ${def}; the checks are due ${eligibleAt.slice(0, 10)}`, { shas, default: def, eligibleAt });
+      }
+    }
     if (minAge != null) {
       const required = Math.max(0, ...itemWindowsMs(iss.body).map((w) => w ?? minAge));
       let landed = 0;
@@ -274,16 +315,16 @@ export async function postDeployGate({ iss, repo, lane, defaultBranch, cwd, io,
       const at = now ?? io.now?.() ?? Date.now(), until = landed * 1000 + required;
       if (at < until) {
         const eligibleAt = new Date(until).toISOString();
-        return res("awaiting-min-age", `fix of #${parent} on ${def} since ${new Date(landed * 1000).toISOString()}; min age ${fmtAge(required)} until ${eligibleAt}`, { shas, default: def, eligibleAt });
+        return res("awaiting-min-age", `fix of ${ps} on ${def} since ${new Date(landed * 1000).toISOString()}; min age ${fmtAge(required)} until ${eligibleAt}`, { shas, default: def, eligibleAt });
       }
     }
     if (preconditionCmd) {
       const code = await (io.execCode ?? execCode)("sh", ["-c", preconditionCmd, "precondition", String(iss.number)],
         { cwd, timeout: 60000, env: { ...process.env, FORGE_ISSUE: String(iss.number) } });
-      if (code === 1) return res("awaiting-precondition", `fix of #${parent} is on ${def}; post_deploy.precondition_cmd says not ready`, { shas, default: def });
+      if (code === 1) return res("awaiting-precondition", `fix of ${ps} is on ${def}; post_deploy.precondition_cmd says not ready`, { shas, default: def });
       if (code !== 0) return res("unresolved", `post_deploy.precondition_cmd exited ${code}`, { shas, default: def });
     }
-    return res("ready", `fix of #${parent} is on ${def}`, { shas, default: def });
+    return res("ready", `fix of ${ps} is on ${def}`, { shas, default: def });
   } catch (e) {
     return res("unresolved", `gate error (${String(e?.message ?? e).slice(0, 120)})`);
   }
@@ -301,21 +342,29 @@ export function lazyDefaultBranch({ io, repo, cwd, configured = null }) {
     return name;
   })());
 }
+/** #4689: one typed `FORGE:OWNER_ASK` comment for the `decision:` items of a follow-up, posted once; best effort. */
+async function ownerAsk({ iss, repo, io, dryRun }) {
+  if (dryRun || (iss.comments ?? []).some((c) => String(c?.body ?? "").includes(OWNER_ASK_MARKER) && isTrustedIssueComment(c))) return;
+  const asks = checkItems(iss.body).filter((t) => DECISION_ITEM_RE.test(t)).map((t) => `- ${sanitizeMd(t).slice(0, 300)}`);
+  try { await io.gh(["issue", "comment", String(iss.number), "-R", repo, "--body", capComment(`<!-- ${OWNER_ASK_MARKER} -->\n## Owner ask\nNo lane was started: these items need a decision from the owner.\n\n${asks.join("\n")}`)]); } catch { /* the report still shows it */ }
+}
 /** #4389: label and explain a parked issue once (the comment only when the label was not there yet); best effort. */
 async function markParked({ issue, repo, io, had, gate }) {
   const measure = gate.state === "awaiting-measurement"; // #4626
-  const label = measure ? AWAITING_MEASUREMENT_LABEL : AWAITING_PROMOTION_LABEL;
-  const edit = () => io.gh(["issue", "edit", String(issue), "-R", repo, "--add-label", label]);
+  const due = gate.state === "awaiting-due"; // #4689
+  const label = measure ? AWAITING_MEASUREMENT_LABEL : due ? AWAITING_DUE_LABEL : AWAITING_PROMOTION_LABEL;
+  const labels = due && gate.eligibleAt ? [label, `due:${gate.eligibleAt.slice(0, 10)}`] : [label];
+  const edit = () => io.gh(["issue", "edit", String(issue), "-R", repo, "--add-label", labels.join(",")]);
   try { await edit(); } catch {
     try {
-      await io.gh(["label", "create", label, "-R", repo, "--force", "--color", "C5DEF5", "--description", measure ? "Post-deploy follow-up with no runnable default-branch check; never given a lane. Managed by ForgeDock." : "Post-deploy follow-up parked until its parent fix reaches the default branch. Managed by ForgeDock."]);
+      for (const l of labels) await io.gh(["label", "create", l, "-R", repo, "--force", "--color", "C5DEF5", "--description", measure ? "Post-deploy follow-up with no runnable default-branch check; never given a lane. Managed by ForgeDock." : due ? "Post-deploy follow-up parked until its due date; re-queued by the engine. Managed by ForgeDock." : "Post-deploy follow-up parked until its parent fix reaches the default branch. Managed by ForgeDock."]);
       await edit();
     } catch { /* the comment and the report still show it */ }
   }
   if (had) return;
-  const what = measure ? "awaiting measurement" : gate.state === "awaiting-promotion" ? "awaiting promotion" : gate.state === "awaiting-min-age" ? "awaiting its post-deploy soak window" : "awaiting its post-deploy precondition";
+  const what = measure ? "awaiting measurement" : gate.state === "awaiting-promotion" ? "awaiting promotion" : due ? "awaiting its due date" : gate.state === "awaiting-min-age" ? "awaiting its post-deploy soak window" : "awaiting its post-deploy precondition";
   const tail = measure ? "Every item here is a post-deploy check, and at least one names no runnable check, so no lane was started and none will be. Name each one with `[check:<id>]` and add `<id>` to the checks file on the default branch, or measure it by hand."
-    : "Every item here is a post-deploy check, so no lane was started. The next orchestrate or triage run checks again and launches this issue once the precondition holds.";
+    : "Every item here is a post-deploy check, so no lane was started. The next orchestrate or triage run, or the daemon's parked sweep, checks again and releases this issue once the precondition holds.";
   const body = `<!-- ${PRECONDITION_MARKER} -->\n## Parked: ${what}\n${sanitizeMd(gate.detail)}.\n\n${tail}`;
   try { await io.gh(["issue", "comment", String(issue), "-R", repo, "--body", capComment(body)]); } catch { /* the label still shows it */ }
 }
@@ -335,6 +384,10 @@ export function formatParkedLine(rows) {
     const defs = uniq(soak.map((r) => r.prefilter.default));
     out.push(`awaiting min age: ${soak.map((r) => `#${r.issue}`).join(" ")} (fix on ${defs.join(", ") || "the default branch"}, soak window not elapsed)`);
   }
+  const due = parked.filter((r) => r.prefilter.kind === "awaiting-due"); // #4689
+  if (due.length) out.push(`due date: ${due.map((r) => `#${r.issue}${r.prefilter.eligibleAt ? ` (${r.prefilter.eligibleAt.slice(0, 10)})` : ""}`).join(" ")} (re-queued on or after the date)`);
+  const ask = parked.filter((r) => r.prefilter.kind === "owner-ask");
+  if (ask.length) out.push(`owner ask: ${ask.map((r) => `#${r.issue}`).join(" ")} (a decision or measurement only the owner can give; no lane)`);
   const meas = parked.filter((r) => r.prefilter.kind === "awaiting-measurement"); // #4626
   if (meas.length) out.push(`awaiting measurement: ${meas.map((r) => `#${r.issue}`).join(" ")} (no runnable default-branch check; no lane)`);
   const failed = parked.filter((r) => r.prefilter.kind === "check-failed");
@@ -350,7 +403,7 @@ export function formatParkedLine(rows) {
  * Pre-filter one issue. Never throws.
  * @returns {Promise<{issue:number, closed:boolean, kind:?string, candidate:boolean, verdict:?string, cost_usd:number, detail:string}>}
  */
-export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAULT_PREFILTER_MODEL, dryRun = false, agentId = null, maxMinutes = 5, selfLogins = null, defaultBranch = null, preconditionCmd = null, minAge = null }) {
+export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAULT_PREFILTER_MODEL, dryRun = false, agentId = null, maxMinutes = 5, selfLogins = null, defaultBranch = null, preconditionCmd = null, minAge = null, gateOnly = false }) {
   const out = { issue, closed: false, kind: null, candidate: false, verdict: null, cost_usd: 0, detail: "" };
   try {
     const iss = JSON.parse(String(await io.gh(["issue", "view", String(issue), "-R", repo, "--json", "number,title,body,state,labels,comments"])));
@@ -367,15 +420,20 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
       try { st = await io.projector.readState(issue); } catch { /* unreadable: proceed */ }
       if (st?.lease && st.lease.until > Date.now() && st.lease.by !== agentId) return { ...out, detail: `leased by ${st.lease.by}` };
     }
+    if (gated && hasDecisionItem(iss.body)) { // #4689: a decision item is the owner's: parked, one typed ask, no lane
+      await ownerAsk({ iss, repo, io, dryRun });
+      return { ...out, parked: true, kind: "owner-ask", parent: deferredFrom(iss.body), lane, detail: "a decision item needs the owner" };
+    }
     if (gated) {
       const gate = await postDeployGate({ iss, repo, lane, defaultBranch, cwd, io, preconditionCmd, minAge });
       const had = names.includes(AWAITING_PROMOTION_LABEL);
-      if (["awaiting-promotion", "awaiting-min-age", "awaiting-precondition"].includes(gate.state)) {
-        if (!dryRun) await markParked({ issue, repo, io, had, gate });
-        return { ...out, parked: true, kind: gate.state, parent: gate.parent, lane, default: gate.default, detail: gate.detail };
+      if (["awaiting-promotion", "awaiting-due", "awaiting-min-age", "awaiting-precondition"].includes(gate.state)) {
+        if (!dryRun) await markParked({ issue, repo, io, had: had || (gate.state === "awaiting-due" && names.includes(AWAITING_DUE_LABEL)), gate });
+        return { ...out, parked: true, kind: gate.state, parent: gate.parent, lane, default: gate.default, ...(gate.eligibleAt ? { eligibleAt: gate.eligibleAt } : {}), detail: gate.detail };
       }
-      if (gate.state === "ready" && had && !dryRun) {
-        try { await io.gh(["issue", "edit", String(issue), "-R", repo, "--remove-label", AWAITING_PROMOTION_LABEL]); } catch { /* best effort */ }
+      const stale = names.filter((l) => l === AWAITING_PROMOTION_LABEL || l === AWAITING_DUE_LABEL || /^due:/.test(l)); // #4689: released: every wait label goes
+      if (gate.state === "ready" && stale.length && !dryRun) {
+        try { await io.gh(["issue", "edit", String(issue), "-R", repo, "--remove-label", stale.join(",")]); } catch { /* best effort */ }
       }
       if (gate.state === "ready") {
         const m = await measureFollowup({ iss, repo, parent: gate.parent, def: gate.default, shas: gate.shas, cwd, io, dryRun, isTrusted: isTrustedIssueComment, ...(io.spawnCheck ? { spawn: io.spawnCheck } : {}) });
@@ -387,8 +445,10 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
         if (m.state === "pass") return { ...out, closed: !dryRun, kind: "post-deploy-check", parent: gate.parent, lane, default: gate.default, detail: m.detail };
         if (m.state === "fail" || m.state === "recorded-fail") return { ...out, parked: true, kind: "check-failed", parent: gate.parent, lane, default: gate.default, detail: m.detail };
       }
+      if (gateOnly) return { ...out, detail: `released (post-deploy gate: ${gate.state})` }; // #4689: the sweep never runs the already-fixed path
       if (labelled) return { ...out, detail: `labelled, left to the lane (post-deploy gate: ${gate.state}${gate.detail ? `, ${gate.detail}` : ""})` };
     }
+    if (gateOnly) return { ...out, detail: "not a gated follow-up" };
     // #4399: an issue reopened by a failed acceptance probe goes to a lane, never back to an already-fixed close
     if ((iss.comments ?? []).some((c) => probeResultOf(c?.body)?.result === "fail")
       && flakyReason({ comments: iss.comments }, await ownFor(iss, selfResolver(selfLogins, io.gh)))?.reason === "probe-failed") {

package/bin/lean/prefilter.test.mjs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { prefilterIssue, flakyReason, makePrefilter, postDeployGate, postDeployOnly, deferredFrom, formatParkedLine, lazyDefaultBranch, ownLogins, resolveOwnLogins, formatPrefilterSummary, claimsFix, ciFailureRun, namedPaths, isTrustedIssueComment, DEFAULT_PREFILTER_MODEL, parseMinAge, itemWindowsMs, landedAt } from "./prefilter.mjs";
+import { prefilterIssue, flakyReason, makePrefilter, postDeployGate, postDeployOnly, deferredFrom, formatParkedLine, lazyDefaultBranch, ownLogins, resolveOwnLogins, formatPrefilterSummary, claimsFix, ciFailureRun, namedPaths, isTrustedIssueComment, DEFAULT_PREFILTER_MODEL, parseMinAge, itemWindowsMs, landedAt, itemDueMs, hasDecisionItem, deferredFromAll, itemDueAnchors } from "./prefilter.mjs";
 import { writeFileSync } from "node:fs";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { execFileSync } from "node:child_process";
@@ -516,6 +516,36 @@ describe("post_deploy.min_age soak window (#4425)", () => {
     assert.deepEqual(itemWindowsMs(followup([item("R1", "after 24h of traffic, then 7 days of retention"), item("R2", "only in prod")])), [7 * 24 * H * 1000, null]);
   });
 
+  describe("post-deploy rollup with several parents (#4724)", () => {
+    const M2 = "f".repeat(40);
+    const prs = [...parentPr, { number: 91, title: "fix(y): other (#50)", body: "", mergeCommit: { oid: M2 } }];
+    const rollup = (items) => `## Acceptance Criteria\n\n### #40\n<!-- FORGE:DEFERRED_FROM: #40 -->\n${items[0]}\n### #50\n<!-- FORGE:DEFERRED_FROM: #50 -->\n${items[1] ?? items[0]}\n`;
+    it("deferredFromAll lists every section parent once, in order", () => {
+      assert.deepEqual(deferredFromAll(rollup([item("R1", "x")])), [40, 50]);
+      assert.deepEqual(deferredFromAll("no marker"), []);
+      assert.equal(deferredFrom(rollup([item("R1", "x")])), 40);
+    });
+    it("the rollup waits while ANY parent is off the default branch, and names them all", async () => {
+      const w = soakWorld({ mergedPrs: prs, ancestry: { [MERGE]: 0, [M2]: 1 } });
+      const g = await gate(w, rollup([item("R1", "x")]));
+      assert.equal(g.state, "awaiting-promotion"); assert.match(g.detail, /#40, #50/); assert.deepEqual(g.shas, [MERGE, M2]);
+    });
+    it("is ready once every parent is on the default branch; a parent without a merge SHA is unresolved", async () => {
+      assert.equal((await gate(soakWorld({ mergedPrs: prs, ancestry: { [MERGE]: 0, [M2]: 0 } }), rollup([item("R1", "x")]))).state, "ready");
+      const g = await gate(soakWorld({ mergedPrs: parentPr, ancestry: { [MERGE]: 0 } }), rollup([item("R1", "x")]));
+      assert.equal(g.state, "unresolved"); assert.match(g.detail, /#50/);
+    });
+    it("a date item is re-anchored to when its fix landed: due + (landed - from)", async () => {
+      const it1 = item("R1", "[bucket:date] due:2027-02-01 from:2027-01-01 later");
+      assert.deepEqual(itemDueAnchors(followup([it1])), [{ dueMs: Date.UTC(2027, 1, 1), fromMs: Date.UTC(2027, 0, 1) }]);
+      const w = soakWorld({ mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
+      const g = await gate(w, followup([it1]), { now: Date.UTC(2027, 1, 10) }); // past the contract-time date, before the shifted one
+      assert.equal(g.state, "awaiting-due");
+      assert.equal(g.eligibleAt, new Date(Date.UTC(2027, 1, 1) + LANDED * 1000 - Date.UTC(2027, 0, 1)).toISOString());
+      assert.equal((await gate(soakWorld({ mergedPrs: parentPr, ancestry: { [MERGE]: 0 } }), followup([it1]), { now: Date.UTC(2027, 2, 1) })).state, "ready");
+    });
+  });
+
   it("landedAt: the promotion merge time, or the SHA's own time when it is on the mainline", async () => {
     const w = soakWorld();
     assert.equal(await landedAt({ sha: MERGE, def: "main", io: w.io, cwd: "/repo" }), LANDED);
@@ -602,3 +632,45 @@ describe("#4467: isTrustedIssueComment", () => {
     assert.equal(isTrustedIssueComment(null), false);
   });
 });
+
+describe("due-date and decision follow-ups (#4689)", () => {
+  const MERGE = "a".repeat(40);
+  const dueItem = (date) => `- [ ] \`R2: the 7-day window shows a health row\` — post-deploy: due:${date} only checkable after the window`;
+  const decision = "- [ ] `R3: pick the retention` — decision: owner chooses 30 or 90 days";
+  const body = (items) => `## Problem\n\n${items.join("\n")}\n\n<!-- FORGE:DEFERRED_FROM: #40 -->\n`;
+  const parentPr = [{ number: 90, title: "fix(x): health row (#40)", body: "", mergeCommit: { oid: MERGE } }];
+  const at = (iso) => Date.parse(iso);
+
+  it("parses the due token (latest wins) and decision items; a decision-only body counts as verification-only", () => {
+    assert.equal(itemDueMs(body([dueItem("2026-11-03"), dueItem("2026-11-10")])), Date.UTC(2026, 10, 10));
+    assert.equal(itemDueMs(body(["- [ ] `R2: x` — post-deploy: no date"])), null);
+    assert.ok(postDeployOnly(body([decision]))); assert.ok(hasDecisionItem(body([decision])));
+    assert.ok(!hasDecisionItem(body([dueItem("2026-11-03")])));
+  });
+
+  it("before the due date the follow-up parks awaiting-due with a due:<date> label, no lane; after it, the labels are removed", async () => {
+    const w = world({ issues: { 41: { body: body([dueItem("2026-11-03")]) } }, mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
+    w.io.now = () => at("2026-11-01T00:00:00Z");
+    const r = await pf(w, 41, { defaultBranch: "main" });
+    assert.equal(r.parked, true); assert.equal(r.kind, "awaiting-due"); assert.equal(r.eligibleAt, "2026-11-03T00:00:00.000Z");
+    assert.deepEqual(w.edits, [[41, "--add-label", "awaiting-due,due:2026-11-03"]]);
+    assert.equal(w.runner.length, 0);
+    assert.match(formatParkedLine([{ issue: 41, prefilter: r }]), /^due date: #41 \(2026-11-03\)/);
+    const w2 = world({ issues: { 41: { body: body([dueItem("2026-11-03")]), labels: [{ name: "awaiting-due" }, { name: "due:2026-11-03" }] } }, mergedPrs: parentPr, ancestry: { [MERGE]: 0 } });
+    w2.io.now = () => at("2026-11-03T00:00:01Z");
+    const r2 = await pf(w2, 41, { defaultBranch: "main", gateOnly: true });
+    assert.equal(r2.kind, "awaiting-measurement"); // released from the date; with no check on main it waits on its owner, never a lane
+    assert.deepEqual(w2.edits[0], [41, "--remove-label", "awaiting-due,due:2026-11-03"]);
+    assert.ok(w2.comments.some(([, b]) => /FORGE:OWNER_ASK/.test(b)));
+    assert.equal(w2.runner.length, 0);
+  });
+
+  it("a decision item is parked as one typed owner ask (posted once), never a lane, never needs-human", async () => {
+    const w = world({ issues: { 42: { body: body([decision]) } }, mergedPrs: parentPr, ancestry: { [MERGE]: 1 } });
+    const r = await pf(w, 42, { defaultBranch: "main" });
+    assert.equal(r.parked, true); assert.equal(r.kind, "owner-ask"); assert.equal(w.runner.length, 0);
+    assert.equal(w.comments.length, 1); assert.match(w.comments[0][1], /FORGE:OWNER_ASK/);
+    assert.match(formatParkedLine([{ issue: 42, prefilter: r }]), /^owner ask: #42/);
+    assert.deepEqual(w.edits, []);
+  });
+});

package/bin/lean/probe.mjs

@@ -244,14 +244,14 @@ export async function probeIssue({ issue, repo, cwd = process.cwd(), io, default
   try { defaultSha = String(await io.git(["rev-parse", `origin/${defaultBranch}`], { cwd })).trim() || null; } catch { /* recorded as null */ }
   const r = await runProbe(d.probe, { cwd, env: probeEnv(config.env, env), mask: config.env.map((k) => env[k]), timeoutS: config.timeoutS, ...(spawn ? { spawn } : {}) });
   const detail = `exit ${r.exit ?? "timeout"} in ${r.ms}ms`;
-  if (dryRun) return row(r.result, `${detail} (dry run: not recorded)`, { fix, output: r.output });
+  if (dryRun) return row(r.result, `${detail} (dry run: not recorded)`, { fix, defaultBranch, output: r.output });
   const body = renderProbeComment({ probe: d.probe, fix, defaultBranch, defaultSha, r });
   let note = "";
   if (r.result === "fail") {
     try { await io.gh(["issue", "reopen", String(issue), "-R", repo]); } catch (e) { note = `; reopen failed: ${String(e?.message ?? e).slice(0, 120)}`; }
   }
   await io.gh(["issue", "comment", String(issue), "-R", repo, "--body", body]);
-  return row(r.result, detail + note, { fix });
+  return row(r.result, detail + note, { fix, defaultBranch });
 }
 
 /** The default branch: forge.yaml `branches.default`, else GitHub's. */

package/bin/lean/probe.test.mjs

@@ -125,7 +125,7 @@ describe("probe (#4399)", () => {
     const w = world({ comments: [], prs: [{ number: 3, title: "x", body: "mentions #7 only", mergeCommit: { oid: "1111111" }, mergedAt: "2026-10-02" },
       { number: 4, title: "fix", body: "Closes #7", mergeCommit: { oid: "2222222" }, mergedAt: "2026-10-01" }] });
     const r = await run(w);
-    assert.equal(r.outcome, "pass"); assert.equal(r.fix, "2222222");
+    assert.equal(r.outcome, "pass"); assert.equal(r.fix, "2222222"); assert.ok(r.defaultBranch);
   });
 
   it("pass: records FORGE:PROBE with the result JSON, no reopen", async () => {

package/bin/lean/prompts.mjs

@@ -72,7 +72,10 @@ export function i18nCopiesPrompt(findings, mode = "local") {
 /** #4591: lane-added migrations the repo's generator did not produce. */
 export function migrationGeneratorPrompt(problems, mode = "local") {
   const rows = problems.slice(0, 30).map((p) => `- ${p}`).join("\n");
-  return `These migration files were named by hand, not produced by the repo's migration generator:\n${rows}\n\nA made-up name or timestamp collides with another lane's migration. Delete each such file, then recreate it with the generator (hand-written SQL: the generator's \`--custom\` mode, e.g. \`drizzle-kit generate --custom --name=<name>\`, then put your SQL in the file it wrote), so the journal entry and snapshot come from it. Never name or number migration files by hand. ${rerun(mode)}, commit, and update ${IMPLEMENTATION_FILE} and ${RESULT_FILE}. Do not push or touch GitHub.`;
+  const stale = problems.some((p) => /not above the base max when|is not after/.test(p))
+    ? ` Entries reported with a stale \`when\` are stamped older than the base's newest migration, so a newest-only migrator (drizzle \`migrate()\`) skips them on a persistent database: re-stamp each one (a \`when\` and name above the base journal's max, same SQL, snapshot regenerated by the generator) and keep \`when\` increasing in the journal.`
+    : "";
+  return `These migration problems were found (hand-named files the repo's migration generator did not produce, or journal timestamps older than the base's):\n${rows}\n\nA made-up name or timestamp collides with another lane's migration. Delete each such file, then recreate it with the generator (hand-written SQL: the generator's \`--custom\` mode, e.g. \`drizzle-kit generate --custom --name=<name>\`, then put your SQL in the file it wrote), so the journal entry and snapshot come from it. Never name or number migration files by hand.${stale} ${rerun(mode)}, commit, and update ${IMPLEMENTATION_FILE} and ${RESULT_FILE}. Do not push or touch GitHub.`;
 }
 
 /** #4390: byte cap of the diff hunks a context-ceiling restart carries (the stat is always kept). */
@@ -154,12 +157,13 @@ ${HOST_RULES}${toolchainRule(toolchain)}${sparseRule(sparse)}${factsRule(facts)}
 If the issue is already fixed or invalid, write ${RESULT_FILE} {"status":"already-fixed|invalid","summary":"one line","evidence":["file:line ..."]} and stop. If it is blocked, write {"status":"blocked","summary":"",...} with a typed "block" (rules below) and stop.
 
 2. Otherwise write ${CONTRACT_FILE}, the frozen hand-off: a developer who never saw the issue must be able to implement and verify it from this file alone.
-{"requirements":[{"id":"R1","quote":"<verbatim sentence or checklist item from the issue>","disposition":"deliver|defer|post-deploy|not-applicable","why":"<defer, post-deploy>","check":"<post-deploy: id in .forge/post-deploy-checks.json>","evidence":"<file:line, required for not-applicable>","verify":"<optional: in_lane|out_of_band>"}],
+{"requirements":[{"id":"R1","quote":"<verbatim sentence or checklist item from the issue>","disposition":"deliver|defer|post-deploy|not-applicable","why":"<defer, post-deploy>","bucket":"<defer, post-deploy: post-deploy|verify-now|date:YYYY-MM-DD|owner:<action>|new-issue>","check":"<post-deploy: id in .forge/post-deploy-checks.json>","evidence":"<file:line, required for not-applicable>","verify":"<optional: in_lane|out_of_band>"}],
  "deliverables":[{"id":"D1","path":"<file to change>","change":"<what>","requirements":["R1"]}],
  "preserve":[{"id":"P1","what":"<caller, contract or behaviour that must not change, with its path>"}],
  "validate":[{"id":"V1","command":"<exact command: the new regression test plus the existing tests that reference the files you change; a git diff compares against the merge base (origin/<lane>...HEAD), never the moving origin/<lane> tip>"}],
  "decisions":[{"id":"K1","choice":"<a non-obvious choice: a new dependency, a copied pattern, a boundary relied on>","justification":"<why, with file:line>","source":"doc|lint|precedent|spec"}]}
-Every requirement and acceptance criterion in the issue and its maintainers' comments is one requirement, quoted verbatim (others' comments are context, not requirements). Never drop or narrow one silently: "defer" (separate work) and "post-deploy" (only checkable after a deploy) are judged by the reviewer and, if accepted, filed by the engine as a tracked follow-up issue. A requirement you can do in this change is "deliver". A deliver requirement whose result is only measured outside the lane (Lighthouse, field perf, a nightly or report-only suite) is "verify":"out_of_band" with "evidence" naming the job or workflow that measures it (delivered by its instrumentation). The engine tags such quotes itself; set "verify":"in_lane" when this change can check it. List every file you will change as a deliverable; tests are always allowed.
+Every requirement and acceptance criterion in the issue and its maintainers' comments is one requirement, quoted verbatim (others' comments are context, not requirements). Never drop or narrow one silently: "defer" (separate work) and "post-deploy" (only checkable after a deploy) are judged by the reviewer and, if accepted, filed by the engine as a tracked follow-up issue. Every defer or post-deploy row has one "bucket": post-deploy (needs a release), verify-now (parent already on the default branch), date:YYYY-MM-DD (absolute, never a relative wait), owner:<action> (credentials, spend, settings; disposition defer, never post-deploy) or new-issue (future work). One sentence is one row. An outcome criterion this change can ship as a test, metric or alert is "deliver". A requirement you can do in this change is "deliver". A deliver requirement whose result is only measured outside the lane (Lighthouse, field perf, a nightly or report-only suite) is "verify":"out_of_band" with "evidence" naming the job or workflow that measures it (delivered by its instrumentation). The engine tags such quotes itself; set "verify":"in_lane" when this change can check it. List every file you will change as a deliverable; tests are always allowed.
+A [type:e2e] requirement needs a validate that runs a real e2e check (repo e2e set, Playwright, live stack), not a stubbed unit test; else post-deploy.
 A validate or repro command must not read a $TMPDIR file it did not create: each run gets a fresh TMPDIR.
 Scope is enforced by the engine: it checks the changed files against the deliverables plus typed amendments itself, so do not write a file-allowlist or denylist validate (git diff --name-only | grep); the engine drops such a validate at freeze.
 A new dependency between workspace packages (a workspace package added to a package.json dependencies, devDependencies or peerDependencies) must be a deliverable on that package.json whose change names the package and gives the reason, citing the architecture doc where there is one; "the lint allows it" or "there is a precedent" is not a reason on its own. Record each non-obvious choice in "decisions" with where its justification comes from (doc, lint, precedent or spec); omit the field when none. Then stop.
@@ -171,7 +175,7 @@ ${BLOCK_RULES}`;
  * #4374: the conformance rubric, one definition shared verbatim by `reviewerPrompt` and the builder's self-review in
  * `builderImplementPrompt`, so the two cannot drift. Each question is answered yes (OK) or no; codebase-agnostic.
  */
-export const REVIEW_RUBRIC = `1. Fixed: does the diff resolve the issue as written, delivering every requirement and acceptance criterion of the issue and every contract requirement with disposition deliver? An out-of-band requirement is delivered by its instrumentation (budget test or bench committed, job configured), not its measured result.
+export const REVIEW_RUBRIC = `1. Fixed: does the diff resolve the issue as written, delivering every requirement and acceptance criterion of the issue and every contract requirement with disposition deliver? An out-of-band requirement is delivered by its instrumentation (budget test or bench committed, job configured), not its measured result. A [type:e2e] requirement is delivered only when its validate command is a real end-to-end check, not a unit test with stubbed I/O.
 2. No regression: is the diff free of breakage of an existing caller, test or behaviour (a concrete path:line failure)?
 3. Contract: is every deliverable changed as described, every preserve item intact and every validate command passing?
 4. Scope: does the diff change only deliverable paths and tests?`;
@@ -184,13 +188,15 @@ export function builderImplementPrompt(mode = "local", { toolchain = null, spars
 ${HOST_RULES}${toolchainRule(toolchain)}${sparseRule(sparse)}${factsRule(facts)}${remote ? `\n\n${VERIFY_RULES[mode]}` : ""}
 
 The contract changes only through typed amendments in ${RESULT_FILE}, each with a why:
-- {"kind":"add-deliverable","path":"<file>","why":""}: a file the contract did not list.
-- {"kind":"add-requirement","requirement":{"id":"R9","quote":"<verbatim from the issue>","disposition":"deliver|defer|post-deploy"},"why":""}: an issue requirement the contract missed.
-- {"kind":"defer|post-deploy","requirement":"R#","why":"","check":"<id>"}: a requirement that becomes separate work or a post-deploy check. Filed as a tracked follow-up. Not "type"; other kinds are rejected.
-- {"kind":"amend-requirement","requirement":"R#","text":"<revised wording>","why":""}: reworded; judged against text.
+- {"kind":"add-deliverable","path":"<file>","why":""}: a file not listed.
+- {"kind":"add-requirement","requirement":{"id":"R9","quote":"<verbatim from the issue>","disposition":"deliver|defer|post-deploy"},"why":""}: a missed issue requirement.
+- {"kind":"defer|post-deploy","requirement":"R#","why":"","check":"<id>"}: separate work or a post-deploy check. Filed as a tracked follow-up. Not "type"; unknown kinds are rejected. One requirement id per row (R2, R3 as two rows).
+- {"kind":"amend-requirement","requirement":"R#","text":"<revised wording>","why":""}: reworded.
+- {"kind":"decision","decision":{"choice":"","anchors":["<base path>"],"supersedes":"<id>"},"why":""}: supersedes changes an H-row.
 New keys: translate, never copy English; status entries in place.
 Never report a deliver requirement as "deferred" or "follow-up" without an amendment.
 Never name or number migration files by hand; use the generator.
+A [type:e2e] requirement needs a validate that runs a real e2e check (repo e2e set, Playwright, live stack), not a stubbed unit test; else post-deploy.
 A new workspace-package dependency in a package.json no deliverable names is blocked by the engine: add it through add-deliverable with a why naming the package, or do not add it.
 If the repository has scripts/check-devdocs-freshness.sh, a behaviour change under the paths it checks must update the matching dossier (devdocs/modules/*.md, per devdocs/index.yaml) in the same change. Run it against the base first; the engine runs it too.
 
@@ -371,7 +377,7 @@ export const REVIEWER_SYSTEM = `You are an independent conformance reviewer of o
 You receive the GitHub issue with its comments, the frozen contract (requirements quoted from the issue, deliverables, preserve constraints, validate commands) with typed amendments, the builder's result with validation output, the changed files, the diff, and a row skeleton with one row per contract id and changed file. The engine computes the verdict from your rows; a reply without rows is rejected, so fill the skeleton rather than composing rows: fill EVERY row (set each empty status, evidence and validated_by, and each null deferral_ok; keep the ids and files as given):
 - issue_coverage: one row per requirement or acceptance criterion in the issue, quoted verbatim, saying whether the contract covers it, narrows it, or misses it. The skeleton lists the contract's quotes; add a row for any issue requirement the contract does not quote.
 - amendment: a requirement with an \`amendment\` is judged against amendment.text and its why, not the quote; its issue_coverage row is covered when the amendment follows from its why. If it does not hold, mark the row partial with note "amendment: <what to change>".
-- requirements: one row per contract requirement id: implemented|partial|missing|deferred|post-deploy|not-applicable, with evidence as a backtick-quoted repo-relative path:line copied verbatim from the changed files, including (group), [slug] and [...slug] folders (e.g. \`apps/web/app/(console)/layout.tsx:12\`, not route.ts:12) and the validate id or test that proves it (validated_by). For a defer or post-deploy requirement add deferral_ok: true only if it is genuinely separate work or only checkable after a deploy, false if it belongs in this change. For a verify out_of_band row (measured by the named job, not in this lane) set instrumented: true only when its budget test or bench is committed and that job is configured, with that path:line as evidence; false otherwise. Do not judge the measured result.
+- requirements: one row per contract requirement id: implemented|partial|missing|deferred|post-deploy|not-applicable, with evidence as a backtick-quoted repo-relative path:line copied verbatim from the changed files, including (group), [slug] and [...slug] folders (e.g. \`apps/web/app/(console)/layout.tsx:12\`, not route.ts:12) and the validate id or test that proves it (validated_by). For a defer or post-deploy requirement add deferral_ok: true only if it is genuinely separate work or only checkable after a deploy, false if it belongs in this change, including an outcome criterion (a metric, rate or log expectation) this change could ship as a test, metric or alert, or a read-only production check possible now (bucket verify-now). For a verify out_of_band row (measured by the named job, not in this lane) set instrumented: true only when its budget test or bench is committed and that job is configured, with that path:line as evidence; false otherwise. Do not judge the measured result.
 - post-deploy requirements: deferral_ok is false when the requirement has no \`check\` id, or its check is neither in .forge/post-deploy-checks.json on the default branch nor added by this change (the commands run from that file only).
 - scope: one row per changed file, pre-filled with the engine's authorization: the deliverable id that authorizes it (deliverables may be directories or globs), "test", "incidental" (changelog, lockfile), or "none" with what it changes. Change it only if the diff shows the file does something its deliverable does not cover.
 - preserve: one row per preserve id: intact|violated|unverified, with path:line. The skeleton starts each at "unverified"; set intact only after checking it.

package/bin/lean/resume.test.mjs

@@ -11,7 +11,7 @@ const facts = (validation, files = ["src/a.ts"]) => `<!-- ${FACTS_MARKER} -->\n$
 const CONTRACT = {
   requirements: [
     { id: "R1", quote: "Retries keep the session.", disposition: "deliver" },
-    { id: "R2", quote: "Measure it after deploy.", disposition: "post-deploy", why: "prod" },
+    { id: "R2", quote: "Measure it after deploy.", disposition: "post-deploy", why: "prod", bucket: "post-deploy" },
     { id: "R3", quote: "Log the retry count.", disposition: "deliver" },
   ],
   validate: [{ id: "V1", command: "npm test -- a.test.ts" }, { id: "V2", command: "npm run lint" }],

package/bin/lean/retry.mjs

@@ -43,3 +43,31 @@ export async function ghCacheRetry(call, cache) {
     return await call(cache?.env?.());
   }
 }
+
+/** #4662: an expired or revoked token (HTTP 401). 403 is a missing scope or a rate limit, which a refresh does not fix. */
+export const GH_AUTH_RE = /HTTP 401|\b401\b[^\n]{0,40}(?:unauthorized|bad credentials)|bad credentials|requires authentication|authentication required|gh auth login|try authenticating/i;
+export const GH_AUTH_RETRY_SECONDS = 120;
+
+/** Runs scripts/refresh-bot-token.sh (or $FORGE_REFRESH_TOKEN_SCRIPT); resolves on exit 0, rejects otherwise. */
+export async function runRefreshScript(env = process.env) {
+  const { execFile } = await import("node:child_process");
+  const script = env.FORGE_REFRESH_TOKEN_SCRIPT || new URL("../../scripts/refresh-bot-token.sh", import.meta.url).pathname;
+  return new Promise((res, rej) => execFile("bash", [script], { env, timeout: 60000 }, (err, _out, stderr) => (err ? rej(Object.assign(err, { stderr })) : res())));
+}
+
+/**
+ * #4662: one refresh-and-retry for an auth failure. `refresh` runs once per `state` (shared across calls, so a dead token
+ * does not spawn a refresh per gh call); when the call still fails with an auth error the error carries
+ * `deferCode: "gh.auth"` so the lane ends `deferred` (requeued in `retryInSeconds`), never `engine-error`.
+ */
+export async function refreshAuthOnce(call, { refresh, state = { refreshed: false } }) {
+  try { return await call(); } catch (e) {
+    if (!GH_AUTH_RE.test(errText(e))) throw e;
+    if (!state.refreshed) {
+      state.refreshed = true;
+      try { await refresh(); state.ok = true; } catch { state.ok = false; }
+      if (state.ok) { try { const r = await call(); state.refreshed = false; return r; } catch (e2) { if (!GH_AUTH_RE.test(errText(e2))) throw e2; e = e2; } }
+    }
+    throw Object.assign(e, { deferCode: "gh.auth", deferDetail: `gh auth failed (HTTP 401) after a token refresh: ${errText(e).trim().split("\n")[0].slice(0, 200)}`, retryInSeconds: GH_AUTH_RETRY_SECONDS });
+  }
+}

package/bin/lean/sandbox-provider.contract.test.mjs

@@ -186,9 +186,7 @@ describe("remote adapter (#4254)", () => {
     const flaky = { ...fakeTransport(), status: async () => { throw new Error("ECONNRESET"); } };
     const q = remoteProvider({ batch, repo: "o/r", transport: flaky, env: {} });
     const h = await q.start({ issue: 6, args: [] });
-    const seen = [];
-    for (let i = 0; i < 5; i++) seen.push(await q.status(h));
-    assert.deepEqual(seen, ["running", "running", "running", "running", "gone"]);
+    await assert.rejects(() => q.status(h), /ECONNRESET/); // #4672: a transport error propagates; providerLanes retries it for the unreachable window
   });
 
   it("httpTransport: bearer token, JSON protocol, 404 = gone/destroyed, 429 retryable; the token never in errors", async () => {
@@ -303,6 +301,13 @@ describe("pool provider (#4546)", () => {
     assert.equal(Buffer.from(spec.env.CS_FORGE_YAML_B64, "base64").toString(), "verify:\n  mode: ci\n");
   });
 
+  it("#4685 a configured token_env that resolves empty falls back to the router token", async () => {
+    const { cfg } = setupPool();
+    const batch = openBatch(tmpDir("pool-b3-"), "bt");
+    const c = await launchOnce(() => providerByName("pool", { batch, repo: "o/r", cwd: tmpDir("pool-cwd3-"), exec: parseExecution({ mode: "remote", provider: "pool", token_env: "NO_SUCH_TOKEN_4685" }), env: {}, poolConfigPath: cfg }));
+    assert.equal(c.init.headers.authorization, "Bearer pool-token-789");
+  });
+
   it("an explicit endpoint wins; no forge.yaml adds no env; a missing router config is misconfigured", async () => {
     const { dir } = setupPool();
     const batch = openBatch(tmpDir("pool-b2-"), "bt");

package/bin/lean/sandbox-remote.mjs

@@ -23,7 +23,6 @@ import { scopedEnv } from "./execution.mjs";
 import { resolveCredential } from "./credentials.mjs";
 
 const REDACTED = "[redacted]";
-const STATUS_ERRORS = 5;
 /** Replace every value of `secrets` (4+ chars, longest first) in `text`. */
 export function redact(text, secrets = []) {
   let s = String(text ?? "");
@@ -58,6 +57,8 @@ export function httpTransport({ endpoint, token = null, fetchFn = globalThis.fet
   };
   const fail = (what, r) => {
     const e = new Error(`sandbox ${what}: HTTP ${r.status}`);
+    e.status = r.status;
+    if ([502, 503, 504].includes(r.status)) e.transient = true; // #4672: a router restart or gateway blip, retried by the lane poll
     if (r.status === 429 || r.status === 503) { e.retryable = true; const n = Number(r.retryAfter); if (Number.isFinite(n) && n > 0) e.retryInSeconds = n; }
     return e;
   };
@@ -113,7 +114,6 @@ export function gitIdentityEnv(identity, laneEnv = {}) {
 export function remoteProvider({ batch, repo, settings = {}, name = "remote", transport, env = process.env, credentials = (name) => resolveCredential(name, { env }), now = () => Date.now(), gitIdentity = hostGitIdentity }) {
   if (!transport) throw new Error("remote provider needs a transport");
   const idFor = (issue) => `fdrsbx-${safeSegment(batch.id)}-${issue}`;
-  const errs = new Map(); // sandbox id -> consecutive status errors
   const known = new Set(); // secret values seen this process, for redaction
   const remember = (v) => { if (typeof v === "string" && v.length >= 4) known.add(v); };
   for (const k of settings.secrets ?? []) remember(credentials(k));
@@ -156,8 +156,8 @@ export function remoteProvider({ batch, repo, settings = {}, name = "remote", tr
     },
     async status(h) {
       let s;
-      // A transient transport error is not an exit; STATUS_ERRORS in a row is (the lane then ends without a result).
-      try { s = await transport.status(h.id); errs.delete(h.id); } catch { const k = (errs.get(h.id) ?? 0) + 1; errs.set(h.id, k); return k >= STATUS_ERRORS ? "gone" : "running"; }
+      // #4672: a transport error is not an exit; it propagates and providerLanes retries it for execution.unreachable_window_min.
+      s = await transport.status(h.id);
       await pullLogs(h);
       return s === "running" ? "running" : s === "gone" ? "gone" : "exited";
     },