forgedock 1.36.0 → 1.37.0

package/bin/forgedock.mjs

@@ -86,6 +86,8 @@ import {
   CYAN,
 } from "./tui.mjs";
 import { buildMinimalForgeYaml } from "./init-detect.mjs";
+import { checkContext, refreshContextFlow } from "./review-context.mjs";
+import { botTokenStatus } from "./bot-token-status.mjs";
 import {
   parseNameStatusDiff,
   classifyCommandChanges,
@@ -234,7 +236,7 @@ const SCRIPTS_DIR = join(FORGE_HOME, "scripts");
 // --minimal is init-only. Subcommands with their own flag parsing (run,
 // run-issue, demo) receive restArgs — everything after the command token.
 const rawArgs = process.argv.slice(2);
-const FLAGS = new Set(["--fast", "--manual", "--verbose", "--minimal", "--extras"]);
+const FLAGS = new Set(["--fast", "--manual", "--verbose", "--minimal", "--extras", "--refresh-context"]);
 const flags = rawArgs.filter((a) => FLAGS.has(a));
 // --global is stripped from positionals/restArgs for backward compatibility
 // with existing invocations, but is otherwise a no-op — see the install-mode
@@ -1042,6 +1044,13 @@ function ensureToolStateIgnored(c) {
 
 async function initFlow(c) {
   const outputPath = join(c.cwd, "forge.yaml");
+  if (flags.includes("--refresh-context")) {
+    return refreshContextFlow({
+      cwd: c.cwd,
+      out: c.stdout,
+      deps: { interactive: process.stdin.isTTY === true, confirm, backup: backupExisting, write: atomicWriteFile },
+    });
+  }
   const hasExisting = existsSync(outputPath);
   if (hasExisting && process.stdin.isTTY !== true) {
     const dim = (s) => (c.mode === "none" ? s : `\x1b[2m${s}\x1b[22m`);
@@ -2704,6 +2713,15 @@ async function doctor(fix = false) {
             );
           }
 
+          try {
+            const ctxCheck = checkContext({ configPath: forgeYamlPath, root: process.cwd(), repo: forgeOwner && forgeRepo ? `${forgeOwner}/${forgeRepo}` : "" });
+            if (ctxCheck.stale) {
+              warn("review context", `REVIEW_CONTEXT_STALE: ${ctxCheck.reasons.map((r) => r.detail).join("; ")}. Run: npx forgedock init --refresh-context`);
+            } else if (ctxCheck.advisory) {
+              warn("review context", `REVIEW_CONTEXT_STALE: generated ${ctxCheck.generated_at}, ${ctxCheck.merged_since} PRs merged since (limit ${ctxCheck.max_merged_prs}). Run: npx forgedock init --refresh-context`);
+            }
+          } catch { /* advisory check: never fail doctor */ }
+
           const defaultMatch = content.match(/^\s+default:\s+"([^"]*)"/m);
           const stagingMatch = content.match(/^\s+staging:\s+"([^"]*)"/m);
           if (
@@ -3243,14 +3261,20 @@ async function doctor(fix = false) {
   }
 
   // ── Check 12: GitHub App / bot token status ─────────────────────────────────
-  // Informational only — never a hard failure. Installing the ForgeDock GitHub
+  // Informational without a refresh stamp (#4662: with one, a stale or expiring token fails). Installing the ForgeDock GitHub
   // App registers it against the account/org but does not, by itself, mint a
   // bot token: that requires the app's private key, which only the app owner
   // holds. Pipeline gh calls always use whatever `gh auth` context is active
   // locally (personal token unless the operator manually configured a bot
   // token) — this check exists so that state is surfaced instead of silent.
   // See docs/CONFIG.md "GitHub App Install" and forge#1890.
-  {
+  const botTok = botTokenStatus(); // #4662: lifetime from the refresh stamp; no stamp means no refresher is installed
+  if (botTok.configured) {
+    const min = (ms) => Math.round(ms / 60000);
+    const detail = botTok.remainingMs != null ? `${min(botTok.remainingMs)} min left, refreshed ${min(botTok.ageMs)} min ago (${botTok.refreshedAt})` : botTok.reason;
+    if (botTok.ok) pass("GitHub App / bot token", detail);
+    else fail(`GitHub App / bot token: ${botTok.reason} (${detail})`, "run scripts/refresh-bot-token.sh and install the timer: docs/CONFIG.md \"Bot token refresh\"");
+  } else {
     warn(
       "GitHub App / bot token",
       "pipeline commands use your active `gh auth` (personal token, unless you've manually configured a bot token). Installing the GitHub App alone does not create one — see docs/CONFIG.md \"GitHub App Install\".",
@@ -3277,6 +3301,19 @@ async function doctor(fix = false) {
     }
   }
 
+  // ── Check 14: Router/schedd restarts (#4673) ───────────────────────────────
+  // A restart in the last hour usually means an OOM killer or SIGTERM took the coordinator and dropped in-flight lanes. Warn only.
+  {
+    try {
+      const { restartCheck } = await import("./pool/health.mjs");
+      for (const unit of ["computeshare-router", "forgedock-schedd"]) {
+        const r = restartCheck({ unit });
+        if (r.status === "warn") warn(`Restarts: ${unit}`, r.detail);
+        else if (r.status === "pass") pass(`Restarts: ${unit}`, r.detail);
+      }
+    } catch { /* no systemd here: nothing to report */ }
+  }
+
   // ── Summary ────────────────────────────────────────────────────────────────
   console.log("");
   if (fix && fixesApplied > 0) {
@@ -3314,12 +3351,16 @@ function help() {
     ["npx forgedock run <cmd> [args]", "Run a command headlessly (local claude CLI or Anthropic API)"],
     ["npx forgedock bootstrap <idea|docs> [--dry-run] [--spike <path>] | --plan <plan.json> [--dry-run]", "Headless /bootstrap: idea to orchestrate-ready backlog (--dry-run previews milestones, titles, DAG and estimated agent cost without GitHub writes); --plan validates and creates (or previews) a plan, and re-running resumes from GitHub"],
     ["npx forgedock run-issue <issue> [--lane <lane>] [--lane-override] [--path core|full] [--retry] [--wait-lease]", "Run the lean core work-on on one issue (default; --path full = legacy multi-phase pipeline; the lane comes from the issue: milestone → milestone/<slug>, else staging; --lane is an assertion, never the default branch) (--retry reopens an engine-error run, or a needs-human run once the label is cleared; --wait-lease waits for a held lease; exit 75 = deferred, lease held)"],
+    ["npx forgedock plan validate --live [--repo owner/repo] [--json]", "Re-run the bootstrap dependency-order rules on live GitHub state: each cross-milestone Depends-on edge is ok, held or invalid (exit 1 on invalid)"],
     ["npx forgedock orchestrate <issue...> [--parallel K] [--lane L]", "Run core work-on on several issues with bounded concurrency and Depends-on ordering; each issue on its own lane, cross-lane dependencies reported"],
-    ["npx forgedock orchestrate --resume <id> [N...] | --set-parallel <id> K | --add <id> N... | --requeue <id> N... [--reason \"...\"] | --cancel <id> | --hold <id> N... | --release <id> N...", "Reattach to a batch hosted by the schedd daemon (a finished one replays its report, an orphaned one is resumed with live lanes re-adopted), change its concurrency live, add issues to a running (or held) batch under its K and DAG, requeue a terminal issue (and the dependents skipped behind it) after an operator decision (refused while it is labelled needs-human or closed; a finished batch is reopened), or stop one batch without stopping schedd (running lanes torn down with their work saved, the rest held for --resume), or hold/release single issues of a batch (a held issue is not admitted until released or named by --resume)"],
+    ["npx forgedock orchestrate --resume <id> [N...] | --set-parallel <id> K | --add <id> N... | --requeue <id> N... [--reason \"...\"] | --cancel <id> | --hold <id> N... | --release <id> N... | --show-env <id> | --set-env <id> KEY=VAL | --unset-env <id> KEY", "Reattach to a batch hosted by the schedd daemon (a finished one replays its report, an orphaned one is resumed with live lanes re-adopted), change its concurrency live, add issues to a running (or held) batch under its K and DAG, requeue a terminal issue (and the dependents skipped behind it) after an operator decision (refused while it is labelled needs-human or closed; a finished batch is reopened), or stop one batch without stopping schedd (running lanes torn down with their work saved, the rest held for --resume), or hold/release single issues of a batch (a held issue is not admitted until released or named by --resume), or print (secrets redacted), set or unset a batch's pinned lane env (applies to newly launched lanes)"],
     ["npx forgedock triage <issue...> [--lane L] [--dry-run]", "Already-fixed pre-filter: close issues a merged PR or green CI already resolved; print the rest"],
     ["npx forgedock probe [issue...] [--dry-run]", "Run declared acceptance probes for closed issues whose fix is on the default branch; a fail reopens the issue"],
     ["npx forgedock check [--base REF] [--json]", "Run the lane's frozen validate commands and change-scoped pre-PR checks locally in this worktree, as the engine will (no GitHub, no Actions)"],
+    ["npx forgedock milestone train <slug...> [--parallel-milestones N] | --resume <id> | --insert <id> <slug> [--before s|--after s] | --show <id>", "Unattended multi-milestone train: one durable state file (order, active set, lifecycle), typed STOP reasons, resumable; never edits forge.yaml"],
+    ["npx forgedock guards list [--path p] [--json] | backfill --since <date> [--dry-run]", "Fix guards: list the FORGE:GUARD records (test files + protected hunks of merged fixes) covering a path, or build them for already-merged lean lanes"],
     ["npx forgedock limits show | clear <id>|--all", "Show or clear per-account usage-limit holds shared by orchestrate batches"],
+    ["npx forgedock decisions list [--stale] [--refresh]", "List anchored decisions (FORGE:DECISION); --stale shows those with an anchor missing on the base"],
     ["npx forgedock sched show | cap <N>|--clear | weight <owner/repo> <N>|--clear", "Show the host lane registry, set the host-wide lane cap shared by orchestrate batches, or set a repo's share of slots within a priority (default equal)"],
     ["npx forgedock schedd [status]", "Host scheduler daemon hosting every orchestrate batch (auto-spawned by orchestrate; run in the foreground for a systemd-user unit); status shows its pid and batches"],
     ["npx forgedock pool router [install] | enroll [--cpus N --mem GB] | status | upgrade [agent] | remove <agent>", "Built-in remote compute pool: run the router (foreground, or install it as a user service), print the one-time install command for a host, list agents, upgrade or remove them"],
@@ -3350,6 +3391,7 @@ function help() {
     ["--manual", "Plain text prompts instead of the review screen (init)"],
     ["--verbose", "Show detection sources for every field (init)"],
     ["--minimal", "Generate a minimal forge.yaml with required sections only (init)"],
+    ["--refresh-context", "Regenerate review.context/tech_stack from manifests and show a diff for approval (init)"],
     ["--version, -v", "Print the installed version and check for updates"],
   ];
 
@@ -3903,7 +3945,7 @@ async function watch() {
 const SPLASH_COMMANDS = new Set(["run", "bootstrap", "run-issue", "orchestrate", "triage", "probe", "gc", "resume-stalled", "demo", "doctor", "watch", "help", "--help", "-h"]);
 const KNOWN_COMMANDS = new Set([
   "install", "init", "enable", "disable", "status", "uninstall", "update",
-  "run", "bootstrap", "backend-check", "run-issue", "orchestrate", "triage", "probe", "review-staging", "gc", "resume-stalled", "demo", "doctor", "watch", "labels", "config", "stats", "limits", "sched", "schedd", "pool", "check", "help", "--help", "-h",
+  "run", "bootstrap", "backend-check", "run-issue", "orchestrate", "milestone", "milestone-sync", "guards", "triage", "probe", "review-staging", "gc", "resume-stalled", "demo", "doctor", "watch", "labels", "config", "stats", "limits", "decisions", "sched", "schedd", "pool", "check", "help", "--help", "-h",
   "version", "--version", "-v",
 ]);
 if (SPLASH_COMMANDS.has(command) || !KNOWN_COMMANDS.has(command)) splash(command);
@@ -4060,6 +4102,12 @@ switch (command) {
   case "run":
     await run();
     break;
+  case "plan": {
+    // #4659: bootstrap-validate's dependency rules on live GitHub state
+    const { runLive } = await import("../scripts/plan-validate-live.mjs");
+    exitCode = await runLive(restArgs);
+    break;
+  }
   case "bootstrap": {
     // #4177: headless /bootstrap; --plan runs scripts/bootstrap-create.mjs directly (no LLM), a re-run resumes.
     const { runBootstrap } = await import("./bootstrap.mjs");
@@ -4136,6 +4184,17 @@ switch (command) {
     }
     break;
   }
+  case "decisions": {
+    // #4695: anchored decisions of the local index
+    const { decisionsFromCli } = await import("./engine-cli.mjs");
+    try {
+      await decisionsFromCli(restArgs);
+    } catch (err) {
+      process.stderr.write(`${RED}${err.message}${RESET}\n`);
+      exitCode = 1;
+    }
+    break;
+  }
   case "check": {
     // #4364: the builder's in-session run of the engine's validate and pre-PR checks; local only
     const { checkFromCli } = await import("./engine-cli.mjs");
@@ -4199,6 +4258,50 @@ switch (command) {
     }
     break;
   }
+  case "milestone-sync": {
+    // On-demand milestone branch sync (#4663): PR + auto-merge under protected branches, one debounced sync PR.
+    const { milestoneSyncFromCli } = await import("./engine-cli.mjs");
+    try {
+      exitCode = await milestoneSyncFromCli(restArgs);
+    } catch (err) {
+      process.stderr.write(`${RED}${err.message}${RESET}\n`);
+      exitCode = 1;
+    }
+    break;
+  }
+  case "milestone": {
+    // Native unattended milestone train (#4658): `forgedock milestone train <slug...>`.
+    const { trainFromCli } = await import("./engine-cli.mjs");
+    try {
+      if (restArgs[0] !== "train") throw new Error("usage: forgedock milestone train <slug...> [--parallel-milestones N] | --resume <id> | --insert <id> <slug> | --show <id>");
+      const result = await trainFromCli(restArgs.slice(1));
+      if (result && !result.ok) exitCode = 1;
+    } catch (err) {
+      process.stderr.write(`${RED}${err.message}${RESET}\n`);
+      exitCode = 1;
+    }
+    break;
+  }
+  case "guards": {
+    // Fix guards (#4692): `forgedock guards list [--path p]` | `guards backfill --since <date>`.
+    const { guardsFromCli } = await import("./engine-cli.mjs");
+    try { exitCode = await guardsFromCli(restArgs); } catch (err) {
+      process.stderr.write(`${RED}${err.message}${RESET}\n`);
+      exitCode = 1;
+    }
+    break;
+  }
+  case "integration": {
+    // Milestone integration runs (#4667): `forgedock integration run` for cron or a scheduled workflow.
+    const { integrationFromCli } = await import("./engine-cli.mjs");
+    try {
+      exitCode = await integrationFromCli(restArgs);
+    } catch (err) {
+      process.stderr.write(`${RED}${err.message}${RESET}\n`);
+      exitCode = 1;
+    }
+    break;
+  }
   case "probe": {
     const { probeFromCli } = await import("./engine-cli.mjs");
     try {

package/bin/labels.json

@@ -69,11 +69,31 @@
     "color": "E4E669",
     "description": "Pipeline stalled — requires human intervention. Managed by ForgeDock."
   },
+  {
+    "name": "needs-human:external",
+    "color": "E4E669",
+    "description": "Waiting on an external prerequisite (credential, account, sign-off). Comment names the owner and unblock condition. Managed by ForgeDock."
+  },
+  {
+    "name": "parked",
+    "color": "FBCA04",
+    "description": "Mechanical park on a terminal code; per-code labels are parked:<code>. Managed by ForgeDock."
+  },
+  {
+    "name": "remediation-queue",
+    "color": "FBCA04",
+    "description": "Parked issue awaiting /work-on:remediate. Managed by ForgeDock."
+  },
   {
     "name": "workflow:engine-error",
     "color": "B60205",
     "description": "Pipeline stalled — engine/tool failure (not a genuine human-judgment block). Managed by ForgeDock."
   },
+  {
+    "name": "awaiting-due",
+    "color": "C5DEF5",
+    "description": "Post-deploy follow-up parked until its due date; re-queued by the engine. Managed by ForgeDock."
+  },
   {
     "name": "awaiting-promotion",
     "color": "C5DEF5",
@@ -183,5 +203,35 @@
     "name": "performance",
     "color": "F9D0C4",
     "description": "Performance optimization or regression. Managed by ForgeDock."
+  },
+  {
+    "name": "integration-red",
+    "color": "D93F0B",
+    "description": "Scheduled full-suite integration run on a milestone branch is red. Managed by ForgeDock."
+  },
+  {
+    "name": "followup:engineering",
+    "color": "BFD4F2",
+    "description": "Deferred buildable engineering work. Managed by ForgeDock."
+  },
+  {
+    "name": "followup:post-deploy",
+    "color": "BFD4F2",
+    "description": "Deferred post-deploy checks. Managed by ForgeDock."
+  },
+  {
+    "name": "followup:external",
+    "color": "BFD4F2",
+    "description": "Deferred items blocked on something outside the repo (credentials, third parties). Managed by ForgeDock."
+  },
+  {
+    "name": "followup:ops",
+    "color": "BFD4F2",
+    "description": "Deferred ops work (drills, runbooks). Managed by ForgeDock."
+  },
+  {
+    "name": "external-prerequisite",
+    "color": "E99695",
+    "description": "Follow-up that waits on an external prerequisite. Managed by ForgeDock."
   }
 ]

package/bin/lean/batch.mjs

@@ -99,7 +99,7 @@ export function openBatch(root, id) {
   if (!ID_RE.test(String(id ?? ""))) throw new Error(`invalid batch id ${JSON.stringify(id)}`);
   const dir = join(root, id);
   const f = (name) => join(dir, name);
-  return {
+  const self = {
     id, dir,
     exists: () => existsSync(f("plan.json")),
     readPlan: () => readJson(f("plan.json")),
@@ -122,16 +122,19 @@ export function openBatch(root, id) {
      * `order`, in the file or earlier in `list`: skipped `already in batch`. @returns {{added:number[], skipped:Array<{issue, reason}>}}
      */
     addIssues: (list) => {
-      const have = new Set([...(readJson(f("state.json"))?.order ?? []), ...readAdded(f("add"))]);
-      const added = [], skipped = [];
+      const st = readJson(f("state.json")) ?? {};
+      const have = new Set([...(st.order ?? []), ...readAdded(f("add"))]);
+      const added = [], skipped = [], requeued = [];
       for (const x of Array.isArray(list) ? list : []) {
         const n = typeof x === "number" ? x : typeof x === "string" && /^#?\d+$/.test(x.trim()) ? parseInt(x.trim().replace("#", ""), 10) : NaN;
         if (!Number.isSafeInteger(n) || n < 1) { skipped.push({ issue: x, reason: "not an integer" }); continue; }
+        // #4687: an issue skipped in the batch (a dependency ended) is re-queued, not refused; any other row is "already in batch"
+        if (have.has(n) && st.results?.[n]?.outcome === "skipped" && !requeued.includes(n) && self.requeue([n], { reason: "--add", by: "operator" }).requeued.length) { requeued.push(n); continue; }
         if (have.has(n)) { skipped.push({ issue: n, reason: "already in batch" }); continue; }
         have.add(n); added.push(n);
       }
       if (added.length) writeAtomic(f("add"), JSON.stringify([...new Set([...readAdded(f("add")), ...added])].sort((a, b) => a - b)) + "\n");
-      return { added, skipped };
+      return { added, skipped, requeued };
     },
     /**
      * `--requeue` (#4550): record that each issue returns to pending. Refused: not a positive integer, not in the batch's
@@ -164,6 +167,8 @@ export function openBatch(root, id) {
     unrunRequeues: () => { const done = new Set(readJson(f("state.json"))?.requeueApplied ?? []); return readRequeueFile(f("requeue")).filter((e) => !done.has(requeueKey(e))); },
     /** Issues held by `--hold` (#4592): the `hold` file, sorted unique positive integers; [] when missing or invalid. */
     readHeld: () => readAdded(f("hold")),
+    /** #4656: gates waiting on issues (`gates` file: [{ name, waitsOn: [n...], since? }], written by the ship/settle pre-flight); [] when missing or invalid. */
+    readGates: () => { const v = readJson(f("gates")); return Array.isArray(v) ? v.filter((g) => g && typeof g.name === "string" && Array.isArray(g.waitsOn)) : []; },
     /** Merge the positive integers of `list` into the `hold` file. @returns {number[]} the issues newly held */
     holdIssues: (list) => {
       const have = new Set(readAdded(f("hold")));
@@ -197,6 +202,7 @@ export function openBatch(root, id) {
     resultFile: (n) => f(join("lanes", `${n}.json`)),
     logFile: (n) => f(join("lanes", `${n}.log`)),
   };
+  return self;
 }
 
 /** True when `pid` is alive and (where /proc exists) its command line names `marker`, so a reused pid is not adopted. */

package/bin/lean/batch.test.mjs

@@ -89,6 +89,21 @@ await orchestrateFromCli(["1", "2", "3", "--parallel", "2", "--repo", "o/r", "--
     assert.deepEqual(deferPolicy({ code: "host.busy" }, { now: 0, deferrals: 99 }), { delayMs: 60000, host: true });
   });
 
+  it("#4685 a breaker tripped by transport errors closes itself after the cooldown; any other stays tripped", async () => {
+    const run = async (detail) => {
+      let t = 0; const updates = []; const saves = [];
+      const rows = await orchestrate({ issues: [1, 2, 3, 4], parallel: 1, readBody: async () => "", now: () => t, sleep: async (ms) => { t += ms; }, maxDeferrals: 3, breaker: { errors: 3, window_min: 30 },
+        onUpdate: (r) => updates.push(r), store: { load: () => null, save: (s) => saves.push(s) },
+        runOne: async (n) => { t += 1000; return n <= 3 ? { terminalReason: "engine-error", detail } : { terminalReason: "merged", pr: 5 }; } });
+      return { rows, updates, saves };
+    };
+    const tr = await run("sandbox launch: fetch failed");
+    const trip = tr.saves.map((s) => s.breaker).find(Boolean);
+    assert.equal(trip?.transport, true);
+    const other = await run("boom");
+    assert.equal(other.saves.map((s) => s.breaker).find(Boolean)?.transport, undefined);
+  });
+
   it("gh.unavailable deferrals (forge#4157) are requeued, never relaunched as engine-error, and never trip the breaker", async () => {
     const { now, sleep } = fakeClock();
     const updates = [];
@@ -105,6 +120,31 @@ await orchestrateFromCli(["1", "2", "3", "--parallel", "2", "--repo", "o/r", "--
     assert.deepEqual(deferPolicy({ code: "gh.unavailable", retryInSeconds: 60 }, { now: 0 }), { delayMs: 60000 });
   });
 
+  it("gh.auth deferrals (forge#4662) are requeued, never relaunched as engine-error, and never trip the breaker", async () => {
+    const { now, sleep } = fakeClock();
+    const updates = [];
+    let calls = 0;
+    const rows = await orchestrate({ issues: [1], readBody: async () => "", now, sleep, maxDeferrals: 3, breaker: { errors: 3, window_min: 30 },
+      onUpdate: (r) => updates.push(r),
+      runOne: async () => (++calls <= 3
+        ? { terminalReason: "deferred", code: "gh.auth", retryInSeconds: 120, detail: "gh auth failed (HTTP 401)" }
+        : { terminalReason: "merged", pr: 5 }) });
+    assert.equal(calls, 4);
+    assert.equal(rows[0].outcome, "merged");
+    assert.ok(!updates.some((u) => u.outcome === "breaker" || u.outcome === "engine-error"));
+    assert.equal(updates.filter((u) => /requeued in 120s: gh.auth/.test(u.detail ?? "")).length, 3);
+  });
+
+  it("#4690 env.lane_limit (needs-human) is never counted by the breaker and the batch keeps admitting", async () => {
+    const { now, sleep } = fakeClock();
+    const updates = [], ran = [];
+    const rows = await orchestrate({ issues: [1, 2, 3], parallel: 1, readBody: async () => "", now, sleep, breaker: { errors: 1, window_min: 30 }, onUpdate: (r) => updates.push(r),
+      runOne: async (n) => { ran.push(n); return n === 1 ? { terminalReason: "needs-human", code: "env.lane_limit", detail: "TasksMax" } : { terminalReason: "merged", pr: n }; } });
+    assert.deepEqual(ran, [1, 2, 3]);
+    assert.ok(!updates.some((u) => u.outcome === "breaker" || u.outcome === "engine-error"));
+    assert.deepEqual(rows.map((r) => r.outcome), ["needs-human", "merged", "merged"]);
+  });
+
   it("a usage limit holds every admission until its reset; a deferred issue's dependents wait instead of being skipped", async () => {
     const { now, sleep, c } = fakeClock();
     const t0 = c.t, starts = {};
@@ -309,6 +349,26 @@ describe("#4318: the batch dispatcher's signal relabel and the needs-human relab
       const b = hook({ state: "OPEN", body: "" }, { comment: true });
       assert.equal(await b.run(), true);
     });
+    it("#4736: a mechanical park creates its parked:<code> label before the edit", async () => {
+      const calls = [];
+      const gh = async (a) => { calls.push(a.slice(0, 3).join(" ")); return a[1] === "view" ? JSON.stringify({ state: "OPEN", body: "" }) : ""; };
+      assert.equal(await makeRelabelNeedsHuman({ gh, repo: "o/r", now: () => 1000 })({ issue: 7, evidence: "e", parked: { code: "ci.red", pr: 3 } }), true);
+      assert.deepEqual(calls.slice(0, 3), ["issue view 7", "label create parked:ci.red", "issue edit 7"]);
+    });
+  });
+
+  it("#4736: a parked relabel that reports failed is not reported as queued for remediation", async () => {
+    const leanIo = { gh: async (a) => (a.includes("milestone") ? JSON.stringify({ milestone: null }) : JSON.stringify({ body: "" })), git: async (a) => (a[0] === "ls-remote" ? "abc\trefs/heads/staging\n" : "") };
+    const out = [], l = console.log;
+    console.log = (...x) => out.push(x.join(" "));
+    try {
+      await orchestrateFromCli(["1", "--parallel", "1", "--repo", "o/r", "--no-prefilter"], { dir: tmpDir("pf-"), batchRoot: tmpDir("pf-batch-"), allowTmpfs: true,
+        emitTelemetry: async () => {}, io: { gh: async () => "o/r\n" }, leanIo, sched: null, decide: () => {},
+        orchestration: { breaker: null, maxDeferrals: 3, globalParallel: null, recovery: { maxAttempts: 1 } },
+        relabelNeedsHuman: async (x) => (x.parked ? "failed" : true),
+        leanModule: { runCore: async () => ({ terminalReason: "needs-human", code: "ci.red", detail: "x", pr: 5 }) } });
+    } finally { console.log = l; }
+    assert.doesNotMatch(out.join("\n"), /remediation queue/);
   });
 });
 
@@ -428,6 +488,19 @@ describe("#4408: issues added to a running batch (forgedock orchestrate --add)",
     assert.deepEqual(plain.map((r) => r.issue), [1]);
   });
 
+  it("#4687 --add re-queues an issue that is skipped in the batch; any other ended issue stays 'already in batch'", () => {
+    const root = tmpDir("batch-add-skipped-");
+    const b = openBatch(root, "b1");
+    b.writePlan({ argv: ["1"], repo: "o/r" });
+    b.store.save({ order: [1, 2, 3], results: { 1: { outcome: "needs-human" }, 2: { outcome: "skipped", detail: "dependency #1 ended needs-human" }, 3: { outcome: "merged" } } });
+    const r = b.addIssues([2, 3, 1]);
+    assert.deepEqual(r.requeued, [2]);
+    assert.deepEqual(r.added, []);
+    assert.deepEqual(r.skipped.map((x) => [x.issue, x.reason]), [[3, "already in batch"], [1, "already in batch"]]);
+    assert.deepEqual(b.readRequeued().map((e) => e.issue), [2]);
+    assert.deepEqual(b.readAdded(), []);
+  });
+
   it("the add file: integers only, no issue twice, cumulative; --add through the CLI skips closed and unreadable issues", async () => {
     const root = tmpDir("batch-add-");
     const b = openBatch(root, "b1");
@@ -659,7 +732,7 @@ describe("#4481: a closed issue or a merged lane PR is skipped at dispatch", ()
 
   it("makeDispatchCheck: merged head-branch PR, closed issue, open issue, unreadable answers fail open", async () => {
     const mk = (issue, prs, events = "") => makeDispatchCheck({ repo: "o/r", gh: async (a) => {
-      if (a[0] === "issue") { assert.deepEqual(a, ["issue", "view", "9", "-R", "o/r", "--json", "state"]); if (issue instanceof Error) throw issue; return issue; }
+      if (a[0] === "issue") { assert.deepEqual(a, ["issue", "view", "9", "-R", "o/r", "--json", "state,stateReason"]); if (issue instanceof Error) throw issue; return issue; }
       if (a[0] === "api") { assert.equal(a[1], "repos/o/r/issues/9/events"); if (events instanceof Error) throw events; return events; }
       assert.deepEqual(a.slice(0, 6), ["pr", "list", "-R", "o/r", "--head", "feat/issue-9-lean"]);
       if (prs instanceof Error) throw prs;
@@ -673,6 +746,7 @@ describe("#4481: a closed issue or a merged lane PR is skipped at dispatch", ()
     assert.equal(await mk('{"state":"OPEN"}', '[{"number":12}]')(9), null, "no mergedAt: the lane runs");
     assert.deepEqual(await mk('{"state":"CLOSED"}', merged, new Error("not read"))(9), { outcome: "merged", pr: 12, detail: "PR #12 already merged" }, "closed: no reopen lookup");
     assert.deepEqual(await mk('{"state":"CLOSED"}', "[]")(9), { outcome: "invalid", detail: "issue closed" });
+    assert.deepEqual(await mk('{"state":"CLOSED","stateReason":"NOT_PLANNED"}', "[]")(9), { outcome: "invalid", detail: "issue closed (not planned)", final: true }, "#4687: not planned is final");
     assert.equal(await mk('{"state":"OPEN"}', "[]")(9), null);
     assert.equal(await mk('{"body":"","labels":[]}', '{"body":""}')(9), null, "a stub without state or a list: run");
     assert.equal(await mk(new Error("x"), new Error("y"))(9), null);

package/bin/lean/conformance.e2e.test.mjs

@@ -56,7 +56,7 @@ const contract = (reqs) => ({ requirements: reqs, deliverables: reqs.filter((r)
   preserve: [{ id: "P1", what: `${Q.AC3} (src/billing.js price())` }, { id: "P2", what: `${Q.AC2} (test/routes.test.js)` }], validate: [{ id: "V1", command: V1 }] });
 const FULL = () => contract([req("R1"), req("R2"), req("R3"), req("R4"), req("R5")]);
 const OMIT = () => contract([req("R1"), req("R2"), req("R4"), req("R5")]);
-const DEFER = () => contract([req("R1"), req("R2"), req("R3", "defer", { why: "export.js ships on the data-export module's own release train" }), req("R4"), req("R5")]);
+const DEFER = () => contract([req("R1"), req("R2"), req("R3", "defer", { bucket: "new-issue", why: "export.js ships on the data-export module's own release train" }), req("R4"), req("R5")]);
 
 // ---- world ----
 function makeWorld(dir, script) {