forgedock 1.43.1 → 1.44.0

package/bin/lean/selftest-live.mjs

@@ -10,10 +10,14 @@ import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { batchRoot, listBatches, openBatch } from "./batch.mjs";
 import { staticCheck, formatStatic, realGh } from "./selftest-static.mjs";
+import { pollUntil } from "./retry.mjs";
 import { postMarker } from "./selftest-gate.mjs";
 import { reportNightly } from "./selftest-nightly.mjs";
 import { parseForgeYaml } from "../forge-utils.mjs";
 
+const BATCH_WAIT_TRIES = 60, BATCH_WAIT_MS = 1000;
+const DEFAULT_TIMEOUT_MS = 45 * 60 * 1000, DEFAULT_POLL_MS = 5000, GH_MAX_BUFFER = 64 * 1024 * 1024;
+
 export class StepError extends Error {
   constructor(step, message) { super(message); this.step = step; }
 }
@@ -33,20 +37,31 @@ export const FIXTURES = {
   },
 };
 
+/**
+ * The fixture with every path and title made unique to this run (#4952): a merged run leaves its files on the sandbox
+ * default branch, and the next run's "the test fails on the current code" premise must still hold.
+ */
+export function uniqueFixture(fx, lang, runId) {
+  const re = lang === "python" ? /`((?:test_)?[ab]\.py)`/g : /`src\/([ab](?:\.test)?\.js)`/g;
+  const dir = (m, f) => (lang === "python" ? `\`${runId}/${f}\`` : `\`src/${runId}/${f}\``);
+  const one = (i) => ({ title: `${i.title} (${runId})`, body: i.body.replace(re, dir) });
+  return { files: fx.files, a: one(fx.a), b: one(fx.b) };
+}
+
+/** Whether a batch plan is the one this harness started: the sandbox repo and every issue it passed (#4952). */
+export const isOwnBatch = (plan, repo, issues) =>
+  String(plan?.repo ?? "").toLowerCase() === repo.toLowerCase() && issues.every((n) => (plan?.argv ?? []).map(String).includes(String(n)));
+
 /** The issue body with its FORGE:STATE annotation removed. */
 export const stripState = (body) => String(body ?? "").replace(/<!--\s*FORGE:STATE[\s\S]*?-->/g, "").trim();
 
 const num = (out) => { const m = /\/issues\/(\d+)/.exec(String(out)) ?? /^(\d+)$/m.exec(String(out)); if (!m) throw new Error(`no issue number in: ${String(out).slice(0, 120)}`); return Number(m[1]); };
 
 async function waitFor(ctx, step, what, cond, onTick) {
-  const { io, timeoutMs } = ctx, t0 = io.now();
-  for (;;) {
-    if (onTick) await onTick();
-    const v = await cond();
-    if (v) return v;
-    if (io.now() - t0 > timeoutMs) fail(step, `timed out waiting for ${what}`);
-    await io.sleep(ctx.pollMs);
-  }
+  const { io, timeoutMs, pollMs } = ctx;
+  const v = await pollUntil(async () => { if (onTick) await onTick(); return cond(); }, { timeoutMs, pollMs, sleep: io.sleep, now: io.now });
+  if (!v) fail(step, `timed out waiting for ${what}`);
+  return v;
 }
 
 /** Step "body": every issue body still holds its creation text (#4860). */
@@ -59,16 +74,16 @@ async function checkBodies(ctx, step = "body") {
 
 export const STEPS = [
   { name: "create", run: async (ctx) => {
-    const { io, repo, fx } = ctx;
+    const { io, repo } = ctx, fx = ctx.fx = uniqueFixture(ctx.fx, ctx.lang, ctx.runId);
     for (const [path, content] of Object.entries(fx.files)) {
       await io.gh(["api", "-X", "PUT", `repos/${repo}/contents/${path}`, "-f", `message=selftest fixture ${path}`, "-f", `content=${Buffer.from(content).toString("base64")}`]).catch(() => { /* already present */ });
     }
-    const mk = async (t, body) => num(await io.gh(["issue", "create", "-R", repo, "--title", t, "--body", body]));
+    // Tracked the moment it exists: if B's create fails, A is still cleaned up.
+    const mk = async (t, body) => { const n = num(await io.gh(["issue", "create", "-R", repo, "--title", t, "--body", body])); ctx.created.push(n); return n; };
     const a = await mk(fx.a.title, fx.a.body);
     const b = await mk(fx.b.title, `${fx.b.body}\n\n**Depends on**: #${a}`);
     ctx.issues = { A: a, B: b };
     ctx.bodies = { [a]: fx.a.body, [b]: fx.b.body };
-    ctx.created.push(a, b);
   } },
   { name: "add", run: async (ctx) => {
     const { io, repo, issues } = ctx;
@@ -84,12 +99,13 @@ export const STEPS = [
     const { io, issues } = ctx;
     const pid = async () => (await io.orchestrate.state(ctx.run.id))?.running?.[issues.A]?.pid ?? null;
     const before = await waitFor(ctx, "resume", `a live lane for #${issues.A}`, pid);
+    // The batch runs inside schedd: killing the client stops nothing, so the batch itself is cancelled (#4952).
     await ctx.run.kill();
+    await io.orchestrate.stop(ctx.run.id);
+    await waitFor(ctx, "resume", `the lane of #${issues.A} (pid ${before}) to stop after the cancel`, async () => ((await pid()) ? null : { stopped: true }));
     ctx.run = await io.orchestrate.resume(ctx.run.id);
-    await io.sleep(ctx.pollMs);
-    const st = await io.orchestrate.state(ctx.run.id), after = st?.running?.[issues.A]?.pid ?? null;
-    const done = st?.results?.[issues.A];
-    if (!done && after !== before) fail("resume", `#${issues.A} was launched again after --resume (pid ${before} -> ${after}), not re-adopted`);
+    const st = await waitFor(ctx, "resume", `the batch to pick #${issues.A} up again after --resume`, async () => { const s = await io.orchestrate.state(ctx.run.id); return s?.results?.[issues.A] || s?.running?.[issues.A]?.pid ? s : null; });
+    if (!st.results?.[issues.A] && st.running?.[issues.A]?.pid === before) fail("resume", `#${issues.A} still has its pre-cancel lane (pid ${before}) after --resume: the batch was never stopped`);
     await checkBodies(ctx, "body");
   } },
   { name: "merge", run: async (ctx) => {
@@ -127,26 +143,31 @@ export const STEPS = [
  * Run the steps in order; the first failure stops them, cleanup always runs.
  * @returns {{ok:boolean, step:string|null, message:string|null, notes:string[], cleanupErrors:string[]}}
  */
-export async function runSelftestLive({ repo, lang = "node", io, timeoutMs = 45 * 60 * 1000, pollMs = 5000 }) {
+export async function runSelftestLive({ repo, lang = "node", io, timeoutMs = DEFAULT_TIMEOUT_MS, pollMs = DEFAULT_POLL_MS }) {
   const fx = FIXTURES[lang];
   if (!fx) return { ok: false, step: "setup", message: `unknown fixture language ${lang} (node|python)`, notes: [], cleanupErrors: [] };
-  const ctx = { io, repo, fx, timeoutMs, pollMs, issues: {}, bodies: {}, created: [], notes: [], run: null };
+  const ctx = { io, repo, fx, lang, runId: `r${io.now?.().toString(36) ?? "0"}`, timeoutMs, pollMs, issues: {}, bodies: {}, created: [], notes: [], run: null };
   let out = { ok: true, step: null, message: null };
   for (const s of STEPS) {
     try { await s.run(ctx); } catch (e) { out = { ok: false, step: e.step ?? s.name, message: String(e.message ?? e) }; break; }
   }
   const cleanupErrors = [];
   const tryC = async (what, f) => { try { await f(); } catch (e) { cleanupErrors.push(`${what}: ${String(e.message ?? e).slice(0, 120)}`); } };
-  if (ctx.run) await tryC("stop orchestrate", () => ctx.run.kill());
+  if (ctx.run) {
+    await tryC("kill orchestrate client", () => ctx.run.kill());
+    await tryC("stop batch", () => io.orchestrate.stop(ctx.run.id));
+  }
   for (const n of ctx.created) {
     await tryC(`close #${n}`, () => io.gh(["issue", "close", String(n), "-R", repo]));
-    await tryC(`delete branches of #${n}`, async () => {
-      const refs = String(await io.gh(["api", `repos/${repo}/git/matching-refs/heads/forge/issue-${n}`, "--jq", ".[].ref"])).split("\n").filter(Boolean);
-      for (const ref of refs) await io.gh(["api", "-X", "DELETE", `repos/${repo}/git/${ref}`]);
-    });
-    await tryC(`close PRs of #${n}`, async () => {
-      const prs = String(await io.gh(["pr", "list", "-R", repo, "--search", `#${n} in:title,body`, "--state", "open", "--json", "number", "--jq", ".[].number"])).split("\n").filter(Boolean);
-      for (const p of prs) await io.gh(["pr", "close", p, "-R", repo, "--delete-branch"]);
+    // The prefix search over-matches (issue-5 lists issue-50): keep only this issue's own branches, then find PRs by head.
+    const own = new RegExp(`^refs/heads/forge/issue-${n}(?![0-9])`);
+    const lines = async (args) => String(await io.gh(args)).split("\n").filter(Boolean);
+    await tryC(`clean up branches of #${n}`, async () => {
+      const refs = (await lines(["api", `repos/${repo}/git/matching-refs/heads/forge/issue-${n}`, "--jq", ".[].ref"])).filter((r) => own.test(r));
+      for (const ref of refs) {
+        for (const p of await lines(["pr", "list", "-R", repo, "--head", ref.replace(/^refs\/heads\//, ""), "--state", "open", "--json", "number", "--jq", ".[].number"])) await io.gh(["pr", "close", p, "-R", repo]);
+        await io.gh(["api", "-X", "DELETE", `repos/${repo}/git/${ref}`]);
+      }
     });
   }
   return { ...out, notes: ctx.notes, cleanupErrors };
@@ -159,28 +180,32 @@ export function realIo(env = process.env, { pool = false } = {}) {
   let self;
   const root = batchRoot(env);
   const detached = (args) => { const p = spawn(process.execPath, [CLI, ...args], { detached: true, windowsHide: true, stdio: "ignore", env }); p.unref(); return { kill: async () => { try { process.kill(-p.pid, "SIGTERM"); } catch { /* gone */ } } }; };
-  const waitBatch = async (before) => { for (let i = 0; i < 60; i++) { const id = listBatches(root).find((b) => !before.has(b)); if (id) return id; await new Promise((r) => setTimeout(r, 1000)); } throw new Error("orchestrate did not create a batch within 60s"); };
+  // The batch of THIS start: new on disk, for the sandbox repo, and naming the issue we passed. A concurrent real batch is never adopted (#4952).
+  const ownBatch = (id, repo, issues) => { try { return isOwnBatch(openBatch(root, id).readPlan(), repo, issues); } catch { return false; } };
+  const waitBatch = async (before, repo, issues) => { const id = await pollUntil(() => listBatches(root).find((b) => !before.has(b) && ownBatch(b, repo, issues)), { timeoutMs: BATCH_WAIT_TRIES * BATCH_WAIT_MS, pollMs: BATCH_WAIT_MS }); if (id) return id; throw new Error(`orchestrate did not create a batch for ${repo} ${issues.join(",")} within ${BATCH_WAIT_TRIES * BATCH_WAIT_MS / 1000}s`); };
   return (self = {
     now: () => Date.now(), sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
-    gh: async (args) => { const r = spawnSync("gh", args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }); if (r.status !== 0) throw new Error(r.stderr.trim() || `gh exited ${r.status}`); return r.stdout; },
+    gh: async (args) => { const r = spawnSync("gh", args, { encoding: "utf8", maxBuffer: GH_MAX_BUFFER }); if (r.status !== 0) throw new Error(r.stderr.trim() || `gh exited ${r.status}`); return r.stdout; },
     cli: async (args) => { const r = spawnSync(process.execPath, [CLI, ...args], { encoding: "utf8", env }); return { code: r.status ?? 1, stdout: r.stdout, stderr: r.stderr }; },
     cliVersion: async () => JSON.parse(readFileSync(join(dirname(CLI), "..", "package.json"), "utf8")).version,
     orchestrate: {
       start: async (repo, issues, parallel) => {
         const before = new Set(listBatches(root)), h = detached(["orchestrate", ...issues.map(String), "--parallel", String(parallel), "--repo", repo]);
-        return { id: await waitBatch(before), kill: h.kill };
+        return { id: await waitBatch(before, repo, issues), kill: h.kill };
       },
+      // The batch lives in schedd, not in the client: `--cancel` is what stops it (its lanes tear down, the rest is held for --resume).
+      stop: async (id) => { const r = await self.cli(["orchestrate", "--cancel", id]); if (r.code !== 0) throw new Error(`orchestrate --cancel ${id} exited ${r.code}: ${String(r.stderr || r.stdout).slice(0, 160)}`); },
       resume: async (id) => ({ id, ...detached(["orchestrate", "--resume", id]) }),
       state: async (id) => openBatch(root, id).store.load(),
     },
     // Step 6: one lane through the pool. The issue's FORGE:STATE records the placement and the lane's FORGE:TELEMETRY rows
     // carry the engine's forge_version (the sandbox's, not the CLI's: the #4818 stale-image defect).
     remote: pool ? { run: async ({ repo, issue, timeoutMs, pollMs }) => {
-      const run = await self.orchestrate.start(repo, [issue], 1), t0 = Date.now();
+      const run = await self.orchestrate.start(repo, [issue], 1);
       let row = null;
       try {
-        while (!row && Date.now() - t0 < timeoutMs) { row = (await self.orchestrate.state(run.id))?.results?.[issue] ?? null; if (!row) await self.sleep(pollMs); }
-      } finally { await run.kill(); }
+        row = await pollUntil(async () => (await self.orchestrate.state(run.id))?.results?.[issue] ?? null, { timeoutMs, pollMs, sleep: self.sleep, now: self.now });
+      } finally { await run.kill(); await self.orchestrate.stop(run.id).catch(() => {}); }
       if (!row) throw new Error(`#${issue} produced no result within ${Math.round(timeoutMs / 1000)}s`);
       const v = JSON.parse(await self.gh(["issue", "view", String(issue), "-R", repo, "--json", "body,comments"]));
       const text = `${v.body}\n${v.comments.map((c) => c.body).join("\n")}`;

package/bin/lean/selftest-live.test.mjs

@@ -5,11 +5,11 @@ import assert from "node:assert/strict";
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { runSelftestLive, stripState, selftestFromCli, STEPS } from "./selftest-live.mjs";
+import { runSelftestLive, stripState, selftestFromCli, STEPS, FIXTURES, uniqueFixture, isOwnBatch } from "./selftest-live.mjs";
 
 /** A fake sandbox world. `d` toggles a defect: add4859 (--add skips), wipe4860 (body wiped), double (resume relaunches), orderBA, noRemoteAuth. */
 function world(d = {}) {
-  const w = { issues: {}, closed: [], calls: [], killed: 0, pid: 100, results: {}, order: [], deps: {}, running: {}, clock: 0, pool: !!d.pool };
+  const w = { issues: {}, closed: [], calls: [], killed: 0, stops: [], pid: 100, results: {}, order: [], deps: {}, running: {}, clock: 0, pool: !!d.pool };
   const gh = async (a) => {
     w.calls.push(a.join(" "));
     if (a[0] === "api" && a[1] === "-X" && a[2] === "PUT") return "{}";
@@ -36,7 +36,9 @@ function world(d = {}) {
     },
     orchestrate: {
       start: async (repo, issues) => { w.order.push(...issues); w.running[issues[0]] = { pid: ++w.pid }; w.a = issues[0]; return { id: "b1", kill: async () => { w.killed++; } }; },
-      resume: async (id) => { w.resumedAt = w.tick ?? 0; if (d.double) w.running[w.a] = { pid: ++w.pid }; return { id, kill: async () => { w.killed++; } }; },
+      // stop = `orchestrate --cancel`: the lane is torn down (d.nostop: the defect where only the client dies and the lane lives on)
+      stop: async (id) => { w.stops.push(id); if (!d.nostop) delete w.running[w.a]; },
+      resume: async (id) => { w.resumedAt = w.tick ?? 0; w.running[w.a] = { pid: d.nostop ? w.running[w.a]?.pid ?? ++w.pid : ++w.pid }; return { id, kill: async () => { w.killed++; } }; },
       state: async () => ({ order: w.order, deps: w.deps, running: w.running, results: w.results }),
     },
     remote: w.pool ? { run: async ({ issue }) => { w.remoteIssue = issue; return { where: d.local ? "local" : "remote", authenticated: !d.noRemoteAuth, engineVersion: d.oldEngine ? "1.37.0" : "1.39.0" }; } } : null,
@@ -73,9 +75,14 @@ describe("selftest --live steps (#4865)", () => {
     const { r } = await run({ wipe4860: true });
     assert.equal(r.ok, false); assert.equal(r.step, "body"); assert.match(r.message, /lost its body text/);
   });
-  it("a lane launched twice after --resume fails the resume step", async () => {
-    const { r } = await run({ double: true });
-    assert.equal(r.step, "resume"); assert.match(r.message, /launched again/);
+  it("resume really stops the batch (not just the client) and cleanup stops it again (#4952)", async () => {
+    const { r, w } = await run({});
+    assert.equal(r.ok, true, JSON.stringify(r));
+    assert.deepEqual(w.stops, ["b1", "b1"], "once in the resume step, once in cleanup");
+  });
+  it("a stop that leaves the lane running fails the resume step instead of passing vacuously (#4952)", async () => {
+    const { r } = await run({ nostop: true }, { timeoutMs: 20000 });
+    assert.equal(r.step, "resume"); assert.match(r.message, /to stop after the cancel/);
   });
   it("B merging before A fails the merge step", async () => {
     const { r } = await run({ orderBA: true });
@@ -89,6 +96,41 @@ describe("selftest --live steps (#4865)", () => {
     const ok = await run({ pool: true });
     assert.equal(ok.w.remoteIssue, 12); assert.deepEqual(ok.w.closed, ["10", "11", "12"]);
   });
+  it("fixtures are run-unique, so a merged run leaves nothing the next run trips on (#4952)", async () => {
+    const x = uniqueFixture(FIXTURES.node, "node", "r1"), y = uniqueFixture(FIXTURES.python, "python", "r1");
+    assert.match(x.a.body, /`src\/r1\/a\.js`.*`src\/r1\/a\.test\.js`/); assert.match(x.a.title, /\(r1\)/);
+    assert.match(y.b.body, /`r1\/b\.py`.*`r1\/test_b\.py`/);
+    const { w } = await run({});
+    assert.match(w.issues[10].body, /src\/r[0-9a-z]+\/a\.js/);
+  });
+  it("the created issue is tracked at once: A is closed when B's create fails (#4952)", async () => {
+    const { w, io } = world({}), gh = io.gh; let creates = 0;
+    io.gh = async (a) => { if (a[0] === "issue" && a[1] === "create" && ++creates === 2) throw new Error("rate limited"); return gh(a); };
+    const r = await runSelftestLive({ repo: "o/sandbox", io, pollMs: 1, timeoutMs: 60000 });
+    assert.equal(r.step, "create"); assert.deepEqual(w.closed, ["10"]);
+  });
+  it("cleanup matches branches exactly and finds PRs by the head branch it created (#4952)", async () => {
+    const { w, io } = world({ add4859: true }), gh = io.gh, log = [];
+    io.gh = async (a) => {
+      if (a[0] === "api" && a[1].includes("matching-refs/heads/forge/issue-10")) return "refs/heads/forge/issue-10\nrefs/heads/forge/issue-100\nrefs/heads/forge/issue-10-x\n";
+      if (a[0] === "api" && a[2] === "DELETE") { log.push(`del ${a[3].split("git/")[1]}`); return ""; }
+      if (a[0] === "api") return "";
+      if (a[0] === "pr" && a[1] === "list") { log.push(`list ${a[a.indexOf("--head") + 1]}`); return a.includes("forge/issue-10") ? "7\n" : ""; }
+      if (a[0] === "pr" && a[1] === "close") { log.push(`close ${a[2]}`); return ""; }
+      return gh(a);
+    };
+    const r = await runSelftestLive({ repo: "o/sandbox", io, pollMs: 1, timeoutMs: 60000 });
+    assert.deepEqual(r.cleanupErrors, []);
+    assert.deepEqual(log, ["list forge/issue-10", "close 7", "del refs/heads/forge/issue-10", "list forge/issue-10-x", "del refs/heads/forge/issue-10-x"]);
+    assert.ok(!w.calls.some((c) => /search/.test(c)), "no text search for PRs");
+  });
+  it("own batch is picked by repo and issues: a foreign concurrent batch is never adopted (#4952)", () => {
+    const mine = { repo: "o/Sandbox", argv: ["orchestrate", "10", "11", "--repo", "o/Sandbox"] };
+    assert.ok(isOwnBatch(mine, "o/sandbox", [10, 11]));
+    assert.ok(!isOwnBatch({ repo: "o/real", argv: ["orchestrate", "10", "11"] }, "o/sandbox", [10, 11]));
+    assert.ok(!isOwnBatch({ repo: "o/sandbox", argv: ["orchestrate", "7"] }, "o/sandbox", [10, 11]));
+    assert.ok(!isOwnBatch(null, "o/sandbox", [10]));
+  });
   it("unknown fixture language fails at setup", async () => {
     assert.equal((await runSelftestLive({ repo: "o/r", lang: "ruby", io: {} })).step, "setup");
   });

package/bin/lean/selftest-nightly.mjs

@@ -9,9 +9,9 @@ import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { schedDir } from "./sched.mjs";
+import { neutralize, findMarked } from "./prodwatch-triage.mjs";
 
 export const NIGHTLY_MARKER = "<!-- FORGE:SELFTEST_NIGHTLY -->";
-const neutralize = (s) => String(s ?? "").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 /** One last-run file per repo: two repos on one host never share (and so never skip) each other's schedule. */
 const stateFile = (repo) => `selftest-nightly-${String(repo).replace(/[^\w.-]+/g, "_")}.json`;
 
@@ -49,8 +49,12 @@ export async function reportNightly({ repo, io, now = () => Date.now(), result }
   const step = result?.step ?? "unknown";
   const title = `selftest --live failed at step ${step} (nightly)`;
   const body = `The nightly \`forgedock selftest --live\` failed at step **${neutralize(step)}**.\n\n${neutralize(String(result?.message ?? "").slice(0, 2000))}\n\nLast failure: ${new Date(now()).toISOString()}\n\n${NIGHTLY_MARKER}\n`;
-  const open = JSON.parse(String(await io.gh(["issue", "list", "-R", repo, "--state", "open", "--search", `"FORGE:SELFTEST_NIGHTLY" in:body`, "--limit", "30", "--json", "number,body"])))
-    .find((i) => String(i.body ?? "").includes(NIGHTLY_MARKER));
+  // #4952: the marker is public text, so only an issue authored by the actor running the harness is edited; an unreadable
+  // login trusts nobody (a new issue is filed instead).
+  let me = "";
+  try { me = String(await io.gh(["api", "user", "--jq", ".login"])).trim().toLowerCase(); } catch { /* untrusted */ }
+  const issues = JSON.parse(String(await io.gh(["issue", "list", "-R", repo, "--state", "open", "--search", `"FORGE:SELFTEST_NIGHTLY" in:body`, "--limit", "30", "--json", "number,body,author"])));
+  const open = findMarked(issues, NIGHTLY_MARKER, (i) => me && String(i.author?.login ?? "").toLowerCase() === me);
   if (open) {
     await io.gh(["issue", "edit", String(open.number), "-R", repo, "--title", title, "--body", body]);
     return { issue: open.number, action: "edit" };

package/bin/lean/selftest-nightly.test.mjs

@@ -8,7 +8,7 @@ import { nightlyConfig, nightlyDue, launchNightly, NIGHTLY_MARKER } from "./self
 
 const setup = (yaml) => { const cwd = tmpDir("nt-"), stateDir = tmpDir("ns-"); if (yaml) writeFileSync(join(cwd, "forge.yaml"), yaml); return { cwd, stateDir }; };
 const YAML = "selftest:\n  sandbox_repo: a/b\n  nightly_interval_hours: 24\n";
-const fakeIo = (open = []) => { const calls = []; return { calls, gh: async (a) => { calls.push(a); if (a[1] === "list") return JSON.stringify(open); if (a[1] === "create") return "https://github.com/o/r/issues/77\n"; return ""; } }; };
+const fakeIo = (open = []) => { const calls = []; return { calls, gh: async (a) => { calls.push(a); if (a[0] === "api") return "bot\n"; if (a[1] === "list") return JSON.stringify(open); if (a[1] === "create") return "https://github.com/o/r/issues/77\n"; return ""; } }; };
 
 test("nightlyConfig: unset, zero and other sections are off", () => {
   assert.equal(nightlyConfig(""), null);
@@ -42,7 +42,7 @@ test("failure files one issue naming the step; the second failure edits it", asy
   assert.match(create.join(" "), /step body/); assert.ok(create.join(" ").includes(NIGHTLY_MARKER));
   assert.ok(!create[create.indexOf("--body") + 1].includes("<!-- x"));
   t += 25 * 3600_000;
-  const io2 = fakeIo([{ number: 77, body: `x\n${NIGHTLY_MARKER}` }]);
+  const io2 = fakeIo([{ number: 77, body: `x\n${NIGHTLY_MARKER}`, author: { login: "Bot" } }]);
   const r2 = await nightlyDue({ ...s, repo: "o/r", io: io2, now: () => t, runLive: async () => ({ ok: false, step: "add", message: "m" }) });
   assert.deepEqual([r2.action, r2.issue], ["edit", 77]);
   assert.ok(!io2.calls.some((a) => a[1] === "create"));
@@ -82,3 +82,25 @@ test("launchNightly: detached, unref'd, and an async spawn error never escapes (
   assert.doesNotThrow(() => child.emit("error", Object.assign(new Error("spawn EAGAIN"), { code: "EAGAIN" })));
   assert.equal(launchNightly({ cli: "c", repo: "o/r", spawnFn: () => { throw new Error("EMFILE"); } }), null);
 });
+
+test("the dedupe never edits a marker-bearing issue authored by someone else (#4952)", async () => {
+  const s = setup(YAML), io = fakeIo([{ number: 5, body: `evil\n${NIGHTLY_MARKER}`, author: { login: "mallory" } }, { number: 6, body: `no marker`, author: { login: "bot" } }]);
+  const r = await nightlyDue({ ...s, repo: "o/r", io, runLive: async () => ({ ok: false, step: "add", message: "m" }) });
+  assert.deepEqual([r.action, r.issue], ["create", 77]);
+  assert.ok(!io.calls.some((a) => a[1] === "edit"));
+  assert.ok(io.calls.find((a) => a[1] === "list").join(" ").includes("number,body,author"));
+});
+
+test("an unreadable login trusts nobody: a new issue is filed", async () => {
+  const s = setup(YAML), io = fakeIo([{ number: 5, body: NIGHTLY_MARKER, author: { login: "bot" } }]), gh = io.gh;
+  io.gh = async (a) => { if (a[0] === "api") throw new Error("no token user"); return gh(a); };
+  const r = await nightlyDue({ ...s, repo: "o/r", io, runLive: async () => ({ ok: false, step: "add", message: "m" }) });
+  assert.equal(r.action, "create");
+});
+
+test("a marker quoted mid-body by the trusted author is not a dedupe hit (shared trailer rule)", async () => {
+  const s = setup(YAML), io = fakeIo([{ number: 5, body: `quote: ${NIGHTLY_MARKER}\nmore text`, author: { login: "bot" } }]);
+  const r = await nightlyDue({ ...s, repo: "o/r", io, runLive: async () => ({ ok: false, step: "add", message: "m" }) });
+  assert.equal(r.action, "create");
+  assert.ok(!io.calls.some((a) => a[1] === "edit"));
+});

package/bin/lean/selftest-static.mjs

@@ -18,15 +18,20 @@ export function listSources(dir) {
   return out.sort();
 }
 
-/** @returns {{cmd:string, fields:string[], line:number}[]} the literal gh `--json` field lists of `text` (cmd e.g. "issue view"). */
+/**
+ * The `gh issue|pr view|list --json <fields>` uses of `text`. A literal field list is `{cmd, fields, line}`; a list the
+ * scan cannot read (a variable or template, e.g. `"--json", fields`) is `{cmd, fields: [], unchecked: true, line}`.
+ * @returns {{cmd:string, fields:string[], line:number, unchecked?:true}[]} cmd e.g. "issue view"
+ */
 export function extractJsonFields(text) {
-  const out = [];
-  const re = /\[([^[\]]*?)["'`]--json["'`]\s*,\s*["'`]([A-Za-z0-9_,]+)["'`]/g;
+  const out = [], re = /["'`]--json["'`]\s*,\s*/g;
   for (let m; (m = re.exec(text));) {
-    const words = [...m[1].matchAll(/["'`]([a-z-]+)["'`]/g)].map((x) => x[1]);
-    const i = words.findIndex((w, k) => (w === "issue" || w === "pr") && (words[k + 1] === "view" || words[k + 1] === "list"));
-    if (i < 0) continue;
-    out.push({ cmd: `${words[i]} ${words[i + 1]}`, fields: m[2].split(",").filter(Boolean), line: text.slice(0, m.index).split("\n").length });
+    const before = text.slice(Math.max(0, m.index - 300), m.index), seg = before.slice(before.lastIndexOf(";") + 1);
+    const cmds = [...seg.matchAll(/["'`](issue|pr)["'`]\s*,\s*["'`](view|list)["'`]/g)];
+    if (!cmds.length) continue;
+    const c = cmds.at(-1), lit = /^["'`]([A-Za-z0-9_,]+)["'`]\s*[,\])]/.exec(text.slice(m.index + m[0].length));
+    const row = { cmd: `${c[1]} ${c[2]}`, fields: lit ? lit[1].split(",").filter(Boolean) : [], line: text.slice(0, m.index).split("\n").length };
+    out.push(lit ? row : { ...row, unchecked: true });
   }
   return out;
 }
@@ -47,14 +52,15 @@ export function parseHelpFields(help) {
 
 /**
  * @param {{root:string, io:{gh:(args:string[])=>string, read?:(p:string)=>string, list?:(d:string)=>string[]}}} a
- * @returns {{ok:boolean, checked:number, missing:{file:string,line:number,cmd:string,field:string}[], errors:string[]}}
+ * @returns {{ok:boolean, checked:number, unchecked:{file:string,line:number,cmd:string}[], missing:{file:string,line:number,cmd:string,field:string}[], errors:string[]}}
  */
 export function staticCheck({ root, io }) {
   const read = io.read ?? ((p) => readFileSync(p, "utf8")), list = io.list ?? listSources;
-  const known = new Map(), errors = [], missing = [];
+  const known = new Map(), errors = [], missing = [], unchecked = [];
   let checked = 0;
   for (const file of list(root)) {
     for (const u of extractJsonFields(read(file))) {
+      if (u.unchecked) { unchecked.push({ file, line: u.line, cmd: u.cmd }); continue; } // reported, never silently skipped (#4952)
       if (!known.has(u.cmd)) {
         let fields = [];
         try { fields = parseHelpFields(io.gh([...u.cmd.split(" "), "--help"])); } catch (e) { errors.push(`gh ${u.cmd} --help failed: ${e.message}`); }
@@ -67,7 +73,7 @@ export function staticCheck({ root, io }) {
       for (const field of u.fields) if (!set.has(field)) missing.push({ file, line: u.line, cmd: u.cmd, field });
     }
   }
-  return { ok: !missing.length && !errors.length, checked, missing, errors };
+  return { ok: !missing.length && !errors.length, checked, unchecked, missing, errors };
 }
 
 export const realGh = (args) => execFileSync("gh", args, { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
@@ -76,6 +82,7 @@ export function formatStatic(r) {
   return [
     ...r.missing.map((m) => `${m.file}:${m.line}: gh ${m.cmd} --json field "${m.field}" is not offered by this gh`),
     ...r.errors,
-    `static check: ${r.ok ? "ok" : "FAILED"} (${r.checked} field lists checked)`,
+    ...(r.unchecked ?? []).map((u) => `${u.file}:${u.line}: gh ${u.cmd} --json field list is not a string literal: unchecked`),
+    `static check: ${r.ok ? "ok" : "FAILED"} (${r.checked} field lists checked, ${(r.unchecked ?? []).length} unchecked)`,
   ].join("\n");
 }

package/bin/lean/selftest-static.test.mjs

@@ -29,4 +29,12 @@ describe("selftest static check (#4865)", () => {
     const r = staticCheck({ root: "/bin", io: { gh: () => { throw new Error("no gh"); }, list: () => ["/a.mjs"], read: () => 'x(["pr", "view", "--json", "title"])' } });
     assert.equal(r.ok, false);
   });
+  it("reports a non-literal --json list as unchecked, not as checked (#4952)", () => {
+    const t = 'x();\ngh(["issue", "view", String(n), ...(repo ? ["-R", repo] : []), "--json", fields]);\ngh(["pr", "list", "--json", `a,${f}`]);';
+    assert.deepEqual(extractJsonFields(t), [{ cmd: "issue view", fields: [], line: 2, unchecked: true }, { cmd: "pr list", fields: [], line: 3, unchecked: true }]);
+    const r = staticCheck({ root: "/bin", io: { gh, list: () => ["/bin/a.mjs"], read: () => t } });
+    assert.equal(r.ok, true); assert.equal(r.checked, 0); assert.equal(r.unchecked.length, 2);
+    assert.match(formatStatic(r), /a\.mjs:2: gh issue view --json field list is not a string literal: unchecked/);
+    assert.match(formatStatic(r), /0 field lists checked, 2 unchecked/);
+  });
 });

package/bin/lean/signoff.mjs

@@ -61,16 +61,18 @@ export async function ensureSignedOff({ git, lane, branch, env = process.env })
   }
   const fenv = { FD_BAD: bad.map((c) => c.sha).join(" "), FD_NAME: name, FD_EMAIL: email, FILTER_BRANCH_SQUELCH_WARNING: "1" };
   // filter-branch refuses a dirty tree (lockfile churn, build output): park tracked changes on a private ref, never the shared stash stack
-  const saved = await ok(["status", "--porcelain", "--untracked-files=no"]) ? await ok(["stash", "create"]) : "";
+  const porcelain = await ok(["status", "--porcelain", "--untracked-files=no"]);
+  const dirty = porcelain ? porcelain.split("\n").map((l) => l.replace(/^\s*\S+\s+/, "")).slice(0, 20) : []; // #4905: the dirty paths are reported so the source of the dirt (validate/format output) is visible
+  const saved = porcelain ? await ok(["stash", "create"]) : "";
   if (saved) { await git(["update-ref", STASH_REF, saved]); await git(["reset", "-q", "--hard", "HEAD"]); }
   let failure = null;
   try { await git(["filter-branch", "-f", "--env-filter", ENV_FILTER, "--msg-filter", MSG_FILTER, "--", "HEAD", ...exclude], { env: fenv }); }
-  catch (e) { failure = `could not rewrite ${bad.length} unpushed commit(s) for DCO: ${String(e?.stderr ?? e?.message ?? e).slice(0, 300)}`; }
+  catch (e) { failure = `could not rewrite ${bad.length} unpushed commit(s) for DCO: ${String(e?.stderr ?? e?.message ?? e).slice(0, 300)}${dirty.length ? ` (dirty tracked files: ${dirty.join(", ")})` : ""}`; }
   if (saved) {
     try { await git(["stash", "apply", saved]); await ok(["update-ref", "-d", STASH_REF]); }
     catch { failure = `${failure ? `${failure}; ` : ""}could not restore the lane's uncommitted changes after the DCO rewrite; they are kept as ${saved} (${STASH_REF})`; }
   }
   if (failure) throw Object.assign(new Error(failure), { noIdentity: false, engineCode: "engine.dco_rewrite" });
   await ok(["for-each-ref", "--format=delete %(refname)", "refs/original/"]).then(async (l) => { for (const r of l.split("\n").map((x) => x.replace(/^delete /, "")).filter(Boolean)) await ok(["update-ref", "-d", r]); });
-  return { rewritten: bad.length };
+  return { rewritten: bad.length, ...(dirty.length ? { dirty } : {}) };
 }

package/bin/lean/signoff.test.mjs

@@ -99,6 +99,27 @@ describe("ensureSignedOff", () => {
     await assert.rejects(ensureSignedOff({ git: f.git, lane: "staging", branch: "feat/x", env: {} }), (e) => e.noIdentity === true);
     assert.equal(f.sh("rev-parse", "HEAD"), bad);
   });
+  it("rewrites on a dirty worktree and keeps the dirty tracked and untracked files (#4905)", async () => {
+    const f = fixture();
+    f.commit("b.txt", "unpushed placeholder", "placeholder");
+    writeFileSync(join(f.wt, "base.txt"), "modified\n");
+    writeFileSync(join(f.wt, "new.txt"), "untracked\n");
+    const r = await ensureSignedOff({ git: f.git, lane: "staging", branch: "feat/x", env: {} });
+    assert.equal(r.rewritten, 1);
+    assert.deepEqual(r.dirty, ["base.txt"]); // the source of the dirt is reported
+    assert.equal(readFileSync(join(f.wt, "base.txt"), "utf8"), "modified\n");
+    assert.equal(readFileSync(join(f.wt, "new.txt"), "utf8"), "untracked\n");
+    assert.match(f.sh("status", "--porcelain"), /M base\.txt/);
+    assert.equal(f.sh("log", "-1", "--format=%ae"), "lane@example.com");
+  });
+  it("restores the dirty file when the rewrite itself fails (#4905)", async () => {
+    const f = fixture();
+    f.commit("b.txt", "unpushed placeholder", "placeholder");
+    writeFileSync(join(f.wt, "base.txt"), "modified\n");
+    const git = async (a, o) => { if (a[0] === "filter-branch") throw Object.assign(new Error("boom"), { stderr: "boom" }); return f.git(a, o); };
+    await assert.rejects(ensureSignedOff({ git, lane: "staging", branch: "feat/x", env: {} }), /could not rewrite 1 unpushed.*dirty tracked files: base\.txt/s);
+    assert.equal(readFileSync(join(f.wt, "base.txt"), "utf8"), "modified\n");
+  });
 
   it("rewrites on a dirty tree (#4997): unstaged and staged tracked changes survive, no stash entry is left", async () => {
     const f = fixture();

package/bin/pool/cli.mjs

@@ -15,10 +15,38 @@ import { call as httpCall } from "./http.mjs";
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const loadJson = (p) => JSON.parse(readFileSync(p, "utf8"));
 
+const USAGE = "usage: forgedock pool router [install] | enroll [--cpus N --mem GB] | status | upgrade [agent] | remove <agent>  [--config path]";
+const HELP_FLAGS = ["--help", "-h"];
+// Flags each verb accepts: `value` flags consume the next token, `bool` flags stand alone. Anything else dash-prefixed is rejected (#5008).
+const VERB_FLAGS = {
+  router: { value: ["--config"], bool: [] },
+  agent: { value: ["--config"], bool: [] },
+  status: { value: ["--config"], bool: [] },
+  upgrade: { value: ["--config"], bool: [] },
+  remove: { value: ["--config"], bool: [] },
+  enroll: { value: ["--config", "--cpus", "--mem"], bool: [] },
+  "install-command": { value: ["--config", "--cpus", "--mem"], bool: [] },
+  resize: { value: ["--config", "--cpus", "--mem", "--vm-cpus", "--vm-mem", "--vm-swap"], bool: ["--drain"] },
+};
+
+function rejectUnknownFlags(cmd, rest) {
+  const spec = VERB_FLAGS[cmd];
+  if (!spec) return;
+  for (let i = 0; i < rest.length; i++) {
+    const t = rest[i];
+    if (spec.value.includes(t)) { i++; continue; }
+    if (spec.bool.includes(t)) continue;
+    if (t.startsWith("-") && !/^-\d/.test(t)) throw new Error(`usage: unknown flag ${t} for 'forgedock pool ${cmd}'. ${USAGE.slice("usage: ".length)}`);
+  }
+}
+
 /** The `forgedock pool` verbs (and the `computeshare` script). Throws on usage or router errors; `deps` injects the HTTP client and config. */
 export async function runPoolCli(argv, deps = {}) {
   const [cmd, ...rest] = argv;
   const call = deps.call ?? httpCall;
+  // Help never reaches the router or starts a service (#5008).
+  if (HELP_FLAGS.includes(cmd) || cmd === "help" || rest.some((x) => HELP_FLAGS.includes(x))) { console.log(USAGE); return; }
+  rejectUnknownFlags(cmd, rest);
   const flag = (name, dflt) => { const i = rest.indexOf(`--${name}`); return i >= 0 ? rest[i + 1] : dflt; };
 
   function routerConfig() {
@@ -103,7 +131,7 @@ export async function runPoolCli(argv, deps = {}) {
       break;
     }
     default:
-      throw new Error("usage: forgedock pool router [install] | enroll [--cpus N --mem GB] | status | upgrade [agent] | remove <agent>  [--config path]");
+      throw new Error(USAGE);
   }
 }
 

package/commands/orchestrate.md

@@ -150,7 +150,10 @@ When a lane finishes (agent lanes; the batch runner applies the same rules itsel
 - `needs-human` with a **recoverable code**: `ci.red`, `base.conflict` (merge conflict), `ci-pending` on a conflicting
   PR, `contract.invalid` caused by an issue edited mid-run, `builder.block_untyped` (an in-scope technical choice),
   and the environment codes `env.tool_missing` (a validate command the host cannot run) and `env.repro_unrunnable`
-  (the repro harness could not run the repro test).
+  (the repro harness could not run the repro test), and the conformance gaps `conformance.unimplemented`,
+  `conformance.omission` and `conformance.unjustified_deferral` (the recovery lane delivers the gap, or defers an optional
+  clause with a why so a tracked follow-up is filed; `conformance.regression`, `guard_broken`, `scope_creep` and
+  `e2e_unverified` stay terminal).
   These are mechanical. **Do not ask for confirmation on them.** The batch runner recovers each one itself
   (`orchestration.recovery.max_attempts`, default 1 per issue). It launches one recovery lane under the same lease, lane
   and admission rules as any lane, with `run-issue --recover <code> [--recover-attempt n]` (core path only:
@@ -166,7 +169,7 @@ When a lane finishes (agent lanes; the batch runner applies the same rules itsel
   the issue's last comment for the reason, mark its dependents skipped, and add it to the escalation list (step 4). Only
   explicit or logical edges skip a dependent (after you decide the block in scope, clear the label and run
   `forgedock orchestrate --requeue <id> N... --reason "..."`, never a second batch); an issue that merely overlaps the same file keeps running.
-- `needs-human` with a **terminal code** that is neither recoverable nor human (for example a `conformance.*` code, or
+- `needs-human` with a **terminal code** that is neither recoverable nor human (for example `conformance.regression`, or
   `contract.invalid` without a mid-run issue edit): the runner does not recover it and it is not an escalation. The
   batch report lists it as `unrecovered: #N (<code>: <detail>)`, like a recovery that did not merge. Mark its dependents
   skipped and leave the issue for a later run once its cause is fixed.