forgedock 1.46.0 → 1.47.0

package/docs/CONFIG.md

@@ -730,11 +730,21 @@ issue_watch:
 
 ## `followups` (OPTIONAL)
 
-Deferred follow-ups (`scripts/file-deferred-followups.sh`) are filed as one issue per class per parent: `engineering`, `post-deploy`, `external` and `ops`. Each carries the label `followup:<class>` (`external` also `external-prerequisite`, and states the parent it is a prerequisite of) and inherits the parent's milestone. A requirement may set an optional `class` in the contract; otherwise `post-deploy` items are `post-deploy` and the rest `engineering`. A parent milestone that has shipped (closed) is replaced by the next open milestone by due date, else `followups.default_milestone`.
+Deferred follow-ups (`scripts/file-deferred-followups.sh`) are routed by kind (#5078):
+
+| Kind | Where it goes |
+|---|---|
+| Post-promotion, production-verify, rollout-promote (`post-deploy`, `owner:orchestrator`, `owner:promote:<flag>`, or an owner why such as "after release", "rollout", "purge") | A checklist line in the repo's ONE open post-deploy rollup (`FORGE:POSTDEPLOY_ROLLUP`, else the lowest open issue labelled `followups.rollup_issue_label`). Never a new issue when one is open. |
+| Read-only production data or capture (bucket `host`, or an owner why naming obs-psql, a `*-monitor` or a read-only prod query) | Class `host`: added to the parent's engineering follow-up of the same run, else one per-parent follow-up. Labels `followup:host` and `host-task`, never `needs-human`. |
+| Truly external (credentials, spend, an account, a third party, a customer) | ONE issue per batch (`FORGE:EXTERNAL_BATCH: <batch id>`) holding every item under a `### #<parent>` heading, labelled `followup:external`, `external-prerequisite` and `needs-human`. |
+| Engineering | The parent's open follow-up when one exists, else one issue per parent with all its items together. `ops` and `verify-now` also keep one issue per parent. |
+
+Each issue carries the label `followup:<class>` and inherits the parent's milestone. A requirement may set an optional `class` in the contract. Otherwise `post-deploy` items are `post-deploy` and the rest `engineering`. A parent milestone that has shipped (closed) is replaced by the next open milestone by due date, else `followups.default_milestone`. The batch report lists `follow-ups appended: #N (<class>: k item(s) from #a,#b)` per issue, not "issues filed".
 
 ```yaml
 followups:
-  default_milestone: "Backlog"   # optional: milestone title used when the parent's milestone has shipped and no later one is open
+  default_milestone: "Backlog"     # optional: milestone title used when the parent's milestone has shipped and no later one is open
+  rollup_issue_label: post-deploy  # optional: a repo's own open issue with this label is the post-deploy rollup when no marked one is open
 ```
 
 ## `rollouts` (OPTIONAL)
@@ -888,6 +898,7 @@ verify:
   guard_command:                # optional; per-extension command for the guard gate's base test files
     ".py": "scripts/pytest {path}"
   e2e: auto                     # optional e2e merge gate: auto (default) | always | never
+  precheck_block: false         # optional (#5079); true: a declared pre-PR check still failing after the fix round (or a round with no commit) ends the lane needs-human ci.red (recoverable) instead of opening the PR with an anomaly
   e2e_label: full-ci            # PR label that makes the repo's CI run e2e (label path)
   e2e_checks: "e2e"             # check names of the e2e jobs the label path waits on
   # e2e_workflow: e2e.yml       # or: a workflow_dispatch workflow that runs e2e (wins over the label)
@@ -1018,6 +1029,7 @@ execution:
 | `budget_minutes`, `budget_usd` | number | No | The `execution.budget` per batch: once the batch's sandbox minutes / estimated USD (settled lanes plus the running ones' elapsed time) reach the cap, no new remote lane is admitted. Missing, non-numeric or negative means no cap. |
 | `day_budget_minutes`, `day_budget_usd` | number | No | The same cap per host UTC day, summed over every batch on the host from the host-day store (`execution-budget.json` in `~/.forge/sched/`, or `FORGEDOCK_EXECUTION_BUDGET_FILE`). A corrupt or unreadable store refuses remote lanes while a day cap is set; remove the file to reset it. |
 | `fallback_local` | boolean | No | `true`: a remote-placed lane runs on the host while the provider reports no agent online (`GET {endpoint}/status -> {"online": N}`, the built-in router answers it with `online`, `total` and per-agent `ok`/`paused`), so a batch completes locally with every pool agent offline or asleep (forge#4547). Default `false`: such lanes defer (`sandbox.capacity`). A missing or failing `/status` is unknown and never triggers it. |
+| `account_rotator` | string | No | `tokenbaton`: the `claude` on PATH is the tokenbaton shim, which runs each call on the logged-in account with the most room (`CLAUDE_CONFIG_DIR=~/.claude-<n>`) (forge#5094). forgedock reads `~/.tokenbaton/current` (the account number) and `~/.tokenbaton/live.<n>` (`<5h used %> <5h reset s> <weekly used %> <weekly reset s> <updated s>`), re-read on every check and never written. An account has headroom when its 5-hour use is under 95% and its weekly use under 100% (a window whose reset has passed counts as 0). While any account has headroom no host-wide usage hold is recorded and admissions continue; they stop only when every account is exhausted and resume when the first one resets. A lane whose call hits a usage limit retries that same call (same session) on the next account at once, at most once per account, before it pauses or defers. `forgedock limits show` lists each account's 5-hour use. Any other value, or unreadable files: off (per-account holds as before). |
 | `warm_sandboxes` | integer | No | Warm sandboxes per repo the pool agent keeps ready (checkout at the base ref, dependency cache primed). When `N > 0` the launch spec carries `warm: N` and the lane first calls `POST {endpoint}/sandboxes/claim`; a ready warm sandbox takes the lane (refreshed to the lane's base ref with an incremental fetch before work starts), and when none is ready, the claim fails or the endpoint lacks the route the lane starts cold. Default `0` (off): no claim call and the launch spec is unchanged (forge#4912). |
 | `unreachable_window_min` | number | No | Remote providers: how long a lane keeps polling (with backoff, up to 30s) after the provider's transport fails (connection refused/reset, `fetch failed`, timeout, 502/503/504) before it ends `deferred` with `sandbox.unreachable` (forge#4672). Inside the window the lane never ends and the sandbox is never torn down; after it the sandbox is kept and adopted on the next attempt or `--resume`; the engine-error breaker does not count it. `adopt` applies the same window. Default: 5 |
 | `on_budget` | string | No | `stop` (default): running lanes finish and the rest end `held` (`execution budget: ...`) for a later `--resume`. `local`: the rest run as detached host lanes. |
@@ -1343,6 +1355,9 @@ verification:
   test_runners:            # path prefix -> runner command prefix (block-style map)
     services/worker: "poetry -C services/worker run"
     web: "pnpm --filter web exec"
+
+topology:
+  route_reachability: "bash scripts/check-ingress.sh"   # optional; blocking when declared
 ```
 
 | Field | Type | Required | Description |
@@ -1360,7 +1375,9 @@ verification:
 | `consumer_sweep.mode` | string | No | `advisory` (default): the validate consumer sweep (`scripts/consumer-sweep.sh`, V4.6) records unaddressed referencing sites and never fails. `blocking`: unaddressed sites fail validate with `consumer_unaddressed`, build runs one repair round, and sites still unaddressed are recorded as `CONSUMERS: unresolved` and passed to review as known risk (never `needs-human`). Flip to `blocking` only after `bash scripts/consumer-sweep.sh --eval-history 20` shows a mean of at most 2 flagged sites per merge and none above 10 on your repo |
 | `consumer_sweep.budget_seconds` | integer | No | Wall-clock budget for the sweep (default `60`). When it runs out the sweep stops with `BUDGET_EXCEEDED`, reports the partial result, and never fails, in either mode |
 | `test_runners` | map (path prefix → runner) | No | Default unset (no runner enforced). For repos whose validate commands need a managed runner (uv, poetry, pnpm workspace). The lean engine checks it at contract freeze (`testRunnerProblems`, `bin/lean/preflight.mjs`): a validate command that touches a configured path prefix without containing that prefix's runner string is reported as a contract problem, instead of failing later as `contract.invalid_command` / `env.tool_missing`. Paths in the command are relative to the runner's cwd. Write it as a block-style map: `parseForgeYaml` does not read inline `{ ... }` maps. |
+| `coupled_files` | map (glob → glob list) | No | Default unset (#5079). "If file A changes, file B must change": a block map `{when glob: required glob[, glob]}`, e.g. `"infra/guard/bootstrap.sh": "infra/guard/MANIFEST.sha256"`. A key prefixed `added:` fires only for files the lane adds (`"added:scripts/tests/test_*.py": ".github/workflows/ci.yml"`). A lane that changes a `when` file without a matching required file fails precheck with `coupled_file_missing` (`conformance.unimplemented`, builder resumed once). Quote keys that contain `*`, and list alternatives as separate keys: brace globs (`*.{ts,tsx}`) are not expanded. |
 | `validate.recipes` | map (regex → replacement) | No | Default unset. A top-level `validate:` block with a block-style `recipes:` map, e.g. `"poetry run pytest": "uv run --with-requirements r.txt pytest"`. Each key is a regex source; the first recipe that matches a frozen validate or `repro_test` command rewrites it at contract freeze (`applyValidateRecipes`), recorded as a decision. Use it for commands whose environment is not installed in lane sandboxes. |
+| `topology.route_reachability` | string (command) | No | Default unset (no check, no behaviour change). A repo-supplied command that takes the route paths a diff adds (Next.js `app/**/route.*`, `pages/api/**`; URL form, route groups removed) as arguments and exits non-zero when the production ingress does not deliver them to the service that implements them. Runs in the lean lane after validate and in `review-pr-staging`; a non-zero exit blocks (`conformance.unimplemented`, kind `route_unreachable`). Read by `readEnvConfig` (`bin/engine-cli.mjs`), run by `bin/lean/routecheck.mjs`. |
 
 **Commands that use this section**: `quality-gate`, `validate` (V2 runs `verification.commands`; V4.8 runs the local CI gate; health checks and `consumer_sweep`), `work-on`
 

package/docs/OUTCOME-CODES.md

@@ -56,8 +56,9 @@ An absent or unknown code is recorded as `unclassified`, with the raw reason kep
 | `env.tool_missing` | Core work-on (forge#4323): a validate command the builder recorded as failed was rerun by the engine and could not run because the host lacks a tool or module (`command not found` / exit 127, Python `No module named x`, Node `Cannot find module|package 'x'` for a bare name the repo does not track). An environment error, not a conformance failure: no builder resume, no reviewer. Also ends this way when a remote-sandbox builder reports a missing tool as a `credentials` block (forge#4685, `missingToolBlock`). Ends `needs-human` naming the tool; recoverable by `forgedock orchestrate` (the recovery lane runs the check through the repo's own toolchain). Skipped on a CI-verified head | lean | `gate()` rerun via `io.runCommand`, `{rc, output}` classified by `conformance.mjs` `missingTool` |
 | `env.repro_unrunnable` | Core work-on (forge#4334): on a bug lane the frozen `repro_test` could not be run on head by `scripts/acceptance-red-green.sh` (`HEAD=UNRUNNABLE`: timeout, exit 126/127, unclassifiable output) or the harness returned no result. An environment error, not a conformance failure: no builder resume, no reviewer. Ends `needs-human`; recoverable by `forgedock orchestrate` (the recovery lane reruns the repro command through the repo's own toolchain and installed dependencies). Other non-proofs (passes on base, fails on head, base unrunnable) stay `conformance.unimplemented` | lean | `gate()` `io.redGreen` words, classified by `conformance.mjs` `reproFailures` |
 | `env.capability_remote` | Core work-on (forge#4542): a lane placed in a remote sandbox ended `builder.blocked (credentials)` and its summary names only host capabilities declared in `execution.host_capabilities` (SOPS/age key, ops credentials, prod monitor SSH), which the sandbox does not relay but the dispatching host has. Recoverable by `forgedock orchestrate`: the recovery lane is placed local, once, under the same lease. A credential need the host lacks too stays `builder.blocked` | lean | `endBlocked` via `execution.mjs` `hostCapabilityBlock` |
-| `sandbox.start_failed` | A `forgedock orchestrate` lane sandbox (forge.yaml `execution`, provider `container` or `remote`) could not start: bad image, missing endpoint or credential, refused launch. The lane never ran. Final `needs-human` row: not relaunched and not counted by the engine-error circuit breaker | orchestrate | `bin/lean/execution.mjs` `providerLanes`: `provider.start` threw without `retryable` |
+| `sandbox.start_failed` | A `forgedock orchestrate` lane sandbox (forge.yaml `execution`, provider `container` or `remote`) could not start: bad image, missing endpoint, a refused launch (HTTP 4xx other than 401/403/429) or a non-HTTP start failure. The lane never ran. Final `needs-human` row: not relaunched and not counted by the engine-error circuit breaker | orchestrate | `bin/lean/execution.mjs` `providerLanes`: `provider.start` threw without `retryable`, `transient` or a 5xx/401/403 `status` |
 | `sandbox.capacity` | The sandbox provider had no capacity for the lane (HTTP 429/503 from the remote transport). `deferred`, requeued after `Retry-After` when sent, else 60s; not counted toward `orchestration.max_deferrals`, like `host.busy` (forge#4528) | orchestrate | `provider.start` threw with `err.retryable: true` |
+| `sandbox.transient` | The remote sandbox provider answered HTTP 500/502/504 on launch: a router or agent infrastructure failure, not a code or human problem (forge#5095). `deferred`, requeued after `Retry-After` when sent, else 60s; counted toward `orchestration.max_deferrals` (so a broken pool ends `deferred`, never `needs-human`); not counted by the engine-error circuit breaker | orchestrate | `bin/lean/execution.mjs` `providerLanes` `startFailed`: `provider.start` threw with `err.status` 5xx (not retryable) or `err.transient` |
 | `sandbox.auth` | The remote sandbox provider refused the lane's credential (HTTP 401/403) at start (forge#4685). `deferred`, retried after 300s, never `needs-human`; the pool token resolves from the env, the keychain, then `~/.config/computeshare/forgedock.token` | orchestrate | `provider.start` threw with `err.status` 401/403 |
 | `sandbox.unreachable` | The remote sandbox provider stayed unreachable (connection refused/reset, `fetch failed`, timeout, 502/503/504) for `execution.unreachable_window_min` while a lane polled or adopted its sandbox (forge#4672). `deferred`, requeued after 60s; not counted by the engine-error circuit breaker. The sandbox is NOT torn down: the next attempt or `--resume` adopts it | orchestrate | `bin/lean/execution.mjs` `providerLanes` poll guard |
 | `lease.held` | Another live agent holds the issue lease | engine | Foreign live lease on acquire |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.46.0",
+  "version": "1.47.0",
   "description": "Autonomous development pipeline for coding agents. GitHub as institutional memory, with native Claude Code and OpenCode entrypoints.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/file-deferred-followups.sh

@@ -7,7 +7,7 @@
 # that stay deferred: trusted lookup (claim marker <!-- FORGE:DEFERRED_ISSUE: #M --> on the parent, then a state-all search) of a follow-up carrying
 # <!-- FORGE:DEFERRED_FROM: #N -->, append the missing items (exact path match; a closed one is reopened only if completed, not resolved by a person, and given new items), or create ONE issue
 # with a checklist, claim it on the parent and re-check once for a concurrent lower-numbered duplicate.
-# Items are grouped by class (engineering | post-deploy | external | ops, #4664): one follow-up per class per parent, each
+# Items are grouped by class (engineering | post-deploy | external | ops | host, #4664/#5078): one follow-up per class per parent, each
 # labelled `followup:<class>`, carrying `<!-- FORGE:DEFERRED_CLASS: <class> -->` (absent = engineering, for older issues) and the
 # parent's milestone (a shipped/closed one: the next open milestone by due date, else FORGE_FOLLOWUPS_DEFAULT_MILESTONE).
 #
@@ -17,7 +17,12 @@
 #   error (exit 2, DEFERRED_TSV=INVALID, nothing filed). The label (default: the path) is the item's identity in the checklist
 #   and in the stdout rows; repeated `R<n>: R<m>:` prefixes in it collapse to the first. Class: column 4, else the why's
 #   `post-deploy:|external:|ops:` prefix, else engineering.
-#   #4724 buckets: a why carrying `[bucket:<kind>]` is routed by it: `owner` is always class external (never the rollup),
+#   #4724 buckets: a why carrying `[bucket:<kind>]` is routed by it (#5078): `owner` is class external only for credentials, spend,
+#   an account, a third party or a customer; `owner: orchestrator`, `owner: promote...` and post-promotion text join the rollup and
+#   read-only production data or capture is class host. `host` (labels `followup:host` + `host-task`, never `needs-human`) joins
+#   the parent's engineering follow-up when the run has one. External items go to ONE aggregate per batch, found by
+#   `<!-- FORGE:EXTERNAL_BATCH: <FORGE_BATCH_ID or adhoc> -->` (an older per-parent external follow-up is still appended to).
+#   The rollup may also be the lowest open trusted issue labelled FORGE_ROLLUP_LABEL (forge.yaml followups.rollup_issue_label).
 #   `new-issue` engineering, `verify-now` (the parent is already on the default branch) its own per-parent follow-up class
 #   `verify-now` that the gate releases at once, and `post-deploy`/`date` go to the ONE open rollup of the release lane.
 #   The rollup (class post-deploy) is found by `<!-- FORGE:POSTDEPLOY_ROLLUP: <lane> -->`, not by parent: every lane appends
@@ -57,7 +62,20 @@ if [ "$ITEMS" = "-" ]; then cat > "$TMP/items.raw"; else cat "$ITEMS" > "$TMP/it
 # Internal file uses a non-whitespace separator (US, \x1f): a tab IFS collapses an empty `why` and drops the known-flaw flag.
 # Fields: identity, why, flag, path (`-` when none), class.
 SEP=$(printf '\037')
-CLASSES="engineering post-deploy external ops verify-now"
+CLASSES="engineering post-deploy external ops verify-now host"
+# #5078: an owner item is external only when it needs credentials, spend, an account, a third party or a customer. A
+# post-promotion action (owner:orchestrator, owner:promote:*, after promotion/release, rollout, purge) joins the rollup and
+# read-only production data or capture (obs-psql, *-monitor, a read-only prod query) is a host task. Mirrors
+# bin/lean/conformance.mjs ownerRoute; word boundaries spelled (^|[^[:alnum:]_]) / ([^[:alnum:]_]|$), no \b, for BSD grep (bash 3.2 hosts).
+POSTPROM_ERE='(after|post)[- ]?(promotion|release|deploy)|in production after|production[- ]verif|promot(e|ion)|rollout|purge|deploy[- ]time'
+ROPROD_ERE='ssh[[:space:]]+[[:alnum:]_.-]*-monitor([^[:alnum:]_]|$)|(^|[^[:alnum:]_])obs-psql([^[:alnum:]_]|$)|(^|[^[:alnum:]_])prod(uction)?[ _-]monitor([^[:alnum:]_]|$)|(^|[^[:alnum:]_])read[- ]only[^[:alnum:]_.]([^.]{0,38}[^[:alnum:]_.])?prod(uction)?([^[:alnum:]_]|$)|(^|[^[:alnum:]_])prod(uction)?[^[:alnum:]_.]([^.]{0,28}[^[:alnum:]_.])?(query|queries|capture|telemetry|logs?)([^[:alnum:]_]|$)'
+EXTNEED_ERE='credential|secret|api[- ]?key|token|password|passphrase|ssh[- ]?keys?([^[:alnum:]_]|$)|private[- ]key|(^|[^[:alnum:]_])login([^[:alnum:]_]|$)|(^|[^[:alnum:]_])sudo([^[:alnum:]_]|$)|spend|budget|billing|purchase|payment|account|third[- ]party|vendor|customer|contract sign|legal|(^|[^[:alnum:]_])(delete|drop|truncate|wipe|destroy|modify|migrate|write)([^[:alnum:]_]|$)'
+owner_route() { # why -> post-deploy | host | external
+  case "$1" in "owner: orchestrator"*|"owner: promote"*) echo "post-deploy"; return 0 ;; esac
+  if printf '%s' "$1" | grep -qiE "$POSTPROM_ERE" && ! printf '%s' "$1" | grep -qiE "$EXTNEED_ERE"; then echo "post-deploy"
+  elif printf '%s' "$1" | grep -qiE "$ROPROD_ERE" && ! printf '%s' "$1" | grep -qiE "$EXTNEED_ERE"; then echo "host"
+  else echo "external"; fi
+}
 : > "$TMP/items"
 BAD=0; ROW=0
 bad_row() { BAD=$((BAD+1)); echo "file-deferred-followups: row $ROW: $1" >&2; }
@@ -86,12 +104,13 @@ while IFS= read -r line || [ -n "$line" ]; do
   if [ "$id" = "-" ]; then bad_row "no path and no label"; continue; fi
   w=$(printf '%s' "$w" | tr '\r\n' '  ')
   if [ -z "$c" ]; then
-    case "$w" in post-deploy:*) c="post-deploy" ;; external:*) c="external" ;; ops:*) c="ops" ;; *) c="engineering" ;; esac
+    case "$w" in post-deploy:*) c="post-deploy" ;; external:*) c="external" ;; ops:*) c="ops" ;; host:*) c="host" ;; *) c="engineering" ;; esac
   fi
-  case " $CLASSES " in *" $c "*) ;; *) bad_row "unknown class \`$c\` (engineering|post-deploy|external|ops)"; continue ;; esac
+  case " $CLASSES " in *" $c "*) ;; *) bad_row "unknown class \`$c\` (engineering|post-deploy|external|ops|host)"; continue ;; esac
   # #4724: the bucket token decides the class: owner actions never join the post-deploy rollup, verify-now needs no release.
   case "$w" in
-    *"[bucket:owner]"*) [ "$c" = "ops" ] || c="external" ;;
+    *"[bucket:owner]"*) [ "$c" = "ops" ] || c=$(owner_route "$w") ;;
+    *"[bucket:host]"*) c="host" ;;
     *"[bucket:new-issue]"*) [ "$c" = "post-deploy" ] && c="engineering" ;;
     *"[bucket:verify-now]"*) [ "$c" = "post-deploy" ] && c="verify-now" ;;
   esac
@@ -100,6 +119,12 @@ while IFS= read -r line || [ -n "$line" ]; do
   printf '%s%s%s%s%s%s%s%s%s\n' "$id" "$SEP" "$w" "$SEP" "$k" "$SEP" "${p:--}" "$SEP" "$c" >> "$TMP/items"
 done < "$TMP/items.raw"
 if [ "$BAD" -gt 0 ]; then echo "DEFERRED_TSV=INVALID"; exit 2; fi
+# #5078: host items join the parent's engineering follow-up of this run (dependent items together; it gets `host-task`).
+HOST_JOIN=""
+if awk -F"$SEP" '$5 == "engineering" { e = 1 } $5 == "host" { h = 1 } END { exit !(e && h) }' "$TMP/items"; then
+  HOST_JOIN=1
+  awk -F"$SEP" -v OFS="$SEP" '$5 == "host" { $5 = "engineering" } { print }' "$TMP/items" > "$TMP/items.j" && mv "$TMP/items.j" "$TMP/items"
+fi
 TOTAL=$(wc -l < "$TMP/items" | tr -d ' ')
 
 MARKER="<!-- FORGE:DEFERRED_FROM: #${PARENT} -->"
@@ -181,27 +206,50 @@ find_canonical() {
   return 0
 }
 # --- #4724: the post-deploy rollup: ONE open issue per release lane, found by marker (not by parent) ------------------
+# #5078: the same shape holds every external item of one batch (`FORGE:EXTERNAL_BATCH: <batch>`), and the rollup may also
+# be a repo's own open issue carrying forge.yaml `followups.rollup_issue_label` (FORGE_ROLLUP_LABEL) when no marked one is open.
 RELEASE_LANE="${FORGE_RELEASE_LANE:-default}"
 ROLLUP_MARKER="<!-- FORGE:POSTDEPLOY_ROLLUP: ${RELEASE_LANE} -->"
-verify_rollup() { # number -> `number<TAB>open` when a trusted, open, non-PR issue carries the rollup marker
-  local out rc
+BATCH="${FORGE_BATCH_ID:-adhoc}"
+EXTERNAL_MARKER="<!-- FORGE:EXTERNAL_BATCH: ${BATCH} -->"
+ROLLUP_LABEL="${FORGE_ROLLUP_LABEL:-}"
+agg_marker() { if [ "$1" = "post-deploy" ]; then printf '%s' "$ROLLUP_MARKER"; else printf '%s' "$EXTERNAL_MARKER"; fi; }
+verify_rollup() { # number [marker] -> `number<TAB>open` when a trusted, open, non-PR issue carries the marker
+  local out rc m="${2:-$ROLLUP_MARKER}"
   out=$(gh api "repos/${REPO}/issues/$1" 2>"$TMP/verr"); rc=$?
   if [ "$rc" -ne 0 ]; then grep -qE '404|Not Found|410' "$TMP/verr" 2>/dev/null && return 0; return 1; fi
-  printf '%s' "$out" | jq -r --arg assoc "$TRUSTED_ASSOC" --arg logins "$TRUSTED_LOGINS" --arg m "$ROLLUP_MARKER" "$JQ_PRE"'
+  printf '%s' "$out" | jq -r --arg assoc "$TRUSTED_ASSOC" --arg logins "$TRUSTED_LOGINS" --arg m "$m" "$JQ_PRE"'
       select(.pull_request == null) | select(trusted) | select(.state == "open") | select((.body // "") | contains($m))
       | "\(.number)\t\(.state)"' 2>/dev/null
 }
-find_rollup() { # sets CANON/CSTATE to the lowest open rollup of the lane; non-zero only when a lookup failed
-  local cands n r
+verify_labelled() { # number -> `number<TAB>open` when a trusted, open, non-PR issue carries label $ROLLUP_LABEL
+  local out rc
+  out=$(gh api "repos/${REPO}/issues/$1" 2>"$TMP/verr"); rc=$?
+  if [ "$rc" -ne 0 ]; then grep -qE '404|Not Found|410' "$TMP/verr" 2>/dev/null && return 0; return 1; fi
+  printf '%s' "$out" | jq -r --arg assoc "$TRUSTED_ASSOC" --arg logins "$TRUSTED_LOGINS" --arg l "$ROLLUP_LABEL" "$JQ_PRE"'
+      select(.pull_request == null) | select(trusted) | select(.state == "open") | select(any(.labels[]?; (.name // .) == $l))
+      | "\(.number)\t\(.state)"' 2>/dev/null
+}
+find_aggregate() { # kind (post-deploy|external) ; sets CANON/CSTATE to the lowest open one; non-zero only when a lookup failed
+  local kind="$1" m q cands n r
   CANON=""; CSTATE=""
-  cands=$(gh api -X GET search/issues -f per_page=50 -f q="\"FORGE:POSTDEPLOY_ROLLUP: ${RELEASE_LANE}\" in:body repo:${REPO} is:issue is:open" 2>/dev/null \
+  m=$(agg_marker "$kind"); q="${m#<!-- }"; q="${q% -->}"
+  cands=$(gh api -X GET search/issues -f per_page=50 -f q="\"${q}\" in:body repo:${REPO} is:issue is:open" 2>/dev/null \
+    | jq -r '[.items[].number] | sort | .[]' 2>/dev/null) || return 1
+  for n in $cands; do
+    r=$(verify_rollup "$n" "$m") || return 1
+    if [ -n "$r" ]; then CANON="${r%%$'\t'*}"; CSTATE="${r#*$'\t'}"; return 0; fi
+  done
+  [ "$kind" = "post-deploy" ] && [ -n "$ROLLUP_LABEL" ] || return 0
+  cands=$(gh api -X GET search/issues -f per_page=50 -f q="label:\"${ROLLUP_LABEL}\" repo:${REPO} is:issue is:open" 2>/dev/null \
     | jq -r '[.items[].number] | sort | .[]' 2>/dev/null) || return 1
   for n in $cands; do
-    r=$(verify_rollup "$n") || return 1
+    r=$(verify_labelled "$n") || return 1
     if [ -n "$r" ]; then CANON="${r%%$'\t'*}"; CSTATE="${r#*$'\t'}"; return 0; fi
   done
   return 0
 }
+find_rollup() { find_aggregate post-deploy; }
 # The root parent: a parent that is itself a follow-up (or the rollup) files its items under the parent it came from.
 ROOT="$PARENT"
 resolve_root() {
@@ -238,8 +286,9 @@ rollup_append() { # number ; non-zero = failure
   else gh issue edit "$num" -R "$REPO" --body-file "$TMP/newbody" >/dev/null 2>&1 || return 1; fi
   return 0
 }
-file_rollup() { # items in $ITEMS_F; sets FILED_N, FILED_NEW
+file_rollup() { # items in $ITEMS_F, class $CLS (post-deploy: the release-lane rollup; external: the batch aggregate, #5078); sets FILED_N, FILED_NEW
   local n_items; n_items=$(wc -l < "$ITEMS_F" | tr -d ' ')
+  local m title what lbls
   FILED_N=""; FILED_NEW=0
   resolve_root
   CANON=$(cut -f1 "$TMP/canon.$CLS")
@@ -247,31 +296,53 @@ file_rollup() { # items in $ITEMS_F; sets FILED_N, FILED_NEW
     rollup_append "$CANON" || { echo "DEFERRED_FILE=FAILED"; exit 4; }
     FILED_N="$CANON"; return 0
   fi
+  m=$(agg_marker "$CLS")
+  if [ "$CLS" = "post-deploy" ]; then
+    title="post-deploy: release checklist (${RELEASE_LANE})"; what="post-deploy rollup ${RELEASE_LANE}"; lbls="followup:post-deploy"
+  else
+    title="external: prerequisites of batch ${BATCH}"; what="external aggregate of batch ${BATCH}"; lbls="followup:external external-prerequisite needs-human"
+  fi
   : > "$TMP/body"; rollup_missing "$ITEMS_F" "$TMP/body"
   {
-    printf '## Problem\n\nPost-deploy checklist of release lane `%s`%s. Every merged lane appends its post-deploy items under a `### #<parent>` heading (deduplicated), so one read-only verification works through this one issue per release.\n\n' "$RELEASE_LANE" "${FORGE_RELEASE_SHA:+ (deploy target at $FORGE_RELEASE_SHA)}"
+    if [ "$CLS" = "post-deploy" ]; then
+      printf '## Problem\n\nPost-deploy checklist of release lane `%s`%s. Every merged lane appends its post-deploy items under a `### #<parent>` heading (deduplicated), so one read-only verification works through this one issue per release.\n\n' "$RELEASE_LANE" "${FORGE_RELEASE_SHA:+ (deploy target at $FORGE_RELEASE_SHA)}"
+    else
+      printf '## Problem\n\nExternal prerequisites of batch `%s`: every item below waits on something outside the repo (credentials, spend, an account, a third party or a customer). Every lane of the batch appends its items under a `### #<parent>` heading (deduplicated), so the batch has ONE external issue.' "$BATCH"
+      [ -n "${FORGE_EXTERNAL_PREREQ:-}" ] && printf ' Linked prerequisite: #%s.' "${FORGE_EXTERNAL_PREREQ#\#}"
+      printf '\n\n'
+    fi
     printf '## Acceptance Criteria\n\n### #%s\n<!-- FORGE:DEFERRED_FROM: #%s -->\n\n' "$ROOT" "$ROOT"
     cat "$TMP/add"
-    printf '\n%s\n<!-- FORGE:DEFERRED_CLASS: post-deploy -->\n' "$ROLLUP_MARKER"
+    printf '\n%s\n<!-- FORGE:DEFERRED_CLASS: %s -->\n' "$m" "$CLS"
   } > "$TMP/newissue"
   local NUM
   if [ -n "${DRY_RUN:-}" ]; then
-    echo "DRY_RUN: gh issue create (post-deploy rollup ${RELEASE_LANE}: ${n_items} item(s) from #${PARENT})" >&2
+    echo "DRY_RUN: gh issue create (${what}: ${n_items} item(s) from #${PARENT})" >&2
     NUM=0
   else
     resolve_milestone
-    local args=() URL
-    gh label create "followup:post-deploy" -R "$REPO" --force --color BFD4F2 --description "Deferred post-deploy checks. Managed by ForgeDock." >/dev/null 2>&1 || true
-    args=(--label "followup:post-deploy")
+    local args=() URL l
+    for l in $lbls; do
+      case "$l" in
+        needs-human) gh label create "$l" -R "$REPO" --color D93F0B --description "Needs a human decision or action." >/dev/null 2>&1 || true ;; # never --force: the repo's own label wins
+        external-prerequisite) gh label create "$l" -R "$REPO" --force --color E99695 --description "External prerequisite. Managed by ForgeDock." >/dev/null 2>&1 || true ;;
+        *) gh label create "$l" -R "$REPO" --force --color BFD4F2 --description "Deferred follow-up (${CLS}). Managed by ForgeDock." >/dev/null 2>&1 || true ;;
+      esac
+      args+=(--label "$l")
+    done
     [ -n "$MS_TITLE" ] && args+=(--milestone "$MS_TITLE")
-    URL=$(gh issue create -R "$REPO" --title "post-deploy: release checklist (${RELEASE_LANE})" --body-file "$TMP/newissue" "${args[@]}" 2>/dev/null) || URL=""
+    URL=$(gh issue create -R "$REPO" --title "$title" --body-file "$TMP/newissue" "${args[@]}" 2>/dev/null) || URL=""
     NUM=$(printf '%s' "$URL" | grep -oE '[0-9]+$' | tail -n 1)
     [ -n "$NUM" ] || { echo "DEFERRED_FILE=FAILED"; exit 4; }
-    # Post-create re-check: a concurrent lane may have filed first. The lowest open rollup is canonical; the newer one is closed.
-    if find_rollup; then
+    if [ "$CLS" = "external" ]; then # the parent's claim marker, as for a per-parent follow-up (best effort)
+      gh issue comment "$PARENT" -R "$REPO" --body "<!-- FORGE:DEFERRED_ISSUE: #${NUM} class=external -->" >/dev/null 2>&1 \
+        || echo "file-deferred-followups: warning: could not post claim marker for #${NUM} on #${PARENT}" >&2
+    fi
+    # Post-create re-check: a concurrent lane may have filed first. The lowest open one is canonical; the newer one is closed.
+    if find_aggregate "$CLS"; then
       if [ -n "$CANON" ] && [ "$CANON" -lt "$NUM" ]; then
         if rollup_append "$CANON"; then
-          gh issue close "$NUM" -R "$REPO" --reason "not planned" --comment "Duplicate of #${CANON}: the post-deploy items of lane ${RELEASE_LANE} are tracked there." >/dev/null 2>&1 \
+          gh issue close "$NUM" -R "$REPO" --reason "not planned" --comment "Duplicate of #${CANON}: the ${what} items are tracked there." >/dev/null 2>&1 \
             || echo "file-deferred-followups: warning: could not close duplicate #${NUM}" >&2
           NUM="$CANON"
         else
@@ -286,19 +357,34 @@ file_rollup() { # items in $ITEMS_F; sets FILED_N, FILED_NEW
 }
 
 CLS_LIST=$(cut -d "$SEP" -f5 "$TMP/items" | sort -u)
-CLS=""
+CLS=""; CKIND=""
+# #5078: post-deploy -> the release-lane rollup; external -> the batch aggregate, else (older runs) the parent's own external
+# follow-up; every other class -> the parent's follow-up of that class. Sets CANON/CSTATE/CKIND (agg|legacy|class).
+lookup_class() {
+  CKIND="agg"
+  case "$CLS" in
+    post-deploy) find_aggregate post-deploy ;;
+    external)
+      find_aggregate external || return 1
+      [ -n "$CANON" ] && return 0
+      find_canonical || return 1
+      [ -n "$CANON" ] && CKIND="legacy"
+      return 0 ;;
+    *) CKIND="class"; find_canonical ;;
+  esac
+}
 # Phase 1: look up the canonical follow-up of every class before filing anything (a failed lookup files nothing).
 for CLS in $CLS_LIST; do
   LOOKUP_OK=""
   for attempt in 1 2; do
-    if { [ "$CLS" = "post-deploy" ] && find_rollup; } || { [ "$CLS" != "post-deploy" ] && find_canonical; }; then LOOKUP_OK=1; break; fi
+    if lookup_class; then LOOKUP_OK=1; break; fi
     [ "$attempt" = 1 ] && sleep "${FORGE_DEFERRED_RETRY_SLEEP:-2}"
   done
   if [ -z "$LOOKUP_OK" ]; then
     echo "DEFERRED_LOOKUP=FAILED"
     exit 3
   fi
-  printf '%s\t%s\n' "$CANON" "$CSTATE" > "$TMP/canon.$CLS"
+  printf '%s\t%s\t%s\n' "$CANON" "$CSTATE" "$CKIND" > "$TMP/canon.$CLS"
   awk -F"$SEP" -v c="$CLS" '$5 == c' "$TMP/items" > "$TMP/items.$CLS"
 done
 
@@ -366,6 +452,10 @@ file_class() {
   CANON=$(cut -f1 "$TMP/canon.$CLS"); CSTATE=$(cut -f2 "$TMP/canon.$CLS")
   if [ -n "$CANON" ]; then
     append_items "$CANON" "$CSTATE" || { echo "DEFERRED_FILE=FAILED"; exit 4; }
+    if [ "$CLS" = "engineering" ] && [ -n "$HOST_JOIN" ]; then
+      if [ -n "${DRY_RUN:-}" ]; then echo "DRY_RUN: gh issue edit $CANON (add label host-task)" >&2
+      else gh issue edit "$CANON" -R "$REPO" --add-label host-task >/dev/null 2>&1 || echo "file-deferred-followups: warning: could not label #${CANON} host-task" >&2; fi
+    fi
     FILED_N="$CANON"; return 0
   fi
   local claim="<!-- FORGE:DEFERRED_ISSUE: #%s -->" title="follow-up: ${n_items} deferred item(s) (deferred from #${PARENT})"
@@ -400,6 +490,10 @@ file_class() {
       gh label create external-prerequisite -R "$REPO" --force --color E99695 --description "External prerequisite. Managed by ForgeDock." >/dev/null 2>&1 || true
       args+=(--label external-prerequisite)
     fi
+    if [ "$CLS" = "host" ] || { [ "$CLS" = "engineering" ] && [ -n "$HOST_JOIN" ]; }; then # #5078: never needs-human
+      gh label create host-task -R "$REPO" --color 0E8A16 --description "Work the host can run (read-only production access)." >/dev/null 2>&1 || true
+      args+=(--label host-task)
+    fi
     [ -n "$MS_TITLE" ] && args+=(--milestone "$MS_TITLE")
     URL=$(gh issue create -R "$REPO" --title "$title" --body-file "$TMP/newissue" "${args[@]}" 2>/dev/null) || URL=""
     NUM=$(printf '%s' "$URL" | grep -oE '[0-9]+$' | tail -n 1)
@@ -434,7 +528,10 @@ file_class() {
 INTO=""; FILED=0
 for CLS in $CLS_LIST; do
   ITEMS_F="$TMP/items.$CLS"
-  if [ "$CLS" = "post-deploy" ]; then file_rollup; else file_class; fi
+  case "$CLS:$(cut -f3 "$TMP/canon.$CLS")" in
+    post-deploy:*|external:agg) file_rollup ;;
+    *) file_class ;;
+  esac
   case " $INTO " in *" $FILED_N "*) ;; *) INTO="${INTO:+$INTO }$FILED_N" ;; esac
   FILED=$((FILED + FILED_NEW))
   while IFS="$SEP" read -r p w k fp cl; do printf '%s\t%s\n' "$p" "$FILED_N"; done < "$ITEMS_F"

package/scripts/file-deferred-followups.test.sh

@@ -338,5 +338,54 @@ printf -- '-\tdefer: later\t\t\tR2: wire `pd.py` in\n' > "$T/fu.tsv"
 OUT=$(bash "$S" --parent 20 --repo o/r --items "$T/fu.tsv"); RC=$?
 check "follow-up parent: new follow-up issue, parent body unchanged" "[ $RC -eq 0 ] && [ \$(grep -c '^issue create' '$GH_LOG') -eq 1 ] && ! grep -q '^issue edit 20' '$GH_LOG' && [ ! -e '$ISSUE_BODY.edited' ] && grep -q '^\*\*Parent\*\*: #20\$' '$T/created.901.body' && grep -q 'FORGE:DEFERRED_FROM: #20' '$T/created.901.body' && printf '%s\n' \"\$OUT\" | grep -q '^R2: wire pd.py in.901\$'"
 
+# 24. #5078: routing by kind
+# post-promotion owner deferral appends to the open rollup, creates no issue
+reset
+printf '{"number":902,"state":"open","author_association":"OWNER","user":{"type":"User"},"body":"<!-- FORGE:POSTDEPLOY_ROLLUP: default -->"}\n' > "$T/issue.902.json"
+echo '{"items":[{"number":902}]}' > "$SEARCH_JSON"; printf '<!-- FORGE:POSTDEPLOY_ROLLUP: default -->\n' > "$ISSUE_BODY"
+printf -- '-\towner: orchestrator. [bucket:owner] post-deploy action with no registered check\t\t\tR1: verify the banner in prod\n-\towner: promote:new-nav. [bucket:owner] flip the flag\t\t\tR2: promote the new nav\n-\towner: ops. [bucket:owner] purge the CDN after release\t\t\tR3: purge the cdn\n' > "$T/pp.tsv"
+OUT=$(bash "$S" --parent 10 --repo o/r --items "$T/pp.tsv"); RC=$?
+check "routing: post-promotion owner items append to the rollup, no issue create" "[ $RC -eq 0 ] && ! grep -q '^issue create' '$GH_LOG' && grep -q '^issue edit 902' '$GH_LOG' && [ \$(grep -c '^- \[ \] ' '$ISSUE_BODY.edited') -eq 3 ] && printf '%s' \"\$OUT\" | grep -q 'classes=post-deploy '"
+# a configured-label rollup (forge.yaml followups.rollup_issue_label) is used when no marked rollup is open
+reset
+printf '{"number":950,"state":"open","author_association":"OWNER","user":{"type":"User"},"labels":[{"name":"post-deploy"}],"body":"release checklist"}\n' > "$T/issue.950.json"
+echo '{"items":[{"number":950}]}' > "$SEARCH_JSON"; printf 'release checklist\n' > "$ISSUE_BODY"
+printf -- '-\tpost-deploy: [bucket:post-deploy] [check:smoke] check it\t\t\tR4: smoke the login\n' > "$T/lab.tsv"
+OUT=$(FORGE_ROLLUP_LABEL=post-deploy bash "$S" --parent 10 --repo o/r --items "$T/lab.tsv"); RC=$?
+check "routing: labelled rollup #950 appended, no issue create" "[ $RC -eq 0 ] && ! grep -q '^issue create' '$GH_LOG' && grep -q '^issue edit 950' '$GH_LOG' && grep -q 'smoke the login' '$ISSUE_BODY.edited' && printf '%s\n' \"\$OUT\" | grep -q '^R4: smoke the login.950\$'"
+reset
+OUT=$(bash "$S" --parent 10 --repo o/r --items "$T/lab.tsv"); RC=$?
+check "routing: without the label setting an unmarked labelled issue is not the rollup" "[ $RC -eq 0 ] && [ \$(grep -c '^issue create' '$GH_LOG') -eq 1 ]"
+# read-only production data -> host follow-up, host-task, never needs-human / external-prerequisite
+reset
+printf -- '-\towner: obs-psql. [bucket:owner] capture the read-only production query counts\t\t\tR5: capture prod counts\n' > "$T/host.tsv"
+OUT=$(bash "$S" --parent 10 --repo o/r --items "$T/host.tsv"); RC=$?
+check "routing: read-only prod owner item -> one host follow-up labelled host-task" "[ $RC -eq 0 ] && [ \$(grep -c '^issue create' '$GH_LOG') -eq 1 ] && grep '^issue create' '$GH_LOG' | grep -q -- '--label followup:host' && grep '^issue create' '$GH_LOG' | grep -q -- '--label host-task' && grep -q 'FORGE:DEFERRED_CLASS: host' '$T/created.901.body'"
+check "routing: host follow-up carries no needs-human or external-prerequisite" "! grep '^issue create' '$GH_LOG' | grep -qE 'needs-human|external-prerequisite'"
+reset
+printf -- '-\t[bucket:host] host: run the obs-psql report\t\t\tR6: report rows\n-\tdefer: [bucket:new-issue] wire it\t\t\tR7: wire the report\n' > "$T/join.tsv"
+OUT=$(bash "$S" --parent 10 --repo o/r --items "$T/join.tsv"); RC=$?
+check "routing: host items join the engineering follow-up of the same run" "[ $RC -eq 0 ] && [ \$(grep -c '^issue create' '$GH_LOG') -eq 1 ] && grep -q 'report rows' '$T/created.901.body' && grep -q 'wire the report' '$T/created.901.body' && grep '^issue create' '$GH_LOG' | grep -q -- '--label followup:engineering' && grep '^issue create' '$GH_LOG' | grep -q -- '--label host-task' && ! grep '^issue create' '$GH_LOG' | grep -q needs-human"
+# N external deferrals in one batch -> ONE aggregated issue carrying needs-human
+reset
+export FORGE_BATCH_ID=b42
+printf -- '-\towner: stripe. [bucket:owner] needs live Stripe credentials\t\t\tR8: charge a real card\n' > "$T/e1.tsv"
+OUT=$(bash "$S" --parent 10 --repo o/r --items "$T/e1.tsv"); RC=$?
+check "external batch: first parent creates the aggregate with needs-human" "[ $RC -eq 0 ] && [ \$(grep -c '^issue create' '$GH_LOG') -eq 1 ] && grep -q 'FORGE:EXTERNAL_BATCH: b42' '$T/created.901.body' && grep -q '^### #10\$' '$T/created.901.body' && grep '^issue create' '$GH_LOG' | grep -q -- '--label needs-human' && grep '^issue create' '$GH_LOG' | grep -q -- '--label external-prerequisite'"
+printf '{"number":901,"state":"open","author_association":"OWNER","user":{"type":"User"},"body":"<!-- FORGE:EXTERNAL_BATCH: b42 -->"}\n' > "$T/issue.901.json"
+echo '{"items":[{"number":901}]}' > "$SEARCH_JSON"; cp "$T/created.901.body" "$ISSUE_BODY"
+printf -- '-\texternal: [bucket:owner] buy the domain (spend)\t\t\tR1: register the domain\n' > "$T/e2.tsv"
+OUT2=$(bash "$S" --parent 11 --repo o/r --items "$T/e2.tsv"); cp "$ISSUE_BODY.edited" "$ISSUE_BODY"
+printf -- '-\texternal: customer sign-off\t\t\tR2: customer signs the DPA\n-\texternal: dup\t\t\tR9: Charge a real card!\n' > "$T/e3.tsv"
+OUT3=$(bash "$S" --parent 12 --repo o/r --items "$T/e3.tsv"); RC=$?
+check "external batch: three parents, exactly one issue create, later lanes append to it" "[ $RC -eq 0 ] && [ \$(grep -c '^issue create' '$GH_LOG') -eq 1 ] && [ \$(grep -c '^issue edit 901' '$GH_LOG') -eq 2 ] && printf '%s\n' \"\$OUT3\" | grep -q '^R2: customer signs the DPA.901\$'"
+check "external batch: per-parent headings, duplicate text stored once" "grep -q '^### #11\$' '$ISSUE_BODY.edited' && grep -q '^### #12\$' '$ISSUE_BODY.edited' && [ \$(grep -ci 'charge a real card' '$ISSUE_BODY.edited') -eq 1 ]"
+unset FORGE_BATCH_ID
+# engineering deferrals from one parent land in one issue
+reset
+printf -- '-\tdefer: parser first\t\t\tR1: add the parser\n-\tdefer: needs the parser\t\t\tR2: use the parser\n' > "$T/eng.tsv"
+OUT=$(bash "$S" --parent 10 --repo o/r --items "$T/eng.tsv"); RC=$?
+check "engineering: dependent items of one parent in one issue" "[ $RC -eq 0 ] && [ \$(grep -c '^issue create' '$GH_LOG') -eq 1 ] && grep -q 'add the parser' '$T/created.901.body' && grep -q 'use the parser' '$T/created.901.body'"
+
 echo "passed=$PASS failed=$FAIL"
 [ "$FAIL" -eq 0 ]

package/scripts/issue-create.sh

@@ -144,6 +144,13 @@ if [ -n "$APPEND" ]; then
   BODY="${BODY}${APPEND}"
   echo "WARNING: body was missing mandatory sections; placeholders added before creation" >&2
 fi
+# #5085: a bug/fix issue should carry a ## Prior Attempts table (prior-attempts.mjs); warn only, never block
+IS_BUG=false
+for l in ${LABELS[@]+"${LABELS[@]}"}; do [ "$l" = bug ] && IS_BUG=true; done
+printf '%s' "$TITLE" | grep -qE '^(fix|bug)(\(|:|!)' && IS_BUG=true
+if [ "$IS_BUG" = true ] && ! printf '%s\n' "$BODY" | grep -q '^## Prior Attempts'; then
+  echo "WARNING: bug/fix issue has no ## Prior Attempts section (run prior-attempts.mjs)" >&2
+fi
 
 if [ "$DRY_RUN" = true ]; then
   LABEL_TEXT=""; for l in ${LABELS[@]+"${LABELS[@]}"}; do LABEL_TEXT="${LABEL_TEXT:+$LABEL_TEXT, }$l"; done

package/scripts/issue-create.test.sh

@@ -158,6 +158,19 @@ log_lacks "no milestone after failed read-back" "--milestone"
 MOCK_READBACK=missing-sections run "post-create repair is not fatal" 0 --repo o/r --title "fix: a" --body-file "$GOOD"
 log_has "missing section appended after create" "|issue|edit|901|-R|o/r|--body|"
 
+# --- #5085: bug/fix issues without ## Prior Attempts warn, never block ---------------
+WARN="no ## Prior Attempts section"
+run "fix title without prior attempts still creates" 0 --repo o/r --title "fix(api): a" --body-file "$GOOD"
+grep -qF "$WARN" "$TMP/err" && ok || bad "fix title warns about missing ## Prior Attempts"
+out_has "warning keeps the CREATED line" "ISSUE_CREATE_RESULT:CREATED"
+run "bug label warns" 0 --repo o/r --title "chore: a" --body-file "$GOOD" --label bug
+grep -qF "$WARN" "$TMP/err" && ok || bad "bug label warns about missing ## Prior Attempts"
+PA="$TMP/pa.md"; { printf '## Prior Attempts\n\nNone found (terms: a).\n\n'; cat "$GOOD"; } > "$PA"
+run "fix with prior attempts" 0 --repo o/r --title "fix: a" --body-file "$PA"
+grep -qF "$WARN" "$TMP/err" && bad "warned although ## Prior Attempts is present" || ok
+run "feat never warns" 0 --repo o/r --title "feat: a" --body-file "$GOOD"
+grep -qF "$WARN" "$TMP/err" && bad "feat issue warned about ## Prior Attempts" || ok
+
 # --- dedup helper comes from the script's own directory, never the cwd ---------------
 printf '#!/usr/bin/env bash\necho "DUPLICATE: #666 planted"; exit 1\n' > "$TMP/work/scripts/issue-dedup.sh"
 run "planted cwd dedup helper ignored" 0 --repo o/r --title "fix: a" --body-file "$GOOD"

package/scripts/issue-dedup.sh

@@ -43,8 +43,8 @@
 #   3. Remove any --exclude'd issue numbers from the candidate set.
 #   4. For each remaining candidate open issue, count shared tokens (length ≥ 4)
 #      between the proposed title and the candidate title.
-#   5. MATCH threshold: ≥ 3 shared tokens OR shared token count ≥ 50% of
-#      the shorter title's token set — whichever fires first.
+#   5. MATCH threshold: ≥ 3 shared tokens OR (≥ 2 shared tokens AND ≥ 50% of
+#      the shorter title's token set). One shared word never matches (#5080).
 #   6. On match: print "DUPLICATE: #<N> <title>" to stdout, exit 1.
 #   7. On no match: exit 0 (silent).
 #
@@ -243,7 +243,8 @@ fi
 # --------------------------------------------------------------------------- #
 # Token overlap matching
 # For each candidate, count shared tokens between proposed and candidate titles.
-# Match if: shared_count >= 3  OR  shared_count >= 50% of the shorter token set.
+# Match if: shared_count >= 3  OR  (shared_count >= 2 AND >= 50% of the shorter token set).
+# A single shared word never matches (#5080: one generic noun is not a duplicate).
 # --------------------------------------------------------------------------- #
 MATCH_NUMBER=""
 MATCH_TITLE=""
@@ -279,7 +280,7 @@ while IFS=$'\t' read -r CAND_NUMBER CAND_TITLE; do
   # 50% threshold: shared >= ceil(shorter / 2)
   HALF_THRESHOLD=$(( (SHORTER + 1) / 2 ))
 
-  if [[ "$SHARED_COUNT" -ge 3 ]] || [[ "$SHARED_COUNT" -ge "$HALF_THRESHOLD" && "$SHORTER" -ge 2 ]]; then
+  if [[ "$SHARED_COUNT" -ge 3 ]] || [[ "$SHARED_COUNT" -ge 2 && "$SHARED_COUNT" -ge "$HALF_THRESHOLD" && "$SHORTER" -ge 2 ]]; then
     MATCH_NUMBER="$CAND_NUMBER"
     MATCH_TITLE="$CAND_TITLE"
     break

package/scripts/issue-dedup.test.sh

@@ -137,6 +137,21 @@ MOCK_GH_CANDIDATES="$MEMBERS_ONLY" assert_exit \
   "--exclude alongside pre-joined -R token -> exit 0" \
   0 "$PROPOSED_TITLE" "-R test/repo" --exclude "2422,2424"
 
+# --------------------------------------------------------------------------- #
+# Scenario F (#5080): one shared generic noun is not a duplicate; two shared tokens still are.
+# --------------------------------------------------------------------------- #
+ONE_NOUN="$TMP_FIXTURES/one_noun.tsv"
+printf '30575\tintegrate platform policy with browser actions and workflows\n' > "$ONE_NOUN"
+MOCK_GH_CANDIDATES="$ONE_NOUN" assert_exit \
+  "one shared noun (workflows) does not match an unrelated feature -> exit 0" \
+  0 "bug: workflows broken" -R test/repo
+
+TWO_SHARED="$TMP_FIXTURES/two_shared.tsv"
+printf '31000\tworkflows page returns 401\n' > "$TWO_SHARED"
+MOCK_GH_CANDIDATES="$TWO_SHARED" assert_exit \
+  "two shared tokens on a short title still match -> exit 1" \
+  1 "bug: workflows page returns 401 unauthorized" -R test/repo
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"
 [[ "$FAIL" -eq 0 ]]

package/scripts/owner-route-parity.test.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Release review #5103 (QA-3, BUG-2): scripts/file-deferred-followups.sh owner_route must agree with
+# bin/lean/conformance.mjs ownerRoute on every case, including the over-broad matches the review found.
+set -u
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+eval "$(sed -n '/^POSTPROM_ERE=/,/^}/p' "$ROOT/scripts/file-deferred-followups.sh")"
+PASS=0; FAIL=0
+while IFS='|' read -r want why; do
+  [ -z "$why" ] && continue
+  sh=$(owner_route "$why")
+  js=$(node -e 'import(process.argv[1]).then(m=>console.log(m.ownerRoute({bucket:"owner:x", why: process.argv[2]})))' "$ROOT/bin/lean/conformance.mjs" "$why")
+  if [ "$sh" = "$want" ] && [ "$js" = "$want" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: '$why' want=$want sh=$sh js=$js"; fi
+done <<'CASES'
+host|read-only production telemetry from ovh
+host|ssh ovh-monitor to capture the queue depth
+host|obs-psql count of the jobs table
+host|run a production query against the replica
+host|capture production logs for the failing run
+host|prod query of the job table
+external|Should we delete production data older than 90 days?
+external|add uptime-monitor dashboard
+external|needs the production database password to query prod data
+external|needs the prod ssh key to read production logs
+external|product manager decides the pricing page
+external|production dataset retention policy
+external|provide the Stripe API key, needed before rollout
+post-deploy|verify the dashboard after release
+CASES
+echo "passed=$PASS failed=$FAIL"
+[ "$FAIL" -eq 0 ]