forgedock 1.46.0 → 1.48.0

package/bin/lean/issuewatch.test.mjs

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import { mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { join } from "node:path";
-import { unclaimedOrOwn, parseWatches, validateWatch, loadWatches, matchesSelectors, issueVersion, hasUnresolvedDefer, classifyIssue, laneFor, dagOrder, claimIssue, acquireLock, tick, runWatch, formatStatus, repoDir, watchDir, issueWatchFromCli } from "./issuewatch.mjs";
+import { unclaimedOrOwn, parseWatches, validateWatch, loadWatches, matchesSelectors, issueVersion, hasUnresolvedDefer, classifyIssue, laneFor, dagOrder, claimIssue, acquireLock, tick, runWatch, formatStatus, repoDir, watchDir, issueWatchFromCli, isOwnApp, selectorMiss, planClaims, ghFailureEffect, ghRunner } from "./issuewatch.mjs";
 import { openBatch } from "./batch.mjs";
 
 const tmp = () => tmpDir("iw-");
@@ -419,3 +419,125 @@ test("#4793 formatStatus lists decided / evidence-gathered / folded / external-k
     decisions: { rows: [{ action: "decided" }, { action: "evidence-needed" }, { action: "post-deploy-only" }, { action: "external", kept: true }, { action: "external", kept: true }] } };
   assert.match(formatStatus(s, w, 0), /needs-human decisions: decided 1  evidence-gathered 1  folded 1  external-kept 2/);
 });
+
+// ── #5088: opt-in trust for the repo's own ForgeDock App, claim dry-run, named 401/403 ──────────────────────────────
+const appIss = (n, login = "rapiercraft-forgedock[bot]", o = {}) => iss(n, { title: `fix: app ${n}`, authorAssociation: "NONE", author: { login }, ...o });
+
+test("#5088 trust_app / trust_app_labels are validated watch keys, default off", () => {
+  assert.equal(W().trust_app, false);
+  assert.deepEqual(W().trust_app_labels, []);
+  assert.equal(W({ trust_app: "true" }).trust_app, true);
+  assert.equal(W({ trust_app: "false" }).trust_app, false);
+  assert.deepEqual(W({ trust_app: true, trust_app_labels: ["operator"] }).trust_app_labels, ["operator"]);
+  assert.throws(() => W({ trust_app: "yes" }), /trust_app must be true or false/);
+  assert.throws(() => W({ trust_app_labels: ["operator"] }), /trust_app_labels needs trust_app: true/);
+  assert.deepEqual(parseWatches("issue_watch:\n  watches:\n    a:\n      trust_app: true\n      trust_app_labels: [operator, intake]\n").a, { trust_app: "true", trust_app_labels: ["operator", "intake"] });
+});
+
+test("#5088 trust_app claims the repo's own App issues only; other bots and NONE humans stay out", () => {
+  const on = W({ trust_app: true });
+  // Release review #5123 (AUTH-1): the bare slug counts only with a bot signal; a human who registers the slug is never the App.
+  assert.ok(isOwnApp(appIss(1, "rapiercraft-forgedock", { author: { login: "rapiercraft-forgedock", is_bot: true } })));
+  assert.ok(!isOwnApp(appIss(1, "rapiercraft-forgedock", { author: { login: "rapiercraft-forgedock", is_bot: false } })), "human with the slug as login");
+  assert.equal(classifyIssue(appIss(1, "rapiercraft-forgedock", { author: { login: "rapiercraft-forgedock", is_bot: false } }), on), null, "human slug never claimed");
+  for (const l of ["rapiercraft-forgedock[bot]", "app/rapiercraft-forgedock"]) {
+    assert.ok(isOwnApp(appIss(1, l)), l);
+    assert.equal(classifyIssue(appIss(1, l), on), "claim", l);
+  }
+  for (const l of ["forge[bot]", "dependabot[bot]", "rapiercraft-forgedock-evil"]) assert.equal(classifyIssue(appIss(2, l), on), null, l);
+  assert.ok(!isOwnApp(appIss(2, "rapiercraft-forgedock-evil")));
+  assert.equal(classifyIssue(iss(3, { authorAssociation: "NONE", author: { login: "mallory" } }), on), null);
+  assert.equal(classifyIssue(iss(4), on), "claim"); // trusted humans unchanged
+  const narrow = W({ trust_app: true, trust_app_labels: ["operator"] });
+  assert.equal(classifyIssue(appIss(5), narrow), null);
+  assert.equal(classifyIssue(appIss(5, undefined, { labels: lbl("operator") }), narrow), "claim");
+  // App follow-ups stay governed by include_followups (post-deploy-only folds, never claims)
+  const defer = "- [ ] `R1: x` — defer: separate work\n", pd = "- [ ] `R2: y` — post-deploy: check later\n";
+  const fu = (body) => appIss(6, undefined, { title: "follow-up: 1 deferred item(s)", body });
+  const onFu = W({ trust_app: true, include_followups: "defer-only", postdeploy_rollup: "50" });
+  assert.equal(classifyIssue(fu(defer), onFu), "claim");
+  assert.equal(classifyIssue(fu(pd), onFu), "fold");
+  assert.equal(classifyIssue(fu("no items"), onFu), null);
+  assert.equal(classifyIssue(fu(pd), W({ trust_app: true })), null);
+});
+
+test("#5088 regression: without trust_app an App-authored issue is not claimed", async () => {
+  for (const l of ["rapiercraft-forgedock[bot]", "app/rapiercraft-forgedock", "rapiercraft-forgedock"]) assert.equal(classifyIssue(appIss(1, l), W()), null, l);
+  const io = fakeIo(tmp(), [appIss(1), iss(2)]);
+  const s = await tick({ watch: W(), repo: "o/r", io, state: { phase: "running", claimed: [], inflight: [], merged: [], verified: [], failed: [], folded: [], retries: {}, lanes: {}, batch: null } });
+  assert.deepEqual(s.claimed, [2]);
+});
+
+test("#5088 tick with trust_app claims and launches the App issue, not a NONE human or another bot", async () => {
+  const io = fakeIo(tmp(), [appIss(1), appIss(2, "forge[bot]"), iss(3, { authorAssociation: "NONE", author: { login: "mallory" } }), iss(4)]);
+  const s = await tick({ watch: W({ trust_app: true }), repo: "o/r", io, state: { phase: "running", claimed: [], inflight: [], merged: [], verified: [], failed: [], folded: [], retries: {}, lanes: {}, batch: null } });
+  assert.deepEqual(s.claimed, [1, 4]);
+  assert.deepEqual(io.launched.map(([n]) => n), [1, 4]);
+});
+
+test("#5088 selectorMiss names the failing selector", () => {
+  assert.equal(selectorMiss(iss(1, { labels: lbl("epic") }), W({ exclude_labels: ["epic"] })), "excluded label epic");
+  assert.equal(selectorMiss(iss(1), W({ labels: ["ready"] })), "missing label ready");
+  assert.equal(selectorMiss(iss(1), W()), null);
+});
+
+for (const mode of ["per-issue", "batch"]) {
+  test(`#5088 --dry-run (${mode}) lists would-claim and skipped issues with reasons and writes nothing`, async () => {
+    const dir = tmp(), cwd = tmp();
+    writeFileSync(join(cwd, "forge.yaml"), `branches:\n  default: main\nissue_watch:\n  watches:\n    intake:\n      mode: ${mode}\n      trust_app: true\n      exclude_labels: [epic]\n`);
+    const io = fakeIo(dir, [appIss(1), iss(2, { labels: lbl("epic") }), iss(3, { authorAssociation: "NONE", author: { login: "mallory" } }), iss(4), appIss(5, "dependabot[bot]")]);
+    io.gh = ((orig) => async (a) => (a[0] === "repo" ? (a.includes("nameWithOwner") ? JSON.stringify({ nameWithOwner: "o/r" }) : "main") : orig(a)))(io.gh);
+    const rdir = repoDir("o/r", io.env);
+    mkdirSync(rdir, { recursive: true });
+    writeFileSync(join(rdir, "claims.json"), JSON.stringify({ 4: "other" }) + "\n");
+    const out = [];
+    const r = await issueWatchFromCli(["run", "--name", "intake", "--dry-run"], { cwd, env: io.env, io, print: (l) => out.push(l) });
+    const t = out.join("\n");
+    assert.match(t, /would claim #1 -> staging: ForgeDock App author \(trust_app\)/);
+    assert.match(t, /skip #2: excluded label epic/);
+    assert.match(t, /skip #3: untrusted author mallory \(NONE\)/);
+    assert.match(t, /skip #4: already claimed by watch other/);
+    assert.match(t, /skip #5: bot author dependabot\[bot\]/);
+    assert.deepEqual(r.dryRun.claim, [{ number: 1, lane: "staging", reason: "ForgeDock App author (trust_app)" }]);
+    assert.ok(Array.isArray(r.dryRun.rows));
+    assert.deepEqual(JSON.parse(readFileSync(join(rdir, "claims.json"), "utf8")), { 4: "other" });
+    assert.ok(!existsSync(join(watchDir("o/r", "intake", io.env), "status.json")));
+    assert.deepEqual(io.launched, []);
+    assert.deepEqual(io.batchOps, []);
+  });
+}
+
+test("#5088 planClaims: own registry claim stays claimable, room caps the rest as over capacity", async () => {
+  const io = fakeIo(tmp(), [iss(1), iss(2), iss(3)]);
+  const rdir = repoDir("o/r", io.env);
+  mkdirSync(rdir, { recursive: true });
+  writeFileSync(join(rdir, "claims.json"), JSON.stringify({ 1: "w" }) + "\n");
+  const p = await planClaims({ watch: W(), repo: "o/r", io, state: { claimed: [3], inflight: [] }, room: 1 });
+  assert.deepEqual(p.claim.map((c) => c.number), [1]);
+  assert.deepEqual(p.skip, [{ number: 3, reason: "already claimed by this watch" }, { number: 2, reason: "over capacity (room 1)" }]);
+});
+
+test("#5088 ghRunner names the failing call; 401/403 also warn with the effect on the pass", () => {
+  const assocArgs = ["api", "repos/o/r/issues?state=open&per_page=100", "--paginate", "--jq", ".[]"];
+  assert.match(ghFailureEffect(assocArgs), /every author untrusted/);
+  assert.match(ghFailureEffect(["api", "user", "--jq", ".login"]), /^no effect/);
+  assert.match(ghFailureEffect(["api", "app", "--jq", ".slug"]), /^no effect/);
+  assert.match(ghFailureEffect(["api", "repos/o/r/branches/staging/protection/required_status_checks"]), /required checks unknown/);
+  assert.match(ghFailureEffect(["issue", "list", "-R", "o/r"]), /raised to its caller/);
+  const warned = [];
+  const fail = (stderr) => () => { throw Object.assign(new Error("Command failed"), { status: 1, stderr }); };
+  const gh403 = ghRunner(fail("gh: Resource not accessible by integration (HTTP 403)\n"), (l) => warned.push(l));
+  assert.throws(() => gh403(assocArgs), (e) => /gh api repos\/o\/r\/issues\?state=open&per_page=100 --paginate failed: gh: Resource not accessible by integration \(HTTP 403\)/.test(e.message) && e.status === 1);
+  assert.equal(warned.length, 1);
+  assert.match(warned[0], /gh api repos\/o\/r\/issues\?state=open.* -> HTTP 403: .*effect: pass degraded: .*every author untrusted/);
+  const gh401 = ghRunner(fail("gh: A JSON web token could not be decoded (HTTP 401)"), (l) => warned.push(l));
+  assert.throws(() => gh401(["api", "app", "--jq", ".slug"]), /gh api app --jq failed/);
+  assert.match(warned[1], /gh api app --jq -> HTTP 401: .*effect: no effect/);
+  const gh500 = ghRunner(fail("gh: Server Error (HTTP 500)"), (l) => warned.push(l));
+  assert.throws(() => gh500(["issue", "list"]), /gh issue list failed: gh: Server Error/);
+  assert.equal(warned.length, 2);
+  let seen;
+  assert.equal(ghRunner((cmd, args, opts) => { seen = { cmd, args, opts }; return "out"; })(["repo", "view"]), "out");
+  assert.equal(seen.cmd, "gh");
+  assert.deepEqual(seen.opts.stdio, ["ignore", "pipe", "pipe"]);
+});

package/bin/lean/lane.mjs

@@ -21,6 +21,19 @@ export function milestoneSlug(title) {
   return String(title ?? "").toLowerCase().replace(/ /g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 
+/**
+ * Every milestone of `repo` in `state` (all|open|closed), across every page (#5084: one page of 100 hid newer milestones).
+ * One `gh api --paginate` call, one object per line; a whole-JSON reply (a single array) is accepted too. gh errors propagate.
+ */
+export async function listMilestones({ gh, repo, state = "all" }) {
+  const text = String(await gh(["api", `repos/${repo}/milestones?state=${state}&per_page=100`, "--paginate", "--jq", ".[] | @json"]) ?? "").trim();
+  if (!text) return [];
+  let whole;
+  try { whole = JSON.parse(text); } catch { whole = undefined; }
+  if (whole !== undefined) return Array.isArray(whole) ? whole : whole && typeof whole === "object" ? [whole] : [];
+  return text.split("\n").map((l) => l.trim()).filter(Boolean).flatMap((l) => JSON.parse(l));
+}
+
 /** forge.yaml `branches` from the checkout: {default, staging, featurePattern}; missing keys are null. */
 export function readBranches(cwd = process.cwd()) {
   let b = {};

package/bin/lean/lane.test.mjs

@@ -4,7 +4,7 @@ import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { writeFileSync } from "node:fs";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { milestoneSlug, readBranches, resolveLane, makeLaneCache } from "./lane.mjs";
+import { milestoneSlug, readBranches, resolveLane, makeLaneCache, listMilestones } from "./lane.mjs";
 
 /** Fake gh/git: the issue's milestone, GitHub's default branch, and the branches on origin. */
 function io({ milestone = null, ghDefault = "main", onOrigin = ["staging", "main"], ghFails = null, gitFails = false } = {}) {
@@ -133,3 +133,30 @@ describe("per-batch lane lookups (#4963)", () => {
     assert.equal((await resolveLane({ issue: 1, repo: "o/r", io: io(), cwd: "/r", cache, milestone: null })).ok, true);
   });
 });
+
+describe("(#5084) listMilestones", () => {
+  it("(#5084) listMilestones pages with --paginate, path at args[1], state in the query", async () => {
+    const calls = [];
+    const gh = async (a) => { calls.push(a); return '{"number":1,"title":"A"}\n{"number":2,"title":"B"}\n'; };
+    assert.deepEqual(await listMilestones({ gh, repo: "o/r", state: "open" }), [{ number: 1, title: "A" }, { number: 2, title: "B" }]);
+    assert.equal(calls[0][1], "repos/o/r/milestones?state=open&per_page=100");
+    assert.ok(calls[0].includes("--paginate"));
+    assert.equal(calls[0][calls[0].indexOf("--jq") + 1], ".[] | @json");
+    await listMilestones({ gh, repo: "o/r" });
+    assert.match(calls[1][1], /state=all/);
+  });
+  it("(#5084) listMilestones accepts a single array, a single object and empty output", async () => {
+    assert.deepEqual(await listMilestones({ gh: async () => '[{"number":3}]', repo: "o/r" }), [{ number: 3 }]);
+    assert.deepEqual(await listMilestones({ gh: async () => '{"number":4}\n', repo: "o/r" }), [{ number: 4 }]);
+    assert.deepEqual(await listMilestones({ gh: async () => "  \n", repo: "o/r" }), []);
+    assert.deepEqual(await listMilestones({ gh: async () => "", repo: "o/r" }), []);
+  });
+  it("(#5084) listMilestones keeps a description containing '][' intact", async () => {
+    const ms = [{ number: 1, title: "A", description: "see [a][b] and ] [" }, { number: 2, title: "B", description: "]\n[" }];
+    const out = ms.map((m) => JSON.stringify(m)).join("\n");
+    assert.deepEqual(await listMilestones({ gh: async () => out, repo: "o/r" }), ms);
+  });
+  it("(#5084) listMilestones propagates a gh error", async () => {
+    await assert.rejects(listMilestones({ gh: async () => { throw new Error("HTTP 502"); }, repo: "o/r" }), /HTTP 502/);
+  });
+});

package/bin/lean/lean.mjs

@@ -15,7 +15,7 @@ import { ciPollDelayMs, ENGINE_VERSION, DEFAULT_MAX_SESSION_LIMIT_PAUSES, DEFAUL
 import { openDependency, laneMergedPrs, dependencyOnLane, isTrustedComment, decomposedSubissues, isDecomposedRecord, reopenRevokedDecomposition } from "../engine/phases.mjs";
 import { createHash, randomBytes } from "node:crypto";
 import { otherLaneOwner } from "./lanelock.mjs";
-import { applyValidateRecipes, deferChecklessPostDeploy, reproEnvMiss, resolveForgedockPaths, describesUnrunnableCommand, removedPathsOf, TRACKED, normalizeKindModes, blockingFailures, unverifiedRequirements, mutationTargets, mutationFailures, runMutationCheck, MUTATION_SURVIVED, isBugIssue, scopeText, explainFailures, inIssue, validateContract, cliUsageError, normalizeRunnerCommand, applyAmendments, precheck, repoTracks, dropScopeValidates, tagOutOfBand, parseReview, decide, mergeReviewRows, evidencePathOnly, closePlan, followupItems, bucketTally, pendingTracking, unnamedEdges, structureNote, impliedDocDeliverables } from "./conformance.mjs";
+import { applyValidateRecipes, deferChecklessPostDeploy, reproEnvMiss, resolveForgedockPaths, describesUnrunnableCommand, removedPathsOf, TRACKED, normalizeKindModes, blockingFailures, unverifiedRequirements, mutationTargets, mutationFailures, runMutationCheck, MUTATION_SURVIVED, isBugIssue, scopeText, explainFailures, inIssue, validateContract, cliUsageError, normalizeRunnerCommand, applyAmendments, amendmentKindProblems, precheck, alreadyFixedOnBase, READONLY_PROD_RE, EXTERNAL_NEED_RE, repoTracks, dropScopeValidates, tagOutOfBand, parseReview, decide, mergeReviewRows, evidencePathOnly, closePlan, followupItems, bucketTally, pendingTracking, unnamedEdges, structureNote, impliedDocDeliverables } from "./conformance.mjs";
 import { checkAdmission, hostParallelism, ADMISSION_RETRY_SECONDS } from "./admission.mjs";
 import { namedPaths, isTrustedIssueComment } from "./prefilter.mjs";
 import { checksAt } from "./postdeploy-check.mjs";
@@ -38,9 +38,11 @@ import { hostCapabilityBlock, contractHostNeeds } from "./execution.mjs";
 const MISSING_TOOL_RE = /command not found|not found in PATH|no such file or directory.*\b(?:docker|promtool)\b|\b(?:docker|promtool)\b[^\n]{0,80}(?:not (?:installed|found|available)|no such file|cannot connect|daemon)|cannot connect to the docker daemon|no docker daemon|no module named|ModuleNotFoundError|\bENOENT\b[^\n]{0,60}spawn/i;
 /** #4685: true when a builder's block summary names a missing tool or module (environment), not a credential. */
 export function missingToolBlock(summary) { return MISSING_TOOL_RE.test(String(summary ?? "")); }
-import { CHECKS_CLI, FORGEDOCK_CLI, REVIEWER_SYSTEM, LEAN_DIR, RESULT_FILE, INVESTIGATION_FILE, IMPLEMENTATION_FILE, CONTRACT_FILE, builderPlanPrompt, builderImplementPrompt, contractCorrectionPrompt, conformanceResumePrompt, reviewerPrompt, investigationVerdict, decisionNote, reviewerRepairPrompt, REVIEW_DIFF_MAX_BYTES, blockCorrectionPrompt, HUMAN_BLOCK_REASONS, structurePrompt, hotspotPlanNote, hotspotBuildRule, reproPlanNote, unrunnableValidateNote, contextPackNote, docsPrompt, ciFailurePrompt, ciUnavailablePrompt, precheckFailurePrompt, contextRestartPrompt, turnBudgetWrapupPrompt, syncChecks, GROUPING_SYSTEM, enumeratingPlanNote, enumeratingBuildRule, invariantsPlanNote, invariantsBuildRule, missingEntriesPrompt, sequencePrompt, sequenceSyncNote, sequenceSyncPrompt, fixSessionPrompt, postMergeFailurePrompt, duplicateExportsPrompt, migrationGeneratorPrompt, i18nCopiesPrompt } from "./prompts.mjs";
+import { CHECKS_CLI, FORGEDOCK_CLI, REVIEWER_SYSTEM, LEAN_DIR, RESULT_FILE, INVESTIGATION_FILE, IMPLEMENTATION_FILE, CONTRACT_FILE, builderPlanPrompt, builderImplementPrompt, contractCorrectionPrompt, conformanceResumePrompt, amendmentCorrectionPrompt, reviewerPrompt, investigationVerdict, decisionNote, reviewerRepairPrompt, REVIEW_DIFF_MAX_BYTES, blockCorrectionPrompt, HUMAN_BLOCK_REASONS, structurePrompt, hotspotPlanNote, hotspotBuildRule, reproPlanNote, unrunnableValidateNote, contextPackNote, docsPrompt, ciFailurePrompt, ciUnavailablePrompt, precheckFailurePrompt, contextRestartPrompt, turnBudgetWrapupPrompt, syncChecks, GROUPING_SYSTEM, enumeratingPlanNote, enumeratingBuildRule, invariantsPlanNote, invariantsBuildRule, missingEntriesPrompt, sequencePrompt, sequenceSyncNote, sequenceSyncPrompt, fixSessionPrompt, postMergeFailurePrompt, duplicateExportsPrompt, migrationGeneratorPrompt, i18nCopiesPrompt } from "./prompts.mjs";
 import { postMergeCommands } from "./postmerge.mjs";
 import { guardAfterMerge, withHistoryRows } from "./guards.mjs";
+import { routePathsFromFiles, routeReachabilityFailures } from "./routecheck.mjs";
+import { parseCoupled, coupledFailures } from "./coupled.mjs";
 import { loadGuards, selectGuards, runGuards, supersededIds, supersessionComment } from "./guardgate.mjs";
 import { freshFix, issueSummary, firstPassOf, sessionCostDelta } from "./fixround.mjs";
 import { parseBuilderRouting, routeBuilder, shouldEscalate } from "./routing.mjs";
@@ -51,6 +53,7 @@ import { addLaneWorktree, DEFAULT_SPARSE_MAX_KB } from "./worktree.mjs";
 import { parseVerify, runCiVerify, collectFailedLogs, capLogs, VERIFY_MODES, VERIFY_CHECK_NAME, verifyReport, ciGate, rerunFailedOnce, rerunTarget, splitFlaky } from "./verify.mjs";
 import { e2eSpecs, e2eWanted, ownFailures, runE2eGate, NO_TRIGGER } from "./e2e.mjs";
 import { laneBackendId } from "./limits.mjs";
+import { openRotator, rotatorRetry } from "./rotator.mjs";
 import { SPLIT_LABEL } from "./refactor.mjs";
 import { writeHeavyShims, sumWaits, isHeavyProcess } from "./heavy.mjs";
 import { priorityFromLabels } from "./sched.mjs";
@@ -194,6 +197,7 @@ export function isProtectedLaneBranch(b, { issue, lane = null, branches = {}, de
  * @param {string} [o.fixModel]     model of fresh fix-round sessions (#4363, forge.yaml lean.fix_model); default the reviewer model
  * @param {object} [o.builderRouting] forge.yaml lean.builder_routing/builder_mid_model (#4394): {mode: on (default)|off, midModel}
  * @param {string} [o.followupsDefaultMilestone] forge.yaml followups.default_milestone (#4664): milestone of deferred follow-ups whose parent's milestone has shipped and has no next one
+ * @param {string} [o.followupsRollupLabel] forge.yaml followups.rollup_issue_label (#5078): a repo's own open issue with this label is the post-deploy rollup when no marked one is open
  * @param {string} [o.sequenceRegenerate] forge.yaml lean.sequence.regenerate (#4386): snapshot generator for a schema-changing renumbered migration
  * @param {object} [o.baseMerge] forge.yaml lean.base_merge_* (#4588): {unionGlobs, jsonGlobs, generatedGlobs, generatedCommand} for deterministic base-merge conflict resolution
  * @param {number} [o.ciMaxMinutes]  remote-CI wait budget (default 360); exhaustion is NOT needs-human
@@ -226,8 +230,9 @@ export function isProtectedLaneBranch(b, { issue, lane = null, branches = {}, de
  */
 export async function runCore(o) {
   const { issue, repo, lane: requestedLane = null, laneOverride = false, branches = {}, cwd, dir, io, builderModel = null, reviewerModel = DEFAULT_REVIEWER_MODEL, fixModel = null,
-    toolchainOverride = null, testRunners = null, validateRecipes = null, envSetup = null, ciMaxMinutes = 360, conformance = "shadow", conformanceKinds = null, conformanceMutation = "off", reviewIncomplete = "needs-human", reproTest = "prefer", closeParent = false, mergeWait = "required", maxSessionLimitPauses = DEFAULT_MAX_SESSION_LIMIT_PAUSES, cliIdleMinutes = 15, cliMaxMinutes = 180, cliBusyMinutes = 45, contextCeilingTokens = 120000, turnBudgets = null, laneLimits = null, maxMergeRetries = 5, sessionLimitMaxWaitMs = DEFAULT_SESSION_LIMIT_WAIT_MS, onProgress = () => {}, emitTelemetry = null, random = Math.random } = o;
+    toolchainOverride = null, testRunners = null, coupledFiles = null, validateRecipes = null, routeReachability = null, envSetup = null, ciMaxMinutes = 360, conformance = "shadow", conformanceKinds = null, conformanceMutation = "off", reviewIncomplete = "needs-human", reproTest = "prefer", closeParent = false, mergeWait = "required", maxSessionLimitPauses = DEFAULT_MAX_SESSION_LIMIT_PAUSES, cliIdleMinutes = 15, cliMaxMinutes = 180, cliBusyMinutes = 45, contextCeilingTokens = 120000, turnBudgets = null, laneLimits = null, maxMergeRetries = 5, sessionLimitMaxWaitMs = DEFAULT_SESSION_LIMIT_WAIT_MS, onProgress = () => {}, emitTelemetry = null, random = Math.random } = o;
   const now = io.now ?? (() => Date.now());
+  const rotator = io.rotator !== undefined ? io.rotator : openRotator({ kind: o.accountRotator }); // #5094
   const vcfg = { ...parseVerify({}), ...(o.verify ?? {}) };
   const learnedCommands = (Array.isArray(o.precheck?.commands) ? o.precheck.commands : []).map((c) => String(c ?? "").trim()).filter(Boolean);
   if (!VERIFY_MODES.includes(vcfg.mode)) vcfg.mode = "local";
@@ -348,6 +353,7 @@ export async function runCore(o) {
   let heavyEnv = null, heavyWaitsFile = null, heavyQueueMax = 0, stage = "plan", iss;
   let seqLease = null; // #4386: the host sequence lease, held from the merge-gate renumber through the merge
   const waits = {};
+  const followupsFiled = []; // #5078: {issue, class, count} per tracking issue this lane filed into, for the batch report
   let precheckMs = 0, precheckDeferred = 0, precheckRan = false; // #4331: pre-PR check wall time and deferrals, for the batch report
   const addWait = (phase, ms, queued = 0) => {
     if (Number.isFinite(ms) && ms > 0) waits[phase] = (waits[phase] ?? 0) + ms;
@@ -470,13 +476,14 @@ export async function runCore(o) {
         await ghc(["issue", "edit", String(issue), "-R", repo, "--add-label", "needs-human"]);
       } catch { /* best effort */ }
     }
-    if (["needs-human", "engine-error", "dependency-open", "dependency-blocked", "dependency-unreadable", "decomposed"].includes(reason)) {
+    if (["needs-human", "engine-error", "dependency-open", "dependency-blocked", "dependency-unreadable", "decomposed", "host-task"].includes(reason)) {
       const wf = ["investigating", "building", "in-review"].map((x) => `workflow:${x}`).join(",");
       try { await ghc(["issue", "edit", String(issue), "-R", repo, "--remove-label", wf]); } catch { /* best effort */ }
     }
     if (["merged", "invalid", "needs-human", "budget-exceeded"].includes(reason)) {
       if (reason === "budget-exceeded") T.close = ["left open", "recoverable budget.exceeded"]; // #4505: not a human escalation
       else if (reason === "merged") T.close = [extra.close === "partial" ? "issue closed (partial)" : "issue closed (completed)", "label workflow:merged"];
+      else if (reason === "invalid" && extra.close === "already-fixed") T.close = ["issue closed (completed)", "already fixed on the base"]; // #5080
       else if (reason === "invalid") T.close = ["issue closed (not planned)", "label workflow:invalid"];
       else { T.close = ["left open", "label needs-human"]; T.anomalies.push(`needs-human: ${String(detail).split("\n")[0].slice(0, 300)}`); }
       try { await post(["FORGE:TRAJECTORY", REGISTER_MARKER], renderTrajectory({ ...T, usage: usageLine() })); } catch { /* best effort */ }
@@ -484,7 +491,7 @@ export async function runCore(o) {
     await releaseLease(reason, code, extra.mergedTo ?? null);
     done = { terminalReason: reason, detail, branch, worktree: wt, cost_usd: usage.cost_usd, tokens: { input: usage.input, output: usage.output, cache: usage.cache }, wall_ms: now() - t0, model_ms: modelMs, phases: phaseLedger.snapshot(),
       ...(laneHead && reason !== "merged" ? { laneHead: { ...laneHead } } : {}), light, ...(lightVerdict ? { light_eligibility: lightVerdict } : {}), ...(lightUpgrade ? { light_upgrade: lightUpgrade } : {}), // #4453
-      ...(Object.keys(waits).length ? { waits: { ...waits } } : {}), ...(heavyQueueMax ? { heavyQueueMax } : {}), ...(precheckRan ? { precheckMs, precheckDeferred } : {}),
+      ...(Object.keys(waits).length ? { waits: { ...waits } } : {}), ...(followupsFiled.length ? { followups: followupsFiled.map((f) => ({ ...f })) } : {}), ...(heavyQueueMax ? { heavyQueueMax } : {}), ...(precheckRan ? { precheckMs, precheckDeferred } : {}),
       ...(firstPassOf(builderTriggers) != null ? { firstPass: firstPassOf(builderTriggers) } : {}), ...(tb.record() ? { turns: tb.record() } : {}), // #4392
       ...(route ? { builderRoute: { tier: route.tier, class: route.class, escalated, model: route.model ?? "default" } } : {}),
       ...(gateRan ? { conformance: { mode: conformance === "enforce" || riskEnforced ? "enforce" : "shadow", would: shadowWould, risk: Boolean(riskEnforced), ...(Object.keys(kinds).length ? { kinds: [...failureClasses] } : {}) } } : {}), ...extra };
@@ -625,7 +632,7 @@ export async function runCore(o) {
   }
   /** Runner call with the per-run TMPDIR and FORGE_HOST_PARALLELISM; a usage limit pauses and resumes the same step, or defers past the cap (#4101). */
   async function callRunner(args) {
-    let pauses = 0;
+    let pauses = 0, rotations = 0;
     for (;;) {
       // #4181: every Docker resource the builder creates carries the lane's ownership labels (same batch/lane as the ledger).
       const labels = dockerLabels({ batch: o.batchId ?? "adhoc", lane: `lean-${issue}`, issue, expires: now() + LEDGER_TTL_MS }).join(" ");
@@ -637,6 +644,7 @@ export async function runCore(o) {
       catch (e) {
         const epoch = Number.isFinite(e?.resetAtEpochMs) ? e.resetAtEpochMs : null;
         if (!(e?.usageLimit === true || epoch !== null)) throw e;
+        if (rotatorRetry(rotator, rotations)) { rotations++; ev({ event: "PHASE_ACCOUNT_ROTATED", phase: args.role }); continue; } // #5094: same args (resume too), next account
         const waitMs = epoch !== null && epoch > now() ? epoch - now() : DEFAULT_SESSION_LIMIT_WAIT_MS;
         if (pauses >= maxSessionLimitPauses || waitMs > sessionLimitMaxWaitMs) { e.deferUsageLimit = true; throw e; }
         pauses++;
@@ -929,6 +937,17 @@ export async function runCore(o) {
       const caps = hostCapabilityBlock(s, o.hostCaps);
       if (caps.length) return await needsHuman(`Remote sandbox lacks host capability ${caps.join(", ")} (Builder is blocked (credentials)): ${s}\n\nThe dispatching host has it; the lane is recovered locally.`, OUTCOME_CODES.ENV_CAPABILITY_REMOTE);
     }
+    if (b.kind === "human" && b.why === "credentials" && READONLY_PROD_RE.test(s) && !EXTERNAL_NEED_RE.test(s)) {
+      // #5080: read-only production access with no credential/spend/account need is host work: recovered on the host, never a human ask
+      T.decisions.push("Builder block: read-only production access is host work (host-task), not an owner ask");
+      if (o.placement?.where !== "remote") { // on the host already: a host task (label host-task), never needs-human
+        const why = `Host-task: the lane needs read-only production access (Builder is blocked (credentials)): ${s}\n\nNot a credential or an owner ask: run it on the host with its read-only prod tools.`;
+        try { await post("FORGE:HOST_TASK", `## Host task\n${why}\n\n_${usageLine()}_`); } catch { /* best effort */ }
+        try { await ghc(["issue", "edit", String(issue), "-R", repo, "--add-label", "host-task"]); } catch { /* best effort */ }
+        return await finish("host-task", why, { code: OUTCOME_CODES.ENV_CAPABILITY_REMOTE }, OUTCOME_CODES.ENV_CAPABILITY_REMOTE);
+      }
+      return await needsHuman(`Host-task: the lane needs read-only production access, which the dispatching host has (Builder is blocked (credentials)): ${s}\n\nNot a credential: the lane is recovered on the host.`, OUTCOME_CODES.ENV_CAPABILITY_REMOTE);
+    }
     if (b.kind === "human" && b.why === "credentials" && o.placement?.where === "remote" && missingToolBlock(s)) {
       // #4685: a tool the sandbox lacks (docker, promtool, a Python module) is an environment gap the host recovers, never a credential.
       return await needsHuman(`Remote sandbox lacks a validate tool (Builder is blocked (credentials)): ${s}\n\nNot a credential: the lane is recovered where the tool exists.`, OUTCOME_CODES.ENV_TOOL_MISSING);
@@ -1265,6 +1284,13 @@ export async function runCore(o) {
       const differs = new Set(names(await git(["diff", "--name-only", base, "HEAD"])));
       return touched.filter((f) => differs.has(f));
     };
+    /** #5079: verification.coupled_files failures for the lane diff ([] when unconfigured; added files only read when a rule needs them) */
+    const coupledOf = async (files) => {
+      const rules = parseCoupled(coupledFiles);
+      if (!rules.length) return null;
+      const addedFiles = rules.some((r) => r.addedOnly) ? names(await git(["diff", "--name-only", "--diff-filter=A", `${base}...HEAD`]).catch(() => "")) : [];
+      return coupledFailures({ rules, changedFiles: files, addedFiles });
+    };
     /** #4364: the last `forgedock check` record vs the current tree: skipped|stale|red|green; any read or git error is skipped. */
     const selfCheckNow = async () => {
       try { return selfCheckState(JSON.parse(await io.fs.read(`${wt}/${SELF_CHECK_FILE}`)), await worktreeFingerprint({ git, base })); } catch { return "skipped"; }
@@ -1332,7 +1358,7 @@ export async function runCore(o) {
         pitMatched = inPack.filter((x) => x.match === "files").length;
         // #4375: which pitfalls were in the pack (signatures only, run log only: never telemetry or a comment)
         const rec = { event: "CONTEXT_PACK", mode: ctxCfg.mode, ...ctxAb, lane_type: ctxLane, sources: p.sources, found: p.found, bytes: p.bytes, items: p.items, truncated: p.truncated,
-          hash: p.hash, cached: r.cached, ...(r.errors?.length ? { errors: r.errors } : {}) };
+          hash: p.hash, cached: r.cached, ...(p.recall ? { recall: p.recall.present ? "present" : "absent" } : {}), ...(r.errors?.length ? { errors: r.errors } : {}) };
         ev({ ...rec, pitfalls: inPack }); await emit(rec);
         const seen = trustedComments.some((c) => String(c?.body ?? "").startsWith("<!-- FORGE:CONTEXT -->") && String(c.body).includes(`hash ${p.hash})`));
         if (p.items && !seen) { try { await post("FORGE:CONTEXT", renderContextRecord(p, { mode: ctxCfg.mode, laneType: ctxLane })); } catch { /* best effort */ } }
@@ -1381,7 +1407,7 @@ export async function runCore(o) {
       if (!io.fileFollowups) throw fail("no follow-up filing effect is configured");
       const items = followupItems(reqs, { now: now() });
       let filed;
-      try { filed = await io.fileFollowups({ parent: issue, repo, items, milestone, defaultMilestone: o.followupsDefaultMilestone ?? null, lane }); } catch (e) { throw fail(`filing the follow-up issue failed: ${String(e?.message ?? e).slice(0, 200)}`); }
+      try { filed = await io.fileFollowups({ parent: issue, repo, items, milestone, defaultMilestone: o.followupsDefaultMilestone ?? null, lane, batchId: o.batchId ?? null, rollupLabel: o.followupsRollupLabel ?? null }); } catch (e) { throw fail(`filing the follow-up issue failed: ${String(e?.message ?? e).slice(0, 200)}`); }
       for (const [i, r] of reqs.entries()) {
         const n = Number(filed?.[items[i].key]);
         if (!Number.isSafeInteger(n) || n <= 0) throw fail(`no tracking issue was returned for ${r.id}`);
@@ -1389,6 +1415,8 @@ export async function runCore(o) {
         try { st = JSON.parse(String(await ghc(["issue", "view", String(n), "-R", repo, "--json", "number,state"]))); } catch { st = null; }
         if (String(st?.state).toUpperCase() !== "OPEN") throw fail(`tracking issue #${n} for ${r.id} is not open or unreadable`);
         r.tracked = `#${n}`;
+        const f = followupsFiled.find((x) => x.issue === n && x.class === items[i].class); // #5078: grouped per issue and class
+        if (f) f.count += 1; else followupsFiled.push({ issue: n, class: items[i].class, count: 1 });
       }
       const buckets = Object.entries(bucketTally(reqs)).map(([k, c]) => `${k}:${c}`).join(","); // #4724
       T.decisions.push(`Tracked ${reqs.map((r) => `${r.id} (${r.disposition})`).join(", ")} in ${[...new Set(reqs.map((r) => r.tracked))].join(", ")} (${why}; buckets ${buckets})`);
@@ -1802,7 +1830,7 @@ export async function runCore(o) {
         const names = failed.map((f) => `\`${f.command}\` (exit ${f.rc})`).join(", ");
         if (isSplit) return await needsHuman(`Declared check command(s) fail on the refactor:split move (no builder edits a split); nothing merged: ${names}`, OUTCOME_CODES.CI_RED);
         checkCommandsFailing = true;
-        if (round >= vcfg.maxRounds || !sessionId) { T.anomalies.push(`Declared check command(s) still failing before the PR: ${names}`); break; }
+        if (round >= vcfg.maxRounds || !sessionId) { if (vcfg.precheckBlock) return await needsHuman(`Declared check command(s) still failing before the PR (verify.precheck_block); nothing merged: ${names}`, OUTCOME_CODES.CI_RED); T.anomalies.push(`Declared check command(s) still failing before the PR: ${names}`); break; }
         T.decisions.push(`Declared check command(s) failed: ${names}; builder resumed (round ${round + 1}/${vcfg.maxRounds})`);
         const before = String(await git(["rev-parse", "HEAD"])).trim();
         const capped = capLogs(failed.map((f) => ({ ...f, log: f.output }))).map((f) => ({ command: f.command, rc: f.rc, output: f.log }));
@@ -1816,7 +1844,7 @@ export async function runCore(o) {
         await fixRound("precheck", precheckFailurePrompt(quiet, vcfg.mode), [], "precheck", capped.map((f) => `${f.command}\n${f.output ?? ""}`).join("\n"));
         await upsertStage("implementation");
         result = (await readResult()) ?? result;
-        if (String(await git(["rev-parse", "HEAD"])).trim() === before) { T.anomalies.push(`Declared check command(s) failing and the builder made no new commit for them: ${names}`); break; }
+        if (String(await git(["rev-parse", "HEAD"])).trim() === before) { if (vcfg.precheckBlock) return await needsHuman(`Declared check command(s) failing and the builder made no new commit for them (verify.precheck_block); nothing merged: ${names}`, OUTCOME_CODES.CI_RED); T.anomalies.push(`Declared check command(s) failing and the builder made no new commit for them: ${names}`); break; }
         files = await changedFiles();
       }
     }
@@ -2301,6 +2329,7 @@ export async function runCore(o) {
       const cfg = readRollouts(wt);
       return cfg ? detectNewOffKeys(cfg, String(await git(["diff", "-U0", `${base}...HEAD`, "--", ...cfg.files]).catch(() => ""))) : [];
     }
+    let amendFixed = false;
     async function gate() {
       await refreshIssue("conformance");
       result = (await readResult()) ?? result;
@@ -2313,6 +2342,14 @@ export async function runCore(o) {
         ev({ event: "CONFORMANCE_RISK_ENFORCED", paths: hits });
         T.decisions.push(`Conformance enforced (review.risk_paths): ${hits.slice(0, 10).join(", ")}${hits.length > 10 ? ` and ${hits.length - 10} more` : ""}`);
       }
+      if (!amendFixed && sessionId && amendmentKindProblems(result?.amendments).length) { // #5089: one in-lane correction, outside the conformance resume budget
+        amendFixed = true;
+        const bad = amendmentKindProblems(result.amendments);
+        T.decisions.push(`Amendment kinds invalid (${bad.length}); builder asked to correct ${RESULT_FILE} once`);
+        await builder(++attemptN, amendmentCorrectionPrompt(bad), sessionId, false, undefined, { mode: "resume", trigger: "contract_correction" });
+        result = (await readResult()) ?? result;
+        files = await changedFiles();
+      }
       const amendProblems = await amend();
       const gateHead = String(await git(["rev-parse", "HEAD"])).trim();
       const ciVerified = remoteVerify && ciVerifiedHead !== null && ciVerifiedHead === gateHead;
@@ -2321,6 +2358,8 @@ export async function runCore(o) {
       // #4693: guards run beside the validate rerun; SPEC-11: the substituted-original rerun shares the one validate phase
       const validatePhase = phaseLedger.during("validate", async () => ({ runs: await rerunFailedValidatesRaw(effective), subs: await rerunSubstitutedOriginals(effective) })).finally(() => { validateMs = now() - gateT0; });
       const [{ runs: validateRuns, subs: substitutedRuns }, guardFailures] = await Promise.all([validatePhase, guardGate(files)]);
+      // #5087: forge.yaml topology.route_reachability gates the route handlers this diff adds; unset = no check
+      const routeFailures = routeReachability && io.runCommand ? await routeReachabilityFailures({ command: routeReachability, paths: routePathsFromFiles(String(await git(["diff", "--name-only", "--diff-filter=A", `${base}...HEAD`]).catch(() => "")).split("\n").map((x) => x.trim()).filter(Boolean)), run: async ({ command }) => (await io.runCommand({ command, cwd: wt, timeoutMs: vcfg.precheckTimeoutSeconds * 1000, env: laneEnv() }).then((x) => x?.r ?? x)) ?? { rc: 127 } }) : [];
       // #4705: only the part not hidden behind the validate rerun; 0 when the gate errored or skipped
       const guardRunMs = guardEv && !guardEv.error ? Math.max(0, now() - gateT0 - validateMs) : 0;
       guardAddedMs += guardRunMs;
@@ -2330,7 +2369,7 @@ export async function runCore(o) {
       const checkIds = effective.requirements?.some((r) => r.disposition === "post-deploy") ? new Set(Object.keys(await checksAt(git, [base, "HEAD"], wt))) : null;
       const removedPaths = (effective.validate ?? []).some((v) => v.substituted) ? await removedPathsOf(git, base) : []; // #4990
       const subBaseFiles = (effective.validate ?? []).some((v) => v.substituted) ? String(await git(["ls-tree", "-r", "-z", "--name-only", base]).catch(() => "")).split("\0").filter(Boolean) : []; // #5003
-      const pc = precheck({ contract: effective, result, changedFiles: files, ignore: IGNORE, ciVerified, hotspots, repro: await reproOf(effective), validateRuns, repoHas, frozen, checkIds, guardFailures, newOffKeys: await newOffKeysOf(), substitutedRuns, removedPaths, baseFiles: subBaseFiles });
+      const pc = precheck({ contract: effective, result, changedFiles: files, ignore: IGNORE, ciVerified, hotspots, repro: await reproOf(effective), validateRuns, repoHas, frozen, checkIds, guardFailures, coupledFailures: await coupledOf(files), routeFailures, newOffKeys: await newOffKeysOf(), substitutedRuns, removedPaths, baseFiles: subBaseFiles });
       // #4350: a scope-check validate stale only by amended deliverables is judged by the engine's scope gate instead
       if (pc.superseded?.length) {
         ev({ event: "VALIDATE_SUPERSEDED", runs: pc.superseded });
@@ -2367,6 +2406,8 @@ export async function runCore(o) {
       const envFails = pc.failures.filter((f) => ENV_CODES.includes(f.code));
       const pre = [...pc.failures.filter((f) => !ENV_CODES.includes(f.code)), ...amendProblems, ...mutBlock];
       if (pre.length) ev({ event: "PRECHECK", failures: pre.map((f) => f.code) });
+      // #5080: the repro already passes on the base and the diff changes no source: the fix is on the base, not missing
+      if (alreadyFixedOnBase(pre, files, IGNORE)) return { state: "already-fixed", by: "precheck", failures: pre };
       if (pre.length && !recording()) return { state: "nonconforming", by: "precheck", failures: pre };
       // shadow: the builder's own failed checks block before any reviewer tokens are spent (#4160)
       const hard = recording() ? blockingOf(pre, SHADOW_PRE_BLOCKS).block : [];
@@ -2462,6 +2503,13 @@ export async function runCore(o) {
         const explained = explainFailures(outcome.failures, effective); // #4265: name the unmet requirement, not only the code
         const list = explained.slice(0, 15).map((f) => `- ${f.code}: ${f.detail}`).join("\n");
         if (outcome.state === "environment") return await envNeedsHuman(outcome.failures);
+        if (outcome.state === "already-fixed") { // #5080: close as delivered, citing the base commit
+          const sha = String(await git(["rev-parse", base]).catch(() => "")).trim().slice(0, 12) || base;
+          const note = `Already fixed on the base: the repro test passes on \`${base}\` (${sha}) without this change, and the diff changes no source file. Closing as delivered.\n\n${list}`;
+          T.decisions.push(`Already fixed on base ${sha} (repro BASE=RAN HEAD=RAN)`);
+          await ghw(["issue", "close", String(issue), "-R", repo, "--reason", "completed", "--comment", note]);
+          return await finish("invalid", `already fixed on base ${sha}`, { close: "already-fixed" });
+        }
         if (outcome.state === "review.unparseable") return await needsHuman(`The conformance reviewer returned no parseable JSON twice; nothing merged.`, OUTCOME_CODES.REVIEW_NO_VERDICT);
         if (shadow && reviewIncomplete === "degraded" && (outcome.state === "review.incomplete" || outcome.state === "review.inconsistent")) {
           degraded = { state: outcome.state, missing: outcome.missing ?? [] };
@@ -2982,7 +3030,7 @@ export async function runCore(o) {
   } catch (e) {
     if (e?.deferUsageLimit) {
       const when = e.resetAt || (Number.isFinite(e.resetAtEpochMs) ? new Date(e.resetAtEpochMs).toISOString() : "unknown");
-      return finish("deferred", `usage limit hit; resets at ${when}`, { code: OUTCOME_CODES.RATE_LIMITED, resetAt: when, resetAtEpochMs: Number.isFinite(e.resetAtEpochMs) ? e.resetAtEpochMs : null, backendId: laneBackendId(process.env) }, OUTCOME_CODES.RATE_LIMITED);
+      return finish("deferred", `usage limit hit; resets at ${when}`, { code: OUTCOME_CODES.RATE_LIMITED, resetAt: when, resetAtEpochMs: Number.isFinite(e.resetAtEpochMs) ? e.resetAtEpochMs : null, backendId: laneBackendId(process.env, rotator) }, OUTCOME_CODES.RATE_LIMITED);
     }
     if (e?.deferCode) return finish("deferred", e.deferDetail ?? String(e.message), { code: e.deferCode, ...(e.retryInSeconds ? { retryInSeconds: e.retryInSeconds } : {}) }, e.deferCode);
     // #4505: a turn overrun is mechanical: a non-human end the batch recovers, needs-human only once a budget recovery failed too

package/bin/lean/lean.test.mjs

@@ -310,6 +310,22 @@ describe("core work-on", () => {
     assert.match(t, /\| Plan \| not reached \|/);
   });
 
+  it("an unknown amendment kind gets one in-lane correction before the gate and does not use the conformance resume (#5089)", async () => {
+    const w = world({ amendments: [{ kind: "deliverable_change", requirement: "R1", why: "no Linux build" }], resumeAmendments: [], reviews: [ok()] });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "merged");
+    assert.ok(builders(w).some((c) => /amendments in .*result\.json are not valid/.test(c[4] ?? "")), "the correction prompt ran");
+    assert.match(traj(w)[0], /Amendment kinds invalid \(1\); builder asked to correct/);
+  });
+
+  it("an unknown amendment kind the builder does not fix parks only after the one correction (#5089)", async () => {
+    const bad = [{ kind: "deliverable_change", requirement: "R1", why: "w" }];
+    const w = world({ amendments: bad, resumeAmendments: bad, reviews: [ok()] });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "needs-human");
+    assert.equal(builders(w).filter((c) => /amendments in .*result\.json are not valid/.test(c[4] ?? "")).length, 1);
+  });
+
   it("nonconforming review -> builder resumed in its session with the failed rows -> re-review conforms -> merge; the note is re-posted", async () => {
     const w = world({ reviews: [bad("src/foo.js:9 still wrong"), ok()] });
     const r = await run(w);
@@ -443,6 +459,19 @@ describe("core work-on", () => {
     assert.equal((await run(world({ changed: [] }))).terminalReason, "needs-human");
   });
 
+  it("#5080 a credentials block that is only read-only prod access ends host-task locally, env.capability_remote remotely, never builder.blocked; real credentials stay builder.blocked", async () => {
+    const prod = { result: { status: "blocked", summary: "gated on read-only production telemetry: a host-only prod_monitor capability", block: { kind: "human", why: "credentials" } } };
+    const lw = world(prod);
+    const local = await run(lw);
+    assert.equal(local.terminalReason, "host-task"); assert.equal(local.code, "env.capability_remote");
+    assert.ok(lw.edits.some((e) => e.includes("--add-label") && e.includes("host-task")), JSON.stringify(lw.edits));
+    assert.ok(!lw.edits.some((e) => e.includes("--add-label") && e.includes("needs-human")), JSON.stringify(lw.edits));
+    const remote = await run(world(prod), { placement: { where: "remote", reason: "mode remote" } });
+    assert.equal(remote.code, "env.capability_remote"); assert.notEqual(remote.terminalReason, "host-task");
+    const real = await run(world({ result: { status: "blocked", summary: "needs the production API key to read prod data", block: { kind: "human", why: "credentials" } } }));
+    assert.equal(real.code, "builder.blocked");
+  });
+
   // #4124: a builder block is typed; only kind "human" with an allowed reason may reach needs-human.
   const depWorld = (o, deps) => {
     const w = world(o);
@@ -928,6 +957,7 @@ describe("conformance gate (frozen contract, precheck, structured review)", () =
     assert.equal(w.followups.length, 1);
     assert.deepEqual(w.followups[0].items.map((i) => i.key), ["R2: Existing callers of foo keep working."]);
     assert.match(w.followups[0].items[0].why, /^post-deploy: \[bucket:post-deploy\] callers live in another module/);
+    assert.deepEqual(r.followups, [{ issue: 900, class: "post-deploy", count: 1 }]); // #5078: the batch report's follow-ups line
     const body = w.prs[0][w.prs[0].indexOf("--body") + 1];
     assert.match(body, /## Remaining work tracked\n- #900\n\nCloses #7$/);
     assert.ok(w.comments.some((c) => c.includes("<!-- FORGE:TRACKED -->") && c.includes("#900")));
@@ -1938,6 +1968,17 @@ describe("bug lanes freeze a red-green repro_test (#4271)", () => {
     assert.equal((await run(fixed, { conformance: "shadow" })).terminalReason, "merged"); assert.equal(fixed.rgCalls.length, 2);
   });
 
+  it("#5080 a repro that already passes on the base ends already-fixed: the issue closes as completed citing the base, nothing merges, no resume", async () => {
+    for (const conformance of ["enforce", "shadow"]) {
+      const w = rworld([{ base: "RAN", head: "RAN" }], { changed: ["test/foo.test.js"] });
+      const r = await run(w, { conformance });
+      assert.equal(r.terminalReason, "invalid", conformance); assert.equal(w.merges.length, 0);
+      assert.equal(builders(w).length, 2, "no resume"); assert.equal(reviewers(w).length, 0);
+      assert.equal(w.closed.length, 1); assert.equal(w.closed[0][w.closed[0].indexOf("--reason") + 1], "completed");
+      assert.match(w.closed[0][w.closed[0].indexOf("--comment") + 1], /Already fixed on the base/);
+    }
+  });
+
   it("a repro test the harness cannot run on head (or no harness result) is env.repro_unrunnable: recoverable, no resume, no reviewer (#4334)", async () => {
     for (const conformance of ["enforce", "shadow"]) {
       for (const rg of [{ base: "SKIPPED", head: "UNRUNNABLE" }, null]) {
@@ -3298,6 +3339,45 @@ describe("usage limit, lease takeover, worktree setup, run tmp (#4101-#4104)", (
     assert.match(r.detail, /resets at unknown/);
   });
 
+  // #5094: an account rotator re-sends the limited call on the next account at once, with the same args (resume too).
+  const fakeRotator = (o = {}) => ({ kind: "tokenbaton", accounts: o.accounts ?? [{ n: 1 }, { n: 2 }], headroom: () => o.headroom ?? true, resumeAt: () => null,
+    currentIdentity: () => o.id ?? "acct-2", accountIdentity: (n) => `acct-${n}`, isAccount: () => true });
+  const captureBuilders = (w, err, times) => { const orig = w.io.runner; const sent = []; let n = 0;
+    w.io.runner = async (c) => { if (c.role === "builder") { sent.push({ prompt: c.prompt, resume: c.resume ?? null, model: c.model ?? null }); if (n++ < times) throw err; } return orig(c); }; return sent; };
+
+  it("#5094 a rotator switches accounts mid-lane: the limited call is re-sent on the next account at once and the lane continues", async () => {
+    const w = world(); const sleeps = []; const dir = tmpDir("core-");
+    const s0 = w.io.sleep; w.io.sleep = async (ms) => { sleeps.push(ms); return s0(ms); };
+    const sent = captureBuilders(w, limitErr({ resetAtEpochMs: 3 * 3600 * 1000, resetAt: "8:30pm" }), 1);
+    w.io.rotator = fakeRotator();
+    const r = await run(w, { dir });
+    assert.equal(r.terminalReason, "merged", "no deferral: the next account ran the call");
+    assert.equal(sleeps.includes(3 * 3600 * 1000), false, "no pause for the exhausted account's reset");
+    assert.deepEqual(sent[1], sent[0], "the same step is re-sent (same prompt, same resume session): no state lost");
+    const clean = world(); await run(clean);
+    assert.equal(builders(w).length, builders(clean).length, "no builder phase is repeated beyond the re-sent call");
+    assert.ok(readLog(dir, 7).some((e) => e.event === "PHASE_ACCOUNT_ROTATED" && e.phase === "builder"));
+  });
+
+  it("#5094 rotations stop at the account count, then the lane defers naming the rotator's current account", async () => {
+    const w = world();
+    const sent = captureBuilders(w, limitErr({ resetAtEpochMs: 3 * 3600 * 1000, resetAt: "8:30pm" }), 99);
+    w.io.rotator = fakeRotator({ id: "acct-2" });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "deferred"); assert.equal(r.code, "rate_limited");
+    assert.equal(sent.length, 3, "first call plus one retry per account");
+    assert.equal(r.backendId, "acct-2");
+  });
+
+  it("#5094 a rotator without headroom does not retry: the usual pause/defer applies", async () => {
+    const w = world();
+    const sent = captureBuilders(w, limitErr({ resetAtEpochMs: 3 * 3600 * 1000, resetAt: "8:30pm" }), 99);
+    w.io.rotator = fakeRotator({ headroom: false });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "deferred");
+    assert.equal(sent.length, 1);
+  });
+
   it("#4101 a non-limit runner error is still engine-error", async () => {
     const w = world(); failFirstBuilder(w, new Error("boom"));
     assert.equal((await run(w)).terminalReason, "engine-error");

package/bin/lean/limits.mjs

@@ -13,8 +13,12 @@ import { join } from "node:path";
 import { backendIdentity } from "../engine.mjs";
 import { writeAtomic } from "./batch.mjs";
 
-/** Identity of the account a core lane runs on: the lane always uses the claude CLI with the dispatcher's env. */
-export function laneBackendId(env = process.env) {
+/**
+ * Identity of the account a core lane runs on: the lane always uses the claude CLI with the dispatcher's env. With an
+ * account rotator (#5094, rotator.mjs) the shim picks the account per call, so the rotator's current account is the identity.
+ */
+export function laneBackendId(env = process.env, rotator = null) {
+  if (rotator) { try { const id = rotator.currentIdentity(); if (id) return id; } catch { /* fail-open: the env identity */ } }
   return backendIdentity({ backend: "cli", env });
 }