forgedock 1.48.1 → 1.49.0

package/bin/lean/lanecheck.mjs

@@ -31,20 +31,49 @@ const C = PREFLIGHT_CODES;
 /** A remote or hybrid execution is configured (the only case the pool checks apply to). */
 export const usesPool = (exec) => Boolean(exec) && (exec.mode === "remote" || exec.mode === "hybrid") && ["pool", "remote"].includes(exec.provider ?? "pool");
 
-/** The pool token resolves (env/keychain `token_env`, else the router's `forgedock_token_file`) and the router does not answer 401/403 to an authenticated ping. */
-export async function checkPoolAuth({ exec, router = null, credential = () => null, ping = null }) {
+/** #5131: `a` and `b` name the same `scheme://host:port` (default ports filled, path and trailing slash ignored). */
+const sameEndpoint = (a, b) => {
+  const key = (u) => { try { const x = new URL(String(u)); return `${x.protocol}//${x.hostname}:${x.port || (x.protocol === "https:" ? "443" : "80")}`; } catch { return null; } };
+  return key(a) !== null && key(a) === key(b);
+};
+
+/**
+ * The injectable stand-in for execution.mjs `poolCredential` when no `poolToken` is given (tests, older callers): `credential`
+ * on `token_env` (default COMPUTESHARE_TOKEN), then the router token, for `remote` only when its endpoint is unset or the router's.
+ */
+export const legacyPoolToken = (credential = () => null) => (exec, router) => {
+  const name = exec?.tokenEnv ?? "COMPUTESHARE_TOKEN";
+  const v = credential(name);
+  if (v) return { token: v, source: name };
+  const ok = Boolean(router?.token) && ((exec?.provider ?? "pool") === "pool" || !exec?.endpoint || sameEndpoint(exec.endpoint, router.endpoint));
+  return ok ? { token: router.token, source: "forgedock_token_file" } : { token: null, source: null };
+};
+
+/** The sources a resolver tries for `exec` (names only, never values), for a FAIL detail. */
+const sourcesTried = (exec, router) => [
+  `env/keychain ${exec.tokenEnv ?? (exec.provider === "remote" ? "(no token_env)" : "COMPUTESHARE_TOKEN")}`,
+  ...(exec.tokenFile ? [`token_file ${exec.tokenFile}`] : []),
+  !router ? "no router config (COMPUTESHARE_CONFIG / ~/.config/computeshare/router.json)"
+    : (exec.provider ?? "pool") === "remote" && exec.endpoint && !sameEndpoint(exec.endpoint, router.endpoint) ? `the router's forgedock_token_file (not used: endpoint ${exec.endpoint} is not the local router ${router.endpoint})`
+      : "the router's forgedock_token_file",
+].join(", ");
+
+/**
+ * The pool token resolves through `poolToken(exec, router) -> {token, source}` (#5131: hostLaneIo wires execution.mjs
+ * poolCredential with the dispatch env, so preflight and lane dispatch resolve the same token), else `credential`/`router`
+ * (legacyPoolToken), and the router does not answer 401/403 to an authenticated ping. Details name sources, never values.
+ */
+export async function checkPoolAuth({ exec, router = null, credential = () => null, ping = null, poolToken = null }) {
   const code = C.PREFLIGHT_POOL_AUTH;
   if (!usesPool(exec)) return pass(code, "skipped: no remote or hybrid execution", "remote");
-  const name = exec.tokenEnv ?? "COMPUTESHARE_TOKEN";
-  const fromEnv = credential(name);
-  const token = fromEnv || router?.token || null;
-  if (!token) return fail(code, `pool token does not resolve: tried env/keychain ${name}, ${router ? "the router's forgedock_token_file" : "no router config (COMPUTESHARE_CONFIG / ~/.config/computeshare/router.json)"}`, "remote");
+  const { token, source } = (poolToken ?? legacyPoolToken(credential))(exec, router) ?? {};
+  if (!token) return fail(code, `pool token does not resolve: tried ${sourcesTried(exec, router)}`, "remote");
   const endpoint = exec.endpoint ?? router?.endpoint ?? null;
-  if (!endpoint || typeof ping !== "function") return pass(code, `token resolved from ${fromEnv ? name : "forgedock_token_file"}`, "remote");
+  if (!endpoint || typeof ping !== "function") return pass(code, `token resolved from ${source}`, "remote");
   let r = null;
   try { r = await ping(endpoint, token); } catch { r = null; }
-  if ([401, 403].includes(r?.status)) return fail(code, `router ${endpoint} answered HTTP ${r.status} to the token from ${fromEnv ? name : "forgedock_token_file"}`, "remote");
-  return pass(code, `token resolved from ${fromEnv ? name : "forgedock_token_file"}${r ? "" : "; router unreachable (not an auth failure)"}`, "remote");
+  if ([401, 403].includes(r?.status)) return fail(code, `router ${endpoint} answered HTTP ${r.status} to the token from ${source}`, "remote");
+  return pass(code, `token resolved from ${source}${r ? "" : "; router unreachable (not an auth failure)"}`, "remote");
 }
 
 /** Every online pool agent runs the CLI's version. `agents` is the router's `GET /agents` list (each spreads versionOf: version, image). */
@@ -99,9 +128,11 @@ export async function runLaneChecks({ exec = null, env = process.env, cliVersion
   let router = null;
   try { router = io.router?.() ?? null; } catch { router = null; }
   const ping = io.ping ?? null;
-  const agentsOf = async () => { try { return (await io.agents?.(exec?.endpoint ?? router?.endpoint, exec?.tokenEnv ? (io.credential?.(exec.tokenEnv) ?? router?.token) : router?.token)) ?? null; } catch { return null; } };
+  // #5131: one resolver for the auth check and the agents read: io.poolToken (poolCredential), else the injected credential/router.
+  const poolToken = io.poolToken ?? legacyPoolToken(io.credential ?? (() => null));
+  const agentsOf = async () => { try { return (await io.agents?.(exec?.endpoint ?? router?.endpoint, poolToken(exec, router)?.token ?? null)) ?? null; } catch { return null; } };
   return Promise.all([
-    safe(C.PREFLIGHT_POOL_AUTH, "remote", () => checkPoolAuth({ exec, router, credential: io.credential, ping })),
+    safe(C.PREFLIGHT_POOL_AUTH, "remote", () => checkPoolAuth({ exec, router, poolToken, ping })),
     safe(C.PREFLIGHT_POOL_VERSION, "remote", async () => checkPoolVersion({ exec, agents: usesPool(exec) ? await agentsOf() : null, cliVersion: cliV })),
     safe(C.PREFLIGHT_PATH_LOOP, "all", () => checkPathLoop({ env: { ...env, PATH: env.PATH ?? "" }, ...(io.loops ? { loops: io.loops } : {}) })),
     safe(C.PREFLIGHT_GH_FIELDS, "all", () => (io.ghExec ? checkGhFields({ exec: io.ghExec }) : pass(C.PREFLIGHT_GH_FIELDS, "skipped: no gh", "all"))),
@@ -113,7 +144,7 @@ export const formatLaneChecks = (checks) => checks.map((c) => `${c.ok ? "PASS" :
 
 /** Real-host io for the daemon, the batch and `doctor --lanes`. gh output is cached per process (it cannot change under a running engine). */
 export async function hostLaneIo({ env = process.env } = {}) {
-  const { poolRouterConfig } = await import("./execution.mjs");
+  const { poolCredential, poolRouterConfig } = await import("./execution.mjs");
   const { resolveCredential } = await import("./credentials.mjs");
   const { execFile } = await import("node:child_process");
   const call = (url, token, timeoutMs = 5000) => fetch(url, { headers: token ? { authorization: `Bearer ${token}` } : {}, signal: AbortSignal.timeout(timeoutMs) });
@@ -122,6 +153,7 @@ export async function hostLaneIo({ env = process.env } = {}) {
   return {
     router: () => poolRouterConfig({ env }),
     credential: (n) => resolveCredential(n, { env }),
+    poolToken: (exec, router) => poolCredential(exec, { env, router }), // #5131: the dispatch resolver on the dispatch env
     ping: async (endpoint, token) => ({ status: (await call(`${endpoint}/status`, token)).status }),
     agents: async (endpoint, token) => { const r = await call(`${endpoint}/agents`, token); return r.ok ? (await r.json())?.agents ?? null : null; },
     ghExec: (args) => { const k = args.join(" "); if (!memo.has(k)) memo.set(k, run(args)); return memo.get(k); },

package/bin/lean/lanecheck.test.mjs

@@ -31,6 +31,29 @@ describe("pool_auth", () => {
   });
 });
 
+describe("pool_auth shared resolver (#5131)", () => {
+  const remote = { mode: "remote", provider: "remote", endpoint: "https://runner.example.com", tokenEnv: "COMPUTESHARE_TOKEN" };
+  const router = { endpoint: "http://127.0.0.1:7710", token: "router-tok" };
+  it("5131: FAILs remote on a non-matching endpoint although a router token exists, naming sources never the value", async () => {
+    const a = await checkPoolAuth({ exec: remote, router, credential: () => null });
+    assert.equal(a.ok, false); assert.equal(a.code, "preflight.pool_auth"); assert.equal(a.scope, "remote");
+    assert.match(a.detail, /COMPUTESHARE_TOKEN/); assert.match(a.detail, /not the local router/); assert.doesNotMatch(a.detail, /router-tok/);
+    const viaIo = await checkPoolAuth({ exec: remote, router, poolToken: () => ({ token: null, source: null }) });
+    assert.equal(viaIo.ok, false);
+    assert.equal((await checkPoolAuth({ exec: { ...remote, endpoint: "http://127.0.0.1:7710/" }, router, credential: () => null })).ok, true, "matching endpoint: router token applies");
+  });
+  it("5131: runLaneChecks uses io.poolToken for the auth check and the agents read, and FAILs a rejected token", async () => {
+    const calls = [];
+    const io = { router: () => router, poolToken: (exec, r) => { calls.push([exec.provider, r?.endpoint]); return { token: "tok", source: "token_file" }; },
+      ping: async (_e, t) => ({ status: t === "tok" ? 401 : 200 }), agents: async (_e, t) => { calls.push(["agents", t]); return []; } };
+    const checks = await runLaneChecks({ exec: remote, env: { PATH: "" }, io: { ...io, loops: () => [] } });
+    const auth = checks.find((c) => c.code === "preflight.pool_auth");
+    assert.equal(auth.ok, false); assert.match(auth.detail, /HTTP 401/); assert.match(auth.detail, /token_file/); assert.doesNotMatch(auth.detail, /\btok\b/);
+    assert.ok(calls.some((c) => c[0] === "agents" && c[1] === "tok"));
+    assert.ok(calls.some((c) => c[0] === "remote" && c[1] === router.endpoint));
+  });
+});
+
 describe("pool_version", () => {
   it("reports the agent, image version, CLI version and upgrade command", () => {
     const c = checkPoolVersion({ exec: pool, cliVersion: "1.39.0", agents: [{ name: "a1", ok: true, version: "1.37.0" }, { name: "a2", ok: true, version: "1.39.0" }] });

package/bin/lean/lean.mjs

@@ -32,7 +32,7 @@ import { runChecks, runWithTimeoutRetry, planPrecheck, worktreeFingerprint, self
 import { retrying, ghCacheRetry, refreshAuthOnce, runRefreshScript, GH_AUTH_RE, GH_AUTH_RETRY_SECONDS, PUSH_TRANSIENT_RE, PUSH_PERMANENT_RE, GH_TRANSIENT_RE, MERGE_TRANSIENT_RE, MERGE_CONFLICT_RE } from "./retry.mjs";
 import { renderInvestigation, renderImplementation, renderReview, renderPrBody, renderTrajectory, renderContract, renderAmendments, renderShadowReview, parseContractComment, parseAmendmentsComment, contractJson, capComment, sanitizeMd, MAX_COMMENT_CHARS, recoveryEvidence } from "./render.mjs";
 import { parseVerifierConfig, pickVerifierModel, changedSymbols, callersOf, verifierBudget, verifierPrompt, parseVerifierFindings, findingsToFailures, renderVerifierNote, VERIFIER_SYSTEM } from "./verifier.mjs";
-import { computeTrigger, riskPathHits, TRIGGER_MODES } from "./review-trigger.mjs";
+import { computeTrigger, riskPathHits, TRIGGER_MODES, pathDomains, parseEnforceDomains } from "./review-trigger.mjs";
 import { hostCapabilityBlock, contractHostNeeds } from "./execution.mjs";
 
 const MISSING_TOOL_RE = /command not found|not found in PATH|no such file or directory.*\b(?:docker|promtool)\b|\b(?:docker|promtool)\b[^\n]{0,80}(?:not (?:installed|found|available)|no such file|cannot connect|daemon)|cannot connect to the docker daemon|no docker daemon|no module named|ModuleNotFoundError|\bENOENT\b[^\n]{0,60}spawn/i;
@@ -205,7 +205,8 @@ export function isProtectedLaneBranch(b, { issue, lane = null, branches = {}, de
  * @param {"off"|"report"} [o.conformanceMutation] forge.yaml engine.conformance_mutation (#4913): rerun each evidence test with the change reverted; a survivor is conformance.mutation_survived (shadow unless conformance_kinds enforces it)
  * @param {Record<string,"enforce"|"shadow">} [o.conformanceKinds] forge.yaml engine.conformance_kinds: a failure code's own mode (enforce blocks, shadow is recorded only); others follow `conformance`
  * @param {"needs-human"|"degraded"} [o.reviewIncomplete] shadow only: what an incomplete review after the re-ask does (default needs-human)
- * @param {object} [o.reviewTrigger] forge.yaml review.trigger/risk_paths (#4273): {mode: shadow (default)|enforce|off, riskPaths: globs}
+ * @param {object} [o.reviewTrigger] forge.yaml review.trigger/risk_paths (#4273): {mode: shadow (default)|enforce|off, riskPaths: globs,
+ *                                   enforceDomains: review.enforce_domains (#5099), a touched listed domain makes the lane enforce}
  * @param {object} [o.verifier]      forge.yaml review.verifier/verifier_model (#4397): {mode: off (default)|shadow|enforce, model}
  * @param {object} [o.verify]        forge.yaml verify (verify.mjs parseVerify): mode local (default) | ci | hybrid (#4167)
  * @param {object} [o.precheck]      {commands, maxMinutes}: forge.yaml learned.test_commands, run in the worktree before the PR (#4240);
@@ -239,6 +240,7 @@ export async function runCore(o) {
   const remoteVerify = vcfg.mode !== "local";
   const triggerMode = TRIGGER_MODES.includes(o.reviewTrigger?.mode) ? o.reviewTrigger.mode : "shadow";
   const riskPaths = Array.isArray(o.reviewTrigger?.riskPaths) ? o.reviewTrigger.riskPaths : [];
+  const enforceDomains = parseEnforceDomains(o.reviewTrigger?.enforceDomains ?? []); // #5099
   const verifierCfg = parseVerifierConfig(o.verifier ?? {});
   const routingCfg = parseBuilderRouting(o.builderRouting ?? {});
   // #4394: the build's model tier, routed from the frozen contract; a failed validate round on the mid tier escalates once
@@ -336,6 +338,7 @@ export async function runCore(o) {
   let guardAddedMs = 0; // #4705 (R12): wall time the guard gate added, summed over the lane, carried on RUN_TERMINAL
   let shadowWould = null; // forge#4165: the shadow gate's verdict, carried on RUN_TERMINAL (no telemetry write of its own)
   const kinds = normalizeKindModes(conformanceKinds); // engine.conformance_kinds: a failure code's own mode
+  let domains = [], domainsLogged = null; // #5099: review domains the diff touches (review-roster.sh path triggers)
   let riskEnforced = null, gateRan = false; // #4398: declared risk paths that made a shadow lane enforce (sticky); the gate ran
   let done = null, finishing = null, wtCreated = false, salvagedRef = null;
   let light = false, modelMs = 0; // #4451: the light lane finished without an upgrade (the same structure/hotspot gates as the full lane, #4502); summed session time
@@ -2211,7 +2214,7 @@ export async function runCore(o) {
         await renew();
         const rr = await callRunner({ role: "reviewer", issue, cwd: wt, model: reviewerModel, resume: null, system: REVIEWER_SYSTEM, readOnly: true,
           prompt: repair ? reviewerRepairPrompt({ missing: d.missing ?? [], problems: d.failures.map((f) => f.detail), rows: first })
-            : reviewerPrompt({ issue: iss, comments: trustedComments, contract: effective, result, files, diff, stat, base, structure: structureLine, ignore: IGNORE, investigationVerdict: investigationVerdict(await io.fs.read(`${wt}/.forge-lean/investigation.md`).catch(() => null)) }) });
+            : reviewerPrompt({ issue: iss, comments: trustedComments, contract: effective, result, files, diff, stat, base, structure: structureLine, ignore: IGNORE, domains, investigationVerdict: investigationVerdict(await io.fs.read(`${wt}/.forge-lean/investigation.md`).catch(() => null)) }) });
         await renew();
         await attempt("review", ++reviewN, rr, null, "review");
         const parsed = parseReview(rr?.text);
@@ -2342,6 +2345,20 @@ export async function runCore(o) {
         ev({ event: "CONFORMANCE_RISK_ENFORCED", paths: hits });
         T.decisions.push(`Conformance enforced (review.risk_paths): ${hits.slice(0, 10).join(", ")}${hits.length > 10 ? ` and ${hits.length - 10} more` : ""}`);
       }
+      // #5099: the domains the diff touches get domain checks in the review; a review.enforce_domains hit enforces (sticky)
+      const pd = pathDomains(files);
+      const dErr = "Review domains unavailable: scripts/review-roster.sh failed; reviewed without domain checks";
+      if (pd === null && !T.anomalies.includes(dErr)) T.anomalies.push(dErr);
+      domains = pd ?? [];
+      const dHits = shadow ? domains.filter((d) => enforceDomains.includes(d)) : [];
+      if (dHits.length) {
+        shadow = false; riskEnforced = dHits.map((d) => `domain:${d}`);
+        T.decisions.push(`Conformance enforced (review.enforce_domains): ${dHits.join(", ")}`);
+      }
+      if (domainsLogged !== domains.join(",")) {
+        domainsLogged = domains.join(",");
+        ev({ event: "REVIEW_DOMAINS", domains, enforced: dHits.length ? dHits : undefined, ...(pd === null ? { error: "roster.failed" } : {}) });
+      }
       if (!amendFixed && sessionId && amendmentKindProblems(result?.amendments).length) { // #5089: one in-lane correction, outside the conformance resume budget
         amendFixed = true;
         const bad = amendmentKindProblems(result.amendments);

package/bin/lean/lean.test.mjs

@@ -1659,6 +1659,24 @@ describe("conformance shadow mode (the default)", () => {
     assert.ok(traj(w)[0].includes("| Close | issue closed (partial) |"));
   });
 
+  it("#5099 a web/ diff gets frontend domain checks in the reviewer prompt; review.enforce_domains makes the lane enforce", async () => {
+    const k = { ...CONTRACT, preserve: [] }, changed = ["web/app/page.tsx", "test/foo.test.js"];
+    const seenPrompts = (w) => { const out = [], r0 = w.io.runner; w.io.runner = async (c) => { if (c.role === "reviewer") out.push(c.prompt); return r0(c); }; return out; };
+    const dir = tmpDir("dom-"), s = world({ contract: k, changed, reviews: [omission()] }), ps = seenPrompts(s);
+    const rs = await runShadow(s, { dir });
+    assert.equal(rs.terminalReason, "merged", "without enforce_domains the lane stays shadow");
+    assert.match(ps[0], /<domain_checks>[\s\S]*regressions row[\s\S]*- frontend: [\s\S]*not-found\/error boundary/);
+    assert.deepEqual(readLog(dir, 7).filter((e) => e.event === "REVIEW_DOMAINS").map((e) => e.domains), [["frontend"]]);
+    const plain = world({ contract: k, reviews: [ok({}, k)] }), pp = seenPrompts(plain);
+    await runShadow(plain);
+    assert.ok(!pp[0].includes("<domain_checks>"), "no domain touched: no domain block");
+    const e = world({ contract: k, changed, reviews: [omission(), omission()] });
+    const re = await runShadow(e, { reviewTrigger: { mode: "shadow", riskPaths: [], enforceDomains: ["frontend"] } });
+    assert.equal(re.terminalReason, "needs-human"); assert.equal(e.merges.length, 0);
+    assert.deepEqual(re.conformance, { mode: "enforce", would: null, risk: true });
+    assert.ok(traj(e)[0].includes("Conformance enforced (review.enforce_domains): frontend"));
+  });
+
   it("#4398 an investigation whose answer the review marks deferred is tracked before the PR and closes partial, even though shadow merges it", async () => {
     const k = { ...CONTRACT, preserve: [] };
     const w = world({ title: "investigate: foo", contract: k, reviews: [conf({ requirements: [{ id: "R1", status: "deferred", evidence: "", validated_by: "", note: "question open" }] }, k)] });
@@ -5930,6 +5948,8 @@ describe("review trigger (#4273): shadow logs and always reviews, enforce skips
     assert.deepEqual(at('review:\n  trigger: enforce\n  risk_paths: "db/**, *.sql"\n'), { mode: "enforce", riskPaths: ["db/**", "*.sql"] });
     assert.deepEqual(at("review:\n  tech_stack: x\n  risk_paths:\n    - \"infra/**\"\n    - lib/acct/*.ts  # c\n  trigger: bogus\n"), { mode: "shadow", riskPaths: ["infra/**", "lib/acct/*.ts"] });
     assert.equal(at("engine:\n  path: core\n"), undefined);
+    assert.deepEqual(at('review:\n  enforce_domains: "Frontend, bogus"\n'), { mode: "shadow", riskPaths: [], enforceDomains: ["frontend"] }, "#5099");
+    assert.deepEqual(at("review:\n  enforce_domains:\n    - auth\n  risk_paths:\n    - db/**\n"), { mode: "shadow", riskPaths: ["db/**"], enforceDomains: ["auth"] }, "#5099 block lists");
   });
 });
 

package/bin/lean/orchestrate.mjs

@@ -4,7 +4,8 @@
  * Thin orchestrate: run core work-on for several issues with bounded concurrency, honouring `Depends on` / `Blocked by`
  * among the given issues (wait for the dependency to merge; skip when it ends anywhere but merged/invalid).
  * A `dependency-open` run is requeued behind its dependencies, pulling an out-of-set one into the batch; a
- * `decomposed` run adds its sub-issues and its dependents wait on them instead (#4124). A dependency that is parked
+ * `decomposed` run adds its sub-issues and its dependents wait on them instead (#4124); an issue read later (`--add`,
+ * `--requeue`, a resume, a body re-read) resolves a decomposed dependency to its sub-issues too (#5112). A dependency that is parked
  * (ended needs-human in this batch, or an out-of-set issue labelled needs-human per `issueLabels(n)`) is never pulled in:
  * the issue ends `skipped` (`dependency #N needs-human`) and its dependents with it (#4387).
  * A skipped dependent whose blocker later closes or merges outside its lane is re-admitted (#4595, needs `dispatchCheck`).
@@ -21,6 +22,8 @@
  * `deferred` is a scheduling fact, not an end: each typed code is requeued with its retry-at (`deferPolicy`), a usage
  * limit holds admissions for that account until its reset, and deferrals other than a wait (`host.busy`,
  * `sandbox.capacity`, #4528; `sandbox.unreachable`, #4788; `rate_limited`, #4784) stop after `maxDeferrals`.
+ * #5112: with `remote.offlineFallback` (`execution.fallback_local`), an issue deferred `remote.capacityFallbackAfter` times (default
+ * `CAPACITY_FALLBACK_AFTER`) for `sandbox.capacity` runs on the host when `remote.headroom()` (host-busy guard) allows it.
  * Usage-limit holds (#4190) are keyed by backend identity in `limits` (the host store, shared by every batch on the
  * host; in memory when absent): admission checks the hold of `identity()`, the account the next lane would use. While held, the
  * batch re-reads the store every `pollMs` (#4446), so `forgedock limits clear` admits on the next poll, not at the reset.
@@ -136,6 +139,8 @@ export const HOST_BUSY_RETRY_S = 60;
 // #4788: an unreachable pool is a wait too (the lane already retried for unreachable_window_min); a stall is reported by poolStall.
 const UNCAPPED_DEFERRALS = new Set(["host.busy", "sandbox.capacity", "sandbox.unreachable", "lane.unresolved"]);
 export const POOL_OFFLINE_ALERT_MIN = 10;
+// #5112: `sandbox.capacity` deferrals of one issue after which `execution.fallback_local` runs it on the host (headroom permitting).
+export const CAPACITY_FALLBACK_AFTER = 3;
 export const RATE_LIMIT_FALLBACK_S = 15 * 60;
 export const DEFER_BACKOFF_S = 120;
 export const DEFER_BACKOFF_MAX_S = 30 * 60;
@@ -274,6 +279,8 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   const notBefore = toMap(saved?.notBefore);
   const requeues = toMap(saved?.requeues);
   const deferrals = toMap(saved?.deferrals);
+  const capDefers = toMap(saved?.capDeferrals); // #5112: issue -> `sandbox.capacity` deferrals (uncapped, so not in `deferrals`)
+  const capFellBack = new Set(); // #5112: issues already reported as a capacity fallback (one decision each)
   const engineErrors = toMap(saved?.engineErrors);
   const checked = toMap(saved?.prefilter); // issue -> pre-filter result
   const estimates = toMap(saved?.estimates); // #4409: issue -> estimated lane minutes; only with `estimate`
@@ -358,7 +365,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   const save = () => {
     if (!store || halted) return;
     store.save({ v: 1, ...(setup ? { phase: "setup", setup: { ...setup } } : {}), order, deps: toObj(deps), lanes: toObj(lanes), crossSeen: [...crossSeen], results: toObj(results), running: toObj(runRecs),
-      pending, notBefore: toObj(notBefore), requeues: toObj(requeues), deferrals: toObj(deferrals), engineErrors: toObj(engineErrors), ...(quota.size ? { quota: toObj(quota) } : {}),
+      pending, notBefore: toObj(notBefore), requeues: toObj(requeues), deferrals: toObj(deferrals), engineErrors: toObj(engineErrors), ...(quota.size ? { quota: toObj(quota) } : {}), ...(capDefers.size ? { capDeferrals: toObj(capDefers) } : {}),
       prefilter: toObj(checked), errorTimes, breaker: tripped, ...(budget ? { classes: toObj(classes), dispatch: { ...dispatch } } : {}),
       ...(reg ? { priorities: toObj(priorities) } : {}), ...(sandboxUse.size ? { sandbox: toObj(sandboxUse) } : {}),
       ...(recoveries.size || recovering.size ? { recoveries: toObj(recoveries), recovering: toObj(recovering), recoveryClasses: toObj(classUsed) } : {}),
@@ -391,6 +398,26 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     if (typeof trusted === "function") { let ok = false; try { ok = (await trusted(n)) === true; } catch { ok = false; } if (!ok) return []; }
     return parseDeps(body, n);
   };
+  // #5112: a dependency that ended `decomposed` (sub-issues joined, mode not off) is its sub-issues, to a fixpoint; used on every edge write.
+  const throughDecomposed = (ds) => {
+    if (!joinsDecomposed(autoChildren?.mode ?? "decomposed")) return [...new Set(ds)];
+    const out = [], seen = new Set(), stack = [...ds].reverse();
+    while (stack.length) {
+      const d = stack.pop();
+      if (seen.has(d)) continue;
+      seen.add(d);
+      const r = results.get(d), subs = r?.outcome === "decomposed" && Array.isArray(r.subissues) ? r.subissues.filter((x) => Number.isSafeInteger(x) && x > 0) : [];
+      if (subs.length) stack.push(...[...subs].reverse()); else out.push(d);
+    }
+    return [...new Set(out)];
+  };
+  // #5112: the issue's declared edges re-read from its body (null when unreadable: the caller keeps what it has).
+  const reread = async (n) => {
+    let body;
+    try { body = await readBody(n); } catch { return null; }
+    if (drift?.holds) bodies.set(n, body);
+    return declared(n, body);
+  };
   const readDeps = async (n) => {
     let body = "";
     try { body = await readBody(n); } catch { /* unreadable: no ordering info, work-on's own check still applies */ }
@@ -401,7 +428,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     await readPriority(n);
     if (resolveLane) { let l; try { l = await resolveLane(n); } catch (e) { l = { ok: false, code: "lane.unresolved", detail: e?.message ?? String(e), transient: true }; } lanes.set(n, l); }
     // deps marks the issue read (a resume skips it): set it last, so a concurrent setup save never persists a half-read issue (#4963)
-    deps.set(n, d);
+    deps.set(n, throughDecomposed(d));
   };
   const edges = (n) => (deps.get(n) ?? []).filter((d) => set.has(d));
   // A milestone issue waiting on a staging fix (or the reverse) never sees that fix on its own base: surface the edge.
@@ -516,6 +543,15 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     }
     return "busy";
   };
+  // #5112: opt-in (`execution.fallback_local`): an issue the pool refused `capacityFallbackAfter` times (default CAPACITY_FALLBACK_AFTER)
+  // for `sandbox.capacity` runs on the host when the host-busy guard (`remote.headroom()`, absent = allowed) passes; not ok or a throw waits.
+  const capacityFallback = (n) => {
+    if (!remote?.offlineFallback) return false;
+    const after = Number.isInteger(remote.capacityFallbackAfter) && remote.capacityFallbackAfter > 0 ? remote.capacityFallbackAfter : CAPACITY_FALLBACK_AFTER;
+    if ((capDefers.get(n) ?? 0) < after) return false;
+    if (typeof remote.headroom !== "function") return true;
+    try { return remote.headroom()?.ok !== false; } catch { return false; }
+  };
   // A host slot for `n` (a lane-refused issue runs nothing and needs none); refused: `n` stays queued in the registry.
   // true: start it; false: no capacity now; "busy" (#4481): another batch runs `n`, try the next issue.
   const grant = (n, wanted) => {
@@ -555,6 +591,13 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
         // #4547: opt-in (`execution.fallback_local`): every pool agent offline or asleep (sampled online 0) runs the lane on the host.
         if (remote.offlineFallback && cap && cap.online === 0) {
           p = { where: "local", reason: `fallback to local: no pool agent online (${p.reason})` };
+        } else if (capacityFallback(n)) {
+          p = { where: "local", reason: `fallback to local: pool at capacity after ${capDefers.get(n)} deferrals (${p.reason})` };
+          if (!capFellBack.has(n)) {
+            capFellBack.add(n);
+            decided({ issue: n, what: `run #${n} on the host: the pool refused it ${capDefers.get(n)} times for capacity (execution.fallback_local)`, why: "sustained sandbox.capacity and the host has headroom",
+              alternative: "keep deferring until a pool slot frees" });
+          }
         } else if (cap && Number.isInteger(cap.free)) {
           if (cap.at !== capAt) { capAt = cap.at; capAdmits = 0; }
           if (capWait.blocked(n, cap)) { notBefore.set(n, now() + Math.max(pollMs, 1)); return false; }
@@ -664,7 +707,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     if (row.outcome === "dependency-open" && depList.length && (requeues.get(n) ?? 0) < MAX_REQUEUES) {
       // A scheduling fact, not a failure: add the edge, pull the dependency in, and run this issue again after it.
       requeues.set(n, (requeues.get(n) ?? 0) + 1);
-      deps.set(n, [...new Set([...(deps.get(n) ?? []), ...depList])]);
+      deps.set(n, throughDecomposed([...(deps.get(n) ?? []), ...depList]));
       await addIssues(depList);
       // Dependencies already done but still open on GitHub: a delay instead of a hot relaunch loop.
       const allDone = depList.every((d) => results.has(d) && SATISFIED.has(results.get(d).outcome));
@@ -686,6 +729,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       if (r?.code === "sandbox.unreachable") notePool(true, r.detail ?? "sandbox unreachable");
       if (r?.code === "sandbox.capacity") {
         capWait.refused(n);
+        capDefers.set(n, (capDefers.get(n) ?? 0) + 1); // #5112: counted for the fallback_local capacity fallback
         try { capGated = Number.isInteger(remote?.capacity?.()?.free); } catch { capGated = false; }
       }
       if (!pol.capped) {
@@ -929,10 +973,8 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     if (!fresh.length) return kids;
     // An edge an operator wrote into a pending issue after the batch started (it waits on an added issue) holds too.
     for (const n of pending) {
-      let body;
-      try { body = await readBody(n); } catch { continue; }
-      if (drift?.holds) bodies.set(n, body);
-      deps.set(n, [...new Set([...(deps.get(n) ?? []), ...(await declared(n, body))])]);
+      const d = await reread(n);
+      if (d) deps.set(n, throughDecomposed([...(deps.get(n) ?? []), ...d]));
     }
     await addIssues(fresh);
     save();
@@ -964,10 +1006,8 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       .filter((n) => { try { return !(reg?.holder && reg.holder(entryOf(n)) != null); } catch { return true; } });
     if (!fresh.length) return 0;
     for (const n of pending) {
-      let body;
-      try { body = await readBody(n); } catch { continue; }
-      if (drift?.holds) bodies.set(n, body);
-      deps.set(n, [...new Set([...(deps.get(n) ?? []), ...(await declared(n, body))])]);
+      const d = await reread(n);
+      if (d) deps.set(n, throughDecomposed([...(deps.get(n) ?? []), ...d]));
     }
     await addIssues(fresh);
     save();
@@ -980,7 +1020,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     return fresh.length;
   };
   // #4550: `--requeue` entries (batch `requeue` file) not applied yet: a terminal issue and the dependents skipped behind it
-  // return to pending, the prior rows kept in history; edges stay, so a dependent still waits for the issue to merge.
+  // return to pending, the prior rows kept in history; their `Depends on` edges are re-read from the body and replaced (#5112).
   const drainRequeues = async () => {
     if (!getRequeued) return 0;
     let got = [];
@@ -1000,14 +1040,25 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
         }
       }
       for (const m of moved) {
-        for (const x of [requeues, deferrals, engineErrors, recoveries, recovering]) x.delete(m);
+        for (const x of [requeues, deferrals, capDefers, engineErrors, recoveries, recovering]) x.delete(m);
         relabelled.delete(m);
         if (m === e.issue) requeuedInfo.set(m, { reason: e.reason, by: e.by, at: e.at, prior: [...(requeuedInfo.get(m)?.prior ?? []), priors.get(m)] });
         if (!pending.includes(m)) requeue(m, 0);
       }
+      // #5112: the requeued issues' `Depends on` edges are re-read and replaced, so a body edit drops or repoints an edge
+      // (a decomposed dependency resolves to its sub-issues); an unreadable body keeps the edges it had.
+      const edited = [];
+      for (const m of moved) {
+        const d = await reread(m);
+        if (!d) continue;
+        const before = deps.get(m) ?? [], after = throughDecomposed(d);
+        deps.set(m, after);
+        if (before.length !== after.length || before.some((x) => !after.includes(x))) edited.push(`#${m} -> ${after.length ? after.map((x) => `#${x}`).join(", ") : "none"}`);
+      }
+      noteCrossLane();
       save();
       const list = moved.filter((m) => m !== e.issue).map((m) => `#${m}`);
-      decided({ issue: e.issue, what: `requeued by ${e.by ?? "operator"} (forgedock orchestrate --requeue); prior outcome ${row.outcome}${list.length ? `; dependents back to pending: ${list.join(", ")}` : ""}`,
+      decided({ issue: e.issue, what: `requeued by ${e.by ?? "operator"} (forgedock orchestrate --requeue); prior outcome ${row.outcome}${list.length ? `; dependents back to pending: ${list.join(", ")}` : ""}${edited.length ? `; edges re-read: ${edited.join("; ")}` : ""}`,
         why: e.reason || "operator decision", alternative: "start a second batch" });
       update({ issue: e.issue, outcome: "requeued", detail: `${e.reason || "operator decision"} (was ${row.outcome})` });
       for (const m of moved) if (m !== e.issue) update({ issue: m, outcome: "requeued", detail: `dependency #${e.issue} requeued`, trigger: e.issue }); // #4687

package/bin/lean/prompts.mjs

@@ -463,12 +463,25 @@ export function decisionNote(comments = []) {
   return kept.length ? `\n\nBinding decisions posted after the contract froze (trusted; they override the issue text where they conflict, and the frozen contract still applies):\n${kept.join("\n---\n")}` : "";
 }
 
-export function reviewerPrompt({ issue, comments = [], contract, result, files = [], diff, stat = "", base = "", structure = "", ignore = [`${LEAN_DIR}/`], skeleton = null, investigationVerdict = null }) {
+/** #5099: one check line per review domain (domains from review-trigger.mjs pathDomains); mirrors the /review-pr personas. */
+export const DOMAIN_CHECKS = Object.freeze({
+  frontend: "Dynamic API in a static/ISR tree: a headers(), cookies(), connection() or searchParams read in a layout, a not-found/error boundary or a module they import, when the route tree is static or ISR (revalidate, generateStaticParams, dynamic = 'force-static'), opts the route out of static rendering or throws at render and turns pages into HTTP 500.",
+});
+
+/** #5099: the <domain_checks> block for the domains the diff touches; "" when none. */
+export function domainChecksBlock(domains = []) {
+  const ds = [...new Set((domains ?? []).map(String).filter(Boolean))].sort();
+  if (!ds.length) return "";
+  const lines = ds.map((d) => `- ${d}: check the diff for breakage in this domain.${DOMAIN_CHECKS[d] ? ` ${DOMAIN_CHECKS[d]}` : ""}`);
+  return `\n<domain_checks>\nThis diff touches these review domains. Report every finding below as a regressions row with path:line (it blocks the merge).\n${lines.join("\n")}\n</domain_checks>`;
+}
+
+export function reviewerPrompt({ issue, comments = [], contract, result, files = [], diff, stat = "", base = "", structure = "", ignore = [`${LEAN_DIR}/`], skeleton = null, investigationVerdict = null, domains = [] }) {
   const notes = comments.map((c) => String(c?.body ?? "")).filter((b) => !/^<!-- FORGE:/.test(b.trim()));
   const decisions = comments.filter((c) => isDecision(c?.body) && isTrustedIssueComment(c)).map((c) => String(c.body)); // #4901: operator decisions bind the review; other FORGE: records stay out
   notes.push(...decisions);
   const sk = JSON.stringify(skeleton ?? reviewSkeleton(contract ?? {}, files, ignore), null, 1);
-  return `Issue #${issue.number}: ${issue.title}\n\n<issue_body>\n${cap(issue.body ?? "", 20000)}\n</issue_body>\n\n<issue_comments>\n${cap(notes.join("\n---\n"), 8000)}\n</issue_comments>\n\n<contract>\n${cap(JSON.stringify(contract ?? {}, null, 1), 12000)}\n</contract>\n\n<builder_result>\n${cap(JSON.stringify(result ?? {}, null, 1), 6000)}\n</builder_result>\n\n${investigationVerdict ? `<investigation_verdict>${investigationVerdict}</investigation_verdict>\n${VERDICT_RULE}\n\n` : ""}<changed_files>\n${files.join("\n")}\n</changed_files>\n\n<rubric>\n${REVIEW_RUBRIC}\n</rubric>\n\n<row_skeleton>\n${cap(sk, 30000)}\n</row_skeleton>\n\n<diff>\n${boundDiff(diff, { stat, base })}\n</diff>${structure ? `\n<structure>${String(structure).replace(/[\r\n]+/g, " ")}</structure>` : ""}`;
+  return `Issue #${issue.number}: ${issue.title}\n\n<issue_body>\n${cap(issue.body ?? "", 20000)}\n</issue_body>\n\n<issue_comments>\n${cap(notes.join("\n---\n"), 8000)}\n</issue_comments>\n\n<contract>\n${cap(JSON.stringify(contract ?? {}, null, 1), 12000)}\n</contract>\n\n<builder_result>\n${cap(JSON.stringify(result ?? {}, null, 1), 6000)}\n</builder_result>\n\n${investigationVerdict ? `<investigation_verdict>${investigationVerdict}</investigation_verdict>\n${VERDICT_RULE}\n\n` : ""}<changed_files>\n${files.join("\n")}\n</changed_files>\n\n<rubric>\n${REVIEW_RUBRIC}\n</rubric>\n\n<row_skeleton>\n${cap(sk, 30000)}\n</row_skeleton>\n\n<diff>\n${boundDiff(diff, { stat, base })}\n</diff>${structure ? `\n<structure>${String(structure).replace(/[\r\n]+/g, " ")}</structure>` : ""}${domainChecksBlock(domains)}`;
 }
 
 /**

package/bin/lean/review-trigger.mjs

@@ -7,6 +7,7 @@
  * log REVIEW_TRIGGER, always review), enforce (skip the reviewer when not triggered), off (today's behaviour).
  * Run directly, it reports per repo how many would-skip lanes the reviewer flagged as nonconforming.
  */
+import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -43,6 +44,30 @@ export function parseRiskPaths(v) {
   return xs.map((x) => String(x ?? "").trim()).filter(Boolean);
 }
 
+/** #5099: the review domains a lane can touch, from scripts/review-roster.sh path triggers. */
+export const DOMAINS = Object.freeze(["api", "auth", "database", "frontend", "infra"]);
+const DOMAIN_OF_TRIGGER = Object.freeze({ "frontend-path": "frontend", "auth-path": "auth", "infra-path": "infra", "route-handler": "infra", "migration-path": "database", "sdk-path": "api" });
+const ROSTER = fileURLToPath(new URL("../../scripts/review-roster.sh", import.meta.url));
+
+/** forge.yaml review.enforce_domains (#5099): a comma-separated string or a list -> known domains, lowercased, unique. */
+export function parseEnforceDomains(v) {
+  return [...new Set(parseRiskPaths(v).map((x) => x.toLowerCase()).filter((x) => DOMAINS.includes(x)))].sort();
+}
+
+/**
+ * #5099: the domains the changed files touch, by the path triggers of the bundled scripts/review-roster.sh (the one
+ * source of the domain path rules). Sorted, unique; [] without files; null when the script fails (the caller logs it).
+ */
+export function pathDomains(files = [], { script = ROSTER } = {}) {
+  const list = [...new Set((files ?? []).map(String).filter(Boolean))];
+  if (!list.length) return [];
+  let out;
+  try { out = execFileSync("bash", [script, "--files-file", "-", "--changed-lines", "1"], { input: `${list.join("\n")}\n`, encoding: "utf8", timeout: 15000, stdio: ["pipe", "pipe", "ignore"] }); } catch { return null; }
+  const m = /^REASON=.*?triggers:([^\n]*)$/m.exec(String(out));
+  if (!/^SELECTED_AGENTS=/m.test(String(out))) return null;
+  return [...new Set((m ? m[1].trim().split(/\s+/) : []).map((t) => DOMAIN_OF_TRIGGER[t]).filter(Boolean))].sort();
+}
+
 /**
  * #4398: the changed files matching a declared forge.yaml review.risk_paths glob (sorted, unique). Only declared globs
  * count, never the built-in risk words: a hit makes the conformance gate enforce for that lane. [] without globs.

package/bin/lean/review-trigger.test.mjs

@@ -7,7 +7,8 @@ import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { computeTrigger, riskPathHits, parseRiskPaths, riskClassOf, triggerReport, readRunLogs, formatReport } from "./review-trigger.mjs";
+import { computeTrigger, riskPathHits, parseRiskPaths, riskClassOf, triggerReport, readRunLogs, formatReport, pathDomains, parseEnforceDomains } from "./review-trigger.mjs";
+import { reviewerPrompt, domainChecksBlock } from "./prompts.mjs";
 
 const HOT = { enabled: true, file_lines: 2000, growth_lines: 150, files: [] };
 const clean = (patch = {}) => computeTrigger({ files: ["src/foo.js", "test/foo.test.js"], hotspots: HOT, ...patch });
@@ -118,3 +119,29 @@ describe("triggerReport (#4273)", () => {
     assert.deepEqual(JSON.parse(cli.stdout)["o/a"].would_skip_flagged, 1);
   });
 });
+
+describe("pathDomains / domain checks (#5099)", () => {
+  it("maps review-roster.sh path triggers to domains: web/ is frontend", () => {
+    assert.deepEqual(pathDomains(["web/src/app/(site)/not-found.tsx"]), ["frontend"]);
+    assert.deepEqual(pathDomains(["src/auth/x.js", "app/api/route.ts", "db/migrations/0001.sql", "sdk/client.py"]), ["api", "auth", "database", "frontend", "infra"]);
+    assert.deepEqual(pathDomains(["src/foo.js"]), []);
+    assert.deepEqual(pathDomains([]), []);
+  });
+  it("a failing roster script is null (never throws)", () => {
+    assert.equal(pathDomains(["web/a.tsx"], { script: "/nonexistent/review-roster.sh" }), null);
+  });
+  it("parseEnforceDomains keeps known domains only", () => {
+    assert.deepEqual(parseEnforceDomains("Frontend, bogus , auth"), ["auth", "frontend"]);
+    assert.deepEqual(parseEnforceDomains(["infra", "infra"]), ["infra"]);
+    assert.deepEqual(parseEnforceDomains(undefined), []);
+  });
+  it("the reviewer prompt gains a frontend check only when frontend is touched, and is unchanged without domains", () => {
+    const args = { issue: { number: 7, title: "t", body: "b" }, contract: {}, diff: "" };
+    assert.equal(reviewerPrompt(args), reviewerPrompt({ ...args, domains: [] }));
+    assert.equal(domainChecksBlock([]), "");
+    const p = reviewerPrompt({ ...args, domains: ["frontend"] });
+    assert.ok(p.endsWith("</domain_checks>"));
+    assert.match(p, /- frontend: .*headers\(\), cookies\(\).*ISR/);
+    assert.match(p, /regressions row with path:line/);
+  });
+});

package/bin/lean/schedd.mjs

@@ -87,10 +87,11 @@ export function sanitizePath(path, { exclude = [], exists = existsSync, tmpRoots
 /**
  * The allowlisted part of `env`, with PATH sanitised. `passthrough` names extra keys to keep (`orchestration.env_passthrough`,
  * the configured `execution.token_env`); `pathExclude` is `orchestration.path_exclude`. Secret-looking names are dropped unless named.
+ * An empty value is never pinned, passthrough keys included (#5131: an empty pin would mask the daemon's secret).
  */
 export function batchEnv(env = process.env, { passthrough = [], pathExclude = [], exists = existsSync, tmpRoots } = {}) {
   const extra = new Set(passthrough);
-  const out = Object.fromEntries(Object.entries(env).filter(([k, v]) => typeof v === "string" && (extra.has(k) || (ENV_KEEP.test(k) && !SECRET_ENV.test(k)))));
+  const out = Object.fromEntries(Object.entries(env).filter(([k, v]) => typeof v === "string" && v !== "" && (extra.has(k) || (ENV_KEEP.test(k) && !SECRET_ENV.test(k)))));
   if (typeof out.PATH === "string") out.PATH = sanitizePath(out.PATH, { exclude: pathExclude, exists, ...(tmpRoots ? { tmpRoots } : {}) });
   return out;
 }
@@ -105,10 +106,17 @@ export function redactEnv(env) {
   return Object.fromEntries(Object.entries(env ?? {}).map(([k, v]) => [k, SECRET_ENV.test(k) ? "<redacted>" : v]));
 }
 
-/** `base` without its allowlisted non-secret keys (secret-named ones, e.g. GH_TOKEN, stay from the daemon: never pinned), plus `kept`: an account selector the client did not set never leaks in from the daemon. */
+/**
+ * `base` without its allowlisted non-secret keys, plus `kept`: an account selector the client did not set never leaks in from
+ * the daemon, and a pinned key wins. A secret-named key is only pinned when named (`env_passthrough`, `token_env`): a non-empty
+ * pin wins, as before #5131 (the operator chose that account); an empty secret pin never overrides the daemon's value (#5131).
+ */
 export function mergeEnv(base, kept) {
   const out = Object.fromEntries(Object.entries(base).filter(([k]) => k in kept || !ENV_KEEP.test(k) || SECRET_ENV.test(k)));
-  return { ...out, ...kept };
+  for (const [k, v] of Object.entries(kept)) {
+    if (!SECRET_ENV.test(k) || (typeof v === "string" && v !== "")) out[k] = v;
+  }
+  return out;
 }
 
 /** Take the daemon lock: `{took}` (the dead owner's pid it replaced, or null); null when another live daemon holds it. */