forgedock 1.48.1 → 1.50.0

package/bin/lean/lean.mjs

@@ -15,7 +15,7 @@ import { ciPollDelayMs, ENGINE_VERSION, DEFAULT_MAX_SESSION_LIMIT_PAUSES, DEFAUL
 import { openDependency, laneMergedPrs, dependencyOnLane, isTrustedComment, decomposedSubissues, isDecomposedRecord, reopenRevokedDecomposition } from "../engine/phases.mjs";
 import { createHash, randomBytes } from "node:crypto";
 import { otherLaneOwner } from "./lanelock.mjs";
-import { applyValidateRecipes, deferChecklessPostDeploy, reproEnvMiss, resolveForgedockPaths, describesUnrunnableCommand, removedPathsOf, TRACKED, normalizeKindModes, blockingFailures, unverifiedRequirements, mutationTargets, mutationFailures, runMutationCheck, MUTATION_SURVIVED, isBugIssue, scopeText, explainFailures, inIssue, validateContract, cliUsageError, normalizeRunnerCommand, applyAmendments, amendmentKindProblems, precheck, alreadyFixedOnBase, READONLY_PROD_RE, EXTERNAL_NEED_RE, repoTracks, dropScopeValidates, tagOutOfBand, parseReview, decide, mergeReviewRows, evidencePathOnly, closePlan, followupItems, bucketTally, pendingTracking, unnamedEdges, structureNote, impliedDocDeliverables } from "./conformance.mjs";
+import { applyValidateRecipes, deferChecklessPostDeploy, reproEnvMiss, resolveForgedockPaths, describesUnrunnableCommand, removedPathsOf, TRACKED, normalizeKindModes, blockingFailures, unverifiedRequirements, mutationTargets, mutationFailures, runMutationCheck, MUTATION_SURVIVED, isBugIssue, scopeText, explainFailures, inIssue, validateContract, cliUsageError, normalizeRunnerCommand, applyAmendments, amendmentKindProblems, precheck, alreadyFixedOnBase, READONLY_PROD_RE, EXTERNAL_NEED_RE, repoTracks, dropScopeValidates, tagOutOfBand, parseReview, decide, mergeReviewRows, evidencePathOnly, closePlan, followupItems, renderPendingFollowups, bucketTally, pendingTracking, unnamedEdges, structureNote, impliedDocDeliverables } from "./conformance.mjs";
 import { checkAdmission, hostParallelism, ADMISSION_RETRY_SECONDS } from "./admission.mjs";
 import { namedPaths, isTrustedIssueComment } from "./prefilter.mjs";
 import { checksAt } from "./postdeploy-check.mjs";
@@ -32,7 +32,7 @@ import { runChecks, runWithTimeoutRetry, planPrecheck, worktreeFingerprint, self
 import { retrying, ghCacheRetry, refreshAuthOnce, runRefreshScript, GH_AUTH_RE, GH_AUTH_RETRY_SECONDS, PUSH_TRANSIENT_RE, PUSH_PERMANENT_RE, GH_TRANSIENT_RE, MERGE_TRANSIENT_RE, MERGE_CONFLICT_RE } from "./retry.mjs";
 import { renderInvestigation, renderImplementation, renderReview, renderPrBody, renderTrajectory, renderContract, renderAmendments, renderShadowReview, parseContractComment, parseAmendmentsComment, contractJson, capComment, sanitizeMd, MAX_COMMENT_CHARS, recoveryEvidence } from "./render.mjs";
 import { parseVerifierConfig, pickVerifierModel, changedSymbols, callersOf, verifierBudget, verifierPrompt, parseVerifierFindings, findingsToFailures, renderVerifierNote, VERIFIER_SYSTEM } from "./verifier.mjs";
-import { computeTrigger, riskPathHits, TRIGGER_MODES } from "./review-trigger.mjs";
+import { computeTrigger, riskPathHits, TRIGGER_MODES, pathDomains, parseEnforceDomains } from "./review-trigger.mjs";
 import { hostCapabilityBlock, contractHostNeeds } from "./execution.mjs";
 
 const MISSING_TOOL_RE = /command not found|not found in PATH|no such file or directory.*\b(?:docker|promtool)\b|\b(?:docker|promtool)\b[^\n]{0,80}(?:not (?:installed|found|available)|no such file|cannot connect|daemon)|cannot connect to the docker daemon|no docker daemon|no module named|ModuleNotFoundError|\bENOENT\b[^\n]{0,60}spawn/i;
@@ -205,7 +205,8 @@ export function isProtectedLaneBranch(b, { issue, lane = null, branches = {}, de
  * @param {"off"|"report"} [o.conformanceMutation] forge.yaml engine.conformance_mutation (#4913): rerun each evidence test with the change reverted; a survivor is conformance.mutation_survived (shadow unless conformance_kinds enforces it)
  * @param {Record<string,"enforce"|"shadow">} [o.conformanceKinds] forge.yaml engine.conformance_kinds: a failure code's own mode (enforce blocks, shadow is recorded only); others follow `conformance`
  * @param {"needs-human"|"degraded"} [o.reviewIncomplete] shadow only: what an incomplete review after the re-ask does (default needs-human)
- * @param {object} [o.reviewTrigger] forge.yaml review.trigger/risk_paths (#4273): {mode: shadow (default)|enforce|off, riskPaths: globs}
+ * @param {object} [o.reviewTrigger] forge.yaml review.trigger/risk_paths (#4273): {mode: shadow (default)|enforce|off, riskPaths: globs,
+ *                                   enforceDomains: review.enforce_domains (#5099), a touched listed domain makes the lane enforce}
  * @param {object} [o.verifier]      forge.yaml review.verifier/verifier_model (#4397): {mode: off (default)|shadow|enforce, model}
  * @param {object} [o.verify]        forge.yaml verify (verify.mjs parseVerify): mode local (default) | ci | hybrid (#4167)
  * @param {object} [o.precheck]      {commands, maxMinutes}: forge.yaml learned.test_commands, run in the worktree before the PR (#4240);
@@ -239,6 +240,7 @@ export async function runCore(o) {
   const remoteVerify = vcfg.mode !== "local";
   const triggerMode = TRIGGER_MODES.includes(o.reviewTrigger?.mode) ? o.reviewTrigger.mode : "shadow";
   const riskPaths = Array.isArray(o.reviewTrigger?.riskPaths) ? o.reviewTrigger.riskPaths : [];
+  const enforceDomains = parseEnforceDomains(o.reviewTrigger?.enforceDomains ?? []); // #5099
   const verifierCfg = parseVerifierConfig(o.verifier ?? {});
   const routingCfg = parseBuilderRouting(o.builderRouting ?? {});
   // #4394: the build's model tier, routed from the frozen contract; a failed validate round on the mid tier escalates once
@@ -317,7 +319,8 @@ export async function runCore(o) {
     const terminal = ["merged", "invalid", "needs-human", "engine-error"].includes(reason);
     // forge#4275: the typed outcome code and failure classes ride on FORGE:STATE, so the next run's context pack reads them typed.
     const typed = terminal ? { terminalCode: code ?? null, failureClasses: [...failureClasses].sort(), ...(reason === "merged" && mergedTo ? { mergedTo } : {}) } : {}; // #4711: where the change landed
-    try { await writeLease(null, terminal ? { terminal: true, terminalReason: reason, ...typed } : {}); } catch { /* best effort */ }
+    const pending = pendingRecord().length ? { pendingFollowups: pendingRecord() } : {}; // #5141: unfiled follow-ups, filed later by the marker
+    try { await writeLease(null, terminal ? { terminal: true, terminalReason: reason, ...typed, ...pending } : pending); } catch { /* best effort */ }
   }
 
   // Pipeline trajectory (posted once at the end): phase rows, decisions, anomalies.
@@ -336,6 +339,7 @@ export async function runCore(o) {
   let guardAddedMs = 0; // #4705 (R12): wall time the guard gate added, summed over the lane, carried on RUN_TERMINAL
   let shadowWould = null; // forge#4165: the shadow gate's verdict, carried on RUN_TERMINAL (no telemetry write of its own)
   const kinds = normalizeKindModes(conformanceKinds); // engine.conformance_kinds: a failure code's own mode
+  let domains = [], domainsLogged = null; // #5099: review domains the diff touches (review-roster.sh path triggers)
   let riskEnforced = null, gateRan = false; // #4398: declared risk paths that made a shadow lane enforce (sticky); the gate ran
   let done = null, finishing = null, wtCreated = false, salvagedRef = null;
   let light = false, modelMs = 0; // #4451: the light lane finished without an upgrade (the same structure/hotspot gates as the full lane, #4502); summed session time
@@ -354,6 +358,8 @@ export async function runCore(o) {
   let seqLease = null; // #4386: the host sequence lease, held from the merge-gate renumber through the merge
   const waits = {};
   const followupsFiled = []; // #5078: {issue, class, count} per tracking issue this lane filed into, for the batch report
+  const pendingFollowups = []; // #5141: {req, why} whose filing kept failing in-lane; filed after the merge, else recorded
+  const pendingRecord = () => pendingFollowups.filter((p) => !p.req.tracked).map((p) => ({ id: p.req.id, quote: String(p.req.quote ?? ""), disposition: p.req.disposition, why: p.why, marker: `FORGE:DEFERRED_FROM: #${issue}` }));
   let precheckMs = 0, precheckDeferred = 0, precheckRan = false; // #4331: pre-PR check wall time and deferrals, for the batch report
   const addWait = (phase, ms, queued = 0) => {
     if (Number.isFinite(ms) && ms > 0) waits[phase] = (waits[phase] ?? 0) + ms;
@@ -491,7 +497,7 @@ export async function runCore(o) {
     await releaseLease(reason, code, extra.mergedTo ?? null);
     done = { terminalReason: reason, detail, branch, worktree: wt, cost_usd: usage.cost_usd, tokens: { input: usage.input, output: usage.output, cache: usage.cache }, wall_ms: now() - t0, model_ms: modelMs, phases: phaseLedger.snapshot(),
       ...(laneHead && reason !== "merged" ? { laneHead: { ...laneHead } } : {}), light, ...(lightVerdict ? { light_eligibility: lightVerdict } : {}), ...(lightUpgrade ? { light_upgrade: lightUpgrade } : {}), // #4453
-      ...(Object.keys(waits).length ? { waits: { ...waits } } : {}), ...(followupsFiled.length ? { followups: followupsFiled.map((f) => ({ ...f })) } : {}), ...(heavyQueueMax ? { heavyQueueMax } : {}), ...(precheckRan ? { precheckMs, precheckDeferred } : {}),
+      ...(Object.keys(waits).length ? { waits: { ...waits } } : {}), ...(followupsFiled.length ? { followups: followupsFiled.map((f) => ({ ...f })) } : {}), ...(pendingRecord().length ? { pendingFollowups: pendingRecord() } : {}), ...(heavyQueueMax ? { heavyQueueMax } : {}), ...(precheckRan ? { precheckMs, precheckDeferred } : {}),
       ...(firstPassOf(builderTriggers) != null ? { firstPass: firstPassOf(builderTriggers) } : {}), ...(tb.record() ? { turns: tb.record() } : {}), // #4392
       ...(route ? { builderRoute: { tier: route.tier, class: route.class, escalated, model: route.model ?? "default" } } : {}),
       ...(gateRan ? { conformance: { mode: conformance === "enforce" || riskEnforced ? "enforce" : "shadow", would: shadowWould, risk: Boolean(riskEnforced), ...(Object.keys(kinds).length ? { kinds: [...failureClasses] } : {}) } } : {}), ...extra };
@@ -1401,25 +1407,54 @@ export async function runCore(o) {
       }
       return block ? await endBlocked(block, result.summary) : null;
     }
-    /** File (or append to) the parent's one batched follow-up issue for these requirements, then verify each tracking issue is open. */
-    async function track(reqs, why) {
-      const fail = (detail) => Object.assign(new Error(detail), { deferCode: OUTCOME_CODES.FOLLOWUP_UNAVAILABLE, deferDetail: `${detail}; nothing merged, rerun to retry` });
+    /**
+     * File (or append to) the parent's one batched follow-up issue for these requirements, then verify each tracking issue is open.
+     * #5141: the whole step is retried in-lane (3 attempts, 5s then 15s): the script is idempotent (claim marker /
+     * FORGE:DEFERRED_FROM lookup, checklist dedup, duplicate close), so only a persistent failure defers the run.
+     * A malformed TSV (DEFERRED_TSV=INVALID) is deterministic and never retried. #5141: when the retries are spent the run
+     * keeps going (keep): the untracked requirements join pendingFollowups, recorded in FORGE:STATE and filed after the merge.
+     */
+    async function track(reqs, why, { keep = true } = {}) {
+      const fail = (detail, final = true) => Object.assign(new Error(detail), { deferCode: OUTCOME_CODES.FOLLOWUP_UNAVAILABLE, deferDetail: `${detail}; nothing merged, rerun to retry`, final });
       if (!io.fileFollowups) throw fail("no follow-up filing effect is configured");
       const items = followupItems(reqs, { now: now() });
-      let filed;
-      try { filed = await io.fileFollowups({ parent: issue, repo, items, milestone, defaultMilestone: o.followupsDefaultMilestone ?? null, lane, batchId: o.batchId ?? null, rollupLabel: o.followupsRollupLabel ?? null }); } catch (e) { throw fail(`filing the follow-up issue failed: ${String(e?.message ?? e).slice(0, 200)}`); }
-      for (const [i, r] of reqs.entries()) {
-        const n = Number(filed?.[items[i].key]);
-        if (!Number.isSafeInteger(n) || n <= 0) throw fail(`no tracking issue was returned for ${r.id}`);
-        let st = null;
-        try { st = JSON.parse(String(await ghc(["issue", "view", String(n), "-R", repo, "--json", "number,state"]))); } catch { st = null; }
-        if (String(st?.state).toUpperCase() !== "OPEN") throw fail(`tracking issue #${n} for ${r.id} is not open or unreadable`);
-        r.tracked = `#${n}`;
-        const f = followupsFiled.find((x) => x.issue === n && x.class === items[i].class); // #5078: grouped per issue and class
-        if (f) f.count += 1; else followupsFiled.push({ issue: n, class: items[i].class, count: 1 });
-      }
-      const buckets = Object.entries(bucketTally(reqs)).map(([k, c]) => `${k}:${c}`).join(","); // #4724
-      T.decisions.push(`Tracked ${reqs.map((r) => `${r.id} (${r.disposition})`).join(", ")} in ${[...new Set(reqs.map((r) => r.tracked))].join(", ")} (${why}; buckets ${buckets})`);
+      const attempt = async () => {
+        let filed;
+        try { filed = await io.fileFollowups({ parent: issue, repo, items, milestone, defaultMilestone: o.followupsDefaultMilestone ?? null, lane, batchId: o.batchId ?? null, rollupLabel: o.followupsRollupLabel ?? null }); } catch (e) {
+          throw fail(`filing the follow-up issue failed: ${String(e?.message ?? e).slice(0, 200)}`, /DEFERRED_TSV=INVALID/.test(`${e?.stdout ?? ""}${e?.message ?? ""}`));
+        }
+        for (const [i, r] of reqs.entries()) {
+          if (recorded.has(i)) continue; // tracked in an earlier attempt: keeps its r.tracked, never re-counted
+          const n = Number(filed?.[items[i].key]);
+          if (!Number.isSafeInteger(n) || n <= 0) throw fail(`no tracking issue was returned for ${r.id}`, false);
+          let st = null;
+          try { st = JSON.parse(String(await ghc(["issue", "view", String(n), "-R", repo, "--json", "number,state"]))); } catch { st = null; }
+          if (String(st?.state).toUpperCase() !== "OPEN") throw fail(`tracking issue #${n} for ${r.id} is not open or unreadable`, false);
+          recorded.add(i);
+          r.tracked = `#${n}`;
+          const f = followupsFiled.find((x) => x.issue === n && x.class === items[i].class); // #5078: grouped per issue and class
+          if (f) f.count += 1; else followupsFiled.push({ issue: n, class: items[i].class, count: 1 });
+        }
+      };
+      const recorded = new Set();
+      const waits = [5000, 15000];
+      for (let k = 0; ; k++) {
+        try { await attempt(); break; } catch (e) {
+          if (e.final || (k >= waits.length && !keep)) throw e;
+          if (k >= waits.length) { // #5141: keep the merge-capable work; the close step files these after the merge
+            const left = reqs.filter((_, i) => !recorded.has(i));
+            for (const r of left) if (!pendingFollowups.some((p) => p.req === r)) pendingFollowups.push({ req: r, why });
+            T.anomalies.push(`follow-up filing failed ${k + 1} times (${String(e.message).slice(0, 160)}): ${left.map((r) => r.id).join(", ")} pending, filed after the merge (FORGE:DEFERRED_FROM: #${issue})`);
+            break;
+          }
+          T.decisions.push(`Follow-up filing attempt ${k + 1} failed (${String(e.message).slice(0, 160)}); retrying in-lane in ${waits[k] / 1000}s`);
+          await sleep(waits[k]);
+        }
+      }
+      const done = reqs.filter((r) => r.tracked);
+      if (!done.length) return;
+      const buckets = Object.entries(bucketTally(done)).map(([k, c]) => `${k}:${c}`).join(","); // #4724
+      T.decisions.push(`Tracked ${done.map((r) => `${r.id} (${r.disposition})`).join(", ")} in ${[...new Set(done.map((r) => r.tracked))].join(", ")} (${why}; buckets ${buckets})`);
     }
     /**
      * #4328: probe the host for the tools and modules a contract's validate commands need; #4393: then flag `$NAME`s the lane
@@ -2211,7 +2246,7 @@ export async function runCore(o) {
         await renew();
         const rr = await callRunner({ role: "reviewer", issue, cwd: wt, model: reviewerModel, resume: null, system: REVIEWER_SYSTEM, readOnly: true,
           prompt: repair ? reviewerRepairPrompt({ missing: d.missing ?? [], problems: d.failures.map((f) => f.detail), rows: first })
-            : reviewerPrompt({ issue: iss, comments: trustedComments, contract: effective, result, files, diff, stat, base, structure: structureLine, ignore: IGNORE, investigationVerdict: investigationVerdict(await io.fs.read(`${wt}/.forge-lean/investigation.md`).catch(() => null)) }) });
+            : reviewerPrompt({ issue: iss, comments: trustedComments, contract: effective, result, files, diff, stat, base, structure: structureLine, ignore: IGNORE, domains, investigationVerdict: investigationVerdict(await io.fs.read(`${wt}/.forge-lean/investigation.md`).catch(() => null)) }) });
         await renew();
         await attempt("review", ++reviewN, rr, null, "review");
         const parsed = parseReview(rr?.text);
@@ -2342,6 +2377,20 @@ export async function runCore(o) {
         ev({ event: "CONFORMANCE_RISK_ENFORCED", paths: hits });
         T.decisions.push(`Conformance enforced (review.risk_paths): ${hits.slice(0, 10).join(", ")}${hits.length > 10 ? ` and ${hits.length - 10} more` : ""}`);
       }
+      // #5099: the domains the diff touches get domain checks in the review; a review.enforce_domains hit enforces (sticky)
+      const pd = pathDomains(files);
+      const dErr = "Review domains unavailable: scripts/review-roster.sh failed; reviewed without domain checks";
+      if (pd === null && !T.anomalies.includes(dErr)) T.anomalies.push(dErr);
+      domains = pd ?? [];
+      const dHits = shadow ? domains.filter((d) => enforceDomains.includes(d)) : [];
+      if (dHits.length) {
+        shadow = false; riskEnforced = dHits.map((d) => `domain:${d}`);
+        T.decisions.push(`Conformance enforced (review.enforce_domains): ${dHits.join(", ")}`);
+      }
+      if (domainsLogged !== domains.join(",")) {
+        domainsLogged = domains.join(",");
+        ev({ event: "REVIEW_DOMAINS", domains, enforced: dHits.length ? dHits : undefined, ...(pd === null ? { error: "roster.failed" } : {}) });
+      }
       if (!amendFixed && sessionId && amendmentKindProblems(result?.amendments).length) { // #5089: one in-lane correction, outside the conformance resume budget
         amendFixed = true;
         const bad = amendmentKindProblems(result.amendments);
@@ -2998,8 +3047,22 @@ export async function runCore(o) {
     }
     try { await recordStructure(pr); } catch (e) { ev({ event: "STRUCTURE_DELTA_FAILED", error: String(e?.message ?? e).slice(0, 300) }); }
     await deleteMergedBranch();
+    let keepOpen = false;
+    if (pendingRecord().length) { // #5141: the close step files what the lane could not track before the PR (idempotent by the marker)
+      const left = pendingFollowups.filter((p) => !p.req.tracked);
+      for (const why of new Set(left.map((p) => p.why))) {
+        try { await track(left.filter((p) => p.why === why).map((p) => p.req), `${why}; filed after the merge`); } catch (e) { T.anomalies.push(`follow-up filing after the merge failed: ${String(e?.message ?? e).slice(0, 160)}`); }
+      }
+      for (const p of left) if (p.req.tracked && !closing.tracked.includes(p.req.tracked)) closing.tracked.push(p.req.tracked);
+      const still = pendingRecord();
+      if (still.length) {
+        keepOpen = true; // release review #5155 (#5156): nothing re-files a pending item, so the issue stays open as the durable record
+        T.decisions.push(`Follow-up still unfiled after the merge: ${still.map((x) => x.id).join(", ")}; issue left open (FORGE:FOLLOWUP_PENDING, FORGE:STATE pendingFollowups) until it is tracked`);
+        try { await post("FORGE:FOLLOWUP_PENDING", renderPendingFollowups(still, pr)); } catch { /* FORGE:STATE and the lane result carry them too */ }
+      }
+    }
     const partial = closing.reason === "partial";
-    await ghw(["issue", "close", String(issue), "-R", repo, "--reason", partial ? "not planned" : "completed"]).catch(() => {});
+    if (!keepOpen) await ghw(["issue", "close", String(issue), "-R", repo, "--reason", partial ? "not planned" : "completed"]).catch(() => {});
     if (partial) {
       try { await post("FORGE:TRACKED", `## Closed as partial\nThe investigation's stated question is not answered in this change (PR #${pr}); carried forward in ${closing.tracked.join(", ")}.`); } catch { /* the PR body links them too */ }
     } else if (closing.tracked.length) {

package/bin/lean/lean.test.mjs

@@ -186,7 +186,9 @@ function world(o = {}) {
     transitionLabel: async (n, s) => { w.labels.push(s); w.seq.push(`label:${s}`); },
     ...(o.procs ? { proc: { inDir: async () => o.procs, alive: (pid) => w.alive.has(pid), kill: (pid, sig) => { w.kills.push([pid, sig]); w.seq.push(`kill-${sig}`); if (sig === "SIGKILL" || !o.stubborn) w.alive.delete(pid); } } } : {}),
     fs: { ...(o.wtExists ? { exists: async (p) => p.startsWith("/wt/lean-7") } : {}), stat: async (p) => (p in w.files ? { mtimeMs: w.mtimes[p] ?? 1 } : null), read: async (p) => { if (!(p in w.files)) throw new Error("ENOENT"); return w.files[p]; }, append: async (p, t) => { w.files[p] = (w.files[p] ?? "") + t; }, write: async (p, t) => { w.files[p] = t; }},
-    fileFollowups: async ({ parent, items }) => { w.followups.push({ parent, items }); if (o.followupError) throw new Error(o.followupError); return Object.fromEntries(items.map((i) => [i.key, o.followupIssue ?? 900])); },
+    fileFollowups: async ({ parent, items }) => { w.followups.push({ parent, items }); if (o.followupError) throw Object.assign(new Error(o.followupError), { stdout: o.followupStdout ?? "" });
+      if (o.followupRet) return o.followupRet(w.followups.length, items);
+      if (w.followups.length <= (o.followupFailTimes ?? 0)) throw new Error("DEFERRED_LOOKUP=FAILED"); if (w.followups.length <= (o.followupMissingTimes ?? 0)) return {}; return Object.fromEntries(items.map((i) => [i.key, o.followupIssue ?? 900])); },
   };
   return w;
 }
@@ -982,21 +984,82 @@ describe("conformance gate (frozen contract, precheck, structured review)", () =
     });
   }
 
-  it("a follow-up that cannot be filed defers the run (followup.unavailable): no PR, merge or close; never needs-human", async () => {
+  it("#5141 a follow-up that cannot be filed keeps the work: PR and merge proceed, the issue stays open with the unfiled item recorded, never needs-human (#5156)", async () => {
     const k = two("defer", { why: "w" });
     const w = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], followupError: "DEFERRED_LOOKUP=FAILED" });
+    w.leaseWrites = []; w.io.projector = { readState: async () => null, writeState: async (_i, st) => { w.leaseWrites.push(st); } };
     const r = await run(w);
-    assert.equal(r.terminalReason, "deferred"); assert.equal(r.code, "followup.unavailable");
-    assert.ok(!w.comments.some((c) => c.includes("FORGE:REVIEW")), "no verdict is published for a run that cannot link its tracking");
-    assert.equal(w.prs.length, 0); assert.equal(w.merges.length, 0); assert.equal(w.closed.length, 0);
+    assert.equal(r.terminalReason, "merged"); assert.notEqual(r.code, "followup.unavailable");
+    assert.equal(w.prs.length, 1); assert.equal(w.merges.length, 1);
+    assert.equal(w.closed.length, 0, "release review #5155 (#5156): nothing re-files a pending item, so the issue is not closed over it");
+    assert.equal(w.followups.length, 6, "3 in-lane attempts before the PR, 3 more in the close step");
+    assert.deepEqual(r.pendingFollowups, [{ id: "R2", quote: "Existing callers of foo keep working.", disposition: "defer", why: "accepted by the conformance review", marker: "FORGE:DEFERRED_FROM: #7" }]);
+    assert.deepEqual(w.leaseWrites.at(-1).pendingFollowups, r.pendingFollowups, "the issue's FORGE:STATE carries the unfiled item");
+    const note = w.comments.find((c) => c.includes("FORGE:FOLLOWUP_PENDING"));
+    assert.match(note, /R2 \(defer\): Existing callers of foo keep working\..*`FORGE:DEFERRED_FROM: #7`/);
     assert.ok(!w.edits.some((e) => e.includes("--add-label") && e.includes("needs-human")));
   });
 
-  it("a tracking issue that is not open is not a tracking issue (followup.unavailable)", async () => {
+  it("#5141 a follow-up that keeps failing before the PR is filed by the close step after the merge", async () => {
+    const k = two("defer", { why: "w" });
+    const w = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], followupMissingTimes: 3 });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "merged"); assert.equal(w.followups.length, 4); assert.equal(r.pendingFollowups, undefined);
+    assert.ok(w.comments.some((c) => c.includes("FORGE:TRACKED") && c.includes("#900")));
+    assert.ok(!w.comments.some((c) => c.includes("FORGE:FOLLOWUP_PENDING")));
+    assert.match(traj(w).join("\n"), /Tracked R2 \(defer\) in #900 \(accepted by the conformance review; filed after the merge/);
+  });
+
+  it("#5141 a follow-up filing that fails once is retried in-lane, not requeued: the run proceeds and tracks once", async () => {
+    const k = two("defer", { why: "w" });
+    const w = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], followupFailTimes: 1 });
+    const r = await run(w);
+    assert.notEqual(r.code, "followup.unavailable");
+    assert.equal(w.followups.length, 2, "one retry of the whole filing step");
+    assert.equal(w.prs.length, 1);
+  });
+
+  it("#5141 a follow-up filing that returns no tracking issue is retried in-lane before deferring", async () => {
+    const k = two("defer", { why: "w" });
+    const w = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], followupMissingTimes: 2 });
+    const r = await run(w);
+    assert.notEqual(r.code, "followup.unavailable");
+    assert.equal(w.followups.length, 3);
+  });
+
+  it("#5141 a requirement tracked in an earlier attempt keeps its tracking issue; the retry tracks only the rest, once each", async () => {
+    const base = two("defer", { why: "w" });
+    const k = { ...base, requirements: [...base.requirements, { id: "R3", quote: "Old callers log a warning.", disposition: "defer", bucket: "post-deploy", why: "w" }] };
+    let views900 = 0;
+    const w = world({ contract: k, body: `${ISSUE_BODY}\n- Old callers log a warning.`, issueStates: { get 900() { views900 += 1; return "OPEN"; } }, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)],
+      followupRet: (call, items) => (call === 1 ? { [items[0].key]: 900 } : { [items[0].key]: 900, [items[1].key]: 901 }) });
+    const r = await run(w);
+    assert.notEqual(r.code, "followup.unavailable");
+    assert.equal(w.followups.length, 2);
+    const t = traj(w).join("\n");
+    assert.match(t, /Follow-up filing attempt 1 failed \(no tracking issue was returned for R3\); retrying in-lane in 5s/);
+    assert.match(t, /Tracked R2 \(defer\), R3 \(defer\) in #900, #901/);
+    assert.equal(views900, 1, "R2, verified open in attempt 1, is not re-verified or re-counted by the retry");
+  });
+
+  it("#5141 a persistent follow-up failure is retried 3 times in-lane, then the run keeps going; a malformed TSV is not retried and defers", async () => {
+    const k = two("defer", { why: "w" });
+    const w = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], followupMissingTimes: 99 });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "merged"); assert.equal(w.followups.length, 6); assert.equal(w.prs.length, 1);
+    assert.equal(r.pendingFollowups[0].id, "R2");
+    const w2 = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], followupError: "Command failed", followupStdout: "DEFERRED_TSV=INVALID\n" });
+    const r2 = await run(w2);
+    assert.equal(r2.code, "followup.unavailable"); assert.equal(w2.followups.length, 1); assert.equal(w2.prs.length, 0);
+  });
+
+  it("a tracking issue that is not open is not a tracking issue: the item stays pending and is recorded", async () => {
     const k = two("defer", { why: "w" });
     const w = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], issueStates: { 900: "CLOSED" } });
     const r = await run(w);
-    assert.equal(r.code, "followup.unavailable"); assert.equal(w.merges.length, 0);
+    assert.equal(r.terminalReason, "merged"); assert.equal(r.pendingFollowups[0].id, "R2");
+    assert.ok(w.comments.some((c) => c.includes("FORGE:FOLLOWUP_PENDING")));
+    assert.equal(w.closed.length, 0, "left open while R2 is untracked (#5156)");
   });
 
   it("an existing PR gets the tracking links in its body before merge", async () => {
@@ -1659,6 +1722,24 @@ describe("conformance shadow mode (the default)", () => {
     assert.ok(traj(w)[0].includes("| Close | issue closed (partial) |"));
   });
 
+  it("#5099 a web/ diff gets frontend domain checks in the reviewer prompt; review.enforce_domains makes the lane enforce", async () => {
+    const k = { ...CONTRACT, preserve: [] }, changed = ["web/app/page.tsx", "test/foo.test.js"];
+    const seenPrompts = (w) => { const out = [], r0 = w.io.runner; w.io.runner = async (c) => { if (c.role === "reviewer") out.push(c.prompt); return r0(c); }; return out; };
+    const dir = tmpDir("dom-"), s = world({ contract: k, changed, reviews: [omission()] }), ps = seenPrompts(s);
+    const rs = await runShadow(s, { dir });
+    assert.equal(rs.terminalReason, "merged", "without enforce_domains the lane stays shadow");
+    assert.match(ps[0], /<domain_checks>[\s\S]*regressions row[\s\S]*- frontend: [\s\S]*not-found\/error boundary/);
+    assert.deepEqual(readLog(dir, 7).filter((e) => e.event === "REVIEW_DOMAINS").map((e) => e.domains), [["frontend"]]);
+    const plain = world({ contract: k, reviews: [ok({}, k)] }), pp = seenPrompts(plain);
+    await runShadow(plain);
+    assert.ok(!pp[0].includes("<domain_checks>"), "no domain touched: no domain block");
+    const e = world({ contract: k, changed, reviews: [omission(), omission()] });
+    const re = await runShadow(e, { reviewTrigger: { mode: "shadow", riskPaths: [], enforceDomains: ["frontend"] } });
+    assert.equal(re.terminalReason, "needs-human"); assert.equal(e.merges.length, 0);
+    assert.deepEqual(re.conformance, { mode: "enforce", would: null, risk: true });
+    assert.ok(traj(e)[0].includes("Conformance enforced (review.enforce_domains): frontend"));
+  });
+
   it("#4398 an investigation whose answer the review marks deferred is tracked before the PR and closes partial, even though shadow merges it", async () => {
     const k = { ...CONTRACT, preserve: [] };
     const w = world({ title: "investigate: foo", contract: k, reviews: [conf({ requirements: [{ id: "R1", status: "deferred", evidence: "", validated_by: "", note: "question open" }] }, k)] });
@@ -5930,6 +6011,8 @@ describe("review trigger (#4273): shadow logs and always reviews, enforce skips
     assert.deepEqual(at('review:\n  trigger: enforce\n  risk_paths: "db/**, *.sql"\n'), { mode: "enforce", riskPaths: ["db/**", "*.sql"] });
     assert.deepEqual(at("review:\n  tech_stack: x\n  risk_paths:\n    - \"infra/**\"\n    - lib/acct/*.ts  # c\n  trigger: bogus\n"), { mode: "shadow", riskPaths: ["infra/**", "lib/acct/*.ts"] });
     assert.equal(at("engine:\n  path: core\n"), undefined);
+    assert.deepEqual(at('review:\n  enforce_domains: "Frontend, bogus"\n'), { mode: "shadow", riskPaths: [], enforceDomains: ["frontend"] }, "#5099");
+    assert.deepEqual(at("review:\n  enforce_domains:\n    - auth\n  risk_paths:\n    - db/**\n"), { mode: "shadow", riskPaths: ["db/**"], enforceDomains: ["auth"] }, "#5099 block lists");
   });
 });
 

package/bin/lean/live-execution.mjs

@@ -0,0 +1,136 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * Live execution control of a running batch (#5138): `forgedock orchestrate --set-max-remote <id> N` and
+ * `--set-placement <id> remote|hybrid|local`, like `--set-parallel` for K. The override lives in the batch's `execution`
+ * file (batch.mjs `readExecution`/`setExecution`, JSON `{maxRemote?, mode?, provider?}`); the runner re-reads it on every
+ * admission through the getters `liveRemote` puts on the `remote` object orchestrate gets (`max`, `fallbackLocal`, `place`).
+ * Running lanes are never stopped: a lower `max_remote` only holds new remote admissions. A batch that started without a
+ * remote provider (`provider` not true: mode local, or `max_remote` 0) refuses `remote`/`hybrid`, since its provider,
+ * ledger and execution budget are built once at start; start a new batch for that.
+ */
+
+export const LIVE_MODES = Object.freeze(["remote", "hybrid", "local"]);
+const LIGHT_WEIGHT = Object.freeze({ heavy: false, signals: [] });
+
+/** Validate a patch `{maxRemote?, mode?, provider?}`; throws on a bad value. @returns the cleaned patch. */
+export function validateExecutionPatch(patch = {}) {
+  const out = {};
+  if (patch.maxRemote !== undefined) {
+    const n = typeof patch.maxRemote === "string" && /^\d+$/.test(patch.maxRemote.trim()) ? parseInt(patch.maxRemote, 10) : patch.maxRemote;
+    if (!Number.isInteger(n) || n < 0) throw new Error("max_remote must be a non-negative integer");
+    out.maxRemote = n;
+  }
+  if (patch.mode !== undefined) {
+    if (!LIVE_MODES.includes(patch.mode)) throw new Error(`placement must be one of ${LIVE_MODES.join("|")}`);
+    out.mode = patch.mode;
+  }
+  if (patch.provider !== undefined) {
+    if (typeof patch.provider !== "boolean") throw new Error("provider must be a boolean");
+    out.provider = patch.provider;
+  }
+  return out;
+}
+
+/** The fields of a stored override that are valid (anything else is dropped); null when there is none. */
+export function sanitizeOverride(o) {
+  if (!o || typeof o !== "object" || Array.isArray(o)) return null;
+  const out = {};
+  if (Number.isInteger(o.maxRemote) && o.maxRemote >= 0) out.maxRemote = o.maxRemote;
+  if (LIVE_MODES.includes(o.mode)) out.mode = o.mode;
+  if (typeof o.provider === "boolean") out.provider = o.provider;
+  return out;
+}
+
+/** The pinned forge.yaml `exec` with the live override's `maxRemote` and `mode` applied. */
+export function effectiveExecution(exec, override) {
+  const o = sanitizeOverride(override) ?? {};
+  return { ...(exec ?? {}), ...(o.maxRemote !== undefined ? { maxRemote: o.maxRemote } : {}), ...(o.mode !== undefined ? { mode: o.mode } : {}) };
+}
+
+/**
+ * `--set-max-remote <id> N` / `--set-placement <id> MODE` in argv → `{id, patch}`, or null when neither flag is there.
+ * Throws on a missing id or a bad value.
+ */
+export function parseSetExecution(argv = []) {
+  const at = (flag) => argv.indexOf(flag);
+  let id = null;
+  const patch = {};
+  for (const [flag, key] of [["--set-max-remote", "maxRemote"], ["--set-placement", "mode"]]) {
+    const i = at(flag);
+    if (i < 0) continue;
+    const bid = argv[i + 1], val = argv[i + 2];
+    if (!bid || val === undefined) throw new Error(`usage: forgedock orchestrate ${flag} <id> ${key === "mode" ? LIVE_MODES.join("|") : "N"}`);
+    if (id !== null && id !== bid) throw new Error("--set-max-remote and --set-placement must name the same batch");
+    id = bid;
+    patch[key] = key === "maxRemote" ? (/^\d+$/.test(val) ? parseInt(val, 10) : NaN) : val;
+  }
+  return id === null ? null : { id, patch: validateExecutionPatch(patch) };
+}
+
+/**
+ * Apply a patch to `batch` (batch.mjs openBatch): refused for a missing batch, and `remote`/`hybrid` for a batch whose
+ * `execution` file does not record `provider: true`. @returns the stored override.
+ */
+export function applySetExecution(batch, patch) {
+  if (!batch.exists()) throw new Error(`no batch ${batch.id}`);
+  const p = validateExecutionPatch(patch);
+  if ((p.mode === "remote" || p.mode === "hybrid") && batch.readExecution()?.provider !== true) {
+    throw new Error(`batch ${batch.id} has no remote provider; placement ${p.mode} needs one: start a new batch with forge.yaml execution`);
+  }
+  return batch.setExecution(p);
+}
+
+/** Text for a stored override: `max_remote 2, placement hybrid`. */
+export function formatOverride(o) {
+  const s = sanitizeOverride(o) ?? {};
+  return [s.maxRemote !== undefined ? `max_remote ${s.maxRemote}` : null, s.mode ? `placement ${s.mode}` : null].filter(Boolean).join(", ") || "no change";
+}
+
+/**
+ * Hybrid validation weight (#4256) that is computed only when first needed: `initial` (already computed) or `compute()`
+ * started on the first `get()`; until it resolves (or when it fails) a light weight is used.
+ */
+export function lazyWeight({ initial = null, compute = null } = {}) {
+  let w = initial, started = initial !== null;
+  return {
+    get: () => {
+      if (!started && typeof compute === "function") {
+        started = true;
+        Promise.resolve().then(compute).then((r) => { w = r ?? LIGHT_WEIGHT; }, () => { w = LIGHT_WEIGHT; });
+      }
+      return w ?? LIGHT_WEIGHT;
+    },
+  };
+}
+
+/**
+ * Put live `max`, `fallbackLocal` and `place` getters on `base` (the `remote` object orchestrate gets; never spread it
+ * afterwards, a spread freezes the getters). `place(exec, n)` places one lane under the effective exec (execution.mjs
+ * `placeLane` with the remote or hybrid facts); mode `local` places every new lane on the host. `onChange(exec)` is
+ * called once each time the effective `{mode, maxRemote}` differs from the last one seen (the pinned one first).
+ */
+export function liveRemote(base, { exec, readOverride = () => null, place, onChange = null }) {
+  const keyOf = (e) => `${e.mode}|${e.maxRemote}`;
+  let last = keyOf(effectiveExecution(exec, null));
+  const current = () => {
+    let o = null;
+    try { o = readOverride() ?? null; } catch { o = null; }
+    const e = effectiveExecution(exec, o);
+    const k = keyOf(e);
+    if (k !== last) { last = k; try { onChange?.(e); } catch { /* advisory */ } }
+    return e;
+  };
+  return Object.defineProperties(base, {
+    max: { get: () => current().maxRemote, enumerable: true, configurable: true },
+    fallbackLocal: { get: () => { const e = current(); return e.mode === "hybrid" && Number.isInteger(e.maxRemote) && e.maxRemote >= 1; }, enumerable: true, configurable: true },
+    place: {
+      value: (n) => {
+        const e = current();
+        if (e.mode === "local") return { where: "local", reason: "live placement: local" };
+        return place(e, n);
+      },
+      enumerable: true, configurable: true, writable: true,
+    },
+  });
+}

package/bin/lean/live-execution.test.mjs

@@ -0,0 +1,83 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { tmpDir } from "../tests/_tmp.mjs";
+import { openBatch } from "./batch.mjs";
+import { validateExecutionPatch, sanitizeOverride, effectiveExecution, parseSetExecution, applySetExecution, formatOverride, lazyWeight, liveRemote, LIVE_MODES } from "./live-execution.mjs";
+
+describe("#5138 live execution control", () => {
+  it("validates patches: max_remote a non-negative integer, mode remote|hybrid|local", () => {
+    assert.deepEqual(LIVE_MODES, ["remote", "hybrid", "local"]);
+    assert.deepEqual(validateExecutionPatch({ maxRemote: 0, mode: "local" }), { maxRemote: 0, mode: "local" });
+    assert.deepEqual(validateExecutionPatch({ maxRemote: "3" }), { maxRemote: 3 });
+    for (const bad of [{ maxRemote: -1 }, { maxRemote: 1.5 }, { maxRemote: "x" }]) assert.throws(() => validateExecutionPatch(bad), /non-negative integer/);
+    assert.throws(() => validateExecutionPatch({ mode: "cloud" }), /placement must be one of/);
+    assert.throws(() => validateExecutionPatch({ provider: "yes" }), /boolean/);
+    assert.deepEqual(sanitizeOverride({ maxRemote: -2, mode: "x", provider: true }), { provider: true });
+    assert.equal(sanitizeOverride(null), null);
+  });
+
+  it("merges the override over the pinned exec", () => {
+    const exec = { mode: "remote", maxRemote: 4, provider: "container" };
+    assert.deepEqual(effectiveExecution(exec, null), exec);
+    assert.deepEqual(effectiveExecution(exec, { maxRemote: 1, mode: "hybrid" }), { mode: "hybrid", maxRemote: 1, provider: "container" });
+    assert.equal(formatOverride({ maxRemote: 2, mode: "hybrid" }), "max_remote 2, placement hybrid");
+  });
+
+  it("parses --set-max-remote / --set-placement", () => {
+    assert.equal(parseSetExecution(["--set-parallel", "b", "2"]), null);
+    assert.deepEqual(parseSetExecution(["--set-max-remote", "b1", "2"]), { id: "b1", patch: { maxRemote: 2 } });
+    assert.deepEqual(parseSetExecution(["--set-placement", "b1", "hybrid", "--set-max-remote", "b1", "0"]), { id: "b1", patch: { maxRemote: 0, mode: "hybrid" } });
+    assert.throws(() => parseSetExecution(["--set-max-remote", "b1", "-1"]), /non-negative/);
+    assert.throws(() => parseSetExecution(["--set-placement", "b1"]), /usage/);
+    assert.throws(() => parseSetExecution(["--set-placement", "b1", "x"]), /placement must be/);
+    assert.throws(() => parseSetExecution(["--set-placement", "b1", "local", "--set-max-remote", "b2", "1"]), /same batch/);
+  });
+
+  it("applySetExecution: missing batch and a provider-less batch going remote/hybrid are refused", () => {
+    const root = tmpDir("live-exec-");
+    assert.throws(() => applySetExecution(openBatch(root, "nope"), { mode: "local" }), /no batch nope/);
+    const b = openBatch(root, "b1");
+    b.writePlan({ argv: ["1"] });
+    for (const mode of ["remote", "hybrid"]) assert.throws(() => applySetExecution(b, { mode }), /no remote provider/);
+    assert.deepEqual(applySetExecution(b, { mode: "local", maxRemote: 0 }), { mode: "local", maxRemote: 0 });
+    b.setExecution({ provider: true });
+    assert.deepEqual(applySetExecution(b, { mode: "hybrid" }), { mode: "hybrid", maxRemote: 0, provider: true });
+    assert.deepEqual(b.readExecution(), { mode: "hybrid", maxRemote: 0, provider: true });
+  });
+
+  it("liveRemote getters follow the override file; local places on the host; onChange once per change", () => {
+    let o = null;
+    const changes = [], placed = [];
+    const r = liveRemote({ onBudget: "stop" }, { exec: { mode: "remote", maxRemote: 2 }, readOverride: () => o, onChange: (e) => changes.push(`${e.mode}/${e.maxRemote}`),
+      place: (e, n) => { placed.push([e.mode, n]); return { where: "remote", reason: `mode ${e.mode}` }; } });
+    assert.equal(r.max, 2);
+    assert.equal(r.fallbackLocal, false);
+    assert.deepEqual(r.place(1), { where: "remote", reason: "mode remote" });
+    o = { maxRemote: 5 };
+    assert.equal(r.max, 5);
+    o = { maxRemote: 5, mode: "hybrid" };
+    assert.equal(r.fallbackLocal, true);
+    r.place(2);
+    o = { maxRemote: 5, mode: "local" };
+    assert.deepEqual(r.place(3), { where: "local", reason: "live placement: local" });
+    assert.deepEqual(placed, [["remote", 1], ["hybrid", 2]]);
+    assert.deepEqual(changes, ["remote/5", "hybrid/5", "local/5"]);
+    assert.equal({ ...r }.onBudget, "stop");
+  });
+
+  it("lazyWeight is light until the computed weight resolves, and computes once", async () => {
+    let calls = 0;
+    const w = lazyWeight({ compute: async () => { calls++; return { heavy: true, signals: ["tsc"] }; } });
+    assert.deepEqual(w.get(), { heavy: false, signals: [] });
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(w.get(), { heavy: true, signals: ["tsc"] });
+    w.get();
+    assert.equal(calls, 1);
+    assert.deepEqual(lazyWeight({ initial: { heavy: true, signals: [] } }).get(), { heavy: true, signals: [] });
+    const failing = lazyWeight({ compute: () => { throw new Error("scan"); } });
+    failing.get(); await new Promise((r) => setImmediate(r));
+    assert.deepEqual(failing.get(), { heavy: false, signals: [] });
+  });
+});