forgedock 1.49.0 → 1.51.0

package/bin/lean/batch.test.mjs

@@ -3,11 +3,11 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
 import { resolveLane, makeLaneCache } from "./lane.mjs";
-import { orchestrate, deferPolicy, DEFER_BACKOFF_S, formatOutcomeLists, CAPACITY_FALLBACK_AFTER } from "./orchestrate.mjs";
+import { orchestrate, deferPolicy, DEFER_BACKOFF_S, formatOutcomeLists, CAPACITY_FALLBACK_AFTER, isTransientEngineError, transientRetryDelayMs, DEFAULT_TRANSIENT_RETRIES } from "./orchestrate.mjs";
 import { openBatch, fsTypeOf, assertDiskPath, isLaneAlive, writeAtomic, launchLane, detachedLanes } from "./batch.mjs";
 import { orchestrateFromCli, runFromCli, readOrchestration, makeRelabelNeedsHuman, makeDispatchCheck } from "../engine-cli.mjs";
 
@@ -265,9 +265,9 @@ await orchestrateFromCli(["1", "2", "3", "--parallel", "2", "--repo", "o/r", "--
     assert.equal(isLaneAlive(42, "lane", { kill: () => true, procDir: proc }), true);
     writeFileSync(join(pd, "stat"), "42 (no) de) Z 1 42 42 0 -1\n");
     assert.equal(isLaneAlive(42, "lane", { kill: () => true, procDir: proc }), false);
-    assert.deepEqual(readOrchestration(root), { breaker: { errors: 3, window_min: 30 }, maxDeferrals: 3, blockedLabel: "blocked", globalParallel: null, recovery: { maxAttempts: 1, mechanicalMaxAttempts: 2 }, baseSync: { enabled: true, unionGlobs: [] } });
-    writeFileSync(join(root, "forge.yaml"), "orchestration:\n  breaker:\n    errors: 5\n    window_min: 10\n  max_deferrals: 2\n  global_parallel: 4\n");
-    assert.deepEqual(readOrchestration(root), { breaker: { errors: 5, window_min: 10 }, maxDeferrals: 2, blockedLabel: "blocked", globalParallel: 4, recovery: { maxAttempts: 1, mechanicalMaxAttempts: 2 }, baseSync: { enabled: true, unionGlobs: [] } });
+    assert.deepEqual(readOrchestration(root), { breaker: { errors: 3, window_min: 30 }, maxDeferrals: 3, transientRetries: 4, blockedLabel: "blocked", globalParallel: null, recovery: { maxAttempts: 1, mechanicalMaxAttempts: 2 }, baseSync: { enabled: true, unionGlobs: [] } });
+    writeFileSync(join(root, "forge.yaml"), "orchestration:\n  breaker:\n    errors: 5\n    window_min: 10\n  max_deferrals: 2\n  global_parallel: 4\n  transient_retries: 2\n");
+    assert.deepEqual(readOrchestration(root), { breaker: { errors: 5, window_min: 10 }, maxDeferrals: 2, transientRetries: 2, blockedLabel: "blocked", globalParallel: 4, recovery: { maxAttempts: 1, mechanicalMaxAttempts: 2 }, baseSync: { enabled: true, unionGlobs: [] } });
   });
 
   it("run-issue --result-file writes the lane result, also when the run throws", async () => {
@@ -794,7 +794,7 @@ describe("#4481: a closed issue or a merged lane PR is skipped at dispatch", ()
     const mk = (issue, prs, events = "", { body = "{}", open = "[]" } = {}) => makeDispatchCheck({ repo: "o/r", gh: async (a) => {
       if (a[0] === "issue" && a[a.length - 1] === "body") return body; // #4920: the lease lookup
       if (a[0] === "pr" && a.includes("open")) return open; // #4920: the open lane PR lookup
-      if (a[0] === "issue") { assert.deepEqual(a, ["issue", "view", "9", "-R", "o/r", "--json", "state,stateReason"]); if (issue instanceof Error) throw issue; return issue; }
+      if (a[0] === "issue") { assert.deepEqual(a, ["issue", "view", "9", "-R", "o/r", "--json", "state,stateReason,labels"]); if (issue instanceof Error) throw issue; return issue; }
       if (a[0] === "api") { assert.equal(a[1], "repos/o/r/issues/9/events"); if (events instanceof Error) throw events; return events; }
       assert.deepEqual(a.slice(0, 6), ["pr", "list", "-R", "o/r", "--head", "feat/issue-9-lean"]);
       if (prs instanceof Error) throw prs;
@@ -813,6 +813,42 @@ describe("#4481: a closed issue or a merged lane PR is skipped at dispatch", ()
     assert.equal(await mk('{"body":"","labels":[]}', '{"body":""}')(9), null, "a stub without state or a list: run");
     assert.equal(await mk(new Error("x"), new Error("y"))(9), null);
   });
+  it("#5152 makeDispatchCheck: a merged investigation closed as partial (NOT_PLANNED + workflow:merged) satisfies its dependents", async () => {
+    // the blocker's lane PR is not on feat/issue-9-lean (legacy or renamed branch): only its labels say it was delivered
+    let closed = false;
+    const gh = async (a) => {
+      if (a[0] === "issue" && a[2] === "9" && a.includes("state,stateReason,labels")) {
+        return JSON.stringify(closed ? { state: "CLOSED", stateReason: "NOT_PLANNED", labels: [{ name: "workflow:merged" }] } : { state: "OPEN", labels: [] });
+      }
+      if (a[0] === "issue" && a[a.length - 1] === "body") return "{}";
+      if (a[0] === "pr") return "[]";
+      return "";
+    };
+    const dispatchCheck = makeDispatchCheck({ repo: "o/r", gh });
+    closed = true;
+    assert.deepEqual(await dispatchCheck(9), { outcome: "merged", detail: "issue closed, workflow:merged" }, "never final: delivered scope");
+    closed = false;
+    const ran = [];
+    const rows = await orchestrate({ issues: [9, 1], parallel: 1, readBody: async (n) => (n === 1 ? "**Depends on**: #9" : ""), dispatchCheck,
+      runOne: async (n) => { ran.push(n); if (n === 9) { closed = true; return { terminalReason: "needs-human", detail: "ci.red" }; } return { terminalReason: "merged", pr: 101 }; } });
+    assert.ok(ran.includes(1), "the dependent runs instead of being skipped");
+    assert.deepEqual(rows.find((r) => r.issue === 1)?.outcome, "merged");
+  });
+  it("#5152 makeDispatchCheck: decomposed parents are satisfied once every sub-issue closed; only an unlabelled NOT_PLANNED is final", async () => {
+    const dec = '<!-- FORGE:DECOMPOSED -->\n## Split into sub-issues\n- #21 a\n- #22 b';
+    const mk = (labels, subs, { decomposed = dec } = {}) => makeDispatchCheck({ repo: "o/r", gh: async (a) => {
+      if (a[0] === "issue" && a[2] === "9") return JSON.stringify({ state: "CLOSED", stateReason: "NOT_PLANNED", labels });
+      if (a[0] === "issue" && ["21", "22"].includes(a[2])) return JSON.stringify({ state: subs[a[2]] });
+      if (a[0] === "api") { assert.equal(a.find((x) => String(x).includes("/issues/9/comments")), "repos/o/r/issues/9/comments", "pinned to the batch repo"); return JSON.stringify({ body: decomposed, author_association: "NONE", user: { type: "Bot", login: "forgedock[bot]" } }); }
+      if (a[0] === "pr") return "[]";
+      return "";
+    } });
+    const d = [{ name: "workflow:decomposed" }];
+    assert.deepEqual(await mk(d, { 21: "CLOSED", 22: "CLOSED" })(9), { outcome: "merged", detail: "issue decomposed; all sub-issues closed" });
+    assert.deepEqual(await mk(d, { 21: "CLOSED", 22: "OPEN" })(9), { outcome: "invalid", detail: "issue closed: decomposed, sub-issues still open" }, "moving: not final");
+    assert.deepEqual(await mk(d, {}, { decomposed: "no trail" })(9), { outcome: "invalid", detail: "issue closed: decomposed, sub-issues still open" }, "no trail: not final");
+    assert.deepEqual(await mk([{ name: "workflow:invalid" }], {})(9), { outcome: "invalid", detail: "issue closed (not planned)", final: true }, "#4687 kept: dropped scope is final");
+  });
 });
 
 describe("#4504: a resume settles lanes that ended while no dispatcher ran", () => {
@@ -933,7 +969,7 @@ describe("#4550: forgedock orchestrate --requeue", () => {
         if (n === 1 && started.filter((x) => x === 1).length === 1) return { terminalReason: "needs-human", detail: "builder.blocked: product-decision" };
         return { terminalReason: "merged" };
       } });
-    await until(() => log.some((r) => r.issue === 2 && r.outcome === "skipped"));
+    await until(() => log.some((r) => r.issue === 2 && ["skipped", "held"].includes(r.outcome)));
     entries = [{ issue: 1, reason: "decided in scope", by: "operator", at: "2026-10-24T00:00:00Z" }];
     await until(() => started.filter((x) => x === 2).length === 1, 3000);
     g3.open();
@@ -1105,7 +1141,7 @@ describe("#5112: late dependents of a decomposed issue, edge re-read on --requeu
         if (n === 3) { await g3.p; return { terminalReason: "merged" }; }
         return n === 1 ? { terminalReason: "needs-human", detail: "builder.blocked: product-decision" } : { terminalReason: "merged" };
       } });
-    await until(() => log.some((r) => r.issue === 2 && r.outcome === "skipped"));
+    await until(() => log.some((r) => r.issue === 2 && ["skipped", "held"].includes(r.outcome)));
     bodies[2] = ""; // the operator dropped the wrong edge
     entries = [{ issue: 2, reason: "edge dropped", by: "operator", at: "2026-11-05T00:00:00Z" }];
     await until(() => started.includes(2), 3000);
@@ -1345,3 +1381,263 @@ describe("batch plan secrets (#4787)", () => {
     assert.ok(fast < 10 * LAT, `first lane after ${fast} ms`);
   });
 });
+
+describe("#5138: live max_remote and placement of a running batch", () => {
+  const tick = () => new Promise((r) => setTimeout(r, 1));
+  it("live max_remote raised from 1 to 2 admits a waiting remote lane while the first still runs", async () => {
+    let m = 1, open;
+    const gate = new Promise((r) => { open = r; });
+    const live = new Set(), seen = [];
+    const done = orchestrate({ issues: [1, 2], parallel: 2, pollMs: 1, readBody: async () => "", sleep: tick,
+      remote: { get max() { return m; }, isRemote: () => true, capacity: () => null },
+      runOne: async (n, _ln, ctx = {}) => { live.add(n); seen.push([n, ctx.placement?.where, [...live].sort()]); if (n === 1) await gate; live.delete(n); return { terminalReason: "merged", pr: 100 + n }; } });
+    await until(() => live.has(1));
+    for (let i = 0; i < 20; i++) await tick();
+    assert.ok(!seen.some(([n]) => n === 2), "#2 waits: max_remote 1 is taken by #1");
+    m = 2;
+    await until(() => seen.some(([n]) => n === 2));
+    assert.deepEqual(seen.find(([n]) => n === 2), [2, "remote", [1, 2]]);
+    open();
+    const rows = await done;
+    assert.deepEqual(rows.map((r) => r.outcome), ["merged", "merged"]);
+  });
+  it("live max_remote raised from 0 to 1 admits a waiting remote lane (nothing running)", async () => {
+    let m = 0;
+    const seen = [];
+    const done = orchestrate({ issues: [1], parallel: 2, pollMs: 1, readBody: async () => "", sleep: tick,
+      remote: { get max() { return m; }, isRemote: () => true, capacity: () => null },
+      runOne: async (n, _ln, ctx = {}) => { seen.push([n, ctx.placement?.where]); return { terminalReason: "merged", pr: 100 + n }; } });
+    for (let i = 0; i < 20; i++) await tick();
+    assert.deepEqual(seen, [], "#1 waits under max_remote 0");
+    m = 1;
+    const rows = await done;
+    assert.deepEqual(seen, [[1, "remote"]]);
+    assert.deepEqual(rows.map((r) => r.outcome), ["merged"]);
+  });
+  it("live max_remote lowered from 2 to 1 stops no running lane and holds new remote admissions", async () => {
+    let m = 2;
+    const live = new Set(), gates = new Map(), seen = [];
+    const gate = (n) => { let open; const p = new Promise((r) => { open = r; }); gates.set(n, open); return p; };
+    const done = orchestrate({ issues: [1, 2, 3], parallel: 3, pollMs: 1, readBody: async () => "", sleep: tick,
+      remote: { get max() { return m; }, isRemote: () => true, capacity: () => null },
+      runOne: async (n) => { live.add(n); seen.push([n, [...live].sort()]); if (n !== 3) await gate(n); live.delete(n); return { terminalReason: "merged", pr: 100 + n }; } });
+    await until(() => live.size === 2);
+    m = 1;
+    gates.get(1)();
+    for (let i = 0; i < 20; i++) await tick();
+    assert.ok(!seen.some(([n]) => n === 3), "#3 waits while #2 holds the one remote slot");
+    assert.ok(live.has(2), "#2 keeps running");
+    gates.get(2)();
+    const rows = await done;
+    assert.deepEqual(rows.map((r) => r.outcome), ["merged", "merged", "merged"]);
+    assert.deepEqual(seen.find(([n]) => n === 3)[1], [3]);
+  });
+  it("--set-max-remote / --set-placement write the batch's execution file; bad values and provider-less remote refused", async () => {
+    const root = tmpDir("batch-live-exec-");
+    const b = openBatch(root, "b1");
+    b.writePlan({ argv: ["1"] });
+    await quiet(() => orchestrateFromCli(["--set-max-remote", "b1", "3"], { batchRoot: root }));
+    assert.deepEqual(b.readExecution(), { maxRemote: 3 });
+    await quiet(() => orchestrateFromCli(["--set-placement", "b1", "local"], { batchRoot: root }));
+    assert.deepEqual(b.readExecution(), { maxRemote: 3, mode: "local" });
+    await assert.rejects(orchestrateFromCli(["--set-placement", "b1", "hybrid"], { batchRoot: root }), /no remote provider/);
+    await assert.rejects(orchestrateFromCli(["--set-max-remote", "b1", "-1"], { batchRoot: root }), /non-negative integer/);
+    await assert.rejects(orchestrateFromCli(["--set-placement", "b1", "cloud"], { batchRoot: root }), /placement must be one of/);
+    await assert.rejects(orchestrateFromCli(["--set-max-remote", "nope", "1"], { batchRoot: root }), /no batch nope/);
+    b.setExecution({ provider: true });
+    await quiet(() => orchestrateFromCli(["--set-placement", "b1", "hybrid"], { batchRoot: root }));
+    assert.equal(b.readExecution().mode, "hybrid");
+  });
+});
+
+describe("#5161 transient engine-error retries", () => {
+  const CURL_502 = 'claude CLI exited with status 1. Output: curl: (22) The requested URL returned error: 502 {"duration_api_ms":0}';
+  // Launch times per issue under the fake clock.
+  const launches = () => { const at = new Map(); return { at, note: (n, t) => at.set(n, [...(at.get(n) ?? []), t]) }; };
+  const gaps = (ts) => ts.slice(1).map((t, i) => t - ts[i]);
+
+  it("#5161 the classifier: curl 502, HTTP/1.1 5xx, Bad Gateway, Service Unavailable, overloaded and resets are transient; code failures are not", () => {
+    for (const d of [CURL_502, "HTTP/1.1 503 Service Unavailable", "HTTP/2 504", "502 Bad Gateway", "Service Unavailable", "API overloaded", "read ECONNRESET", "sandbox launch: fetch failed"])
+      assert.equal(isTransientEngineError(d), true, d);
+    for (const d of ["boom", "TypeError: x is undefined", "", null, undefined]) assert.equal(isTransientEngineError(d), false, String(d));
+    assert.deepEqual([1, 2, 3, 4, 5].map(transientRetryDelayMs), [30_000, 120_000, 480_000, 900_000, 900_000]);
+    assert.equal(DEFAULT_TRANSIENT_RETRIES, 4);
+  });
+
+  it("#5161 a curl 502 engine-error is retried with growing backoff and merges, not ended after one immediate relaunch", async () => {
+    const { c, now, sleep } = fakeClock();
+    const l = launches(), updates = [];
+    let tries = 0;
+    const rows = await orchestrate({ issues: [1], readBody: async () => "", now, sleep, onUpdate: (r) => updates.push(r),
+      runOne: async (n) => { l.note(n, c.t); if (++tries <= 3) throw new Error(CURL_502); return { terminalReason: "merged", pr: 7 }; } });
+    assert.equal(rows[0].outcome, "merged");
+    const g = gaps(l.at.get(1));
+    assert.equal(g.length, 3);
+    assert.ok(g[0] >= 30_000 && g[1] >= 120_000 && g[2] >= 480_000, `gaps ${g}`);
+    assert.ok(!updates.some((u) => /relaunching once/.test(u.detail ?? "")));
+  });
+
+  it("#5161 an always-502 issue is retried up to transientRetries with growing delays, then ends engine-error; one decided row per retry", async () => {
+    const { c, now, sleep } = fakeClock();
+    const l = launches(), decisions = [];
+    const [row] = await orchestrate({ issues: [1], readBody: async () => "", now, sleep, transientRetries: 2, decide: (d) => decisions.push(d),
+      runOne: async (n) => { l.note(n, c.t); throw new Error(CURL_502); } });
+    assert.equal(row.outcome, "engine-error");
+    assert.match(row.detail, /gave up after 2 transient retries/);
+    const g = gaps(l.at.get(1));
+    assert.equal(g.length, 2);
+    assert.ok(g[0] > 0 && g[1] > g[0], `gaps ${g}`);
+    assert.equal(decisions.length, 2);
+    assert.ok(decisions.every((d) => d.issue === 1 && /^transient: /.test(d.why) && /retry after transient engine-error \(\d\/2\)/.test(d.what)));
+  });
+
+  it("#5161 a dependent stays pending while its root's transient retries are pending and runs after it merges", async () => {
+    const { now, sleep } = fakeClock();
+    const started = [], updates = [];
+    let tries = 0;
+    const rows = await orchestrate({ issues: [1, 2], parallel: 2, readBody: async (n) => (n === 2 ? "Depends on #1" : ""), now, sleep, onUpdate: (r) => updates.push(r),
+      runOne: async (n) => { started.push(n); if (n === 1 && ++tries <= 2) throw new Error(CURL_502); return { terminalReason: "merged", pr: 10 + n }; } });
+    assert.deepEqual(rows.map((r) => r.outcome), ["merged", "merged"]);
+    assert.ok(!updates.some((u) => u.issue === 2 && u.outcome === "skipped"));
+    assert.deepEqual(started, [1, 1, 1, 2]);
+  });
+
+  it("#5161 a non-transient engine-error keeps the single immediate relaunch", async () => {
+    const { c, now, sleep } = fakeClock();
+    const l = launches();
+    const [row] = await orchestrate({ issues: [9], readBody: async () => "", now, sleep, runOne: async (n) => { l.note(n, c.t); throw new Error("boom"); } });
+    assert.equal(row.outcome, "engine-error");
+    assert.deepEqual(gaps(l.at.get(9)), [0]);
+  });
+
+  it("#5161 the breaker still counts transient engine-errors as transport errors (#4685)", async () => {
+    const { now, sleep } = fakeClock();
+    const saves = [];
+    const rows = await orchestrate({ issues: [1, 2], parallel: 1, readBody: async () => "", now, sleep, breaker: { errors: 2, window_min: 30 },
+      store: { load: () => null, save: (st) => saves.push(st) }, runOne: async () => { throw new Error(CURL_502); } });
+    assert.equal(saves.map((st) => st.breaker).find(Boolean)?.transport, true);
+    assert.ok(rows.some((r) => r.outcome === "held"));
+  });
+});
+
+describe("#5167 early batch health in runBatch", () => {
+  // #1 and #3 are roots, #2 depends on #1. #3 runs until `release`; the captured T+15 timer fires while it runs.
+  const mk = ({ fail }) => {
+    const timers = [], comments = [], notes = [], gate = { open: null };
+    const released = new Promise((r) => { gate.open = r; });
+    const bodies = { 1: "", 2: "Depends on #1", 3: "" };
+    const leanIo = { gh: async (a) => {
+      if (a[0] === "issue" && a[1] === "comment") { if (/FORGE:BATCH-HEALTH/.test(a.at(-1))) comments.push(a); return ""; }
+      if (a[0] === "issue" && a[1] === "view") return JSON.stringify({ body: bodies[a[2]] ?? "", milestone: { title: "M Two" }, comments: [], author: { login: "x" } });
+      return a[0] === "repo" ? "main\n" : "[]";
+    }, git: async (a) => (a[0] === "ls-remote" ? "abc\tref\n" : "") };
+    const deps = { dir: tmpDir("bh-run-"), batchRoot: tmpDir("bh-batch-"), allowTmpfs: true, emitTelemetry: async () => {}, leanIo, pollMs: 5, preflight: null,
+      io: { gh: async (a) => (a[0] === "issue" ? JSON.stringify({ body: bodies[a[2]] ?? "", state: "OPEN" }) : "o/r\n"), git: async () => "" },
+      healthConfig: { rootFailed: true, terminalShare: 0.5, stalled: true, checksMin: [15, 60], issue: 77, notifyCommand: "notify-me" },
+      healthTimer: { set: (fn, ms) => { timers.push({ fn, ms }); return timers.length; }, clear: () => {} },
+      notify: async (cmd, payload) => { notes.push([cmd, payload]); return { ok: true }; },
+      leanModule: { runCore: async (o) => {
+        if (o.issue === 3) { await released; return { terminalReason: "merged", pr: 3, cost_usd: 0, wall_ms: 1 }; }
+        return fail ? { terminalReason: "engine-error", detail: "lane crashed: boom", cost_usd: 0, wall_ms: 1 } : { terminalReason: "merged", pr: o.issue, cost_usd: 0, wall_ms: 1 };
+      } } };
+    return { deps, timers, comments, notes, gate };
+  };
+  const capture = async (fn) => { const lines = [], l = console.log; console.log = (...a) => lines.push(a.join(" ")); try { await fn(); } finally { console.log = l; } return lines; };
+
+  it("#5167 roots ending engine-error raise one BATCH UNHEALTHY at T+15 with recovery commands, on every channel", async () => {
+    const { deps, timers, comments, notes, gate } = mk({ fail: true });
+    let id = null;
+    const lines = await capture(async () => {
+      const run = orchestrateFromCli(["1", "2", "3", "--repo", "o/r", "--no-prefilter", "--parallel", "3"], deps);
+      try {
+        await until(() => { id = readdirSyncSafe(deps.batchRoot)[0]; return id && JSON.parse(readFileSync(join(deps.batchRoot, id, "state.json"), "utf8")).results?.[1]; });
+        assert.deepEqual(timers.map((t) => t.ms > 14 * 60000 && t.ms <= 15 * 60000 ? 15 : t.ms > 59 * 60000 ? 60 : t.ms), [15, 60], "T+15 and T+60 armed");
+        await timers[0].fn();
+        await until(() => existsSync(join(deps.batchRoot, id, "health.json")) && JSON.parse(readFileSync(join(deps.batchRoot, id, "health.json"), "utf8")).alertedAt, 5000);
+        await until(() => notes.length === 1, 5000);
+      } finally { gate.open(); await run; }
+    });
+    assert.ok(lines.some((l) => /^health checks: T\+15 \d\d:\d\dZ, T\+60 \d\d:\d\dZ, and at batch end; forgedock status --batch /.test(l)), lines.join("\n"));
+    const alerts = lines.filter((l) => /^BATCH UNHEALTHY /.test(l));
+    assert.equal(alerts.length, 1, "alerted once (T+15), not again at batch end");
+    assert.match(alerts[0], /\(T\+15\)/);
+    assert.match(alerts[0], /cause: root-failed: root #1 engine-error/);
+    assert.match(alerts[0], /recovery:\n {4}forgedock orchestrate --requeue \S+ 1 2 --reason/);
+    assert.match(alerts[0], new RegExp(`forgedock orchestrate --cancel ${id}`));
+    assert.equal(comments.length, 1);
+    assert.deepEqual(comments[0].slice(0, 5), ["issue", "comment", "77", "-R", "o/r"]);
+    assert.equal(notes[0][0], "notify-me");
+    assert.equal(notes[0][1].batch, id);
+    const h = JSON.parse(readFileSync(join(deps.batchRoot, id, "health.json"), "utf8"));
+    assert.deepEqual(Object.keys(h.checks).sort(), ["T+15", "end"]);
+  });
+
+  it("#5167 a healthy batch emits no alert", async () => {
+    const { deps, timers, comments, notes, gate } = mk({ fail: false });
+    gate.open();
+    const lines = await capture(() => orchestrateFromCli(["1", "2", "3", "--repo", "o/r", "--no-prefilter"], deps));
+    for (const t of timers) await t.fn(); // a late timer after the end still finds the batch healthy
+    assert.ok(!lines.some((l) => /BATCH UNHEALTHY/.test(l)), lines.join("\n"));
+    assert.equal(comments.length + notes.length, 0);
+    const [id] = readdirSyncSafe(deps.batchRoot);
+    const h = JSON.parse(readFileSync(join(deps.batchRoot, id, "health.json"), "utf8"));
+    assert.equal(h.last.healthy, true);
+    assert.equal(h.alertedAt, undefined);
+  });
+});
+
+
+describe("#5168: --requeue accepts engine-error; a claude login failure is held, not an engine-error", () => {
+  const gate = () => { let open; const p = new Promise((r) => { open = r; }); return { p, open }; };
+  it("#5168 --requeue accepts a final engine-error outcome and resets its engine-error count", async () => {
+    const b = openBatch(tmpDir("batch-requeue-5168-"), "b1");
+    b.writePlan({ argv: ["1"], repo: "o/r" });
+    b.store.save({ order: [1, 2], results: { 1: { outcome: "engine-error" }, 2: { outcome: "merged" } } });
+    const r = b.requeue([1, 2], { reason: "login fixed", by: "operator" });
+    assert.deepEqual(r.requeued, [1]);
+    assert.deepEqual(r.refused, [{ issue: 2, reason: "not terminal" }]);
+
+    // The runner applies it: the issue returns to pending with a fresh relaunch (its engine-error count reset).
+    let entries = [];
+    const started = [], g2 = gate(), log = [];
+    const done = orchestrate({ issues: [1, 2], parallel: 2, pollMs: 5, readBody: async () => "", getRequeued: () => entries, onUpdate: (u) => log.push(u),
+      runOne: async (n) => {
+        started.push(n);
+        if (n === 2) { await g2.p; return { terminalReason: "merged" }; }
+        return started.filter((x) => x === 1).length <= 3 ? { terminalReason: "engine-error", detail: "Failed to authenticate" } : { terminalReason: "merged" };
+      } });
+    await until(() => log.some((u) => u.issue === 1 && u.outcome === "engine-error" && !/relaunching/.test(u.detail ?? "")));
+    entries = [{ issue: 1, reason: "login fixed", by: "operator", at: "2026-11-07T00:00:00Z" }];
+    try { await until(() => started.filter((x) => x === 1).length >= 4, 3000); } catch { /* asserted below */ }
+    g2.open();
+    const rows = await done;
+    assert.equal(started.filter((x) => x === 1).length, 4, "two runs before the requeue, then a fresh run and its relaunch");
+    assert.equal(rows.find((x) => x.issue === 1).outcome, "merged");
+    assert.equal(rows.find((x) => x.issue === 1).requeued.prior[0].outcome, "engine-error");
+  });
+
+  it("#5168 deferPolicy holds backend.auth like a usage limit: never capped, never counted", () => {
+    assert.deepEqual(deferPolicy({ code: "backend.auth", retryInSeconds: 900 }, { now: 0, deferrals: 99, maxDeferrals: 3 }), { delayMs: 900_000, hold: true });
+    assert.equal(deferPolicy({ code: "backend.auth" }, { now: 0 }).hold, true);
+  });
+
+  it("#5168 a backend.auth lane stays pending under the account hold: no relaunch used, no breaker, no engine-error", async () => {
+    const { now, sleep, c } = fakeClock();
+    const t0 = c.t, updates = [], starts = {};
+    let calls = 0;
+    const rows = await orchestrate({ issues: [1, 2], parallel: 1, now, sleep, readBody: async () => "", breaker: { errors: 1, window_min: 30 }, maxDeferrals: 1,
+      onUpdate: (u) => updates.push(u),
+      runOne: async (n) => {
+        (starts[n] ??= []).push(now());
+        if (n === 1 && ++calls <= 3) return { terminalReason: "deferred", code: "backend.auth", retryInSeconds: 900, backendId: "default", detail: "claude CLI authentication failed" };
+        return { terminalReason: "merged", pr: 5 };
+      } });
+    assert.deepEqual(rows.map((r) => r.outcome), ["merged", "merged"]);
+    assert.equal(starts[1].length, 4, "deferred past maxDeferrals: the hold is uncapped");
+    assert.ok(starts[2][0] >= t0 + 900_000, "the held account admits nothing until the hold ends");
+    assert.ok(!updates.some((u) => u.outcome === "breaker" || u.outcome === "engine-error"));
+    assert.ok(updates.some((u) => u.outcome === "paused" && /paused \(backend\.auth\)/.test(u.detail ?? "")));
+  });
+});
+
+function readdirSyncSafe(d) { try { return readdirSync(d).filter((n) => !n.endsWith(".json")); } catch { return []; } }

package/bin/lean/conformance.mjs

@@ -73,6 +73,32 @@ export function inIssue(quote, issueText) {
   if (q.length < 3) return false;
   return String(issueText ?? "").split("\n").some((l) => norm(l.replace(ITEM_PREFIX_RE, "")) === q);
 }
+/** #5164: the issue's list or checklist item lines (item marker stripped), or every non-empty line when it has none. */
+export function criterionLines(issueText) {
+  const lines = String(noComments(String(issueText ?? ""))).split("\n");
+  const items = lines.filter((l) => /^\s*(?:[-*+]\s+|\d+[.)]\s+)/.test(l)).map((l) => l.replace(ITEM_PREFIX_RE, "").trim()).filter((l) => norm(l));
+  return items.length ? items : lines.map((l) => l.trim()).filter((l) => norm(l));
+}
+/** #5164: norm() plus what a reviewer retyping a criterion slips on: `#N` reference digits, trailing punctuation, a plural `s`. */
+const loose = (s) => norm(String(s ?? "").replace(/#\d+/g, "#")).replace(/[\s.,;:!?)\]]+$/, "").replace(/\b([a-z]{3,})s\b/g, "$1");
+const MATCH_MIN = 0.8;
+/**
+ * #5164: the issue's exact criterion line a near-verbatim quote stands for, or null. After loose normalisation the quote is a
+ * prefix covering at least 80% of exactly one line, or else at least 80% of its words are in exactly one line (no ties).
+ */
+export function matchCriterion(quote, issueText) {
+  const q = loose(quote);
+  if (q.length < MIN_QUOTE_CHARS) return null;
+  const lines = criterionLines(issueText).map((raw) => ({ raw, l: loose(raw) }));
+  const prefix = lines.filter(({ l }) => l.startsWith(q) && q.length >= MATCH_MIN * l.length);
+  if (prefix.length === 1) return prefix[0].raw;
+  if (prefix.length > 1) return null;
+  const qw = [...new Set(q.match(WORD_RE) ?? [])];
+  if (qw.length < 3) return null;
+  const hits = lines.filter(({ l }) => { const lw = new Set(l.match(WORD_RE) ?? []); return qw.filter((w) => lw.has(w)).length / qw.length >= MATCH_MIN; });
+  return hits.length === 1 ? hits[0].raw : null;
+}
+const MISQUOTE_PREFIX = "issue_coverage quote is not verbatim from the issue";
 // Scan-based (not a one-pass regex), so nested or unclosed markers cannot survive into the scope hash.
 const stripHtmlComments = (s) => noComments(s).replace(/\r\n/g, "\n").trim();
 /**
@@ -268,7 +294,7 @@ const tmpInputProblem = (id, p) => `${id}: reads ${p}, which the command does no
 
 const E2E_TERM = String.raw`(?:e2e|end-to-end|integration|playwright|cypress|live[- ]stack)`;
 const E2E_WORD_RE = new RegExp(String.raw`\b${E2E_TERM}\b`, "i");
-const MOCKED_TERM = String.raw`(?:mock\w*|stub\w*|fake\w*|unit(?:[- ]tests?)?|vitest|jest|component tests?|route tests?)`;
+const MOCKED_TERM = String.raw`(?:mock\w*|stub\w*|fake\w*|unit(?:[- ]?test\w*)?|(?:use[sd]?|using|via|by)\s+units|vitest|jest|component tests?|route tests?)`;
 const MOCKED_RE = new RegExp(String.raw`\b${MOCKED_TERM}\b`, "i");
 // #5116: a negated mock ("do not mock", "no stubs") or a fake clock is not a substitute for the e2e check.
 const NEG_MOCK_RE = /\b(?:do(?:es)? not|don't|never|no|not|without)\s+(?:use\s+|any\s+)?(?:mock\w*|stub\w*|fake\w*)/gi;
@@ -277,7 +303,10 @@ const NEG_DROP_RE = /\b(?:do(?:es)? not|don't|never|not)\s+(?:be\s+|been\s+|bein
 const FAKE_CLOCK_RE = /\bfake[- ](?:timers?|clocks?)\b/gi;
 // A weakener governs the e2e term only within a few words and the same clause (no . or ; between them).
 const GAP = String.raw`(?:[\s,]+\w+){0,5}?[\s,]+`;
-const DROP_BEFORE_RE = new RegExp(String.raw`\b(?:no|not|without|never|drop(?:ped|s|ping)?|skip(?:ped|s|ping)?|replac\w+|downgrad\w+|swap\w*)${GAP}${E2E_TERM}\b`, "i");
+// #5145/#5157: only the determiner "no" ("no new fixtures needed for e2e") stops at a preposition, since it negates a noun. not/without/never
+// negate the verb that governs e2e ("not need to run e2e", "not with e2e") and "no need/reason/point/requirement" negates the action; all keep the wide GAP.
+const NEG_GAP = String.raw`(?:[\s,]+(?!(?:for|of|in|on|at|by|with|from|via)\b)\w+){0,5}?[\s,]+`;
+const DROP_BEFORE_RE = new RegExp(String.raw`\b(?:no${NEG_GAP}|(?:not|without|never|no\s+(?:need|reason|point|requirement)|drop(?:ped|s|ping)?|skip(?:ped|s|ping)?|replac\w+|downgrad\w+|swap\w*)${GAP})${E2E_TERM}\b`, "i");
 const DROP_AFTER_RE = new RegExp(String.raw`\b${E2E_TERM}${GAP}(?:replaced|dropped|skipped|swapped|downgraded|unnecessary|(?:not|no longer)\s+(?:needed|required|necessary|run\w*|used|executed))\b`, "i");
 const INSTEAD_OF_RE = new RegExp(String.raw`\b${MOCKED_TERM}[^.;]{0,60}?\b(?:instead of|rather than|in lieu of)\b${GAP}${E2E_TERM}\b`, "i");
 const PROBE_RE = /forge-probe|acceptance[- ]probe/i;
@@ -1000,6 +1029,13 @@ const MISSING_PATH_RE = /^[^:]+: evidence path .+ does not exist$/;
 export function evidencePathOnly(problems = []) {
   return problems.length > 0 && problems.every((p) => MISSING_PATH_RE.test(String(p)));
 }
+/**
+ * #5164: true when every problem of an incomplete review is a reviewer slip a targeted re-ask can fix: an evidence path that
+ * did not resolve (#4327) or an issue_coverage misquote. A real coverage gap is never one, so it keeps the two-run limit.
+ */
+export function reaskable(problems = []) {
+  return problems.length > 0 && problems.every((p) => MISSING_PATH_RE.test(String(p)) || String(p).startsWith(MISQUOTE_PREFIX));
+}
 const reviewedFiles = (changedFiles, ignore) => changedFiles.filter((x) => !ignore.some((pre) => x.startsWith(pre)));
 
 /**
@@ -1007,7 +1043,7 @@ const reviewedFiles = (changedFiles, ignore) => changedFiles.filter((x) => !igno
  * contract's own authorization ("none" when unauthorized, still scope creep), a preserve row per id as "unverified"
  * (still preserve_violated), and implemented evidence rewritten to `path:line` with the repo path. Returns a new object.
  */
-export function fillEngineRows(rv, { contract, changedFiles = [], repoFiles = [], ignore = [] }) {
+export function fillEngineRows(rv, { contract, changedFiles = [], repoFiles = [], ignore = [], issueText = null }) {
   if (!rv || typeof rv !== "object") return rv;
   const out = { ...rv };
   const scope = Array.isArray(rv.scope) ? [...rv.scope] : [];
@@ -1016,6 +1052,14 @@ export function fillEngineRows(rv, { contract, changedFiles = [], repoFiles = []
   const pres = Array.isArray(rv.preserve) ? [...rv.preserve] : [];
   for (const c of contract.preserve ?? []) if (!pres.some((x) => x?.id === c.id)) pres.push({ id: c.id, status: "unverified", note: "no row from the reviewer", filled: true });
   out.preserve = pres;
+  // #5164: a near-verbatim coverage quote is replaced by the issue's exact criterion line; the original stays as `requoted`
+  if (Array.isArray(rv.issue_coverage) && issueText != null) {
+    out.issue_coverage = rv.issue_coverage.map((c) => {
+      if (!c || typeof c !== "object" || typeof c.quote !== "string" || inIssue(c.quote, issueText)) return c;
+      const line = matchCriterion(c.quote, issueText);
+      return line ? { ...c, quote: line, requoted: c.quote } : c;
+    });
+  }
   if (Array.isArray(rv.requirements)) {
     out.requirements = rv.requirements.map((r) => {
       if (r?.status !== "implemented" && r?.instrumented !== true) return r;
@@ -1036,7 +1080,10 @@ export function checkCompleteness(rv, { contract, changedFiles, issueText, pathE
   if (!cov?.length) miss("issue_coverage", "issue_coverage is missing or empty");
   for (const c of cov ?? []) {
     if (!COVER_STATUS.includes(c?.status)) miss("issue_coverage", `issue_coverage status invalid: ${c?.status}`);
-    if (!inIssue(c?.quote, issueText)) miss("issue_coverage", `issue_coverage quote is not verbatim from the issue: "${String(c?.quote ?? "").slice(0, 60)}"`);
+    if (!inIssue(c?.quote, issueText)) {
+      const near = nearestSpan(c?.quote, criterionLines(issueText).join("\n"));
+      miss("issue_coverage", `${MISQUOTE_PREFIX}: "${String(c?.quote ?? "").slice(0, 60)}"${near ? `; nearest criterion line: "${near}"` : ""}`);
+    }
   }
   const reqs = arr("requirements");
   if (!reqs) p.push("requirements rows are missing");
@@ -1283,12 +1330,37 @@ export function followupItems(reqs, { now = Date.now() } = {}) {
   });
 }
 
-/** #4388: the follow-up script's `key\tissue` lines as {[item.key]: issue}, matched on trimmed keys (the script trims what it echoes); unmatched items omitted. */
+/**
+ * #5141: the FORGE:FOLLOWUP_PENDING note for follow-ups the lane could not file before or after the merge. Each row keeps the
+ * requirement text and the `FORGE:DEFERRED_FROM: #<n>` marker the follow-up script looks up, so a later pass files it once.
+ */
+export function renderPendingFollowups(rows, pr) {
+  const flat = (s) => String(s ?? "").replace(/[\t\r\n]+/g, " ").trim();
+  return [`## Follow-up pending`, `Merged by PR #${pr}, but the tracking issue could not be filed, so this issue stays open until it is. Still to file (idempotent by the marker):`, "",
+    ...rows.map((r) => `- ${flat(r.id)} (${flat(r.disposition)}): ${flat(r.quote)} | why: ${flat(r.why)} | \`${r.marker}\``)].join("\n");
+}
+
+/**
+ * #4388: the follow-up script's `key\tissue` lines as {[item.key]: issue}; unmatched items omitted. Both sides get every
+ * identity rule of scripts/file-deferred-followups.sh: trimmed (#4388), backticks stripped (#4984) and repeated leading
+ * `R<n>: R<m>:` prefixes collapsed to the first (#5141: a quote starting with its own id looped on followup.unavailable).
+ * An item still unmatched takes the one echoed row whose identity starts with `<item.id>:`; never when several do.
+ */
 export function followupMap(out, items) {
+  const norm = (k) => {
+    let s = String(k).replace(/`/g, "").trim(), m;
+    while ((m = /^(R\d+:)\s*R\d+:\s*(.*)$/s.exec(s))) s = `${m[1]} ${m[2]}`;
+    return s;
+  };
   const echoed = new Map();
-  const norm = (k) => String(k).replace(/`/g, "").trim(); // #4984: the script strips backticks from the label it echoes
   for (const l of String(out ?? "").split("\n")) { const [k, n] = l.split("\t"); if (k && /^\d+$/.test(String(n ?? "").trim())) echoed.set(norm(k), Number(n)); }
-  return Object.fromEntries(items.filter((i) => echoed.has(norm(i.key))).map((i) => [i.key, echoed.get(norm(i.key))]));
+  const byId = (id) => { const hits = [...echoed].filter(([k]) => k.startsWith(`${id}:`)); return hits.length === 1 ? hits[0][1] : undefined; };
+  const res = {};
+  for (const i of items) {
+    const n = echoed.get(norm(i.key)) ?? (i.id ? byId(String(i.id)) : undefined);
+    if (n !== undefined) res[i.key] = n;
+  }
+  return res;
 }
 
 /**

package/bin/lean/conformance.test.mjs

@@ -3,7 +3,7 @@
 import { readFileSync } from "node:fs";
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
-import { removedNamedPaths, removedPathsOf, shellSyntaxError, unrunnableValidate, noopCommand, substituteVerdict, describesUnrunnableCommand, vitestQuietFlag, normalizeRunnerCommand, cliUsageError, validateContract, applyAmendments, amendmentKindProblems, precheck, hotspotGrowth, reproFailures, isBugIssue, parseReview, checkCompleteness, decide, closePlan, isInvestigation, formatShadowSummary, followupItems, inIssue, isTestPath, normalizeEvidencePath, mergeReviewRows, reviewSkeleton, missingIds, resolveEvidencePath, movingBaseDiff, scopeText, evidencePathLine, evidencePathOnly, explainFailures, resolveForgedockPaths, missingTool, repoTracks, tmpdirInputs, isScopeCheck, isPureScopeCheck, dropScopeValidates, tagOutOfBand, outOfBandRequirements, isOutOfBand, followupMap, VERIFY_MODES, OUT_OF_BAND_RE, FOLLOWUP_CLASSES, followupClass, BUCKETS, bucketKind, bucketProblems, bucketTally, isE2eCommand, e2eVerified, impliedDocDeliverables, applyValidateRecipes, deferChecklessPostDeploy, substituteShellProblem, reproEnvMiss, ORCHESTRATOR_BUCKET, ownerRoute, weakenedE2eDecisions } from "./conformance.mjs";
+import { removedNamedPaths, removedPathsOf, shellSyntaxError, unrunnableValidate, noopCommand, substituteVerdict, describesUnrunnableCommand, vitestQuietFlag, normalizeRunnerCommand, cliUsageError, validateContract, applyAmendments, amendmentKindProblems, precheck, hotspotGrowth, reproFailures, isBugIssue, parseReview, checkCompleteness, decide, closePlan, isInvestigation, formatShadowSummary, followupItems, inIssue, isTestPath, normalizeEvidencePath, mergeReviewRows, reviewSkeleton, missingIds, resolveEvidencePath, movingBaseDiff, scopeText, evidencePathLine, evidencePathOnly, reaskable, matchCriterion, criterionLines, fillEngineRows, explainFailures, resolveForgedockPaths, missingTool, repoTracks, tmpdirInputs, isScopeCheck, isPureScopeCheck, dropScopeValidates, tagOutOfBand, outOfBandRequirements, isOutOfBand, followupMap, renderPendingFollowups, VERIFY_MODES, OUT_OF_BAND_RE, FOLLOWUP_CLASSES, followupClass, BUCKETS, bucketKind, bucketProblems, bucketTally, isE2eCommand, e2eVerified, impliedDocDeliverables, applyValidateRecipes, deferChecklessPostDeploy, substituteShellProblem, reproEnvMiss, ORCHESTRATOR_BUCKET, ownerRoute, weakenedE2eDecisions } from "./conformance.mjs";
 
 const ISSUE = "## Requirements\n1. The scrape route must release the spend reservation on 429.\n2. The search route must release the spend reservation on 429.\n\n- [ ] Billing pricing is unchanged.";
 const Q1 = "The scrape route must release the spend reservation on 429.";
@@ -494,6 +494,38 @@ describe("conformance review: the engine computes the verdict from complete rows
   it("incomplete: a coverage quote paraphrased instead of verbatim", () => {
     assert.equal(decide({ ...good, issue_coverage: [{ quote: "scrape should release money on rate limits", status: "covered" }] }, ctx).state, "review.incomplete");
   });
+  it("#5164 a near-verbatim coverage misquote is requoted to the criterion line and the review completes", () => {
+    const issue = "## Acceptance Criteria\n- [ ] Every manifest step kind from #38826 compiles to engine nodes, with a test per kind.\n- [ ] The scrape route must release the spend reservation on 429.";
+    const k = { ...C, requirements: [{ id: "R1", quote: "The scrape route must release the spend reservation on 429.", disposition: "deliver" }, { id: "R2", quote: Q2, disposition: "deliver" }] };
+    const quote = "Every manifest step kind from #38829 compiles to engine node";
+    const rv = { ...good, issue_coverage: [{ quote, contract_ids: ["R1"], status: "covered" }, { quote: "The scrape route must release the spend reservation on 429.", status: "covered" }] };
+    const d = decide(rv, { ...ctx, contract: k, issueText: `${issue}\n${ISSUE}` });
+    assert.equal(d.state, "conforms");
+    assert.equal(d.review.issue_coverage[0].quote, "Every manifest step kind from #38826 compiles to engine nodes, with a test per kind.");
+    assert.equal(d.review.issue_coverage[0].requoted, quote, "the substitution is recorded in the review");
+  });
+  it("#5164 matchCriterion: loose prefix or a unique token match; a paraphrase, an ambiguous or a short quote matches nothing", () => {
+    const t = "- [ ] Every manifest step kind from #38826 compiles to engine nodes, with a test per kind.\n- The scrape route must release the spend reservation on 429.\n- The search route must release the spend reservation on 429.";
+    assert.deepEqual(criterionLines(t)[0], "Every manifest step kind from #38826 compiles to engine nodes, with a test per kind.");
+    assert.equal(matchCriterion("every manifest step kind from #1 compiles to engine node with a test per kinds", t), criterionLines(t)[0], "prefix tier");
+    assert.equal(matchCriterion("The scrape route must release the spend reservations on 429", t), "The scrape route must release the spend reservation on 429.");
+    assert.equal(matchCriterion("route must release the spend reservation", t), null, "two lines tie");
+    assert.equal(matchCriterion("scrape should release money on rate limits", t), null);
+    assert.equal(matchCriterion("engine node", t), null);
+  });
+  it("#5164 a quote that matches no criterion still fails as incomplete, naming the nearest criterion line; it is re-askable, a real gap is not", () => {
+    const d = decide({ ...good, issue_coverage: [{ quote: "scrape should release money on rate limits", status: "covered" }] }, ctx);
+    assert.equal(d.state, "review.incomplete");
+    assert.equal(d.review.issue_coverage[0].requoted, undefined);
+    const problems = d.failures.map((f) => f.detail);
+    assert.match(problems[0], /nearest criterion line: "The scrape route must release/);
+    assert.ok(reaskable(problems));
+    assert.ok(reaskable(["R1: evidence path /layout.tsx does not exist"]), "#4327 evidence paths stay re-askable");
+    assert.ok(!reaskable([...problems, "requirement R1 needs exactly one row (has 0)"]));
+    assert.ok(!reaskable(["issue_coverage is missing or empty"]));
+    assert.ok(!reaskable([]));
+    assert.deepEqual(fillEngineRows(good, ctx).issue_coverage, good.issue_coverage, "verbatim rows are untouched");
+  });
   it("omission: an issue requirement missing from or narrowed by the contract", () => {
     const d = decide({ ...good, issue_coverage: [...good.issue_coverage.slice(0, 2), { quote: "Billing pricing is unchanged.", status: "missing" }] }, ctx);
     assert.deepEqual(codes(d), ["conformance.omission"]);
@@ -903,6 +935,22 @@ describe("#4594 amend-requirement", () => {
   it("the reviewer prompt tells it to compare amended_from with the amendment (#4996)", () => {
     assert.match(readFileSync(new URL("./prompts.mjs", import.meta.url), "utf8"), /amended_from\.quote and amended_from\.why with amendment\.text/);
   });
+  it("followupMap matches a key whose quote repeats its own R<n>: prefix, as the script collapses it (#5141)", () => {
+    const items = followupItems([{ id: "R6", disposition: "defer", bucket: "host", quote: "R6: Fleet: x in (browser, replay) over 48h.", why: "w" }, { id: "R1", disposition: "defer", bucket: "new-issue", quote: "R3: Named accounts", why: "w" }]);
+    assert.deepEqual(followupMap("R6: Fleet: x in (browser, replay) over 48h.\t901\nR1: Named accounts\t902\n", items), { [items[0].key]: 901, [items[1].key]: 902 });
+  });
+
+  it("renderPendingFollowups lists each unfiled follow-up with its text and the FORGE:DEFERRED_FROM marker (#5141)", () => {
+    const md = renderPendingFollowups([{ id: "R2", disposition: "defer", quote: "a\tb\nc", why: "w", marker: "FORGE:DEFERRED_FROM: #7" }], 12);
+    assert.match(md, /^## Follow-up pending\nMerged by PR #12/);
+    assert.match(md, /\n- R2 \(defer\): a b c \| why: w \| `FORGE:DEFERRED_FROM: #7`$/);
+  });
+  it("followupMap falls back to the single echoed row carrying the item id, never to an ambiguous one (#5141)", () => {
+    assert.deepEqual(followupMap("R2: drifted text\t7\n", [{ id: "R2", key: "R2: original text" }]), { "R2: original text": 7 });
+    assert.deepEqual(followupMap("R2: a\t7\nR2: b\t8\n", [{ id: "R2", key: "R2: c" }]), {});
+    assert.deepEqual(followupMap("R20: a\t7\n", [{ id: "R2", key: "R2: c" }]), {});
+  });
+
   it("followupMap matches an item key whose backticks the script stripped (#4984)", () => {
     assert.deepEqual(followupMap("R2: wire pd.py in\t20\n", [{ key: "R2: wire `pd.py` in" }]), { "R2: wire `pd.py` in": 20 });
   });
@@ -1343,6 +1391,20 @@ describe("#5087 a plan decision may not weaken an e2e/integration criterion to m
       assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ id: "K1", choice, source: "doc" }] }), ["K1"], choice);
     }
   });
+  it("#5145 unittest/unittests and substitute units are mocks; a negator across a preposition is not a weakener", () => {
+    for (const choice of ["Replace e2e with unittest cases", "Skip e2e, covered by unittests", "e2e dropped, use units", "Use unittest cases instead of the e2e check"]) {
+      assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ id: "K1", choice, source: "doc" }] }), ["K1"], choice);
+    }
+    for (const choice of ["Keep playwright e2e coverage; add unit tests (no new fixtures needed for e2e)"]) {
+      assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ id: "K1", choice, source: "doc" }] }), [], choice);
+    }
+  });
+  it("#5157 negated verbs and bare negators before a preposition still weaken e2e", () => {
+    for (const choice of ["We do not need to run e2e; mocked route tests cover it", "will not rely on e2e, mock the API", "not with e2e: unit tests used", "not for e2e, unit tests used", "no need to run e2e; mocks cover it", "no need for e2e, mocks cover it"]) {
+      assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ id: "K1", choice, source: "doc" }] }), ["K1"], choice);
+    }
+    assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ id: "K1", choice: "Keep playwright e2e coverage; add unit tests (no new fixtures needed for e2e)", source: "doc" }] }), []);
+  });
   it("leaves unrelated decisions and contracts without decisions alone", () => {
     assert.deepEqual(weakenedE2eDecisions(C), []);
     assert.deepEqual(weakenedE2eDecisions({ ...C, decisions: [{ id: "K1", choice: "Run the Playwright e2e suite against the live stack", source: "doc" }, { id: "K3", choice: "Use unit tests with mocks for the parser", source: "spec" }] }), []);