forgedock 1.50.0 → 1.51.0

package/bin/lean/lean.test.mjs

@@ -188,7 +188,7 @@ function world(o = {}) {
     fs: { ...(o.wtExists ? { exists: async (p) => p.startsWith("/wt/lean-7") } : {}), stat: async (p) => (p in w.files ? { mtimeMs: w.mtimes[p] ?? 1 } : null), read: async (p) => { if (!(p in w.files)) throw new Error("ENOENT"); return w.files[p]; }, append: async (p, t) => { w.files[p] = (w.files[p] ?? "") + t; }, write: async (p, t) => { w.files[p] = t; }},
     fileFollowups: async ({ parent, items }) => { w.followups.push({ parent, items }); if (o.followupError) throw Object.assign(new Error(o.followupError), { stdout: o.followupStdout ?? "" });
       if (o.followupRet) return o.followupRet(w.followups.length, items);
-      if (w.followups.length <= (o.followupFailTimes ?? 0)) throw new Error("DEFERRED_LOOKUP=FAILED"); if (w.followups.length <= (o.followupMissingTimes ?? 0)) return {}; return Object.fromEntries(items.map((i) => [i.key, o.followupIssue ?? 900])); },
+      if (w.followups.length <= (o.followupFailTimes ?? 0)) throw new Error("DEFERRED_LOOKUP=FAILED"); if (w.followups.length <= (o.followupMissingTimes ?? 0)) return {}; return Object.fromEntries(items.filter((i) => !(o.followupSkip ?? []).some((q) => JSON.stringify(i).includes(q))).map((i) => [i.key, o.followupIssue ?? 900])); },
   };
   return w;
 }
@@ -281,13 +281,16 @@ describe("core work-on", () => {
     const t = traj(w)[0];
     for (const needle of ["| Validate | INVALID |", "| Plan | skipped |", "| Implement | skipped |", "| Review | skipped |", "| PR | none |", "| Close | issue closed (not planned) |"]) assert.ok(t.includes(needle), needle);
     assert.equal(w.closed.length, 1);
+    assert.equal(w.closed[0][w.closed[0].indexOf("--reason") + 1], "not planned", "#5152: invalid keeps not planned");
     assert.equal(w.prs.length, 0);
     assert.equal(reviewers(w).length, 0);
   });
 
-  it("already-fixed with evidence also closes", async () => {
+  it("already-fixed with evidence also closes, as completed (#5152)", async () => {
     const w = world({ changed: [], result: { status: "already-fixed", summary: "done upstream", evidence: ["a.js:1"], tests: [] } });
     assert.equal((await run(w)).terminalReason, "invalid");
+    assert.deepEqual(w.closed.map((a) => a[a.indexOf("--reason") + 1]), ["completed"], "#5152: already-fixed is delivered, never not planned");
+    assert.ok(traj(w)[0].includes("| Close | issue closed (completed) |"));
   });
 
   it("a failed needs-human comment is recorded as an anomaly and the lane still ends needs-human (#4905)", async () => {
@@ -383,6 +386,21 @@ describe("core work-on", () => {
     assert.equal(r2.code, "review.incomplete"); assert.equal(reviewers(w2).length, 3, "at most three reviewer runs"); assert.equal(w2.merges.length, 0);
   });
 
+  it("#5164 a coverage misquote gets one more targeted re-ask with the issue's criterion lines; a near-verbatim one is requoted without a re-ask", async () => {
+    const mis = () => conf({ issue_coverage: [{ quote: "foo copes when nothing at all is passed", contract_ids: ["R1"], status: "covered" }] });
+    const w = world({ reviews: [mis(), mis(), ok()] });
+    assert.equal((await run(w)).terminalReason, "merged");
+    const rv = reviewers(w);
+    assert.equal(rv.length, 3); assert.equal(builders(w).length, 2, "never charged to the builder");
+    for (const i of [1, 2]) { assert.match(rv[i][4], /<issue_criteria>/); assert.match(rv[i][4], /- foo must handle a null argument without throwing\./); }
+    assert.match(rv[1][4], /answer ONLY for these ids or sections: issue_coverage/);
+    const w2 = world({ reviews: [mis(), mis(), mis(), ok()] });
+    const r2 = await run(w2);
+    assert.equal(r2.code, "review.incomplete"); assert.equal(reviewers(w2).length, 3, "at most three reviewer runs"); assert.equal(w2.merges.length, 0);
+    const w3 = world({ reviews: [conf({ issue_coverage: [{ quote: "foo must handle null arguments without throwing", contract_ids: ["R1"], status: "covered" }] })] });
+    assert.equal((await run(w3)).terminalReason, "merged"); assert.equal(reviewers(w3).length, 1);
+  });
+
   it("a CONFORMS verdict whose rows fail is not conforming (the engine computes the verdict)", async () => {
     const w = world({ reviews: [bad("half done", "CONFORMS"), ok()] });
     assert.equal((await run(w)).terminalReason, "merged");
@@ -689,13 +707,13 @@ describe("core work-on", () => {
     assert.ok(w.labels.includes("decomposed"));
   });
 
-  it("#4337 with decomposition.close_parent a split closes the parent not planned after its FORGE:DECOMPOSED trail and label, listing every sub-issue", async () => {
+  it("#4337 #5152 with decomposition.close_parent a split closes the parent completed after its FORGE:DECOMPOSED trail and label, listing every sub-issue", async () => {
     const w = depWorld({ changed: [], result: splitBlock }, {});
     const r = await run(w, { closeParent: true });
     assert.equal(r.terminalReason, "decomposed");
     assert.equal(w.closed.length, 1);
     const c = w.closed[0];
-    assert.equal(c[c.indexOf("--reason") + 1], "not planned");
+    assert.equal(c[c.indexOf("--reason") + 1], "completed", "#5152: the scope moved to the sub-issues, it was not dropped");
     const note = c[c.indexOf("--comment") + 1];
     assert.match(note, /#201/); assert.match(note, /#202/);
     assert.ok(w.labels.includes("decomposed"));
@@ -998,6 +1016,9 @@ describe("conformance gate (frozen contract, precheck, structured review)", () =
     const note = w.comments.find((c) => c.includes("FORGE:FOLLOWUP_PENDING"));
     assert.match(note, /R2 \(defer\): Existing callers of foo keep working\..*`FORGE:DEFERRED_FROM: #7`/);
     assert.ok(!w.edits.some((e) => e.includes("--add-label") && e.includes("needs-human")));
+    assert.ok(!w.comments.some((c) => /Closed as/.test(c)), "#5159: no note says the kept-open issue was closed");
+    assert.match(traj(w).join("\n"), /left open \(follow-up pending\)/, "#5159: the trajectory Close row says left open");
+    assert.doesNotMatch(traj(w).join("\n"), /issue closed \(/);
   });
 
   it("#5141 a follow-up that keeps failing before the PR is filed by the close step after the merge", async () => {
@@ -1053,6 +1074,21 @@ describe("conformance gate (frozen contract, precheck, structured review)", () =
     assert.equal(r2.code, "followup.unavailable"); assert.equal(w2.followups.length, 1); assert.equal(w2.prs.length, 0);
   });
 
+  it("#5159 one follow-up tracked, another still pending: FORGE:TRACKED says left open, never 'Closed as', and the trajectory says left open", async () => {
+    const k0 = two("defer", { why: "w" });
+    const k = { ...k0, requirements: [...k0.requirements, { id: "R3", quote: "foo crashes on null input.", disposition: "defer", bucket: "post-deploy", why: "w" }] };
+    const w = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], followupSkip: ["foo crashes on null input."] });
+    const r = await run(w);
+    assert.equal(r.terminalReason, "merged");
+    assert.deepEqual((r.pendingFollowups ?? []).map((p) => p.id), ["R3"]);
+    assert.equal(w.closed.length, 0);
+    const tracked = w.comments.find((c) => c.includes("FORGE:TRACKED"));
+    assert.ok(tracked, "the tracked item is still recorded");
+    assert.match(tracked, /Left open: follow-up pending/); assert.match(tracked, /#900/);
+    assert.ok(!w.comments.some((c) => /Closed as/.test(c)));
+    assert.match(traj(w).join("\n"), /left open \(follow-up pending\)/);
+  });
+
   it("a tracking issue that is not open is not a tracking issue: the item stays pending and is recorded", async () => {
     const k = two("defer", { why: "w" });
     const w = world({ contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)], issueStates: { 900: "CLOSED" } });
@@ -1712,13 +1748,13 @@ describe("conformance shadow mode (the default)", () => {
     assert.deepEqual(rs.conformance, { mode: "shadow", would: "nonconforming", risk: false });
   });
 
-  it("#4398 an investigation whose question is deferred closes partial (not planned), carried forward in the tracking issue", async () => {
+  it("#4398 #5152 an investigation whose question is deferred closes partial (completed), carried forward in the tracking issue", async () => {
     const k = { ...CONTRACT, preserve: [], requirements: [CONTRACT.requirements[0], { id: "R2", quote: "Existing callers of foo keep working.", disposition: "defer", why: "w", bucket: "new-issue" }] };
     const w = world({ title: "investigate(stealth): which signal is rejected", contract: k, claims: [{ id: "R1", status: "implemented" }], reviews: [conf({}, k)] });
     const r = await runShadow(w);
     assert.equal(r.terminalReason, "merged"); assert.equal(r.close, "partial");
-    assert.deepEqual(w.closed.map((a) => a[a.indexOf("--reason") + 1]), ["not planned"]);
-    assert.ok(w.comments.some((c) => c.includes("<!-- FORGE:TRACKED -->") && /Closed as partial[\s\S]*carried forward in #900/.test(c)));
+    assert.deepEqual(w.closed.map((a) => a[a.indexOf("--reason") + 1]), ["completed"], "#5152: merged with a tracked remainder is completed");
+    assert.ok(w.comments.some((c) => c.includes("<!-- FORGE:TRACKED -->") && /Closed as partial[\s\S]*Closed as completed by PR #[\s\S]*carried forward in #900/.test(c)));
     assert.ok(traj(w)[0].includes("| Close | issue closed (partial) |"));
   });
 
@@ -1747,7 +1783,7 @@ describe("conformance shadow mode (the default)", () => {
     assert.equal(r.terminalReason, "merged"); assert.equal(r.close, "partial");
     assert.equal(w.followups.length, 1); assert.match(w.followups[0].items[0].key, /^R1: /); assert.match(w.followups[0].items[0].why, /investigation question not answered/);
     assert.match(w.prs[0].join(" "), /#900/);
-    assert.deepEqual(w.closed.map((a) => a[a.indexOf("--reason") + 1]), ["not planned"]);
+    assert.deepEqual(w.closed.map((a) => a[a.indexOf("--reason") + 1]), ["completed"]);
   });
 
   it("#4398 an answered investigation and a non-investigation with a deferral both close completed", async () => {
@@ -2649,10 +2685,10 @@ describe("orchestrate", () => {
     assert.ok(h.log.ends.indexOf(1) < h.log.starts.indexOf(2), JSON.stringify(h.log));
   });
 
-  it("a dependent is skipped, without running, when its dependency ends needs-human (transitively)", async () => {
+  it("a dependent is held, without running, when its dependency ends needs-human (transitively)", async () => {
     const h = harness({ 2: "**Depends on**: #1", 3: "**Depends on**: #2" }, { 1: "needs-human" });
     const rows = await orchestrate({ issues: [1, 2, 3, 4], parallel: 3, ...h });
-    assert.deepEqual(rows.map((r) => r.outcome), ["needs-human", "skipped", "skipped", "merged"]);
+    assert.deepEqual(rows.map((r) => r.outcome), ["needs-human", "held", "held", "merged"]);
     assert.ok(!h.log.starts.includes(2) && !h.log.starts.includes(3));
     assert.match(rows[1].detail, /#1/);
   });
@@ -2733,7 +2769,7 @@ describe("orchestrate", () => {
       const rows = await orchestrate({ issues: [9, 1], parallel: 1, readBody: async (n) => (n === 1 ? "**Depends on**: #9" : ""), ...(dispatchCheck ? { dispatchCheck } : {}),
         runOne: async (n) => { log.push(n); return { terminalReason: "needs-human", detail: "ci.red" }; } });
       assert.deepEqual(log, [9]);
-      assert.deepEqual(rows.map((r) => [r.issue, r.outcome]), [[9, "needs-human"], [1, "skipped"]]);
+      assert.deepEqual(rows.map((r) => [r.issue, r.outcome]), [[9, "needs-human"], [1, "held"]]);
     }
   });
 
@@ -2744,7 +2780,7 @@ describe("orchestrate", () => {
       onUpdate: (r) => rowsSeen.push(r),
       dispatchCheck: async (n) => (n === 9 && merged ? { outcome: "merged", pr: 90, detail: "PR #90 already merged" } : null),
       runOne: async (n) => { if (n === 9) { merged = true; return { terminalReason: "needs-human", detail: "ci.red" }; } return { terminalReason: "merged", pr: 101 }; } });
-    const skipRow = rowsSeen.find((r) => r.issue === 1 && r.outcome === "skipped");
+    const skipRow = rowsSeen.find((r) => r.issue === 1 && r.outcome === "held");
     assert.equal(skipRow.waiting, true);
     assert.equal(skipRow.trigger, 9);
     assert.ok(rowsSeen.some((r) => r.issue === 1 && r.outcome === "readmitted" && r.trigger === 9));
@@ -2756,7 +2792,7 @@ describe("orchestrate", () => {
     const rows = await orchestrate({ issues: [9, 1], parallel: 1, readBody: async (n) => (n === 1 ? "**Depends on**: #9" : ""),
       dispatchCheck: async (n) => { if (n === 9 && ran) { checks++; return { outcome: "invalid", detail: "issue closed (not planned)", final: true }; } return null; },
       runOne: async () => { ran = true; return { terminalReason: "needs-human", detail: "ci.red" }; } });
-    assert.deepEqual(rows.map((r) => [r.issue, r.outcome, r.waiting]), [[9, "needs-human", undefined], [1, "skipped", undefined]]);
+    assert.deepEqual(rows.map((r) => [r.issue, r.outcome, r.waiting]), [[9, "needs-human", undefined], [1, "held", undefined]]);
     assert.equal(checks, 1, "a final blocker is not re-checked");
   });
 
@@ -3410,6 +3446,31 @@ describe("usage limit, lease takeover, worktree setup, run tmp (#4101-#4104)", (
     assert.equal(w.merges.length, 0);
   });
 
+  it("#5168 a claude login failure ends the lane deferred/backend.auth with the account, not engine-error", async () => {
+    const w = world(); projector(w, null); const sleeps = [];
+    const s0 = w.io.sleep; w.io.sleep = async (ms) => { sleeps.push(ms); return s0(ms); };
+    const authErr = Object.assign(new Error("claude CLI exited with status 1. Failed to authenticate. API Error: 401"), { code: "CLI_BACKEND_FAILED", authFailure: true });
+    let tries = 0; const orig = w.io.runner; w.io.runner = async (c) => { if (c.role === "builder") { tries++; throw authErr; } return orig(c); };
+    const r = await run(w);
+    assert.equal(r.terminalReason, "deferred");
+    assert.equal(r.code, "backend.auth");
+    assert.equal(r.retryInSeconds, 900);
+    assert.equal(r.backendId, laneBackendId(process.env), "the hold names the account whose login failed");
+    assert.match(r.detail, /claude CLI authentication failed/);
+    assert.equal(tries, 1, "no in-lane retry or pause on a dead login");
+    assert.equal(sleeps.length, 0);
+    assert.equal(w.edits.some((e) => e.includes("needs-human")), false);
+    assert.equal(w.leaseWrites.at(-1).lease, null, "lease released");
+  });
+
+  it("#5168 an error that is both a usage limit and auth-like stays rate_limited", async () => {
+    const w = world();
+    failFirstBuilder(w, limitErr({ authFailure: true, resetAtEpochMs: 3 * 3600 * 1000, resetAt: "8:30pm" }));
+    const r = await run(w);
+    assert.equal(r.terminalReason, "deferred");
+    assert.equal(r.code, "rate_limited");
+  });
+
   it("#4101 unknown reset pauses a bounded number of times, then defers", async () => {
     const w = world(); let sleeps = 0;
     const s0 = w.io.sleep; w.io.sleep = async (ms) => { sleeps++; return s0(ms); };

package/bin/lean/orchestrate-blocked.test.mjs

@@ -120,3 +120,50 @@ describe("#5048: the pool is unreachable only after a failed capacity probe", ()
     assert.deepEqual(notes, ["down", "clear"]);
   });
 });
+
+describe("#5162: failed roots hold their subtree; only real cycles are cycles", () => {
+  const memStore = () => { let st = null; return { load: () => st, save: (s) => { st = JSON.parse(JSON.stringify(s)); }, get: () => st }; };
+  const chain = { 1: "", 2: "**Depends on**: #1", 3: "**Depends on**: #2", 4: "**Depends on**: #1, #3" };
+  const outcome = (rows, n) => rows.find((r) => r.issue === n);
+
+  it("a DAG whose engine-error root ends marks no row dependency cycle; every dependent is held and names the root", async () => {
+    const rows = await orchestrate({ issues: [1, 2, 3, 4], parallel: 2, pollMs: 5, readBody: async (n) => chain[n], engineErrorRetries: 0, transientRetries: 0,
+      runOne: async () => ({ terminalReason: "engine-error", detail: "boom" }) });
+    assert.ok(!rows.some((r) => /dependency cycle/.test(r.detail ?? "")), JSON.stringify(rows));
+    for (const n of [2, 3, 4]) { assert.equal(outcome(rows, n).outcome, "held"); assert.match(outcome(rows, n).detail, /^blocked by #1 \(engine-error\)$/); }
+  });
+
+  it("a genuine cycle is still labelled dependency cycle; its downstream names a member", async () => {
+    const bodies = { 1: "**Depends on**: #2", 2: "**Depends on**: #1", 3: "**Depends on**: #2" };
+    const rows = await orchestrate({ issues: [1, 2, 3], parallel: 2, pollMs: 5, readBody: async (n) => bodies[n], runOne: async () => merged });
+    assert.deepEqual(rows.map((r) => r.outcome), ["skipped", "skipped", "skipped"]);
+    assert.equal(outcome(rows, 1).detail, "dependency cycle");
+    assert.equal(outcome(rows, 2).detail, "dependency cycle");
+    assert.match(outcome(rows, 3).detail, /^blocked by #[12] \(dependency cycle\)$/);
+  });
+
+  it("dependents of a needs-human root end held; after the label is removed a resume admits root then dependents in order", async () => {
+    const store = memStore();
+    const first = await orchestrate({ issues: [1, 2, 3, 4], parallel: 2, pollMs: 5, store, readBody: async (n) => chain[n], runOne: async () => ({ terminalReason: "needs-human", code: "ci.red", detail: "red" }) });
+    assert.equal(outcome(first, 1).outcome, "needs-human");
+    for (const n of [2, 3, 4]) assert.deepEqual([outcome(first, n).outcome, outcome(first, n).detail], ["held", "blocked by #1 (needs-human)"]);
+    const started = [];
+    const rows = await orchestrate({ issues: [1, 2, 3, 4], parallel: 3, pollMs: 5, store, readBody: async (n) => chain[n], issueLabels: async () => [],
+      runOne: async (n) => { started.push(n); await new Promise((r) => setTimeout(r, 5)); return merged; } });
+    assert.deepEqual(started, [1, 2, 3, 4]);
+    assert.ok(rows.every((r) => r.outcome === "merged"), JSON.stringify(rows));
+  });
+
+  it("a resume with the needs-human label still on the root keeps the subtree held", async () => {
+    const store = memStore();
+    await orchestrate({ issues: [1, 2], parallel: 1, pollMs: 5, store, readBody: async (n) => chain[n], runOne: async () => ({ terminalReason: "needs-human", detail: "x" }) });
+    const rows = await orchestrate({ issues: [1, 2], parallel: 1, pollMs: 5, store, readBody: async (n) => chain[n], issueLabels: async () => ["needs-human"], runOne: async () => merged });
+    assert.deepEqual(rows.map((r) => r.outcome), ["needs-human", "held"]);
+  });
+
+  it("the report lists a held subtree with its root and one --requeue command", async () => {
+    const { formatOutcomeLists } = await import("./orchestrate.mjs");
+    const lines = formatOutcomeLists([{ issue: 1, outcome: "engine-error" }, { issue: 2, outcome: "held", root: 1 }, { issue: 3, outcome: "held", root: 1 }]);
+    assert.ok(lines.some((l) => /held subtree: #1 \(engine-error\) holds #2 #3; release: forgedock orchestrate --requeue <batch> 1/.test(l)), lines.join("\n"));
+  });
+});

package/bin/lean/orchestrate.mjs

@@ -20,8 +20,10 @@
  * A seam calls `onLive()` before it waits on a live lane (#4504); an adopt that resolves first is settled (or requeued on null)
  * before scheduling, so a live lane does not hold up the others.
  * `deferred` is a scheduling fact, not an end: each typed code is requeued with its retry-at (`deferPolicy`), a usage
- * limit holds admissions for that account until its reset, and deferrals other than a wait (`host.busy`,
- * `sandbox.capacity`, #4528; `sandbox.unreachable`, #4788; `rate_limited`, #4784) stop after `maxDeferrals`.
+ * limit (and #5168 a claude login failure, `backend.auth`) holds admissions for that account until its reset, and deferrals other than a wait (`host.busy`,
+ * `sandbox.capacity`, #4528; `sandbox.unreachable`, #4788; `rate_limited`, #4784; `backend.auth`, #5168) stop after `maxDeferrals`.
+ * #5161: an engine-error whose detail is a transport/gateway failure (`isTransientEngineError`) is requeued with backoff
+ * (`transientRetryDelayMs`) up to `transientRetries` times, not counted against `ENGINE_ERROR_RELAUNCHES`; then it ends engine-error.
  * #5112: with `remote.offlineFallback` (`execution.fallback_local`), an issue deferred `remote.capacityFallbackAfter` times (default
  * `CAPACITY_FALLBACK_AFTER`) for `sandbox.capacity` runs on the host when `remote.headroom()` (host-busy guard) allows it.
  * Usage-limit holds (#4190) are keyed by backend identity in `limits` (the host store, shared by every batch on the
@@ -128,6 +130,27 @@ import { joinsDecomposed, addsEpicChildren, selectChildren, edgeText, DEFAULT_PO
 
 // A dependency that finished like this no longer blocks its dependents.
 const SATISFIED = new Set(["merged", "invalid"]);
+// #5162: a dependent of a root that ended like this is held (resumable), not skipped.
+const HOLD_ROOT = new Set(["needs-human", "engine-error", "deferred", "budget-exceeded"]);
+/** #5162: members of a real dependency cycle (a nontrivial SCC or a self-loop) among `nodes`; `edgesOf(n)` lists n's dependencies. */
+export function cyclicNodes(nodes, edgesOf) {
+  const inSet = new Set(nodes), idx = new Map(), low = new Map(), stack = [], on = new Set(), out = new Set();
+  let i = 0;
+  const visit = (v) => {
+    idx.set(v, i); low.set(v, i); i++; stack.push(v); on.add(v);
+    for (const w of edgesOf(v).filter((d) => inSet.has(d))) {
+      if (w === v) out.add(v);
+      if (!idx.has(w)) { visit(w); low.set(v, Math.min(low.get(v), low.get(w))); } else if (on.has(w)) low.set(v, Math.min(low.get(v), idx.get(w)));
+    }
+    if (low.get(v) === idx.get(v)) {
+      const comp = [];
+      for (let w; w !== v;) { w = stack.pop(); on.delete(w); comp.push(w); }
+      if (comp.length > 1) for (const c of comp) out.add(c);
+    }
+  };
+  for (const n of nodes) if (!idx.has(n)) visit(n);
+  return out;
+}
 const WATCH_EVERY_MS = 60_000; // #4595
 // Times one issue may be requeued behind a dependency before its dependency-open row is final.
 export const MAX_REQUEUES = 2;
@@ -146,6 +169,15 @@ export const CAPACITY_FALLBACK_AFTER = 3;
 export const RATE_LIMIT_FALLBACK_S = 15 * 60;
 export const DEFER_BACKOFF_S = 120;
 export const DEFER_BACKOFF_MAX_S = 30 * 60;
+// #4685 + #5161: an engine-error detail that names a link or gateway failure (curl's "returned error: 502", HTTP/1.1 503, ...).
+export const TRANSPORT_TEXT = /fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|socket hang up|HTTP 50[234]|returned error: 5\d\d|HTTP\/\d(\.\d)? 5\d\d|Bad Gateway|Service Unavailable|overloaded/i;
+/** #5161: a transient engine failure (model gateway 5xx, connection reset): retried with backoff, not the single relaunch. */
+export const isTransientEngineError = (detail) => TRANSPORT_TEXT.test(String(detail ?? ""));
+// #5161: transient engine-error retries per issue (forge.yaml `orchestration.transient_retries`) and their backoff: 30s, 2m, 8m, then 15m.
+export const DEFAULT_TRANSIENT_RETRIES = 4;
+export const TRANSIENT_BACKOFF_S = 30;
+export const TRANSIENT_BACKOFF_MAX_S = 15 * 60;
+export const transientRetryDelayMs = (k) => Math.min(TRANSIENT_BACKOFF_S * 4 ** (Math.max(1, k) - 1), TRANSIENT_BACKOFF_MAX_S) * 1000;
 // A dependency-open whose dependencies already finished satisfied (GitHub not yet closed): wait before relaunching.
 export const DEP_REQUEUE_DELAY_S = 60;
 
@@ -204,6 +236,8 @@ export function deferPolicy(r, { now, deferrals = 0, maxDeferrals = DEFAULT_MAX_
     const at = posNum(r?.resetAtEpochMs) && r.resetAtEpochMs > now ? r.resetAtEpochMs : now + (posNum(r?.retryInSeconds) ?? RATE_LIMIT_FALLBACK_S) * 1000;
     return { delayMs: at - now, hold: true };
   }
+  // #5168: a failed claude login is an account condition, not an engine fault: held like a usage limit, never capped.
+  if (code === "backend.auth") return { delayMs: (posNum(r?.retryInSeconds) ?? RATE_LIMIT_FALLBACK_S) * 1000, hold: true };
   const k = deferrals + 1;
   if (k > maxDeferrals) return { capped: true };
   if (posNum(r?.retryInSeconds)) return { delayMs: r.retryInSeconds * 1000 };
@@ -267,7 +301,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   classify = null, maintenance = null, limits = null, identity = () => "default", batchId = null, drift = null, integration = null, sched = null, priorityOf = null, remote = null, beforeAdmit = null, preflight = null,
   recovery = null, decide = () => {}, conflicting = null, relabelNeedsHuman = null, onExit = null, issueLabels = null, issueState = null, getCancelled = null, getHeld = null, getBlocked = null, trusted = null, getGates = null, stopLane = null,
   estimate = null, starveMs = DEFAULT_STARVE_MS, setupConcurrency = DEFAULT_SETUP_CONCURRENCY, signal = null, dispatchCheck = null, syncParked = null, syncEveryMs = DEFAULT_SYNC_EVERY_MS, lifecycle = null,
-  getChildren = null, autoChildren = null, baseWait = null, rotator = null }) {
+  getChildren = null, autoChildren = null, baseWait = null, rotator = null, transientRetries = DEFAULT_TRANSIENT_RETRIES }) {
   const saved = store?.load?.() ?? null;
   const order = saved ? [...saved.order] : [];
   const set = new Set(order);
@@ -284,6 +318,8 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   const capDefers = toMap(saved?.capDeferrals); // #5112: issue -> `sandbox.capacity` deferrals (uncapped, so not in `deferrals`)
   const capFellBack = new Set(); // #5112: issues already reported as a capacity fallback (one decision each)
   const engineErrors = toMap(saved?.engineErrors);
+  const transients = toMap(saved?.transientRetries); // #5161: issue -> transient engine-error retries taken
+  const transientMax = Number.isInteger(transientRetries) && transientRetries >= 0 ? transientRetries : DEFAULT_TRANSIENT_RETRIES;
   const checked = toMap(saved?.prefilter); // issue -> pre-filter result
   const estimates = toMap(saved?.estimates); // #4409: issue -> estimated lane minutes; only with `estimate`
   const enqueued = toMap(saved?.enqueued); // #4409: issue -> when it last entered the queue (starvation guard)
@@ -369,7 +405,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   const save = () => {
     if (!store || halted) return;
     store.save({ v: 1, ...(setup ? { phase: "setup", setup: { ...setup } } : {}), order, deps: toObj(deps), lanes: toObj(lanes), crossSeen: [...crossSeen], results: toObj(results), running: toObj(runRecs),
-      pending, notBefore: toObj(notBefore), requeues: toObj(requeues), deferrals: toObj(deferrals), engineErrors: toObj(engineErrors), ...(quota.size ? { quota: toObj(quota) } : {}), ...(capDefers.size ? { capDeferrals: toObj(capDefers) } : {}),
+      pending, notBefore: toObj(notBefore), requeues: toObj(requeues), deferrals: toObj(deferrals), engineErrors: toObj(engineErrors), ...(transients.size ? { transientRetries: toObj(transients) } : {}), ...(quota.size ? { quota: toObj(quota) } : {}), ...(capDefers.size ? { capDeferrals: toObj(capDefers) } : {}),
       prefilter: toObj(checked), errorTimes, breaker: tripped, ...(budget ? { classes: toObj(classes), dispatch: { ...dispatch } } : {}),
       ...(reg ? { priorities: toObj(priorities) } : {}), ...(sandboxUse.size ? { sandbox: toObj(sandboxUse) } : {}),
       ...(recoveries.size || recovering.size ? { recoveries: toObj(recoveries), recovering: toObj(recovering), recoveryClasses: toObj(classUsed) } : {}),
@@ -633,15 +669,19 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     results.set(n, { issue: n, outcome: "skipped", pr: null, cost_usd: 0, minutes: 0, detail, ...(trigger !== null && dispatchCheck ? { waiting: true } : {}) });
     update({ ...results.get(n), ...(trigger !== null ? { trigger } : {}) });
   };
+  // #5162: a dependent of a failed root ends held (trigger = the root, not the parent) and is released with the root.
+  const holdBehind = (n, root, rootOutcome) => {
+    results.set(n, { issue: n, outcome: "held", pr: null, cost_usd: 0, minutes: 0, detail: `blocked by #${root} (${rootOutcome})`, root, ...(dispatchCheck ? { waiting: true } : {}) });
+    update({ ...results.get(n), trigger: root });
+  };
   const requeue = (n, delayMs) => { pending.push(n); enqueued.set(n, now()); if (delayMs > 0) notBefore.set(n, now() + delayMs); else notBefore.delete(n); };
-  const TRANSPORT_TEXT = /fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|socket hang up|HTTP 50[234]/i;
   const TRANSPORT_COOLDOWN_MS = 5 * 60000;
   let transportErrors = 0; // #4685: engine-errors in the current window that were link failures
   const noteEngineError = (detail = "") => {
     if (!breaker) return;
     const t = now(), windowMs = breaker.window_min * 60000;
     errorTimes = [...errorTimes.filter((x) => t - x < windowMs), t];
-    transportErrors = TRANSPORT_TEXT.test(String(detail)) ? Math.min(transportErrors + 1, errorTimes.length) : 0;
+    transportErrors = isTransientEngineError(detail) ? Math.min(transportErrors + 1, errorTimes.length) : 0;
     if (!tripped && errorTimes.length >= breaker.errors) {
       tripped = { at: t, ...(transportErrors >= errorTimes.length ? { transport: true } : {}), detail: `circuit breaker: ${errorTimes.length} engine-errors within ${breaker.window_min} min; admissions stopped` };
       update({ issue: null, outcome: "breaker", detail: tripped.detail });
@@ -757,7 +797,7 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
             resumeAt, rotations: (q.rotations ?? 0) + (rq?.rotated ? 1 : 0) });
           requeue(n, delayMs); done(); save();
           const iso = new Date(resumeAt).toISOString();
-          update({ ...row, outcome: "paused", quota: { resumeAt: iso }, detail: `paused (quota) until ${iso}: ${r?.code ?? "deferred"}${r?.detail ? ` ${r.detail}` : ""}` });
+          update({ ...row, outcome: "paused", quota: { resumeAt: iso }, detail: `paused (${r?.code === "backend.auth" ? "backend.auth" : "quota"}) until ${iso}: ${r?.code ?? "deferred"}${r?.detail ? ` ${r.detail}` : ""}` });
           return;
         }
         requeue(n, capGated ? 0 : delayMs); done(); save();
@@ -768,7 +808,20 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
     }
     if (row.outcome === "engine-error") {
       noteEngineError(r?.detail);
-      if ((engineErrors.get(n) ?? 0) < ENGINE_ERROR_RELAUNCHES) {
+      // #5161: a transient failure (gateway 5xx, reset) waits out the outage with backoff instead of the single immediate relaunch.
+      if (transientMax > 0 && isTransientEngineError(row.detail)) {
+        const k = (transients.get(n) ?? 0) + 1;
+        if (k <= transientMax) {
+          const delayMs = transientRetryDelayMs(k), secs = Math.round(delayMs / 1000);
+          transients.set(n, k);
+          requeue(n, delayMs); done(); save();
+          decided({ issue: n, what: `retry after transient engine-error (${k}/${transientMax}) in ${secs}s`, why: `transient: ${firstLine(row.detail) || "engine-error"}`,
+            alternative: "end the issue engine-error and skip its dependents" });
+          update({ ...row, detail: `transient retry ${k}/${transientMax} in ${secs}s: ${row.detail ?? ""}` });
+          return;
+        }
+        row.detail = `gave up after ${transientMax} transient retries: ${row.detail ?? ""}`;
+      } else if ((engineErrors.get(n) ?? 0) < ENGINE_ERROR_RELAUNCHES) {
         engineErrors.set(n, (engineErrors.get(n) ?? 0) + 1);
         requeue(n, 0); done(); save();
         decided({ issue: n, what: "relaunch once after engine-error", why: firstLine(row.detail) || "engine-error", alternative: "end the issue engine-error and skip its dependents" });
@@ -1039,12 +1092,13 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       results.delete(e.issue);
       for (let i = 0; i < moved.length; i++) { // dependents skipped behind a requeued issue (fixpoint)
         for (const [m, r] of [...results]) {
-          if (r?.outcome !== "skipped" || Number(/^dependency #(\d+)/.exec(r.detail ?? "")?.[1]) !== moved[i]) continue;
+          const heldBehind = r?.outcome === "held" && r.root === moved[i]; // #5162
+          if (!heldBehind && (r?.outcome !== "skipped" || Number(/^dependency #(\d+)/.exec(r.detail ?? "")?.[1]) !== moved[i])) continue;
           priors.set(m, r); results.delete(m); moved.push(m);
         }
       }
       for (const m of moved) {
-        for (const x of [requeues, deferrals, capDefers, engineErrors, recoveries, recovering]) x.delete(m);
+        for (const x of [requeues, deferrals, capDefers, engineErrors, transients, recoveries, recovering]) x.delete(m);
         relabelled.delete(m);
         if (m === e.issue) requeuedInfo.set(m, { reason: e.reason, by: e.by, at: e.at, prior: [...(requeuedInfo.get(m)?.prior ?? []), priors.get(m)] });
         if (!pending.includes(m)) requeue(m, 0);
@@ -1182,7 +1236,45 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
   const readmitted = new Set(); // "n:b": re-admit n on blocker b once; a lane that re-skips on b stays skipped
   const blockerOf = (n) => { const r = results.get(n); const m = r?.outcome === "skipped" ? /^dependency #(\d+) /.exec(r.detail ?? "") : null; return m ? Number(m[1]) : null; };
   const watchable = () => !!dispatchCheck && [...results.keys()].some((n) => blockerOf(n) !== null);
+  // #5162: held rows behind `root` return to pending (and the root too when `withRoot`: requeued, counters reset), parents first via the edges.
+  const releaseHeld = (root, withRoot, why) => {
+    const moved = withRoot && results.has(root) ? [root] : [];
+    if (moved.length) results.delete(root);
+    for (const [m, r] of [...results]) if (r?.outcome === "held" && r.root === root) { results.delete(m); moved.push(m); }
+    for (const m of moved) {
+      for (const x of [requeues, deferrals, capDefers, engineErrors, transients, recoveries, recovering]) x.delete(m);
+      relabelled.delete(m);
+      if (!pending.includes(m)) requeue(m, 0);
+      update({ issue: m, outcome: "readmitted", detail: m === root ? why : `dependency #${root} ${why}`, trigger: root });
+    }
+    if (moved.length) { save(); decided({ issue: root, what: `released held subtree of #${root}: ${moved.filter((m) => m !== root).map((m) => `#${m}`).join(", ") || "none"}`, why, alternative: "leave it held until a --requeue" }); }
+  };
+  const restoredHeld = new Set([...results.values()].filter((r) => r?.outcome === "held" && Number.isInteger(r.root)).map((r) => r.root)); // roots held by an earlier run of this batch
+  const watchHeldRoots = async () => {
+    for (const root of new Set([...results.values()].filter((r) => r?.outcome === "held" && Number.isInteger(r.root)).map((r) => r.root))) {
+      const ro = results.get(root)?.outcome;
+      if (ro === undefined || running.has(root) || settled.has(root)) continue;
+      if (restoredHeld.has(root) && ["needs-human", "budget-exceeded"].includes(ro) && typeof issueLabels === "function") { // label removed: requeue the root, its subtree follows
+        let names = null;
+        try { names = await issueLabels(root); } catch { names = null; }
+        if (Array.isArray(names) && !names.includes("needs-human")) { releaseHeld(root, true, "needs-human label removed"); continue; }
+      }
+      if (!dispatchCheck) continue;
+      let g = null;
+      try { g = (await dispatchCheck(root)) ?? null; } catch { g = null; }
+      if (g?.final) { // closed as not planned: terminal for its held dependents
+        settled.add(root);
+        for (const [m, r] of [...results]) if (r?.outcome === "held" && r.root === root && r.waiting) { const { waiting, ...rest } = r; results.set(m, rest); update({ ...rest, trigger: root }); }
+        continue;
+      }
+      if (g && SATISFIED.has(g.outcome)) { // merged or closed outside the batch
+        results.set(root, { ...results.get(root), outcome: g.outcome, pr: Number.isInteger(g.pr) ? g.pr : results.get(root).pr, detail: g.detail ?? results.get(root).detail });
+        update(results.get(root)); releaseHeld(root, false, "merged or closed");
+      }
+    }
+  };
   const watchBlockers = async (final) => {
+    if (!cancelled && !tripped && (final || lastWatch === null || now() - lastWatch >= WATCH_EVERY_MS) && [...results.values()].some((r) => r?.outcome === "held" && Number.isInteger(r.root))) await watchHeldRoots();
     if (!watchable() || cancelled || tripped) return;
     const t0 = now();
     if (!final && lastWatch !== null && t0 - lastWatch < WATCH_EVERY_MS) return;
@@ -1240,7 +1332,12 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
           const n = pending[i];
           if (results.has(n)) { pending.splice(i, 1); continue; }
           const bad = edges(n).find((d) => results.has(d) && !SATISFIED.has(results.get(d).outcome));
-          if (bad !== undefined) { pending.splice(i, 1); skip(n, `dependency #${bad} ended ${results.get(bad).outcome}`, bad); again = true; }
+          if (bad !== undefined) {
+            pending.splice(i, 1); again = true;
+            const br = results.get(bad), root = br.root ?? bad, ro = results.get(root)?.outcome ?? br.outcome;
+            if (HOLD_ROOT.has(ro)) holdBehind(n, root, ro); // #5162
+            else skip(n, `dependency #${bad} ended ${br.outcome}`, bad);
+          }
         }
       }
       const t = now();
@@ -1373,7 +1470,19 @@ export async function orchestrate({ issues, parallel = 3, runOne, readBody, pref
       else if (pending.length && (driftHeld.size || integHeld.size)) { if (await drainAdds()) continue; break; } // held by a drift flag (block_dispatch) or a red integration streak (#4667): pending for a later batch
       else if (pending.some((n) => remoteCapped.has(n))) await nap(wake ?? pollMs); // #5138: live max_remote 0: wait for a raise or another placement
       else if (pending.length) { // nothing runnable, nothing running, nothing waiting on time: a dependency cycle
-        for (const n of pending.splice(0)) skip(n, "dependency cycle");
+        // #5162: only real cycles are labelled so; the rest name the cycle member (or failed root) that blocks them
+        const cyc = cyclicNodes(pending, edges), inP = new Set(pending);
+        const blocker = (n, seen = new Set()) => {
+          for (const d of edges(n)) {
+            if (cyc.has(d)) return d;
+            if (inP.has(d) && !seen.has(d)) { seen.add(d); const b = blocker(d, seen); if (b !== null) return b; }
+          }
+          return null;
+        };
+        for (const n of pending.splice(0)) {
+          const b = cyc.has(n) ? null : blocker(n);
+          skip(n, cyc.has(n) ? "dependency cycle" : b !== null ? `blocked by #${b} (dependency cycle)` : "blocked: no dependency path is runnable");
+        }
         save();
       }
     }
@@ -1444,6 +1553,9 @@ export function formatOutcomeLists(rows) {
   const one = (x) => String(x ?? "").split("\n")[0].slice(0, OUTCOME_LINE_MAX);
   const requeued = (rows ?? []).filter((r) => r?.requeued); // #4550: operator --requeue after a decision; the row is the latest outcome
   if (requeued.length) out.push(`requeued: ${requeued.map((r) => `#${r.issue} (${one(r.requeued.reason)})`).join(" ")}`);
+  const heldBy = new Map(); // #5162: held subtrees by root, one --requeue command each
+  for (const r of rows ?? []) if (r?.outcome === "held" && Number.isInteger(r.root)) heldBy.set(r.root, [...(heldBy.get(r.root) ?? []), r.issue]);
+  for (const [root, xs] of heldBy) { const ro = (rows ?? []).find((r) => r?.issue === root)?.outcome ?? "failed"; out.push(`held subtree: #${root} (${ro}) holds ${xs.map((x) => `#${x}`).join(" ")}; release: forgedock orchestrate --requeue <batch> ${root}`); }
   const rec = (rows ?? []).filter((r) => r?.recovered);
   if (rec.length) out.push(`recovered: ${rec.map((r) => `#${r.issue} (${r.recovered})`).join(" ")}`);
   for (const r of rows ?? []) {

package/bin/lean/prefilter.mjs

@@ -455,11 +455,12 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
       return { ...out, detail: "acceptance probe failed after promotion (FORGE:PROBE): no already-fixed close; lane" };
     }
     const sig = await collectSignals({ iss, repo, lane, io, cwd, selfLogins });
-    const close = async (kind, body, detail) => {
+    // #5152: `completed` for a delivered outcome (CI green again, ALREADY-FIXED); only an INVALID verdict is dropped scope
+    const close = async (kind, body, detail, reason = "completed") => {
       let note = "";
       if (!dryRun) {
         // #4315: close first: the marker is posted only on an issue that was closed, so it always means "reopened" later
-        await io.gh(["issue", "close", String(issue), "-R", repo, "--reason", "not planned"]);
+        await io.gh(["issue", "close", String(issue), "-R", repo, "--reason", reason]);
         // #4314: the issue IS closed from here on: the result is closed:true whatever the comment does, so no lane starts on it.
         // The comment is retried once, then a marker-only comment (a second, tiny payload) keeps the #4305 reopen guard working.
         const comment = (text) => io.gh(["issue", "comment", String(issue), "-R", repo, "--body", text]);
@@ -498,7 +499,7 @@ export async function prefilterIssue({ issue, repo, lane, cwd, io, model = DEFAU
     if (!v || v.verdict === "CONFIRMED" || !v.evidence.length) return keep(`candidate (${why}) ${v ? (v.verdict === "CONFIRMED" ? "confirmed" : "without evidence") : "unparseable verdict"}: lane`);
     const ev = v.evidence.map((x) => `- ${sanitizeMd(x).replace(/\s+/g, " ").slice(0, 400)}`).join("\n");
     return await close("validated", `## Pre-filter: ${v.verdict}\n**Signal:** ${why}\n**Summary:** ${sanitizeMd(v.summary).replace(/\s+/g, " ").slice(0, 600) || "not reported"}\n\n**Evidence:**\n${ev}\n\nValidated by a single read-only check (${model}), without a lane. Reopen if this is wrong.`,
-      `${v.verdict.toLowerCase()} (${why})`);
+      `${v.verdict.toLowerCase()} (${why})`, v.verdict === "INVALID" ? "not planned" : "completed");
   } catch (e) {
     return { ...out, detail: `pre-filter error (${String(e?.message ?? e).slice(0, 120)}): lane` };
   }

package/bin/lean/prefilter.test.mjs

@@ -73,7 +73,7 @@ describe("pre-filter (#4123)", () => {
     const call = w.runner[0];
     assert.equal(call.model, DEFAULT_PREFILTER_MODEL); assert.equal(call.readOnly, true); assert.equal(call.resume, null); assert.equal(call.cwd, "/repo");
     assert.match(call.prompt, /merged PR #90/); assert.doesNotMatch(call.prompt, /PR #91/);
-    assert.deepEqual(w.closed, [[12, "not planned"]]);
+    assert.deepEqual(w.closed, [[12, "completed"]]); // #5152: ALREADY-FIXED is delivered
     assert.deepEqual(w.labels, [[12, "invalid"]]);
     assert.match(w.comments[0][1], /FORGE:PREFILTER/); assert.match(w.comments[0][1], /src\/foo\.js:3 null guard/); assert.match(w.comments[0][1], /PR #90/);
   });
@@ -120,7 +120,7 @@ describe("pre-filter (#4123)", () => {
     assert.equal(r.closed, true); assert.equal(r.kind, "ci-green");
     assert.equal(w.runner.length, 0);
     assert.match(w.comments[0][1], /actions\/runs\/600/); assert.match(w.comments[0][1], /actions\/runs\/500/);
-    assert.deepEqual(w.closed, [[34, "not planned"]]);
+    assert.deepEqual(w.closed, [[34, "completed"]]); // #5152: CI green again is delivered
   });
 
   it("#4305 the CI-green shortcut is skipped for intermittent, reopened and same-SHA-flaky CI failures", async () => {
@@ -204,7 +204,7 @@ describe("pre-filter (#4123)", () => {
     assert.equal(r2.closed, true); assert.equal(tiny.comments.length, 1); assert.match(tiny.comments[0][1], /^<!-- FORGE:PREFILTER -->/);
     assert.match(flakyReason({ comments: [{ body: tiny.comments[0][1], author: { login: "forgedock-app[bot]" }, authorAssociation: "NONE" }] }, ["forgedock-app"])?.reason ?? "", /reopened/);
     const dead = flaky(99); const r3 = await pf(dead, 34);
-    assert.equal(r3.closed, true); assert.equal(dead.runner.length, 0); assert.deepEqual(dead.closed, [[34, "not planned"]]); assert.match(r3.detail, /no marker comment/);
+    assert.equal(r3.closed, true); assert.equal(dead.runner.length, 0); assert.deepEqual(dead.closed, [[34, "completed"]]); assert.match(r3.detail, /no marker comment/);
   });
 
   it("a CI-failure issue whose workflow is still red (or whose latest run is the failing one) goes to a lane", async () => {
@@ -224,6 +224,7 @@ describe("pre-filter (#4123)", () => {
     assert.deepEqual(namedPaths("fix lib/a.js <!-- x/hidden.js --!> visible/e.js and <!-- unclosed c/d.js"), ["lib/a.js", "visible/e.js"]);
     const gone = world({ issues: { 5: { body: "crash in src/old/foo.js:12" } }, verdict: { verdict: "INVALID", evidence: ["src/old/foo.js removed in abc123"] } });
     assert.equal((await pf(gone, 5)).closed, true);
+    assert.deepEqual(gone.closed, [[5, "not planned"]], "#5152: only an INVALID verdict closes not planned");
     assert.match(gone.runner[0].prompt, /do not exist on origin\/staging: src\/old\/foo\.js/);
     const kept = world({ issues: { 5: { body: "crash in src/old/foo.js:12 and src/new.js/x.ts" } }, paths: ["src/old/foo.js"] });
     const r = await pf(kept, 5);
@@ -300,7 +301,7 @@ describe("orchestrate with the pre-filter (#4123)", () => {
     assert.deepEqual(res.lanes, [13]);
     assert.equal(logs.at(-1), "lanes: #13");
     assert.ok(logs.some((s) => /^pre-filter: 2 checked, 1 candidate\(s\), 1 closed/.test(s)));
-    assert.deepEqual(w.closed, [[12, "not planned"]]);
+    assert.deepEqual(w.closed, [[12, "completed"]]); // #5152: ALREADY-FIXED is delivered
     await assert.rejects(triageFromCli([], {}), /usage/);
   });
 

package/bin/lean/prompts.mjs

@@ -488,8 +488,10 @@ export function reviewerPrompt({ issue, comments = [], contract, result, files =
  * #4160: the targeted re-ask after an incomplete or inconsistent reply. Only the missing or invalid ids are asked
  * for, with the exact problems and the reviewer's previous reply; no diff is re-sent (the worktree still holds the change).
  */
-export function reviewerRepairPrompt({ missing = [], problems = [], rows = null }) {
-  return `Your conformance review is incomplete. The engine keeps your other rows; answer ONLY for these ids or sections: ${missing.join(", ") || "(see the problems)"}.\n\n<previous_reply_problems>\nYour previous reply was rejected as incomplete. Fix exactly these:\n${problems.slice(0, 60).map((p) => `- ${String(p).slice(0, 300)}`).join("\n")}\n</previous_reply_problems>\n\n<previous_reply>\n${cap(JSON.stringify(rows ?? {}), 20000)}\n</previous_reply>\n\nRead the changed files in your worktree as needed. Output ONLY a JSON object in a json code fence with just the rows for those ids (requirements rows by id, preserve rows by id, scope rows by file, issue_coverage in full if it is listed) plus "verdict":"CONFORMS|NONCONFORMING" consistent with all rows. Evidence is a backtick-quoted repo-relative path:line copied verbatim (e.g. \`apps/web/app/(console)/layout.tsx:12\`); for an evidence path reported as not existing, give the full repo-relative path of that file from the changed files or the repository.`;
+export function reviewerRepairPrompt({ missing = [], problems = [], rows = null, criteria = [] }) {
+  // #5164: a coverage misquote is re-asked with the issue's criterion lines verbatim, so the quote is copied, not retyped
+  const crit = (criteria ?? []).length ? `\n\n<issue_criteria>\nCopy every issue_coverage quote exactly (character for character, including #numbers and plurals) from one of these issue lines:\n${criteria.slice(0, 80).map((c) => `- ${String(c).slice(0, 400)}`).join("\n")}\n</issue_criteria>` : "";
+  return `Your conformance review is incomplete. The engine keeps your other rows; answer ONLY for these ids or sections: ${missing.join(", ") || "(see the problems)"}.\n\n<previous_reply_problems>\nYour previous reply was rejected as incomplete. Fix exactly these:\n${problems.slice(0, 60).map((p) => `- ${String(p).slice(0, 300)}`).join("\n")}\n</previous_reply_problems>${crit}\n\n<previous_reply>\n${cap(JSON.stringify(rows ?? {}), 20000)}\n</previous_reply>\n\nRead the changed files in your worktree as needed. Output ONLY a JSON object in a json code fence with just the rows for those ids (requirements rows by id, preserve rows by id, scope rows by file, issue_coverage in full if it is listed) plus "verdict":"CONFORMS|NONCONFORMING" consistent with all rows. Evidence is a backtick-quoted repo-relative path:line copied verbatim (e.g. \`apps/web/app/(console)/layout.tsx:12\`); for an evidence path reported as not existing, give the full repo-relative path of that file from the changed files or the repository.`;
 }
 
 /** Pre-filter (#4123): one read-only, single-turn check of an issue a cheap signal flagged as possibly already fixed. */