forgedock 1.8.3 → 1.9.0

package/bin/engine/admission.mjs

@@ -123,7 +123,7 @@ export function canDeduplicateAutomatedAlert(canonical, candidate) {
  *   amplification remains at or above 1.0.
  * @property {boolean} amplificationBreaker - On-by-default circuit breaker over ALL
  *   cascade findings (not only same-lineage refinements): when the last
- *   `convergenceWindow` amplification ratios are all >= 1.0, P3-and-below admission
+ *   `convergenceWindow` amplification ratios are all >= 1.0, P3 admission
  *   pauses (P1/P2 are never affected). Opt out with `amplification_breaker: off`.
  *   It is deliberately independent of the cascade presets, so lifting the
  *   generation cap or token budget (`policy: all`) never disables it.
@@ -478,9 +478,9 @@ export function evaluateCascadeFinding(finding, policy) {
   if (!admitsTokenSpend(finding.projectedTokenSpend, policy)) {
     return { admit: false, reason: `per-batch token budget exhausted (orchestration.cascade.token_budget=${policy.tokenBudget})` };
   }
-  // Rule 6 (forge#3060) is evaluated last, mirroring the bash chain. It only gates P3-and-below:
-  // P0/P1/P2 already returned above.
-  if (policy.amplificationBreaker && finding.amplificationBreakerTripped && /^P[3-9]$/.test(finding.priority || "")) {
+  // Rule 6 (forge#3060) is evaluated last, mirroring the bash chain. It only gates P3 (whitespace stripped
+  // and upper-cased, matching the bash twin's `tr -d '[:space:]'`): P0/P1/P2 already returned above.
+  if (policy.amplificationBreaker && finding.amplificationBreakerTripped && String(finding.priority ?? "").replace(/\s+/g, "").toUpperCase() === "P3") {
     return {
       admit: false,
       reason: "amplification breaker tripped — P3 admission paused (routed to P3 batches / completion sweep)",
@@ -583,3 +583,22 @@ export function planP3BatchGroups(findings, rules = P3_BATCHING_RULES, { openBat
 
   return { groups, extensions, ungrouped: [...remaining.keys()] };
 }
+
+/**
+ * Pure per-run counts over a `planP3BatchGroups()` result, for the batching
+ * summary: clusters formed, members absorbed, open batches extended, members
+ * added to extended batches, and ungrouped members. Tolerates missing keys.
+ */
+export function summarizeP3BatchPlan(plan) {
+  const groups = Array.isArray(plan?.groups) ? plan.groups : [];
+  const extensions = Array.isArray(plan?.extensions) ? plan.extensions : [];
+  const ungrouped = Array.isArray(plan?.ungrouped) ? plan.ungrouped : [];
+  const count = (items) => items.reduce((sum, item) => sum + (Array.isArray(item?.members) ? item.members.length : 0), 0);
+  return {
+    clusters: groups.length,
+    absorbed: count(groups),
+    extended: extensions.length,
+    extensionMembers: count(extensions),
+    ungrouped: ungrouped.length,
+  };
+}

package/bin/engine/admission.test.mjs

@@ -16,6 +16,7 @@ import {
   evaluateAmplificationBreaker,
   batchExclusionReason,
   planP3BatchGroups,
+  summarizeP3BatchPlan,
   canDeduplicateAutomatedAlert,
 } from "./admission.mjs";
 
@@ -260,6 +261,18 @@ describe("evaluateAmplificationBreaker (forge#3060)", () => {
     assert.equal(evaluateCascadeFinding({ ...base, priority: "P3", amplificationBreakerTripped: false }, policy).admit, true);
   });
 
+  it("rule 6 normalizes case/whitespace on priority (fail closed)", () => {
+    const { policy } = resolveCascadePolicy({ policy: "all" });
+    const base = { generation: 1, title: "x", sameFileAsBatch: false, batchFullyGated: false, projectedTokenSpend: 0, amplificationBreakerTripped: true };
+    assert.equal(evaluateCascadeFinding({ ...base, priority: "p3" }, policy).admit, false);
+    assert.equal(evaluateCascadeFinding({ ...base, priority: " P3 " }, policy).admit, false);
+    assert.equal(evaluateCascadeFinding({ ...base, priority: "P2" }, policy).admit, true);
+    assert.equal(evaluateCascadeFinding({ ...base, priority: "P 3" }, policy).admit, false);
+    assert.equal(evaluateCascadeFinding({ ...base, priority: undefined }, policy).admit, true);
+    assert.equal(evaluateCascadeFinding({ ...base, priority: null }, policy).admit, true);
+    assert.equal(evaluateCascadeFinding({ ...base, priority: "P4" }, policy).admit, true);
+  });
+
   it("rule 6 never gates untriaged (empty/unknown) priorities", () => {
     const { policy } = resolveCascadePolicy();
     const f = { generation: 1, priority: "", title: "x", sameFileAsBatch: false, batchFullyGated: false, projectedTokenSpend: 0, amplificationBreakerTripped: true };
@@ -504,3 +517,27 @@ describe("planP3BatchGroups — concern-level P3 batching", () => {
     assert.equal(batchExclusionReason({ labels: ["priority:P2"], affectedFile: ".env.example" }), "high-blast-radius");
   });
 });
+
+describe("summarizeP3BatchPlan", () => {
+  it("counts clusters, absorbed, extensions and ungrouped from a real plan", () => {
+    const f = (number, affectedFile) => ({ number, affectedFile, title: "t", body: "", labels: ["priority:P3"] });
+    const plan = planP3BatchGroups(
+      [f(1, "scripts/a.sh"), f(2, "scripts/a.sh"), f(3, "scripts/b.sh"), f(4, "docs/x.md")],
+      undefined,
+      { openBatches: [{ number: 99, affectedFile: "scripts/b.sh", members: [], memberCount: 1 }] },
+    );
+    const summary = summarizeP3BatchPlan(plan);
+    assert.equal(summary.clusters, plan.groups.length);
+    assert.equal(summary.absorbed, plan.groups.reduce((n, g) => n + g.members.length, 0));
+    assert.equal(summary.extended, 1);
+    assert.equal(summary.extensionMembers, 1);
+    assert.equal(summary.ungrouped, plan.ungrouped.length);
+  });
+
+  it("tolerates empty and partial plans", () => {
+    const zero = { clusters: 0, absorbed: 0, extended: 0, extensionMembers: 0, ungrouped: 0 };
+    assert.deepEqual(summarizeP3BatchPlan({}), zero);
+    assert.deepEqual(summarizeP3BatchPlan(undefined), zero);
+    assert.deepEqual(summarizeP3BatchPlan({ ungrouped: [5, 6] }), { ...zero, ungrouped: 2 });
+  });
+});

package/commands/orchestrate/phase-1-resolve.md

@@ -206,14 +206,20 @@ Classify `$ARGUMENTS` and persist that classification alongside the resolved iss
 ```bash
 # FORGE_ROOT bootstrap (canonical; keep byte-identical across specs, guarded by scripts/forge-root.test.sh)
 FORGE_ROOT=""
-if [ -n "${FORGEDOCK_HOME:-}" ]; then case "$FORGEDOCK_HOME" in /*) FORGE_ROOT="$FORGEDOCK_HOME" ;; esac; else
-  # Portable to bash 3.2 (macOS), BSD/GNU coreutils and zsh: no mapfile, no sort -V, no bare globs (zsh aborts on no match).
-  _l="$HOME/.claude/commands/work-on.md"; _l="$(readlink -f "$_l" 2>/dev/null || readlink "$_l" 2>/dev/null)"; [ -n "$_l" ] && _l="$(dirname "$(dirname "$_l")")"
-  # newest cached version first: numeric major.minor.patch of the version dir name only; a release outranks its pre-release (1.10.0 > 1.9.0 > 1.9.0-rc1)
-  _v="$(find -L "$HOME/.claude/plugins/cache" -mindepth 3 -maxdepth 3 -type d 2>/dev/null | awk -F/ '$(NF-1)=="forgedock"{v=$NF;p=index(v,"-");r=1;if(p){v=substr(v,1,p-1);r=0};split(v,a,".");printf "%d %d %d %d %s\n",a[1],a[2],a[3],r,$0}' | sort -k1,1nr -k2,2nr -k3,3nr -k4,4nr | cut -d' ' -f5-)"
-  _m="$(find -L "$HOME/.claude/plugins/marketplaces" -mindepth 1 -maxdepth 1 -type d -iname '*forgedock*' 2>/dev/null)"
+# Windows drive-letter FORGEDOCK_HOME (C:/x or C:\x) is normalized to /c/x (cygpath when present); relative values stay rejected.
+_h="${FORGEDOCK_HOME:-}"; case "$_h" in [A-Za-z]:[/\\]*) _w="$_h"; _h="$(cygpath -u "$_w" 2>/dev/null || true)"; [ -n "$_h" ] || _h="/$(printf %s "$_w" | cut -c1 | tr 'A-Z' 'a-z')$(printf %s "${_w#??}" | tr '\\' '/')" ;; esac
+# Only the official marketplace is trusted (name pinned; override only via the trusted FORGEDOCK_MARKETPLACE env, never repo files).
+_mk="${FORGEDOCK_MARKETPLACE:-forgedock}"; case "$_mk" in ""|.|..|*[!A-Za-z0-9._-]*) _mk="forgedock" ;; esac
+if [ -n "${FORGEDOCK_HOME:-}" ]; then case "$_h" in /*) FORGE_ROOT="$_h" ;; esac; else
+  # Portable to bash 3.2 (macOS), BSD/GNU coreutils and zsh: no mapfile, no sort -V, no bare globs (zsh aborts on no match). Every assignment ends in || true so the block survives set -e / pipefail.
+  _l="$HOME/.claude/commands/work-on.md"; _l="$(readlink -f "$_l" 2>/dev/null || readlink "$_l" 2>/dev/null || true)"; [ -n "$_l" ] && _l="$(dirname "$(dirname "$_l")")"
+  # Codex: install-codex.sh records the clone path in $CODEX_HOME/forge-home (one absolute path); skills are generated files, not symlinks.
+  _cx="${CODEX_HOME:-$HOME/.codex}"; case "$_cx" in /*) _x="$(head -n 1 "$_cx/forge-home" 2>/dev/null || true)" ;; *) _x="" ;; esac
+  # newest cached version first: numeric major.minor.patch of the version dir name only (non-semver names such as commit SHAs are skipped); a release outranks its pre-release (1.10.0 > 1.9.0 > 1.9.0-rc1)
+  _v="$(find -L "$HOME/.claude/plugins/cache" -mindepth 3 -maxdepth 3 -type d 2>/dev/null | awk -F/ -v mk="$_mk" '$(NF-2)==mk && $(NF-1)=="forgedock" && $NF ~ /^[0-9]+\.[0-9]+\.[0-9]+(-.*)?$/{v=$NF;p=index(v,"-");r=1;if(p){v=substr(v,1,p-1);r=0};split(v,a,".");printf "%d %d %d %d %s\n",a[1],a[2],a[3],r,$0}' | sort -k1,1nr -k2,2nr -k3,3nr -k4,4nr | cut -d' ' -f5- || true)"
+  _m="$HOME/.claude/plugins/marketplaces/$_mk"
   # '${CLAUDE_PLUGIN_ROOT}' is substituted by Claude Code when it loads a plugin spec (the exact spelling only, never as an env var), so a running plugin resolves to its own root first; unsubstituted (other runtimes) it stays a literal that the /* check rejects.
-  _k="$(printf '%s\n' '${CLAUDE_PLUGIN_ROOT}' "${FORGE_HOME:-}" "$_l" "$_v" "$_m")"
+  _k="$(printf '%s\n' '${CLAUDE_PLUGIN_ROOT}' "${FORGE_HOME:-}" "$_l" "$_x" "$_v" "$_m")"
   while IFS= read -r _c; do
     case "$_c" in /*) [ -z "$FORGE_ROOT" ] && [ -f "$_c/scripts/verify-phase-trail.sh" ] && [ -f "$_c/scripts/lint-dispatch-prompt.sh" ] && [ -f "$_c/scripts/is-docs-only.sh" ] && [ -f "$_c/bin/engine/resolve.mjs" ] && [ -f "$_c/bin/engine/orchestrate-canary.mjs" ] && [ -f "$_c/bin/engine/admission.mjs" ] && FORGE_ROOT="$_c" ;; esac
   done <<< "$_k"
@@ -377,26 +383,33 @@ done
 
 Before finalizing the issue set, apply the shared batching rule to reduce full-pipeline overhead on routine review findings.
 
-**Single implementation (MANDATORY):** `bin/engine/admission.mjs` owns the eligibility, same-file, leaf-directory, age, eight-member, open-batch-extension, and singleton-reason rules through `planP3Batches()`. Every admission point supplies its complete current candidate registry plus parsed open batch metadata to that function, then executes only its returned `create`/`extend` actions. Do not independently reproduce thresholds or eligibility predicates in this file. The legacy shell examples below describe GitHub data collection and action execution only; their grouping decisions must be replaced by the evaluator result. Include original resolved issues, prior-cycle singletons, cascade findings, predicate re-resolution matches, and completion-sweep candidates in the registry. <!-- Added: forge#2851 -->
+**Single implementation (MANDATORY):** `bin/engine/admission.mjs` owns the eligibility, same-file, source-PR, defect-class, leaf-directory, eight-member and open-batch-extension rules through `planP3BatchGroups()`. Every admission point supplies its complete current candidate registry plus parsed open batch metadata to that function, then executes only its returned `groups`/`extensions` (member issue numbers). Do not independently reproduce thresholds or eligibility predicates in this file. The legacy shell examples below describe GitHub data collection and action execution only; their grouping decisions must be replaced by the evaluator result. Include original resolved issues, prior-cycle singletons, cascade findings, predicate re-resolution matches, and completion-sweep candidates in the registry. <!-- Added: forge#2851 -->
 
-After executing the plan, retain every singleton in the registry for the next admission event and record `summarizeP3BatchPlan()` in the per-run batching summary: clusters formed, members absorbed, open batches extended, and ungrouped members with their reasons.
+After executing the plan, retain every ungrouped finding in the registry for the next admission event and record `summarizeP3BatchPlan()` in the per-run batching summary: clusters formed, members absorbed, open batches extended, and ungrouped member count. The engine returns ungrouped members as issue numbers only; use `batchExclusionReason()` when the reason for an exclusion is needed.
 
 ```bash
 # BATCH_CANDIDATE_REGISTRY_JSON contains every candidate accumulated so far, with
-# a stable `id` (`{repo}:{number}`), repo, title, problem/body, labels, affectedFile,
-# createdAt, and isBatch. OPEN_BATCHES_JSON contains existing batch issue metadata.
-# Run this after initial resolution and every later admission event; execute returned
-# actions using memberIds, never bare issue numbers, so satellite issues cannot collide.
+# `number` and `affectedFile` (required: the engine silently drops findings without
+# them), plus repo, title, problem/body, labels. OPEN_BATCHES_JSON contains existing
+# batch metadata as `{number, affectedFile, members, memberCount}`.
+# Run this after initial resolution and every later admission event; execute the
+# returned `groups`/`extensions` member numbers against the repo each candidate came from.
 # FORGE_ROOT bootstrap (canonical; keep byte-identical across specs, guarded by scripts/forge-root.test.sh)
 FORGE_ROOT=""
-if [ -n "${FORGEDOCK_HOME:-}" ]; then case "$FORGEDOCK_HOME" in /*) FORGE_ROOT="$FORGEDOCK_HOME" ;; esac; else
-  # Portable to bash 3.2 (macOS), BSD/GNU coreutils and zsh: no mapfile, no sort -V, no bare globs (zsh aborts on no match).
-  _l="$HOME/.claude/commands/work-on.md"; _l="$(readlink -f "$_l" 2>/dev/null || readlink "$_l" 2>/dev/null)"; [ -n "$_l" ] && _l="$(dirname "$(dirname "$_l")")"
-  # newest cached version first: numeric major.minor.patch of the version dir name only; a release outranks its pre-release (1.10.0 > 1.9.0 > 1.9.0-rc1)
-  _v="$(find -L "$HOME/.claude/plugins/cache" -mindepth 3 -maxdepth 3 -type d 2>/dev/null | awk -F/ '$(NF-1)=="forgedock"{v=$NF;p=index(v,"-");r=1;if(p){v=substr(v,1,p-1);r=0};split(v,a,".");printf "%d %d %d %d %s\n",a[1],a[2],a[3],r,$0}' | sort -k1,1nr -k2,2nr -k3,3nr -k4,4nr | cut -d' ' -f5-)"
-  _m="$(find -L "$HOME/.claude/plugins/marketplaces" -mindepth 1 -maxdepth 1 -type d -iname '*forgedock*' 2>/dev/null)"
+# Windows drive-letter FORGEDOCK_HOME (C:/x or C:\x) is normalized to /c/x (cygpath when present); relative values stay rejected.
+_h="${FORGEDOCK_HOME:-}"; case "$_h" in [A-Za-z]:[/\\]*) _w="$_h"; _h="$(cygpath -u "$_w" 2>/dev/null || true)"; [ -n "$_h" ] || _h="/$(printf %s "$_w" | cut -c1 | tr 'A-Z' 'a-z')$(printf %s "${_w#??}" | tr '\\' '/')" ;; esac
+# Only the official marketplace is trusted (name pinned; override only via the trusted FORGEDOCK_MARKETPLACE env, never repo files).
+_mk="${FORGEDOCK_MARKETPLACE:-forgedock}"; case "$_mk" in ""|.|..|*[!A-Za-z0-9._-]*) _mk="forgedock" ;; esac
+if [ -n "${FORGEDOCK_HOME:-}" ]; then case "$_h" in /*) FORGE_ROOT="$_h" ;; esac; else
+  # Portable to bash 3.2 (macOS), BSD/GNU coreutils and zsh: no mapfile, no sort -V, no bare globs (zsh aborts on no match). Every assignment ends in || true so the block survives set -e / pipefail.
+  _l="$HOME/.claude/commands/work-on.md"; _l="$(readlink -f "$_l" 2>/dev/null || readlink "$_l" 2>/dev/null || true)"; [ -n "$_l" ] && _l="$(dirname "$(dirname "$_l")")"
+  # Codex: install-codex.sh records the clone path in $CODEX_HOME/forge-home (one absolute path); skills are generated files, not symlinks.
+  _cx="${CODEX_HOME:-$HOME/.codex}"; case "$_cx" in /*) _x="$(head -n 1 "$_cx/forge-home" 2>/dev/null || true)" ;; *) _x="" ;; esac
+  # newest cached version first: numeric major.minor.patch of the version dir name only (non-semver names such as commit SHAs are skipped); a release outranks its pre-release (1.10.0 > 1.9.0 > 1.9.0-rc1)
+  _v="$(find -L "$HOME/.claude/plugins/cache" -mindepth 3 -maxdepth 3 -type d 2>/dev/null | awk -F/ -v mk="$_mk" '$(NF-2)==mk && $(NF-1)=="forgedock" && $NF ~ /^[0-9]+\.[0-9]+\.[0-9]+(-.*)?$/{v=$NF;p=index(v,"-");r=1;if(p){v=substr(v,1,p-1);r=0};split(v,a,".");printf "%d %d %d %d %s\n",a[1],a[2],a[3],r,$0}' | sort -k1,1nr -k2,2nr -k3,3nr -k4,4nr | cut -d' ' -f5- || true)"
+  _m="$HOME/.claude/plugins/marketplaces/$_mk"
   # '${CLAUDE_PLUGIN_ROOT}' is substituted by Claude Code when it loads a plugin spec (the exact spelling only, never as an env var), so a running plugin resolves to its own root first; unsubstituted (other runtimes) it stays a literal that the /* check rejects.
-  _k="$(printf '%s\n' '${CLAUDE_PLUGIN_ROOT}' "${FORGE_HOME:-}" "$_l" "$_v" "$_m")"
+  _k="$(printf '%s\n' '${CLAUDE_PLUGIN_ROOT}' "${FORGE_HOME:-}" "$_l" "$_x" "$_v" "$_m")"
   while IFS= read -r _c; do
     case "$_c" in /*) [ -z "$FORGE_ROOT" ] && [ -f "$_c/scripts/verify-phase-trail.sh" ] && [ -f "$_c/scripts/lint-dispatch-prompt.sh" ] && [ -f "$_c/scripts/is-docs-only.sh" ] && [ -f "$_c/bin/engine/resolve.mjs" ] && [ -f "$_c/bin/engine/orchestrate-canary.mjs" ] && [ -f "$_c/bin/engine/admission.mjs" ] && FORGE_ROOT="$_c" ;; esac
   done <<< "$_k"
@@ -406,11 +419,14 @@ fi
 BATCH_PLAN=""
 if [ -n "$FORGE_ROOT" ] && [ -r "$FORGE_ROOT/bin/engine/admission.mjs" ]; then
   BATCH_PLAN=$(node -e '
-    import(require("node:url").pathToFileURL(process.argv[1]).href).then(({ planP3Batches, summarizeP3BatchPlan }) => {
-      const plan = planP3Batches({ candidates: JSON.parse(process.argv[2]), openBatches: JSON.parse(process.argv[3]) });
+    import(require("node:url").pathToFileURL(process.argv[1]).href).then(({ planP3BatchGroups, summarizeP3BatchPlan }) => {
+      const plan = planP3BatchGroups(JSON.parse(process.argv[2]), undefined, { openBatches: JSON.parse(process.argv[3]) });
       console.log(JSON.stringify({ plan, summary: summarizeP3BatchPlan(plan) }));
-    });
-  ' "$FORGE_ROOT/bin/engine/admission.mjs" "$BATCH_CANDIDATE_REGISTRY_JSON" "$OPEN_BATCHES_JSON")
+    }).catch((e) => { console.error("WARNING: planP3Batches failed: " + e.message); process.exit(1); });
+  ' "$FORGE_ROOT/bin/engine/admission.mjs" "$BATCH_CANDIDATE_REGISTRY_JSON" "$OPEN_BATCHES_JSON") || BATCH_PLAN=""
+  if [ -z "$BATCH_PLAN" ]; then
+    echo "WARNING: P3 batch plan empty (admission.mjs import or JSON parse failed) — candidates retained as ungrouped singletons" >&2
+  fi
 else
   echo "WARNING: ForgeDock install root unresolved or admission.mjs missing (set FORGEDOCK_HOME) — no P3 batch plan; candidates retained as ungrouped singletons" >&2
 fi

package/commands/orchestrate/phase-3-dependency.md

@@ -1388,13 +1388,22 @@ if [ -n "${FORGE_COORD_ISSUE:-}" ] && [ -n "${COORD_ISSUE_NUMBER:-}" ] && [ -n "
 fi
 
 # 1. Re-fetch all issue labels and classify each into DONE / GATED / FAILED / IN_PROGRESS
-#    (same classify_predecessor_state() function defined in phase-4-execution.md Step 4B —
-#    re-declare it here if this block runs in a fresh context that hasn't sourced Step 4B yet).
+#    (same classify_predecessor_state() function defined in phase-4-execution.md Step 4B).
+#    MANDATORY in a fresh context (wake/compaction): re-declare byte-identically from phase-4-execution.md Step 4B,
+#    in this order, hold_merged_trail, resolve_orch_login, trail_escalation_state, release_merged_trail and
+#    classify_predecessor_state, in the SAME shell as the loop below (guarded by the declare -F check below).
 #    forge#3168: classify_predecessor_state() also needs these Step 4B helpers declared in the SAME shell:
 #    hold_merged_trail, resolve_orch_login, trail_escalation_state, release_merged_trail (reverify_merged_trail is
 #    nested inside the classifier). It reports a missing helper on stderr and classifies GATED. The same trusted-author
-#    filter (OWNER/MEMBER/COLLABORATOR or the orchestrator login) applies to the release/fail markers on wake.
+#    filter (OWNER, the orchestrator login, or a MEMBER/COLLABORATOR with admin/maintain/write on `collaborators/<login>/permission`; forge#3207) applies to the release/fail markers on wake.
 #    forge#3169: merged + needs-human with no escalation record classifies GATED on wake (never keyed on the verifier).
+# The helpers cache trail lookups in the stable per-user/per-repo dir (trail_cache_dir / init_trail_cache, phase-4-execution.md Step 4B).
+# resolve_orch_login queries the GraphQL viewer login and caches it in that same dir (forge#3205), so init_trail_cache must run before it for the cache to apply (otherwise it re-queries per call).
+# Re-declare those helpers first (same Bash block), then reset the cache; if init fails the helpers simply skip caching.
+declare -F init_trail_cache >/dev/null && init_trail_cache || echo "WARNING: init_trail_cache not declared — trail lookups will be uncached" >&2
+for H in hold_merged_trail resolve_orch_login trail_escalation_state release_merged_trail classify_predecessor_state; do
+  declare -F "$H" >/dev/null || echo "WARNING: $H not declared — re-declare it from phase-4-execution.md Step 4B before classifying; merged-trail predecessors will classify GATED" >&2
+done
 declare -A ISSUE_CLASS
 declare -A ISSUE_FILES
 DONE_ISSUES=()
@@ -1508,20 +1517,56 @@ BLOCKED_NOW=$(gh issue list -R {GH_REPO} --state open --label "blocked-on-human-
   --jq '.[].number' 2>/dev/null || echo "")
 for DEP in $BLOCKED_NOW; do
   # Read which predecessor(s) this DEP is tracked against
-  GATING_PREDS_RAW=$(gh api repos/{GH_REPO}/issues/${DEP}/comments \
-    --jq '[.[] | select(.body | contains("FORGE:BLOCKED_ON_HUMAN_MERGE")) | (.body | capture("Gating predecessor\\*\\*: #(?<p>[0-9]+)").p)]' 2>/dev/null || echo '[]')
+  # Fetch is split from `sort`: in a pipeline, `|| echo ""` binds to sort's status (dead code), so a failed or
+  # partially paginated gh api would be read as a (truncated) list and could release DEP. Capture gh's own status.
+  GATING_PREDS_RAW=$(gh api --paginate repos/{GH_REPO}/issues/${DEP}/comments \
+    --jq '.[] | select((.body // "") | contains("FORGE:BLOCKED_ON_HUMAN_MERGE")) | ((.body // "") | capture("Gating predecessor\\*\\*: #(?<p>[0-9]+)").p)' 2>/dev/null) \
+    || { echo "WARNING: #${DEP} gating-predecessor lookup failed - keeping blocked; retrying next wake." >&2; continue; }
+  GATING_PREDS_RAW=$(printf '%s\n' "$GATING_PREDS_RAW" | sort -u | sed '/^$/d')
+  [ -n "$GATING_PREDS_RAW" ] || { echo "WARNING: #${DEP} has blocked-on-human-merge but no parseable Gating predecessor line - leaving blocked" >&2; continue; }   # no tracked predecessor found: fail closed, stay blocked
   STILL_GATED=false
-  for GPRED in $(echo "$GATING_PREDS_RAW" | jq -r '.[]' 2>/dev/null); do
+  for GPRED in $GATING_PREDS_RAW; do
     GPRED_CLASS=$(classify_predecessor_state "$GPRED")
     [ "$GPRED_CLASS" != "DONE" ] && STILL_GATED=true
   done
   if [ "$STILL_GATED" = "false" ]; then
+    # Hardened release sequence — keep in sync with phase-4-execution.md Step 4B item 6.6 (same ordering and fail-closed semantics;
+    # a fix to one copy MUST be applied to the other). <!-- Added: forge#3245 -->
+    if [ "${DRY_RUN:-false}" = "true" ]; then echo "DRY_RUN: would release #${DEP} (remove blocked-on-human-merge, post FORGE:UNBLOCKED, dispatch)"; continue; fi
+    # Idempotency: skip if another path already dispatched DEP.
+    DEP_ALREADY_DISPATCHED=$(gh issue view "$DEP" -R {GH_REPO} --json labels \
+      --jq '[.labels[].name | select(startswith("workflow:"))] | length' 2>/dev/null || echo "0")
+    [ "$DEP_ALREADY_DISPATCHED" -eq 0 ] || continue
+    # Durable marker FIRST (deduped against the last comment so a retried wake does not repeat it): an interrupted release
+    # then leaves durable evidence instead of an unlabelled, undispatched issue.
+    LAST_DEP_COMMENT=$(gh issue view "$DEP" -R {GH_REPO} --json comments --jq '.comments[-1].body // ""' 2>/dev/null || echo "")
+    case "$LAST_DEP_COMMENT" in "<!-- FORGE:UNBLOCKED -->"*) ;; *)
+      gh issue comment "$DEP" -R {GH_REPO} --body "<!-- FORGE:UNBLOCKED -->
+All gating predecessor(s) are now resolved — merged, or released by a human after a phase-trail hold (detected on orchestrator wake) — dispatching now." >/dev/null 2>&1 \
+        || { echo "WARNING: #${DEP} UNBLOCKED marker not posted — not releasing; retrying next wake." >&2; continue; } ;;
+    esac
+    # Remove the hold label and verify it is gone. Fail CLOSED: a failed edit OR a failed/empty `view` is "unverified" —
+    # skip dispatch and retry next wake (the view result is captured separately, never piped into grep).
+    gh issue edit "$DEP" -R {GH_REPO} --remove-label "blocked-on-human-merge" >/dev/null 2>&1 \
+      || { echo "WARNING: #${DEP} label removal failed — not dispatching; retrying next wake." >&2; continue; }
+    if ! DEP_LABELS=$(gh issue view "$DEP" -R {GH_REPO} --json labels --jq '.labels[].name' 2>/dev/null) \
+       || printf '%s\n' "$DEP_LABELS" | grep -qx "blocked-on-human-merge"; then
+      echo "WARNING: #${DEP} label removal unverified — not dispatching; retrying next wake." >&2
+      continue
+    fi
+    # Re-check after removal: another path may have labelled DEP workflow:* in the meantime.
+    DEP_ALREADY_DISPATCHED=$(gh issue view "$DEP" -R {GH_REPO} --json labels \
+      --jq '[.labels[].name | select(startswith("workflow:"))] | length' 2>/dev/null || echo "0")
+    [ "$DEP_ALREADY_DISPATCHED" -eq 0 ] || continue
     # forge#3157: record a human release (FORGE:PHASE_TRAIL_RELEASED) of a trail-held merged predecessor (decay of the escalation marker;
-    # release_merged_trail is defined in phase-4-execution.md Step 4B and is a no-op unless the escalation is ACTIVE).
-    for GPRED in $(echo "$GATING_PREDS_RAW" | jq -r '.[]' 2>/dev/null); do release_merged_trail "$GPRED"; done
-    gh issue edit "$DEP" -R {GH_REPO} --remove-label "blocked-on-human-merge" 2>/dev/null || true
-    gh issue comment "$DEP" -R {GH_REPO} --body "<!-- FORGE:UNBLOCKED -->
-All gating predecessor(s) are now resolved — merged, or released by a human after a phase-trail hold (detected on orchestrator wake) — dispatching now."
+    # release_merged_trail is defined in phase-4-execution.md Step 4B and is a no-op unless the escalation is ACTIVE). It is a decay
+    # record, not the dispatch gate, so a failure here is warned about but does not block dispatch.
+    for GPRED in $GATING_PREDS_RAW; do
+      if declare -F release_merged_trail >/dev/null; then
+        release_merged_trail "$GPRED" \
+          || echo "WARNING: release_merged_trail declared but failed for #${GPRED} — RELEASED record skipped" >&2
+      else echo "WARNING: release_merged_trail not declared — RELEASED record for #${GPRED} skipped; re-declare from phase-4-execution.md Step 4B" >&2; fi
+    done
     READY_ISSUES+=("$DEP")
   fi
 done