Sentinel: shared:01m23vygyffx5hg2f5vm8r74sr:2aw0b8usmp is past its budget: trevato/forge: "a repository name with markup in it is escaped in the select, never raw" failed on 3 pulls in the last … #10486

shared:01m23vygyffx5hg2f5vm8r74sr:2aw0b8usmp is past its budget: trevato/forge: "a repository name with markup in it is escaped in the select, never raw" failed on 3 pulls in the last …

Evidence

• cause: shared:01m23vygyffx5hg2f5vm8r74sr:2aw0b8usmp
• sentence: trevato/forge: "a repository name with markup in it is escaped in the select, never raw" failed on 3 pulls in the last hour — the lane's red, not theirs; they wait for main's next green check, unparked.
• since: 2026-11-10T01:24:19.590Z
• href: /trevato/forge/issues/new
• test: a repository name with markup in it is escaped in the select, never raw
• failed: pull #10424, check run 01m71ecaz3zmqkrhg9jnejska4
• failed: pull #10459, check run 01m71cs1rh7xxcva48zeh6b0mh
• failed: pull #10410, check run 01m71cfje7b499yypbj70e6wsh
• base: [redacted] (run 01m71ecaz3zmqkrhg9jnejska4)
• log: 79 | if (!made.ok) throw new Error("repo");
• log: 80 | insertApp(app.db, { repoId: made.value.id, slug: "wild", access: "public" });
• log: 81 | app.db.query("UPDATE repo SET name = ?1 WHERE id = ?2").run('x"><img src=x onerror=alert(1)>', made.value.id);
• log: 82 | const form = await composerOf(cookie);
• log: 83 | expect(form).not.toContain("<img");
• log: 84 | expect(form).not.toContain('x">');
• log: ^
• log: error: expect(received).not.toContain(expected)
• log: Expected to not contain: "x\">"
• log: Received: "<form id=\"composer\" class=\"stack\" method=\"post\" action=\"/tell\">\n <input type=\"hidden\" name=\"back\" value=\"/feed\" />\n \n <textarea class=\"input\" name=\"text\" rows=\"2\" ma…
• log: at <anonymous> (test/feed-composer-language.test.ts:84:20)
• main: passes on main's newest check, run 01m71gcqn0zqrwhdcxyqf6eg5j at [redacted]

Pillar: P0 Trust: the forge says when it is not well, and is well again

What to look for when fixed: shared:01m23vygyffx5hg2f5vm8r74sr:2aw0b8usmp is gone from the degraded list and the cause is fixed, not waited out.

Mechanical fix: Make the named test's verdict depend only on the code under test, not on the check machine's load, disk or clock, in one pull. Pulls red on it alone wait, unparked, for main's next green check.

Found by the sentinel at 2026-11-10T01:24:40.159Z.

Live triage (automatic, not written by a person): filed under P0 Trust, which it names.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10523 closed; its branch scout/10486-sentinel-shared-01m23vygyffx5hg2f5vm8r74 at 2f489622f66e keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.