The `--open-issue` run proposed 800+ entries, all `rcppparallel-bundled-tbb` on
ubuntu-2604, each pre-filling `RcppParallel/disable-tbb.patch` for an unrelated
package (ACEsimFit, AovBay, ...). Those packages fail only because their
RcppParallel *dependency* does not build there, so bincraft records
RcppParallel's TBB error text against each dependent and they all match the
signature. Applying a RcppParallel source patch to a dependent's source is not
just noise -- it is broken (the diff targets RcppParallel's Makevars.in).
Add an optional `applies_to` field pinning a package-specific fix to the package
it targets. A signature whose fix is a curated per-package source patch
(rcppparallel-bundled-tbb -> RcppParallel) is only ever proposed for that
package; other matching packages are downstream failures reported as "blocked on
<dependency>" and never proposed a bogus entry. Fix the dependency once and the
whole cascade clears.
- gate proposal generation in build_triage_report on applies_to, add blocked_on
- surface blocked groups in the report and proposer instead of a misleading
"already registered" note
- cover both the dependent-blocked and RcppParallel-itself-proposed cases
## Problem
A live `propose-patches.R --open-issue` run aborted with:
```
Patch registry validation FAILED:
- ambiguous duplicate entries: hmmTMB|ubuntu-2604|*, imt|ubuntu-2604|*, refundBayes|ubuntu-2604|*
Error: Candidate registry failed validation; not writing or proposing.
```
Root cause: a package whose failing builds match **more than one** auto-proposable signature (e.g. some logs hit `tbb-stddef-removed`, others `rcppparallel-bundled-tbb`) landed in two separate signature groups, so the proposer emitted two candidate entries with the same `package|platforms|versions` key. The validator's ambiguous-duplicate check then failed the whole candidate set, aborting the run — so even the unambiguous candidates (e.g. `vacalibration`) never got proposed.
## Fix
Add a pure, tested `dedupe_candidates()` that:
- keeps a package's candidate only when it maps to a **single** signature (collapsing an accidental repeat under the same signature), and
- routes a package that maps to **multiple** signatures (conflicting fix tiers -- makevars vs source patch) to **human triage** instead of guessing between them.
The proposer prints the skipped ambiguous packages and proceeds with the clean candidates, so one ambiguous package no longer blocks the rest. This matches the issue #115 guardrail: don't auto-pick when the fix is ambiguous.
## Verification
- New unit tests in `test-proposal-tracking-lib.R` cover the single-signature, multi-signature (conflict), duplicate-under-one-signature, and empty cases.
- Reproduced the original failure end-to-end with a stubbed DB (`hmmTMB` ambiguous + `vacalibration` clean): `hmmTMB` is now listed under "Ambiguous -> human triage", `vacalibration` is proposed, and the candidate registry validates (`Patch registry OK`).
- Full suite: 78 tests pass; all pre-commit hooks pass.
Reviewed-on: #119
Implements steps 3 + 4 of #115, building on the classifier merged in #116. Now that bincraft **v4.4.3** applies registry `patch`/`makevars`/`configure_args` to the *target* package build (previously deps-only), a trial patched build is a meaningful acceptance gate, so the "propose" half is viable.
## Step 3 — propose, do not apply
- **`local/propose-patches.R`** — for each classified, safe fix affecting a package with no current registry entry, emits a pre-filled `registry.json` entry and validates the candidate set against a *temporary* merged registry (the real one is never touched unless asked).
- default: print candidates + validation, **take no action**
- `--write`: append entries to `registry.json` + the proposals ledger (you commit + open the PR)
- `--open-issue`: post/update a Forgejo tracking issue (reuses the weekly-audit `httr2` + `FORGEJO_TOKEN` pattern)
- **`local/trial-build-patch.R`** — isolated bincraft build of one package with the registry applied (no upload/archive/metadata; `patchhash` keeps it out of the real cache). Exit 0/1, so it gates a CI step or manual pre-merge check.
The human gate stays: nothing merges. Acceptance = `validate-patches.R` passes (checked automatically) **and** the trial build succeeds. Novel source diffs and unknown signatures are never proposed (they carry `auto = FALSE`).
## Step 4 — feedback loop
- **`local/proposal-tracking.R`** (read-only) — signature hit rate (builds/pkgs/addressed/open per signature), proposed-vs-merged (a proposal counts merged once its package is in the registry), and retirement candidates (registry entries whose package no longer fails, i.e. likely fixed upstream).
- **`local/proposal-tracking-lib.R`** — the pure metric/ledger helpers.
## Supporting changes
- Refactored the classify helpers to expose a pure `build_triage_report()` + a list-returning entry builder; `failing-builds-report.R` now renders from the shared function (no behaviour change).
- `validate-patches.R` gains optional `PATCH_DIR`/`REGISTRY_FILE` overrides (backward-compatible) so a candidate registry can be validated in isolation.
- Documented the propose/trial-build/tracking workflow in `local/patches/README.md`.
## Verification
- 71 unit tests pass (incl. new `test-proposal-tracking-lib.R`) under the Dockerized R 4.5.3 build env.
- All pre-commit hooks pass (`air-format`, `validate-patches`, prettier, etc.).
- Smoke-tested all three entrypoints end-to-end with a stubbed DB: dry-run, `--write` (produces a registry that passes the canonical validator + a valid ledger, then reverted), and the tracker.
Closes#115
Reviewed-on: #117
