@dzhechkov/harness-core 0.8.32 → 0.8.34

package/dist/release.d.ts

@@ -20,6 +20,7 @@
  *
  * @packageDocumentation
  */
+import type { PackedInstallPlan } from './packed-install-smoke.js';
 /** The four HARD verify gates, in execution order. */
 export type ReleaseGateId = 'tests' | 'audit' | 'syntax' | 'smoke';
 /** Order the CLI executes and the verdict reports gates in. */
@@ -90,6 +91,15 @@ export interface GatePlan {
     readonly skips: readonly GateSkip[];
     /** Package names in the release set (dependency order). */
     readonly packages: readonly string[];
+    /**
+     * AM-7 (feature publish-sibling-drift-gate): the packed-install sub-plan, carried through so
+     * {@link classifyGateExecutions} can re-judge its `bin-version`/`bin-exists` steps through the
+     * SAME judge `dz publish` uses (`judgePackedInstallSmoke`: exit 0 AND non-empty stdout, AND the
+     * declared bin must exist post-install) instead of the generic exit-code-only check every other
+     * step gets. Without this, a silently no-op bin could pass `dz release` while `dz publish`
+     * refuses it — the two doors would not be equal, contradicting FR-6's own claim.
+     */
+    readonly packedInstallPlan?: PackedInstallPlan | undefined;
 }
 /** The CLI's record of running one exec step. */
 export interface GateExecution {
@@ -105,6 +115,22 @@ export interface GateFailure {
     readonly pkg?: string | undefined;
     readonly reason: string;
     readonly class: ReleaseFailureClass;
+    /**
+     * Feature release-gate-output-tail (AM-4): the last non-empty lines of the step's stdout and
+     * stderr, KEPT SEPARATE — each stream through {@link outputTail} on its own, never merged —
+     * so a reader can tell which stream a line came from. Set for `tests`/`syntax`/`smoke`
+     * EXIT_NONZERO/TIMEOUT failures; absent for `audit` (its own detail line already summarizes)
+     * and for failures with no execution record (e.g. UNEXECUTED_STEP).
+     *
+     * Scope honesty (AM-4): the two streams are captured independently, so a printed/issued
+     * `stdout:`/`stderr:` pair does NOT reconstruct the chronological interleaving of the two
+     * streams as the process actually emitted them — only each stream's own tail order is
+     * preserved. Documented in the CLI README (AM-8), not silently implied.
+     */
+    readonly tails?: {
+        readonly stdout: string;
+        readonly stderr: string;
+    };
 }
 /** Per-gate verdict. `skip` = the gate had nothing to execute (still not a pass). */
 export interface GateResult {
@@ -164,6 +190,15 @@ export interface PlanReleaseGatesOptions {
     readonly auditTimeoutMs?: number | undefined;
     readonly syntaxTimeoutMs?: number | undefined;
     readonly smokeTimeoutMs?: number | undefined;
+    /**
+     * FR-6 (feature publish-sibling-drift-gate): real tmp dirs for the packed-install smoke,
+     * supplied by the CLI (planning stays pure — it never calls mkdtemp itself). Omitted ⇒ no
+     * packed-install steps are planned, byte-identical to the pre-feature behavior.
+     */
+    readonly packedInstall?: {
+        readonly packDir: string;
+        readonly installDir: string;
+    } | undefined;
 }
 /**
  * Plan the four gates from injected facts. Pure: same facts ⇒ byte-identical plan; nothing
@@ -176,6 +211,54 @@ export declare function planReleaseGates(facts: readonly ReleasePackageFacts[],
  * Exported so the CLI reuses it for gh/tag periphery messages (G9 reuse-never-copy).
  */
 export declare function firstOutputLine(...chunks: readonly unknown[]): string;
+/**
+ * Feature release-gate-output-tail (FR-1, amended AM-2): a one-line-ish detail for a
+ * `tests`/`syntax`/`smoke` EXIT_NONZERO/TIMEOUT failure that names the ACTUAL failure — not
+ * just the first output line, which for `pnpm test`/vitest is routinely an unrelated
+ * vite/esbuild deprecation warning (MEASURED 2026-09-13 16:05/18:52).
+ *
+ * AM-2: ANSI escapes are stripped FIRST (a coloured runner must match the same patterns as a
+ * plain one). Recognised shapes, collected in this priority order and joined:
+ * 1. vitest summary lines (`Tests …`, `Test Files …`);
+ * 2. up to 5 `FAIL …` / `× …` / `❯ …` lines (failing test names/paths);
+ * 3. node:test (TAP) lines: `not ok N - name` and `# fail N`.
+ *
+ * If NONE of the above is present (a non-vitest, non-TAP failure, or empty output), fall back
+ * to the prior `firstLine` behavior, marked `(no test-runner summary recognised)` so a reader
+ * knows the detail is a guess, not a parsed summary — UNLESS `firstLine` itself is empty (no
+ * output at all), in which case the mark would manufacture a synthetic line where none existed
+ * and is withheld. Capped at 600 chars — a detail line, not a dump.
+ */
+export declare function testsFailureDetail(stdout: unknown, stderr: unknown): string;
+/**
+ * Feature release-gate-output-tail (FR-2/FR-3, amended AM-3): the last non-empty lines of ONE
+ * stream (call separately for stdout and stderr — AM-4), bounded on BOTH axes (line count and
+ * byte size) so a runaway suite cannot blow up a report or an issue body.
+ *
+ * AM-3 bounds, each an explicit branch rather than an emergent `Array.slice(-0)` accident
+ * (`slice(-0)` returns the WHOLE array, not `[]` — the pre-amendment bug):
+ * - `maxLines <= 0` → `''`; `maxBytes <= 0` → `''`.
+ * - Whole-line selection: lines are pulled from the END while the running BYTE total (each
+ *   line's UTF-8 byte length plus its joining `\n`) stays `<= maxBytes` — never a partial line.
+ * - A single most-recent line that ALONE exceeds `maxBytes` is truncated at a UTF-8 CHARACTER
+ *   boundary (never splitting a multi-byte codepoint) and marked `… (line truncated)`.
+ *
+ * Empty/whitespace-only output → `''` (never a synthetic line).
+ */
+export declare function outputTail(stdout: unknown, stderr: unknown, maxLines?: number, maxBytes?: number): string;
+/**
+ * Feature release-gate-output-tail (AM-1): redact secret-shaped substrings before ANY tail text
+ * reaches a GitHub issue body. Patterns, each independently redacted:
+ * - `token`/`secret`/`password` (case-insensitive) as a `key: value` or `key=value` pair — the
+ *   KEY survives, only the value is replaced;
+ * - `Bearer <token>` HTTP auth headers;
+ * - vendor-prefixed tokens: `npm_…`, `ghp_…`, `sk-…`, `AKIA…`;
+ * - long opaque strings (base64/hex-ish, `[A-Za-z0-9+/=]{32,}`) that look like a key/secret even
+ *   without a recognisable prefix.
+ * Order matters: prefixed/labelled patterns run BEFORE the generic long-opaque-string pattern so
+ * a `Bearer …` token is redacted as a whole rather than surviving as a shorter unlabelled blob.
+ */
+export declare function redactSecrets(text: string): string;
 /**
  * Merge plan + executions into the {@link ReleaseVerdict} — the single fail-closed decision
  * point (ADR load-bearing property):
@@ -194,6 +277,14 @@ export interface FailureIssueContext {
 /**
  * gh-2.4-safe `gh issue create` payload (only `--title`/`--body` are assumed downstream).
  * Pure + deterministic for a fixed verdict — the issue is the verdict's echo, never its judge.
+ *
+ * AM-1/AM-4/AM-5: every tail is (a) redacted (secret-shaped substrings replaced — see
+ * {@link redactSecrets}) and ANSI-stripped BEFORE it is ever considered for the body; (b) shown
+ * per STREAM, labelled `stdout:`/`stderr:` — AM-4's scope note applies here too: the two labelled
+ * blocks do NOT reconstruct chronological interleaving between the streams; (c) fenced so the
+ * payload cannot break out of its code block; (d) the WHOLE body is capped at
+ * {@link MAX_ISSUE_BODY_BYTES} — when it would exceed the cap, every tail is shrunk EVENLY
+ * (byte-proportional), not by dropping some tails whole while keeping others untouched.
  */
 export declare function buildFailureIssue(verdict: ReleaseVerdict, ctx?: FailureIssueContext): {
     title: string;

package/dist/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnE,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,EAAE,SAAS,aAAa,EAA0C,CAAC;AAElG;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,SAAS,GACT,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,cAAc,GACd,eAAe,GACf,aAAa,GACb,iBAAiB,CAAC;AAEtB,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AAE3E,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,CAAC;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjD;AAED,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACxC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AA4CX;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,mBAAmB,EAAE,CA8C3G;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,EACtC,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACpC,mBAAmB,EAAE,CAYvB;AAMD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,QAAQ,CA4K/G;AAyCD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAErE;AAWD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,GAAG,GAAE,IAAiB,GACrB,cAAc,CA8EhB;AAMD,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,GAAE,mBAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAsBzH;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,CAQpF;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMlE"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAA0B,MAAM,2BAA2B,CAAC;AAE3F,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnE,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,EAAE,SAAS,aAAa,EAA0C,CAAC;AAElG;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,SAAS,GACT,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,cAAc,GACd,eAAe,GACf,aAAa,GACb,iBAAiB,CAAC;AAEtB,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AAE3E,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,CAAC;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjD;AAED,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACxC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC5D;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AA4CX;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,mBAAmB,EAAE,CA8C3G;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,EACtC,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACpC,mBAAmB,EAAE,CAYvB;AAMD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAChG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,QAAQ,CAuN/G;AAyCD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAErE;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAiB3E;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,SAAK,EAAE,QAAQ,SAAO,GAAG,MAAM,CA6BnG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,GAAG,GAAE,IAAiB,GACrB,cAAc,CA+HhB;AAMD,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAoBD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,GAAE,mBAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAyFzH;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,CAQpF;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMlE"}

package/dist/release.js

@@ -21,8 +21,9 @@
  * @packageDocumentation
  */
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, relative } from 'node:path';
 import { discoverPackages, orderByDependencies } from './publish.js';
+import { planPackedInstallSmoke, judgePackedInstallSmoke } from './packed-install-smoke.js';
 /** Order the CLI executes and the verdict reports gates in. */
 export const RELEASE_GATE_ORDER = ['tests', 'audit', 'syntax', 'smoke'];
 /** Default per-step timeouts (NFR-4: a hung child is a classified failure, not a hung release). */
@@ -323,7 +324,46 @@ export function planReleaseGates(facts, opts) {
             }
         }
     }
-    return { steps, skips, packages: facts.map((f) => f.name) };
+    // FR-6 (feature publish-sibling-drift-gate): the packed-install smoke joins the SAME smoke
+    // gate `dz publish` runs (planPackedInstallSmoke, ADR-001 Decision 2) — so both doors apply
+    // the identical rule. Opt-in via `opts.packedInstall` (real tmp dirs, supplied by the CLI):
+    // omitted, this is byte-identical to the pre-feature plan, which every existing planner test
+    // relies on. Skipped entirely when nothing in the batch has a bin — packing siblings nobody
+    // will boot proves nothing a fresh `npm install` doesn't already cover elsewhere.
+    let packedInstallPlan;
+    if (opts.packedInstall !== undefined) {
+        const bins = facts.flatMap((f) => f.bins.map((b) => ({ pkg: f.name, binName: b.name, relPath: relative(f.dir, b.path) })));
+        if (bins.length > 0) {
+            const packages = facts.map((f) => ({ name: f.name, dir: f.dir, version: f.version }));
+            const smokePlan = planPackedInstallSmoke({
+                packages,
+                bins,
+                packDir: opts.packedInstall.packDir,
+                installDir: opts.packedInstall.installDir,
+            });
+            packedInstallPlan = smokePlan; // AM-7: kept for classifyGateExecutions's re-judge pass
+            for (const s of smokePlan.steps) {
+                const reason = s.kind === 'pack'
+                    ? `pack ${s.pkg} for the packed-install smoke — the tarball a consumer would actually receive`
+                    : s.kind === 'install'
+                        ? 'install every packed tarball together in a clean dir — out-of-batch siblings resolve from the registry, exactly like a fresh user'
+                        : s.kind === 'bin-exists'
+                            ? `bin "${s.binName}" must EXIST after the packed install (AM-8)`
+                            : `bin "${s.binName}" must boot from the PACKED install (--version, exit 0, non-empty stdout)`;
+                steps.push({
+                    id: `smoke:packed-install:${s.id}`,
+                    gate: 'smoke',
+                    pkg: s.pkg,
+                    cmd: s.cmd,
+                    cwd: s.cwd,
+                    timeoutMs: s.timeoutMs,
+                    reason,
+                    kind: 'exec',
+                });
+            }
+        }
+    }
+    return { steps, skips, packages: facts.map((f) => f.name), ...(packedInstallPlan !== undefined ? { packedInstallPlan } : {}) };
 }
 /* ------------------------------------------------------------------ */
 /*  VERIFY — pure classification                                       */
@@ -374,6 +414,137 @@ function firstLine(...chunks) {
     }
     return '';
 }
+/**
+ * Strip ANSI/VT100 escape sequences (colour codes, cursor moves, OSC hyperlinks) so pattern
+ * matching sees the plain text a human reads on a non-colour terminal. AM-2/AM-1 precondition:
+ * `testsFailureDetail` and the issue-body redaction both run this FIRST, before any regex tries
+ * to recognise a runner's summary/FAIL lines or a secret value — a coloured `FAIL` token (e.g.
+ * `\x1b[31mFAIL\x1b[0m`) must still match `/^FAIL\b/` once stripped.
+ */
+// eslint-disable-next-line no-control-regex -- deliberately matching raw ESC control bytes
+function stripAnsi(s) {
+    return s
+        .replace(/\x1B\][^\x07\x1B]*(?:\x07|\x1B\\)/g, '') // OSC …  BEL | OSC … ST
+        .replace(/\x1B[[()#;?]*[0-9]*(?:;[0-9]*)*[a-zA-Z@]/g, ''); // CSI/other short escapes
+}
+/**
+ * Feature release-gate-output-tail (FR-1, amended AM-2): a one-line-ish detail for a
+ * `tests`/`syntax`/`smoke` EXIT_NONZERO/TIMEOUT failure that names the ACTUAL failure — not
+ * just the first output line, which for `pnpm test`/vitest is routinely an unrelated
+ * vite/esbuild deprecation warning (MEASURED 2026-09-13 16:05/18:52).
+ *
+ * AM-2: ANSI escapes are stripped FIRST (a coloured runner must match the same patterns as a
+ * plain one). Recognised shapes, collected in this priority order and joined:
+ * 1. vitest summary lines (`Tests …`, `Test Files …`);
+ * 2. up to 5 `FAIL …` / `× …` / `❯ …` lines (failing test names/paths);
+ * 3. node:test (TAP) lines: `not ok N - name` and `# fail N`.
+ *
+ * If NONE of the above is present (a non-vitest, non-TAP failure, or empty output), fall back
+ * to the prior `firstLine` behavior, marked `(no test-runner summary recognised)` so a reader
+ * knows the detail is a guess, not a parsed summary — UNLESS `firstLine` itself is empty (no
+ * output at all), in which case the mark would manufacture a synthetic line where none existed
+ * and is withheld. Capped at 600 chars — a detail line, not a dump.
+ */
+export function testsFailureDetail(stdout, stderr) {
+    const all = stripAnsi(`${stdout == null ? '' : String(stdout)}\n${stderr == null ? '' : String(stderr)}`);
+    const lines = all
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+    const summaryLines = lines.filter((l) => /^(Tests|Test Files)\b/.test(l));
+    const failLines = lines.filter((l) => /^(FAIL\b|×|❯)/.test(l)).slice(0, 5);
+    const tapNotOkLines = lines.filter((l) => /^not ok \d+/.test(l)).slice(0, 5);
+    const tapFailCountLines = lines.filter((l) => /^# fail \d+/i.test(l));
+    const parts = [...summaryLines, ...failLines, ...tapNotOkLines, ...tapFailCountLines];
+    if (parts.length === 0) {
+        // lead r2: the fallback is derived from the ANSI-STRIPPED text, never the raw stream
+        const fl = lines[0] ?? '';
+        return fl.length === 0 ? '' : `${fl.slice(0, 200)} (no test-runner summary recognised)`;
+    }
+    return parts.join(' — ').slice(0, 600);
+}
+/** Truncate `s` to at most `maxBytes` UTF-8 bytes, never splitting a multi-byte character. */
+function truncateToBytes(s, maxBytes) {
+    if (maxBytes <= 0)
+        return '';
+    const buf = Buffer.from(s, 'utf-8');
+    if (buf.length <= maxBytes)
+        return s;
+    let end = maxBytes;
+    // back off while the next byte is a UTF-8 continuation byte (10xxxxxx)
+    while (end > 0 && (buf[end] & 0xc0) === 0x80)
+        end -= 1;
+    return buf.subarray(0, end).toString('utf-8');
+}
+/**
+ * Feature release-gate-output-tail (FR-2/FR-3, amended AM-3): the last non-empty lines of ONE
+ * stream (call separately for stdout and stderr — AM-4), bounded on BOTH axes (line count and
+ * byte size) so a runaway suite cannot blow up a report or an issue body.
+ *
+ * AM-3 bounds, each an explicit branch rather than an emergent `Array.slice(-0)` accident
+ * (`slice(-0)` returns the WHOLE array, not `[]` — the pre-amendment bug):
+ * - `maxLines <= 0` → `''`; `maxBytes <= 0` → `''`.
+ * - Whole-line selection: lines are pulled from the END while the running BYTE total (each
+ *   line's UTF-8 byte length plus its joining `\n`) stays `<= maxBytes` — never a partial line.
+ * - A single most-recent line that ALONE exceeds `maxBytes` is truncated at a UTF-8 CHARACTER
+ *   boundary (never splitting a multi-byte codepoint) and marked `… (line truncated)`.
+ *
+ * Empty/whitespace-only output → `''` (never a synthetic line).
+ */
+export function outputTail(stdout, stderr, maxLines = 40, maxBytes = 8192) {
+    if (maxLines <= 0 || maxBytes <= 0)
+        return '';
+    const all = `${stdout == null ? '' : String(stdout)}\n${stderr == null ? '' : String(stderr)}`;
+    const nonEmpty = all
+        .split('\n')
+        .map((l) => l.replace(/\r$/, ''))
+        .filter((l) => l.trim().length > 0);
+    const tailLines = nonEmpty.slice(-maxLines);
+    if (tailLines.length === 0)
+        return '';
+    const lastLine = tailLines[tailLines.length - 1];
+    if (Buffer.byteLength(lastLine, 'utf-8') > maxBytes) {
+        // lead r2: the marker lives INSIDE the byte budget, so the returned text never exceeds maxBytes
+        const marker = '… (line truncated)';
+        const room = Math.max(0, maxBytes - Buffer.byteLength(marker, 'utf-8'));
+        return `${truncateToBytes(lastLine, room)}${marker}`;
+    }
+    const selected = [];
+    let bytes = 0;
+    for (let i = tailLines.length - 1; i >= 0; i--) {
+        const line = tailLines[i];
+        const lineBytes = Buffer.byteLength(line, 'utf-8');
+        const joinerBytes = selected.length > 0 ? 1 : 0; // the '\n' this line adds once prepended
+        if (bytes + lineBytes + joinerBytes > maxBytes)
+            break;
+        selected.unshift(line);
+        bytes += lineBytes + joinerBytes;
+    }
+    return selected.join('\n');
+}
+/**
+ * Feature release-gate-output-tail (AM-1): redact secret-shaped substrings before ANY tail text
+ * reaches a GitHub issue body. Patterns, each independently redacted:
+ * - `token`/`secret`/`password` (case-insensitive) as a `key: value` or `key=value` pair — the
+ *   KEY survives, only the value is replaced;
+ * - `Bearer <token>` HTTP auth headers;
+ * - vendor-prefixed tokens: `npm_…`, `ghp_…`, `sk-…`, `AKIA…`;
+ * - long opaque strings (base64/hex-ish, `[A-Za-z0-9+/=]{32,}`) that look like a key/secret even
+ *   without a recognisable prefix.
+ * Order matters: prefixed/labelled patterns run BEFORE the generic long-opaque-string pattern so
+ * a `Bearer …` token is redacted as a whole rather than surviving as a shorter unlabelled blob.
+ */
+export function redactSecrets(text) {
+    let out = text;
+    out = out.replace(/\bBearer\s+\S+/gi, 'Bearer [redacted]');
+    out = out.replace(/\bnpm_[A-Za-z0-9]+/g, '[redacted]');
+    out = out.replace(/\bghp_[A-Za-z0-9]+/g, '[redacted]');
+    out = out.replace(/\bsk-[A-Za-z0-9]+/g, '[redacted]');
+    out = out.replace(/\bAKIA[A-Za-z0-9]+/g, '[redacted]');
+    out = out.replace(/\b(token|secret|password)(\s*[:=]\s*)(\S+)/gi, '$1$2[redacted]');
+    out = out.replace(/\b[A-Za-z0-9+/=]{32,}\b/g, '[redacted]');
+    return out;
+}
 /**
  * Merge plan + executions into the {@link ReleaseVerdict} — the single fail-closed decision
  * point (ADR load-bearing property):
@@ -389,6 +560,27 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
         if (e != null && typeof e.stepId === 'string')
             byId.set(e.stepId, e);
     }
+    // AM-7: `bin-exists`/`bin-version` packed-install steps are judged through
+    // `judgePackedInstallSmoke` — the SAME rule `dz publish` applies (exit 0 AND non-empty stdout,
+    // AND the declared bin must exist post-install) — instead of the generic exit-code-only check
+    // every other step gets. The generic loop below SKIPS these step ids; the judged verdict is
+    // folded into the 'smoke' gate's failures/passed count after the loop.
+    const packedInstallPlan = plan?.packedInstallPlan;
+    const packedInstallBinStepIds = new Set((packedInstallPlan?.steps ?? []).filter((s) => s.kind === 'bin-exists' || s.kind === 'bin-version').map((s) => `smoke:packed-install:${s.id}`));
+    let packedInstallVerdict;
+    if (packedInstallPlan !== undefined) {
+        const prefix = 'smoke:packed-install:';
+        const translated = (executions ?? [])
+            .filter((e) => e != null && typeof e.stepId === 'string' && e.stepId.startsWith(prefix))
+            .map((e) => ({
+            stepId: e.stepId.slice(prefix.length),
+            exitCode: e.exitCode,
+            stdout: e.stdout ?? '',
+            stderr: e.stderr ?? '',
+            ...(e.timedOut !== undefined ? { timedOut: e.timedOut } : {}),
+        }));
+        packedInstallVerdict = judgePackedInstallSmoke(packedInstallPlan, translated);
+    }
     const gates = RELEASE_GATE_ORDER.map((gate) => {
         const gateSteps = (plan?.steps ?? []).filter((s) => s?.gate === gate);
         const gateSkips = (plan?.skips ?? []).filter((s) => s?.gate === gate);
@@ -396,6 +588,8 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
         let passed = 0;
         for (const step of gateSteps) {
             try {
+                if (packedInstallBinStepIds.has(step.id))
+                    continue; // judged separately below (AM-7)
                 if (step.kind === 'synthetic-fail') {
                     failures.push({ pkg: step.pkg, reason: step.reason, class: step.failClass ?? 'EXIT_NONZERO' });
                     continue;
@@ -414,6 +608,9 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
                         pkg: step.pkg,
                         reason: `timed out after ${step.timeoutMs}ms: ${step.cmd}`,
                         class: gate === 'smoke' ? 'SMOKE_TIMEOUT' : 'TIMEOUT',
+                        // FR-3 / AM-4: a killed-by-timeout step still has whatever it printed before the
+                        // kill — captured per-stream, never merged (see GateFailure.tails doc comment).
+                        tails: { stdout: outputTail(exec.stdout, undefined), stderr: outputTail(undefined, exec.stderr) },
                     });
                     continue;
                 }
@@ -424,10 +621,15 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
                         failures.push({ pkg: step.pkg, reason: `${reason}${detail ? ` — ${detail}` : ''}`, class: cls });
                     }
                     else {
+                        // FR-1: for tests/syntax/smoke, name the ACTUAL failure (summary + failing tests),
+                        // not just the first output line — see testsFailureDetail's doc comment for why.
+                        const detail = testsFailureDetail(exec.stderr, exec.stdout);
                         failures.push({
                             pkg: step.pkg,
-                            reason: `exit ${String(exec.exitCode)}: ${step.cmd}${firstLine(exec.stderr, exec.stdout) ? ` — ${firstLine(exec.stderr, exec.stdout)}` : ''}`,
+                            reason: `exit ${String(exec.exitCode)}: ${step.cmd}${detail ? ` — ${detail}` : ''}`,
                             class: 'EXIT_NONZERO',
+                            // AM-4: per-stream tails, never merged — see GateFailure.tails doc comment.
+                            tails: { stdout: outputTail(exec.stdout, undefined), stderr: outputTail(undefined, exec.stderr) },
                         });
                     }
                     continue;
@@ -439,6 +641,22 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
                 failures.push({ pkg: step?.pkg, reason: 'unclassifiable step/execution record', class: 'EXIT_NONZERO' });
             }
         }
+        // AM-7: fold the packed-install bin verdicts (judged via judgePackedInstallSmoke, above) into
+        // the 'smoke' gate — the ONLY gate that ever plans packed-install steps.
+        if (gate === 'smoke' && packedInstallVerdict !== undefined) {
+            for (const bin of packedInstallVerdict.bins) {
+                if (bin.ok) {
+                    passed += 1;
+                }
+                else {
+                    failures.push({
+                        pkg: bin.pkg,
+                        reason: `packed-install bin "${bin.binName}" ${bin.detail ?? 'failed'}`,
+                        class: 'EXIT_NONZERO',
+                    });
+                }
+            }
+        }
         const status = failures.length > 0 ? 'fail' : passed > 0 ? 'pass' : 'skip';
         return { gate, status, passed, failures, skips: gateSkips };
     });
@@ -458,34 +676,112 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
         timestamp: now.toISOString(),
     };
 }
+/** AM-1: total issue-body cap — a courier never balloons into an unpostable payload. */
+const MAX_ISSUE_BODY_BYTES = 60 * 1024;
+/**
+ * AM-5: fence `text` so the payload can never prematurely close the code block — the fence is
+ * N+1 backticks, where N is the LONGEST run of consecutive backticks already present in `text`.
+ * Every content line (and the fence itself) carries `indent` so a multi-line block renders as a
+ * continuation of the enclosing markdown list item, not as a sibling paragraph.
+ */
+function fencedBlock(text, indent = '    ') {
+    const runs = text.match(/`+/g) ?? [];
+    const longestRun = runs.reduce((m, r) => Math.max(m, r.length), 0);
+    // GFM needs >= 3 backticks for a FENCED (block) code fence — fewer reads as inline code.
+    const fence = '`'.repeat(Math.max(3, longestRun + 1));
+    const contentLines = text.split('\n').map((l) => `${indent}${l}`);
+    return [`${indent}${fence}`, ...contentLines, `${indent}${fence}`];
+}
 /**
  * gh-2.4-safe `gh issue create` payload (only `--title`/`--body` are assumed downstream).
  * Pure + deterministic for a fixed verdict — the issue is the verdict's echo, never its judge.
+ *
+ * AM-1/AM-4/AM-5: every tail is (a) redacted (secret-shaped substrings replaced — see
+ * {@link redactSecrets}) and ANSI-stripped BEFORE it is ever considered for the body; (b) shown
+ * per STREAM, labelled `stdout:`/`stderr:` — AM-4's scope note applies here too: the two labelled
+ * blocks do NOT reconstruct chronological interleaving between the streams; (c) fenced so the
+ * payload cannot break out of its code block; (d) the WHOLE body is capped at
+ * {@link MAX_ISSUE_BODY_BYTES} — when it would exceed the cap, every tail is shrunk EVENLY
+ * (byte-proportional), not by dropping some tails whole while keeping others untouched.
  */
 export function buildFailureIssue(verdict, ctx = {}) {
     const failed = verdict.gates.filter((g) => g.status === 'fail').map((g) => g.gate);
     const title = `dz release: gate failure — ${failed.length > 0 ? failed.join(', ') : 'nothing verified'}`;
-    const lines = [
-        `Verified release blocked at ${verdict.timestamp}.`,
-        '',
-        ...(ctx.invocation ? [`Invocation: \`${ctx.invocation}\``, ''] : []),
-        ...(ctx.repo ? [`Repo: ${ctx.repo}`, ''] : []),
-        '## Gate verdict',
-        '',
-    ];
+    const refsByFailure = new Map();
     for (const g of verdict.gates) {
-        const icon = g.status === 'pass' ? '✓' : g.status === 'fail' ? '✗' : '○';
-        lines.push(`- ${icon} **${g.gate}** — ${g.status} (${g.passed} passed, ${g.failures.length} failed, ${g.skips.length} skipped)`);
-        for (const f of g.failures)
-            lines.push(`  - [${f.class}] ${f.pkg ? `${f.pkg}: ` : ''}${f.reason}`);
+        for (const f of g.failures) {
+            if (f.tails === undefined)
+                continue;
+            const refs = [];
+            for (const stream of ['stdout', 'stderr']) {
+                const raw = f.tails[stream];
+                if (raw.length === 0)
+                    continue;
+                const clean = redactSecrets(stripAnsi(raw));
+                refs.push({ stream, text: clean, rawBytes: Buffer.byteLength(clean, 'utf-8') });
+            }
+            if (refs.length > 0)
+                refsByFailure.set(f, refs);
+        }
     }
-    if (verdict.skipped.length > 0) {
-        lines.push('', '## Skipped (honestly reported, never counted as passed)', '');
-        for (const s of verdict.skipped)
-            lines.push(`- [${s.class}] ${s.pkg}: ${s.reason}`);
+    const render = () => {
+        const lines = [
+            `Verified release blocked at ${verdict.timestamp}.`,
+            '',
+            ...(ctx.invocation ? [`Invocation: \`${redactSecrets(stripAnsi(ctx.invocation)).replace(/`/g, "'")}\``, ''] : []),
+            ...(ctx.repo ? [`Repo: ${ctx.repo}`, ''] : []),
+            '## Gate verdict',
+            '',
+        ];
+        for (const g of verdict.gates) {
+            const icon = g.status === 'pass' ? '✓' : g.status === 'fail' ? '✗' : '○';
+            lines.push(`- ${icon} **${g.gate}** — ${g.status} (${g.passed} passed, ${g.failures.length} failed, ${g.skips.length} skipped)`);
+            for (const f of g.failures) {
+                // lead r2 (HIGH): the reason is output-derived free text — strip ANSI and redact it like a tail
+                lines.push(`  - [${f.class}] ${f.pkg ? `${f.pkg}: ` : ''}${redactSecrets(stripAnsi(f.reason))}`);
+                // FR-2 / AM-4 / AM-5: a labelled, fenced block per non-empty stream — the issue is the
+                // echo of the verdict, so a reader can see the actual failing output without re-running.
+                for (const ref of refsByFailure.get(f) ?? []) {
+                    lines.push(`    ${ref.stream}:`, ...fencedBlock(ref.text));
+                }
+            }
+        }
+        if (verdict.skipped.length > 0) {
+            lines.push('', '## Skipped (honestly reported, never counted as passed)', '');
+            for (const s of verdict.skipped)
+                lines.push(`- [${s.class}] ${s.pkg}: ${s.reason}`);
+        }
+        lines.push('', `Blocked by: ${verdict.blockedBy.join('; ')}`, '', '_Auto-created by `dz release` (best-effort; the release verdict is independent of this issue)._');
+        return lines.join('\n');
+    };
+    let body = render();
+    let bodyBytes = Buffer.byteLength(body, 'utf-8');
+    if (bodyBytes > MAX_ISSUE_BODY_BYTES && refsByFailure.size > 0) {
+        const allRefs = [...refsByFailure.values()].flat();
+        let overage = bodyBytes - MAX_ISSUE_BODY_BYTES;
+        // Bounded iteration: each pass's cut is based on the LATEST measured overage (markup like
+        // "… (truncated)" adds a few bytes back per ref, so one pass rarely lands exactly) — a few
+        // passes converge; the safety net below closes any pathological remainder.
+        for (let pass = 0; pass < 3 && overage > 0; pass++) {
+            const perRefCut = Math.ceil(overage / allRefs.length);
+            for (const ref of allRefs) {
+                const targetBytes = Math.max(0, ref.rawBytes - perRefCut);
+                if (Buffer.byteLength(ref.text, 'utf-8') > targetBytes) {
+                    ref.text = `${truncateToBytes(ref.text, targetBytes)}… (truncated)`;
+                }
+            }
+            body = render();
+            bodyBytes = Buffer.byteLength(body, 'utf-8');
+            overage = bodyBytes - MAX_ISSUE_BODY_BYTES;
+        }
+        // Safety net: a pathological shape (a huge non-tail skeleton, tiny/no tails) can still exceed
+        // the cap after every tail is wiped — hard-truncate the whole body as the last resort so the
+        // cap is an INVARIANT, never a best-effort.
+        if (bodyBytes > MAX_ISSUE_BODY_BYTES) {
+            body = `${truncateToBytes(body, MAX_ISSUE_BODY_BYTES - 20)}\n… (truncated)`;
+        }
     }
-    lines.push('', `Blocked by: ${verdict.blockedBy.join('; ')}`, '', '_Auto-created by `dz release` (best-effort; the release verdict is independent of this issue)._');
-    return { title, body: lines.join('\n') };
+    return { title, body };
 }
 /** Short, bounded release notes from injected `git log --oneline`-style lines. */
 export function buildReleaseNotes(gitLogLines, limit = 15) {