elanous 0.2.22 → 0.2.24

package/scripts/release-loop/gate-wall.ts

@@ -0,0 +1,208 @@
+// GATE-SPEED-P2 — measure one commit's gate wall clock without folding earlier attempts into retries.
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { readJunitFileSeconds } from './gate-method.js';
+import { resolveGateLogDir } from './gate-timing.js';
+
+type TimedPod = { name: string; start: number; end: number; durationMs: number; root: boolean };
+export interface GateWallAttempt {
+  commit: string;
+  records: number;
+  roots: number;
+  retries: number;
+  wallMin: number;
+  rootWallMin: number | null;
+  retryTailMin: number | null;
+  overhead: { medianMin: number | null; p90Min: number | null; unmeasuredRoots: number };
+}
+export interface GateWallReport {
+  dir: string;
+  targetMin: number;
+  measured: boolean;
+  commit: string | null;
+  records: number;
+  roots: number;
+  retries: number;
+  wallMin: number | null;
+  wallSource: 'pod-records' | null;
+  rootWallMin: number | null;
+  retryTailMin: number | null;
+  overhead: GateWallAttempt['overhead'];
+  retryOnlyAttempts: number;
+  attempts: GateWallAttempt[];
+  shardsWallMin: number | null;
+  disagree: boolean;
+  unreadable: string[];
+  /** ✓ only when every pod record was read; a slower verdict is already certain. */
+  verdict: 'pass' | 'fail' | 'undetermined' | null;
+  /** Why shards.json was not compared although present (it carries no attempt identity). */
+  shardsSkipped: 'not-latest-attempt' | 'outside-attempt-window' | null;
+}
+
+const POD_JSON = /^pod-.+\.json$/;
+const ROOT = /^pod-\d+\.json$/;
+function median(values: number[]): number {
+  const sorted = [...values].sort((a, b) => a - b);
+  const mid = Math.floor(sorted.length / 2);
+  return sorted.length % 2 ? sorted[mid]! : (sorted[mid - 1]! + sorted[mid]!) / 2;
+}
+function spanMin(pods: TimedPod[]): number {
+  return (Math.max(...pods.map((p) => p.end)) - Math.min(...pods.map((p) => p.start))) / 60_000;
+}
+function attempt(dir: string, commit: string, pods: TimedPod[]): GateWallAttempt {
+  const roots = pods.filter((p) => p.root);
+  const overhead: number[] = [];
+  let unmeasuredRoots = 0;
+  for (const pod of roots) {
+    try {
+      const xml = readFileSync(join(dir, pod.name.replace(/\.json$/, '.junit.xml')), 'utf8');
+      const seconds = [...readJunitFileSeconds(xml).values()];
+      if (!seconds.length) { unmeasuredRoots++; continue; }
+      overhead.push((pod.durationMs - seconds.reduce((sum, s) => sum + s, 0) * 1000) / 60_000);
+    } catch { unmeasuredRoots++; }
+  }
+  const wall = spanMin(pods);
+  const rootWall = roots.length ? spanMin(roots) : null;
+  const sorted = overhead.sort((a, b) => a - b);
+  return {
+    commit, records: pods.length, roots: roots.length, retries: pods.length - roots.length,
+    wallMin: wall, rootWallMin: rootWall,
+    retryTailMin: rootWall === null ? null : wall - rootWall,
+    overhead: {
+      medianMin: sorted.length ? median(sorted) : null,
+      p90Min: sorted.length ? sorted[Math.ceil(sorted.length * 0.9) - 1]! : null,
+      unmeasuredRoots,
+    },
+  };
+}
+
+const SHARDS_WINDOW_SLACK_MS = 5 * 60_000;
+/**
+ * shards.json is a snapshot of the latest attempt, not an archive of every commit, and has no attempt identity.
+ * A row is attributed to the attempt only when its root id is one of the attempt's roots AND
+ * a row starts inside the attempt's pod-record window (from 5 min before its first start to its last end) — a
+ * previous attempt's snapshot reusing `pod-0` started earlier and is rejected. The end is free: a longer
+ * snapshot is exactly the disagreement this report keeps.
+ */
+function shardsSpan(dir: string, rootNames: Set<string>, window: { start: number; end: number }): number | 'outside-attempt-window' | null {
+  try {
+    const file: unknown = JSON.parse(readFileSync(join(dir, 'shards.json'), 'utf8'));
+    if (!file || typeof file !== 'object' || !('shards' in file) || !Array.isArray(file.shards)) return null;
+    const rows = file.shards as unknown[];
+    if (!rows.length) return null;
+    const starts: number[] = [];
+    const ends: number[] = [];
+    for (const row of rows) {
+      if (!row || typeof row !== 'object' || !('id' in row) || typeof row.id !== 'string'
+        || !rootNames.has(`${row.id}.json`)) return null;
+      const start = 'startedAt' in row && typeof row.startedAt === 'string' ? Date.parse(row.startedAt) : NaN;
+      const end = 'endedAt' in row && typeof row.endedAt === 'string' ? Date.parse(row.endedAt) : NaN;
+      if (!Number.isFinite(start) || !Number.isFinite(end) || end < start) return null;
+      if (start < window.start - SHARDS_WINDOW_SLACK_MS || start > window.end) return 'outside-attempt-window';
+      starts.push(start);
+      ends.push(end);
+    }
+    if (Math.max(...ends) < Math.min(...starts)) return null;
+    return (Math.max(...ends) - Math.min(...starts)) / 60_000;
+  } catch { return null; }
+}
+
+export function gateWall(dir: string, opts: { commit?: string; targetMin?: number } = {}): GateWallReport {
+  const targetMin = opts.targetMin ?? 30;
+  if (!Number.isFinite(targetMin) || targetMin <= 0) throw new Error('target-min 은 양수여야 합니다');
+  const groups = new Map<string, TimedPod[]>();
+  const unreadable: string[] = [];
+  const names = existsSync(dir) && statSync(dir).isDirectory() ? readdirSync(dir).filter((n) => POD_JSON.test(n)).sort() : [];
+  for (const name of names) {
+    try {
+      const pod: unknown = JSON.parse(readFileSync(join(dir, name), 'utf8'));
+      if (!pod || typeof pod !== 'object' || !('commit' in pod) || !('durationMs' in pod)
+        || typeof pod.commit !== 'string' || !pod.commit.trim()
+        || typeof pod.durationMs !== 'number' || !Number.isFinite(pod.durationMs) || pod.durationMs < 0) {
+        unreadable.push(name); continue;
+      }
+      const end = statSync(join(dir, name)).mtimeMs;
+      if (!Number.isFinite(end)) { unreadable.push(name); continue; }
+      const group = groups.get(pod.commit) ?? [];
+      group.push({ name, start: end - pod.durationMs, end, durationMs: pod.durationMs, root: ROOT.test(name) });
+      groups.set(pod.commit, group);
+    } catch { unreadable.push(name); }
+  }
+  const ordered = [...groups].sort((a, b) => Math.max(...b[1].map((p) => p.end)) - Math.max(...a[1].map((p) => p.end)));
+  const matching = opts.commit === undefined ? ordered : ordered.filter(([commit]) => commit.startsWith(opts.commit!));
+  if (opts.commit !== undefined && matching.length > 1) throw new Error(`모호한 커밋 앞자리: ${opts.commit}`);
+  const chosen = matching.find(([, pods]) => pods.some((p) => p.root));
+  const attempts = ordered.map(([commit, pods]) => attempt(dir, commit, pods));
+  const selected = chosen && attempts.find((a) => a.commit === chosen[0]);
+  // The snapshot has no commit field. Only the latest recorded attempt can own it; require its root row IDs too.
+  const latest = chosen !== undefined && ordered[0]?.[0] === chosen[0];
+  const span = chosen && latest
+    ? shardsSpan(dir, new Set(chosen[1].filter((p) => p.root).map((p) => p.name)),
+      { start: Math.min(...chosen[1].map((p) => p.start)), end: Math.max(...chosen[1].map((p) => p.end)) }) : null;
+  const snapshot = typeof span === 'number' ? span : null;
+  const shardsWallMin = snapshot;
+  const hasShards = existsSync(join(dir, 'shards.json'));
+  const shardsSkipped = !hasShards || !chosen ? null : !latest ? 'not-latest-attempt' as const : span === 'outside-attempt-window' ? span : null;
+  const wallMin = selected?.wallMin ?? null;
+  const verdict = wallMin === null ? null : wallMin > targetMin ? 'fail' as const : unreadable.length ? 'undetermined' as const : 'pass' as const;
+  return {
+    dir, targetMin, measured: selected !== undefined, commit: selected?.commit ?? null,
+    records: selected?.records ?? 0, roots: selected?.roots ?? 0, retries: selected?.retries ?? 0,
+    wallMin: selected?.wallMin ?? null, wallSource: selected ? 'pod-records' : null,
+    rootWallMin: selected?.rootWallMin ?? null, retryTailMin: selected?.retryTailMin ?? null,
+    overhead: selected?.overhead ?? { medianMin: null, p90Min: null, unmeasuredRoots: 0 },
+    retryOnlyAttempts: attempts.filter((a) => a.roots === 0).length,
+    attempts, shardsWallMin,
+    disagree: snapshot !== null && chosen !== undefined && Math.abs(snapshot - spanMin(chosen[1])) > 5,
+    unreadable, verdict, shardsSkipped,
+  };
+}
+
+export function formatGateWall(report: GateWallReport): string {
+  const number = (value: number | null) => value === null ? '못 잼' : `${value.toFixed(1)}분`;
+  if (!report.measured) return `게이트 벽시계 못 잼 · 목표 ≤${report.targetMin}분 판정 못 잼 · 루트 못 잼 · 재시도 꼬리 못 잼 · 조각 준비 중앙 못 잼`;
+  return [
+    `게이트 벽시계 ${number(report.wallMin)}(pod-records · 커밋 ${report.commit!.slice(0, 8)}) · 목표 ≤${report.targetMin}분 ${report.verdict === 'pass' ? '✓' : report.verdict === 'fail' ? '✗' : `판정 보류(못 읽은 기록 ${report.unreadable.length})`} · 루트 ${number(report.rootWallMin)} · 재시도 꼬리 ${number(report.retryTailMin)} · 조각 준비 중앙 ${number(report.overhead.medianMin)}`,
+    `커밋 ${report.commit} · 기록 ${report.records} · 루트 ${report.roots} · 재시도 ${report.retries} · 루트 없는 시도 ${report.retryOnlyAttempts} · 준비 p90 ${number(report.overhead.p90Min)} · 준비 못 잰 루트 ${report.overhead.unmeasuredRoots}`,
+    ...(report.shardsWallMin === null ? [] : [`shards.json 벽시계 ${number(report.shardsWallMin)} · 기록 추정 ${number(report.wallMin)}${report.disagree ? ' · ⚠ 5분 초과 불일치' : ''}`]),
+    ...(report.shardsSkipped ? [`shards.json 대조 생략 — 이 시도의 것인지 확인 못 함(${report.shardsSkipped})`] : []),
+    ...(report.unreadable.length ? [`⚠ 못 읽은 기록 ${report.unreadable.length}: ${report.unreadable.slice(0, 3).join(', ')}`] : []),
+  ].join('\n');
+}
+
+export const GATE_WALL_USAGE = '사용법: bun scripts/release-loop/gate-wall.ts <version|dir> [--commit <sha>] [--target-min <n>] [--json]';
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  let target: string | undefined;
+  let commit: string | undefined;
+  let targetMin: number | undefined;
+  let json = false;
+  let error: string | undefined;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === '--json') { json = true; continue; }
+    if (arg === '--commit' || arg === '--target-min') {
+      const value = args[++i];
+      if (!value || value.startsWith('-')) { error = `값이 없는 옵션: ${arg}`; break; }
+      if (arg === '--commit') commit = value;
+      else {
+        targetMin = Number(value);
+        if (!Number.isFinite(targetMin) || targetMin <= 0) { error = `잘못된 목표 분: ${value}`; break; }
+      }
+      continue;
+    }
+    if (arg.startsWith('-')) { error = `알 수 없는 옵션: ${arg}`; break; }
+    if (target) { error = `예상치 못한 인자: ${arg}`; break; }
+    target = arg;
+  }
+  if (error || !target) { console.error(`${error ?? '대상 경로 또는 버전이 필요합니다'}\n${GATE_WALL_USAGE}`); process.exit(2); }
+  try {
+    const report = gateWall(resolveGateLogDir(target), { commit, targetMin });
+    console.log(json ? JSON.stringify(report, null, 2) : formatGateWall(report));
+    if (!report.measured) process.exitCode = 1;
+  } catch (e) {
+    console.error(`${e instanceof Error ? e.message : String(e)}\n${GATE_WALL_USAGE}`);
+    process.exitCode = 2;
+  }
+}

package/scripts/release-loop/known-issues-node.ts

@@ -1,5 +1,7 @@
 #!/usr/bin/env bun
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
+import type { GraphRunState } from '../../src/graph-runner/runner.js';
 import { join } from 'node:path';
 import { emitNodeResult, readGraphContext, runCommand, type CommandRunner, type GraphContext } from './node-verdict.js';
 
@@ -64,6 +66,37 @@ function cleanBullet(text: string): string | null {
   return line;
 }
 
+/** A waiver is copied verbatim into public notes, so reject internal or resolved claims before resuming. */
+export function publicWaiverReason(text: string): string {
+  const bullet = cleanBullet(text);
+  if (!bullet || resolved.test(bullet) || !/[a-z]{3}/i.test(bullet)) throw new Error('unsafe public waiver reason');
+  return bullet;
+}
+
+function recordedWaivers(context: GraphContext, accepted: Issue[]): Issue[] {
+  const contextPath = process.env.ELANOUS_GRAPH_CONTEXT;
+  if (!contextPath || !/\.json\.contexts\/[1-9]\d*\.json$/.test(contextPath)) return [];
+  const raw = JSON.parse(readFileSync(contextPath, 'utf8')) as { graphId?: string; runId?: string; nodeId?: string };
+  if (raw.graphId !== 'release-loop' || raw.nodeId !== 'known-issues' || !raw.runId || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(raw.runId)) return [];
+  const statePath = join(effectiveInstanceRoot(), 'graph-runs', 'release-loop', `${raw.runId}.json`);
+  const visit = Number(contextPath.slice(contextPath.lastIndexOf('/') + 1, -'.json'.length));
+  if (contextPath !== join(`${statePath}.contexts`, `${visit}.json`)) return [];
+  const state = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+  if (state.graphId !== 'release-loop' || state.runId !== raw.runId || state.path[visit - 1] !== 'known-issues' ||
+    JSON.stringify((state.input as { acceptedRegressions?: unknown })?.acceptedRegressions ?? []) !== JSON.stringify(context.input.acceptedRegressions ?? [])) return [];
+  return accepted.filter((issue) => {
+    if (!issue.id.startsWith('waive:')) return false;
+    const node = issue.id.slice('waive:'.length);
+    const index = state.path.indexOf(node);
+    const record = state.nodes[index];
+    const waiver = record?.waiver;
+    return index >= 0 && index < visit - 1 && record?.nodeId === node && waiver !== undefined && waiver.reason === issue.note &&
+      // The runner writes a waiver only over a failed executed node (releaseResumeWaiver); its exit may be 0 (outcome fail) or null (timeout).
+      record.ok === true && record.executed === false &&
+      context.outputs[node]?.verdict === 'waived' && context.outputs[node]?.reason === issue.note;
+  });
+}
+
 function command(run: CommandRunner, program: string, args: string[], cwd?: string): string {
   const result = run(program, args, cwd);
   if (result.status !== 0) throw new Error(`${program} ${args[0]} failed: ${result.stderr || result.stdout}`);
@@ -85,13 +118,18 @@ export function runKnownIssues(context: GraphContext = readGraphContext(), run:
   let bullets: string[];
   let fallbackUsed = false;
   const allIssues = [...checklist, ...accepted];
-  const sourceIds = allIssues.map((issue) => issue.id);
-  const prompt = `Write public English release-note bullets for these known issues. Describe only user-visible impact; include a one-line workaround when available. No internal names, test paths, track names, PR numbers, or people. Each bullet must have at most two sentences. Return ONLY a JSON array with exactly one object {"id":"input ID","bullet":"English public sentence"} for each input, using each input ID exactly once. Do not include IDs in bullet text. Input: ${JSON.stringify({ checklist, acceptedRegressions: accepted })}`;
-  let response: ReturnType<CommandRunner>;
-  try {
-    response = run('elanous', ['--test', 'ask', '--json', prompt]);
-  } catch {
-    response = { status: 1, stdout: '', stderr: '' };
+  // The persisted failed-node waiver, not a claimed output or an ID prefix, is the public-note provenance.
+  const waiverIssues = recordedWaivers(context, accepted);
+  const modelIssues = allIssues.filter((issue) => !waiverIssues.includes(issue));
+  const sourceIds = modelIssues.map((issue) => issue.id);
+  const prompt = `Write public English release-note bullets for these known issues. Describe only user-visible impact; include a one-line workaround when available. No internal names, test paths, track names, PR numbers, or people. Each bullet must have at most two sentences. Return ONLY a JSON array with exactly one object {"id":"input ID","bullet":"English public sentence"} for each input, using each input ID exactly once. Do not include IDs in bullet text. Input: ${JSON.stringify({ checklist, acceptedRegressions: accepted.filter((issue) => !waiverIssues.includes(issue)) })}`;
+  let response: ReturnType<CommandRunner> = { status: 0, stdout: JSON.stringify({ reply: '[]' }), stderr: '' };
+  if (modelIssues.length) {
+    try {
+      response = run('elanous', ['--test', 'ask', '--json', prompt]);
+    } catch {
+      response = { status: 1, stdout: '', stderr: '' };
+    }
   }
   if (response.status !== 0) {
     bullets = [FALLBACK];
@@ -105,7 +143,7 @@ export function runKnownIssues(context: GraphContext = readGraphContext(), run:
           return FALLBACK;
         }
         if (resolved.test(safe)) throw new Error(`bullet for ${sourceIds[index]} claims the issue is resolved`);
-        if (!coversIssue(safe, allIssues[index]!, allIssues.filter((_, otherIndex) => otherIndex !== index))) {
+        if (!coversIssue(safe, modelIssues[index]!, modelIssues.filter((_, otherIndex) => otherIndex !== index))) {
           throw new Error(`bullet does not identify input ${sourceIds[index]}`);
         }
         return safe;
@@ -118,6 +156,13 @@ export function runKnownIssues(context: GraphContext = readGraphContext(), run:
       throw new Error(`known issues coverage not verified: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
+  // A waiver's supplied public impact must survive even when the model omits it or is unavailable.
+  for (const issue of waiverIssues) {
+    const bullet = cleanBullet(issue.note ?? '');
+    if (!bullet || resolved.test(bullet)) throw new Error(`unsafe public waiver reason for ${issue.id}`);
+    const publicBullet = /[.!?]$/.test(bullet) ? bullet : `${bullet}.`;
+    if (!bullets.includes(publicBullet)) bullets.push(publicBullet);
+  }
   const original = readFileSync(notes, 'utf8');
   const heading = /^## Known issues\s*$/m;
   const match = heading.exec(original);

package/scripts/release-loop/publish-at.ts

@@ -0,0 +1,14 @@
+// RELEASE-PUBLISH-AT — the one validator for a promised publish time (CLI entry and the publish node share it).
+
+/** `--publish-at` must be an offset-bearing ISO datetime; returns the refusal message, or null when valid. */
+export function publishAtError(value: string): string | null {
+  const refused = '--publish-at requires an offset-bearing ISO datetime on a real calendar date';
+  const m = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
+  if (!m || !Number.isFinite(Date.parse(value))) return refused;
+  const [y, mo, d, h, mi, sec = '0', oh = '0', om = '0'] = m.slice(1) as string[];
+  // Date.parse rolls 02-30 over into March; a promised publish day must be the day that was written.
+  const day = new Date(Date.UTC(Number(y), Number(mo) - 1, Number(d)));
+  if (day.getUTCFullYear() !== Number(y) || day.getUTCMonth() !== Number(mo) - 1 || day.getUTCDate() !== Number(d)) return refused;
+  if (Number(h) > 23 || Number(mi) > 59 || Number(sec) > 59 || Number(oh) > 23 || Number(om) > 59) return refused;
+  return null;
+}

package/scripts/release-loop/publish-node.ts

@@ -6,6 +6,7 @@ import { WARNING_ONLY } from './auto-approve-node.js';
 import { beginLandingMerge, landingFreezeMessage } from '../../src/release-loop/landing-freeze.js';
 import { debug } from '../../src/debug/log.js';
 import { prereleaseKind } from './release-version.js';
+import { publishAtError } from './publish-at.js';
 import { errorResult, finishNode, lastResult, nodeOutput, readGraphContext, runCommand, type CommandRunner } from './node-verdict.js';
 
 export function publicNotes(markdown: string, pages: { pages: Array<{ id: string; slug?: string; source?: string }> }): string {
@@ -43,7 +44,8 @@ export function waitForAssets(run: CommandRunner, repo: string, tag: string, nam
   }
 }
 
-export function runPublish(run: CommandRunner = runCommand, prodFreezeRoot?: string) {
+export function runPublish(run: CommandRunner = runCommand, prodFreezeRoot?: string,
+  clock: { now: () => number; sleep: (ms: number) => void } = { now: Date.now, sleep: Bun.sleepSync }) {
   const context = readGraphContext();
   const version = context.input.version;
   // A measured automatic decision or the existing human approval must authorize publication.
@@ -69,6 +71,17 @@ export function runPublish(run: CommandRunner = runCommand, prodFreezeRoot?: str
   if (doc.status !== 0 || registry.status !== 0) throw new Error(`docs branch missing notes or pages: ${branch}`);
   if (!doc.stdout.startsWith(`# ${version}\n`)) throw new Error('release notes version mismatch');
   const body = labelPrerelease(version, publicNotes(doc.stdout, JSON.parse(registry.stdout)));
+  if (context.input.publishAt !== undefined) {
+    const at = context.input.publishAt;
+    if (typeof at !== 'string' || publishAtError(at) !== null) {
+      throw new Error('invalid publishAt in release run input');
+    }
+    const deadline = Date.parse(at);
+    while (clock.now() < deadline) {
+      const remaining = deadline - clock.now();
+      clock.sleep(Math.min(remaining, 60_000));
+    }
+  }
   const dir = mkdtempSync(join(tmpdir(), 'release-publish-notes-'));
   try {
     const file = join(dir, 'notes.md');
@@ -83,7 +96,9 @@ export function runPublish(run: CommandRunner = runCommand, prodFreezeRoot?: str
       if (context.input.forceFreeze !== true) return { outcome: 'fail' as const, verdict: 'fail' as const, summary: `publish blocked: ${landingFreezeMessage(frozen)}` };
     }
     let published: ReturnType<typeof run>;
-    try { published = run('bun', ['bin/elanous.mjs', 'release', 'publish', '--dir', out, '--notes-file', file, '--yes', '--json']); }
+    // The graph recipe no longer bounds this node (it may wait for publishAt), so the irreversible publication itself
+    // keeps the former 30-minute bound on every run — with or without publishAt.
+    try { published = run('bun', ['bin/elanous.mjs', 'release', 'publish', '--dir', out, '--notes-file', file, '--yes', '--json'], undefined, 1_800_000); }
     finally { landing.end(); }
     if (published.stderr) process.stderr.write(published.stderr);
     const result = lastResult(published);

package/scripts/release-loop/resume-release.ts

@@ -10,6 +10,7 @@ import { lastJsonObject, runGraph, type GraphRunState } from '../../src/graph-ru
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
 import { changedFilesBetween, clearPartialPlan, planPartialRegate, writePartialPlan } from './gate-partial.js';
+import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
 
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
@@ -55,7 +56,7 @@ function safeRunId(runId: string): string {
 }
 
 /** Point the saved version-release output at the current release/<v> tip (fast-forward of the recorded commit only). */
-export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps = {}, from?: string): TipRefresh {
+export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps = {}, from?: string, waiverCommit?: string): TipRefresh {
   const root = deps.root ?? effectiveInstanceRoot();
   const statePath = join(root, 'graph-runs', 'release-loop', `${safeRunId(runId)}.json`);
   const state = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
@@ -81,6 +82,9 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   if (!/^[0-9a-f]{40}$/i.test(advertised)) throw new Error(`${branch} is not on origin — this run was not cut as a release branch`);
   git(['fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
   const to = git(['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
+  if (waiverCommit && (recorded.toLowerCase() !== waiverCommit.toLowerCase() || to.toLowerCase() !== waiverCommit.toLowerCase() || advertised.toLowerCase() !== waiverCommit.toLowerCase())) {
+    throw new Error('release branch moved — re-gate the new tip before waiving a node');
+  }
   if (to !== advertised) throw new Error(`${branch} moved while it was read (${advertised} → ${to})`);
   if (to === recorded) {
     debug.log('release-loop.resume', 'tip-unchanged', { runId, version, commit: to });
@@ -164,14 +168,46 @@ function savedGraphPath(statePath: string): string | undefined {
 }
 
 /** Refresh the branch tip, then restart the failed run at `from` with the saved graph snapshot. */
-export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
   // RELEASE-LEDGER-UNIVERSE: decide the universe once; the run lookup and every resumed node use it.
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
-  const tip = refreshReleaseBranchTip(opts.runId, deps, opts.from);
+  const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
+  let waiverCommit: string | undefined;
+  if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
+  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined
+    ? JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState : undefined;
+  // GATE-HOST-EXECUTOR: checked before the tip refresh writes anything; the runner checks it again under the resume lock.
+  const gateExecutor = original && opts.gateExecutor !== undefined
+    ? releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost }) : undefined;
+  if (gateExecutor) debug.log('release-loop.resume', 'gate-executor', { runId: opts.runId, from: opts.from, executor: gateExecutor.set.gateExecutor, host: gateExecutor.set.gateRemote ?? null, previous: gateExecutor.previous });
+  const waiver = original && (opts.waive !== undefined || opts.reason !== undefined)
+    ? releaseResumeWaiver(original, opts) : undefined;
+  const acceptedRegressions = original && opts.acceptedRegressions !== undefined && !waiver
+    ? releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from) : undefined;
+  // A waived verdict may reuse its original commit. A moved tip still requires a full re-gate.
+  if (waiver) {
+    const saved = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+    const versionRecord = saved.nodes.find((node) => node.nodeId === 'version-release');
+    const output = lastJsonObject(versionRecord?.output);
+    const version = output?.version;
+    const recorded = output?.commit;
+    if (typeof version !== 'string' || typeof recorded !== 'string' || !isReleaseVersion(version) || !/^[0-9a-f]{40}$/i.test(recorded)) throw new Error('release waiver requires a recorded release commit');
+    const git = deps.git ?? gitRunner(deps.repo ?? process.cwd());
+    const branch = `release/${version}`;
+    const advertised = git(['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]).split(/\s+/)[0];
+    if (advertised?.toLowerCase() !== recorded.toLowerCase()) throw new Error('release branch moved — re-gate the new tip before waiving a node');
+    waiverCommit = recorded;
+  }
+  // Check the refreshed tip before refresh writes a new version-release record or backup.
+  const tip = refreshReleaseBranchTip(opts.runId, deps, opts.from, waiverCommit);
   const partial = preparePartial(tip, opts, deps);
   // Resume the graph at the path it was started from (its snapshot is used); only tests inject another path.
   const graphPath = deps.graphPath ?? savedGraphPath(tip.statePath) ?? GRAPH;
-  const state = await (deps.graph ?? runGraph)(graphPath, { resumeRunId: opts.runId, fromNodeId: opts.from, pinChildUniverse: true, deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
+  const state = await (deps.graph ?? runGraph)(graphPath, { resumeRunId: opts.runId, fromNodeId: opts.from, pinChildUniverse: true,
+    ...(waiver ? { releaseWaiver: { ...waiver, requestedRegressions: opts.acceptedRegressions ?? [] } } : {}),
+    ...(acceptedRegressions ? { releaseAcceptedRegressions: { requested: opts.acceptedRegressions!, acceptedRegressions } } : {}),
+    ...(gateExecutor ? { releaseGateExecutor: { executor: gateExecutor.set.gateExecutor, ...(opts.gateHost !== undefined ? { host: opts.gateHost } : {}) } } : {}),
+    deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
   return { tip, partial, state };
 }

package/scripts/release-loop/resume.ts

@@ -0,0 +1,94 @@
+import type { GraphRunState } from '../../src/graph-runner/runner.js';
+import { publicWaiverReason } from './known-issues-node.js';
+import { checkGateExecutorChoice, type GateExecutor } from './gate-executor.js';
+
+export interface AcceptedRegression { id: string; note: string }
+
+/** Merge explicit public issues with the saved release input without changing the ledger shape. */
+export function releaseResumeAcceptedRegressions(state: GraphRunState, additions: AcceptedRegression[], from?: string): AcceptedRegression[] {
+  if (!Array.isArray(additions) || additions.some((issue) => !issue || typeof issue.id !== 'string' || !issue.id.trim() || typeof issue.note !== 'string' || !issue.note.trim())) {
+    throw new Error('acceptedRegressions must be an array of {id, note}');
+  }
+  const input = state.input;
+  if (!input || typeof input !== 'object' || Array.isArray(input) || typeof (input as { version?: unknown }).version !== 'string') throw new Error('release run has no input');
+  const existing = (input as { acceptedRegressions?: unknown }).acceptedRegressions;
+  if (existing !== undefined && (!Array.isArray(existing) || existing.some((issue) => !issue || typeof issue.id !== 'string' || !issue.id.trim() || typeof issue.note !== 'string' || !issue.note.trim()))) {
+    throw new Error('saved acceptedRegressions is invalid');
+  }
+  // A rerun of a formerly waived node supersedes only that node's recorded waiver;
+  // independently supplied accepted issues (including similarly named IDs) are not inferred to be waivers.
+  const prior = (existing ?? []) as AcceptedRegression[];
+  // Every waived record at or after the restart boundary is cut from the ledger, so each one's issue retires too.
+  const start = from === undefined ? -1 : state.path.indexOf(from);
+  const retired = start < 0 ? [] : state.nodes.slice(start)
+    .filter((record) => record.waiver && record.executed === false && record.ok === true)
+    .map((record) => ({ id: `waive:${record.nodeId}`, note: record.waiver!.reason }));
+  const combined = [...prior.filter((issue) => !retired.some((gone) => gone.id === issue.id && gone.note === issue.note)), ...additions];
+  if (new Set(combined.map(({ id }) => id)).size !== combined.length) throw new Error('acceptedRegressions IDs must be unique');
+  return combined;
+}
+
+/** Only the recorded failure at the restart boundary may be waived. `--from` is never a waiver. */
+export function releaseResumeWaiver(
+  state: GraphRunState,
+  opts: { from: string; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[] },
+): { nodeId: string; reason: string; acceptedRegressions: AcceptedRegression[] } | undefined {
+  if ((opts.waive === undefined) !== (opts.reason === undefined)) throw new Error('--waive <node> and --reason <text> must be supplied together');
+  if (opts.waive !== undefined && !opts.waive.trim()) throw new Error('--waive must not be empty');
+  if (opts.waive === undefined) return undefined;
+  const reason = opts.reason?.trim();
+  if (!reason) throw new Error('--reason must not be empty');
+  publicWaiverReason(reason);
+  if (opts.from !== opts.waive) throw new Error('--from must name the waived node; --from alone does not waive a failure');
+  const index = state.path.indexOf(opts.waive);
+  if (index < 0 || state.path.lastIndexOf(opts.waive) !== index || state.nodes[index]?.nodeId !== opts.waive || state.nodes[index]?.ok !== false ||
+    state.nodes[index]?.executed !== true || state.path.at(-2) !== opts.waive || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed') {
+    throw new Error(`--waive ${opts.waive} requires the failed executable node on the saved path`);
+  }
+  // Only user-visible, non-publication checks can become accepted regressions; build, safety and approval gates stay blocking.
+  if (!['mac-smoke', 'tui'].includes(opts.waive)) {
+    throw new Error(`--waive ${opts.waive} cannot waive a safety, side-effect or approval node`);
+  }
+  return { nodeId: opts.waive, reason, acceptedRegressions: releaseResumeAcceptedRegressions(state,
+    [...(opts.acceptedRegressions ?? []), { id: `waive:${opts.waive}`, note: reason }]) };
+}
+
+/** GATE-HOST-EXECUTOR — one explicit executor switch, recorded on the run (`GraphRunState.inputOverrides`). */
+export interface GateExecutorOverride {
+  kind: 'gate-executor';
+  at: string;
+  from: string;
+  set: { gateExecutor: GateExecutor; gateRemote?: string };
+  /** Input keys removed — switching back to pod drops the host an earlier override added (the original had none). */
+  unset?: Array<'gateRemote'>;
+  previous: { gateExecutor: unknown; gateRemote: unknown };
+}
+
+/**
+ * Switch the gate executor of a resumed release run. Not a waiver: the gate node runs again (the restart must be at or
+ * before gate) and produces a normal verdict; only where its sweep runs changes.
+ */
+export function releaseResumeGateExecutor(state: GraphRunState, opts: { from: string; executor: unknown; host?: unknown; at?: string }): GateExecutorOverride {
+  const input = state.input;
+  if (!input || typeof input !== 'object' || Array.isArray(input) || typeof (input as { version?: unknown }).version !== 'string') throw new Error('release run has no input');
+  const saved = input as { gateExecutor?: unknown; gateRemote?: unknown; gatePodPool?: unknown };
+  // Host executor without --gate-host: the run's own gateRemote (release.loop.gateRemote when it started), like `release run`.
+  const choice = checkGateExecutorChoice(opts.executor, opts.executor === 'host' && opts.host === undefined ? saved.gateRemote : opts.host);
+  if (choice.executor === 'pod' && (typeof saved.gatePodPool !== 'string' || !saved.gatePodPool.trim())) {
+    throw new Error('--gate-executor pod requires the saved run input gatePodPool');
+  }
+  const start = state.path.indexOf(opts.from);
+  if (start < 0) throw new Error(`--from ${opts.from} is not a node on the saved path`);
+  const gate = state.path.indexOf('gate');
+  // A restart after gate keeps the recorded verdict — switching its executor there would record a choice nothing used.
+  if (gate >= 0 && start > gate) throw new Error('--gate-executor needs a resume that re-runs gate (--from gate or earlier)');
+  // Back to pod: restore the gateRemote the run started with (an earlier host override replaced it).
+  const firstHost = choice.executor === 'pod' ? state.inputOverrides?.find((item) => item.kind === 'gate-executor' && item.set.gateRemote !== undefined) : undefined;
+  const restored = firstHost ? firstHost.previous.gateRemote : undefined;
+  return {
+    kind: 'gate-executor', at: opts.at ?? new Date().toISOString(), from: opts.from,
+    set: { gateExecutor: choice.executor, ...(choice.host ? { gateRemote: choice.host } : typeof restored === 'string' ? { gateRemote: restored } : {}) },
+    ...(firstHost && typeof restored !== 'string' ? { unset: ['gateRemote' as const] } : {}),
+    previous: { gateExecutor: saved.gateExecutor ?? null, gateRemote: saved.gateRemote ?? null },
+  };
+}

package/scripts/release-loop/shard-plan.ts

@@ -1,6 +1,7 @@
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
+import { readJunitFileSeconds } from './gate-method';
 
 /** Plan weights for a Pod sweep: wall-scaled when the previous cut recorded shard wall times, junit seconds otherwise. */
 export function planDurations(durationSource: string | undefined): { durations: Map<string, number>; wall?: { shards: number; scaledFiles: number }; fallback?: string } {
@@ -66,21 +67,12 @@ export function logPlanWalltime(wall: { shards: number; scaledFiles: number } |
 export function readFileDurations(dir: string): Map<string, number> {
   const durations = new Map<string, number>();
   let names: string[];
-  const entities: Record<string, string> = { '&amp;': '&', '&quot;': '"', '&apos;': "'", '&lt;': '<', '&gt;': '>' };
   try { names = readdirSync(dir).filter((name) => name.endsWith('.junit.xml')).sort(); }
   catch { return durations; }
   for (const name of names) {
     try {
-      const xml = readFileSync(join(dir, name), 'utf8');
-      for (const match of xml.matchAll(/<testsuite\b([^>]*)>/g)) {
-        const attrs = match[1]!;
-        const file = /\bfile="([^"]+)"/.exec(attrs)?.[1];
-        const rawTime = /\btime="([^"]+)"/.exec(attrs)?.[1];
-        if (!file || rawTime === undefined) continue;
-        const seconds = Number(rawTime);
-        if (!Number.isFinite(seconds) || seconds < 0) continue;
-        const path = file.replace(/&(?:amp|quot|apos|lt|gt);/g, (entity) => entities[entity]!);
-        durations.set(path, Math.max(durations.get(path) ?? 0, seconds));
+      for (const [file, seconds] of readJunitFileSeconds(readFileSync(join(dir, name), 'utf8'))) {
+        durations.set(file, Math.max(durations.get(file) ?? 0, seconds));
       }
     } catch { /* One unreadable report must not discard the others. */ }
   }

package/scripts/release-loop/tui-node-checks.ts

@@ -28,6 +28,28 @@ export function tuiVerdict(checks: readonly TuiCheck[]): 'pass' | 'fail' {
   return checks.every((c) => c.pass) ? 'pass' : 'fail';
 }
 
+/** `tui-sim-node.ts --json` prints the raw result (no `outcome`); `node-verdict.ts tui` adds it. Same rule here so a
+ *  prefetched raw result is judged exactly like the wrapped node result: exit 0 with pass|flaky → ok. */
+export function withTuiOutcome(status: number | null, data: Record<string, unknown> | null): Record<string, unknown> | null {
+  if (!data) return null;
+  const outcome = status === 0 && (data.verdict === 'pass' || data.verdict === 'flaky') ? 'ok' : status === 1 ? 'fail' : 'error';
+  return { ...data, outcome };
+}
+
+export function reusableTui(data: unknown, commit: string): Record<string, unknown> | null {
+  if (!data || typeof data !== 'object' || Array.isArray(data)) return null;
+  const value = data as Record<string, unknown>;
+  if (value.outcome !== 'ok' || value.commit !== commit || (value.verdict !== 'pass' && value.verdict !== 'flaky')
+    || (value.verdict === 'pass' ? value.attempts !== 1 : value.attempts !== 2)
+    || !Array.isArray(value.checks) || value.checks.length !== 6) return null;
+  const ids = ['boot', 'prompt', 'status-bar', 'help-opens', 'help-closes', 'no-error-text'];
+  if (value.checks.some((check: unknown, i: number) => !check || typeof check !== 'object'
+    || (check as TuiCheck).id !== ids[i] || (check as TuiCheck).pass !== true
+    || typeof (check as TuiCheck).detail !== 'string')) return null;
+  if (value.regress === null || typeof value.regress !== 'object' || Array.isArray(value.regress)) return null;
+  return value;
+}
+
 export type TuiRegress = {
   pass: number;
   fail: number;