elanous 0.2.23 → 0.2.25

package/scripts/release-loop/gate-partial.ts

@@ -2,9 +2,13 @@
 // changed — not the whole 24-shard sweep again (0.2.18: two timeout fixes on top of an 84-minute gate meant another full
 // gate). The plan is opt-in (`release resume --from gate --partial`) and fail-closed: any non-test source change, a prior
 // gate record for another commit, or a missing record means «full gate», never a guess.
+// GATE-REUSE-BY-DIFF (0.2.25): a code change no longer forces the full sweep — with the tip's import closure
+// (gate-closure.ts) the plan adds every test that can reach a changed file, and every test whose closure is opaque.
+// `release resume --from gate` now plans this by default when the tip moved (`--no-partial` = full gate).
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
+import { CODE_FILE, type ClosureVerdict } from './gate-closure';
 
 export interface PartialPlan {
   version: string;
@@ -12,7 +16,7 @@ export interface PartialPlan {
   priorCommit: string;
   /** The commit this plan is for — a gate on any other commit ignores it. */
   forCommit: string;
-  /** Test files re-run: changed test files ⊕ files of the prior failures. */
+  /** Test files re-run: changed test files ⊕ files of the prior failures ⊕ tests reaching a changed code file. */
   files: string[];
   priorFailures: string[];
   priorErrors: string[];
@@ -37,19 +41,43 @@ export function testFileOfId(id: string): string {
 
 /** Decide whether a partial re-gate is safe for `changedFiles` (prior → for). Never guesses: any doubt is a full gate. */
 export function planPartialRegate(input: { version: string; priorCommit: string; forCommit: string; changedFiles: readonly string[];
-  priorFailures: readonly string[]; priorErrors: readonly string[] }):
-  { ok: true; plan: PartialPlan } | { ok: false; reason: string } {
+  priorFailures: readonly string[]; priorErrors: readonly string[];
+  /** GATE-REUSE-BY-DIFF: the tests reaching these changed code files (seeds include changed tests). Without it any
+   *  non-test change is a full gate. */
+  closure?: (changedCode: string[]) => ClosureVerdict;
+  /** Tracked at the tip — a deleted changed test is not re-run (nothing to run); a deleted prior-failure file is a full
+   *  gate (its failure can be neither re-measured nor carried). Without it every changed test is planned. */
+  existsAtTip?: (file: string) => boolean }):
+  { ok: true; plan: PartialPlan; closure?: { reached: number; opaque: number } } | { ok: false; reason: string } {
   if (!/^[0-9a-f]{40}$/i.test(input.priorCommit) || !/^[0-9a-f]{40}$/i.test(input.forCommit)) return { ok: false, reason: 'commit is not a full sha' };
   if (input.priorCommit === input.forCommit) return { ok: false, reason: 'no new commit since the prior gate' };
   const source = input.changedFiles.filter((file) => !TEST_FILE.test(file) && !isInert(file));
-  if (source.length) return { ok: false, reason: `non-test change → full gate: ${source.slice(0, 5).join(', ')}${source.length > 5 ? ` (+${source.length - 5})` : ''}` };
+  const list = (files: string[]) => `${files.slice(0, 5).join(', ')}${files.length > 5 ? ` (+${files.length - 5})` : ''}`;
+  // Only code is followed through the closure: a changed fixture, JSON, lockfile, config or script is a full gate.
+  const notCode = source.filter((file) => !CODE_FILE.test(file));
+  if (source.length && (!input.closure || notCode.length)) return { ok: false, reason: `non-test change → full gate: ${list(notCode.length ? notCode : source)}` };
+  let reaching: string[] = [];
+  let closure: { reached: number; opaque: number } | undefined;
+  if (source.length) {
+    let verdict: ClosureVerdict;
+    try { verdict = input.closure!(input.changedFiles.filter((file) => CODE_FILE.test(file))); }
+    catch (error) { return { ok: false, reason: `import closure unreadable → full gate: ${String(error instanceof Error ? error.message : error).slice(0, 200)}` }; }
+    if (!verdict.ok) return { ok: false, reason: verdict.reason };
+    const unsafe = verdict.tests.filter((file) => !TEST_FILE.test(file) || file.split('/').includes('..'));
+    if (unsafe.length) return { ok: false, reason: `closure selected a test path the plan cannot carry → full gate: ${list(unsafe)}` };
+    reaching = verdict.tests;
+    closure = { reached: verdict.reached, opaque: verdict.opaque };
+  }
   let failureFiles: string[];
   try { failureFiles = [...input.priorFailures, ...input.priorErrors].map(testFileOfId); }
   catch (error) { return { ok: false, reason: String(error instanceof Error ? error.message : error) }; }
-  const files = [...new Set([...input.changedFiles.filter((file) => TEST_FILE.test(file)), ...failureFiles])].sort();
+  const exists = input.existsAtTip ?? (() => true);
+  const gone = failureFiles.filter((file) => !exists(file));
+  if (gone.length) return { ok: false, reason: `prior failure file deleted at the tip → full gate: ${list(gone)}` };
+  const files = [...new Set([...input.changedFiles.filter((file) => TEST_FILE.test(file) && exists(file)), ...failureFiles, ...reaching])].sort();
   if (!files.length) return { ok: false, reason: 'nothing to re-run' };
   return { ok: true, plan: { version: input.version, priorCommit: input.priorCommit, forCommit: input.forCommit, files,
-    priorFailures: [...input.priorFailures], priorErrors: [...input.priorErrors] } };
+    priorFailures: [...input.priorFailures], priorErrors: [...input.priorErrors] }, ...(closure ? { closure } : {}) };
 }
 
 export function writePartialPlan(root: string, plan: PartialPlan): string {

package/scripts/release-loop/ops-upgrade-node.ts

@@ -9,7 +9,7 @@ import { prereleaseKind } from './release-version.js';
 interface HostResult { host: string; ok: boolean; before: string; after: string; error?: string; skipped?: string; hooks?: string; restart?: 'no-service' }
 /** Where the internal feed is packed from: a checkout of the release tag, never the run's working tree. */
 export interface FeedSource { checkout: string; commit: string; deps: 'linked' | 'installed'; cleanup: () => void }
-interface OpsUpgradeDeps { exists?: (path: string) => boolean; installSource?: () => string | null; feedSource?: (version: string) => FeedSource }
+interface OpsUpgradeDeps { exists?: (path: string) => boolean; installSource?: () => string | null; installCommit?: () => string | null; feedSource?: (version: string) => FeedSource }
 
 /** Detached worktree at refs/tags/v<version> with the PWA built — the feed ships what was released (10-04 0.2.11:
  *  packing process.cwd() shipped main HEAD ee689ad2 as «0.2.11» to node-b·cloud-vm instead of the cut 31129c91). */
@@ -52,16 +52,24 @@ export function tagFeedSource(run: CommandRunner, repo: string = process.cwd()):
   };
 }
 
-function localInstallSource(): string | null {
+function installMetadata(text: string): { source: string | null; commit: string | null } {
   try {
-    const data: unknown = JSON.parse(readFileSync(join(homedir(), '.local/share/elanous/install.json'), 'utf8'));
-    return data && typeof data === 'object' && 'source' in data && typeof data.source === 'string' ? data.source : null;
-  } catch { return null; }
+    const data: unknown = JSON.parse(text);
+    if (!data || typeof data !== 'object') return { source: null, commit: null };
+    return {
+      source: 'source' in data && typeof data.source === 'string' ? data.source : null,
+      commit: 'commit' in data && typeof data.commit === 'string' ? data.commit : null,
+    };
+  } catch { return { source: null, commit: null }; }
+}
+
+function localInstallMetadata(): { source: string | null; commit: string | null } {
+  try { return installMetadata(readFileSync(join(homedir(), '.local/share/elanous/install.json'), 'utf8')); }
+  catch { return { source: null, commit: null }; }
 }
 
-function installedMatches(installed: unknown, version: string, checkout: boolean): boolean {
-  return installed === version || checkout && typeof installed === 'string'
-    && installed.startsWith(`${version}-`) && /^[0-9a-f]{12}$/.test(installed.slice(version.length + 1));
+function installedMatches(installed: unknown, version: string): boolean {
+  return installed === version;
 }
 
 function missingService(data: Record<string, unknown> | undefined): boolean {
@@ -116,17 +124,21 @@ export function runOpsUpgrade(run: CommandRunner = runCommand, deps: OpsUpgradeD
   }
   const results: HostResult[] = [];
   for (const host of hosts as string[]) {
-    const source = host === 'local' ? (deps.installSource ?? localInstallSource)() : null;
-    const checkout = host === 'local' && source !== null && isAbsolute(source);
-    const path = checkout ? 'checkout' as const : 'release' as const;
+    // Injected install metadata replaces the machine's install.json entirely — a test that injects only the source
+    //   must not inherit this machine's real commit (that turned update cases into kept-ahead skips).
+    const injected = deps.installSource !== undefined || deps.installCommit !== undefined;
+    let metadata: { source: string | null; commit: string | null } = host !== 'local'
+      ? { source: null, commit: null }
+      : injected
+        ? { source: deps.installSource?.() ?? null, commit: deps.installCommit?.() ?? null }
+        : localInstallMetadata();
+    let source = metadata.source;
+    let railSource = false;
+    let path: 'checkout' | 'release' = 'release';
     const record = (result: HostResult) => {
       results.push(result);
       debug.log('release-loop.ops-upgrade', 'host', { host, path, restart: result.restart ?? (context.input.opsRestart === true ? result.ok ? 'ok' : 'failed' : 'skipped'), ok: result.ok });
     };
-    if (host !== 'local' && feedError) {
-      record({ host, ok: false, before: '', after: '', skipped: '내부 피드 발행 실패', error: feedError });
-      continue;
-    }
     const command = (args: string[]): CommandResult => host === 'local'
       ? run('elanous', args)
       // The installer's own bin dir comes first — a --no-modify-path install (the bot VM) has elanous only there.
@@ -134,35 +146,41 @@ export function runOpsUpgrade(run: CommandRunner = runCommand, deps: OpsUpgradeD
     let before = '';
     let after = '';
     try {
+      if (host !== 'local') {
+        const installed = run('ssh', [host, `cat "$HOME/.local/share/elanous/install.json" 2>/dev/null || true`]);
+        if (installed.status === 0) metadata = installMetadata(installed.stdout);
+      }
+      source = metadata.source;
+      if (source !== null && isAbsolute(source)) {
+        const repository = host === 'local'
+          ? run('git', ['rev-parse', '--is-inside-work-tree'], source)
+          : run('ssh', [host, `git -C ${quote(source)} rev-parse --is-inside-work-tree`]);
+        railSource = repository.status === 0 && firstLine(repository.stdout) === 'true';
+      }
+      path = railSource ? 'checkout' : 'release';
       const previous = command(['--version']);
       if (previous.status === 0) before = firstLine(previous.stdout);
-      if (checkout) {
-        const git = (args: string[]) => run('git', args, source!);
-        const dirty = git(['status', '--porcelain', '--untracked-files=all']);
-        if (dirty.status !== 0 || dirty.stdout.trim()) {
-          record({ host, ok: false, before, after, error: dirty.status === 0 ? '체크아웃 변경 있음' : `체크아웃 상태 확인 실패: ${reason(dirty)}` });
-          continue;
-        }
-        const fetched = git(['fetch', '--tags']);
-        if (fetched.status !== 0) {
-          record({ host, ok: false, before, after, error: `태그 가져오기 실패: ${reason(fetched)}` });
-          continue;
-        }
-        const tag = git(['rev-parse', '--verify', `refs/tags/v${version}^{commit}`]);
-        if (tag.status !== 0 || !tag.stdout.trim()) {
-          record({ host, ok: false, before, after, error: `태그 없음: v${version}` });
-          continue;
-        }
-        const moved = git(['checkout', '--detach', `v${version}`]);
-        if (moved.status !== 0) {
-          record({ host, ok: false, before, after, error: `체크아웃 전환 실패: ${reason(moved)}` });
+      if (railSource) {
+        record({ host, ok: true, before, after: before, skipped: 'rail-source' });
+        continue;
+      }
+      const installedCommit = metadata.commit;
+      if (installedCommit && /^[0-9a-f]{40,64}$/.test(installedCommit)) {
+        const ahead = run('git', ['merge-base', '--is-ancestor', `refs/tags/v${version}`, installedCommit]);
+        // Only exit 1 proves non-ancestry; missing local objects must not permit a potentially destructive downgrade.
+        if (ahead.status !== 1) {
+          record({ host, ok: true, before, after: before, skipped: 'kept-ahead' });
           continue;
         }
       }
-      const updated = command(['update', ...(checkout || host !== 'local' && feedPath !== undefined ? [] : ['--version', version]), '--json', ...(context.input.opsRestart === true ? ['--restart'] : [])]);
+      if (host !== 'local' && feedError) {
+        record({ host, ok: false, before, after: '', skipped: '내부 피드 발행 실패', error: feedError });
+        continue;
+      }
+      const updated = command(['update', ...(host !== 'local' && feedPath !== undefined ? [] : ['--version', version]), '--json', ...(context.input.opsRestart === true ? ['--restart'] : [])]);
       const updateResult = lastResult(updated);
       const noService = host !== 'local' && context.input.opsRestart === true && updateResult?.exitCode === 1 && missingService(updateResult);
-      if ((!noService && (updated.status !== 0 || updateResult?.exitCode !== 0)) || !installedMatches(updateResult?.installedVersion, version, checkout)) {
+      if ((!noService && (updated.status !== 0 || updateResult?.exitCode !== 0)) || !installedMatches(updateResult?.installedVersion, version)) {
         const error = (updated.status === 0 && updateResult?.exitCode === 0 || noService)
           ? `설치판 불일치 (기대 ${version}, 실제 ${String(updateResult?.installedVersion)})` : reason(updated);
         record({ host, ok: false, before, after, error });
@@ -174,7 +192,7 @@ export function runOpsUpgrade(run: CommandRunner = runCommand, deps: OpsUpgradeD
         continue;
       }
       after = firstLine(current.stdout);
-      if (!installedMatches(after.split(/\s+/)[0], version, checkout)) {
+      if (!installedMatches(after.split(/\s+/)[0], version)) {
         record({ host, ok: false, before, after, error: `올렸는데 판이 그대로 (기대 ${version}, 실제 ${after || '없음'})` });
         continue;
       }
@@ -198,14 +216,17 @@ export function runOpsUpgrade(run: CommandRunner = runCommand, deps: OpsUpgradeD
     feed: feedError ? 'failed' as const : feedPath === undefined ? 'skipped-no-path' as const : 'published' as const, hosts: results };
 }
 
-if (import.meta.main) {
+function main(): void {
   let version = '';
   try {
     version = readGraphContext().input.version;
     // RELEASE-REHEARSAL-RC: a prerelease never lands docs on main or upgrades the operating hosts.
-    process.exitCode = finishNode('ops-upgrade', version, prereleaseKind(version) !== null
-      ? { outcome: 'ok', verdict: 'pass', summary: `ops-upgrade skipped — ${version} is a prerelease`, skipped: 'prerelease' }
-      : runOpsUpgrade());
+    const result = prereleaseKind(version) !== null
+      ? { outcome: 'ok' as const, verdict: 'pass' as const, summary: `ops-upgrade skipped — ${version} is a prerelease`, skipped: 'prerelease' }
+      : runOpsUpgrade(runCommand);
+    process.exitCode = finishNode('ops-upgrade', version, result);
   }
   catch (error) { process.exitCode = finishNode('ops-upgrade', version, errorResult(error)); }
 }
+
+if (import.meta.main) main();

package/scripts/release-loop/publish-node.ts

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { WARNING_ONLY } from './auto-approve-node.js';
 import { beginLandingMerge, landingFreezeMessage } from '../../src/release-loop/landing-freeze.js';
 import { debug } from '../../src/debug/log.js';
+import { registerStandaloneLogSink } from '../../src/domains/standalone-log-sink.js';
 import { prereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
 import { errorResult, finishNode, lastResult, nodeOutput, readGraphContext, runCommand, type CommandRunner } from './node-verdict.js';
@@ -115,6 +116,11 @@ export function runPublish(run: CommandRunner = runCommand, prodFreezeRoot?: str
 }
 
 if (import.meta.main) {
+  // GATE-OBS2-2 — the release graph spawns this node as its own process, which inherits no daemon sink. Without this the
+  // `release-loop.publish / result` event (the one that says whether the irreversible publication actually happened) stayed
+  // in the file trail and `elanous logs` read 0 rows. Same pattern as gate-node.ts and auto-approve-node.ts (GATE-OBS2-1).
+  // Observability must never stop the publication node — a failed sink registration is skipped (fail-soft).
+  try { await registerStandaloneLogSink('release-loop'); } catch { /* fail-soft: the verdict still goes to stdout */ }
   let version = '';
   try { version = readGraphContext().input.version; process.exitCode = finishNode('publish', version, runPublish()); }
   catch (error) { process.exitCode = finishNode('publish', version, errorResult(error)); }

package/scripts/release-loop/resume-release.ts

@@ -10,7 +10,8 @@ import { lastJsonObject, runGraph, type GraphRunState } from '../../src/graph-ru
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
 import { changedFilesBetween, clearPartialPlan, planPartialRegate, writePartialPlan } from './gate-partial.js';
-import { releaseResumeAcceptedRegressions, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { gitClosureTree, testsReachingChanged, type ClosureTree } from './gate-closure.js';
+import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
 
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
@@ -29,8 +30,15 @@ export interface ResumeReleaseDeps {
   now?: () => Date;
   /** Machine release ledger (gate-failures.json of the prior gate) — default releaseLedgerRoot(). */
   ledgerRoot?: string;
+  /** GATE-REUSE-BY-DIFF: the tip tree for the import closure — default read from git objects of the tip commit. */
+  closureTree?: (commit: string) => ClosureTree;
 }
 
+/** CLI entry files: a production file that only names one (help text, a goal's command line) does not run it. */
+const CLI_ENTRIES = ['bin/elanous.mjs', 'src/index.ts'] as const;
+/** The gate's own test-file set (gate-node sweep: `git ls-files '*.test.*'` filtered by this). */
+const GATE_TEST = /\.test\.(?:tsx?|jsx?|mts|cts)$/;
+
 export interface TipRefresh { version: string; branch: string; from: string; to: string; changed: boolean; statePath: string; backup?: string }
 
 function gitRunner(repo: string) {
@@ -114,18 +122,25 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   return { version, branch, from: recorded, to, changed: true, statePath, backup };
 }
 
-/** GATE-PARTIAL outcome of a resume — applied (plan written) or the reason it fell back to a full gate. */
-export type PartialOutcome = { requested: false } | { requested: true; applied: true; files: number; priorCommit: string } | { requested: true; applied: false; reason: string };
+/** GATE-PARTIAL outcome of a resume — applied (plan written) or the reason it fell back to a full gate. `auto` marks the
+ *  default plan of `--from gate` (GATE-REUSE-BY-DIFF); `closure` is set when code changes were followed. */
+export type PartialOutcome = { requested: false }
+  | { requested: true; applied: true; files: number; priorCommit: string; auto?: true; closure?: { reached: number; opaque: number } }
+  | { requested: true; applied: false; reason: string; auto?: true };
 
-/** Build (or clear) the partial re-gate plan for the new tip. Fail-closed: any doubt leaves a full gate. */
+/** Build (or clear) the partial re-gate plan for the new tip. Fail-closed: any doubt leaves a full gate.
+ *  GATE-REUSE-BY-DIFF: `--from gate` on a moved tip plans by default (`partial: undefined`); `partial: false` opts out. */
 function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean }, deps: ResumeReleaseDeps): PartialOutcome {
   const root = deps.root ?? effectiveInstanceRoot();
-  // Any resume starts from no plan: one without --partial (from whatever node) never inherits an older plan.
+  // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
   clearPartialPlan(root, tip.version);
-  if (!opts.partial) return { requested: false };
+  const auto = opts.partial === undefined;
+  // The default applies only where it can help: a gate re-run on a tip that moved. An unchanged tip re-uses its own
+  // shard results by commit already.
+  if (opts.partial === false || (auto && (opts.from !== 'gate' || !tip.changed))) return { requested: false };
   const fallback = (reason: string): PartialOutcome => {
-    debug.log('release-loop.resume', 'partial-fallback', { version: tip.version, reason });
-    return { requested: true, applied: false, reason };
+    debug.log('release-loop.resume', 'partial-fallback', { version: tip.version, reason, auto });
+    return { requested: true, applied: false, reason, ...(auto ? { auto: true as const } : {}) };
   };
   if (opts.from !== 'gate') return fallback('--partial only applies to --from gate');
   if (!tip.changed) return fallback('release branch tip unchanged — nothing new to re-check');
@@ -151,12 +166,23 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     // The tip is already refreshed — a failed diff must not strand the resume: run the full gate and say why.
     return fallback(`changed files unreadable: ${String(error instanceof Error ? error.message : error).slice(0, 200)}`);
   }
+  // The tip tree (git objects of tip.to, never the working tree): existence of planned tests ⊕ the import closure.
+  let tree: ClosureTree;
+  try { tree = (deps.closureTree ?? ((commit: string) => gitClosureTree(deps.repo ?? process.cwd(), commit)))(tip.to); }
+  catch (error) { return fallback(`tip tree unreadable: ${String(error instanceof Error ? error.message : error).slice(0, 200)}`); }
+  const tracked = new Set(tree.files);
+  const tests = tree.files.filter((file) => GATE_TEST.test(file));
   const planned = planPartialRegate({ version: tip.version, priorCommit: tip.from, forCommit: tip.to, changedFiles: changed,
-    priorFailures: prior.failures as string[], priorErrors: (prior.errors ?? []) as string[] });
+    priorFailures: prior.failures as string[], priorErrors: (prior.errors ?? []) as string[],
+    existsAtTip: (file) => tracked.has(file),
+    closure: (changedCode) => testsReachingChanged(tree, changedCode, tests, { cliEntries: CLI_ENTRIES }) });
   if (!planned.ok) return fallback(planned.reason);
+  if (planned.plan.files.length >= tests.length) return fallback(`every test is re-run (${tests.length}) — full gate`);
   const path = writePartialPlan(root, planned.plan);
-  debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length, path });
-  return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.from };
+  debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
+    tests: tests.length, auto, path, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
+  return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.from,
+    ...(auto ? { auto: true as const } : {}), ...(planned.closure ? { closure: planned.closure } : {}) };
 }
 
 /** The graph file the run started from — a snapshot run refuses any other path (the installed CLI's own copy differs). */
@@ -168,16 +194,22 @@ function savedGraphPath(statePath: string): string | undefined {
 }
 
 /** Refresh the branch tip, then restart the failed run at `from` with the saved graph snapshot. */
-export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[] }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
   // RELEASE-LEDGER-UNIVERSE: decide the universe once; the run lookup and every resumed node use it.
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
   const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
   let waiverCommit: string | undefined;
-  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined
+  if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
+  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined
     ? JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState : undefined;
+  // GATE-HOST-EXECUTOR: checked before the tip refresh writes anything; the runner checks it again under the resume lock.
+  const gateExecutor = original && opts.gateExecutor !== undefined
+    ? releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost }) : undefined;
+  if (gateExecutor) debug.log('release-loop.resume', 'gate-executor', { runId: opts.runId, from: opts.from, executor: gateExecutor.set.gateExecutor, host: gateExecutor.set.gateRemote ?? null, previous: gateExecutor.previous });
   const waiver = original && (opts.waive !== undefined || opts.reason !== undefined)
     ? releaseResumeWaiver(original, opts) : undefined;
+  if (waiver) debug.log('release-loop.resume', 'waiver', { runId: opts.runId, node: waiver.nodeId, reason: waiver.reason, unmeasured: waiver.unmeasured ?? null });
   const acceptedRegressions = original && opts.acceptedRegressions !== undefined && !waiver
     ? releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from) : undefined;
   // A waived verdict may reuse its original commit. A moved tip still requires a full re-gate.
@@ -202,6 +234,7 @@ export async function resumeReleaseRun(opts: { runId: string; from: string; part
   const state = await (deps.graph ?? runGraph)(graphPath, { resumeRunId: opts.runId, fromNodeId: opts.from, pinChildUniverse: true,
     ...(waiver ? { releaseWaiver: { ...waiver, requestedRegressions: opts.acceptedRegressions ?? [] } } : {}),
     ...(acceptedRegressions ? { releaseAcceptedRegressions: { requested: opts.acceptedRegressions!, acceptedRegressions } } : {}),
+    ...(gateExecutor ? { releaseGateExecutor: { executor: gateExecutor.set.gateExecutor, ...(opts.gateHost !== undefined ? { host: opts.gateHost } : {}) } } : {}),
     deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
   return { tip, partial, state };
 }

package/scripts/release-loop/resume.ts

@@ -1,5 +1,6 @@
-import type { GraphRunState } from '../../src/graph-runner/runner.js';
+import { lastJsonObject, STOPPED_NODE_ERROR, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { publicWaiverReason } from './known-issues-node.js';
+import { checkGateExecutorChoice, type GateExecutor } from './gate-executor.js';
 
 export interface AcceptedRegression { id: string; note: string }
 
@@ -27,11 +28,66 @@ export function releaseResumeAcceptedRegressions(state: GraphRunState, additions
   return combined;
 }
 
+const SWEEP_INCOMPLETE = /^(?:pod sweep incomplete|sweep incomplete|[\w-]+ shard incomplete)\b/;
+
+/**
+ * RELEASE-WAIVE-UNMEASURED — why the saved gate record at `index` carries no verdict, or undefined when it does (or may).
+ * Fail-closed: only three shapes count, each read from what the runner and gate-node actually write:
+ *  ① stopped — `graph runs stop` wrote {ok:false, executed:false, exit:null, error:STOPPED_NODE_ERROR} as the run's last record;
+ *  ② no verdict — the gate process ended with exit null (signal, idle timeout, or a spawn that failed) and printed no result line at
+ *     all (no output line is a JSON object with an `outcome`), so the run went gate → failed. A verdict followed by more
+ *     log lines and then a kill is still a verdict: refused;
+ *  ③ sweep incomplete — gate-node printed outcome `error` (no verdict: the baseline comparison never ran, so `introduced`
+ *     is still the empty initial list) and the error is an incomplete sweep (stalled shards / no tests ran). The finished
+ *     shards' counts go into the detail. Any other error (cleanup, baseline persistence, …) may follow a verdict: refused.
+ * An `outcome: fail` (introduced > 0), an introduced list that is not empty, or an already-waived record is never unmeasured.
+ */
+/** Any output line that is a JSON object naming an `outcome` — a verdict was printed, whatever came after it. */
+function printedVerdict(output: unknown): boolean {
+  if (typeof output !== 'string') return false;
+  return output.split('\n').some((line) => {
+    const text = line.trim();
+    if (!text.startsWith('{')) return false;
+    try { const value = JSON.parse(text) as unknown; return !!value && typeof value === 'object' && 'outcome' in value; } catch { return false; }
+  });
+}
+
+export function gateUnmeasuredDetail(state: GraphRunState, index: number): string | undefined {
+  const record = state.nodes[index];
+  if (!record || record.nodeId !== 'gate' || state.path[index] !== 'gate' || record.ok !== false || record.waiver !== undefined) return undefined;
+  if (state.nodes.some((saved) => saved.nodeId === 'gate' && saved !== record)) return undefined;
+  const last = index === state.path.length - 1 && index === state.nodes.length - 1;
+  if (last && record.executed === false && record.exit === null && record.error === STOPPED_NODE_ERROR && record.output === undefined) {
+    return `stopped: ${STOPPED_NODE_ERROR}${typeof record.seconds === 'number' ? ` after ${record.seconds}s` : ''}`;
+  }
+  const failedAfter = index === state.path.length - 2 && state.path.at(-1) === 'failed' && state.nodes.at(-1)?.nodeId === 'failed'
+    && state.nodes.length === state.path.length;
+  if (!failedAfter || record.executed !== true) return undefined;
+  const result = lastJsonObject(record.output);
+  if (result === undefined) {
+    if (record.exit !== null || printedVerdict(record.output)) return undefined;
+    return `no-verdict: gate process ended with exit null and no result line${record.error ? ` — ${record.error.split('\n')[0]!.slice(0, 120)}` : ''}`;
+  }
+  if (result.outcome !== 'error' || !Array.isArray(result.introduced) || result.introduced.length !== 0) return undefined;
+  const error = typeof result.error === 'string' ? result.error : '';
+  if (!SWEEP_INCOMPLETE.test(error)) return undefined;
+  // The detail keeps what WAS measured: each stalled shard's reason and the finished shards' counts (failures there are
+  // not yet split into introduced vs pre-existing — the baseline comparison never ran).
+  const stalled = Array.isArray(result.stalledShards) ? result.stalledShards as Array<{ reason?: unknown }> : [];
+  const reasons = new Map<string, number>();
+  for (const shard of stalled) reasons.set(String(shard?.reason ?? 'unknown'), (reasons.get(String(shard?.reason ?? 'unknown')) ?? 0) + 1);
+  const summary = result.partialSummary as { pass?: unknown; fail?: unknown; errors?: unknown; ran?: unknown } | undefined;
+  const measured = summary && typeof summary === 'object'
+    ? ` · finished shards measured pass ${String(summary.pass)} fail ${String(summary.fail)} errors ${String(summary.errors)} ran ${String(summary.ran)}` : '';
+  return `sweep incomplete: ${error.split('\n')[0]!.slice(0, 200)}`
+    + (stalled.length ? ` · stalled shards ${stalled.length} (${[...reasons].map(([reason, count]) => `${reason}×${count}`).join(', ')})` : '') + measured;
+}
+
 /** Only the recorded failure at the restart boundary may be waived. `--from` is never a waiver. */
 export function releaseResumeWaiver(
   state: GraphRunState,
   opts: { from: string; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[] },
-): { nodeId: string; reason: string; acceptedRegressions: AcceptedRegression[] } | undefined {
+): { nodeId: string; reason: string; acceptedRegressions: AcceptedRegression[]; unmeasured?: string } | undefined {
   if ((opts.waive === undefined) !== (opts.reason === undefined)) throw new Error('--waive <node> and --reason <text> must be supplied together');
   if (opts.waive !== undefined && !opts.waive.trim()) throw new Error('--waive must not be empty');
   if (opts.waive === undefined) return undefined;
@@ -40,14 +96,64 @@ export function releaseResumeWaiver(
   publicWaiverReason(reason);
   if (opts.from !== opts.waive) throw new Error('--from must name the waived node; --from alone does not waive a failure');
   const index = state.path.indexOf(opts.waive);
-  if (index < 0 || state.path.lastIndexOf(opts.waive) !== index || state.nodes[index]?.nodeId !== opts.waive || state.nodes[index]?.ok !== false ||
+  const unique = index >= 0 && state.path.lastIndexOf(opts.waive) === index;
+  // RELEASE-WAIVE-UNMEASURED (OP 10-12): a gate cut before any verdict is the only gate that may be waived — a measured gate
+  // failure or an already-waived gate stays refused (fail-closed below), and the ledger records why it was unmeasured.
+  const unmeasured = opts.waive === 'gate' && unique ? gateUnmeasuredDetail(state, index) : undefined;
+  if (unmeasured !== undefined) {
+    return { nodeId: opts.waive, reason, unmeasured, acceptedRegressions: releaseResumeAcceptedRegressions(state,
+      [...(opts.acceptedRegressions ?? []), { id: `waive:${opts.waive}`, note: reason }]) };
+  }
+  if (!unique || state.path.lastIndexOf(opts.waive) !== index || state.nodes[index]?.nodeId !== opts.waive || state.nodes[index]?.ok !== false ||
     state.nodes[index]?.executed !== true || state.path.at(-2) !== opts.waive || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed') {
     throw new Error(`--waive ${opts.waive} requires the failed executable node on the saved path`);
   }
   // Only user-visible, non-publication checks can become accepted regressions; build, safety and approval gates stay blocking.
+  // A measured gate failure (outcome fail / introduced > 0, or any error that is not an incomplete sweep) lands here too.
   if (!['mac-smoke', 'tui'].includes(opts.waive)) {
-    throw new Error(`--waive ${opts.waive} cannot waive a safety, side-effect or approval node`);
+    throw new Error(`--waive ${opts.waive} cannot waive a safety, side-effect or approval node`
+      + (opts.waive === 'gate' ? ' (only an unmeasured gate — stopped, killed or sweep incomplete — may be waived)' : ''));
   }
   return { nodeId: opts.waive, reason, acceptedRegressions: releaseResumeAcceptedRegressions(state,
     [...(opts.acceptedRegressions ?? []), { id: `waive:${opts.waive}`, note: reason }]) };
 }
+
+/** GATE-HOST-EXECUTOR — one explicit executor switch, recorded on the run (`GraphRunState.inputOverrides`). */
+export interface GateExecutorOverride {
+  kind: 'gate-executor';
+  at: string;
+  from: string;
+  set: { gateExecutor: GateExecutor; gateRemote?: string };
+  /** Input keys removed — switching back to pod drops the host an earlier override added (the original had none). */
+  unset?: Array<'gateRemote'>;
+  previous: { gateExecutor: unknown; gateRemote: unknown };
+}
+
+/**
+ * Switch the gate executor of a resumed release run. Not a waiver: the gate node runs again (the restart must be at or
+ * before gate) and produces a normal verdict; only where its sweep runs changes.
+ */
+export function releaseResumeGateExecutor(state: GraphRunState, opts: { from: string; executor: unknown; host?: unknown; at?: string }): GateExecutorOverride {
+  const input = state.input;
+  if (!input || typeof input !== 'object' || Array.isArray(input) || typeof (input as { version?: unknown }).version !== 'string') throw new Error('release run has no input');
+  const saved = input as { gateExecutor?: unknown; gateRemote?: unknown; gatePodPool?: unknown };
+  // Host executor without --gate-host: the run's own gateRemote (release.loop.gateRemote when it started), like `release run`.
+  const choice = checkGateExecutorChoice(opts.executor, opts.executor === 'host' && opts.host === undefined ? saved.gateRemote : opts.host);
+  if (choice.executor === 'pod' && (typeof saved.gatePodPool !== 'string' || !saved.gatePodPool.trim())) {
+    throw new Error('--gate-executor pod requires the saved run input gatePodPool');
+  }
+  const start = state.path.indexOf(opts.from);
+  if (start < 0) throw new Error(`--from ${opts.from} is not a node on the saved path`);
+  const gate = state.path.indexOf('gate');
+  // A restart after gate keeps the recorded verdict — switching its executor there would record a choice nothing used.
+  if (gate >= 0 && start > gate) throw new Error('--gate-executor needs a resume that re-runs gate (--from gate or earlier)');
+  // Back to pod: restore the gateRemote the run started with (an earlier host override replaced it).
+  const firstHost = choice.executor === 'pod' ? state.inputOverrides?.find((item) => item.kind === 'gate-executor' && item.set.gateRemote !== undefined) : undefined;
+  const restored = firstHost ? firstHost.previous.gateRemote : undefined;
+  return {
+    kind: 'gate-executor', at: opts.at ?? new Date().toISOString(), from: opts.from,
+    set: { gateExecutor: choice.executor, ...(choice.host ? { gateRemote: choice.host } : typeof restored === 'string' ? { gateRemote: restored } : {}) },
+    ...(firstHost && typeof restored !== 'string' ? { unset: ['gateRemote' as const] } : {}),
+    previous: { gateExecutor: saved.gateExecutor ?? null, gateRemote: saved.gateRemote ?? null },
+  };
+}

package/scripts/release-loop/unattended-release.ts

@@ -12,6 +12,7 @@ import { runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { baseVersion, isStableVersion, nextPrereleaseVersion, type PrereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
+import { checkGateExecutorChoice, type GateExecutor } from './gate-executor.js';
 
 const VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
@@ -39,7 +40,10 @@ export interface ReleaseRunInput extends ReleaseLoopConfig {
   version: string;
   previousVersion: string;
   cutCommit?: string;
-  gatePodPool: string;
+  /** Required for the pod executor (the default); a host-executor run may have none. */
+  gatePodPool?: string;
+  /** GATE-HOST-EXECUTOR — absent = pod (today's input, byte-identical); `host` sweeps on `gateRemote`. */
+  gateExecutor?: GateExecutor;
   forceFreeze?: boolean;
   publishAt?: string;
   /** RELEASE-BRANCH: version-release cuts release/<v> from main HEAD and bumps only the branch. */
@@ -104,22 +108,32 @@ export function releaseLoopConfig(configPath = getElanousConfigDirOverride() ? j
   return raw.release?.loop ?? {};
 }
 
-export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDeps = {}, cutCommit?: string): ReleaseRunInput {
+/** GATE-HOST-EXECUTOR — the operator's explicit executor choice (`--gate-executor` / `--gate-host`); absent = pod. */
+export interface GateExecutorRequest { executor?: string; host?: string }
+
+export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDeps = {}, cutCommit?: string, gate: GateExecutorRequest = {}): ReleaseRunInput {
   const config = deps.config ?? releaseLoopConfig(deps.configPath);
+  if (gate.executor === undefined && gate.host !== undefined) throw new Error('--gate-host requires --gate-executor host');
+  const choice = gate.executor === undefined ? undefined
+    : checkGateExecutorChoice(gate.executor, gate.executor === 'host' ? gate.host ?? config.gateRemote : gate.host);
   const pool = config.gatePodPool;
-  if (typeof pool !== 'string' || !pool.trim()) throw new Error('release.loop.gatePodPool is required before graph execution');
+  const hasPool = typeof pool === 'string' && !!pool.trim();
+  // The pod executor (the default) stays fail-closed on a missing pool; an explicit host executor does not need one.
+  if (choice?.executor !== 'host' && !hasPool) throw new Error('release.loop.gatePodPool is required before graph execution');
   const previousVersion = latestPublishedPreviousVersion(baseVersion(version), deps.ledgerRoot);
   return {
     ...config,
     version, previousVersion,
     ...(cutCommit !== undefined ? { cutCommit } : {}),
-    gatePodPool: pool.trim(),
+    ...(hasPool ? { gatePodPool: pool.trim() } : {}),
+    ...(choice ? { gateExecutor: choice.executor } : {}),
+    ...(choice?.host ? { gateRemote: choice.host } : {}),
   };
 }
 
 /** Fail closed at the entry boundary, before any graph node can change a release. */
 export async function runUnattendedRelease(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps = {},
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
@@ -135,7 +149,7 @@ export async function runUnattendedRelease(
     }
   }
   const version = resolveRunVersion(opts.version, opts.prerelease, deps);
-  const input = buildReleaseRunInput(version, deps, opts.cutCommit);
+  const input = buildReleaseRunInput(version, deps, opts.cutCommit, { executor: opts.gateExecutor, host: opts.gateHost });
   if (opts.publishAt !== undefined) {
     const invalid = publishAtError(opts.publishAt);
     if (invalid) throw new Error(invalid);
@@ -143,7 +157,8 @@ export async function runUnattendedRelease(
   }
   if (opts.forceFreeze) input.forceFreeze = true;
   if (branchCut) input.branchCut = true;
-  debug.log('release.run', 'input', { version, requested: opts.version, branchCut, prerelease: opts.prerelease ?? null, dryRun: opts.dryRun === true });
+  debug.log('release.run', 'input', { version, requested: opts.version, branchCut, prerelease: opts.prerelease ?? null, dryRun: opts.dryRun === true,
+    ...(input.gateExecutor ? { gateExecutor: input.gateExecutor, gateHost: input.gateExecutor === 'host' ? input.gateRemote ?? null : null } : {}) });
   if (opts.dryRun) return { input, dryRun: true };
   if (opts.prerelease) {
     // A rehearsal neither judges nor carries the stable version's checklist cells.