elanous 0.2.24 → 0.2.25

package/scripts/bench-report.ts

@@ -13,6 +13,7 @@
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { dedupePodRollupRows } from './usage-rollup.js';
 
 export interface LogRow { category?: string; event?: string; data?: Record<string, unknown> | null }
 export interface ArmDecl { id: string; provider: string; model: string | null }
@@ -40,6 +41,40 @@ export interface ArmReport {
   reviewMustFixCount: number | null;
 }
 
+export interface ProbeJudgment {
+  model: string;
+  runs: number;
+  passed: number;
+  failed: number;
+  unmeasured: number;
+  verdict: 'pass' | 'fail' | 'unmeasured';
+}
+
+export function judgeProbe(
+  arms: readonly ArmReport[],
+  opts?: { passNumerator?: number; passDenominator?: number },
+): ProbeJudgment[] {
+  const passNumerator = opts?.passNumerator ?? 8;
+  const passDenominator = opts?.passDenominator ?? 9;
+  const groups = new Map<string, { runs: number; passed: number; failed: number; unmeasured: number }>();
+  for (const arm of arms) {
+    const model = arm.declared?.model ?? '못 이음';
+    const group = groups.get(model) ?? { runs: 0, passed: 0, failed: 0, unmeasured: 0 };
+    group.runs++;
+    if (arm.gatePassed === null || arm.leakCalls === null) group.unmeasured++;
+    else if (arm.gatePassed === true && arm.leakCalls === 0) group.passed++;
+    else group.failed++;
+    groups.set(model, group);
+  }
+  return [...groups].map(([model, counts]) => ({
+    model,
+    ...counts,
+    verdict: counts.unmeasured > 0
+      ? 'unmeasured'
+      : counts.passed * passDenominator >= counts.runs * passNumerator ? 'pass' : 'fail',
+  }));
+}
+
 const num = (v: unknown): number => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
 const str = (v: unknown): string | null => (typeof v === 'string' && v.length > 0 ? v : null);
 const armKey = (id: string): string => (id.startsWith('pod/') ? id : `pod/${id}`);
@@ -99,7 +134,8 @@ export function buildBenchReport(rows: readonly LogRow[], runId: string): { runI
     a.reviewMustFixCount = typeof r.data!.reviewMustFixCount === 'number' ? r.data!.reviewMustFixCount : null;
   }
   const leak = new Map<string, number>();
-  for (const r of mine) {
+  // ⭐ METER-POD-ROLLUP-GAP-2 — 같은 Pod 의 재방출(부분 ⊕ 최종 · abort ⊕ resume)은 podRollupKey 로 한 번만 센다(팔 사용량 이중계상 방지).
+  for (const r of dedupePodRollupRows(mine, (row) => (row.event === 'llm-usage' ? row.data ?? {} : {}))) {
     if (r.event !== 'llm-usage') continue;
     const site = str(r.data!.site);
     const id = str(r.data!.armId);
@@ -203,6 +239,15 @@ export function renderBenchReport(rep: ReturnType<typeof buildBenchReport>): str
   lines.push(leaked.length
     ? `⛔ 팔 밖 모델로 간 호출이 있다(${leaked.join(', ')}) — 이 판으로 팔을 비교하지 않는다.`
     : '⛔ 한 판(팔당 N=1)이다 — 결론이 아니라 관측이다. 비교는 팔마다 표본이 쌓인 뒤에.');
+  const probe = judgeProbe(rep.arms);
+  lines.push(
+    '',
+    '## 프로브 판정',
+    '',
+    '| 모델 | 통과/런 | 판정 |',
+    '|---|---:|---|',
+    ...probe.map((row) => `| ${row.model} | ${row.passed}/${row.runs} | ${row.verdict} |`),
+  );
   return lines.join('\n');
 }
 

package/scripts/ci-typecheck-changed.ts

@@ -17,6 +17,7 @@ import {
   ROOT_PLACEHOLDER,
   baselineCacheEnabled,
   computeBaselineCacheKey,
+  workingTreeInstallKey,
   lookupBaselineCache,
   storeBaselineCache,
   toPlaceholderPaths,
@@ -819,22 +820,23 @@ export function rebaseWorktreePaths(diagnostics: readonly TypecheckError[], work
 export type BaselineCacheIo = BaselineCacheOptions & { log?: (message: string) => void };
 
 /**
- * 같은 base 커밋 ⊕ 같은 명령 ⊕ 같은 설정 해시면 저장된 진단을 재사용한다(워크트리·tsc 0회).
+ * 같은 base 커밋 ⊕ 같은 명령 ⊕ 같은 설정 해시 ⊕ 같은 작업 트리 설치 키면 저장된 진단을 재사용한다(워크트리·tsc 0회).
  * 캐시의 어떤 실패도 던지지 않는다 — miss 로 떨어져 아래 측정이 그대로 돈다.
  */
-function lookupCachedBaseline(key: string, command: string, cwd: string, cacheIo: BaselineCacheIo): BaselineDiagnostics | undefined {
+function lookupCachedBaseline(key: string, command: string, cwd: string, cacheIo: BaselineCacheIo, installKey?: string): BaselineDiagnostics | undefined {
   const lookup = lookupBaselineCache(key, cacheIo);
   const result = lookup.result === 'hit' ? 'hit' : lookup.result === 'corrupt' ? 'corrupt' : 'miss';
-  cacheIo.log?.(`[tsc-gate] typecheck baseline-cache ${result === 'hit' ? 'hit' : 'miss'} ${key.slice(0, 12)}`);
-  debug.log('typecheck.gate', 'baseline-cache', { result, key, command });
+  cacheIo.log?.(`[tsc-gate] typecheck baseline-cache ${result === 'hit' ? 'hit' : 'miss'} ${key.slice(0, 12)} installKey ${installKey?.slice(0, 12) ?? 'n/a'}`);
+  debug.log('typecheck.gate', 'baseline-cache', { result, key, command, installKey: installKey ?? null });
   if (lookup.result !== 'hit') return undefined;
   return { diagnostics: rebaseWorktreePaths(lookup.diagnostics, ROOT_PLACEHOLDER, cwd) };
 }
 
 export function readMergeBaseDiagnostics(base: string, command: string, cwd = process.cwd(), run = runTsc, cacheIo: BaselineCacheIo = {}): BaselineDiagnostics {
   const cacheKey = baselineCacheEnabled(cacheIo.env ?? process.env) ? computeBaselineCacheKey(base, command, cwd, cacheIo) : undefined;
+  const installKey = cacheKey ? workingTreeInstallKey(cwd, cacheIo) : undefined;
   if (cacheKey) {
-    const cached = lookupCachedBaseline(cacheKey, command, cwd, cacheIo);
+    const cached = lookupCachedBaseline(cacheKey, command, cwd, cacheIo, installKey);
     if (cached) return cached;
   }
   const workspace = mkdtempSync(join(tmpdir(), 'ci-typecheck-baseline-'));

package/scripts/release-loop/auto-approve-node.ts

@@ -2,6 +2,7 @@
 import { mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
+import { registerStandaloneLogSink } from '../../src/domains/standalone-log-sink.js';
 import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
 import { emitNodeResult, readGraphContext, type GraphContext } from './node-verdict.js';
 import { regressWarning, validatedTuiRegress } from './tui-node-checks.js';
@@ -78,6 +79,11 @@ export function runAutoApprove(context: GraphContext = readGraphContext(), deps:
 }
 
 if (import.meta.main) {
+  // GATE-OBS2-1 — the release graph spawns this node as its own process, which inherits no daemon sink. Without this the
+  // `release-loop.approve / auto-decision` event (the one that says why a release was or was not published unattended)
+  // stayed in the file trail and `elanous logs` read 0 rows. Same pattern as gate-node.ts.
+  // Observability must never stop the release node from emitting its verdict — a failed sink registration is skipped.
+  try { await registerStandaloneLogSink('release-loop'); } catch { /* fail-soft: the decision still goes to stdout */ }
   try {
     const result = runAutoApprove();
     emitNodeResult(result);

package/scripts/release-loop/gate-closure.ts

@@ -0,0 +1,286 @@
+// GATE-REUSE-BY-DIFF (0.2.25 · 10-12): which test files can a code change reach? A test whose whole module closure
+// (static ⊕ literal dynamic imports ⊕ requires ⊕ literal repo paths it reads or spawns) avoids every changed file runs
+// the same code at both commits, so its prior gate result is reusable. Everything else — and every test whose closure we
+// cannot read for sure («opaque») — is re-run. Doubt never shrinks the set: a closure we cannot build is a full gate.
+//
+// Read from the tip commit's git objects, never from the working tree (the resume can run from any checkout).
+import { spawnSync } from 'node:child_process';
+import { dirname, join, normalize } from 'node:path/posix';
+import ts from 'typescript';
+import { sourceCandidates } from '../../src/self-implement/importer-test-index.js';
+
+/** Files the closure follows (code). Changing anything else that is not a test or inert Markdown is a full gate. */
+export const CODE_FILE = /\.(?:[cm]?[jt]sx?)$/;
+const TEST_FILE = /^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/;
+/** Test-side helpers: their filesystem scans and unresolved code paths make a test opaque (production code is trusted to
+ *  reach code only through imports and the literal paths below). */
+const TEST_SIDE_DIR = /(?:^|\/)(?:test|tests|__tests__|__mocks__|fixtures|__fixtures__|test-helpers|testing)\//;
+const TEST_SIDE_NAME = /(?:^|[-_.])(?:test-?utils?|test-?helpers?|test-?support|testing|fixtures?|mocks?)$/i;
+const isTestSide = (file: string): boolean => TEST_FILE.test(file) || TEST_SIDE_DIR.test(file)
+  || TEST_SIDE_NAME.test((file.split('/').pop() ?? file).replace(CODE_FILE, ''));
+/** A test-side file that lists directories or tracked files reads paths we cannot see. */
+const FS_SCAN = /\b(?:readdirSync|readdir|opendirSync|opendir|globSync|Glob|walkSync)\b|\bls-files\b/;
+/** `import(x)` / `require(x)` with a non-literal argument loads a module we cannot name. */
+const NON_LITERAL_LOAD = /(?<![.\w$])(?:import|require)\s*\(\s*(?!['"`)\s])([^)]*)\)?/g;
+/** `const NAME = "literal"` bindings — `import(NAME)` with such a NAME loads that literal. */
+const CONST_STRING = /\bconst\s+([A-Za-z_$][\w$]*)\s*=\s*(?:process\.env\.[\w$]+\s*(?:\?\?|\|\|)\s*)?(['"`])((?:(?!\2)[^\n\\$])*)\2\s*[;,\n]/g;
+/** `import(["..", "x", "y.js"].join("/"))` — a specifier spelled as joined literals. */
+const JOINED_IMPORT = /(?<![.\w$])import\s*\(\s*\[((?:\s*"[^"\n]*"\s*,?)+)\]\.join\(\s*"([^"\n]*)"\s*\)\s*\)/g;
+/** Process launches — a file that has one may run a repo path it names. */
+const SPAWNS = /(?<![\w$])(?:spawn|spawnSync|exec|execSync|execFile|execFileSync|fork|Bun\.spawn|Bun\.spawnSync|Bun\.\$)\s*[(`]/;
+const LITERAL = /(['"`])((?:(?!\1)[^\n\\])*)\1/g;
+/** An npm package specifier (`x`, `x/sub`, `@scope/x/sub`). */
+const PACKAGE_NAME = /^(?:@[a-z0-9][\w.~-]*\/)?[a-z0-9][\w.~-]*(?:\/[^\s]*)?$/i;
+const SUFFIXES = ['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs'];
+
+export interface ClosureTree {
+  /** Every tracked path at the tip. */
+  files: readonly string[];
+  /** Content at the tip (code files only are asked for); undefined = unreadable. */
+  read: (path: string) => string | undefined;
+  /** bun test preload files (bunfig.toml `[test].preload`), repo-relative. */
+  preload: readonly string[];
+  /** tsconfig `paths` aliases: specifier prefix → repo dir, scoped to importers under `scope`. */
+  aliases?: readonly { scope: string; prefix: string; target: string }[];
+}
+
+export type ClosureVerdict =
+  | { ok: true; tests: string[]; reached: number; opaque: number; opaqueFiles: string[] }
+  | { ok: false; reason: string };
+
+function loaderOf(file: string): 'ts' | 'tsx' | 'js' {
+  return /\.[jt]sx$/.test(file) ? 'tsx' : /\.[cm]?ts$/.test(file) ? 'ts' : 'js';
+}
+
+export interface ClosureOptions {
+  /** CLI entry files a production literal does not make a dependency of (help text, child command builders). */
+  cliEntries?: readonly string[];
+}
+
+interface ClosureGraph {
+  /** Every dependency a file can load: imports of any kind ⊕ literal repo paths. */
+  forward: Map<string, string[]>;
+  /** Only top-level `import`/`export … from` — what loading the file evaluates before any of its code runs. */
+  staticImports: Map<string, string[]>;
+  opaque: Map<string, string>;
+  tracked: Set<string>;
+}
+
+/** Forward dependency edges of every code file at the tip ⊕ the files whose dependencies we cannot fully name. */
+function closureGraph(tree: ClosureTree, options: ClosureOptions = {}): ClosureGraph {
+  const tracked = new Set(tree.files);
+  const dirs = new Set<string>();
+  for (const file of tree.files) for (let at = file.indexOf('/'); at > 0; at = file.indexOf('/', at + 1)) dirs.add(file.slice(0, at));
+  const resolveFrom = (from: string, spec: string): string | undefined => {
+    for (const candidate of sourceCandidates(from, spec)) if (tracked.has(candidate)) return candidate;
+    const base = normalize(join(dirname(from), spec.replace(/[?#].*$/, '')));
+    if (tracked.has(base)) return base;
+    for (const suffix of SUFFIXES) {
+      if (tracked.has(`${base}${suffix}`)) return `${base}${suffix}`;
+      if (tracked.has(`${base}/index${suffix}`)) return `${base}/index${suffix}`;
+    }
+    return undefined;
+  };
+  /** A literal is a file name, not a module specifier: exact (or emitted `.js` → `.ts`), extensionless relative ones get
+   *  a source suffix (`mock.module('../y')`) — never a directory index (`'src/'` is not `src/index.ts`). */
+  const resolveLiteral = (from: string, value: string): string | undefined => {
+    const relative = value.startsWith('./') || value.startsWith('../');
+    const bases = relative ? [from] : [from, '_'];
+    if (/\.[A-Za-z0-9]+$/.test(value.split('/').pop() ?? '')) {
+      for (const base of bases) for (const candidate of sourceCandidates(base, value)) if (tracked.has(candidate)) return candidate;
+      return undefined;
+    }
+    if (!relative) return undefined;
+    const base = normalize(join(dirname(from), value));
+    for (const suffix of SUFFIXES) if (tracked.has(`${base}${suffix}`)) return `${base}${suffix}`;
+    return undefined;
+  };
+  const transpilers = { ts: new Bun.Transpiler({ loader: 'ts' }), tsx: new Bun.Transpiler({ loader: 'tsx' }), js: new Bun.Transpiler({ loader: 'js' }) };
+  const forward = new Map<string, string[]>();
+  const staticImports = new Map<string, string[]>();
+  const opaque = new Map<string, string>();
+  const blindAs = (file: string, why: string): void => { if (!opaque.has(file)) opaque.set(file, why); };
+  for (const file of tree.files) {
+    if (!CODE_FILE.test(file)) continue;
+    const text = tree.read(file);
+    if (text === undefined) { blindAs(file, 'unreadable'); continue; }
+    const edges = new Set<string>();
+    const testSide = isTestSide(file);
+    let specs: { path: string; kind: string }[];
+    // The transpiled text has no comments or types: literals and loads are read from code only (a path in a comment is
+    // not a dependency).
+    let code: string;
+    try {
+      const source = text.replace(/^#![^\n]*/, '');
+      specs = [...transpilers[loaderOf(file)].scanImports(source)];
+      code = transpilers[loaderOf(file)].transformSync(source).replace(JOINED_IMPORT, (_all, items: string, separator: string) => {
+        const joined = [...items.matchAll(/"([^"\n]*)"/g)].map((item) => item[1]).join(separator);
+        specs.push({ path: joined, kind: 'dynamic-import' });
+        return `import(${JSON.stringify(joined)})`;
+      });
+    } catch { blindAs(file, 'unparsable'); continue; }
+    // A load whose argument is not a literal: resolvable only when it is one identifier bound to a string constant in
+    // this file (`const M = './pitch-api.js'; import(M)`); anything else loads a module we cannot name.
+    const bindings = new Map<string, string>();
+    for (const match of code.matchAll(CONST_STRING)) bindings.set(match[1]!, match[3]!);
+    const codeOnly = code.replace(LITERAL, '""');
+    for (const match of codeOnly.matchAll(NON_LITERAL_LOAD)) {
+      const bound = bindings.get((match[1] ?? '').trim());
+      if (bound === undefined) { blindAs(file, 'non-literal import/require'); continue; }
+      if (!bound.startsWith('.')) continue; // a package name (optional dependency)
+      const hit = resolveFrom(file, bound);
+      if (hit) specs.push({ path: bound, kind: 'dynamic-import' }); else blindAs(file, `unresolved import ${bound}`);
+    }
+    if (testSide && FS_SCAN.test(code)) blindAs(file, `scans (${FS_SCAN.exec(code)?.[0]})`);
+    const eager = new Set<string>();
+    for (const { path: spec, kind } of specs) {
+      let hit: string | undefined;
+      if (spec.startsWith('.') || spec.startsWith('/')) {
+        hit = spec.startsWith('/') ? undefined : resolveFrom(file, spec);
+        if (!hit) { blindAs(file, `unresolved import ${spec}`); continue; }
+      } else {
+        const alias = tree.aliases?.find((entry) => (entry.scope === '' || file.startsWith(`${entry.scope}/`)) && spec.startsWith(entry.prefix));
+        if (!alias) {
+          // Not a package name (`@/x`, `~/x`, `#x`): an alias we do not know — never assume it is outside the repo.
+          if (!/^(?:node:|bun:)/.test(spec) && !PACKAGE_NAME.test(spec)) blindAs(file, `unresolved alias ${spec}`);
+          continue;
+        }
+        hit = resolveFrom(`${alias.target}/_`, `./${spec.slice(alias.prefix.length)}`);
+        if (!hit) { blindAs(file, `unresolved alias ${spec}`); continue; }
+      }
+      edges.add(hit);
+      if (kind === 'import-statement') eager.add(hit);
+      // Anything else is a package (node_modules / builtin) — lockfile and package.json changes are full gates.
+    }
+    // Literal repo paths: a test that reads `src/x.ts`, spawns `bin/elanous.mjs` or mocks `../y` depends on that file.
+    for (const match of code.matchAll(LITERAL)) {
+      const value = match[2]!;
+      if (!value || value.length > 300 || value.includes('${') || /\s/.test(value) || /^[a-z]+:/i.test(value)) continue;
+      const pathLike = value.startsWith('./') || value.startsWith('../') || (value.includes('/') && /^[\w@.-]+(?:\/[\w@.-]+)+\/?$/.test(value)) || CODE_FILE.test(value);
+      if (!pathLike) continue;
+      const plain = value.replace(/\/$/, '');
+      const hit = resolveLiteral(file, plain);
+      // A path naming another test file is runner input (a list, a fixture string), not code this file loads.
+      if (hit) {
+        // A production file that names the CLI entry but spawns nothing only prints it (help text, a goal's command line).
+        const printsOnly = (options.cliEntries ?? []).includes(hit) && !SPAWNS.test(code);
+        if (!TEST_FILE.test(hit) && (testSide || !printsOnly)) edges.add(hit);
+        continue;
+      }
+      if (!testSide) continue;
+      const rootDir = normalize(plain.startsWith('.') ? join(dirname(file), plain) : plain);
+      // A test-side literal naming a tracked directory scans it; one naming a code file we cannot find is a path we miss.
+      if (dirs.has(rootDir) || (plain.startsWith('.') && dirs.has(normalize(join(dirname(file), plain))))) blindAs(file, `names directory ${plain}`);
+      // With or without a slash: `join(dir, '..', 'oauth', 'store.ts')` builds the path from pieces, so the bare file name
+      // is all we see — and a code file we cannot find is a path we miss.
+      else if (CODE_FILE.test(plain) && !TEST_FILE.test(plain)) blindAs(file, `unresolved path ${plain}`);
+    }
+    edges.delete(file);
+    eager.delete(file);
+    forward.set(file, [...edges]);
+    staticImports.set(file, [...eager]);
+  }
+  return { forward, staticImports, opaque, tracked };
+}
+
+/** The tests among `tests` that can reach any of `changed` (code files) — or whose closure is opaque. */
+export function testsReachingChanged(tree: ClosureTree, changed: readonly string[], tests: readonly string[], options: ClosureOptions = {}): ClosureVerdict {
+  const { forward, staticImports, opaque, tracked } = closureGraph(tree, options);
+  const reverse = new Map<string, string[]>();
+  for (const [from, edges] of forward) for (const to of edges) {
+    const list = reverse.get(to);
+    if (list) list.push(from); else reverse.set(to, [from]);
+  }
+  const reachedFrom = (seeds: Iterable<string>): Set<string> => {
+    const seen = new Set<string>(seeds);
+    const queue = [...seen];
+    while (queue.length) for (const importer of reverse.get(queue.pop()!) ?? []) if (!seen.has(importer)) { seen.add(importer); queue.push(importer); }
+    return seen;
+  };
+  // Preload runs before every test file: what it evaluates on load (its static import closure) is a dependency of all
+  // of them — changed, missing or unreadable there is a full gate.
+  const preloadClosure = new Set<string>();
+  const queue = [...tree.preload];
+  while (queue.length) {
+    const file = queue.pop()!;
+    if (preloadClosure.has(file)) continue;
+    preloadClosure.add(file);
+    queue.push(...(staticImports.get(file) ?? []));
+  }
+  const changedSet = new Set(changed);
+  for (const file of preloadClosure) {
+    if (!tracked.has(file)) return { ok: false, reason: `bun test preload closure file ${file} is missing — full gate` };
+    if (changedSet.has(file)) return { ok: false, reason: `bun test preload closure file ${file} changed — full gate` };
+    // Any load we cannot name here — even one that looks lazy — may run before every test: a full gate (#26516 review).
+    const why = opaque.get(file);
+    if (why) return { ok: false, reason: `bun test preload closure file ${file} is opaque (${why}) — full gate` };
+  }
+  const reached = reachedFrom(changed);
+  const blind = reachedFrom([...opaque.keys()].filter((file) => !preloadClosure.has(file)));
+  const selected = tests.filter((test) => reached.has(test) || blind.has(test)).sort();
+  return { ok: true, tests: selected, reached: tests.filter((test) => reached.has(test)).length, opaque: tests.filter((test) => blind.has(test) && !reached.has(test)).length,
+    opaqueFiles: [...opaque].filter(([file]) => !preloadClosure.has(file)).map(([file, why]) => `${file}: ${why}`).sort() };
+}
+
+/** `[test].preload` of a bunfig.toml text (repo-relative). Null when the file has a preload we cannot parse. */
+export function bunfigPreload(text: string | undefined): string[] | null {
+  if (text === undefined) return [];
+  const section = /^\s*\[test\]\s*$([\s\S]*?)(?=^\s*\[|(?![\s\S]))/m.exec(text)?.[1] ?? '';
+  const line = /^\s*preload\s*=\s*(.+)$/m.exec(section.replace(/#[^\n]*/g, ''));
+  if (!line) return /preload/.test(section.replace(/#[^\n]*/g, '')) ? null : [];
+  const list = /^\[([^\]]*)\]\s*$/.exec(line[1]!.trim()) ?? /^(["'][^"']*["'])\s*$/.exec(line[1]!.trim());
+  if (!list) return null;
+  return [...list[1]!.matchAll(/["']([^"']+)["']/g)].map((entry) => normalize(entry[1]!).replace(/^\.\//, ''));
+}
+
+/** The tip tree from git objects (`ls-tree` ⊕ one `cat-file --batch`). Throws on any git failure. */
+export function gitClosureTree(repo: string, commit: string): ClosureTree {
+  if (!/^[0-9a-f]{40}$/i.test(commit)) throw new Error(`not a full sha: ${commit}`);
+  // git-spawn-allow: read-only object reads of one release commit.
+  const listed = spawnSync('git', ['ls-tree', '-r', '-z', '--name-only', commit], { cwd: repo, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
+  if (listed.status !== 0 || listed.error) throw new Error(`git ls-tree failed: ${(listed.stderr || listed.error || '').toString().trim()}`);
+  const files = listed.stdout.split('\0').filter(Boolean);
+  const wanted = files.filter((file) => CODE_FILE.test(file) || file === 'bunfig.toml' || /(?:^|\/)tsconfig[\w.-]*\.json$/.test(file));
+  // git-spawn-allow: read-only object reads of one release commit.
+  const batch = spawnSync('git', ['cat-file', '--batch'], { cwd: repo, input: wanted.map((file) => `${commit}:${file}`).join('\n') + '\n', maxBuffer: 2 * 1024 * 1024 * 1024 });
+  if (batch.status !== 0 || batch.error) throw new Error(`git cat-file failed: ${(batch.stderr || batch.error || '').toString().trim()}`);
+  const out = batch.stdout as Buffer;
+  const contents = new Map<string, string>();
+  let at = 0;
+  for (const file of wanted) {
+    const end = out.indexOf(10, at);
+    if (end < 0) throw new Error('git cat-file output truncated');
+    const header = out.subarray(at, end).toString('utf8');
+    const size = /^[0-9a-f]+ blob (\d+)$/.exec(header);
+    if (!size) { at = end + 1; continue; } // «missing» (a submodule or symlink target) — read() answers undefined → opaque
+    const length = Number(size[1]);
+    contents.set(file, out.subarray(end + 1, end + 1 + length).toString('utf8'));
+    at = end + 1 + length + 1;
+  }
+  const preload = bunfigPreload(contents.get('bunfig.toml'));
+  if (preload === null) throw new Error('bunfig.toml [test].preload is unreadable');
+  return { files, read: (path) => contents.get(path), preload, aliases: tsconfigAliases(contents) };
+}
+
+/** `compilerOptions.paths` entries of the form `"<prefix>*": ["<dir>/*"]` — scoped to the tsconfig's directory. */
+function tsconfigAliases(contents: ReadonlyMap<string, string>): { scope: string; prefix: string; target: string }[] {
+  const aliases: { scope: string; prefix: string; target: string }[] = [];
+  for (const [file, text] of contents) {
+    if (!/(?:^|\/)tsconfig[\w.-]*\.json$/.test(file)) continue;
+    // TypeScript's own JSONC reader (comments, trailing commas, `src/**/*.ts` globs). An alias we cannot read would
+    // silently look like a package — so an unreadable tsconfig is an error (full gate), never skipped.
+    const parsed = ts.parseConfigFileTextToJson(file, text);
+    if (parsed.error) throw new Error(`tsconfig unreadable: ${file}`);
+    const options = (parsed.config as { compilerOptions?: { paths?: unknown; baseUrl?: unknown } } | undefined)?.compilerOptions;
+    const paths = options?.paths;
+    const baseUrl = options?.baseUrl;
+    if (!paths || typeof paths !== 'object') continue;
+    const scope = dirname(file) === '.' ? '' : dirname(file);
+    const base = normalize(join(scope || '.', typeof baseUrl === 'string' ? baseUrl : '.'));
+    for (const [key, targets] of Object.entries(paths as Record<string, unknown>)) {
+      if (key === '*' || !key.endsWith('*') || !Array.isArray(targets) || typeof targets[0] !== 'string' || !targets[0].endsWith('*')) continue;
+      aliases.push({ scope, prefix: key.slice(0, -1), target: normalize(join(base, targets[0].slice(0, -1))).replace(/\/$/, '') });
+    }
+  }
+  return aliases;
+}

package/scripts/release-loop/gate-node.ts

@@ -14,12 +14,13 @@ import { loadEnvKnownFailures, splitKnownEnv } from './env-known-failures';
 import { baselineFromCutLogs } from './baseline-from-logs';
 import { mergePartialFailures, readPartialPlan, testFileOfId } from './gate-partial';
 import { logPlanWalltime, planDurations, planShards, readFileMemory } from './shard-plan';
+import { readJunitFileSeconds } from './gate-method';
 import { deriveCdpTestPatterns } from '../test-deterministic';
 import { emitNodeResult, readGraphContext } from './node-verdict.js';
 import { isGateExecutor, type GateExecutor } from './gate-executor.js';
 import { runPodCommand, parsePodCpu, resolvePodCpu, type RunPodCommandOptions, type PodCommandResult, type PodCpu } from '../../src/task-orchestrator/surfaces/pod-command-job.js';
 import { POD_BUN_CACHE_HOST_PATH, parseInstallSeconds, podBunCacheVolume } from '../../src/task-orchestrator/surfaces/pod-bun-cache.js';
-import { PodPoolScheduler, parsePodPool, checkPodPool } from '../../src/task-orchestrator/surfaces/pod-pool.js';
+import { PodPoolScheduler, parsePodPool, checkPodPool, defaultRemoteRun, type PodPoolMember } from '../../src/task-orchestrator/surfaces/pod-pool.js';
 import { POD_INSTALL_SLOTS_DEFAULT, POD_INSTALL_SLOTS_HOST_PATH, installSlotScript } from '../../src/task-orchestrator/surfaces/pod-install-slots.js';
 import { gateDepsInstallScript, parseGateDeps } from '../../src/task-orchestrator/surfaces/pod-gate-deps.js';
 import { gateShardsPath, recordGateShardsVerdict, writeGateShards, type GateShard } from '../../src/release-loop/gate-shards.js';
@@ -76,7 +77,13 @@ export interface GateOptions {
     /** How often the stall watch reads the live log (ms); omitted = {@link GATE_POD_STALL_POLL_MS}. */
     stallPollMs?: number;
     /** GATE-LIVE-OBS — the shard state file (`gateShardsPath(version)`) this sweep keeps current; absent = not written. */
-    shardsFile?: { path: string; version: string } };
+    shardsFile?: { path: string; version: string };
+    /** GATE-MULTI-HOST — is this pool member reachable (kubectl ns ⊕ ssh)? Injected by tests; absent = the real probe on
+     *  the gate's own pool · an injected pool without it never marks a member down (unchanged). */
+    probeMember?: (member: PodPoolMember) => boolean;
+    /** GATE-MULTI-HOST — seconds a placed shard's Job status may stay unreadable before the shard counts as lost with its
+     *  member; omitted = {@link GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT}. Only a pool of two or more members uses it. */
+    memberUnreadableSeconds?: number };
 }
 export interface GateResult {
   outcome: 'ok' | 'regression' | 'error';
@@ -696,6 +703,18 @@ export const GATE_ADMISSION_WAIT_SECONDS_DEFAULT = 300;
 export type GateAdmissionOutcome = 'granted' | 'admission-timeout' | 'admission-error' | 'off';
 export interface GateAdmissionResult { outcome: GateAdmissionOutcome; waitedMs: number; reason?: string; release: () => void }
 export const gateAdmissionWaitText = (reading: string | null) => `메모리 여유 대기(admission) · ${reading ?? '측정 전'}`.slice(0, 160);
+/**
+ * GATE-MULTI-HOST (0.2.25 · 대표) — the gate pool is a host roster (`release.loop.gatePodPool` =
+ * `pool-node-b@node-b:N,pool-node-c@node-c:M,…`); shards spread over it by free share (selfCapped). A member that fails a
+ * shard's launch or goes silent mid-Job is probed; if it is unreachable it leaves the roster for the rest of this gate and
+ * the shard runs again on the others — one dead host no longer stops the gate. One-member pools keep the old behaviour.
+ */
+export const GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT = 600;
+export function defaultGateMemberProbe(member: PodPoolMember): boolean {
+  if (!checkPodPool([member], defaultKubectl).ok) return false;
+  return !member.sshHost || defaultRemoteRun(member.sshHost, 'true').status === 0;
+}
+
 export function poolGateAdmission(pool: PodPoolScheduler): GateAdmission {
   return { acquire: (signal) => pool.acquireAdmission(signal, undefined, { gate: true }), waitReason: () => pool.waitReason() };
 }
@@ -840,9 +859,30 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     });
     const stallWatch = stallSeconds > 0 && !!liveLog;
     debug.log('release-loop.gate', 'pod-stall-watch', { stallSeconds, source: pod.stallSeconds !== undefined ? 'config' : 'default', enabled: stallWatch });
+    // GATE-MULTI-HOST: members found unreachable during this gate — skipped for placement while any other member is left.
+    const downMembers = new Set<string>();
+    const multiHost = poolScheduler.members.length > 1;
+    const probeMember = pod.probeMember ?? (poolOverride ? undefined : defaultGateMemberProbe);
+    const memberUnreadableSeconds = pod.memberUnreadableSeconds ?? GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT;
+    if (!Number.isFinite(memberUnreadableSeconds) || memberUnreadableSeconds < 0) throw new Error('invalid pod sweep options');
+    debug.log('release-loop.gate', 'pod-roster', { members: poolScheduler.members.map((m) => ({ context: m.context, host: m.sshHost ?? null, capacity: m.capacity })),
+      dropped: ready?.dropped ?? [], multiHost, probe: !!probeMember });
+    /** True when the shard's member is (now) known unreachable — a newly found one is logged and leaves the roster. */
+    const memberLost = (context: string, shard: number, error: string): boolean => {
+      if (downMembers.has(context)) return true;
+      const member = poolScheduler.members.find((m) => m.context === context);
+      if (!multiHost || !probeMember || !member) return false;
+      let reachable: boolean;
+      try { reachable = probeMember(member); } catch { reachable = false; }
+      if (reachable) return false;
+      downMembers.add(context);
+      debug.log('release-loop.gate', 'pod-member-down', { member: context, host: member.sshHost ?? null, shard, error: error.slice(0, 300),
+        remaining: poolScheduler.members.filter((m) => !downMembers.has(m.context)).map((m) => m.context) }, { level: 'warn' });
+      return true;
+    };
     const jobLogTail = (job: PodCommandResult): string => {
       if (podLogTail) return podLogTail(job);
-      for (const member of poolScheduler.members) {
+      for (const member of poolScheduler.members.filter((m) => !downMembers.has(m.context))) {
         const logs = defaultKubectl(['--context', member.context, '-n', 'elanous-test', 'logs', `job/${job.job}`, '-c', 'child', '--tail=200']);
         if (logs.status === 0 && logs.stdout) return logs.stdout;
       }
@@ -882,16 +922,18 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     // Pending/Running in the cluster and the next admission reading counts it, so holding the lease would count it twice.
     const trackedPool = (shard: number, retry: boolean, placed: (member: NonNullable<Awaited<ReturnType<PodPoolScheduler['tryAcquire']>>>) => void = () => {}): PodPoolScheduler => ({
       members: poolScheduler.members,
-      tryAcquire: async (...args: Parameters<PodPoolScheduler['tryAcquire']>) => {
-        const member = await poolScheduler.tryAcquire(...args);
+      tryAcquire: async (...[skip, onEmpty, mode]: Parameters<PodPoolScheduler['tryAcquire']>) => {
+        // GATE-MULTI-HOST: a lost member is skipped while another member is left (all lost = the old behaviour).
+        const anyLeft = poolScheduler.members.some((m) => !downMembers.has(m.context));
+        const member = await poolScheduler.tryAcquire(downMembers.size && anyLeft ? new Set([...(skip ?? []), ...downMembers]) : skip, onEmpty, mode);
         if (member) placed(member);
-        if (member) markShard(shard, { state: retry ? 'retry' : 'running', startedAt: board[shard]?.startedAt ?? new Date().toISOString() }, ['waitReason']);
+        if (member) markShard(shard, { state: retry ? 'retry' : 'running', startedAt: board[shard]?.startedAt ?? new Date().toISOString(), host: member.context }, ['waitReason']);
         else markShard(shard, { waitReason: 'Pod 자리 대기' });
         return member;
       },
       release: (member: Parameters<PodPoolScheduler['release']>[0]) => poolScheduler.release(member),
     }) as unknown as PodPoolScheduler;
-    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
+    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string, hostRetries = 0): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
       // 파일별 소요는 junit 으로 남긴다 — 콘솔 요약(판정 원천)은 그대로이고, 느린 시험 목록(K10 D4)·계층 분리(D2)의 자가 된다.
       // GATE-TIMEOUT-HEAL: parts (each with its own junit) under a soft deadline inside this shard's own Job deadline.
       const shardDeadline = shardDeadlineSeconds(estimated(paths), deadlineSeconds);
@@ -910,6 +952,9 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       let jobExitCode: number | undefined;
       let lastFile: string | undefined;
       let jobFailed = false;
+      let jobError = '';
+      /** GATE-MULTI-HOST — the member this shard's Job was placed on (recorded in the shard json / log / board). */
+      let placedOn: string | undefined;
       let timedOut = false;
       let finished: string[] = [];
       let unfinishedLog: string | undefined;
@@ -960,7 +1005,8 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           } }) : undefined;
         const placed = admitted.release;
         const job = await podCommand({
-          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => { jobContext = member.context; placed(); }), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
+          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => { jobContext = member.context; placedOn = member.context; placed(); }), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
+          ...(multiHost ? { statusUnreadableMs: memberUnreadableSeconds * 1000 } : {}),
           ...(bunCache ? { bunCache } : {}),
           ...(installSlots > 0 ? { installSlots: POD_INSTALL_SLOTS_HOST_PATH } : {}),
           ...(pod.cpu ? { cpu: pod.cpu } : {}),
@@ -982,12 +1028,16 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           try { lastFile = lastStartedTestFile(jobLogTail(job).split(/\r?\n/).slice(-200).join('\n'), paths); }
           catch { /* Log retrieval is diagnostic; do not hide the stalled shard. */ }
         }
-      } catch {
+      } catch (error) {
         jobFailed = true;
+        jobError = error instanceof Error ? error.message : String(error);
       }
       // A launch that failed before placement still gives its admission back (release is idempotent).
       admitted?.release();
       const durationMs = Date.now() - start;
+      const fileSeconds = junit === undefined ? undefined : Object.fromEntries(readJunitFileSeconds(junit));
+      const testSeconds = fileSeconds === undefined ? undefined : Object.values(fileSeconds).reduce((sum, seconds) => sum + seconds, 0);
+      const podOverheadSeconds = testSeconds === undefined ? undefined : Math.max(0, durationMs / 1000 - testSeconds);
       // A reused shard keeps its files as they are — rewriting would replace the measured durationMs the next release plans by.
       if (logDir && !reused && !descent) {
         mkdirSync(logDir, { recursive: true });
@@ -1004,12 +1054,14 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (unfinishedLog !== undefined) writeFileSync(unfinishedDestination, unfinishedLog, { mode: 0o600 });
         else rmSync(unfinishedDestination, { force: true });
         writeFileSync(join(logDir, `pod-${shard}${branch}.json`), JSON.stringify({ durationMs, rc: rc ?? null,
-          ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed,
+          ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed, ...(placedOn ? { host: placedOn } : {}),
+          ...(fileSeconds !== undefined ? { fileSeconds, testSeconds, podOverheadSeconds } : {}),
           ...(admitted && admitted.outcome !== 'off' ? { admission: admitted.outcome, admissionWaitMs: admitted.waitedMs } : {}) }) + '\n', { mode: 0o600 });
       }
       const installSeconds = parseInstallSeconds(output ?? '');
       // GATE-TIMEOUT-HEAL ③: a cut shard is «reason: timeout» (with the files that still finished), not a bare rc=null.
-      if (!reused && !descent) debug.log('release-loop.gate', 'pod-shard', { shard, files: paths, durationMs, rc: rc ?? null, attempt: depth + 1, installSeconds, gateDeps: parseGateDeps(output ?? ''), deadlineSeconds: shardDeadline, parts: parts.length,
+      if (!reused && !descent) debug.log('release-loop.gate', 'pod-shard', { shard, files: paths, durationMs, rc: rc ?? null, attempt: depth + 1, installSeconds, gateDeps: parseGateDeps(output ?? ''), deadlineSeconds: shardDeadline, parts: parts.length, ...(placedOn ? { host: placedOn } : {}),
+        ...(testSeconds !== undefined ? { testSeconds } : {}),
         ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}) });
       if (!reused && !descent) markShard(shard, { ...(installSeconds !== null ? { installSec: installSeconds } : {}), ...(rc !== undefined ? { rc } : {}), ...(timedOut ? { state: 'timeout' as const } : {}) });
       let clean = output?.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
@@ -1064,6 +1116,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         debug.log('release-loop.gate', 'pod-shard-resume-miss', { shard, branch, reason });
         return runShard(paths, shard, depth, branch, retriedNoOutput, true, parentAttempt);
       }
+      // GATE-MULTI-HOST: the Job failed because its member is gone (launch failed · status unreadable) — not the shard's
+      // fault, so no split: the same files run again on the members left. Bounded by the roster size.
+      if (jobFailed && placedOn && hostRetries < poolScheduler.members.length && memberLost(placedOn, shard, jobError)
+        && poolScheduler.members.some((m) => !downMembers.has(m.context))) {
+        debug.log('release-loop.gate', 'pod-shard-host-retry', { shard, branch, files: paths.length, lostMember: placedOn, attempt: hostRetries + 1 }, { level: 'warn' });
+        return runShard(paths, shard, depth, `${branch}-h${hostRetries}`, retriedNoOutput, undefined, attemptId, hostRetries + 1);
+      }
       // GATE-TIMEOUT-HEAL ④: a Pod that died before any test ran (no outbox · jobExitCode≠0 — 0.2.19: isolated retries
       // ending with exit 5, the source checkout) gets the same one fresh retry as «no output» instead of stalling the sweep.
       // 137 (killed · OOM) keeps the isolation path: re-running an OOM file only re-measures the same kill.
@@ -1436,8 +1495,9 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         if (trustedKnown) knownFailures = [...trustedKnown.failures, ...(trustedKnown.errors ?? []), ...loadEnvKnownFailures(repo)];
       } catch (error) { debug.log('release-loop.gate', 'known-failures-unavailable', { error: String(error) }); }
     }
+    const durationSource = join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut');
     const cutRun = await runner.sweep(cutTree, join(root, 'release', opts.version, 'gate-logs', partial ? 'cut-partial' : 'cut'),
-      opts.pod ? { ...opts.pod, durationSource: join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut'), ...(knownFailures.length ? { knownFailures } : {}),
+      opts.pod ? { ...opts.pod, durationSource, ...(knownFailures.length ? { knownFailures } : {}),
         // GATE-LIVE-OBS: the release ledger's shards.json (UX #24782) — never the run tree's universe; an explicit
         // --ledger-root (tests) keeps it in that ledger.
         shardsFile: { path: opts.ledgerRoot ? gateShardsPath(opts.version, opts.ledgerRoot) : gateShardsPath(opts.version), version: opts.version } } : undefined,
@@ -1526,7 +1586,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         // K9b — the baseline is swept on the same Pod pool as the cut, not on this host (0.2.6: an hour of local baseline
         // after a 23-minute Pod cut).
         const baseRun = await runner.sweep(baseTree!, join(root, 'release', opts.version, 'gate-logs', 'baseline'),
-          opts.pod ? { ...opts.pod, durationSource: join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut') } : undefined,
+          opts.pod ? { ...opts.pod, durationSource } : undefined,
           present);
         baseline = await localStalled(baseRun, baseTree!, baseSha, 'baseline');
       } else baseline = { failures: [], errors: [] };