elanous 0.2.24 → 0.2.27

package/scripts/release-loop/export-check-node.ts

@@ -48,11 +48,14 @@ export function runExportCheck(run: CommandRunner = runCommand, repoRoot = proce
             const publicDir = join(out, 'export');
             symlinkSync(join(modulesRoot, 'node_modules'), join(publicDir, 'node_modules'), 'dir');
             const pwaModules = join(modulesRoot, 'apps', 'pwa', 'node_modules');
-            if (existsSync(pwaModules) && existsSync(join(publicDir, 'apps', 'pwa'))) symlinkSync(pwaModules, join(publicDir, 'apps', 'pwa', 'node_modules'), 'dir');
-            const built = run('bun', ['bin/elanous.mjs', 'nexus', 'build'], publicDir);
-            result = built.status === 0 && existsSync(join(publicDir, 'apps', 'pwa', 'out', 'index.html'))
-              ? { outcome: 'ok', verdict: 'pass', summary: `public export and PWA build ${commit.slice(0, 12)}`, step: 'build', tail: '' }
-              : failed('build', 'PWA build or out/index.html missing', built);
+            if (!existsSync(pwaModules)) result = failed('build', 'PWA dependencies missing; run bun install --cwd apps/pwa in the release-loop repository');
+            else {
+              if (existsSync(join(publicDir, 'apps', 'pwa'))) symlinkSync(pwaModules, join(publicDir, 'apps', 'pwa', 'node_modules'), 'dir');
+              const built = run('bun', ['bin/elanous.mjs', 'nexus', 'build'], publicDir);
+              result = built.status === 0 && existsSync(join(publicDir, 'apps', 'pwa', 'out', 'index.html'))
+                ? { outcome: 'ok', verdict: 'pass', summary: `public export and PWA build ${commit.slice(0, 12)}`, step: 'build', tail: '' }
+                : failed('build', 'PWA build or out/index.html missing', built);
+            }
           }
         }
       }

package/scripts/release-loop/gate-closure.ts

@@ -0,0 +1,286 @@
+// GATE-REUSE-BY-DIFF (0.2.25 · 10-12): which test files can a code change reach? A test whose whole module closure
+// (static ⊕ literal dynamic imports ⊕ requires ⊕ literal repo paths it reads or spawns) avoids every changed file runs
+// the same code at both commits, so its prior gate result is reusable. Everything else — and every test whose closure we
+// cannot read for sure («opaque») — is re-run. Doubt never shrinks the set: a closure we cannot build is a full gate.
+//
+// Read from the tip commit's git objects, never from the working tree (the resume can run from any checkout).
+import { spawnSync } from 'node:child_process';
+import { dirname, join, normalize } from 'node:path/posix';
+import ts from 'typescript';
+import { sourceCandidates } from '../../src/self-implement/importer-test-index.js';
+
+/** Files the closure follows (code). Changing anything else that is not a test or inert Markdown is a full gate. */
+export const CODE_FILE = /\.(?:[cm]?[jt]sx?)$/;
+const TEST_FILE = /^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/;
+/** Test-side helpers: their filesystem scans and unresolved code paths make a test opaque (production code is trusted to
+ *  reach code only through imports and the literal paths below). */
+const TEST_SIDE_DIR = /(?:^|\/)(?:test|tests|__tests__|__mocks__|fixtures|__fixtures__|test-helpers|testing)\//;
+const TEST_SIDE_NAME = /(?:^|[-_.])(?:test-?utils?|test-?helpers?|test-?support|testing|fixtures?|mocks?)$/i;
+const isTestSide = (file: string): boolean => TEST_FILE.test(file) || TEST_SIDE_DIR.test(file)
+  || TEST_SIDE_NAME.test((file.split('/').pop() ?? file).replace(CODE_FILE, ''));
+/** A test-side file that lists directories or tracked files reads paths we cannot see. */
+const FS_SCAN = /\b(?:readdirSync|readdir|opendirSync|opendir|globSync|Glob|walkSync)\b|\bls-files\b/;
+/** `import(x)` / `require(x)` with a non-literal argument loads a module we cannot name. */
+const NON_LITERAL_LOAD = /(?<![.\w$])(?:import|require)\s*\(\s*(?!['"`)\s])([^)]*)\)?/g;
+/** `const NAME = "literal"` bindings — `import(NAME)` with such a NAME loads that literal. */
+const CONST_STRING = /\bconst\s+([A-Za-z_$][\w$]*)\s*=\s*(?:process\.env\.[\w$]+\s*(?:\?\?|\|\|)\s*)?(['"`])((?:(?!\2)[^\n\\$])*)\2\s*[;,\n]/g;
+/** `import(["..", "x", "y.js"].join("/"))` — a specifier spelled as joined literals. */
+const JOINED_IMPORT = /(?<![.\w$])import\s*\(\s*\[((?:\s*"[^"\n]*"\s*,?)+)\]\.join\(\s*"([^"\n]*)"\s*\)\s*\)/g;
+/** Process launches — a file that has one may run a repo path it names. */
+const SPAWNS = /(?<![\w$])(?:spawn|spawnSync|exec|execSync|execFile|execFileSync|fork|Bun\.spawn|Bun\.spawnSync|Bun\.\$)\s*[(`]/;
+const LITERAL = /(['"`])((?:(?!\1)[^\n\\])*)\1/g;
+/** An npm package specifier (`x`, `x/sub`, `@scope/x/sub`). */
+const PACKAGE_NAME = /^(?:@[a-z0-9][\w.~-]*\/)?[a-z0-9][\w.~-]*(?:\/[^\s]*)?$/i;
+const SUFFIXES = ['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs'];
+
+export interface ClosureTree {
+  /** Every tracked path at the tip. */
+  files: readonly string[];
+  /** Content at the tip (code files only are asked for); undefined = unreadable. */
+  read: (path: string) => string | undefined;
+  /** bun test preload files (bunfig.toml `[test].preload`), repo-relative. */
+  preload: readonly string[];
+  /** tsconfig `paths` aliases: specifier prefix → repo dir, scoped to importers under `scope`. */
+  aliases?: readonly { scope: string; prefix: string; target: string }[];
+}
+
+export type ClosureVerdict =
+  | { ok: true; tests: string[]; reached: number; opaque: number; opaqueFiles: string[] }
+  | { ok: false; reason: string };
+
+function loaderOf(file: string): 'ts' | 'tsx' | 'js' {
+  return /\.[jt]sx$/.test(file) ? 'tsx' : /\.[cm]?ts$/.test(file) ? 'ts' : 'js';
+}
+
+export interface ClosureOptions {
+  /** CLI entry files a production literal does not make a dependency of (help text, child command builders). */
+  cliEntries?: readonly string[];
+}
+
+interface ClosureGraph {
+  /** Every dependency a file can load: imports of any kind ⊕ literal repo paths. */
+  forward: Map<string, string[]>;
+  /** Only top-level `import`/`export … from` — what loading the file evaluates before any of its code runs. */
+  staticImports: Map<string, string[]>;
+  opaque: Map<string, string>;
+  tracked: Set<string>;
+}
+
+/** Forward dependency edges of every code file at the tip ⊕ the files whose dependencies we cannot fully name. */
+function closureGraph(tree: ClosureTree, options: ClosureOptions = {}): ClosureGraph {
+  const tracked = new Set(tree.files);
+  const dirs = new Set<string>();
+  for (const file of tree.files) for (let at = file.indexOf('/'); at > 0; at = file.indexOf('/', at + 1)) dirs.add(file.slice(0, at));
+  const resolveFrom = (from: string, spec: string): string | undefined => {
+    for (const candidate of sourceCandidates(from, spec)) if (tracked.has(candidate)) return candidate;
+    const base = normalize(join(dirname(from), spec.replace(/[?#].*$/, '')));
+    if (tracked.has(base)) return base;
+    for (const suffix of SUFFIXES) {
+      if (tracked.has(`${base}${suffix}`)) return `${base}${suffix}`;
+      if (tracked.has(`${base}/index${suffix}`)) return `${base}/index${suffix}`;
+    }
+    return undefined;
+  };
+  /** A literal is a file name, not a module specifier: exact (or emitted `.js` → `.ts`), extensionless relative ones get
+   *  a source suffix (`mock.module('../y')`) — never a directory index (`'src/'` is not `src/index.ts`). */
+  const resolveLiteral = (from: string, value: string): string | undefined => {
+    const relative = value.startsWith('./') || value.startsWith('../');
+    const bases = relative ? [from] : [from, '_'];
+    if (/\.[A-Za-z0-9]+$/.test(value.split('/').pop() ?? '')) {
+      for (const base of bases) for (const candidate of sourceCandidates(base, value)) if (tracked.has(candidate)) return candidate;
+      return undefined;
+    }
+    if (!relative) return undefined;
+    const base = normalize(join(dirname(from), value));
+    for (const suffix of SUFFIXES) if (tracked.has(`${base}${suffix}`)) return `${base}${suffix}`;
+    return undefined;
+  };
+  const transpilers = { ts: new Bun.Transpiler({ loader: 'ts' }), tsx: new Bun.Transpiler({ loader: 'tsx' }), js: new Bun.Transpiler({ loader: 'js' }) };
+  const forward = new Map<string, string[]>();
+  const staticImports = new Map<string, string[]>();
+  const opaque = new Map<string, string>();
+  const blindAs = (file: string, why: string): void => { if (!opaque.has(file)) opaque.set(file, why); };
+  for (const file of tree.files) {
+    if (!CODE_FILE.test(file)) continue;
+    const text = tree.read(file);
+    if (text === undefined) { blindAs(file, 'unreadable'); continue; }
+    const edges = new Set<string>();
+    const testSide = isTestSide(file);
+    let specs: { path: string; kind: string }[];
+    // The transpiled text has no comments or types: literals and loads are read from code only (a path in a comment is
+    // not a dependency).
+    let code: string;
+    try {
+      const source = text.replace(/^#![^\n]*/, '');
+      specs = [...transpilers[loaderOf(file)].scanImports(source)];
+      code = transpilers[loaderOf(file)].transformSync(source).replace(JOINED_IMPORT, (_all, items: string, separator: string) => {
+        const joined = [...items.matchAll(/"([^"\n]*)"/g)].map((item) => item[1]).join(separator);
+        specs.push({ path: joined, kind: 'dynamic-import' });
+        return `import(${JSON.stringify(joined)})`;
+      });
+    } catch { blindAs(file, 'unparsable'); continue; }
+    // A load whose argument is not a literal: resolvable only when it is one identifier bound to a string constant in
+    // this file (`const M = './pitch-api.js'; import(M)`); anything else loads a module we cannot name.
+    const bindings = new Map<string, string>();
+    for (const match of code.matchAll(CONST_STRING)) bindings.set(match[1]!, match[3]!);
+    const codeOnly = code.replace(LITERAL, '""');
+    for (const match of codeOnly.matchAll(NON_LITERAL_LOAD)) {
+      const bound = bindings.get((match[1] ?? '').trim());
+      if (bound === undefined) { blindAs(file, 'non-literal import/require'); continue; }
+      if (!bound.startsWith('.')) continue; // a package name (optional dependency)
+      const hit = resolveFrom(file, bound);
+      if (hit) specs.push({ path: bound, kind: 'dynamic-import' }); else blindAs(file, `unresolved import ${bound}`);
+    }
+    if (testSide && FS_SCAN.test(code)) blindAs(file, `scans (${FS_SCAN.exec(code)?.[0]})`);
+    const eager = new Set<string>();
+    for (const { path: spec, kind } of specs) {
+      let hit: string | undefined;
+      if (spec.startsWith('.') || spec.startsWith('/')) {
+        hit = spec.startsWith('/') ? undefined : resolveFrom(file, spec);
+        if (!hit) { blindAs(file, `unresolved import ${spec}`); continue; }
+      } else {
+        const alias = tree.aliases?.find((entry) => (entry.scope === '' || file.startsWith(`${entry.scope}/`)) && spec.startsWith(entry.prefix));
+        if (!alias) {
+          // Not a package name (`@/x`, `~/x`, `#x`): an alias we do not know — never assume it is outside the repo.
+          if (!/^(?:node:|bun:)/.test(spec) && !PACKAGE_NAME.test(spec)) blindAs(file, `unresolved alias ${spec}`);
+          continue;
+        }
+        hit = resolveFrom(`${alias.target}/_`, `./${spec.slice(alias.prefix.length)}`);
+        if (!hit) { blindAs(file, `unresolved alias ${spec}`); continue; }
+      }
+      edges.add(hit);
+      if (kind === 'import-statement') eager.add(hit);
+      // Anything else is a package (node_modules / builtin) — lockfile and package.json changes are full gates.
+    }
+    // Literal repo paths: a test that reads `src/x.ts`, spawns `bin/elanous.mjs` or mocks `../y` depends on that file.
+    for (const match of code.matchAll(LITERAL)) {
+      const value = match[2]!;
+      if (!value || value.length > 300 || value.includes('${') || /\s/.test(value) || /^[a-z]+:/i.test(value)) continue;
+      const pathLike = value.startsWith('./') || value.startsWith('../') || (value.includes('/') && /^[\w@.-]+(?:\/[\w@.-]+)+\/?$/.test(value)) || CODE_FILE.test(value);
+      if (!pathLike) continue;
+      const plain = value.replace(/\/$/, '');
+      const hit = resolveLiteral(file, plain);
+      // A path naming another test file is runner input (a list, a fixture string), not code this file loads.
+      if (hit) {
+        // A production file that names the CLI entry but spawns nothing only prints it (help text, a goal's command line).
+        const printsOnly = (options.cliEntries ?? []).includes(hit) && !SPAWNS.test(code);
+        if (!TEST_FILE.test(hit) && (testSide || !printsOnly)) edges.add(hit);
+        continue;
+      }
+      if (!testSide) continue;
+      const rootDir = normalize(plain.startsWith('.') ? join(dirname(file), plain) : plain);
+      // A test-side literal naming a tracked directory scans it; one naming a code file we cannot find is a path we miss.
+      if (dirs.has(rootDir) || (plain.startsWith('.') && dirs.has(normalize(join(dirname(file), plain))))) blindAs(file, `names directory ${plain}`);
+      // With or without a slash: `join(dir, '..', 'oauth', 'store.ts')` builds the path from pieces, so the bare file name
+      // is all we see — and a code file we cannot find is a path we miss.
+      else if (CODE_FILE.test(plain) && !TEST_FILE.test(plain)) blindAs(file, `unresolved path ${plain}`);
+    }
+    edges.delete(file);
+    eager.delete(file);
+    forward.set(file, [...edges]);
+    staticImports.set(file, [...eager]);
+  }
+  return { forward, staticImports, opaque, tracked };
+}
+
+/** The tests among `tests` that can reach any of `changed` (code files) — or whose closure is opaque. */
+export function testsReachingChanged(tree: ClosureTree, changed: readonly string[], tests: readonly string[], options: ClosureOptions = {}): ClosureVerdict {
+  const { forward, staticImports, opaque, tracked } = closureGraph(tree, options);
+  const reverse = new Map<string, string[]>();
+  for (const [from, edges] of forward) for (const to of edges) {
+    const list = reverse.get(to);
+    if (list) list.push(from); else reverse.set(to, [from]);
+  }
+  const reachedFrom = (seeds: Iterable<string>): Set<string> => {
+    const seen = new Set<string>(seeds);
+    const queue = [...seen];
+    while (queue.length) for (const importer of reverse.get(queue.pop()!) ?? []) if (!seen.has(importer)) { seen.add(importer); queue.push(importer); }
+    return seen;
+  };
+  // Preload runs before every test file: what it evaluates on load (its static import closure) is a dependency of all
+  // of them — changed, missing or unreadable there is a full gate.
+  const preloadClosure = new Set<string>();
+  const queue = [...tree.preload];
+  while (queue.length) {
+    const file = queue.pop()!;
+    if (preloadClosure.has(file)) continue;
+    preloadClosure.add(file);
+    queue.push(...(staticImports.get(file) ?? []));
+  }
+  const changedSet = new Set(changed);
+  for (const file of preloadClosure) {
+    if (!tracked.has(file)) return { ok: false, reason: `bun test preload closure file ${file} is missing — full gate` };
+    if (changedSet.has(file)) return { ok: false, reason: `bun test preload closure file ${file} changed — full gate` };
+    // Any load we cannot name here — even one that looks lazy — may run before every test: a full gate (#26516 review).
+    const why = opaque.get(file);
+    if (why) return { ok: false, reason: `bun test preload closure file ${file} is opaque (${why}) — full gate` };
+  }
+  const reached = reachedFrom(changed);
+  const blind = reachedFrom([...opaque.keys()].filter((file) => !preloadClosure.has(file)));
+  const selected = tests.filter((test) => reached.has(test) || blind.has(test)).sort();
+  return { ok: true, tests: selected, reached: tests.filter((test) => reached.has(test)).length, opaque: tests.filter((test) => blind.has(test) && !reached.has(test)).length,
+    opaqueFiles: [...opaque].filter(([file]) => !preloadClosure.has(file)).map(([file, why]) => `${file}: ${why}`).sort() };
+}
+
+/** `[test].preload` of a bunfig.toml text (repo-relative). Null when the file has a preload we cannot parse. */
+export function bunfigPreload(text: string | undefined): string[] | null {
+  if (text === undefined) return [];
+  const section = /^\s*\[test\]\s*$([\s\S]*?)(?=^\s*\[|(?![\s\S]))/m.exec(text)?.[1] ?? '';
+  const line = /^\s*preload\s*=\s*(.+)$/m.exec(section.replace(/#[^\n]*/g, ''));
+  if (!line) return /preload/.test(section.replace(/#[^\n]*/g, '')) ? null : [];
+  const list = /^\[([^\]]*)\]\s*$/.exec(line[1]!.trim()) ?? /^(["'][^"']*["'])\s*$/.exec(line[1]!.trim());
+  if (!list) return null;
+  return [...list[1]!.matchAll(/["']([^"']+)["']/g)].map((entry) => normalize(entry[1]!).replace(/^\.\//, ''));
+}
+
+/** The tip tree from git objects (`ls-tree` ⊕ one `cat-file --batch`). Throws on any git failure. */
+export function gitClosureTree(repo: string, commit: string): ClosureTree {
+  if (!/^[0-9a-f]{40}$/i.test(commit)) throw new Error(`not a full sha: ${commit}`);
+  // git-spawn-allow: read-only object reads of one release commit.
+  const listed = spawnSync('git', ['ls-tree', '-r', '-z', '--name-only', commit], { cwd: repo, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
+  if (listed.status !== 0 || listed.error) throw new Error(`git ls-tree failed: ${(listed.stderr || listed.error || '').toString().trim()}`);
+  const files = listed.stdout.split('\0').filter(Boolean);
+  const wanted = files.filter((file) => CODE_FILE.test(file) || file === 'bunfig.toml' || /(?:^|\/)tsconfig[\w.-]*\.json$/.test(file));
+  // git-spawn-allow: read-only object reads of one release commit.
+  const batch = spawnSync('git', ['cat-file', '--batch'], { cwd: repo, input: wanted.map((file) => `${commit}:${file}`).join('\n') + '\n', maxBuffer: 2 * 1024 * 1024 * 1024 });
+  if (batch.status !== 0 || batch.error) throw new Error(`git cat-file failed: ${(batch.stderr || batch.error || '').toString().trim()}`);
+  const out = batch.stdout as Buffer;
+  const contents = new Map<string, string>();
+  let at = 0;
+  for (const file of wanted) {
+    const end = out.indexOf(10, at);
+    if (end < 0) throw new Error('git cat-file output truncated');
+    const header = out.subarray(at, end).toString('utf8');
+    const size = /^[0-9a-f]+ blob (\d+)$/.exec(header);
+    if (!size) { at = end + 1; continue; } // «missing» (a submodule or symlink target) — read() answers undefined → opaque
+    const length = Number(size[1]);
+    contents.set(file, out.subarray(end + 1, end + 1 + length).toString('utf8'));
+    at = end + 1 + length + 1;
+  }
+  const preload = bunfigPreload(contents.get('bunfig.toml'));
+  if (preload === null) throw new Error('bunfig.toml [test].preload is unreadable');
+  return { files, read: (path) => contents.get(path), preload, aliases: tsconfigAliases(contents) };
+}
+
+/** `compilerOptions.paths` entries of the form `"<prefix>*": ["<dir>/*"]` — scoped to the tsconfig's directory. */
+function tsconfigAliases(contents: ReadonlyMap<string, string>): { scope: string; prefix: string; target: string }[] {
+  const aliases: { scope: string; prefix: string; target: string }[] = [];
+  for (const [file, text] of contents) {
+    if (!/(?:^|\/)tsconfig[\w.-]*\.json$/.test(file)) continue;
+    // TypeScript's own JSONC reader (comments, trailing commas, `src/**/*.ts` globs). An alias we cannot read would
+    // silently look like a package — so an unreadable tsconfig is an error (full gate), never skipped.
+    const parsed = ts.parseConfigFileTextToJson(file, text);
+    if (parsed.error) throw new Error(`tsconfig unreadable: ${file}`);
+    const options = (parsed.config as { compilerOptions?: { paths?: unknown; baseUrl?: unknown } } | undefined)?.compilerOptions;
+    const paths = options?.paths;
+    const baseUrl = options?.baseUrl;
+    if (!paths || typeof paths !== 'object') continue;
+    const scope = dirname(file) === '.' ? '' : dirname(file);
+    const base = normalize(join(scope || '.', typeof baseUrl === 'string' ? baseUrl : '.'));
+    for (const [key, targets] of Object.entries(paths as Record<string, unknown>)) {
+      if (key === '*' || !key.endsWith('*') || !Array.isArray(targets) || typeof targets[0] !== 'string' || !targets[0].endsWith('*')) continue;
+      aliases.push({ scope, prefix: key.slice(0, -1), target: normalize(join(base, targets[0].slice(0, -1))).replace(/\/$/, '') });
+    }
+  }
+  return aliases;
+}

package/scripts/release-loop/gate-node.ts

@@ -14,12 +14,13 @@ import { loadEnvKnownFailures, splitKnownEnv } from './env-known-failures';
 import { baselineFromCutLogs } from './baseline-from-logs';
 import { mergePartialFailures, readPartialPlan, testFileOfId } from './gate-partial';
 import { logPlanWalltime, planDurations, planShards, readFileMemory } from './shard-plan';
+import { readJunitFileSeconds } from './gate-method';
 import { deriveCdpTestPatterns } from '../test-deterministic';
 import { emitNodeResult, readGraphContext } from './node-verdict.js';
 import { isGateExecutor, type GateExecutor } from './gate-executor.js';
 import { runPodCommand, parsePodCpu, resolvePodCpu, type RunPodCommandOptions, type PodCommandResult, type PodCpu } from '../../src/task-orchestrator/surfaces/pod-command-job.js';
 import { POD_BUN_CACHE_HOST_PATH, parseInstallSeconds, podBunCacheVolume } from '../../src/task-orchestrator/surfaces/pod-bun-cache.js';
-import { PodPoolScheduler, parsePodPool, checkPodPool } from '../../src/task-orchestrator/surfaces/pod-pool.js';
+import { PodPoolScheduler, parsePodPool, checkPodPool, defaultRemoteRun, type PodPoolMember } from '../../src/task-orchestrator/surfaces/pod-pool.js';
 import { POD_INSTALL_SLOTS_DEFAULT, POD_INSTALL_SLOTS_HOST_PATH, installSlotScript } from '../../src/task-orchestrator/surfaces/pod-install-slots.js';
 import { gateDepsInstallScript, parseGateDeps } from '../../src/task-orchestrator/surfaces/pod-gate-deps.js';
 import { gateShardsPath, recordGateShardsVerdict, writeGateShards, type GateShard } from '../../src/release-loop/gate-shards.js';
@@ -76,7 +77,13 @@ export interface GateOptions {
     /** How often the stall watch reads the live log (ms); omitted = {@link GATE_POD_STALL_POLL_MS}. */
     stallPollMs?: number;
     /** GATE-LIVE-OBS — the shard state file (`gateShardsPath(version)`) this sweep keeps current; absent = not written. */
-    shardsFile?: { path: string; version: string } };
+    shardsFile?: { path: string; version: string };
+    /** GATE-MULTI-HOST — is this pool member reachable (kubectl ns ⊕ ssh)? Injected by tests; absent = the real probe on
+     *  the gate's own pool · an injected pool without it never marks a member down (unchanged). */
+    probeMember?: (member: PodPoolMember) => boolean;
+    /** GATE-MULTI-HOST — seconds a placed shard's Job status may stay unreadable before the shard counts as lost with its
+     *  member; omitted = {@link GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT}. Only a pool of two or more members uses it. */
+    memberUnreadableSeconds?: number };
 }
 export interface GateResult {
   outcome: 'ok' | 'regression' | 'error';
@@ -696,6 +703,18 @@ export const GATE_ADMISSION_WAIT_SECONDS_DEFAULT = 300;
 export type GateAdmissionOutcome = 'granted' | 'admission-timeout' | 'admission-error' | 'off';
 export interface GateAdmissionResult { outcome: GateAdmissionOutcome; waitedMs: number; reason?: string; release: () => void }
 export const gateAdmissionWaitText = (reading: string | null) => `메모리 여유 대기(admission) · ${reading ?? '측정 전'}`.slice(0, 160);
+/**
+ * GATE-MULTI-HOST (0.2.25 · 대표) — the gate pool is a host roster (`release.loop.gatePodPool` =
+ * `pool-node-b@node-b:N,pool-node-c@node-c:M,…`); shards spread over it by free share (selfCapped). A member that fails a
+ * shard's launch or goes silent mid-Job is probed; if it is unreachable it leaves the roster for the rest of this gate and
+ * the shard runs again on the others — one dead host no longer stops the gate. One-member pools keep the old behaviour.
+ */
+export const GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT = 600;
+export function defaultGateMemberProbe(member: PodPoolMember): boolean {
+  if (!checkPodPool([member], defaultKubectl).ok) return false;
+  return !member.sshHost || defaultRemoteRun(member.sshHost, 'true').status === 0;
+}
+
 export function poolGateAdmission(pool: PodPoolScheduler): GateAdmission {
   return { acquire: (signal) => pool.acquireAdmission(signal, undefined, { gate: true }), waitReason: () => pool.waitReason() };
 }
@@ -840,9 +859,30 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     });
     const stallWatch = stallSeconds > 0 && !!liveLog;
     debug.log('release-loop.gate', 'pod-stall-watch', { stallSeconds, source: pod.stallSeconds !== undefined ? 'config' : 'default', enabled: stallWatch });
+    // GATE-MULTI-HOST: members found unreachable during this gate — skipped for placement while any other member is left.
+    const downMembers = new Set<string>();
+    const multiHost = poolScheduler.members.length > 1;
+    const probeMember = pod.probeMember ?? (poolOverride ? undefined : defaultGateMemberProbe);
+    const memberUnreadableSeconds = pod.memberUnreadableSeconds ?? GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT;
+    if (!Number.isFinite(memberUnreadableSeconds) || memberUnreadableSeconds < 0) throw new Error('invalid pod sweep options');
+    debug.log('release-loop.gate', 'pod-roster', { members: poolScheduler.members.map((m) => ({ context: m.context, host: m.sshHost ?? null, capacity: m.capacity })),
+      dropped: ready?.dropped ?? [], multiHost, probe: !!probeMember });
+    /** True when the shard's member is (now) known unreachable — a newly found one is logged and leaves the roster. */
+    const memberLost = (context: string, shard: number, error: string): boolean => {
+      if (downMembers.has(context)) return true;
+      const member = poolScheduler.members.find((m) => m.context === context);
+      if (!multiHost || !probeMember || !member) return false;
+      let reachable: boolean;
+      try { reachable = probeMember(member); } catch { reachable = false; }
+      if (reachable) return false;
+      downMembers.add(context);
+      debug.log('release-loop.gate', 'pod-member-down', { member: context, host: member.sshHost ?? null, shard, error: error.slice(0, 300),
+        remaining: poolScheduler.members.filter((m) => !downMembers.has(m.context)).map((m) => m.context) }, { level: 'warn' });
+      return true;
+    };
     const jobLogTail = (job: PodCommandResult): string => {
       if (podLogTail) return podLogTail(job);
-      for (const member of poolScheduler.members) {
+      for (const member of poolScheduler.members.filter((m) => !downMembers.has(m.context))) {
         const logs = defaultKubectl(['--context', member.context, '-n', 'elanous-test', 'logs', `job/${job.job}`, '-c', 'child', '--tail=200']);
         if (logs.status === 0 && logs.stdout) return logs.stdout;
       }
@@ -882,16 +922,18 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     // Pending/Running in the cluster and the next admission reading counts it, so holding the lease would count it twice.
     const trackedPool = (shard: number, retry: boolean, placed: (member: NonNullable<Awaited<ReturnType<PodPoolScheduler['tryAcquire']>>>) => void = () => {}): PodPoolScheduler => ({
       members: poolScheduler.members,
-      tryAcquire: async (...args: Parameters<PodPoolScheduler['tryAcquire']>) => {
-        const member = await poolScheduler.tryAcquire(...args);
+      tryAcquire: async (...[skip, onEmpty, mode]: Parameters<PodPoolScheduler['tryAcquire']>) => {
+        // GATE-MULTI-HOST: a lost member is skipped while another member is left (all lost = the old behaviour).
+        const anyLeft = poolScheduler.members.some((m) => !downMembers.has(m.context));
+        const member = await poolScheduler.tryAcquire(downMembers.size && anyLeft ? new Set([...(skip ?? []), ...downMembers]) : skip, onEmpty, mode);
         if (member) placed(member);
-        if (member) markShard(shard, { state: retry ? 'retry' : 'running', startedAt: board[shard]?.startedAt ?? new Date().toISOString() }, ['waitReason']);
+        if (member) markShard(shard, { state: retry ? 'retry' : 'running', startedAt: board[shard]?.startedAt ?? new Date().toISOString(), host: member.context }, ['waitReason']);
         else markShard(shard, { waitReason: 'Pod 자리 대기' });
         return member;
       },
       release: (member: Parameters<PodPoolScheduler['release']>[0]) => poolScheduler.release(member),
     }) as unknown as PodPoolScheduler;
-    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
+    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string, hostRetries = 0): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
       // 파일별 소요는 junit 으로 남긴다 — 콘솔 요약(판정 원천)은 그대로이고, 느린 시험 목록(K10 D4)·계층 분리(D2)의 자가 된다.
       // GATE-TIMEOUT-HEAL: parts (each with its own junit) under a soft deadline inside this shard's own Job deadline.
       const shardDeadline = shardDeadlineSeconds(estimated(paths), deadlineSeconds);
@@ -910,6 +952,9 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       let jobExitCode: number | undefined;
       let lastFile: string | undefined;
       let jobFailed = false;
+      let jobError = '';
+      /** GATE-MULTI-HOST — the member this shard's Job was placed on (recorded in the shard json / log / board). */
+      let placedOn: string | undefined;
       let timedOut = false;
       let finished: string[] = [];
       let unfinishedLog: string | undefined;
@@ -960,7 +1005,8 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           } }) : undefined;
         const placed = admitted.release;
         const job = await podCommand({
-          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => { jobContext = member.context; placed(); }), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
+          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => { jobContext = member.context; placedOn = member.context; placed(); }), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
+          ...(multiHost ? { statusUnreadableMs: memberUnreadableSeconds * 1000 } : {}),
           ...(bunCache ? { bunCache } : {}),
           ...(installSlots > 0 ? { installSlots: POD_INSTALL_SLOTS_HOST_PATH } : {}),
           ...(pod.cpu ? { cpu: pod.cpu } : {}),
@@ -982,12 +1028,16 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           try { lastFile = lastStartedTestFile(jobLogTail(job).split(/\r?\n/).slice(-200).join('\n'), paths); }
           catch { /* Log retrieval is diagnostic; do not hide the stalled shard. */ }
         }
-      } catch {
+      } catch (error) {
         jobFailed = true;
+        jobError = error instanceof Error ? error.message : String(error);
       }
       // A launch that failed before placement still gives its admission back (release is idempotent).
       admitted?.release();
       const durationMs = Date.now() - start;
+      const fileSeconds = junit === undefined ? undefined : Object.fromEntries(readJunitFileSeconds(junit));
+      const testSeconds = fileSeconds === undefined ? undefined : Object.values(fileSeconds).reduce((sum, seconds) => sum + seconds, 0);
+      const podOverheadSeconds = testSeconds === undefined ? undefined : Math.max(0, durationMs / 1000 - testSeconds);
       // A reused shard keeps its files as they are — rewriting would replace the measured durationMs the next release plans by.
       if (logDir && !reused && !descent) {
         mkdirSync(logDir, { recursive: true });
@@ -1004,12 +1054,14 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (unfinishedLog !== undefined) writeFileSync(unfinishedDestination, unfinishedLog, { mode: 0o600 });
         else rmSync(unfinishedDestination, { force: true });
         writeFileSync(join(logDir, `pod-${shard}${branch}.json`), JSON.stringify({ durationMs, rc: rc ?? null,
-          ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed,
+          ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed, ...(placedOn ? { host: placedOn } : {}),
+          ...(fileSeconds !== undefined ? { fileSeconds, testSeconds, podOverheadSeconds } : {}),
           ...(admitted && admitted.outcome !== 'off' ? { admission: admitted.outcome, admissionWaitMs: admitted.waitedMs } : {}) }) + '\n', { mode: 0o600 });
       }
       const installSeconds = parseInstallSeconds(output ?? '');
       // GATE-TIMEOUT-HEAL ③: a cut shard is «reason: timeout» (with the files that still finished), not a bare rc=null.
-      if (!reused && !descent) debug.log('release-loop.gate', 'pod-shard', { shard, files: paths, durationMs, rc: rc ?? null, attempt: depth + 1, installSeconds, gateDeps: parseGateDeps(output ?? ''), deadlineSeconds: shardDeadline, parts: parts.length,
+      if (!reused && !descent) debug.log('release-loop.gate', 'pod-shard', { shard, files: paths, durationMs, rc: rc ?? null, attempt: depth + 1, installSeconds, gateDeps: parseGateDeps(output ?? ''), deadlineSeconds: shardDeadline, parts: parts.length, ...(placedOn ? { host: placedOn } : {}),
+        ...(testSeconds !== undefined ? { testSeconds } : {}),
         ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}) });
       if (!reused && !descent) markShard(shard, { ...(installSeconds !== null ? { installSec: installSeconds } : {}), ...(rc !== undefined ? { rc } : {}), ...(timedOut ? { state: 'timeout' as const } : {}) });
       let clean = output?.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
@@ -1064,6 +1116,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         debug.log('release-loop.gate', 'pod-shard-resume-miss', { shard, branch, reason });
         return runShard(paths, shard, depth, branch, retriedNoOutput, true, parentAttempt);
       }
+      // GATE-MULTI-HOST: the Job failed because its member is gone (launch failed · status unreadable) — not the shard's
+      // fault, so no split: the same files run again on the members left. Bounded by the roster size.
+      if (jobFailed && placedOn && hostRetries < poolScheduler.members.length && memberLost(placedOn, shard, jobError)
+        && poolScheduler.members.some((m) => !downMembers.has(m.context))) {
+        debug.log('release-loop.gate', 'pod-shard-host-retry', { shard, branch, files: paths.length, lostMember: placedOn, attempt: hostRetries + 1 }, { level: 'warn' });
+        return runShard(paths, shard, depth, `${branch}-h${hostRetries}`, retriedNoOutput, undefined, attemptId, hostRetries + 1);
+      }
       // GATE-TIMEOUT-HEAL ④: a Pod that died before any test ran (no outbox · jobExitCode≠0 — 0.2.19: isolated retries
       // ending with exit 5, the source checkout) gets the same one fresh retry as «no output» instead of stalling the sweep.
       // 137 (killed · OOM) keeps the isolation path: re-running an OOM file only re-measures the same kill.
@@ -1436,8 +1495,9 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         if (trustedKnown) knownFailures = [...trustedKnown.failures, ...(trustedKnown.errors ?? []), ...loadEnvKnownFailures(repo)];
       } catch (error) { debug.log('release-loop.gate', 'known-failures-unavailable', { error: String(error) }); }
     }
+    const durationSource = join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut');
     const cutRun = await runner.sweep(cutTree, join(root, 'release', opts.version, 'gate-logs', partial ? 'cut-partial' : 'cut'),
-      opts.pod ? { ...opts.pod, durationSource: join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut'), ...(knownFailures.length ? { knownFailures } : {}),
+      opts.pod ? { ...opts.pod, durationSource, ...(knownFailures.length ? { knownFailures } : {}),
         // GATE-LIVE-OBS: the release ledger's shards.json (UX #24782) — never the run tree's universe; an explicit
         // --ledger-root (tests) keeps it in that ledger.
         shardsFile: { path: opts.ledgerRoot ? gateShardsPath(opts.version, opts.ledgerRoot) : gateShardsPath(opts.version), version: opts.version } } : undefined,
@@ -1526,7 +1586,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         // K9b — the baseline is swept on the same Pod pool as the cut, not on this host (0.2.6: an hour of local baseline
         // after a 23-minute Pod cut).
         const baseRun = await runner.sweep(baseTree!, join(root, 'release', opts.version, 'gate-logs', 'baseline'),
-          opts.pod ? { ...opts.pod, durationSource: join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut') } : undefined,
+          opts.pod ? { ...opts.pod, durationSource } : undefined,
           present);
         baseline = await localStalled(baseRun, baseTree!, baseSha, 'baseline');
       } else baseline = { failures: [], errors: [] };

package/scripts/release-loop/gate-partial.ts

@@ -2,9 +2,13 @@
 // changed — not the whole 24-shard sweep again (0.2.18: two timeout fixes on top of an 84-minute gate meant another full
 // gate). The plan is opt-in (`release resume --from gate --partial`) and fail-closed: any non-test source change, a prior
 // gate record for another commit, or a missing record means «full gate», never a guess.
+// GATE-REUSE-BY-DIFF (0.2.25): a code change no longer forces the full sweep — with the tip's import closure
+// (gate-closure.ts) the plan adds every test that can reach a changed file, and every test whose closure is opaque.
+// `release resume --from gate` now plans this by default when the tip moved (`--no-partial` = full gate).
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
+import { CODE_FILE, type ClosureVerdict } from './gate-closure';
 
 export interface PartialPlan {
   version: string;
@@ -12,7 +16,7 @@ export interface PartialPlan {
   priorCommit: string;
   /** The commit this plan is for — a gate on any other commit ignores it. */
   forCommit: string;
-  /** Test files re-run: changed test files ⊕ files of the prior failures. */
+  /** Test files re-run: changed test files ⊕ files of the prior failures ⊕ tests reaching a changed code file. */
   files: string[];
   priorFailures: string[];
   priorErrors: string[];
@@ -37,19 +41,43 @@ export function testFileOfId(id: string): string {
 
 /** Decide whether a partial re-gate is safe for `changedFiles` (prior → for). Never guesses: any doubt is a full gate. */
 export function planPartialRegate(input: { version: string; priorCommit: string; forCommit: string; changedFiles: readonly string[];
-  priorFailures: readonly string[]; priorErrors: readonly string[] }):
-  { ok: true; plan: PartialPlan } | { ok: false; reason: string } {
+  priorFailures: readonly string[]; priorErrors: readonly string[];
+  /** GATE-REUSE-BY-DIFF: the tests reaching these changed code files (seeds include changed tests). Without it any
+   *  non-test change is a full gate. */
+  closure?: (changedCode: string[]) => ClosureVerdict;
+  /** Tracked at the tip — a deleted changed test is not re-run (nothing to run); a deleted prior-failure file is a full
+   *  gate (its failure can be neither re-measured nor carried). Without it every changed test is planned. */
+  existsAtTip?: (file: string) => boolean }):
+  { ok: true; plan: PartialPlan; closure?: { reached: number; opaque: number } } | { ok: false; reason: string } {
   if (!/^[0-9a-f]{40}$/i.test(input.priorCommit) || !/^[0-9a-f]{40}$/i.test(input.forCommit)) return { ok: false, reason: 'commit is not a full sha' };
   if (input.priorCommit === input.forCommit) return { ok: false, reason: 'no new commit since the prior gate' };
   const source = input.changedFiles.filter((file) => !TEST_FILE.test(file) && !isInert(file));
-  if (source.length) return { ok: false, reason: `non-test change → full gate: ${source.slice(0, 5).join(', ')}${source.length > 5 ? ` (+${source.length - 5})` : ''}` };
+  const list = (files: string[]) => `${files.slice(0, 5).join(', ')}${files.length > 5 ? ` (+${files.length - 5})` : ''}`;
+  // Only code is followed through the closure: a changed fixture, JSON, lockfile, config or script is a full gate.
+  const notCode = source.filter((file) => !CODE_FILE.test(file));
+  if (source.length && (!input.closure || notCode.length)) return { ok: false, reason: `non-test change → full gate: ${list(notCode.length ? notCode : source)}` };
+  let reaching: string[] = [];
+  let closure: { reached: number; opaque: number } | undefined;
+  if (source.length) {
+    let verdict: ClosureVerdict;
+    try { verdict = input.closure!(input.changedFiles.filter((file) => CODE_FILE.test(file))); }
+    catch (error) { return { ok: false, reason: `import closure unreadable → full gate: ${String(error instanceof Error ? error.message : error).slice(0, 200)}` }; }
+    if (!verdict.ok) return { ok: false, reason: verdict.reason };
+    const unsafe = verdict.tests.filter((file) => !TEST_FILE.test(file) || file.split('/').includes('..'));
+    if (unsafe.length) return { ok: false, reason: `closure selected a test path the plan cannot carry → full gate: ${list(unsafe)}` };
+    reaching = verdict.tests;
+    closure = { reached: verdict.reached, opaque: verdict.opaque };
+  }
   let failureFiles: string[];
   try { failureFiles = [...input.priorFailures, ...input.priorErrors].map(testFileOfId); }
   catch (error) { return { ok: false, reason: String(error instanceof Error ? error.message : error) }; }
-  const files = [...new Set([...input.changedFiles.filter((file) => TEST_FILE.test(file)), ...failureFiles])].sort();
+  const exists = input.existsAtTip ?? (() => true);
+  const gone = failureFiles.filter((file) => !exists(file));
+  if (gone.length) return { ok: false, reason: `prior failure file deleted at the tip → full gate: ${list(gone)}` };
+  const files = [...new Set([...input.changedFiles.filter((file) => TEST_FILE.test(file) && exists(file)), ...failureFiles, ...reaching])].sort();
   if (!files.length) return { ok: false, reason: 'nothing to re-run' };
   return { ok: true, plan: { version: input.version, priorCommit: input.priorCommit, forCommit: input.forCommit, files,
-    priorFailures: [...input.priorFailures], priorErrors: [...input.priorErrors] } };
+    priorFailures: [...input.priorFailures], priorErrors: [...input.priorErrors] }, ...(closure ? { closure } : {}) };
 }
 
 export function writePartialPlan(root: string, plan: PartialPlan): string {

package/scripts/release-loop/node-verdict.ts

@@ -48,9 +48,14 @@ export function lastResult(run: CommandResult): Record<string, unknown> | undefi
   } catch { return undefined; }
 }
 
-export function finishNode(node: string, version: string, result: Record<string, unknown> & { outcome: NodeOutcome; verdict: NodeVerdict; summary: string }): number {
+export function finishNode(node: string, version: string, result: Record<string, unknown> & { outcome: NodeOutcome; verdict: NodeVerdict; summary: string; tail?: string }): number {
   debug.log(`release-loop.${node}`, 'result', { version, outcome: result.outcome });
-  emitNodeResult(result);
+  if (result.outcome === 'fail') {
+    const summary = result.summary.replace(/[\r\n]+/g, ' ').trim();
+    const tail = result.tail?.trim() ? result.tail : summary;
+    debug.log('release.node', 'failed', { node, summary, tail });
+    emitNodeResult({ ...result, summary, tail });
+  } else emitNodeResult(result);
   return result.outcome === 'ok' ? 0 : result.outcome === 'fail' ? 1 : 2;
 }