elanous 0.2.28 → 0.2.31

package/scripts/release-loop/gate-node.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 import { spawn, spawnSync } from 'node:child_process';
 import { appendFileSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { hostname, tmpdir } from 'node:os';
 import { createHash, randomUUID } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
@@ -11,25 +11,43 @@ import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/res
 import { getElanousConfigDirOverride } from '../../src/elanous-config-dir.js';
 import { diffFailures, junitFailures, parseFailures, parseTimedOutFailures } from './gate-diff';
 import { loadEnvKnownFailures, splitKnownEnv } from './env-known-failures';
+import { loadGateBatchSafe } from './gate-batch-safe';
 import { baselineFromCutLogs } from './baseline-from-logs';
-import { mergePartialFailures, readPartialPlan, testFileOfId } from './gate-partial';
-import { logPlanWalltime, planDurations, planShards, readFileMemory } from './shard-plan';
+import { mergePartialFailures, readPartialPlan, testFileOfId, verifyDocsOnlyCarry } from './gate-partial';
+import { logPlanWalltime, planDurations, readFileMemory } from './shard-plan';
+import { defaultGateHostMirrorReaders, resolveGateHostMirror, type GateHostMirror, type GateHostMirrorReaders } from './gate-host-mirror';
+import { isGateSpawnLaneFile, planGateSpawnSeparatedShards } from './spawn-lane';
+import { GATE_POD_ENV_BASELINE, gateTestBaseline } from '../lib/gate-test-env.js';
+export { GATE_POD_ENV_BASELINE } from '../lib/gate-test-env.js';
 import { readJunitFileSeconds } from './gate-method';
 import { deriveCdpTestPatterns } from '../test-deterministic';
 import { emitNodeResult, readGraphContext } from './node-verdict.js';
 import { isGateExecutor, type GateExecutor } from './gate-executor.js';
-import { runPodCommand, parsePodCpu, resolvePodCpu, type RunPodCommandOptions, type PodCommandResult, type PodCpu } from '../../src/task-orchestrator/surfaces/pod-command-job.js';
+import { runPodCommand, parsePodCpu, podCpuMillis, resolvePodCpu, type RunPodCommandOptions, type PodCommandResult, type PodCpu } from '../../src/task-orchestrator/surfaces/pod-command-job.js';
 import { POD_BUN_CACHE_HOST_PATH, parseInstallSeconds, podBunCacheVolume } from '../../src/task-orchestrator/surfaces/pod-bun-cache.js';
 import { PodPoolScheduler, parsePodPool, checkPodPool, defaultRemoteRun, type PodPoolMember } from '../../src/task-orchestrator/surfaces/pod-pool.js';
 import { POD_INSTALL_SLOTS_DEFAULT, POD_INSTALL_SLOTS_HOST_PATH, installSlotScript } from '../../src/task-orchestrator/surfaces/pod-install-slots.js';
 import { gateDepsInstallScript, parseGateDeps } from '../../src/task-orchestrator/surfaces/pod-gate-deps.js';
+import { writeWarmJobManifest } from './gate-warm-artifacts.js';
 import { gateShardsPath, recordGateShardsVerdict, writeGateShards, type GateShard } from '../../src/release-loop/gate-shards.js';
 import { defaultKubectl } from '../../src/task-orchestrator/surfaces/self-implement-pod.js';
+import { executeTuiNodeCheck, type ExecutedTuiCheck } from './tui-node-checks.js';
+import { emitPodLifecycle, gatePodLifecycleEvent, gatePodOutcome } from '../../src/task-orchestrator/surfaces/pod-lifecycle-stages.js';
+import { gateHostReservationRoot, reserveReleaseGateHosts } from '../../src/release-loop/gate-host-reservation.js';
+import { normRoot } from '../../src/instance/resolve.js';
 
-interface CommandResult { rc: number; output: string; passedIds?: string[]; stalledEnv?: Array<{ file: string; reason: 'no-output' }>; timedOut?: boolean }
+interface CommandResult { rc: number; output: string; passedIds?: string[]; stalledEnv?: Array<{ file: string; reason: 'no-output' }>; timedOut?: boolean;
+  /** GATE-POD-STALL-FAILFAST ① — shard Pods whose tests the mid-run watch aborted in this sweep. */
+  abortedShards?: number;
+  /** Each contributing Pod leaf already passed failuresOf; repeated printed ids cannot add new failures. */
+  validatedShards?: boolean }
 export interface GateRunner {
   command(cmd: string, args: string[], cwd: string, limitMs?: number): Promise<CommandResult>;
   localCommand(cmd: string, args: string[], cwd: string, limitMs?: number): Promise<CommandResult>;
+  /** Run one isolated test on the same Pod image and pinned commit as the sweep. */
+  recheckPod?(file: string, commit: string, pod: NonNullable<GateOptions['pod']>, timeoutMs: number, relaxed?: boolean): Promise<CommandResult>;
+  /** One checkout/install for a small independent file group; each file retains its own rc and log. */
+  recheckPodBatch?(files: readonly string[], commit: string, pod: NonNullable<GateOptions['pod']>, timeoutMs: number): Promise<Map<string, CommandResult>>;
   /** `only` (GATE-PARTIAL) restricts the sweep to these test files; absent = every test file. */
   sweep(tree: string, logDir?: string, pod?: GateOptions['pod'], only?: readonly string[]): Promise<CommandResult>;
   add(tree: string, commit: string): Promise<void>;
@@ -52,13 +70,25 @@ export interface GateOptions {
   instanceRoot?: string;
   ledgerRoot?: string;
   repo?: string;
+  /** Rehearsal's opt-in screen measurement; normal release gates keep their existing defaults. */
+  rehearsalTui?: boolean;
+  /** Files per final recheck window; every window is measured (default 32). */
+  recheckFileLimit?: number;
   /** freshShards — GATE-SHARD-RESUME off: every shard starts a Pod even when this logDir already holds its result. */
   pod?: { pool: string; shards?: number; shardTimeoutSeconds?: number; durationSource?: string; bunCache?: string; freshShards?: boolean;
+    /** Maximum concurrent file-isolation fallback Jobs across the entire sweep; omitted = 4. */
+    isolationConcurrency?: number;
     /** GATE-SKIP-KNOWN-RETRY — failure ids the previous release already had (and env-known ones): a shard that fails only
      *  with these is not re-run in isolation; the verdict still classifies them against the baseline as before. */
     knownFailures?: readonly string[];
     /** GATE-SPEED A3① — shard Pod CPU request/limit (`release.loop.gatePodCpu`); omitted = request 1 / limit 4. */
     cpu?: PodCpu;
+    /** GATE-HOSTMIRROR-EXPLICIT — host Git mirror for every gate Pod (wins over env/config); omitted = resolved once per
+     *  runner by {@link resolveGateHostMirror} (env → config → operating config when isolated → none). */
+    hostMirror?: string;
+    /** GATE-HOSTMIRROR-EXPLICIT — injected readers (tests · embedders). Absent = the real ones; an injected pool without
+     *  them reads env only — never a real config from a test. */
+    hostMirrorReaders?: GateHostMirrorReaders;
     /** GATE-INSTALL-CACHE — concurrent `bun install`s per node (`release.loop.gatePodInstallSlots`); omitted = 4 · 0 = off. */
     installSlots?: number;
     /** GATE-MEM-ADMIT — seconds a shard waits for pool admission (memory headroom) before it launches anyway with
@@ -76,6 +106,13 @@ export interface GateOptions {
     stopJob?: (job: { name: string; context?: string }) => boolean | void;
     /** How often the stall watch reads the live log (ms); omitted = {@link GATE_POD_STALL_POLL_MS}. */
     stallPollMs?: number;
+    /** GATE-POD-STALL-FAILFAST ① — seconds a shard may go without its part logs growing once test output began, before
+     *  only its test process group is ended in the Pod (`gatePodMidRunStallSeconds`); omitted =
+     *  {@link GATE_POD_MIDRUN_STALL_SECONDS_DEFAULT} · 0 = off. Needs the stall watch (live log). */
+    midRunStallSeconds?: number;
+    /** GATE-POD-STALL-FAILFAST ① — injected in-Pod test abort (tests · embedders); false = not taken. Absent = `kubectl exec`
+     *  of {@link gateShardAbortScript} on the gate's own pool; an injected pool without it runs without the mid-run watch. */
+    abortTests?: (job: { name: string; context?: string }, reason: string) => boolean | void;
     /** GATE-LIVE-OBS — the shard state file (`gateShardsPath(version)`) this sweep keeps current; absent = not written. */
     shardsFile?: { path: string; version: string };
     /** GATE-MULTI-HOST — is this pool member reachable (kubectl ns ⊕ ssh)? Injected by tests; absent = the real probe on
@@ -83,7 +120,9 @@ export interface GateOptions {
     probeMember?: (member: PodPoolMember) => boolean;
     /** GATE-MULTI-HOST — seconds a placed shard's Job status may stay unreadable before the shard counts as lost with its
      *  member; omitted = {@link GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT}. Only a pool of two or more members uses it. */
-    memberUnreadableSeconds?: number };
+    memberUnreadableSeconds?: number;
+    /** GATE-WARM-BOOT-SCAN — observation only: the sweep's test selection (list · filter · duration plan · shard plan) time. */
+    onSelectionTimed?: (timed: { ms: number; files: number }) => void };
 }
 export interface GateResult {
   outcome: 'ok' | 'regression' | 'error';
@@ -96,12 +135,18 @@ export interface GateResult {
   knownEnvCleared: string[];
   stalledEnv: Array<{ file: string; reason: 'no-output' | 'isolated-timeout'; local: 'passed' | 'failed' | 'timeout' }>;
   rcNonzeroNoFailures: Array<{ file: string; rc: number; pass: number; baseline: 'same' | 'clean' | 'missing' }>;
+  /** Files left unmeasured after isolated recheck; these cannot seed a reusable baseline. */
+  unmeasuredRecheckFiles?: string[];
+  /** GATE-POD-STALL-FAILFAST ① — cut sweep shard Pods ended by the mid-run abort (their files went the timeout way). */
+  abortedShards?: number;
   baselineSource?: 'ledger' | 'instance' | 'cut-logs' | 'swept';
   /** GATE-BASELINE-CACHE — isolated baseline files answered from the ledger (hits) or run now (misses). */
   baselineCache?: { hits: number; misses: number };
   /** GATE-SPEED A4 — a swept baseline ran only the cut's failing files that exist at the previous release. */
   baselineDeferred?: { cutFiles: number; swept: number };
   durationMs: number;
+  /** GATE-WARM-BOOT-SCAN — observation only: the cut sweep's test selection time (pod sweep · absent otherwise). */
+  selectionMs?: number;
   error?: string;
   stalledShards?: Array<{ shard: number; files: string[]; reason: 'incomplete' | 'no-output' | 'job-failed' | 'exit-code' | 'unattributed' | 'timeout'; lastFile?: string; summaryFailures?: number; namedFailures?: number; detail?: string;
     /** GATE-POD-STALL-FAILFAST — the shard (and its one fresh retry) printed no test output within the stall window: unmeasured. */
@@ -112,6 +157,11 @@ export interface GateResult {
   /** GATE-INTRO-RECHECK — new failures that were only the «timed out» shape and passed one isolated re-run with a
    *  {@link GATE_TIMEOUT_RECHECK_MS} per-test limit: a warning (flaky under load), not an introduced regression. */
   loadFlaky?: string[];
+  /** File-level unhandled errors that reproduced or could not be measured in isolation. They keep the gate red. */
+  unmeasuredErrors?: Array<{ file: string; reason: 'reproduced' | 'timeout' | 'unreadable'; ids: string[] }>;
+  /** Shard-only unhandled errors whose file-level replay completed cleanly. */
+  interferenceErrors?: string[];
+  rehearsalTui?: ExecutedTuiCheck;
 }
 
 const sha = /^[0-9a-f]{7,40}$/i;
@@ -182,7 +232,6 @@ function unhandledErrorIds(output: string): string[] | undefined {
     if (/^# Unhandled error between tests/.test(raw.trim())) {
       if (!file) return undefined;
       errors.push(`${file} > [error]`);
-      file = undefined;
     }
   }
   return errors;
@@ -274,20 +323,72 @@ export function shardParts(paths: readonly string[], seconds: (file: string) =>
   if (current.length) parts.push(current);
   return parts;
 }
+/**
+ * GATE-ENV-BASELINE (W5 · 10-15) — the gate shard Pod's deterministic test env, exported before anything runs.
+ * 0.2.29 gate failures were the Pod's «environment», not the code: no LLM provider · `man` stubbed · CLI spawn timeouts.
+ * - `TZ=UTC` — the value `bun test` already uses when TZ is unset; pinned so a later image (or a shell profile) cannot move it.
+ * - `LANG`/`LC_ALL=C.UTF-8` — the image sets no locale (POSIX); C.UTF-8 ships with glibc, so no image rebuild.
+ * - `ELANOUS_TEST_FAKE_LLM=1` — the shared switch for the fake LLM provider. Its reader (UX device #27790) is not on main
+ *   yet; until it lands the switch changes nothing. The reader yields to an explicit provider/endpoint, so a spawned CLI
+ *   test that injects its own stub keeps it.
+ * Retries, splits and file isolation all re-enter `runShard`, which builds every Pod shell here — they carry it too.
+ * Provider keys are not set here on purpose: `test:deterministic` strips every credential-shaped key
+ * (`scripts/lib/deterministic-env.ts` `isCredentialKey`), so a test never reaches a real provider from the Pod.
+ * Binaries the image lacks (`man` pages — `git <sub> --help`) are not fixed here; see MANUAL-gate-regression-response-recipe §2a.
+ */
+export function gateEnvBaselineLine(env: Readonly<Record<string, string>> = gateTestBaseline(process.env)): string {
+  return `export ${Object.entries(env).map(([key, value]) => `${key}=${quote(value)}`).join(' ')}`;
+}
 /**
  * The shard's Pod shell. Install once (behind the node's install slots), then run each part under the soft deadline,
  * leaving `install.log`/`install.rc`, `part-<i>.log`/`.rc`/`.junit.xml`, and `shard.timeout` (the part index) when the
- * deadline cut the shard. A part without `.rc` did not finish. The shell itself always exits 0 (as before).
+ * deadline cut the shard. Real child/PTY parts have an additional 120 s test limit; a cap hit also writes
+ * `shard.timeout` so the artifact reader does not mistake an unfinished child for a test verdict.
+ * A part without `.rc` did not finish. The shell itself always exits 0 (as before).
  */
-export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPatterns: readonly string[]; softSeconds: number; cachePrefix: string; installSlots: number; depsDir?: string; beatSeconds?: number }): string {
-  const run = o.parts.map((part, index) => {
+export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPatterns: readonly string[]; softSeconds: number; cachePrefix: string; installSlots: number; depsDir?: string; beatSeconds?: number; parallelParts?: number; testTimeoutMs?: number; partLimitSeconds?: number; sourceBinding?: { cutSha: string; attemptId: string } }): string {
+  // The planner keeps spawn files in their own shards; reject a mixed part rather than silently lose its limit.
+  for (const part of o.parts) {
+    if (part.some(isGateSpawnLaneFile) && !part.every(isGateSpawnLaneFile)) throw new Error('gate spawn lane part mixed with regular tests');
+  }
+  const spawnParts = o.parts.flatMap((part, index) => part.length && part.every(isGateSpawnLaneFile) ? [index] : []);
+  const commands = o.parts.map((part, index) => {
     const ignores = o.cdpPatterns.filter((pattern) => part.includes(pattern)).flatMap((pattern) => ['--path-ignore-patterns', pattern]);
-    return `run_part ${index} ${['bun', 'run', 'test:deterministic', ...ignores, ...part.map(asPath)].map(quote).join(' ')}`;
-  }).join(' && ');
+    // One-file runs keep named pass lines so their JUnit identities can be
+    // cross-checked. The package script's --dots removes those names.
+    const runner = part.length === 1 ? ['bun', 'run', 'scripts/test-deterministic.ts'] : ['bun', 'run', 'test:deterministic'];
+    // Bash scopes this assignment to run_part; the mixed-part shell test
+    // checks that a following multi-file part gets no source tag. The common
+    // run_part body changes the shell hash once for this feature; keeping the
+    // multi-file invocation unchanged avoids another cache-key change.
+    const warmFile = part.length === 1 ? `WARM_REFERENCE_FILE=${quote(part[0]!)} ` : '';
+    return `${warmFile}run_part ${index} ${[...runner, ...(o.testTimeoutMs !== undefined ? ['--timeout', String(o.testTimeoutMs)] : spawnParts.includes(index) ? ['--timeout=120000'] : []), ...ignores, ...part.map(asPath)].map(quote).join(' ')}`;
+  });
+  // Only file-isolation batches use this path. A bounded group shares one clone/install, but every test process gets
+  // its own HOME, state and tmp directory; part logs/JUnit remain separate and the existing artifact reader judges them.
+  const width = Math.max(1, Math.floor(o.parallelParts ?? 1));
+  const isolateParts = o.parallelParts !== undefined;
+  const run = width === 1 ? commands.join(' && ') : Array.from({ length: Math.ceil(commands.length / width) }, (_, group) => [
+    ...commands.slice(group * width, (group + 1) * width).map((line) => `(${line}) & pids+=("$!")`),
+    'for pid in "${pids[@]}"; do wait "$pid" || true; done; pids=()',
+  ].join('; ')).join('; ');
   return [
     'mkdir -p "$HOME/outbox"; O="$HOME/outbox"',
+    'stage_at() { printf "%s\\t%s\\n" "$1" "$2" >> "$O/stages.tsv"; }',
+    'stage() { stage_at "$(date +%s)" "$1"; }',
+    // This shell's first moment, captured before anything else runs so clone-end/shell-start keep their meaning.
+    'shell_t=$(date +%s)',
+    // Boot stages only: the container's age at shell entry. gate_end below keeps reading pod_age at its own spot.
+    `boot_age=$(awk -v t="$(cut -d' ' -f22 /proc/1/stat 2>/dev/null)" -v hz="$(getconf CLK_TCK 2>/dev/null)" '{ if (t > 0 && hz > 0) print int($1 - t / hz); else print 0 }' /proc/uptime 2>/dev/null)`,
+    'case "$boot_age" in ""|*[!0-9]*) boot_age=0;; esac',
+    // GATE-WARM-BOOT-STAGES: boot on the Pod's own clock — prep start = the child container's PID 1 (none when the age is
+    // unknown, never a guess), clone end = this shell's first line (the source checkout runs right before it).
+    'if [ "$boot_age" -gt 0 ]; then stage_at "$(( shell_t - boot_age ))" prep-start; fi',
+    'stage_at "$shell_t" clone-end',
+    'stage_at "$shell_t" shell-start',
     ...(o.beatSeconds ? gateBeatScript(o.beatSeconds, o.installSlots > 0) : []),
     ...(o.cachePrefix ? [o.cachePrefix] : []),
+    gateEnvBaselineLine(),
     // Seconds since this container's PID 1 started (the clone ran before this shell) — 0 when /proc cannot tell.
     `pod_age=$(awk -v t="$(cut -d' ' -f22 /proc/1/stat 2>/dev/null)" -v hz="$(getconf CLK_TCK 2>/dev/null)" '{ if (t > 0 && hz > 0) print int($1 - t / hz); else print 0 }' /proc/uptime 2>/dev/null)`,
     'case "$pod_age" in ""|*[!0-9]*) pod_age=0;; esac',
@@ -295,19 +396,52 @@ export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPa
     ...(o.installSlots > 0 ? [installSlotScript({ slots: o.installSlots })] : []),
     'run_part() {',
     '  local i=$1; shift',
+    ...(spawnParts.length ? ['  local spawn_part=0', `  case "$i" in ${spawnParts.join('|')}) spawn_part=1;; esac`] : []),
+    '  stage "part-$i-start"',
+    ...(isolateParts ? [
+      '  local isolated; isolated=$(mktemp -d /tmp/gate-isolate.XXXXXX) || return 1',
+      '  mkdir -p "$isolated/home" "$isolated/tmp" "$isolated/state" "$isolated/config" "$isolated/cache" "$isolated/data" "$isolated/xdg-state"',
+      '  local source_repo="$PWD"',
+      '  local -a run_env=(env HOME="$isolated/home" TMPDIR="$isolated/tmp" ELANOUS_STATE_DIR="$isolated/state" XDG_CONFIG_HOME="$isolated/config" XDG_CACHE_HOME="$isolated/cache" XDG_DATA_HOME="$isolated/data" XDG_STATE_HOME="$isolated/xdg-state")',
+      '  stage "part-$i-setup-start"',
+      '  local source_sha; source_sha=$(git rev-parse HEAD) || return 1',
+      '  if ! "${run_env[@]}" git clone --shared --quiet --no-checkout "$source_repo" "$isolated/repo" > "$O/part-$i.setup.log" 2>&1 || ! "${run_env[@]}" git -C "$isolated/repo" checkout --detach --quiet "$source_sha" >> "$O/part-$i.setup.log" 2>&1; then cat "$O/part-$i.setup.log" > "$O/part-$i.log"; rm -rf "$isolated"; return 1; fi',
+      '  ln -s "$source_repo/node_modules" "$isolated/repo/node_modules"',
+      '  if [ -d "$source_repo/apps/pwa/node_modules" ]; then ln -s "$source_repo/apps/pwa/node_modules" "$isolated/repo/apps/pwa/node_modules"; fi',
+      '  cd "$isolated/repo" || return 1',
+      '  stage "part-$i-setup-end"',
+    ] : ['  local -a run_env=()']),
     '  local left=$(( gate_end - $(date +%s) ))',
     '  if [ "$left" -le 0 ]; then echo "$i" > "$O/shard.timeout"; return 1; fi',
-    '  timeout -k 10 "$left" "$@" --reporter=junit --reporter-outfile="$O/part-$i.junit.xml" > "$O/part-$i.log" 2>&1',
+    ...(spawnParts.length ? ['  if [ "$spawn_part" -eq 1 ] && [ "$left" -gt 120 ]; then left=120; fi'] : []),
+    ...(o.partLimitSeconds ? [`  if [ "$left" -gt ${o.partLimitSeconds} ]; then left=${o.partLimitSeconds}; fi`] : []),
+    '  stage "part-$i-test-start"',
+    ...(spawnParts.length ? ['  local test_start; test_start=$(date +%s)'] : []),
+    `  { if [ -n "\${WARM_REFERENCE_FILE:-}" ]; then printf "[warm-worker] file=%s\\n" "$WARM_REFERENCE_FILE"; ${o.sourceBinding ? `printf "[warm-worker] cut=%s attempt=%s\\n" ${quote(o.sourceBinding.cutSha)} ${quote(o.sourceBinding.attemptId)}; ` : ''}fi; "\${run_env[@]}" timeout -k 10 "$left" "$@" --reporter=junit --reporter-outfile="$O/part-$i.junit.xml"; } > "$O/part-$i.log" 2>&1`,
     '  local prc=$?',
+    '  if [ -n "${WARM_REFERENCE_FILE:-}" ] && [ -f "$O/part-$i.junit.xml" ]; then',
+    '    local junit_sha; junit_sha=$(sha256sum "$O/part-$i.junit.xml" 2>/dev/null | awk \'{print $1}\')',
+    '    if [ -z "$junit_sha" ]; then junit_sha=$(shasum -a 256 "$O/part-$i.junit.xml" 2>/dev/null | awk \'{print $1}\'); fi',
+    '    if [[ "$junit_sha" =~ ^[a-f0-9]{64}$ ]]; then printf "[warm-worker] junit-sha256=%s\\n" "$junit_sha" >> "$O/part-$i.log"; fi',
+    '  fi',
+    ...(o.partLimitSeconds ? ['  if [ "$prc" -eq 124 ] || [ "$prc" -eq 137 ]; then echo "$i" > "$O/part-$i.timeout"; fi'] : []),
+    ...(spawnParts.length ? ['  local test_end; test_end=$(date +%s)'] : []),
+    '  stage "part-$i-test-end"',
+    ...(isolateParts ? ['  stage "part-$i-cleanup-start"', '  cd "$source_repo"', '  rm -rf "$isolated"', '  stage "part-$i-cleanup-end"'] : []),
+    '  stage "part-$i-end"',
+    ...(spawnParts.length ? ['  if [ "$spawn_part" -eq 1 ] && { [ "$prc" -eq 124 ] || { [ "$test_end" -ge "$(( test_start + left ))" ] && { [ "$prc" -eq 137 ] || [ "$prc" -eq 143 ]; }; }; }; then echo "$i" > "$O/shard.timeout"; return 1; fi'] : []),
     '  if [ "$(date +%s)" -ge "$gate_end" ] && { [ "$prc" -eq 124 ] || [ "$prc" -eq 137 ] || [ "$prc" -eq 143 ]; }; then echo "$i" > "$O/shard.timeout"; return 1; fi',
     '  echo "$prc" > "$O/part-$i.rc"',
     '}',
     'if cd .. && cd repo; then',
+    '  stage deps-start',
     // GATE-IMAGE-DEPS: link the image's baked node_modules when the lockfiles match; only a miss installs (behind a slot).
     ...gateDepsInstallScript({ log: '"$O/install.log"', installSlots: o.installSlots, ...(o.depsDir ? { depsDir: o.depsDir } : {}) }).split('\n').map((line) => `  ${line}`),
     '  echo "$irc" > "$O/install.rc"',
-    `  if [ "$irc" -eq 0 ]; then ${run || 'true'}; fi`,
+    '  stage deps-end',
+    `  if [ "$irc" -eq 0 ]; then stage test-start; ${width > 1 ? 'pids=(); ' : ''}${run || 'true'}; stage test-end; fi`,
     'else echo 5 > "$O/install.rc"; fi',
+    'stage shell-end',
     'true',
   ].join('\n');
 }
@@ -317,6 +451,9 @@ export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPa
  * shards ran to their 1697 s deadline with `finishedFiles: 0`, then retries and splits did the same for 2h+ and the node
  * never finished. The beat lets the host see «no test output yet» while the Job runs:
  * `ELANOUS_GATE_BEAT <seq> <slot|install|test> <0|1>` — the last field is 1 once any part log has a byte.
+ * GATE-POD-STALL-FAILFAST ① (mid-run): once there is test output the beat adds the part logs' total bytes —
+ * `ELANOUS_GATE_BEAT <seq> test 1 <bytes>` — so the host can see output stop after it started. The old 4-field line is
+ * still read (no bytes = no mid-run watch).
  * It is observation only: the host hashes the shell without it into `runKey`.
  */
 export function gateBeatScript(beatSeconds: number, installSlots: boolean): string[] {
@@ -324,13 +461,13 @@ export function gateBeatScript(beatSeconds: number, installSlots: boolean): stri
     'gate_beat() {',
     '  local n=0 st t f',
     '  while :; do',
-    '    n=$((n + 1)); t=0',
-    '    for f in "$O"/part-*.log; do if [ -s "$f" ]; then t=1; break; fi; done',
+    '    n=$((n + 1)); t=0; b=0',
+    '    for f in "$O"/part-*.log; do if [ -s "$f" ]; then t=1; b=$(( b + $(wc -c < "$f" 2>/dev/null || echo 0) )); fi; done',
     '    if [ -f "$O/install.rc" ]; then st=test',
     // A deps miss with no slot line yet = waiting for an install slot (bounded by the slot script; not a stall).
     ...(installSlots ? ["    elif [ -f \"$O/install.log\" ] && grep -q '^\\[gate\\] deps .* miss' \"$O/install.log\" 2>/dev/null && ! grep -q '^\\[gate\\] install-slot' \"$O/install.log\" 2>/dev/null; then st=slot"] : []),
     '    else st=install; fi',
-    '    echo "ELANOUS_GATE_BEAT $n $st $t"',
+    '    if [ "$t" = 1 ]; then echo "ELANOUS_GATE_BEAT $n $st $t $b"; else echo "ELANOUS_GATE_BEAT $n $st $t"; fi',
     `    sleep ${Math.max(1, Math.floor(beatSeconds))} >/dev/null 2>&1 </dev/null`,
     '  done',
     '}',
@@ -343,30 +480,94 @@ export const GATE_POD_STALL_SECONDS_DEFAULT = 300;
 export const GATE_POD_STALL_POLL_MS = 15_000;
 /** At least ten beats per stall window, never slower than one per 30 s. */
 export const gateStallBeatSeconds = (stallSeconds: number) => Math.min(30, Math.max(1, Math.floor(stallSeconds / 10)));
-export interface ShardLiveLog { checkout: boolean; beat?: { seq: number; stage: 'slot' | 'install' | 'test'; testOutput: boolean } }
+export interface ShardLiveLog { checkout: boolean; beat?: { seq: number; stage: 'slot' | 'install' | 'test'; testOutput: boolean;
+  /** Part logs' total bytes (mid-run progress) — absent on the old beat line. */
+  bytes?: number } }
 /** What the Pod's live stdout says so far: the source checkout line and the latest beat. */
 export function readShardLiveLog(text: string): ShardLiveLog {
   let checkout = false;
   let beat: ShardLiveLog['beat'];
   for (const line of text.split(/\r?\n/)) {
     if (/^ELANOUS_POD_SOURCE (?:commit|default|pr) /.test(line)) checkout = true;
-    const match = /^ELANOUS_GATE_BEAT (\d+) (slot|install|test) ([01])\s*$/.exec(line);
-    if (match) beat = { seq: Number(match[1]), stage: match[2] as 'slot' | 'install' | 'test', testOutput: match[3] === '1' };
+    const match = /^ELANOUS_GATE_BEAT (\d+) (slot|install|test) ([01])(?: (\d+))?\s*$/.exec(line);
+    if (match) beat = { seq: Number(match[1]), stage: match[2] as 'slot' | 'install' | 'test', testOutput: match[3] === '1',
+      ...(match[4] !== undefined ? { bytes: Number(match[4]) } : {}) };
   }
   return { checkout, ...(beat ? { beat } : {}) };
 }
+
+/** Kubernetes clock boundaries for scheduling and init. Child start → shell-start includes source checkout and setup. */
+export function readGatePodLifecycle(text: string): Record<string, string> {
+  try {
+    const pod = (JSON.parse(text) as { items?: Array<{ metadata?: { creationTimestamp?: string }; status?: {
+      conditions?: Array<{ type?: string; lastTransitionTime?: string }>;
+      initContainerStatuses?: Array<{ name?: string; state?: { terminated?: { startedAt?: string; finishedAt?: string } } }>;
+      containerStatuses?: Array<{ name?: string; state?: { terminated?: { startedAt?: string; finishedAt?: string } } }>;
+    } }> }).items?.[0];
+    if (!pod) return {};
+    const out: Record<string, string> = {};
+    const put = (key: string, value?: string) => { if (value && Number.isFinite(Date.parse(value))) out[key] = value; };
+    put('podCreated', pod.metadata?.creationTimestamp);
+    put('podScheduled', pod.status?.conditions?.find((item) => item.type === 'PodScheduled')?.lastTransitionTime);
+    for (const item of pod.status?.initContainerStatuses ?? []) {
+      if (!item.name || !/^[a-z0-9-]+$/.test(item.name)) continue;
+      put(`init-${item.name}-start`, item.state?.terminated?.startedAt);
+      put(`init-${item.name}-end`, item.state?.terminated?.finishedAt);
+    }
+    const child = pod.status?.containerStatuses?.find((item) => item.name === 'child');
+    put('childStart', child?.state?.terminated?.startedAt);
+    put('childEnd', child?.state?.terminated?.finishedAt);
+    return out;
+  } catch { return {}; }
+}
+/** Seconds with at least one isolated test process running; setup gaps between parallel groups remain overhead. */
+export function gateBatchTestWallSeconds(stages: Record<string, number> | undefined, partCount: number): number | undefined {
+  if (!stages || partCount < 1) return undefined;
+  const spans: Array<[number, number]> = [];
+  for (let index = 0; index < partCount; index++) {
+    const start = stages[`part-${index}-test-start`];
+    const end = stages[`part-${index}-test-end`];
+    if (!Number.isFinite(start) || !Number.isFinite(end) || end! < start!) return undefined;
+    spans.push([start!, end!]);
+  }
+  spans.sort((a, b) => a[0] - b[0]);
+  let covered = 0;
+  let [from, to] = spans[0]!;
+  for (const [start, end] of spans.slice(1)) {
+    if (start <= to) to = Math.max(to, end);
+    else { covered += to - from; from = start; to = end; }
+  }
+  return covered + to - from;
+}
 /**
  * GATE-POD-STALL-FAILFAST — watches one running shard Job. Armed once the source checkout line is seen; disarmed for good
  * the moment any test output exists (that shard then behaves exactly as before). Stalled = `stallSeconds` since the
  * checkout with no test output, not counting time the beat reported an install-slot wait. A silent shell (no beat at all)
  * counts like any other stage. Only successful reads decide; a read failure never stalls a shard. `graceMs` covers the
  * beat's report lag: output that appeared just inside the window is reported by the next beat before the stop decides.
+ *
+ * GATE-POD-STALL-FAILFAST ① (mid-run): with `midRunStallSeconds` > 0 and an `abortTests`, the watch does not end at the
+ * first test output when the beat carries the part logs' bytes. It keeps the time the bytes last changed; no change for
+ * `midRunStallSeconds` (⊕ grace) = a mid-run hang: `onAbort`, then `abortTests` ends only the test process group in the
+ * Pod (never the Job — Job backoffLimit 0). One abort per watch; a beat without bytes (old shell) ends the watch as before.
  */
 export function watchShardStall(o: { stallSeconds: number; pollMs: number; read: () => string | null; onStall: (sinceCheckoutMs: number) => void; now?: () => number; graceMs?: number;
   /** Stops the Job; false = not taken, asked again every poll until it is or the watch ends (a stalled Job must not run to its deadline). */
-  stopJob?: () => boolean | void }): { stop(): void; stalled(): { sinceCheckoutMs: number } | undefined } {
+  stopJob?: () => boolean | void;
+  /** Mid-run hang window in seconds (0 / absent = off). */
+  midRunStallSeconds?: number;
+  onAbort?: (info: { sinceLastOutputMs: number }) => void;
+  /** Ends the Pod's test process group; false = not taken, asked again on the next polls (at most {@link GATE_SHARD_ABORT_TRIES}). */
+  abortTests?: () => boolean | void }): { stop(): void; stalled(): { sinceCheckoutMs: number } | undefined; aborted(): ShardAbort | undefined; state(): ShardStallWatchState } {
   const now = o.now ?? Date.now;
+  const midRunMs = o.midRunStallSeconds && o.midRunStallSeconds > 0 && o.abortTests ? o.midRunStallSeconds * 1000 : 0;
+  /** Mid-run phase: the last bytes the beat reported and when they last changed. */
+  let midRun: { bytes: number; changedAt: number } | undefined;
+  let abort: ShardAbort | undefined;
+  let abortTries = 0;
   let checkoutAt: number | undefined;
+  /** Observation only (GATE-WARM-BOOT-SCAN): when the first test output was seen, relative to the checkout. */
+  let firstTestAt: { checkout: number; at: number } | undefined;
   let windowStart: number | undefined;
   let lastSeq: number | undefined;
   let hit: { sinceCheckoutMs: number } | undefined;
@@ -380,6 +581,15 @@ export function watchShardStall(o: { stallSeconds: number; pollMs: number; read:
     try { taken = o.stopJob ? o.stopJob() : true; } catch { taken = false; }
     if (taken === false && !ended) timer = setTimeout(askStop, o.pollMs);
   };
+  const askAbort = () => {
+    timer = undefined;
+    if (ended) return;
+    abortTries++;
+    let taken: boolean | void = false;
+    try { taken = o.abortTests!(); } catch { taken = false; }
+    if (taken !== false && abort) abort.taken = true;
+    if (taken === false && !ended && abortTries < GATE_SHARD_ABORT_TRIES) timer = setTimeout(askAbort, o.pollMs);
+  };
   const tick = () => {
     timer = undefined;
     if (done) return;
@@ -389,7 +599,31 @@ export function watchShardStall(o: { stallSeconds: number; pollMs: number; read:
     if (text !== null) {
       const t = now();
       const live = readShardLiveLog(text);
-      if (live.beat?.testOutput) { done = true; return; }
+      if (midRun) {
+        // A beat without bytes (cannot judge progress) ends the mid-run watch; a failed or empty read decides nothing.
+        if (live.beat?.testOutput && live.beat.bytes === undefined) { done = true; return; }
+        if (live.beat?.bytes !== undefined && live.beat.bytes !== midRun.bytes) midRun = { bytes: live.beat.bytes, changedAt: t };
+        else if (t - midRun.changedAt >= midRunMs + (o.graceMs ?? 0)) {
+          done = true;
+          abort = { reason: `mid-run-stall ${o.midRunStallSeconds}s`, at: new Date().toISOString(), by: 'auto', sinceLastOutputMs: t - midRun.changedAt, taken: false };
+          try { o.onAbort?.({ sinceLastOutputMs: abort.sinceLastOutputMs }); } catch { /* observation only */ }
+          askAbort();
+          return;
+        }
+        timer = setTimeout(tick, o.pollMs);
+        return;
+      }
+      if (live.beat?.testOutput) {
+        const seenCheckout = checkoutAt ?? (live.checkout ? t : undefined);
+        if (seenCheckout !== undefined) firstTestAt = { checkout: seenCheckout, at: t };
+        if (midRunMs && live.beat.bytes !== undefined) {
+          midRun = { bytes: live.beat.bytes, changedAt: t };
+          timer = setTimeout(tick, o.pollMs);
+          return;
+        }
+        done = true;
+        return;
+      }
       if (live.checkout && checkoutAt === undefined) { checkoutAt = t; windowStart = t; }
       if (live.beat && live.beat.seq !== lastSeq) {
         lastSeq = live.beat.seq;
@@ -406,7 +640,69 @@ export function watchShardStall(o: { stallSeconds: number; pollMs: number; read:
     timer = setTimeout(tick, o.pollMs);
   };
   timer = setTimeout(tick, o.pollMs);
-  return { stop: () => { done = true; ended = true; if (timer) clearTimeout(timer); }, stalled: () => hit };
+  return { stop: () => { done = true; ended = true; if (timer) clearTimeout(timer); }, stalled: () => hit, aborted: () => abort,
+    state: () => ({ armed: checkoutAt !== undefined || firstTestAt !== undefined,
+      disarmedBy: hit ? 'stall-fired' : abort ? 'mid-run-stall' : firstTestAt ? 'test-output' : null,
+      firstTestAtSec: firstTestAt ? Math.round((firstTestAt.at - firstTestAt.checkout) / 100) / 10 : null,
+      ...(abort ? { abort: { reason: abort.reason, at: abort.at, by: abort.by } } : {}) }) };
+}
+/** GATE-POD-STALL-FAILFAST ① — a mid-run abort: why (`mid-run-stall <N>s`), when, who (`auto`; a manual knob is slice 2). */
+export type ShardAbort = { reason: string; at: string; by: 'auto'; sinceLastOutputMs: number;
+  /** The in-Pod abort was taken (false = every try failed — the Job then runs to its deadline as before). */
+  taken: boolean };
+/** How many polls ask the in-Pod abort before giving up (the Job then runs to its deadline as before). */
+export const GATE_SHARD_ABORT_TRIES = 3;
+/** GATE-POD-STALL-FAILFAST ① — default mid-run hang window: well under a shard deadline (≈1500 s+), far over one test's limit. */
+export const GATE_POD_MIDRUN_STALL_SECONDS_DEFAULT = 600;
+/** Seconds between the in-Pod TERM and KILL of the test process group. */
+export const GATE_SHARD_ABORT_GRACE_SECONDS = 10;
+/** What one shard's stall watch saw — armed (checkout seen) · why it ended · first test output seconds after the checkout. */
+export type ShardStallWatchState = { armed: boolean; disarmedBy: 'test-output' | 'stall-fired' | 'mid-run-stall' | null; firstTestAtSec: number | null;
+  abort?: Omit<ShardAbort, 'sinceLastOutputMs' | 'taken'> };
+/**
+ * GATE-POD-STALL-FAILFAST ① — run inside the shard Pod (`kubectl exec … bash -c`): ends only the running test process
+ * groups — the group led by a process whose argv carries `--reporter-outfile=…/outbox/part-<i>.junit.xml` (GNU `timeout`
+ * leads its own group) — TERM now, KILL after the grace. It never signals PID 1's group or its own. Before the signal it
+ * leaves `part-<i>.abort` (the reason) and `shard.timeout`, so the outbox reads like a deadline cut of that part
+ * ({@link readShardArtifacts}: unfinished, timed out) while the shell finishes the remaining parts and its outbox.
+ * Exit 0 = at least one group signalled.
+ */
+export function gateShardAbortScript(reason: string, graceSeconds = GATE_SHARD_ABORT_GRACE_SECONDS,
+  /** Only this outbox's parts (tests: never another run's groups on the same machine); absent = any `…/outbox/` in the Pod. */
+  outbox?: string): string {
+  return [
+    `reason=${quote(reason.replace(/[^\w .:-]/g, '_'))}`,
+    `only=${quote(outbox ?? '')}`,
+    "pg_of() { sed 's/^.*) //' \"/proc/$1/stat\" 2>/dev/null | cut -d' ' -f3; }",
+    'root_pg=$(pg_of 1); my_pg=$(pg_of $$); found=0',
+    'for d in /proc/[0-9]*; do',
+    '  pid=${d#/proc/}',
+    "  out=$(tr '\\0' '\\n' < \"$d/cmdline\" 2>/dev/null | grep -m1 -E '^--reporter-outfile=.*/outbox/part-[0-9]+\\.junit\\.xml$') || continue",
+    '  if [ -n "$only" ]; then case "$out" in "--reporter-outfile=$only/part-"*) ;; *) continue;; esac; fi',
+    '  pg=$(pg_of "$pid")',
+    '  case "$pg" in ""|*[!0-9]*) continue;; esac',
+    '  if [ "$pg" != "$pid" ] || [ "$pg" -le 1 ] || [ "$pg" = "$root_pg" ] || [ "$pg" = "$my_pg" ]; then continue; fi',
+    '  out=${out#--reporter-outfile=}; dir=${out%/part-*}; part=${out##*/part-}; part=${part%.junit.xml}',
+    '  printf "%s\\n" "$reason" > "$dir/part-$part.abort"',
+    '  [ -f "$dir/shard.timeout" ] || echo "$part" > "$dir/shard.timeout"',
+    '  if kill -TERM -- "-$pg" 2>/dev/null; then found=$((found + 1)); echo "ELANOUS_GATE_ABORT part=$part pgid=$pg"; fi',
+    `  ( sleep ${Math.max(1, Math.floor(graceSeconds))}; kill -KILL -- "-$pg" 2>/dev/null ) >/dev/null 2>&1 </dev/null &`,
+    'done',
+    'echo "ELANOUS_GATE_ABORT signalled=$found"',
+    '[ "$found" -gt 0 ]',
+  ].join('\n');
+}
+/** The shard json's `stallWatch` record (observation only — never read by any judgment). */
+export type ShardStallWatchRecord = Omit<ShardStallWatchState, 'disarmedBy'> & { disarmedBy: ShardStallWatchState['disarmedBy'] | 'off' | 'no-live-log'; stallSeconds: number };
+export function shardStallWatchRecord(stallSeconds: number, hasLiveLog: boolean, state: ShardStallWatchState | undefined): ShardStallWatchRecord {
+  if (!(stallSeconds > 0)) return { armed: false, disarmedBy: 'off', firstTestAtSec: null, stallSeconds };
+  if (!hasLiveLog) return { armed: false, disarmedBy: 'no-live-log', firstTestAtSec: null, stallSeconds };
+  return { ...(state ?? { armed: false, disarmedBy: null, firstTestAtSec: null }), stallSeconds };
+}
+/** GATE-WARM-BOOT-SCAN — logs the selection time and hands it to the caller; an observer failure never stops the sweep. */
+export function reportSelectionTimed(ms: number, files: number, observer?: (timed: { ms: number; files: number }) => void): void {
+  debug.log('release-loop.gate', 'selection-timed', { ms, files });
+  try { observer?.({ ms, files }); } catch { /* observation only */ }
 }
 /** Removes bun's own summary lines so one summary over several runs can follow (same rule as the sweep's merge). */
 const stripSummary = (output: string) => output.replace(/(?:^|\n)\s*\d+ (?:pass|fail|errors?)\s*(?=\n|$)/g, '\n').replace(/Ran \d+ tests? across \d+ files?\.?/g, '');
@@ -447,6 +743,13 @@ export function readShardArtifacts(dir: string, parts: readonly (readonly string
     const log = read(`part-${index}.log`);
     const rc = rcOf(read(`part-${index}.rc`));
     const clean = log?.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
+    // GATE-POD-STALL-FAILFAST ① — a part the mid-run abort ended reads like a deadline cut: unfinished, its exit (143/137) no verdict.
+    const abort = read(`part-${index}.abort`);
+    if (abort !== undefined) {
+      bad.push(`# part ${index} (abort: ${abort.trim()})\n${log ?? ''}`);
+      otherBad = true;
+      return;
+    }
     if (clean !== undefined && (rc === 0 || rc === 1) && lastMatch(clean, /Ran (\d+) tests? across (\d+) files?/)) {
       const junit = read(`part-${index}.junit.xml`);
       good.push({ log: clean, rc, files, ...(junit !== undefined ? { junit } : {}) });
@@ -480,6 +783,9 @@ export function readShardArtifacts(dir: string, parts: readonly (readonly string
   };
 }
 
+/** The line appended to pod-N.log when part output that never finished went to pod-N.unfinished.log (a reader of pod-N.log alone saw «no test output»). */
+export const gateUnfinishedHint = (relativePath: string, bytes: number) => `[gate] unfinished: ${relativePath} · ${bytes}B (진행 중 part 출력은 그 파일)`;
+
 // review-model-ab: Pod 에서 출력 없이 멈춤 2/2(10-04 0.2.11 · 로컬 단독 4/0 · 1.7s) — GATE-STALL 수리 전까지 Pod 밖.
 export const POD_SWEEP_INTEGRATION_ONLY: readonly string[] = ['scripts/install.test.ts', 'scripts/review-model-ab.test.ts'];
 /** Nightly-only whole-repository cases; gate runs the fixture cases in these same files. */
@@ -565,7 +871,16 @@ function failuresOf(run: CommandResult, label: string): SweepFailures {
   const incomplete = (reason: string) => new Error(`${label} incomplete (rc=${run.rc}; Ran=${ran ? ran[0] : 'missing'}; errors=${Number.isNaN(reportedErrors) ? 'missing' : errorCount}; ${reason})\n${tail40(output)}`);
   const count = summaryCount(output, 'fail');
   const failures = parseFailures(output);
-  const occurrences = [...output.matchAll(/\(fail\)\s+.+?(?:\s+\[[\d.]+(?:ms|s)\])?\s*$/gm)].length;
+  // Bun repeats failed test names under "N tests failed:". A validated Pod sweep joins
+  // separately checked shards, so a summary in one shard can precede real failures
+  // from later shards. Remove each repeated block, not everything after the last one.
+  // Unhandled-error summaries have a separate file-attribution path below and do not
+  // use Bun's repeated `(fail)` block format.
+  const failureSummary = [...output.matchAll(/^\d+ tests? failed:\s*$/gm)].at(-1);
+  const executionOutput = run.validatedShards
+    ? output.replace(/^\d+ tests? failed:\r?\n(?:\(fail\)[^\r\n]*(?:\r?\n|$))*(?:[ \t]*\r?\n)*/gm, '')
+    : failureSummary ? output.slice(0, failureSummary.index) : output;
+  const occurrences = [...executionOutput.matchAll(/^[ \t]*\(fail\)[ \t]+.+?(?:[ \t]+\[[\d.]+(?:ms|s)\])?[ \t]*\r?$/gm)].length;
   // A test that leaves process.exitCode set leaks a non-zero exit into a run whose own summary is complete and clean
   // (0.2.7 gate: agent-cli at v0.2.6 · 12 pass · 0 fail · rc 2). The summary is the verdict; read that exit as clean.
   const leakedExit = !!ran && run.rc !== 0 && run.rc !== 1 && count === 0 && errorCount === 0 && occurrences === 0
@@ -581,11 +896,10 @@ function failuresOf(run: CommandResult, label: string): SweepFailures {
     if (/^# Unhandled error between tests/.test(raw.trim())) {
       if (!file) throw incomplete('unattributed unhandled error');
       errors.push(`${file} > [error]`);
-      file = undefined;
     }
   }
   if (errors.length !== errorCount) throw incomplete(`error attribution identified=${errors.length}`);
-  if (!Number.isFinite(count) || count !== occurrences || (count > 0 && failures.length === 0)
+  if (!Number.isFinite(count) || (count !== occurrences && !(run.validatedShards && occurrences > count && failures.length === count)) || (count > 0 && failures.length === 0)
     || (rc === 1 && count === 0 && errorCount === 0) || (rc === 0 && count + errorCount > 0)) {
     throw incomplete(`failure attribution incomplete: summary=${count}, identified=${failures.length}`);
   }
@@ -634,17 +948,22 @@ export function readIsolatedRun(run: CommandResult, label: string, file: string)
 }
 
 class StalledPodShards extends Error {
-  constructor(readonly stalledShards: NonNullable<GateResult['stalledShards']>, readonly partialSummary: NonNullable<GateResult['partialSummary']>) {
+  constructor(readonly stalledShards: NonNullable<GateResult['stalledShards']>, readonly partialSummary: NonNullable<GateResult['partialSummary']>, readonly abortedShards = 0) {
     const unmeasured = stalledShards.filter((item) => item.stall);
     const exitCode = stalledShards.filter((item) => item.reason === 'exit-code');
     super(`pod sweep incomplete: stalled shards ${stalledShards.map(({ shard }) => shard).join(', ')}`
       + (unmeasured.length ? ` (unmeasured: no test output within ${unmeasured[0]!.stall!.seconds}s of checkout — shards ${[...new Set(unmeasured.map(({ shard }) => shard))].join(', ')})` : '')
-      + (exitCode.length ? ` (exit-code anomaly: 0 fail but exit ≠ 0/1 — ${[...new Set(exitCode.flatMap(({ files }) => files))].join(', ')})` : ''));
+      + (exitCode.length ? ` (exit-code anomaly: 0 fail but exit ≠ 0/1 — ${[...new Set(exitCode.flatMap(({ files }) => files))].join(', ')})` : '')
+      + (abortedShards ? ` (중단 조각 ${abortedShards}: mid-run-stall)` : ''));
   }
 }
 
 /** Isolated re-runs (host stall re-run · cut and baseline re-checks) are time-limited; sweeps and installs keep their full time. */
 export const GATE_ISOLATED_TIMEOUT_MS = 300_000;
+/** Default final recheck window size; overflow continues in later windows. */
+export const GATE_HOST_RECHECK_FILE_LIMIT = 32;
+/** Two isolated test processes in each of four Pods = eight at most, with one checkout/install per eight files. */
+export const GATE_RECHECK_POD_BATCH_FILES = 8;
 /** GATE-INTRO-RECHECK (0.2.19) — the per-test limit of the one re-run given to a «timed out after 5000ms» new failure.
  *  0.2.18: both first-gate introductions were 5 s limits missed at 6.04/6.06 s, and they alone cost an 84-minute re-gate. */
 export const GATE_TIMEOUT_RECHECK_MS = 60_000;
@@ -750,6 +1069,15 @@ export async function admitGateShard(admission: GateAdmission | undefined, o: {
 
 export function createGateRunner(repo: string, remote?: string, commandOverride?: GateRunner['command'], podCommand: (options: RunPodCommandOptions) => Promise<PodCommandResult> = runPodCommand, poolOverride?: PodPoolScheduler, podLogTail?: (job: PodCommandResult) => string): GateRunner {
   let remoteMirror: string | undefined;
+  // GATE-HOSTMIRROR-EXPLICIT: resolved once per runner and handed to every podCommand (shard · retry · recheck).
+  let gateMirror: GateHostMirror | undefined;
+  const gateHostMirror = (pod: NonNullable<GateOptions['pod']>): { hostMirror?: string } => {
+    if (!gateMirror) {
+      gateMirror = resolveGateHostMirror(pod.hostMirror, pod.hostMirrorReaders ?? (poolOverride ? { env: process.env } : defaultGateHostMirrorReaders()));
+      debug.log('release-loop.gate', 'host-mirror-resolved', { source: gateMirror.source, path: gateMirror.path });
+    }
+    return gateMirror.hostMirror ? { hostMirror: gateMirror.hostMirror } : {};
+  };
   const localCommand: GateRunner['localCommand'] = async (cmd, args, cwd, limitMs) => {
     if (limitMs) return limitedLocalCommand(cmd, args, cwd, limitMs);
     const run = spawnSync(cmd, args, { cwd, encoding: 'utf8', maxBuffer: 128 * 1024 * 1024 });
@@ -771,14 +1099,17 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     : localCommand);
   const podSweep = async (tree: string, logDir: string | undefined, pod: NonNullable<GateOptions['pod']>, only?: readonly string[]): Promise<CommandResult> => {
     const shardCount = pod.shards ?? 24;
+    const isolationConcurrency = pod.isolationConcurrency ?? 4;
     // GATE-TIMEOUT-HEAL ①: the configured value is the floor; each shard's own deadline is shardDeadlineSeconds(planned).
     const deadlineSeconds = pod.shardTimeoutSeconds ?? POD_SHARD_TIMEOUT_FLOOR_SECONDS;
     if (!pod.pool || !Number.isSafeInteger(shardCount) || shardCount < 1
-      || !Number.isSafeInteger(deadlineSeconds) || deadlineSeconds < 1) throw new Error('invalid pod sweep options');
+      || !Number.isSafeInteger(deadlineSeconds) || deadlineSeconds < 1
+      || !Number.isSafeInteger(isolationConcurrency) || isolationConcurrency < 1) throw new Error('invalid pod sweep options');
     const head = await command('git', ['rev-parse', 'HEAD'], tree);
     check(head, 'cut tree HEAD');
     const commit = head.output.trim();
     if (!/^[0-9a-f]{40}$/.test(commit)) throw new Error('invalid cut tree HEAD');
+    const selectionStart = Date.now();
     const listed = await command('git', ['ls-files', '*.test.*'], tree);
     check(listed, 'git ls-files tests');
     const allFiles = listed.output.split(/\r?\n/).filter((file) => /\.test\.(?:tsx?|jsx?|mts|cts)$/.test(file)).sort();
@@ -807,11 +1138,12 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     // The TD1 measurements predate the fixture-only gate; do not isolate those five files at their old 2–13 GB peaks.
     const fixtureOnly = new Set([...GATE_NIGHTLY_AUDITS, 'test/guardian/dispatch-surface-contract.test.ts', 'test/user-config-mcp.test.ts']);
     const heavy = new Set(assignable.filter((file) => !fixtureOnly.has(file) && (memory.get(file) ?? 0) >= POD_HEAVY_FILE_MB));
-    const light = assignable.filter((file) => !heavy.has(file));
+    const { shards: lightShards, spawnFiles: spawnLane, spawnShardCount } = planGateSpawnSeparatedShards(assignable.filter((file) => !heavy.has(file)), durations, shardCount);
     const shards = [
-      ...(light.length ? planShards(light, durations, shardCount) : []),
+      ...lightShards,
       ...[...heavy].map((file) => ({ files: [file], plannedSeconds: durations.get(file) ?? 0 })),
     ];
+    if (spawnLane.length) debug.log('release-loop.gate', 'pod-spawn-lane', { files: spawnLane, shards: spawnShardCount });
     logPlanWalltime(planWall, shards);
     if (heavy.size) debug.log('release-loop.gate', 'pod-heavy-alone', { files: [...heavy], thresholdMb: POD_HEAVY_FILE_MB, memoryLimit: POD_ISOLATION_MEMORY_LIMIT });
     const known = assignable.filter((file) => durations.has(file)).length;
@@ -820,9 +1152,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       maxPlannedSeconds: Math.max(...shards.map((shard) => shard.plannedSeconds)),
       source: durations.size ? pod.durationSource : 'none',
     });
+    reportSelectionTimed(Date.now() - selectionStart, assignable.length, pod.onSelectionTimed);
     // GATE-SPEED A3①: shard Pod CPU (`release.loop.gatePodCpu` · default request 1 / limit 4) — shards × request must fit the pool.
     const cpu = resolvePodCpu(pod.cpu);
+    // Only evidence-backed opt-in files reach this batch; every other file retains its own Pod below.
+    const batchWidth = Math.max(1, Math.min(4, Math.floor(podCpuMillis(cpu.limit)! / 1000)));
     debug.log('release-loop.gate', 'shard-resources', { shards: shards.length, cpuRequest: cpu.request, cpuLimit: cpu.limit, cpuSource: pod.cpu ? 'config' : 'default' });
+    debug.log('release-loop.gate', 'isolation-batch-width', { batchWidth, cpuLimit: cpu.limit });
     const ready = poolOverride ? undefined : checkPodPool(parsePodPool(pod.pool), defaultKubectl);
     if (ready && !ready.ok) throw new Error('pod command: 풀의 노드가 하나도 준비되지 않았다');
     const poolScheduler = poolOverride ?? new PodPoolScheduler(ready!.ready);
@@ -861,6 +1197,19 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     });
     const stallWatch = stallSeconds > 0 && !!liveLog;
     debug.log('release-loop.gate', 'pod-stall-watch', { stallSeconds, source: pod.stallSeconds !== undefined ? 'config' : 'default', enabled: stallWatch });
+    // GATE-POD-STALL-FAILFAST ①: a hang after test output began ends only the Pod's test process group (never the Job).
+    const midRunStallSeconds = pod.midRunStallSeconds ?? GATE_POD_MIDRUN_STALL_SECONDS_DEFAULT;
+    if (!Number.isFinite(midRunStallSeconds) || midRunStallSeconds < 0) throw new Error('invalid pod sweep options');
+    const abortTests = pod.abortTests ?? (poolOverride ? undefined : (job: { name: string; context?: string }, reason: string) => {
+      if (!job.context) return false;
+      const ran = defaultKubectl(['--context', job.context, '-n', 'elanous-test', 'exec', `job/${job.name}`, '-c', 'child', '--', 'bash', '-c', gateShardAbortScript(reason)]);
+      if (ran.status !== 0) debug.log('release-loop.gate', 'shard-abort-failed', { job: job.name, rc: ran.status, out: `${ran.stdout}${ran.stderr}`.trim().slice(0, 300) }, { level: 'warn' });
+      return ran.status === 0;
+    });
+    const midRunWatch = stallWatch && midRunStallSeconds > 0 && !!abortTests;
+    debug.log('release-loop.gate', 'pod-midrun-stall-watch', { midRunStallSeconds, source: pod.midRunStallSeconds !== undefined ? 'config' : 'default', enabled: midRunWatch });
+    /** Shard Pods the mid-run watch aborted in this sweep (the verdict summary's «중단 조각 n»). */
+    let abortedShards = 0;
     // GATE-MULTI-HOST: members found unreachable during this gate — skipped for placement while any other member is left.
     const downMembers = new Set<string>();
     const multiHost = poolScheduler.members.length > 1;
@@ -894,7 +1243,23 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     type ShardReason = NonNullable<GateResult['stalledShards']>[number]['reason'];
     // 깊이 끝 OOM 조각은 «조각 전체»를 파일 하나씩 격리한다 — 상한 40 이면 나머지가 못 잰 채 남았다(09-30 ① 7번 조각 110 파일).
     const isolationRemaining = shards.map((item) => item.files.length);
+    // One sweep-wide permit pool: independent root shards must not each launch their own unbounded file fan-out.
+    let activeIsolation = 0;
+    const isolationWaiters: Array<() => void> = [];
+    const isolatedFile = async <T>(run: () => Promise<T>): Promise<T> => {
+      if (activeIsolation < isolationConcurrency) activeIsolation++;
+      else await new Promise<void>((resolve) => isolationWaiters.push(resolve));
+      try { return await run(); }
+      finally {
+        const next = isolationWaiters.shift();
+        if (next) next(); // transfer this permit directly; queued callers cannot exceed the cap
+        else activeIsolation--;
+      }
+    };
+    debug.log('release-loop.gate', 'pod-isolation-concurrency', { limit: isolationConcurrency, source: pod.isolationConcurrency === undefined ? 'default' : 'config' });
     const knownFailures = new Set(pod.knownFailures ?? []);
+    const batchSafe = loadGateBatchSafe(repo);
+    debug.log('release-loop.gate', 'batch-safe-opt-in', { files: batchSafe.size });
     const estimated = (paths: string[]) => paths.reduce((sum, file) => {
       const value = durations.get(file);
       return sum + (value !== undefined && Number.isFinite(value) && value >= 0 ? value : unknownSeconds);
@@ -935,23 +1300,29 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       },
       release: (member: Parameters<PodPoolScheduler['release']>[0]) => poolScheduler.release(member),
     }) as unknown as PodPoolScheduler;
-    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string, hostRetries = 0): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
+    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string, hostRetries = 0, batchIsolation = false): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
       // 파일별 소요는 junit 으로 남긴다 — 콘솔 요약(판정 원천)은 그대로이고, 느린 시험 목록(K10 D4)·계층 분리(D2)의 자가 된다.
       // GATE-TIMEOUT-HEAL: parts (each with its own junit) under a soft deadline inside this shard's own Job deadline.
-      const shardDeadline = shardDeadlineSeconds(estimated(paths), deadlineSeconds);
-      const parts = shardParts(paths, (file) => estimated([file]));
-      const memoryLimit = paths.length === 1 && (depth >= 1 || heavy.has(paths[0]!)) ? POD_ISOLATION_MEMORY_LIMIT : undefined;
-      const shellOptions = { parts, cdpPatterns, softSeconds: softDeadlineSeconds(shardDeadline), cachePrefix, installSlots };
+      const shardDeadline = shardDeadlineSeconds(batchIsolation ? Math.max(...paths.map((file) => estimated([file]))) * Math.ceil(paths.length / batchWidth) : estimated(paths), deadlineSeconds);
+      const parts = batchIsolation ? paths.map((file) => [file]) : shardParts(paths, (file) => estimated([file]));
+      const memoryLimit = batchIsolation || paths.length === 1 && (depth >= 1 || heavy.has(paths[0]!)) ? POD_ISOLATION_MEMORY_LIMIT : undefined;
+      const shellOptions = { parts, cdpPatterns, softSeconds: softDeadlineSeconds(shardDeadline), cachePrefix, installSlots, ...(batchIsolation ? { parallelParts: batchWidth } : {}) };
       const keyShell = gateShardShell(shellOptions);
       // The stall beat only reports; runKey keeps hashing the shell without it, so earlier results stay reusable.
-      const podShell = stallWatch ? gateShardShell({ ...shellOptions, beatSeconds: gateStallBeatSeconds(stallSeconds) }) : keyShell;
       const runKey = createHash('sha256').update(JSON.stringify({ pool: pod.pool, podShell: keyShell, memoryLimit: memoryLimit ?? null, deadlineSeconds: shardDeadline, bunCache: bunCache ?? null })).digest('hex');
       let start = Date.now();
       let admitted: GateAdmissionResult | undefined;
       let output: string | undefined;
+      const phaseTimes: Record<string, string> = {};
+      const stamp = (phase: string) => { phaseTimes[phase] = new Date().toISOString(); };
+      let podStages: Record<string, number> | undefined;
+      let podLifecycle: Record<string, string> | undefined;
+      let podJobName: string | undefined;
+      let batchArtifactsComplete = true;
       let junit: string | undefined;
       let rc: number | undefined;
       let jobExitCode: number | undefined;
+      let batchArtifactDir: string | undefined;
       let lastFile: string | undefined;
       let jobFailed = false;
       let jobError = '';
@@ -962,22 +1333,30 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       let unfinishedLog: string | undefined;
       let exitCodeOnly: string[] | undefined;
       let stall: { seconds: number; sinceCheckoutMs: number } | undefined;
+      let stallWatchState: ShardStallWatchState | undefined;
+      let abort: ShardAbort | undefined;
       // The way down a previous attempt took wins over its own log: that log was not a verdict, or it would have no children.
       // The split this shard would take if it failed here — the same rule as the split code below (isolation at depth 2 ·
       // cap chunks for a big root shard · halves otherwise · none for one file).
       // Isolation follows only while this shard's isolation budget still covers every file (review r7) — the budget is the
       // shard's file count and isolations take disjoint files, so this holds unless the plan changed; if not, run the Pod.
-      const splitChild = depth === 2 && paths.length > 1 ? (isolationRemaining[shard]! >= paths.length ? '-file-0' : undefined)
+      const splitChild = depth === 2 && paths.length > 1 ? (isolationRemaining[shard]! >= paths.length
+        ? batchIsolation || !paths.every((file) => batchSafe.has(file)) ? '-file-0' : '-batch' : undefined)
         : depth < 2 && paths.length > 1 ? (depth === 0 && paths.length > POD_SHARD_FILE_CAP ? '-c0' : '-0') : undefined;
       const found = !fresh && logDir ? previousShardDescent(logDir, `pod-${shard}${branch}`, commit, paths, runKey, parentAttempt, splitChild) : undefined;
       const descent = found?.way;
       const reused = !fresh && !descent && logDir ? previousShardResult(logDir, `pod-${shard}${branch}`, commit, paths, runKey, parentAttempt) : undefined;
       // This shard's attempt id: the recorded one when its way down is followed, a new one when a Pod runs. Children carry it.
       const attemptId = found?.attemptId ?? randomUUID();
+      // The Pod itself stamps its cut and attempt before the test starts. A
+      // collector-created manifest cannot reassign another Job's bytes.
+      const podShell = gateShardShell({ ...shellOptions,
+        ...(stallWatch ? { beatSeconds: gateStallBeatSeconds(stallSeconds) } : {}),
+        sourceBinding: { cutSha: commit, attemptId } });
       if (descent === 'retry') {
         // «descend» is only the way down; «resumed» comes from each leaf whose log reads cleanly (review r4).
         debug.log('release-loop.gate', 'pod-shard-descend', { shard, branch, files: paths.length, via: 'retry' });
-        return runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId);
+        return runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId, hostRetries, batchIsolation);
       }
       if (descent === 'split') {
         output = undefined;
@@ -989,7 +1368,9 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         jobExitCode = 0;
         lastFile = lastStartedTestFile(output, paths);
       } else try {
+        stamp('admissionStart');
         admitted = await admitGateShard(gateAdmission, { waitMs: admissionWaitSeconds * 1000, onWait: (reason) => markShard(shard, { waitReason: reason }) });
+        stamp('admissionEnd');
         if (admitted.outcome !== 'off') debug.log('release-loop.gate', 'shard-admission', { shard, branch, outcome: admitted.outcome, waitedMs: admitted.waitedMs, ...(admitted.reason ? { reason: admitted.reason } : {}) },
           admitted.outcome === 'granted' ? undefined : { level: 'warn' });
         // The admission wait is not the shard's run time: deadline/timeout judgment and the measured duration start here.
@@ -1004,10 +1385,20 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           stopJob: () => {
             try { return stopJob(liveJob()); }
             catch (error) { debug.log('release-loop.gate', 'pod-shard-stall-stop-failed', { job: jobName, error: String(error) }, { level: 'warn' }); return false; }
-          } }) : undefined;
+          },
+          ...(midRunWatch ? {
+            midRunStallSeconds,
+            onAbort: ({ sinceLastOutputMs }: { sinceLastOutputMs: number }) => debug.log('release-loop.gate', 'shard-abort',
+              { shard, branch, reason: `mid-run-stall ${midRunStallSeconds}s`, by: 'auto', sinceLastOutputMs }, { level: 'warn' }),
+            abortTests: () => {
+              try { return abortTests!(liveJob(), `mid-run-stall ${midRunStallSeconds}s`); }
+              catch (error) { debug.log('release-loop.gate', 'shard-abort-failed', { job: jobName, error: String(error) }, { level: 'warn' }); return false; }
+            },
+          } : {}) }) : undefined;
         const placed = admitted.release;
         const job = await podCommand({
-          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => { jobContext = member.context; placedOn = member.context; placed(); }), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
+          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => { stamp('poolPlaced'); jobContext = member.context; placedOn = member.context; placed(); }), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
+          ...gateHostMirror(pod),
           ...(multiHost ? { statusUnreadableMs: memberUnreadableSeconds * 1000 } : {}),
           ...(bunCache ? { bunCache } : {}),
           ...(installSlots > 0 ? { installSlots: POD_INSTALL_SLOTS_HOST_PATH } : {}),
@@ -1017,11 +1408,37 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           name: jobName,
           command: ['bash', '-lc', podShell],
         }).finally(() => watch?.stop());
+        stamp('jobReturned');
+        podJobName = job.job;
+        if (!poolOverride && placedOn) {
+          try {
+            const got = defaultKubectl(['--context', placedOn, '-n', 'elanous-test', 'get', 'pods', '-l', `job-name=${job.job}`, '-o', 'json']);
+            if (got.status === 0) podLifecycle = readGatePodLifecycle(got.stdout);
+          } catch { /* timings never change the verdict */ }
+        }
         jobExitCode = job.exitCode;
+        batchArtifactDir = job.artifactsDir;
         const read = readShardArtifacts(job.artifactsDir, parts);
+        batchArtifactsComplete = !batchIsolation || parts.every((_, index) =>
+          ['rc', 'log', 'junit.xml'].every((suffix) => existsSync(join(job.artifactsDir, `part-${index}.${suffix}`))));
+        const stagesPath = join(job.artifactsDir, 'stages.tsv');
+        if (existsSync(stagesPath)) {
+          try {
+            podStages = Object.fromEntries(readFileSync(stagesPath, 'utf8').split(/\r?\n/).flatMap((line) => {
+              const match = /^(\d+)\t([a-z0-9-]+)$/.exec(line);
+              return match ? [[match[2]!, Number(match[1])]] : [];
+            }));
+          } catch (error) {
+            debug.log('release-loop.gate', 'pod-stages-unreadable', { shard, branch, error: String(error) }, { level: 'warn' });
+          }
+        }
+        stamp('artifactsRead');
         ({ output, junit, rc, timedOut, finished, unfinishedLog, exitCodeOnly } = read);
         // A stall counts only when the Job also left no verdict (a failed stop can let a late shard finish after all).
         const stalledAt = watch?.stalled();
+        stallWatchState = watch?.state();
+        abort = watch?.aborted();
+        if (abort?.taken) abortedShards++;
         if (stalledAt && !finished.length && rc === undefined) stall = { seconds: stallSeconds, sinceCheckoutMs: stalledAt.sinceCheckoutMs };
         // A Job the cluster cut at its own deadline leaves no outbox at all: past the deadline with nothing is a timeout too.
         if (!timedOut && output === undefined && job.exitCode !== 0 && Date.now() - start >= shardDeadline * 1000) timedOut = true;
@@ -1039,15 +1456,26 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       const durationMs = Date.now() - start;
       const fileSeconds = junit === undefined ? undefined : Object.fromEntries(readJunitFileSeconds(junit));
       const testSeconds = fileSeconds === undefined ? undefined : Object.values(fileSeconds).reduce((sum, seconds) => sum + seconds, 0);
-      const podOverheadSeconds = testSeconds === undefined ? undefined : Math.max(0, durationMs / 1000 - testSeconds);
+      const testWallSeconds = batchIsolation
+        ? gateBatchTestWallSeconds(podStages, parts.length)
+        : podStages?.['test-start'] !== undefined && podStages?.['test-end'] !== undefined
+          ? Math.max(0, podStages['test-end'] - podStages['test-start']) : undefined;
+      const podOverheadSeconds = testWallSeconds !== undefined || (!batchIsolation && testSeconds !== undefined)
+        ? Math.max(0, durationMs / 1000 - (testWallSeconds ?? testSeconds!)) : undefined;
       // A reused shard keeps its files as they are — rewriting would replace the measured durationMs the next release plans by.
       if (logDir && !reused && !descent) {
         mkdirSync(logDir, { recursive: true });
+        const warmPrefix = join(logDir, `pod-${shard}${branch}`);
+        rmSync(`${warmPrefix}.warm-manifest.json`, { force: true });
+        rmSync(`${warmPrefix}.rc`, { force: true });
         // GATE-SHARD-RESUME: the json is what makes a log reusable, so it goes first and comes back last — a stop between
         // the new log and the new json leaves no json, never the old Job's exit paired with the new log (review r8).
         rmSync(join(logDir, `pod-${shard}${branch}.json`), { force: true });
         const destination = join(logDir, `pod-${shard}${branch}.log`);
-        if (output !== undefined) writeFileSync(destination, output, { mode: 0o600 });
+        const unfinishedLogBytes = unfinishedLog !== undefined ? Buffer.byteLength(unfinishedLog, 'utf8') : undefined;
+        // GATE-UNFINISHED-HINT: pod-N.log holds finished parts only — point a reader at the running parts' output (file only; the verdict reads `output`).
+        if (output !== undefined) writeFileSync(destination, unfinishedLogBytes !== undefined
+          ? `${output}${output.endsWith('\n') || output === '' ? '' : '\n'}${gateUnfinishedHint(`pod-${shard}${branch}.unfinished.log`, unfinishedLogBytes)}\n` : output, { mode: 0o600 });
         else rmSync(destination, { force: true });
         const junitDestination = join(logDir, `pod-${shard}${branch}.junit.xml`);
         if (junit !== undefined) writeFileSync(junitDestination, junit, { mode: 0o600 });
@@ -1057,14 +1485,29 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         else rmSync(unfinishedDestination, { force: true });
         writeFileSync(join(logDir, `pod-${shard}${branch}.json`), JSON.stringify({ durationMs, rc: rc ?? null,
           ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed, ...(placedOn ? { host: placedOn } : {}),
-          ...(fileSeconds !== undefined ? { fileSeconds, testSeconds, podOverheadSeconds } : {}),
-          ...(admitted && admitted.outcome !== 'off' ? { admission: admitted.outcome, admissionWaitMs: admitted.waitedMs } : {}) }) + '\n', { mode: 0o600 });
+          ...(Object.keys(phaseTimes).length ? { phaseTimes } : {}), ...(podStages ? { podStages } : {}),
+          ...(podLifecycle && Object.keys(podLifecycle).length ? { podLifecycle } : {}),
+          ...(fileSeconds !== undefined ? { fileSeconds, testSeconds } : {}), ...(testWallSeconds !== undefined ? { testWallSeconds } : {}),
+          ...(podOverheadSeconds !== undefined ? { podOverheadSeconds } : {}),
+          ...(unfinishedLogBytes !== undefined ? { unfinishedLogBytes } : {}),
+          ...(admitted && admitted.outcome !== 'off' ? { admission: admitted.outcome, admissionWaitMs: admitted.waitedMs } : {}),
+          ...(abort ? { abort: { reason: `abort: ${abort.reason}`, at: abort.at, by: abort.by, sinceLastOutputMs: abort.sinceLastOutputMs, taken: abort.taken } } : {}),
+          stallWatch: shardStallWatchRecord(stallSeconds, !!liveLog, stallWatchState) }) + '\n', { mode: 0o600 });
+        if (paths.length === 1 && (rc === 0 || rc === 1) && !jobFailed && jobExitCode === 0
+          && output !== undefined && junit !== undefined) {
+          writeFileSync(`${warmPrefix}.rc`, `${rc}\n`, { mode: 0o600 });
+          writeWarmJobManifest(warmPrefix, paths[0]!, commit, attemptId);
+        }
       }
       const installSeconds = parseInstallSeconds(output ?? '');
       // GATE-TIMEOUT-HEAL ③: a cut shard is «reason: timeout» (with the files that still finished), not a bare rc=null.
       if (!reused && !descent) debug.log('release-loop.gate', 'pod-shard', { shard, files: paths, durationMs, rc: rc ?? null, attempt: depth + 1, installSeconds, gateDeps: parseGateDeps(output ?? ''), deadlineSeconds: shardDeadline, parts: parts.length, ...(placedOn ? { host: placedOn } : {}),
         ...(testSeconds !== undefined ? { testSeconds } : {}),
         ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}) });
+      // POD-LIFECYCLE-STAGES: the same values the shard json carries, as one `pod.lifecycle stages` line (observation only) —
+      // only for a Job that came back (a launch that failed before the Job returned has no Pod to describe).
+      if (!reused && !descent && podJobName !== undefined) emitPodLifecycle(gatePodLifecycleEvent({ runId: process.env.ELANOUS_RUN_ID ?? null, podJob: podJobName, host: placedOn ?? null,
+        shard: `pod-${shard}${branch}`, attemptId, phaseTimes, podStages, podLifecycle, outcome: gatePodOutcome({ jobFailed, stalled: !!stall, timedOut, rc }) }));
       if (!reused && !descent) markShard(shard, { ...(installSeconds !== null ? { installSec: installSeconds } : {}), ...(rc !== undefined ? { rc } : {}), ...(timedOut ? { state: 'timeout' as const } : {}) });
       let clean = output?.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
       const ran = clean && lastMatch(clean, /Ran (\d+) tests? across (\d+) files?/);
@@ -1078,6 +1521,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       // GATE-POD-STALL-FAILFAST: stopped with no test output — the existing «no output» reason (one fresh retry).
       else if (stall) reason = 'no-output';
       else if (timedOut) reason = 'timeout';
+      else if (batchIsolation && !batchArtifactsComplete) reason = 'incomplete';
       // GATE-POD-STALL-FAILFAST (OP): a complete summary with 0 fail · 0 error but an exit other than 0/1 is an exit-code
       // anomaly (0.2.23: a test left process.exitCode set → «0 fail · rc 3» read as a stalled shard). Same split/isolation
       // path as job-failed — only the label differs, so the verdict names the file instead of saying «stalled».
@@ -1116,14 +1560,14 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       // A reused result that the current tool cannot read cleanly is not a verdict: run that shard for real.
       if (reused && reason) {
         debug.log('release-loop.gate', 'pod-shard-resume-miss', { shard, branch, reason });
-        return runShard(paths, shard, depth, branch, retriedNoOutput, true, parentAttempt);
+        return runShard(paths, shard, depth, branch, retriedNoOutput, true, parentAttempt, hostRetries, batchIsolation);
       }
       // GATE-MULTI-HOST: the Job failed because its member is gone (launch failed · status unreadable) — not the shard's
       // fault, so no split: the same files run again on the members left. Bounded by the roster size.
       if (jobFailed && placedOn && hostRetries < poolScheduler.members.length && memberLost(placedOn, shard, jobError)
         && poolScheduler.members.some((m) => !downMembers.has(m.context))) {
         debug.log('release-loop.gate', 'pod-shard-host-retry', { shard, branch, files: paths.length, lostMember: placedOn, attempt: hostRetries + 1 }, { level: 'warn' });
-        return runShard(paths, shard, depth, `${branch}-h${hostRetries}`, retriedNoOutput, undefined, attemptId, hostRetries + 1);
+        return runShard(paths, shard, depth, `${branch}-h${hostRetries}`, retriedNoOutput, undefined, attemptId, hostRetries + 1, batchIsolation);
       }
       // GATE-TIMEOUT-HEAL ④: a Pod that died before any test ran (no outbox · jobExitCode≠0 — 0.2.19: isolated retries
       // ending with exit 5, the source checkout) gets the same one fresh retry as «no output» instead of stalling the sweep.
@@ -1131,13 +1575,45 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       const diedBeforeTests = reason === 'job-failed' && output === undefined && !jobFailed && jobExitCode !== undefined && jobExitCode !== 0
         && jobExitCode !== 137 && (paths.length === 1 || jobExitCode === 5);
       if ((reason === 'no-output' || diedBeforeTests) && !retriedNoOutput) {
-        const retry = await runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId);
+        const retry = await runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId, hostRetries, batchIsolation);
         debug.log('release-loop.gate', 'pod-shard-retry', { shard, files: paths, reason, outcome: retry.stalled[0]?.reason ?? 'ok' });
         return retry;
       }
       // GATE-POD-STALL-FAILFAST: a stall after the fresh retry is unmeasured — no split, no isolation: smaller Pods on the
       // same stalled node only re-measure the stall (10-10: retries and splits repeated it for 2h+).
       if (stall && reason === 'no-output') return { runs: [], stalled: [{ shard, files: paths, reason, stall }] };
+      // A shared Job may finish some file parts before another part loses its JUnit/log/rc. Keep every complete part's
+      // original verdict, including a failure, and rerun only parts without the full artifact trio.
+      if (batchIsolation && !batchArtifactsComplete && batchArtifactDir && reason) {
+        const measured: ShardRun[] = [];
+        const missing: string[] = [];
+        parts.forEach((part, index) => {
+          const file = part[0]!;
+          try {
+            const prefix = join(batchArtifactDir!, `part-${index}`);
+            const partLog = readFileSync(`${prefix}.log`, 'utf8');
+            const partJunit = readFileSync(`${prefix}.junit.xml`, 'utf8');
+            const partRc = Number(readFileSync(`${prefix}.rc`, 'utf8').trim());
+            const ranPart = lastMatch(partLog, /Ran (\d+) tests? across (\d+) files?/);
+            const passPart = summaryCount(partLog, 'pass'), failPart = summaryCount(partLog, 'fail');
+            const errorsPart = summaryCount(partLog, 'error');
+            if ((partRc !== 0 && partRc !== 1) || !ranPart || Number(ranPart[2]) !== 1
+              || !Number.isFinite(passPart) || !Number.isFinite(failPart)) throw new Error('incomplete part');
+            const attributed = failuresOf({ rc: partRc, output: partLog }, `pod-${shard} part-${index}`);
+            if (attributed.failures.length !== failPart) throw new Error('unattributed part');
+            measured.push({ output: partLog, rc: partRc, pass: passPart, fail: failPart,
+              errors: Number.isFinite(errorsPart) ? errorsPart : 0, ran: Number(ranPart[1]), files: 1,
+              passedIds: junitPassedIds(partJunit).map(podRelative) });
+          } catch { missing.push(file); }
+        });
+        if (measured.length && missing.length) {
+          debug.log('release-loop.gate', 'isolation-batch-partial', { shard, branch, measured: measured.length, missing });
+          const children = await Promise.all(missing.map((file) => isolatedFile(() => runShard([file], shard, depth + 1,
+            `${branch}-file-${paths.indexOf(file)}`, false, undefined, attemptId))));
+          return { runs: [...measured, ...children.flatMap((child) => child.runs)],
+            stalled: children.flatMap((child) => child.stalled) };
+        }
+      }
       if (reason) {
         // GATE-SKIP-KNOWN-RETRY — a shard whose summary is complete but whose failures could not be read back (unattributed)
         // and whose every named failure is one the previous release already had is not re-run: re-running only re-measures
@@ -1162,7 +1638,8 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           debug.log('release-loop.gate', 'retry-narrowed', { shard, before: paths.length, after: narrowed.length });
           const kept = new Set(paths.filter((file) => !narrowed.includes(file)));
           const passedIds = junitPassedIds(junit!).map(podRelative).filter((id) => { try { return kept.has(testFileOfId(id)); } catch { return false; } });
-          const child = await runShard(narrowed, shard, depth, `${branch}-n`, false, undefined, attemptId);
+          const directBatch = narrowed.length > 1 && narrowed.length <= POD_SHARD_FILE_CAP && narrowed.every((file) => batchSafe.has(file));
+          const child = await runShard(narrowed, shard, directBatch ? 2 : depth, `${branch}-n`, false, undefined, attemptId, 0, directBatch);
           return { runs: [{ output: '', rc: 0, pass: passedIds.length, fail: 0, errors: 0, ran: passedIds.length, files: kept.size, passedIds },
             ...child.runs], stalled: child.stalled };
         }
@@ -1171,19 +1648,27 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (depth === 2 && paths.length > 1) {
           const count = Math.min(paths.length, isolationRemaining[shard]!);
           isolationRemaining[shard]! -= count;
-          const children = await Promise.all(paths.slice(0, count).map(async (file, index) => {
-            const child = await runShard([file], shard, depth + 1, `${branch}-file-${index}`, false, undefined, attemptId);
+          const batchPaths = paths.slice(0, count);
+          // The common path already ran every file as an isolated part in this same Job. Only an incomplete batch
+          // needs a fresh per-file Pod, preserving the earlier fail-closed behavior when the shared Job died.
+          const canBatch = batchPaths.length > 1 && batchPaths.every((file) => batchSafe.has(file));
+          const batch = batchIsolation || !canBatch ? undefined : await runShard(batchPaths, shard, depth + 1, `${branch}-batch`, false, undefined, attemptId, 0, true);
+          const retryPaths = !batch ? batchPaths : batchPaths.filter((file) => batch.stalled.some((item) => item.files.includes(file)));
+          const children = !batch || batch.stalled.length ? await Promise.all(retryPaths.map((file) => isolatedFile(async () => {
+            const child = await runShard([file], shard, depth + 1, `${branch}-file-${batchPaths.indexOf(file)}`, false, undefined, attemptId);
             debug.log('release-loop.gate', 'pod-shard-isolate', { shard, file, outcome: child.stalled[0]?.reason ?? 'ok' });
             return child;
-          }));
-          return { runs: children.flatMap((child) => child.runs), stalled: [
+          }))) : [batch];
+          debug.log('release-loop.gate', 'pod-shard-isolate-batch', { shard, files: batchPaths.length, fallback: !batch || batch.stalled.length > 0 });
+          return { runs: [...(batch?.stalled.length ? batch.runs : []), ...children.flatMap((child) => child.runs)], stalled: [
             ...children.flatMap((child) => child.stalled),
+            ...(batch?.stalled.filter((item) => item.files.some((file) => !retryPaths.includes(file))) ?? []),
             ...(paths.length > count ? [{ shard, files: paths.slice(count), reason,
               ...(lastFile ? { lastFile } : {}),
             }] : []),
           ] };
         }
-        if (depth === 2 || paths.length === 1) return { runs: [], stalled: [{ shard, files: paths, reason,
+        if (depth >= 2 || paths.length === 1) return { runs: [], stalled: [{ shard, files: paths, reason,
           ...(lastFile ? { lastFile } : {}),
           ...(reason === 'unattributed' ? { summaryFailures: fails, namedFailures, ...(unattributedDetail ? { detail: unattributedDetail } : {}) } : {}),
         }] };
@@ -1193,14 +1678,19 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (depth === 0 && paths.length > POD_SHARD_FILE_CAP) {
           const chunks = Array.from({ length: Math.ceil(paths.length / POD_SHARD_FILE_CAP) }, (_, i) => paths.slice(i * POD_SHARD_FILE_CAP, (i + 1) * POD_SHARD_FILE_CAP));
           debug.log('release-loop.gate', 'pod-shard-cap-split', { shard, files: paths.length, chunks: chunks.length, cap: POD_SHARD_FILE_CAP, reason });
-          const children = await Promise.all(chunks.map((chunk, i) => runShard(chunk, shard, 2, `${branch}-c${i}`, false, undefined, attemptId)));
+          // Preserve the proven cap-chunk Job even with an empty opt-in list. Batch isolation is only for chunks whose
+          // every file is explicitly safe; a regular cap chunk keeps the preexisting one-process Pod verdict.
+          const children = await Promise.all(chunks.map((chunk, i) => runShard(chunk, shard, 2, `${branch}-c${i}`, false, undefined, attemptId, 0,
+            chunk.length > 1 && chunk.every((file) => batchSafe.has(file)))));
           return { runs: children.flatMap((child) => child.runs), stalled: children.flatMap((child) => child.stalled) };
         }
         debug.log('release-loop.gate', 'pod-shard-split', { shard, depth, files: paths, reason });
         const middle = Math.ceil(paths.length / 2);
         const children = await Promise.all([
-          runShard(paths.slice(0, middle), shard, depth + 1, `${branch}-0`, false, undefined, attemptId),
-          runShard(paths.slice(middle), shard, depth + 1, `${branch}-1`, false, undefined, attemptId),
+          runShard(paths.slice(0, middle), shard, depth + 1, `${branch}-0`, false, undefined, attemptId, 0,
+            depth + 1 === 2 && middle > 1 && paths.slice(0, middle).every((file) => batchSafe.has(file))),
+          runShard(paths.slice(middle), shard, depth + 1, `${branch}-1`, false, undefined, attemptId, 0,
+            depth + 1 === 2 && paths.length - middle > 1 && paths.slice(middle).every((file) => batchSafe.has(file))),
         ]);
         return { runs: children.flatMap((child) => child.runs), stalled: children.flatMap((child) => child.stalled) };
       }
@@ -1233,16 +1723,62 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     if (unmeasured.length) debug.log('release-loop.gate', 'pod-sweep-unmeasured', { shards: [...new Set(unmeasured.map((item) => item.shard))], files: unmeasured.reduce((sum, item) => sum + item.files.length, 0),
       stallSeconds, measuredFiles: total.files }, { level: 'warn' });
     // An unmeasured (stalled) shard is never handed to the host re-run as an environment stall: the gate fails now.
-    if (stalledShards.some((item) => item.reason !== 'no-output' || item.files.length !== 1 || item.stall)) throw new StalledPodShards(stalledShards, total);
+    if (abortedShards) debug.log('release-loop.gate', 'pod-sweep-aborted', { shards: abortedShards, midRunStallSeconds }, { level: 'warn' });
+    if (stalledShards.some((item) => item.reason !== 'no-output' || item.files.length !== 1 || item.stall)) throw new StalledPodShards(stalledShards, total, abortedShards);
     if (total.ran === 0 && total.errors === 0 && !stalledShards.length) throw new Error('sweep incomplete: no tests ran');
     const outputs = measured.map((run) => run.output.replace(/(?:^|\n)\s*\d+ (?:pass|fail|errors?)\s*(?=\n|$)/g, '\n').replace(/Ran \d+ tests? across \d+ files?\.?/g, ''));
-    return { rc: total.fail + total.errors ? 1 : 0, output: outputs.join('\n') + `\n${total.pass} pass\n${total.fail} fail\n${total.errors} errors\nRan ${total.ran} tests across ${total.files} files.\n`,
+    return { rc: total.fail + total.errors ? 1 : 0, output: outputs.join('\n') + `\n${total.pass} pass\n${total.fail} fail\n${total.errors} errors\nRan ${total.ran} tests across ${total.files} files.\n`, validatedShards: true,
       passedIds: [...new Set(measured.flatMap((run) => run.passedIds))].sort(),
-      stalledEnv: stalledShards.flatMap((item) => item.files.map((file) => ({ file, reason: 'no-output' as const }))) };
+      stalledEnv: stalledShards.flatMap((item) => item.files.map((file) => ({ file, reason: 'no-output' as const }))),
+      ...(abortedShards ? { abortedShards } : {}) };
+  };
+  const runPodRecheckBatch = async (files: readonly string[], commit: string, pod: NonNullable<GateOptions['pod']>, timeoutMs: number, relaxed = false): Promise<Map<string, CommandResult>> => {
+    if (!files.length || files.length > GATE_RECHECK_POD_BATCH_FILES || new Set(files).size !== files.length
+      || files.some((file) => !/^(?:[\w.-]+\/)*[\w.-]+\.test\.[cm]?[jt]sx?$/.test(file)
+        || file.split('/').some((part) => part === '.' || part === '..')))
+      throw new Error('unsafe pod recheck files');
+    if (!sha.test(commit)) throw new Error('invalid pod recheck commit');
+    const installSlots = pod.installSlots ?? POD_INSTALL_SLOTS_DEFAULT;
+    if (!Number.isSafeInteger(installSlots) || installSlots < 0) throw new Error('invalid pod recheck install slots');
+    const bunCache = pod.bunCache?.trim() || process.env[POD_BUN_CACHE_HOST_PATH]?.trim();
+    const partLimitSeconds = Math.ceil(timeoutMs / 1000);
+    const deadlineSeconds = partLimitSeconds * Math.ceil(files.length / 2) + POD_SHARD_EMIT_RESERVE_SECONDS + 60;
+    const shell = gateShardShell({ parts: files.map((file) => [file]), cdpPatterns: [], softSeconds: softDeadlineSeconds(deadlineSeconds),
+      cachePrefix: bunCache ? podBunCacheVolume(bunCache).shellPrefix : '', installSlots, parallelParts: files.length > 1 ? 2 : 1,
+      partLimitSeconds, ...(relaxed ? { testTimeoutMs: GATE_TIMEOUT_RECHECK_MS } : {}) });
+    const job = await podCommand({ pool: pod.pool, ...(poolOverride ? { poolScheduler: poolOverride } : {}), clone: true,
+      source: { kind: 'commit', sha: commit }, deadlineSeconds, ...(bunCache ? { bunCache } : {}), ...gateHostMirror(pod),
+      ...(installSlots > 0 ? { installSlots: POD_INSTALL_SLOTS_HOST_PATH } : {}), ...(pod.cpu ? { cpu: pod.cpu } : {}),
+      memoryLimit: POD_ISOLATION_MEMORY_LIMIT, name: `gate-recheck-${randomUUID()}`, command: ['bash', '-lc', shell] });
+    const artifact = (name: string) => {
+      const path = join(job.artifactsDir, name);
+      return existsSync(path) ? readFileSync(path, 'utf8') : undefined;
+    };
+    const installed = artifact('install.rc')?.trim() === '0';
+    if (!installed || job.exitCode !== 0)
+      throw new Error(`pod isolated recheck setup incomplete: ${commit.slice(0, 9)} job=${job.job} exit=${job.exitCode} install=${installed}`);
+    const timedOut = artifact('shard.timeout') !== undefined;
+    const results = new Map<string, CommandResult>();
+    for (const [index, file] of files.entries()) {
+      const rcText = artifact(`part-${index}.rc`)?.trim();
+      const output = artifact(`part-${index}.log`);
+      const rc = rcText && /^\d+$/.test(rcText) ? Number(rcText) : undefined;
+      const partTimedOut = artifact(`part-${index}.timeout`) !== undefined;
+      if (rc === undefined || output === undefined || partTimedOut) {
+        if (!timedOut && !partTimedOut) throw new Error(`pod isolated recheck incomplete: ${file} @${commit.slice(0, 9)} job=${job.job} rc=${rc ?? 'missing'}`);
+        results.set(file, { rc: 124, output: output ?? '', timedOut: true });
+      } else results.set(file, { rc, output });
+      debug.log('release-loop.gate', 'pod-isolated-recheck', { file, commit, job: job.job, rc: rc ?? 124, relaxed });
+    }
+    return results;
   };
   return {
     command,
     localCommand: commandOverride && !remote ? commandOverride : localCommand,
+    async recheckPod(file, commit, pod, timeoutMs, relaxed = false) {
+      return (await runPodRecheckBatch([file], commit, pod, timeoutMs, relaxed)).get(file)!;
+    },
+    recheckPodBatch: (files, commit, pod, timeoutMs) => runPodRecheckBatch(files, commit, pod, timeoutMs),
     get remoteMirror() { return remoteMirror; },
     set remoteMirror(path) { remoteMirror = path; },
     async sweep(tree, logDir, pod, only) {
@@ -1354,7 +1890,7 @@ const fileOf = testFileOfId;
  * GATE-BASELINE-CACHE (0.2.18) — the isolated `bun run test:deterministic <file>` result of one test file at one commit,
  * kept in the machine ledger so a later gate does not run it again (0.2.17: the failing files were re-run on the previous
  * release commit although that release had already measured them). Cache format harvested from draft #24500.
- * `host` is where the result was measured (`local` or the ssh host) — a result from another host is a miss.
+ * `host` is where the result was measured (`local`, the ssh host, or `pod:<pool>`) — another environment is a miss.
  * Timeouts are never stored: an environment stall is measured again, not remembered.
  */
 export interface BaselineFileResult { commit: string; file: string; host: string; failures: string[]; errors: string[]; missing: boolean }
@@ -1444,6 +1980,8 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       || (opts.baselineVersion && !versionPattern.test(opts.baselineVersion))
       || (opts.baselineCommit && !sha.test(opts.baselineCommit))) throw new Error('invalid commit or version');
     if (!opts.baselineVersion) throw new Error('previous release version required (--baseline-version)');
+    if (!Number.isSafeInteger(opts.recheckFileLimit ?? GATE_HOST_RECHECK_FILE_LIMIT) || (opts.recheckFileLimit ?? GATE_HOST_RECHECK_FILE_LIMIT) < 1)
+      throw new Error('invalid gate recheck file limit');
     if (opts.pod && (!opts.pod.pool || !Number.isSafeInteger(opts.pod.shards ?? 24) || (opts.pod.shards ?? 24) < 1
       || !Number.isSafeInteger(opts.pod.shardTimeoutSeconds ?? 1200) || (opts.pod.shardTimeoutSeconds ?? 1200) < 1)) throw new Error('invalid pod sweep options');
     if (opts.remote && !/^(?:[\w.-]+@)?[\w.-]+$/.test(opts.remote)) throw new Error('invalid ssh host');
@@ -1487,6 +2025,23 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     // Its logs go to cut-partial/ — the full cut/ logs stay whole (the next release reads them as a baseline source).
     const partial = readPartialPlan(roots, opts.version, opts.commit);
     if (partial) debug.log('release-loop.gate', 'partial-regate', { version: opts.version, priorCommit: partial.priorCommit, commit: opts.commit, files: partial.files.length });
+    if (partial?.kind === 'carry') {
+      // The plan alone is not evidence: the old cut and its verdict must still be complete and clean at this SHA.
+      if (!verifyDocsOnlyCarry(repo, partial.priorCommit, opts.commit))
+        throw new Error(`carry plan diff is not docs-only: ${partial.priorCommit}..${opts.commit}`);
+      const trusted = roots.some((location) => {
+        const dir = join(location, 'release', opts.version);
+        const failuresPath = join(dir, 'gate-failures.json');
+        const verdictPath = join(dir, 'gate-verdict.json');
+        if (!existsSync(failuresPath) || !existsSync(verdictPath)) return false;
+        const failures = JSON.parse(readFileSync(failuresPath, 'utf8')) as { commit?: unknown; failures?: unknown; errors?: unknown };
+        const verdict = JSON.parse(readFileSync(verdictPath, 'utf8')) as { commit?: unknown; outcome?: unknown };
+        return failures.commit === partial.priorCommit && Array.isArray(failures.failures) && failures.failures.length === 0
+          && (failures.errors === undefined || (Array.isArray(failures.errors) && failures.errors.length === 0))
+          && verdict.commit === partial.priorCommit && verdict.outcome === 'ok';
+      });
+      if (!trusted) throw new Error(`carry plan has no complete clean gate at ${partial.priorCommit}`);
+    }
     // GATE-SKIP-KNOWN-RETRY — the ids the verdict will not count as introduced (the recorded baseline ⊕ env-known), read
     // before the sweep so a shard failing only with them skips its isolation retries. No recorded baseline = no skip.
     let knownFailures: string[] = [];
@@ -1500,12 +2055,13 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       } catch (error) { debug.log('release-loop.gate', 'known-failures-unavailable', { error: String(error) }); }
     }
     const durationSource = join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut');
-    const cutRun = await runner.sweep(cutTree, join(root, 'release', opts.version, 'gate-logs', partial ? 'cut-partial' : 'cut'),
-      opts.pod ? { ...opts.pod, durationSource, ...(knownFailures.length ? { knownFailures } : {}),
+    const cutRun = partial?.kind === 'carry' ? undefined : await runner.sweep(cutTree, join(root, 'release', opts.version, 'gate-logs', partial ? 'cut-partial' : 'cut'),
+      opts.pod ? { ...opts.pod, durationSource, ...(knownFailures.length ? { knownFailures } : {}), onSelectionTimed: ({ ms }) => { result.selectionMs = ms; },
         // GATE-LIVE-OBS: the release ledger's shards.json (UX #24782) — never the run tree's universe; an explicit
         // --ledger-root (tests) keeps it in that ledger.
         shardsFile: { path: opts.ledgerRoot ? gateShardsPath(opts.version, opts.ledgerRoot) : gateShardsPath(opts.version), version: opts.version } } : undefined,
       partial?.files);
+    if (cutRun?.abortedShards) result.abortedShards = cutRun.abortedShards;
     const localStalled = async (run: CommandResult, tree: string, commit: string, label: string) => {
       const stalled = run.stalledEnv ?? [];
       const noCompletedShard = stalled.length && run.rc === 0
@@ -1545,7 +2101,46 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       debug.log('release-loop.gate', 'pod-shard-stalled-env', { files: stalled.map(({ file, reason }) => ({ file, reason })), local });
       return measured;
     };
-    const measuredCut = await localStalled(cutRun, cutTree, opts.commit, 'cut');
+    const measuredCut = cutRun ? await localStalled(cutRun, cutTree, opts.commit, 'cut') : { failures: [], errors: [] };
+    // A between-tests error proves only that the shared process failed. Re-run each affected file by itself using the
+    // same isolated path as ordinary new-failure rechecks, even when the error was present in the baseline ledger.
+    // Replace that file's shard observations with its isolated observations before the existing regression comparison.
+    const prefetchedCut = new Map<string, CommandResult>();
+    for (const file of [...new Set(measuredCut.errors.filter((id) => id.endsWith(' > [error]')).map(fileOf))].sort()) {
+      let run: CommandResult | undefined;
+      let reading: ReturnType<typeof readIsolatedRun> | undefined;
+      let reason: 'reproduced' | 'timeout' | 'unreadable' | undefined;
+      try {
+        run = opts.pod && runner.recheckPod
+          ? await runner.recheckPod(file, opts.commit, opts.pod, GATE_ISOLATED_TIMEOUT_MS)
+          : await runner.command('bun', ['run', 'test:deterministic', asPath(file)], cutTree, GATE_ISOLATED_TIMEOUT_MS);
+      } catch (error) {
+        reason = 'unreadable';
+        debug.log('release-loop.gate', 'unhandled-isolated-run-failed', { file, error: String(error) });
+      }
+      if (run?.timedOut) reason = 'timeout';
+      else if (run) {
+        try {
+          reading = readIsolatedRun(run, `cut unhandled isolated ${file}`, file);
+          if (reading.kind === 'read' && reading.errors.length) reason = 'reproduced';
+        } catch { reason = 'unreadable'; }
+      }
+      const originalIds = measuredCut.errors.filter((id) => fileOf(id) === file);
+      measuredCut.failures = measuredCut.failures.filter((id) => fileOf(id) !== file);
+      measuredCut.errors = measuredCut.errors.filter((id) => fileOf(id) !== file);
+      if (reading?.kind === 'read') measuredCut.failures.push(...reading.failures);
+      else if (reading?.kind === 'rc-nonzero-no-failures') measuredCut.errors.push(`${file} > [rc-nonzero]`);
+      if (reason) {
+        (result.unmeasuredErrors ??= []).push({ file, reason, ids: originalIds });
+        debug.log('release-loop.gate', 'unhandled-isolated-unmeasured', { file, reason, ids: originalIds });
+      } else {
+        prefetchedCut.set(file, run!);
+        if (reading?.kind === 'read' && !reading.failures.length) {
+          (result.interferenceErrors ??= []).push(...originalIds);
+          debug.log('release-loop.gate', 'unhandled-isolated-interference', { file, ids: originalIds });
+        }
+      }
+    }
     const cut = partial ? mergePartialFailures(partial, measuredCut) : measuredCut;
     if (partial) result.partial = { priorCommit: partial.priorCommit, files: partial.files.length };
     cutFailures = cut;
@@ -1598,20 +2193,20 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     for (const id of [...baseline.failures, ...baseline.errors, ...cut.failures, ...cut.errors]) fileOf(id);
     const known = opts.pod ? loadEnvKnownFailures(repo) : new Set<string>();
     const cutIds = [...cut.failures, ...cut.errors];
-    const cutHostFailed = new Set(cutRun.stalledEnv?.map(({ file }) => file) ?? []);
+    const cutHostFailed = new Set(cutRun?.stalledEnv?.map(({ file }) => file) ?? []);
     const baselineIds = [...baseline.failures, ...baseline.errors];
     const countedCut = splitKnownEnv(cutIds, known);
     const countedBaseline = splitKnownEnv(baselineIds, known);
     knownEnvIds = countedCut.knownEnv;
     result.knownEnv = knownEnvIds.length;
-    result.knownEnvCleared = [...new Set(cutRun.passedIds ?? [])].filter((id) => known.has(id) && !cutIds.includes(id) && !cutRun.stalledEnv?.some(({ file }) => fileOf(id) === file)).sort();
+    result.knownEnvCleared = [...new Set(cutRun?.passedIds ?? [])].filter((id) => known.has(id) && !cutIds.includes(id) && !cutRun?.stalledEnv?.some(({ file }) => fileOf(id) === file)).sort();
     const diff = diffFailures(countedCut.counted, countedBaseline.counted);
     result.fixed = result.baselineDeferred ? null : diff.fixed.length;
     preexistingIds.push(...diff.common);
     result.preexisting = preexistingIds.length;
     // GATE-BASELINE-CACHE — only the files whose new failures reproduce in isolation reach the baseline, and each
     // (commit, file, host) is run at most once across gates: this gate's cut results also seed the next gate's baseline.
-    const cacheHost = opts.remote ?? 'local';
+    const cacheHost = opts.pod && runner.recheckPod ? `pod:${opts.pod.pool}` : opts.remote ?? 'local';
     const newFailureFiles = new Set(diff.newFailures.map(fileOf));
     const baseCache = newFailureFiles.size ? readBaselineFileCache(ledger, baseSha) : new Map<string, BaselineFileResult>();
     const cacheStats = { hits: 0, misses: 0 };
@@ -1625,13 +2220,27 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       try { saveBaselineFileCache(ledger, row.commit, [row]); }
       catch (error) { debug.log('release.gate', 'baseline-cache-write-failed', { commit: row.commit, file: row.file, error: String(error) }); }
     };
-    for (const file of newFailureFiles) {
+    const recheckFiles = [...newFailureFiles].sort();
+    const recheckLimit = opts.recheckFileLimit ?? GATE_HOST_RECHECK_FILE_LIMIT;
+    const recheckConcurrency = opts.pod?.isolationConcurrency ?? 4;
+    if (opts.pod && (!Number.isSafeInteger(recheckConcurrency) || recheckConcurrency < 1)) throw new Error('invalid pod recheck concurrency');
+    // Each window is bounded, but overflow is queued into the next one. A limit must never turn known failures into
+    // unmeasured files. Pod checks use the same file-isolation fanout cap as the sweep; host fallback stays serial.
+    debug.log('release-loop.gate', 'isolated-recheck-plan', { files: recheckFiles.length, window: recheckLimit,
+      concurrency: opts.pod && runner.recheckPod ? recheckConcurrency : 1, executor: opts.pod && runner.recheckPod ? 'pod' : 'host',
+      remote: opts.remote ?? null, podBatchFiles: opts.pod && runner.recheckPod && runner.recheckPodBatch ? GATE_RECHECK_POD_BATCH_FILES : 1 });
+    const recheckStartedAt = Date.now();
+    const recheckFile = async (file: string, index: number) => {
+      debug.log('release-loop.gate', 'isolated-recheck-progress',
+        { index: index + 1, total: recheckFiles.length, file, elapsedSec: Math.round((Date.now() - recheckStartedAt) / 1000) });
       // 0.2.15: the cut re-check of a new-failure file (InsidePage.test.tsx · headless Chrome) hung for good — limit it like the host re-run.
-      const cutCheck = cutHostFailed.has(file) ? undefined : await runner.command('bun', ['run', 'test:deterministic', asPath(file)], cutTree, GATE_ISOLATED_TIMEOUT_MS);
+      const cutCheck = cutHostFailed.has(file) ? undefined : prefetchedCut.get(file) ?? (opts.pod && runner.recheckPod
+        ? await runner.recheckPod(file, opts.commit, opts.pod, GATE_ISOLATED_TIMEOUT_MS)
+        : await runner.command('bun', ['run', 'test:deterministic', asPath(file)], cutTree, GATE_ISOLATED_TIMEOUT_MS));
       if (cutCheck?.timedOut) {
         debug.log('release-loop.gate', 'isolated-timeout', { file, label: 'cut isolated', limitMs: GATE_ISOLATED_TIMEOUT_MS });
         result.stalledEnv.push({ file, reason: 'isolated-timeout', local: 'timeout' });
-        continue;
+        return;
       }
       const cutReading = cutCheck === undefined ? undefined : readIsolatedRun(cutCheck, `cut isolated ${file}`, file);
       const rcOnly = cutReading?.kind === 'rc-nonzero-no-failures' ? cutReading : undefined;
@@ -1648,7 +2257,9 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       const timedOut = cutCheck === undefined ? new Set<string>() : new Set(parseTimedOutFailures(stripPodRepoRoot(cutCheck.output)));
       const shaped = candidates.filter((id) => timedOut.has(id) && isolatedCut.failures.includes(id));
       if (shaped.length) {
-        const relaxed = await runner.command('bun', ['run', 'test:deterministic', asPath(file), '--timeout', String(GATE_TIMEOUT_RECHECK_MS)], cutTree, GATE_ISOLATED_TIMEOUT_MS);
+        const relaxed = opts.pod && runner.recheckPod
+          ? await runner.recheckPod(file, opts.commit, opts.pod, GATE_ISOLATED_TIMEOUT_MS, true)
+          : await runner.command('bun', ['run', 'test:deterministic', asPath(file), '--timeout', String(GATE_TIMEOUT_RECHECK_MS)], cutTree, GATE_ISOLATED_TIMEOUT_MS);
         let flaky: string[] = [];
         let recheck: 'read' | 'timeout' | 'unreadable' = 'read';
         if (relaxed.timedOut) recheck = 'timeout';
@@ -1671,7 +2282,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
           } catch (error) { debug.log('release-loop.gate', 'load-flaky-census-write-failed', { file, error: String(error) }); }
         }
       }
-      if (candidates.length === 0) continue;
+      if (candidates.length === 0) return;
       let oldFailures: Set<string>;
       let baselineMissing = false;
       const hit = baseCache.get(`${file}\0${cacheHost}`);
@@ -1681,15 +2292,17 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         oldFailures = new Set([...hit.failures, ...hit.errors]);
       } else {
         cacheStats.misses++;
-        const baselineTree = await getBaseTree();
-        const previous = await runner.command('bun', ['run', 'test:deterministic', asPath(file)], baselineTree, GATE_ISOLATED_TIMEOUT_MS);
+        const baselineTree = opts.pod && runner.recheckPod ? undefined : await getBaseTree();
+        const previous = opts.pod && runner.recheckPod
+          ? await runner.recheckPod(file, baseSha, opts.pod, GATE_ISOLATED_TIMEOUT_MS)
+          : await runner.command('bun', ['run', 'test:deterministic', asPath(file)], baselineTree!, GATE_ISOLATED_TIMEOUT_MS);
         if (previous.timedOut) {
           debug.log('release-loop.gate', 'isolated-timeout', { file, label: 'baseline isolated', limitMs: GATE_ISOLATED_TIMEOUT_MS });
           result.stalledEnv.push({ file, reason: 'isolated-timeout', local: 'timeout' });
-          continue;
+          return;
         }
         if (/No tests found|had no matches/i.test(previous.output) && previous.rc === 1) {
-          const lookup = await runner.command('git', ['ls-tree', '--name-only', baseSha, '--', file], opts.remote ? baselineTree : repo);
+          const lookup = await runner.command('git', ['ls-tree', '--name-only', baseSha, '--', file], opts.remote ? baselineTree ?? cutTree : repo);
           if (lookup.rc !== 0 || lookup.output.trim()) throw new Error(`baseline isolated run incomplete: ${file}`);
           oldFailures = new Set();
           baselineMissing = true;
@@ -1712,16 +2325,60 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         if (oldFailures.has(id)) preexistingIds.push(id);
         else result.introduced.push(id);
       }
+    };
+    const cap = opts.pod && runner.recheckPod ? recheckConcurrency : 1;
+    const settleStarted = async <T>(jobs: Promise<T>[]): Promise<T[]> => {
+      const settled = await Promise.allSettled(jobs);
+      const rejected = settled.find((item): item is PromiseRejectedResult => item.status === 'rejected');
+      if (rejected) throw rejected.reason;
+      return settled.map((item) => (item as PromiseFulfilledResult<T>).value);
+    };
+    for (let start = 0; start < recheckFiles.length; start += recheckLimit) {
+      const window = recheckFiles.slice(start, start + recheckLimit);
+      debug.log('release-loop.gate', 'isolated-recheck-window', { start, files: window.length, total: recheckFiles.length });
+      if (opts.pod && runner.recheckPod && runner.recheckPodBatch) {
+        const pending = window.filter((file) => !cutHostFailed.has(file) && !prefetchedCut.has(file));
+        const groups = Array.from({ length: Math.ceil(pending.length / GATE_RECHECK_POD_BATCH_FILES) }, (_, index) =>
+          pending.slice(index * GATE_RECHECK_POD_BATCH_FILES, (index + 1) * GATE_RECHECK_POD_BATCH_FILES));
+        for (let next = 0; next < groups.length; next += cap) {
+          const batches = await settleStarted(groups.slice(next, next + cap).map((files) =>
+            runner.recheckPodBatch!(files, opts.commit, opts.pod!, GATE_ISOLATED_TIMEOUT_MS)));
+          for (const batch of batches) for (const [file, run] of batch) prefetchedCut.set(file, run);
+        }
+      }
+      for (let next = 0; next < window.length; next += cap)
+        await settleStarted(window.slice(next, next + cap).map((file, slot) => recheckFile(file, start + next + slot)));
+      for (const file of window) prefetchedCut.delete(file);
     }
+    result.introduced.sort();
+    preexistingIds.sort();
+    result.loadFlaky?.sort();
     result.preexisting = preexistingIds.length;
     result.baselineCache = cacheStats;
     debug.log('release.gate', 'baseline-cache', { hits: cacheStats.hits, misses: cacheStats.misses, commit: baseSha });
-    result.outcome = result.introduced.length ? 'regression' : 'ok';
+    const timedOutFiles = [...new Set(result.stalledEnv.filter((item) => item.reason === 'isolated-timeout').map((item) => item.file))].sort();
+    const unmeasuredFiles = [...new Set([...timedOutFiles, ...(result.unmeasuredErrors ?? []).map((item) => item.file)])].sort();
+    if (unmeasuredFiles.length) result.unmeasuredRecheckFiles = unmeasuredFiles;
+    if (timedOutFiles.length || result.unmeasuredErrors?.length) {
+      result.outcome = 'error';
+      result.error = [
+        timedOutFiles.length ? `isolated recheck timed out: ${timedOutFiles.join(', ')}` : undefined,
+        result.unmeasuredErrors?.length ? `unhandled errors unmeasured after isolated recheck: ${result.unmeasuredErrors.map((item) => `${item.file} (${item.reason})`).join(', ')}` : undefined,
+      ].filter(Boolean).join('; ');
+    } else result.outcome = result.introduced.length ? 'regression' : 'ok';
+    if (opts.rehearsalTui) {
+      result.rehearsalTui = await executeTuiNodeCheck(opts.commit, repo, runner.localCommand);
+      if (result.rehearsalTui.outcome !== 'ok') {
+        result.outcome = 'error';
+        result.error = result.rehearsalTui.detail;
+      }
+    }
   } catch (error) {
     result.error = error instanceof Error ? error.message : String(error);
     if (error instanceof StalledPodShards) {
       result.stalledShards = error.stalledShards;
       result.partialSummary = error.partialSummary;
+      if (error.abortedShards) result.abortedShards = error.abortedShards;
     }
   } finally {
     if (baseSnapshot && work) {
@@ -1741,7 +2398,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     if (opts.remote) runner.remoteMirror = undefined;
     result.durationMs = Date.now() - start;
   }
-  if (cutFailures && !result.stalledShards?.length && !result.stalledEnv.length) {
+  if (cutFailures && !result.stalledShards?.length && !result.stalledEnv.length && !result.unmeasuredRecheckFiles?.length) {
     try {
       for (const location of roots) {
         const path = failureFile(location, opts.version);
@@ -1758,31 +2415,54 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       result.error = `baseline persistence: ${String(error)}`;
     }
   }
-  if (result.outcome !== 'error') {
+  {
     const ids = {
       introduced: [...result.introduced].sort(),
       knownEnv: [...knownEnvIds].sort(),
       preexisting: [...preexistingIds].sort(),
       loadFlaky: [...(result.loadFlaky ?? [])].sort(),
+      ...(result.unmeasuredRecheckFiles?.length ? { unmeasuredRecheckFiles: [...result.unmeasuredRecheckFiles].sort() } : {}),
+      ...(result.unmeasuredErrors?.length ? { unmeasuredErrors: result.unmeasuredErrors } : {}),
+      ...(result.interferenceErrors?.length ? { interferenceErrors: [...result.interferenceErrors].sort() } : {}),
     };
+    const observed = result.selectionMs !== undefined ? { selectionMs: result.selectionMs } : {};
     try {
-      const path = verdictFile(ledger, opts.version);
-      mkdirSync(dirname(path), { recursive: true });
-      const temp = join(dirname(path), `.gate-verdict-${process.pid}-${randomUUID()}.tmp`);
-      try {
-        writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit, outcome: result.outcome, ...ids }, null, 2) + '\n', { mode: 0o600 });
-        chmodSync(temp, 0o600);
-        renameSync(temp, path);
-      } finally { if (existsSync(temp)) rmSync(temp); }
+      for (const location of roots) {
+        const path = verdictFile(location, opts.version);
+        if (existsSync(path)) readFileSync(path, 'utf8');
+      }
+      for (const location of roots) {
+        const path = verdictFile(location, opts.version);
+        mkdirSync(dirname(path), { recursive: true });
+        const temp = join(dirname(path), `.gate-verdict-${process.pid}-${randomUUID()}.tmp`);
+        try {
+          writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit, outcome: result.outcome, ...ids, ...observed }, null, 2) + '\n', { mode: 0o600 });
+          chmodSync(temp, 0o600);
+          renameSync(temp, path);
+        } finally { if (existsSync(temp)) rmSync(temp); }
+      }
     } catch (error) {
       result.outcome = 'error';
       result.error = `verdict persistence: ${String(error)}`;
+      const path = verdictFile(ledger, opts.version);
+      try {
+        mkdirSync(dirname(path), { recursive: true });
+        const temp = join(dirname(path), `.gate-verdict-${process.pid}-${randomUUID()}.tmp`);
+        try {
+          writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit, outcome: result.outcome, ...ids, ...observed }, null, 2) + '\n', { mode: 0o600 });
+          chmodSync(temp, 0o600);
+          renameSync(temp, path);
+        } finally { if (existsSync(temp)) rmSync(temp); }
+      } catch (persistenceError) {
+        result.error += `; error verdict persistence: ${String(persistenceError)}`;
+      }
     }
-    if (result.outcome !== 'error') debug.log('release-loop.gate', 'judged', {
-      version: opts.version, commit: opts.commit,
+    debug.log('release-loop.gate', 'judged', {
+      version: opts.version, commit: opts.commit, outcome: result.outcome,
       introduced: result.introduced.length, preexisting: result.preexisting,
       knownEnv: result.knownEnv, loadFlaky: ids.loadFlaky.length,
       introducedIds: ids.introduced, knownEnvIds: ids.knownEnv, preexistingIds: ids.preexisting, loadFlakyIds: ids.loadFlaky,
+      ...(result.outcome === 'error' ? { error: result.error } : {}),
     });
   }
   // GATE-LIVE-OBS-RC-WORDING ⓒ — the shards board says «판정 전» until this lands; then «새 실패 N» only (UX · gate-shards.ts).
@@ -1804,7 +2484,8 @@ export function graphGateResult(result: GateResult, graph: boolean) {
       + (result.outcome === 'ok' ? `새 회귀 ${result.introduced.length} · 기존 ${result.preexisting} · 고침 ${result.fixed ?? '못 셈(기준선 미루기)'}` : `게이트 ${result.outcome}: ${result.error ?? result.introduced.length + ' new regressions'}`) + ` · 환경 알려진 실패 ${result.knownEnv}`
       + (result.rcNonzeroNoFailures.length ? ` · ⚠ 종료코드만 비영 ${result.rcNonzeroNoFailures.length}` : '')
       + (result.loadFlaky?.length ? ` · ⚠ 부하 흔들림 ${result.loadFlaky.length}(시간 초과 꼴 · ${GATE_TIMEOUT_RECHECK_MS / 1000}s 재실행 통과 · 막지 않음)` : '')
-      + (result.stalledEnv.length ? ` · 환경 멈춤 ${result.stalledEnv.length} (Pod 밖 통과 ${result.stalledEnv.filter((item) => item.local === 'passed').length})` : '') };
+      + (result.stalledEnv.length ? ` · 환경 멈춤 ${result.stalledEnv.length} (Pod 밖 통과 ${result.stalledEnv.filter((item) => item.local === 'passed').length})` : '')
+      + (result.abortedShards ? ` · 중단 조각 ${result.abortedShards}(중간 매달림 · 시험만 끊고 재확인)` : '') };
 }
 
 /** GATE-HOST-EXECUTOR — which executor produced (or will produce) this verdict, for the node output and observation. */
@@ -1813,12 +2494,18 @@ export function gateExecutorOf(opts: Pick<GateOptions, 'pod' | 'remote'>): { exe
   return opts.pod ? { executor: 'pod', host: null } : { executor: 'host', host: opts.remote ?? 'local' };
 }
 
+/** A Pod without an SSH host runs on this machine; it does not reserve every remote gate host. */
+export function reservedGateHosts(opts: Pick<GateOptions, 'pod' | 'remote'>): string[] {
+  return opts.pod ? [...new Set(parsePodPool(opts.pod.pool).map(member => member.sshHost ?? hostname()))]
+    : [opts.remote?.split('@').at(-1) ?? hostname()];
+}
+
 /** What was asked for, read best-effort when the options themselves were refused — so a failed gate still says which executor. */
 export function requestedGateExecutor(args: string[], env: NodeJS.ProcessEnv): { executor: string | null; host: string | null } {
   let executor: unknown;
   let host: unknown;
   try {
-    if (env.ELANOUS_GRAPH_CONTEXT && args.every((arg) => arg === '--json')) {
+    if (usesGraphContext(args, env)) {
       const input = readGraphContext(env).input as Record<string, unknown>;
       executor = input.gateExecutor ?? (typeof input.gatePodPool === 'string' ? 'pod' : undefined);
       host = input.gateRemote;
@@ -1832,8 +2519,12 @@ export function requestedGateExecutor(args: string[], env: NodeJS.ProcessEnv): {
   return { executor: typeof executor === 'string' ? executor : null, host: executor !== 'pod' && typeof host === 'string' ? host : null };
 }
 
+function usesGraphContext(args: string[], env: NodeJS.ProcessEnv): boolean {
+  return !!env.ELANOUS_GRAPH_CONTEXT && args.length > 0 && args.every(arg => arg === '--json');
+}
+
 export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOptions | 'help' {
-  const context = env.ELANOUS_GRAPH_CONTEXT && args.every((arg) => arg === '--json') ? readGraphContext(env) : undefined;
+  const context = usesGraphContext(args, env) ? readGraphContext(env) : undefined;
   const fromGraph: Record<string, unknown> = context?.input ?? {};
   const graphCommit = context?.outputs['version-release']?.commit;
   if (typeof graphCommit === 'string') fromGraph.commit = graphCommit;
@@ -1843,6 +2534,8 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
   // GATE-HOST-EXECUTOR: a host gate never reads the pod settings (a bad pod value must not block the fallback executor).
   const hostExecutor = fromGraph.gateExecutor === 'host';
   const opts: GateOptions = {
+    rehearsalTui: fromGraph.rehearsalTui === true,
+    recheckFileLimit: fromGraph.gateRecheckFileLimit !== undefined ? Number(fromGraph.gateRecheckFileLimit) : undefined,
     commit: typeof fromGraph.commit === 'string' ? fromGraph.commit : '',
     version: typeof fromGraph.version === 'string' ? fromGraph.version : '',
     baselineVersion: typeof fromGraph.previousVersion === 'string' ? fromGraph.previousVersion : undefined,
@@ -1857,7 +2550,9 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
       ...(typeof fromGraph.gatePodBunCache === 'string' && fromGraph.gatePodBunCache.trim() ? { bunCache: fromGraph.gatePodBunCache } : {}),
       ...(fromGraph.gatePodInstallSlots !== undefined ? { installSlots: Number(fromGraph.gatePodInstallSlots) } : {}),
       ...(fromGraph.gatePodAdmissionWaitSeconds !== undefined ? { admissionWaitSeconds: Number(fromGraph.gatePodAdmissionWaitSeconds) } : {}),
+      ...(fromGraph.gatePodIsolationConcurrency !== undefined ? { isolationConcurrency: Number(fromGraph.gatePodIsolationConcurrency) } : {}),
       ...(fromGraph.gatePodStallSeconds !== undefined ? { stallSeconds: Number(fromGraph.gatePodStallSeconds) } : {}),
+      ...(fromGraph.gatePodMidRunStallSeconds !== undefined ? { midRunStallSeconds: Number(fromGraph.gatePodMidRunStallSeconds) } : {}),
       ...(fromGraph.gatePodFreshShards === true ? { freshShards: true } : {}),
       ...((cpu) => cpu ? { cpu } : {})(parsePodCpu(fromGraph.gatePodCpu, 'release.loop.gatePodCpu')),
     } : undefined,
@@ -1870,6 +2565,13 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
     if (arg === '--json') continue;
     // Applied after the loop and only to a Pod gate — on its own it must not turn a local gate into a Pod one (review r5).
     if (arg === '--fresh-shards') { freshShards = true; continue; }
+    if (arg === '--rehearsal-tui') { opts.rehearsalTui = true; continue; }
+    if (arg === '--recheck-file-limit') {
+      const value = args[++i];
+      if (!value || !/^\d+$/.test(value) || Number(value) < 1 || !Number.isSafeInteger(Number(value))) throw new Error('--recheck-file-limit requires a positive integer');
+      opts.recheckFileLimit = Number(value);
+      continue;
+    }
     if (arg === '--executor') {
       const value = args[++i];
       if (!isGateExecutor(value)) throw new Error(`--executor must be pod or host: ${value ?? ''}`);
@@ -1916,11 +2618,21 @@ export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner
       debug.log('release-loop.gate', 'executor', { version: opts.version, ...placement, requested: opts.executor ?? null });
     }
     if (opts === 'help') {
-      console.log('Usage: bun scripts/release-loop/gate-node.ts --commit <sha> --version <v> [--baseline-version <prev>] [--baseline-commit <sha>] [--remote <ssh-host>] [--remote-mirror <path>] [--pod-pool <pool>] [--pod-shards <n>] [--pod-shard-timeout-seconds <n>] [--fresh-shards] [--executor <pod|host>] [--json]\nWithout flags, input.commit, input.version and input.previousVersion come from the JSON file at ELANOUS_GRAPH_CONTEXT.\n--executor host (input.gateExecutor) ignores every pod option and sweeps on --remote (input.gateRemote, required).');
+      console.log('Usage: bun scripts/release-loop/gate-node.ts --commit <sha> --version <v> [--baseline-version <prev>] [--baseline-commit <sha>] [--remote <ssh-host>] [--remote-mirror <path>] [--pod-pool <pool>] [--pod-shards <n>] [--pod-shard-timeout-seconds <n>] [--recheck-file-limit <n>] [--fresh-shards] [--executor <pod|host>] [--json]\nWithout flags, input.commit, input.version and input.previousVersion come from the JSON file at ELANOUS_GRAPH_CONTEXT.\n--executor host (input.gateExecutor) ignores every pod option and sweeps on --remote (input.gateRemote, required).');
       return 0;
     }
     version = opts.version;
-    result = await (runner ? judgeGate(opts, runner) : judgeGate(opts));
+    // The graph's existing gate-node execution path delegates verdict classification and persistence here.
+    const context = usesGraphContext(argv, env) ? readGraphContext(env) : undefined;
+    // Let the gate's existing SSH host validation report an invalid host before any reservation is published.
+    const hosts = opts.remote && !/^(?:[\w.-]+@)?[\w.-]+$/.test(opts.remote) ? [] : reservedGateHosts(opts);
+    const reservationRoot = context ? gateHostReservationRoot() : undefined;
+    if (context && (!context.runId || !env.ELANOUS_STATE_DIR || normRoot(env.ELANOUS_STATE_DIR) !== reservationRoot))
+      throw new Error('release gate host reservation requires graph runId and pinned state root');
+    const releaseHosts = context && hosts.length
+      ? reserveReleaseGateHosts(reservationRoot!, context.runId!, hosts) : () => undefined;
+    try { result = await (runner ? judgeGate(opts, runner) : judgeGate(opts)); }
+    finally { releaseHosts(); }
   } catch (error) {
     result = { outcome: 'error', commit: '', introduced: [], preexisting: 0, fixed: 0, knownEnv: 0, knownEnvCleared: [], stalledEnv: [], rcNonzeroNoFailures: [], durationMs: Date.now() - start, error: String(error) };
     placement ??= requestedGateExecutor(argv, env);