elanous 0.2.28 → 0.2.31

package/scripts/release-loop/gate-triage-node.ts

@@ -0,0 +1,190 @@
+#!/usr/bin/env bun
+import { readFileSync } from 'node:fs';
+import { debug } from '../../src/debug/log.js';
+import { registerStandaloneLogSink } from '../../src/domains/standalone-log-sink.js';
+import type { GateResult } from './gate-node.js';
+import { emitNodeResult, readGraphContext, type GraphContext } from './node-verdict.js';
+
+/** A shadow recommendation. No value here is a release waiver or a graph edge. */
+export type GateTriageClass = 'unmeasured' | 'load' | 'env' | 'regression' | 'clean' | 'exhausted';
+
+export interface GateTriageEvidence {
+  /** Observed from the Pod/host during this gate; a timeout alone is not proof of load. */
+  highLoad?: boolean;
+  /** Count of the suspected failure IDs reproduced in an isolated run. */
+  isolatedReproductions?: number;
+  /** Exact introduced IDs that actually received an isolated recheck. */
+  isolatedCheckedFailureIds?: string[];
+  /** Timeout shard files that completed an isolated recheck. */
+  isolatedPassedFiles?: string[];
+  /** Exact test IDs independently attributed to the Pod environment. */
+  environmentFailureIds?: string[];
+  /** The last two actual decisions, including their measured identities. */
+  priorDecisions?: Array<{ classification: GateTriageClass; commit: string; failureIds: string[] }>;
+}
+
+export interface GateTriageShadow {
+  classification: GateTriageClass;
+  reason: string;
+  commit: string;
+  introduced: string[];
+  stalledFiles: string[];
+  failureIds: string[];
+  evidence: {
+    highLoad: boolean | null;
+    isolatedReproductions: number | null;
+    isolatedCheckedFailureIds: string[] | null;
+    isolatedPassedFiles: string[] | null;
+    environmentFailureIds: string[] | null;
+    loadFlaky: string[] | null;
+    stalledEnv: Array<{ file: string; local: string }>;
+  };
+  /** Shadow always goes to the existing failure exit. */
+  outcome: 'fail';
+}
+
+function timeoutShape(gate: GateResult): boolean {
+  return gate.stalledShards?.some((shard) => shard.reason === 'timeout' || shard.reason === 'no-output') === true
+    || (gate.loadFlaky?.length ?? 0) > 0;
+}
+
+export function classifyGateShadow(gate: GateResult, evidence: GateTriageEvidence = {}): GateTriageShadow {
+  const stalledFiles = [...new Set((gate.stalledShards ?? []).flatMap((shard) => shard.files))].sort();
+  const failureIds = [...new Set([...gate.introduced, ...stalledFiles, ...gate.stalledEnv.map((item) => item.file)])].sort();
+  let classification: GateTriageClass;
+  let reason: string;
+
+  const unmeasured = gate.stalledShards?.some((shard) => shard.reason !== 'timeout' && shard.reason !== 'no-output') === true;
+  const loadExplainsIntroduced = gate.introduced.every((id) => gate.loadFlaky?.includes(id) === true
+    && evidence.isolatedCheckedFailureIds?.includes(id) === true);
+  const loadExplainsStalled = stalledFiles.every((file) => evidence.isolatedPassedFiles?.includes(file) === true);
+  const noUnexplainedEnvironmentFailure = gate.stalledEnv.length === 0;
+  const envFiles = new Set(gate.stalledEnv.filter((item) => item.local === 'passed').map((item) => item.file));
+  const envExplainsIntroduced = gate.introduced.every((id) => envFiles.has(id.split(' > ', 1)[0]!)
+    && evidence.environmentFailureIds?.includes(id) === true);
+  const envExplainsStalled = stalledFiles.every((file) => envFiles.has(file));
+  const allEnvironmentChecksPassed = gate.stalledEnv.length > 0 && gate.stalledEnv.every((item) => item.local === 'passed');
+  if (unmeasured) {
+    classification = 'unmeasured';
+    reason = 'gate has unfinished or unattributed shard files';
+  } else if ((gate.introduced.length > 0 || stalledFiles.length > 0)
+    && timeoutShape(gate) && loadExplainsIntroduced && loadExplainsStalled && noUnexplainedEnvironmentFailure
+    && evidence.highLoad === true && evidence.isolatedReproductions === 0) {
+    classification = 'load';
+    reason = 'timeout shape under observed load did not reproduce in isolation';
+  } else if (gate.outcome !== 'ok' && allEnvironmentChecksPassed && envExplainsIntroduced && envExplainsStalled) {
+    classification = 'env';
+    reason = 'Pod environment failure passed outside the Pod';
+  } else if (stalledFiles.length || (gate.outcome === 'error' && gate.introduced.length === 0)) {
+    classification = 'unmeasured';
+    reason = stalledFiles.length ? 'timeout-shaped files remain unmeasured' : 'gate errored without a measured regression';
+  } else if (gate.introduced.length > 0 || gate.outcome === 'regression') {
+    classification = 'regression';
+    reason = 'gate measured an introduced regression';
+  } else if (gate.outcome === 'ok') {
+    classification = 'clean';
+    reason = 'gate passed';
+  } else {
+    classification = 'unmeasured';
+    reason = 'gate failure has no measured regression identity';
+  }
+
+  const repeated = failureIds.length > 0 && evidence.priorDecisions?.slice(-2).length === 2
+    && evidence.priorDecisions.slice(-2).every((prior) => prior.classification === classification
+      && prior.commit === gate.commit
+      && JSON.stringify([...prior.failureIds].sort()) === JSON.stringify(failureIds));
+  if (classification !== 'clean' && repeated) {
+    classification = 'exhausted';
+    reason = 'the same class and failure identities already recurred twice';
+  }
+  return { classification, reason, commit: gate.commit, introduced: [...gate.introduced], stalledFiles, failureIds,
+    evidence: { highLoad: evidence.highLoad ?? null, isolatedReproductions: evidence.isolatedReproductions ?? null,
+      isolatedCheckedFailureIds: evidence.isolatedCheckedFailureIds ? [...evidence.isolatedCheckedFailureIds] : null,
+      isolatedPassedFiles: evidence.isolatedPassedFiles ? [...evidence.isolatedPassedFiles] : null,
+      environmentFailureIds: evidence.environmentFailureIds ? [...evidence.environmentFailureIds] : null,
+      loadFlaky: gate.loadFlaky ? [...gate.loadFlaky] : null,
+      stalledEnv: gate.stalledEnv.map((item) => ({ file: item.file, local: item.local })) },
+    outcome: 'fail' };
+}
+
+/** Read only the completed gate output. The graph wiring is a separate change after M3. */
+export function gateTriageShadowFromContext(context: GraphContext, evidence?: GateTriageEvidence): GateTriageShadow {
+  const value = context.outputs.gate;
+  if (!value || typeof value.commit !== 'string' || !Array.isArray(value.introduced)
+    || !value.introduced.every((item) => typeof item === 'string')
+    || !Array.isArray(value.stalledEnv)
+    || !value.stalledEnv.every((item) => item && typeof item === 'object' && typeof item.file === 'string'
+      && ['passed', 'failed', 'timeout'].includes(String(item.local)))
+    || (value.stalledShards !== undefined && (!Array.isArray(value.stalledShards)
+      || !value.stalledShards.every((item) => item && typeof item === 'object' && Array.isArray(item.files)
+        && item.files.every((file: unknown) => typeof file === 'string') && typeof item.reason === 'string')))
+    || (value.loadFlaky !== undefined && (!Array.isArray(value.loadFlaky)
+      || !value.loadFlaky.every((item) => typeof item === 'string')))
+    || !['ok', 'regression', 'error'].includes(String(value.outcome))) {
+    throw new Error('gate output is missing or malformed');
+  }
+  const input = context.input.gateTriageEvidence;
+  const supplied = input && typeof input === 'object' && !Array.isArray(input) ? input as Record<string, unknown> : {};
+  const observed: GateTriageEvidence = evidence ?? {
+    ...(supplied.highLoad === true ? { highLoad: true } : {}),
+    ...(Number.isSafeInteger(supplied.isolatedReproductions) && Number(supplied.isolatedReproductions) >= 0
+      ? { isolatedReproductions: Number(supplied.isolatedReproductions) } : {}),
+    ...(Array.isArray(supplied.isolatedCheckedFailureIds) && supplied.isolatedCheckedFailureIds.every((id) => typeof id === 'string')
+      ? { isolatedCheckedFailureIds: supplied.isolatedCheckedFailureIds as string[] } : {}),
+    ...(Array.isArray(supplied.isolatedPassedFiles) && supplied.isolatedPassedFiles.every((file) => typeof file === 'string')
+      ? { isolatedPassedFiles: supplied.isolatedPassedFiles as string[] } : {}),
+    ...(Array.isArray(supplied.environmentFailureIds) && supplied.environmentFailureIds.every((id) => typeof id === 'string')
+      ? { environmentFailureIds: supplied.environmentFailureIds as string[] } : {}),
+    ...(Array.isArray(supplied.priorDecisions) && supplied.priorDecisions.every((item) => item && typeof item === 'object'
+      && typeof item.classification === 'string' && typeof item.commit === 'string' && Array.isArray(item.failureIds)
+      && item.failureIds.every((id: unknown) => typeof id === 'string'))
+      ? { priorDecisions: supplied.priorDecisions as GateTriageEvidence['priorDecisions'] } : {}),
+  };
+  return classifyGateShadow(value as unknown as GateResult, observed);
+}
+
+export function logGateTriageShadow(result: GateTriageShadow, version: string): void {
+  debug.log('graph.ground', 'gate-triage-shadow', { version, ...result });
+}
+
+/** A saved verdict has fewer fields than the live gate output. Keep the absent evidence absent. */
+export function gateTriageShadowFromSavedVerdict(value: unknown): { version: string; result: GateTriageShadow } {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('invalid saved gate verdict');
+  const saved = value as Record<string, unknown>;
+  if (typeof saved.version !== 'string' || typeof saved.commit !== 'string'
+    || !['ok', 'regression', 'error'].includes(String(saved.outcome))
+    || !Array.isArray(saved.introduced) || !saved.introduced.every((id) => typeof id === 'string')
+    || (saved.loadFlaky !== undefined && (!Array.isArray(saved.loadFlaky)
+      || !saved.loadFlaky.every((id) => typeof id === 'string')))) throw new Error('invalid saved gate verdict');
+  const gate: GateResult = { outcome: saved.outcome as GateResult['outcome'], commit: saved.commit,
+    introduced: saved.introduced, preexisting: 0, fixed: null, knownEnv: 0, knownEnvCleared: [],
+    stalledEnv: (saved.stalledEnv ?? []) as GateResult['stalledEnv'], rcNonzeroNoFailures: [], durationMs: 0,
+    ...(saved.stalledShards !== undefined ? { stalledShards: saved.stalledShards as GateResult['stalledShards'] } : {}),
+    ...(saved.loadFlaky !== undefined ? { loadFlaky: saved.loadFlaky as string[] } : {}) };
+  const context: GraphContext = { input: { version: saved.version, previousVersion: '0.0.0' },
+    outputs: { gate: gate as unknown as Record<string, unknown> } };
+  return { version: saved.version, result: gateTriageShadowFromContext(context) };
+}
+
+if (import.meta.main) {
+  await registerStandaloneLogSink('release-loop');
+  try {
+    const savedPath = process.argv[2] === '--gate-verdict' ? process.argv[3] : undefined;
+    if (process.argv[2] && !savedPath) throw new Error('usage: gate-triage-node.ts [--gate-verdict <path>]');
+    const { version, result } = savedPath
+      ? gateTriageShadowFromSavedVerdict(JSON.parse(readFileSync(savedPath, 'utf8')))
+      : (() => { const context = readGraphContext(); return { version: context.input.version,
+        result: gateTriageShadowFromContext(context) }; })();
+    logGateTriageShadow(result, version);
+    emitNodeResult({ ...result, verdict: 'fail', summary: `gate-triage shadow: ${result.classification} — ${result.reason}` });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    const result: GateTriageShadow = { outcome: 'fail', classification: 'unmeasured', reason,
+      commit: 'unknown', introduced: [], stalledFiles: [], failureIds: [],
+      evidence: { highLoad: null, isolatedReproductions: null, isolatedCheckedFailureIds: null,
+        isolatedPassedFiles: null, environmentFailureIds: null, loadFlaky: null, stalledEnv: [] } };
+    logGateTriageShadow(result, 'unknown');
+    emitNodeResult({ ...result, verdict: 'fail', summary: `gate-triage shadow: ${reason}` });
+  }
+  process.exitCode = 1;
+}

package/scripts/release-loop/gate-warm-artifacts.ts

@@ -0,0 +1,253 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { parseFailures } from './gate-diff.js';
+import { isCompleteOneFileGateJunit, parseXml, type XmlElement } from '../../src/self-dev/shard-aggregate.js';
+import type { WarmWorkerFileResult } from '../../src/task-orchestrator/surfaces/pod-warm-worker-protocol.js';
+
+const relative = (path: string) => path.replace(/^(?:\.\.\/)*\/?home\/ubuntu\/repo\//, '').replace(/^\.\//, '');
+const lastCount = (log: string, name: string): number | null => {
+  let count: number | null = null;
+  for (const match of log.matchAll(new RegExp(`(?:^|\\n)\\s*(\\d+) ${name}s?\\s*(?=\\n|$)`, 'g'))) count = Number(match[1]);
+  return count;
+};
+const validXmlCodePoint = (code: number): boolean => Number.isSafeInteger(code)
+  && (code === 9 || code === 10 || code === 13 || code >= 0x20 && code <= 0xd7ff
+    || code >= 0xe000 && code <= 0xfffd || code >= 0x10000 && code <= 0x10ffff);
+const numericXmlEntitiesValid = (value: string): boolean => [...value.matchAll(/&#(x[0-9a-fA-F]+|[0-9]+);/g)]
+  .every((match) => validXmlCodePoint(match[1]!.startsWith('x') ? parseInt(match[1]!.slice(1), 16) : parseInt(match[1]!, 10)));
+const xmlText = (value: string): string => value.replace(/&#(x[0-9a-fA-F]+|[0-9]+);|&(amp|lt|gt|quot|apos);/g, (match, numeric: string | undefined, named: string | undefined) => {
+  if (numeric) {
+    const code = numeric.startsWith('x') ? parseInt(numeric.slice(1), 16) : parseInt(numeric, 10);
+    return validXmlCodePoint(code) ? String.fromCodePoint(code) : match;
+  }
+  return ({ amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" } as Record<string, string>)[named ?? ''] ?? match;
+});
+const failureDetail = (value: string): string => xmlText(value).replace(/\x1b\[[0-9;]*[A-Za-z]/g, '').replace(/\r\n/g, '\n').trim();
+function junitFailureDetails(xml: string): Map<string, string> {
+  const details = new Map<string, string>();
+  const root = parseXml(xml);
+  if (!root) return details;
+  const walkSuite = (suite: XmlElement, file: string, names: string[]): void => {
+    const suiteFile = file || suite.attrs.file || suite.attrs.name || '';
+    const nestedNames = file ? [...names, suite.attrs.name ?? ''] : names;
+    for (const child of suite.children) {
+      if (child.name === 'testsuite') { walkSuite(child, suiteFile, nestedNames); continue; }
+      if (child.name !== 'testcase') continue;
+      const id = `${relative(child.attrs.file ?? suiteFile)} > ${[...nestedNames, child.attrs.name ?? ''].join(' > ')}`;
+      const failures = child.children.filter((element) => element.name === 'failure');
+      // One log failure line cannot identify which of several JUnit failure
+      // elements it belongs to. Leave the case unmeasured instead of allowing
+      // a later element to overwrite an earlier, different diagnostic.
+      if (failures.length > 1) { details.set(id, ''); continue; }
+      for (const failure of failures) {
+        const diagnostic = failure.attrs.message === undefined ? '' : failureDetail(failure.attrs.message);
+        const bodyLines = failure.text.split(/\r?\n/);
+        const stackAt = bodyLines.findIndex(line => /^\s*at\s/.test(line));
+        const body = failureDetail((stackAt < 0 ? bodyLines : bodyLines.slice(0, stackAt)).join('\n')
+          .replace(new RegExp(`^${(failure.attrs.type ?? 'Error').replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}:[ \\t]*`), ''));
+        details.set(id, body && body !== diagnostic ? '' : diagnostic);
+      }
+    }
+  };
+  if (root.name === 'testsuite') walkSuite(root, '', []);
+  else if (root.name === 'testsuites') for (const suite of root.children) if (suite.name === 'testsuite') walkSuite(suite, '', []);
+  return details;
+}
+function logFailureDetails(log: string): Map<string, string> | null {
+  const details = new Map<string, string>();
+  let file = '';
+  let block: string[] = [];
+  let errorCount = 0;
+  let unboundError = false;
+  for (const raw of log.split(/\r?\n/)) {
+    const line = raw.trim();
+    const header = /^(?:\.\/)?((?:[\w.-]+\/)+[\w.-]+\.test\.tsx?):(?:\s|$)/.exec(line);
+    if (header) { if (errorCount > 0) unboundError = true; file = relative(header[1]!); block = []; errorCount = 0; continue; }
+    const failed = /\(fail\)\s+(.+?)(?:\s+\[[\d.]+(?:ms|s)\])?$/.exec(line);
+    if (failed && file) {
+      // Bun's JUnit message includes multiline assertion diffs but excludes
+      // the stack. Compare the complete normalized diagnostic, never a prefix.
+      const stackAt = block.findIndex(item => /^\s*at\s/.test(item));
+      const diagnostic = stackAt < 0 ? block : block.slice(0, stackAt);
+      details.set(`${file} > ${failed[1]!.trim()}`, errorCount === 1 ? failureDetail(diagnostic.join('\n')) : '');
+      block = []; errorCount = 0;
+      continue;
+    }
+    if (/^error:\s*/i.test(line)) { block = [raw.replace(/^\s*error:\s*/i, '')]; errorCount++; }
+    else if (errorCount > 0 && !/^\(pass\)/.test(line)) block.push(raw);
+    else if (/^\(pass\)/.test(line)) { if (errorCount > 0) unboundError = true; block = []; errorCount = 0; }
+  }
+  // An error after the last named failure has no JUnit testcase to bind it.
+  // Bun can omit the numeric `errors` summary, so the open diagnostic itself
+  // must make the reference unmeasured.
+  return unboundError || errorCount > 0 ? null : details;
+}
+function junitCases(root: XmlElement): Array<{ file: string; id: string; failed: boolean; error: boolean; skipped: boolean }> {
+  const cases: Array<{ file: string; id: string; failed: boolean; error: boolean; skipped: boolean }> = [];
+  const walkSuite = (suite: XmlElement, file: string, names: string[]): void => {
+    const suiteFile = file || suite.attrs.file || suite.attrs.name || '';
+    const nestedNames = file ? [...names, suite.attrs.name ?? ''] : names;
+    for (const child of suite.children) {
+      if (child.name === 'testsuite') { walkSuite(child, suiteFile, nestedNames); continue; }
+      if (child.name !== 'testcase') continue;
+      const caseFile = relative(child.attrs.file ?? suiteFile);
+      cases.push({ file: caseFile, id: `${caseFile} > ${[...nestedNames, child.attrs.name ?? ''].join(' > ')}`,
+        failed: child.children.some((element) => element.name === 'failure'),
+        error: child.children.some((element) => element.name === 'error'),
+        skipped: child.children.some((element) => element.name === 'skipped') });
+    }
+  };
+  if (root.name === 'testsuite') walkSuite(root, '', []);
+  else if (root.name === 'testsuites') for (const suite of root.children) if (suite.name === 'testsuite') walkSuite(suite, '', []);
+  return cases;
+}
+function logPassIds(log: string): string[] {
+  const ids: string[] = [];
+  let file = '';
+  for (const raw of log.split(/\r?\n/)) {
+    const line = raw.trim();
+    const header = /^(?:\.\/)?((?:[\w.-]+\/)+[\w.-]+\.test\.tsx?):(?:\s|$)/.exec(line);
+    if (header) { file = relative(header[1]!); continue; }
+    const passed = /^\(pass\)\s+(.+?)(?:\s+\[[\d.]+(?:ms|s)\])?$/.exec(line);
+    if (passed && file) ids.push(`${file} > ${passed[1]!.trim()}`);
+  }
+  return ids.sort();
+}
+const MAX_WARM_ARTIFACT_BYTES = 64 * 1024 * 1024;
+const readMaybe = (path: string): Buffer | null => {
+  try { return statSync(path).size <= MAX_WARM_ARTIFACT_BYTES ? readFileSync(path) : null; }
+  catch { return null; }
+};
+const sha256 = (value: Buffer): string => createHash('sha256').update(value).digest('hex');
+
+/** Bind a completed one-file Job's collected outbox to its host metadata. */
+export function writeWarmJobManifest(prefix: string, file: string, cutSha: string, attemptId: string): boolean {
+  const meta = readMaybe(`${prefix}.json`);
+  const log = readMaybe(`${prefix}.log`);
+  const junit = readMaybe(`${prefix}.junit.xml`);
+  const rcBytes = readMaybe(`${prefix}.rc`);
+  if (!meta || !log || !junit || !rcBytes || !file || !cutSha || !attemptId) return false;
+  let row: Record<string, unknown>;
+  try { row = JSON.parse(meta.toString('utf8')) as Record<string, unknown>; } catch { return false; }
+  if (!row || typeof row !== 'object' || Array.isArray(row) || row.commit !== cutSha
+    || row.attemptId !== attemptId || !Array.isArray(row.files) || row.files.length !== 1 || row.files[0] !== file
+    || (row.rc !== 0 && row.rc !== 1) || row.jobFailed !== false || row.jobExitCode !== 0
+    || rcBytes.toString('utf8').trim() !== String(row.rc)) return false;
+  writeFileSync(`${prefix}.warm-manifest.json`, JSON.stringify({ protocol: 1, cutSha, attemptId, file, rc: row.rc,
+    logSha256: sha256(log), junitSha256: sha256(junit), metaSha256: sha256(meta), rcSha256: sha256(rcBytes) }) + '\n', { mode: 0o600 });
+  return true;
+}
+
+/** Convert only a cut/attempt-bound, complete one-file artifact set. */
+export function warmReferenceFromJobArtifacts(prefix: string, file: string, expected: { cutSha: string; attemptId: string }): WarmWorkerFileResult | null {
+  if (!file || !expected?.cutSha || !expected?.attemptId
+    || !existsSync(`${prefix}.log`)
+    || !existsSync(`${prefix}.junit.xml`) || !existsSync(`${prefix}.json`)
+    || !existsSync(`${prefix}.rc`) || !existsSync(`${prefix}.warm-manifest.json`)) return null;
+  let rc: number;
+  const metadata = readMaybe(`${prefix}.json`);
+  if (metadata === null) return null;
+  {
+    let meta: unknown;
+    try { meta = JSON.parse(metadata.toString('utf8')); } catch { return null; }
+    if (!meta || typeof meta !== 'object' || Array.isArray(meta)) return null;
+    const row = meta as Record<string, unknown>;
+    if ((row.rc !== 0 && row.rc !== 1) || row.jobFailed !== false || row.jobExitCode !== 0
+      || !Array.isArray(row.files) || row.files.length !== 1 || row.files[0] !== file
+      || row.commit !== expected.cutSha || row.attemptId !== expected.attemptId) return null;
+    rc = row.rc;
+  }
+  const logBytes = readMaybe(`${prefix}.log`);
+  const xmlBytes = readMaybe(`${prefix}.junit.xml`);
+  const rcBytes = readMaybe(`${prefix}.rc`);
+  if (logBytes === null || xmlBytes === null || rcBytes === null || rcBytes.toString('utf8').trim() !== String(rc)) return null;
+  {
+    let manifest: unknown;
+    try { manifest = JSON.parse(readMaybe(`${prefix}.warm-manifest.json`)?.toString('utf8') ?? ''); } catch { return null; }
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) return null;
+    const bound = manifest as Record<string, unknown>;
+    if (bound.protocol !== 1 || bound.cutSha !== expected.cutSha || bound.attemptId !== expected.attemptId
+      || bound.file !== file || bound.rc !== rc || bound.logSha256 !== sha256(logBytes)
+      || bound.junitSha256 !== sha256(xmlBytes) || bound.metaSha256 !== sha256(metadata)
+      || bound.rcSha256 !== sha256(rcBytes)) return null;
+  }
+  const log = logBytes.toString('utf8').replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
+  const xml = xmlBytes.toString('utf8');
+  if (!numericXmlEntitiesValid(xml)) return null;
+  const sourceBindings = [...log.matchAll(/^\[warm-worker\] cut=([^\s]+) attempt=([^\s]+)$/gm)];
+  if (sourceBindings.length !== 1 || sourceBindings[0]![1] !== expected.cutSha
+    || sourceBindings[0]![2] !== expected.attemptId
+    || sourceBindings[0]!.index! > log.indexOf('bun test v')) return null;
+  // The one-file shell writes the JUnit digest into its log before collection.
+  // A new host manifest cannot legitimize a JUnit from another Job whose
+  // message matches but exception type or stack location differs.
+  const junitBindings = [...log.matchAll(/^\[warm-worker\] junit-sha256=([0-9a-f]{64})$/gm)];
+  if (junitBindings.length !== 1 || junitBindings[0]![1] !== sha256(xmlBytes)) return null;
+  // Bind the run command to the requested file before comparing result names.
+  // Legacy one-shot Jobs record the wrapper invocation; the resident worker
+  // writes a dedicated header.
+  const workerSources = [...log.matchAll(/^\[warm-worker\] file=([^\s]+)$/gm)].map(match => match[1]);
+  const jobSources = [...log.matchAll(/^\$ bun run scripts\/test-deterministic\.ts[^\n]*$/gm)].map(match => match[0]);
+  const bunSources = [...log.matchAll(/^(?:\.\/)?([A-Za-z0-9_./-]+\.test\.tsx?):(?:\r?\n|$)/gm)].map(match => relative(match[1]!));
+  const escapedFile = file.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const invokedFile = jobSources[0] && new RegExp(`(?:^|[\\s"'])(?:\\.\\/)?${escapedFile}(?=$|[\\s"'])`).test(jobSources[0]);
+  if (workerSources.length > 1 || jobSources.length > 1
+    || (workerSources.length === 1 && workerSources[0] !== file)
+    || (jobSources.length === 1 && !invokedFile)
+    || (workerSources.length === 1 && (bunSources.length !== 1 || bunSources[0] !== file))
+    || (jobSources.length === 1 && bunSources.some(source => source !== file))
+    || (workerSources.length === 0 && jobSources.length === 0)) return null;
+  const runStarts = [...log.matchAll(/(?:^|\n)bun test v[^\n]*/g)];
+  const runSummaries = [...log.matchAll(/Ran (\d+) tests? across (\d+) files?/g)];
+  if (runSummaries.length !== 1 || (existsSync(`${prefix}.json`) && runStarts.length !== 1)) return null;
+  const root = parseXml(xml);
+  const cases = root ? junitCases(root) : [];
+  const declared = root ? Number(root.attrs.tests) : NaN;
+  if (!root || !isCompleteOneFileGateJunit(xml, file) || !cases.length || !Number.isSafeInteger(declared) || declared !== cases.length
+    || cases.some(item => item.file !== file || item.error || item.skipped)) return null;
+  const failureIds = cases.filter(item => item.failed).map(item => item.id).sort();
+  // Dots-only success logs lack test identities. A same-file, same-count
+  // JUnit can then be rebound with a fresh manifest, so fail closed.
+  {
+    const allIds = cases.map(item => item.id).sort();
+    // A duplicate name cannot identify which JUnit case matches which log
+    // line, even when the counts and diagnostics happen to agree.
+    if (new Set(allIds).size !== allIds.length) return null;
+    const fromXml = allIds.filter(id => !failureIds.includes(id));
+    const fromLog = logPassIds(log);
+    if (fromXml.length !== cases.length - failureIds.length || fromLog.length !== fromXml.length
+      || fromXml.some((id, index) => id !== fromLog[index])) return null;
+  }
+  // A manifest can be rebound after mixing two complete runs. Match each
+  // failure's content, not only its test name, against the captured log.
+  const xmlDetails = junitFailureDetails(xml);
+  const logDetails = logFailureDetails(log);
+  if (!logDetails || xmlDetails.size !== failureIds.length || logDetails.size !== failureIds.length
+    || [...xmlDetails].some(([id, message]) => !message || logDetails.get(id) !== message)) return null;
+  const loggedFailureIds = parseFailures(log).map(id => {
+    const at = id.indexOf(' > ');
+    return at < 0 ? id : `${relative(id.slice(0, at))}${id.slice(at)}`;
+  });
+  if (failureIds.length !== loggedFailureIds.length
+    || failureIds.some(id => !loggedFailureIds.includes(id))) return null;
+  const passes = lastCount(log, 'pass');
+  const fails = lastCount(log, 'fail');
+  // Bun omits the error counter entirely when it is zero.
+  const errors = lastCount(log, 'error') ?? 0;
+  const ran = runSummaries[0];
+  const ranEnd = ran === undefined ? -1 : ran.index! + ran[0].length;
+  const tail = ranEnd < 0 ? '' : log.slice(ranEnd);
+  const runTail = junitBindings.length === 1
+    ? tail.replace(/\s*\[warm-worker\] junit-sha256=[0-9a-f]{64}\s*$/, '') : tail;
+  // A completed one-file run may only end with Bun's duration line. Any
+  // partial next-run prefix (including a truncated `bun te`) is unmeasured.
+  if (!/^\.?\s*(?:\[[\d.]+(?:ms|s)\])?\s*$/.test(runTail)) return null;
+  // Bun's unhandled errors are absent from testcase JUnit. With no second
+  // diagnostic channel to bind them, a reused worker must treat them as unknown.
+  if (passes === null || fails === null || errors !== 0 || !ran || Number(ran[1]) !== cases.length || Number(ran[2]) !== 1
+    || passes + fails !== cases.length
+    || failureIds.length !== fails || new Set(failureIds).size !== failureIds.length
+    || failureIds.some(id => !id.startsWith(`${file} > `))
+    || (rc === 0 ? fails !== 0 : fails === 0)) return null;
+  return { file, rc, failureIds, errorIds: [], junitComplete: true };
+}

package/scripts/release-loop/import-graph-scc-run.ts

@@ -0,0 +1,54 @@
+// Bind the shared gate selector to the committed-tree SCC report at one exact HEAD.
+import { spawnSync } from 'node:child_process';
+import { selectGateTestFiles } from '../../src/self-implement/gate-cli.js';
+import { gitClosureTree } from './gate-closure.js';
+import { analyzeImportGraphScc, type ImportGraphSccReport } from './import-graph-scc.js';
+
+export type ImportGraphGateResult =
+  | { readonly ok: false; readonly reason: string }
+  | { readonly ok: true; readonly head40: string; readonly base40: string; readonly changedFiles: readonly string[]; readonly report: ImportGraphSccReport };
+
+function git(repo: string, args: readonly string[]): { status: number | null; stdout: string; stderr: string } {
+  // git-spawn-allow: read-only HEAD/cleanliness checks; no checkout or mutation.
+  const result = spawnSync('git', [...args], { cwd: repo, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}
+
+/** Run only from a clean checkout. Selector and closure reader then observe the same committed HEAD. */
+export function reportImportGraphSccForGate(repo: string, base40: string): ImportGraphGateResult {
+  if (!/^[0-9a-f]{40}$/i.test(base40)) return { ok: false, reason: 'base must be a full commit SHA' };
+  const head = git(repo, ['rev-parse', '--verify', 'HEAD']);
+  const head40 = head.stdout.trim();
+  if (head.status !== 0 || !/^[0-9a-f]{40}$/i.test(head40)) return { ok: false, reason: 'HEAD unreadable' };
+  if (git(repo, ['merge-base', '--is-ancestor', base40, head40]).status !== 0) return { ok: false, reason: 'base is not an ancestor of HEAD' };
+  const status = git(repo, ['status', '--porcelain', '--untracked-files=normal']);
+  if (status.status !== 0 || status.stdout.trim()) return { ok: false, reason: 'working tree is not clean' };
+
+  let selection: ReturnType<typeof selectGateTestFiles>;
+  try {
+    selection = selectGateTestFiles(repo, { base: base40, includeImporterTests: true });
+  } catch (error) {
+    return { ok: false, reason: `gate selector failed: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  if (selection.baseRef !== base40) return { ok: false, reason: 'gate selector base mismatch' };
+  const afterHead = git(repo, ['rev-parse', '--verify', 'HEAD']);
+  const afterStatus = git(repo, ['status', '--porcelain', '--untracked-files=normal']);
+  if (afterHead.status !== 0 || afterHead.stdout.trim() !== head40 || afterStatus.status !== 0 || afterStatus.stdout.trim()) {
+    return { ok: false, reason: 'HEAD or working tree changed during gate selection' };
+  }
+  const issues: string[] = [];
+  if (selection.lookupFailed) issues.push(`importer lookup failed: ${selection.lookupFailed}`);
+  if (selection.unrunImporterTotal === null) issues.push('unrun importer count unknown');
+  else if (selection.unrunImporterTotal > 0) issues.push(`unrun importer tests: ${selection.unrunImporterTotal}`);
+  if (selection.routeLookupFailures.length) issues.push(`route lookup failures: ${selection.routeLookupFailures.length}`);
+  if (selection.callerTestsOverflow.length) issues.push(`caller tests overflow: ${selection.callerTestsOverflow.length}`);
+  if (selection.alwaysIncludeMissing.length) issues.push(`always-include missing: ${selection.alwaysIncludeMissing.length}`);
+  if (selection.unverified.length) issues.push(`changed paths unverified: ${selection.unverified.length}`);
+  let report: ImportGraphSccReport;
+  try {
+    report = analyzeImportGraphScc(gitClosureTree(repo, head40), selection.testFiles, { complete: issues.length === 0, issues }, {}, selection.changedFiles);
+  } catch (error) {
+    return { ok: false, reason: `committed closure unreadable: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  return { ok: true, head40, base40, changedFiles: selection.changedFiles, report };
+}