elanous 0.2.28 → 0.2.31

package/scripts/release-loop/import-graph-scc.ts

@@ -0,0 +1,215 @@
+// IMPORT-GRAPH-SCC: report cycles in the static import graph reached by the gate's selected test files.
+// The graph comes from the same committed-tree reader as gate-closure. A cycle report is diagnostic;
+// opaque or absent inputs remain unmeasured and cannot authorize a smaller gate or concurrent train.
+import { isTestPath } from '../../src/self-implement/importer-test-index.js';
+import { buildClosureGraph, type ClosureGraph, type ClosureOptions, type ClosureTree } from './gate-closure.js';
+
+export interface ChangedFileImpact {
+  readonly file: string;
+  /** Definite reverse-dependency reach, including the test file itself. */
+  readonly affectedTests: readonly string[];
+  readonly affectedTestCount: number;
+  /** Tests with an opaque dependency can also be affected; they are never counted as definitely unaffected. */
+  readonly possibleTests: readonly string[];
+  readonly possibleTestCount: number;
+  readonly measured: boolean;
+  readonly issues: readonly string[];
+}
+
+function changedFileImpacts(graph: ClosureGraph, preload: readonly string[], changedFiles: readonly string[]): ChangedFileImpact[] {
+  const tests = [...graph.tracked].filter(isTestPath).sort();
+  const reverse = new Map<string, string[]>();
+  for (const [from, dependencies] of graph.forward) for (const dependency of dependencies) {
+    const importers = reverse.get(dependency) ?? [];
+    importers.push(from);
+    reverse.set(dependency, importers);
+  }
+  const reverseReach = (seeds: readonly string[]): Set<string> => {
+    const seen = new Set(seeds);
+    const queue = [...seeds];
+    for (let at = 0; at < queue.length; at++) for (const importer of reverse.get(queue[at]!) ?? []) {
+      if (seen.has(importer)) continue;
+      seen.add(importer);
+      queue.push(importer);
+    }
+    return seen;
+  };
+  const uncertainTests = reverseReach([...graph.opaque.keys()]);
+  const preloadClosure = new Set<string>();
+  const pending = [...preload];
+  while (pending.length) {
+    const file = pending.pop()!;
+    if (preloadClosure.has(file)) continue;
+    preloadClosure.add(file);
+    pending.push(...(graph.staticImports.get(file) ?? []));
+  }
+  const preloadOpaque = [...preloadClosure].some((file) => graph.opaque.has(file) || !graph.tracked.has(file));
+  return [...new Set(changedFiles)].sort().map((file) => {
+    const issues: string[] = [];
+    if (!graph.tracked.has(file)) issues.push('changed file missing at HEAD');
+    if (preloadOpaque) issues.push('preload closure opaque or missing');
+    const reached = preloadClosure.has(file) ? new Set(tests) : reverseReach([file]);
+    const affectedTests = tests.filter((test) => reached.has(test));
+    const possibleTests = tests.filter((test) => reached.has(test) || uncertainTests.has(test) || preloadOpaque || !graph.tracked.has(file));
+    if (possibleTests.length > affectedTests.length) issues.push('unresolved reach may affect more tests');
+    return { file, affectedTests, affectedTestCount: affectedTests.length, possibleTests,
+      possibleTestCount: possibleTests.length, measured: issues.length === 0, issues };
+  });
+}
+
+export interface ImportCutCandidate {
+  /** Removing these DFS back edges would make this SCC acyclic; the set is deterministic, not minimal. */
+  readonly from: string;
+  readonly to: string;
+  readonly sccSize: number;
+  /** Reverse dependency closure of `from` within the selected-test graph, including literal dynamic imports. */
+  readonly impactedFiles: readonly string[];
+  readonly impactedTests: readonly string[];
+}
+
+export interface ImportGraphSccReport {
+  readonly scope: 'selected-tests-static-imports';
+  readonly measured: boolean;
+  readonly selectedTests: readonly string[];
+  readonly reachableFiles: number;
+  readonly cycleCount: number;
+  readonly largestScc: number;
+  readonly cutCandidateTotal: number;
+  readonly cutCandidates: readonly ImportCutCandidate[];
+  readonly opaqueFiles: readonly string[];
+  readonly missingTests: readonly string[];
+  readonly selectionIssues: readonly string[];
+  readonly unmeasuredCount: number;
+  readonly changedFileImpacts: readonly ChangedFileImpact[];
+}
+
+export interface ImportGraphSelectionStatus {
+  /** True only after #28000 reports a complete lookup, with no overflow or unrunnable test. */
+  readonly complete: boolean;
+  readonly issues: readonly string[];
+}
+
+/** Read-only structural report. Call with #28000's exact selected test paths at the same HEAD. */
+export function analyzeImportGraphScc(
+  tree: ClosureTree,
+  selectedTests: readonly string[],
+  selectionStatus: ImportGraphSelectionStatus,
+  options: ClosureOptions = {},
+  changedFiles: readonly string[] = [],
+): ImportGraphSccReport {
+  const graph = buildClosureGraph(tree, options);
+  const changedFileImpactsReport = changedFileImpacts(graph, tree.preload, changedFiles);
+  const tests = [...new Set(selectedTests)].sort();
+  const missingTests = tests.filter((test) => !graph.staticImports.has(test));
+  const reachable = new Set<string>();
+  const pending = tests.filter((test) => graph.staticImports.has(test));
+  while (pending.length) {
+    const file = pending.pop()!;
+    if (reachable.has(file)) continue;
+    reachable.add(file);
+    pending.push(...(graph.staticImports.get(file) ?? []));
+  }
+  // The SCC is intentionally static, but certainty must follow every dependency the closure reader knows:
+  // a dynamic import can reach an opaque file even when that file is outside the static SCC graph.
+  const closureReachable = new Set<string>();
+  const closurePending = tests.filter((test) => graph.forward.has(test));
+  while (closurePending.length) {
+    const file = closurePending.pop()!;
+    if (closureReachable.has(file)) continue;
+    closureReachable.add(file);
+    closurePending.push(...(graph.forward.get(file) ?? []));
+  }
+  const opaqueFiles = [...closureReachable].filter((file) => graph.opaque.has(file)).sort();
+  // An empty selection does not prove that no test can observe a change.
+  const issues = [...new Set(selectionStatus.issues.length ? selectionStatus.issues
+    : selectionStatus.complete ? [] : ['selection incomplete'])].sort();
+  const measured = tests.length > 0 && missingTests.length === 0 && opaqueFiles.length === 0 && issues.length === 0;
+  const edges = new Map<string, string[]>();
+  const reverse = new Map<string, string[]>();
+  const impactReverse = new Map<string, string[]>();
+  for (const file of closureReachable) for (const next of graph.forward.get(file) ?? []) {
+    if (closureReachable.has(next)) impactReverse.set(next, [...(impactReverse.get(next) ?? []), file]);
+  }
+  for (const file of reachable) {
+    const neighbors = [...(graph.staticImports.get(file) ?? []), ...(graph.selfStaticImports.has(file) ? [file] : [])]
+      .filter((next) => reachable.has(next)).sort();
+    edges.set(file, neighbors);
+    for (const next of neighbors) reverse.set(next, [...(reverse.get(next) ?? []), file]);
+  }
+  for (const importers of reverse.values()) importers.sort();
+
+  // Iterative Kosaraju avoids a JS call-stack limit on a large repository SCC.
+  const visited = new Set<string>();
+  const order: string[] = [];
+  for (const root of [...reachable].sort()) {
+    if (visited.has(root)) continue;
+    const stack: { file: string; exit: boolean }[] = [{ file: root, exit: false }];
+    while (stack.length) {
+      const { file, exit } = stack.pop()!;
+      if (exit) { order.push(file); continue; }
+      if (visited.has(file)) continue;
+      visited.add(file);
+      stack.push({ file, exit: true });
+      for (const next of [...(edges.get(file) ?? [])].reverse()) if (!visited.has(next)) stack.push({ file: next, exit: false });
+    }
+  }
+  const assigned = new Set<string>();
+  const components: string[][] = [];
+  for (const root of order.reverse()) {
+    if (assigned.has(root)) continue;
+    const component: string[] = [];
+    const stack = [root];
+    assigned.add(root);
+    while (stack.length) {
+      const file = stack.pop()!;
+      component.push(file);
+      for (const next of reverse.get(file) ?? []) if (!assigned.has(next)) { assigned.add(next); stack.push(next); }
+    }
+    if (component.length > 1 || graph.selfStaticImports.has(component[0]!)) components.push(component.sort());
+  }
+  components.sort((a, b) => b.length - a.length || a[0]!.localeCompare(b[0]!));
+
+  const cutEdges: { from: string; to: string; sccSize: number }[] = [];
+  for (const component of components) {
+    const members = new Set(component);
+    const seen = new Set<string>();
+    const active = new Set<string>();
+    for (const root of component) {
+      if (seen.has(root)) continue;
+      const stack: { file: string; next: number; neighbors: string[] }[] = [];
+      const enter = (file: string): void => {
+        seen.add(file);
+        active.add(file);
+        stack.push({ file, next: 0, neighbors: (edges.get(file) ?? []).filter((next) => members.has(next)) });
+      };
+      enter(root);
+      while (stack.length) {
+        const frame = stack[stack.length - 1]!;
+        const next = frame.neighbors[frame.next++];
+        if (next === undefined) { active.delete(frame.file); stack.pop(); continue; }
+        if (active.has(next)) cutEdges.push({ from: frame.file, to: next, sccSize: component.length });
+        else if (!seen.has(next)) enter(next);
+      }
+    }
+  }
+  const testSet = new Set(tests);
+  const cutCandidates = cutEdges.slice(0, 10).map(({ from, to, sccSize }) => {
+    const impact = new Set<string>();
+    const stack = [from];
+    while (stack.length) {
+      const file = stack.pop()!;
+      if (impact.has(file)) continue;
+      impact.add(file);
+      stack.push(...(impactReverse.get(file) ?? []));
+    }
+    const impactedFiles = [...impact].sort();
+    return { from, to, sccSize, impactedFiles, impactedTests: impactedFiles.filter((file) => testSet.has(file)) };
+  });
+  return {
+    scope: 'selected-tests-static-imports', measured, selectedTests: tests,
+    reachableFiles: reachable.size, cycleCount: components.length, largestScc: components[0]?.length ?? 0,
+    cutCandidateTotal: cutEdges.length, cutCandidates, opaqueFiles, missingTests,
+    selectionIssues: issues, unmeasuredCount: opaqueFiles.length + missingTests.length + issues.length + (tests.length === 0 ? 1 : 0),
+    changedFileImpacts: changedFileImpactsReport,
+  };
+}

package/scripts/release-loop/node-verdict.ts

@@ -8,6 +8,7 @@ export type NodeOutcome = 'ok' | 'fail' | 'error';
 export type NodeVerdict = 'pass' | 'flaky' | 'fail';
 export interface GraphContext {
   nodeId?: string;
+  runId?: string;
   input: { version: string; previousVersion: string; [key: string]: unknown };
   outputs: Record<string, Record<string, unknown>>;
 }
@@ -22,6 +23,7 @@ export function readGraphContext(env: NodeJS.ProcessEnv = process.env): GraphCon
   if (!input || typeof input.version !== 'string' || !isReleaseVersion(input.version)
     || typeof input.previousVersion !== 'string' || !/^\d+\.\d+\.\d+$/.test(input.previousVersion)) throw new Error('version and previousVersion required');
   return { ...(typeof context.nodeId === 'string' ? { nodeId: context.nodeId } : {}),
+    ...(typeof context.runId === 'string' ? { runId: context.runId } : {}),
     input: input as GraphContext['input'], outputs: context.outputs && typeof context.outputs === 'object' ? context.outputs as GraphContext['outputs'] : {} };
 }
 

package/scripts/release-loop/probe-pod-host-dirs-live.ts

@@ -0,0 +1,113 @@
+#!/usr/bin/env bun
+// Run on a host with kubectl access. Each arm launches a real k3d Job; no test seam replaces kubectl.
+import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { runPodCommand } from '../../src/task-orchestrator/surfaces/pod-command-job';
+import { PodPoolScheduler, type PodPoolMember } from '../../src/task-orchestrator/surfaces/pod-pool';
+import { prepareHostDirsOnce, resetHostDirsPrepMemo } from '../../src/task-orchestrator/surfaces/pod-install-slots';
+
+type Probe = { arm: 'node-prepared' | 'init-fallback'; job: string; exitCode: number; prep: Record<string, unknown> | null;
+  hostPaths: string[]; initContainers: string[]; node: string; childWritable: boolean; artifactsError: string | null };
+
+function option(name: string, fallback?: string): string {
+  const index = process.argv.indexOf(`--${name}`);
+  const value = index < 0 ? fallback : process.argv[index + 1];
+  if (!value || value.startsWith('--')) throw new Error(`--${name} required`);
+  return value;
+}
+
+async function main(): Promise<void> {
+  const context = option('context');
+  const host = option('host');
+  const cluster = option('cluster', 'elanous-pool');
+  const image = option('image');
+  const namespace = option('namespace', 'elanous-test');
+  const cacheBase = option('cache', '/var/lib/elanous/gate-probe-cache');
+  const slotsBase = option('slots', '/var/lib/elanous/gate-probe-slots');
+  for (const path of [cacheBase, slotsBase]) {
+    if (!/^\/[A-Za-z0-9._/-]+$/.test(path) || path.split('/').includes('..')) throw new Error(`unsafe host path: ${path}`);
+  }
+  const member: PodPoolMember = { context, sshHost: host, k3dCluster: cluster, capacity: 1 };
+  const kubectl = (args: readonly string[], input?: string) => {
+    const run = spawnSync('kubectl', args, { input, encoding: 'utf8', timeout: 30_000, maxBuffer: 4 * 1024 * 1024 });
+    return { status: run.status ?? 1, stdout: run.stdout ?? '', stderr: run.stderr ?? String(run.error ?? '') };
+  };
+  const check = kubectl(['--context', context, '-n', namespace, 'get', 'namespace', namespace]);
+  if (check.status !== 0) throw new Error(`cluster/namespace unreadable: ${check.stderr.trim()}`);
+  const artifactRoot = mkdtempSync(join(tmpdir(), 'gate-host-dirs-live-'));
+  const nonce = `${Date.now().toString(36)}-${process.pid}`;
+  const sourceCommit = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: resolve(import.meta.dir, '../..'), encoding: 'utf8', maxBuffer: SPAWN_SYNC_MAX_BUFFER }).stdout?.trim() || null;
+  const results: Probe[] = [];
+  try {
+    for (const arm of ['node-prepared', 'init-fallback'] as const) {
+      const name = `gate-host-dirs-${arm}-${Date.now().toString(36)}`;
+      // Distinct absent paths: the fallback arm cannot pass merely because the first arm already chowned its dirs.
+      const cache = join(cacheBase, `${arm}-${nonce}`);
+      const slots = join(slotsBase, `${arm}-${nonce}`);
+      let prep: Record<string, unknown> | null = null;
+      let completed = false;
+      try {
+        const result = await runPodCommand({
+          command: ['sh', '-c', 'printf cache-ok > /bun-cache/.host-dir-probe && printf slots-ok > /gate-install-slots/.host-dir-probe && test "$(cat /bun-cache/.host-dir-probe)" = cache-ok && test "$(cat /gate-install-slots/.host-dir-probe)" = slots-ok && rm /bun-cache/.host-dir-probe /gate-install-slots/.host-dir-probe && echo HOST_DIRS_WRITTEN'],
+          name,
+          namespace, image, imageCommit: null, deadlineSeconds: 120, pollMs: 1_000, statusUnreadableMs: 30_000,
+          memoryLimit: '2Gi',
+          bunCache: cache, installSlots: slots, env: { NODE_ENV: 'test' }, configHostMirror: () => undefined,
+          poolScheduler: new PodPoolScheduler([member]), artifactsRoot: artifactRoot,
+          // The exact image was selected by the operator. This probe does not build or sync it.
+          syncImages: async () => new Map([[context, { ok: true, action: 'fresh' as const, detail: 'operator-selected image', ms: 0 }]]),
+          prepareHostDirs: arm === 'node-prepared'
+            ? async (args) => prepareHostDirsOnce(args)
+            : async () => ({ host, ok: false, ms: 0, detail: 'forced init fallback probe' }),
+          kubectl,
+          log: (_category, event, data) => { if (event === 'host-dirs-prep') prep = data; },
+        });
+        const job = kubectl(['--context', context, '-n', namespace, 'get', 'job', result.job, '-o', 'json']);
+        if (job.status !== 0) throw new Error(`applied Job unreadable: ${job.stderr.trim()}`);
+        const applied = JSON.parse(job.stdout) as { spec?: { template?: { spec?: {
+          initContainers?: Array<{ name: string }>;
+          containers?: Array<{ name: string; volumeMounts?: Array<{ name: string; mountPath: string }> }>;
+          volumes?: Array<{ name: string; hostPath?: { path: string } }>;
+        } } } };
+        const podSpec = applied.spec?.template?.spec;
+        const childMounts = podSpec?.containers?.find((item) => item.name === 'child')?.volumeMounts ?? [];
+        const mountedPath = (name: string, mountPath: string): string | null => {
+          if (!childMounts.some((mount) => mount.name === name && mount.mountPath === mountPath)) return null;
+          return podSpec?.volumes?.find((volume) => volume.name === name)?.hostPath?.path ?? null;
+        };
+        const appliedCache = mountedPath('bun-cache', '/bun-cache');
+        const appliedSlots = mountedPath('install-slots', '/gate-install-slots');
+        if (appliedCache !== cache || appliedSlots !== slots) {
+          throw new Error(`applied Job hostPath mismatch: cache=${appliedCache} slots=${appliedSlots}`);
+        }
+        const pod = kubectl(['--context', context, '-n', namespace, 'get', 'pod', '-l', `job-name=${result.job}`, '-o', 'jsonpath={.items[0].spec.nodeName}']);
+        const child = readFileSync(join(result.artifactsDir, 'child.log'), 'utf8');
+        results.push({ arm, job: result.job, exitCode: result.exitCode, prep, hostPaths: [appliedCache, appliedSlots],
+          initContainers: applied.spec?.template?.spec?.initContainers?.map((item) => item.name) ?? [],
+          node: pod.status === 0 ? pod.stdout.trim() : '',
+          childWritable: child.includes('HOST_DIRS_WRITTEN'), artifactsError: result.artifacts?.error ?? null });
+        completed = true;
+      } finally {
+        if (completed) {
+          const deleted = kubectl(['--context', context, '-n', namespace, 'delete', 'job', name, '--ignore-not-found']);
+          if (deleted.status !== 0) throw new Error(`probe Job cleanup failed: ${name}: ${deleted.stderr.trim()}`);
+        } else console.error(`probe incomplete; retained Job for triage: ${name}`);
+      }
+    }
+    const [warm, fallback] = results;
+    const ok = warm?.prep?.ok === true && warm.initContainers.length === 0 && warm.exitCode === 0 && warm.childWritable && warm.artifactsError === null &&
+      fallback?.prep?.ok === false && fallback.initContainers.includes('host-dirs') && fallback.exitCode === 0 && fallback.childWritable && fallback.artifactsError === null &&
+      Boolean(warm.node && fallback.node);
+    console.log(JSON.stringify({ verdict: ok ? 'pass' : 'fail', measuredAt: new Date().toISOString(), sourceCommit,
+      context, namespace, image, results }));
+    if (!ok) process.exitCode = 1;
+  } finally {
+    resetHostDirsPrepMemo();
+    rmSync(artifactRoot, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) main().catch((error) => { console.error(String(error)); process.exitCode = 2; });

package/scripts/release-loop/resume-release.ts

@@ -7,6 +7,7 @@ import { join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
 import { lastJsonObject, runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
 import { changedFilesBetween, clearPartialPlan, planPartialRegate, writePartialPlan } from './gate-partial.js';
@@ -104,9 +105,12 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   }
   // A new tip invalidates everything built from the old one (gate verdict, prepared archive, …): restart no later
   // than the first node that consumed the commit, so each of them runs again on the new tip.
-  const firstConsumer = state.path.indexOf('gate');
+  // The public export now consumes the cut before the gate. Old saved graphs still have export-check after gate,
+  // so use the earliest consumer in this run's recorded path rather than assuming either graph version.
+  const consumers = ['export-check', 'gate'].map((node) => state.path.indexOf(node)).filter((index) => index >= 0);
+  const firstConsumer = consumers.length ? Math.min(...consumers) : -1;
   if (restartAt >= 0 && firstConsumer >= 0 && restartAt > firstConsumer) {
-    throw new Error(`${branch} moved (${recorded.slice(0, 12)} → ${to.slice(0, 12)}): resume at gate or earlier — later nodes were built from the old tip`);
+    throw new Error(`${branch} moved (${recorded.slice(0, 12)} → ${to.slice(0, 12)}): resume at ${state.path[firstConsumer]} or earlier — later nodes were built from the old tip`);
   }
   const stamp = (deps.now?.() ?? new Date()).toISOString().replace(/[:.]/g, '-');
   const backup = `${statePath}.before-tip-${stamp}-${process.pid}-${to.slice(0, 12)}.bak`;
@@ -135,14 +139,20 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
   clearPartialPlan(root, tip.version);
   const auto = opts.partial === undefined;
+  // The current graph checks public export before gate. A moved tip must resume there, so its gate still needs
+  // the diff plan; in older saved graphs export-check followed gate and cannot consume one.
+  const saved = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;
+  const fromIndex = saved.path.indexOf(opts.from);
+  const gateIndex = saved.path.indexOf('gate');
+  const reachesGate = (opts.from === 'gate' || opts.from === 'export-check') && fromIndex >= 0 && gateIndex >= fromIndex;
   // The default applies only where it can help: a gate re-run on a tip that moved. An unchanged tip re-uses its own
   // shard results by commit already.
-  if (opts.partial === false || (auto && (opts.from !== 'gate' || !tip.changed))) return { requested: false };
+  if (opts.partial === false || (auto && (!reachesGate || !tip.changed))) return { requested: false };
   const fallback = (reason: string): PartialOutcome => {
     debug.log('release-loop.resume', 'partial-fallback', { version: tip.version, reason, auto });
     return { requested: true, applied: false, reason, ...(auto ? { auto: true as const } : {}) };
   };
-  if (opts.from !== 'gate') return fallback('--partial only applies to --from gate');
+  if (!reachesGate) return fallback('--partial requires a restart that reaches gate');
   if (!tip.changed) return fallback('release branch tip unchanged — nothing new to re-check');
   let prior: { commit?: unknown; failures?: unknown; errors?: unknown } | undefined;
   for (const location of [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])]) {
@@ -178,6 +188,19 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     closure: (changedCode) => testsReachingChanged(tree, changedCode, tests, { cliEntries: CLI_ENTRIES }) });
   if (!planned.ok) return fallback(planned.reason);
   if (planned.plan.files.length >= tests.length) return fallback(`every test is re-run (${tests.length}) — full gate`);
+  if (planned.plan.kind === 'carry') {
+    // A cut-failures file can exist even when a later gate check errored. Reuse only a completed, clean verdict.
+    const verdicts = [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])].map((location) => join(location, 'release', tip.version, 'gate-verdict.json'));
+    let clean = false;
+    for (const verdictPath of verdicts) {
+      if (!existsSync(verdictPath)) continue;
+      try {
+        const verdict = JSON.parse(readFileSync(verdictPath, 'utf8')) as { commit?: unknown; outcome?: unknown };
+        if (verdict.commit === tip.from && verdict.outcome === 'ok') { clean = true; break; }
+      } catch { return fallback(`unreadable prior gate verdict: ${verdictPath}`); }
+    }
+    if (!clean) return fallback(`no clean gate verdict for ${tip.from.slice(0, 12)} — full gate`);
+  }
   const path = writePartialPlan(root, planned.plan);
   debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
     tests: tests.length, auto, path, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
@@ -195,6 +218,12 @@ function savedGraphPath(statePath: string): string | undefined {
 
 /** Refresh the branch tip, then restart the failed run at `from` with the saved graph snapshot. */
 export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+  // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.root` must not
+  // move this run onto a separate lock inode from the steward resync and the unattended release.
+  return withOpSeatFlock(() => resumeReleaseRunLocked(opts, deps));
+}
+
+async function resumeReleaseRunLocked(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
   // RELEASE-LEDGER-UNIVERSE: decide the universe once; the run lookup and every resumed node use it.
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };

package/scripts/release-loop/resume.ts

@@ -35,7 +35,8 @@ const SWEEP_INCOMPLETE = /^(?:pod sweep incomplete|sweep incomplete|[\w-]+ shard
  * Fail-closed: only three shapes count, each read from what the runner and gate-node actually write:
  *  ① stopped — `graph runs stop` wrote {ok:false, executed:false, exit:null, error:STOPPED_NODE_ERROR} as the run's last record;
  *  ② no verdict — the gate process ended with exit null (signal, idle timeout, or a spawn that failed) and printed no result line at
- *     all (no output line is a JSON object with an `outcome`), so the run went gate → failed. A verdict followed by more
+ *     all (no output line is a JSON object with an `outcome`), so the run went gate → failed (possibly through the
+ *     release-only gate-triage shadow). A verdict followed by more
  *     log lines and then a kill is still a verdict: refused;
  *  ③ sweep incomplete — gate-node printed outcome `error` (no verdict: the baseline comparison never ran, so `introduced`
  *     is still the empty initial list) and the error is an incomplete sweep (stalled shards / no tests ran). The finished
@@ -52,6 +53,14 @@ function printedVerdict(output: unknown): boolean {
   });
 }
 
+/** The only post-gate detour allowed before the terminal failure is the executed, release-only triage shadow. */
+function failedAfterGate(state: GraphRunState, index: number): boolean {
+  if (state.nodes.length !== state.path.length || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed') return false;
+  if (index === state.path.length - 2) return true;
+  return index === state.path.length - 3 && state.path[index + 1] === 'gate-triage'
+    && state.nodes[index + 1]?.nodeId === 'gate-triage' && state.nodes[index + 1]?.executed === true;
+}
+
 export function gateUnmeasuredDetail(state: GraphRunState, index: number): string | undefined {
   const record = state.nodes[index];
   if (!record || record.nodeId !== 'gate' || state.path[index] !== 'gate' || record.ok !== false || record.waiver !== undefined) return undefined;
@@ -60,9 +69,7 @@ export function gateUnmeasuredDetail(state: GraphRunState, index: number): strin
   if (last && record.executed === false && record.exit === null && record.error === STOPPED_NODE_ERROR && record.output === undefined) {
     return `stopped: ${STOPPED_NODE_ERROR}${typeof record.seconds === 'number' ? ` after ${record.seconds}s` : ''}`;
   }
-  const failedAfter = index === state.path.length - 2 && state.path.at(-1) === 'failed' && state.nodes.at(-1)?.nodeId === 'failed'
-    && state.nodes.length === state.path.length;
-  if (!failedAfter || record.executed !== true) return undefined;
+  if (!failedAfterGate(state, index) || record.executed !== true) return undefined;
   const result = lastJsonObject(record.output);
   if (result === undefined) {
     if (record.exit !== null || printedVerdict(record.output)) return undefined;
@@ -105,7 +112,8 @@ export function releaseResumeWaiver(
       [...(opts.acceptedRegressions ?? []), { id: `waive:${opts.waive}`, note: reason }]) };
   }
   if (!unique || state.path.lastIndexOf(opts.waive) !== index || state.nodes[index]?.nodeId !== opts.waive || state.nodes[index]?.ok !== false ||
-    state.nodes[index]?.executed !== true || state.path.at(-2) !== opts.waive || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed') {
+    state.nodes[index]?.executed !== true || (opts.waive === 'gate' ? !failedAfterGate(state, index)
+      : state.path.at(-2) !== opts.waive || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed')) {
     throw new Error(`--waive ${opts.waive} requires the failed executable node on the saved path`);
   }
   // Only user-visible, non-publication checks can become accepted regressions; build, safety and approval gates stay blocking.

package/scripts/release-loop/spawn-lane.ts

@@ -0,0 +1,51 @@
+import { planShards } from './shard-plan';
+import { isGateSpawnLaneFile } from '../../src/self-dev/spawn-lane-files.js';
+export { GATE_SPAWN_LANE_FILES, isGateSpawnLaneFile } from '../../src/self-dev/spawn-lane-files.js';
+
+/**
+ * Gate tests that exercise a real process or PTY. Keep them in their own Pod
+ * shards so an external CLI/terminal stall cannot consume an ordinary shard's
+ * deadline. These are file paths at the cut commit, not test title patterns.
+ *
+ * 0.2.29 (2026-10-15): these files from the failed gate attempts launch a
+ * real child. Add a file only after checking its test body, not merely because
+ * its name mentions a process.
+ */
+export const GATE_SPAWN_LANE_SHARDS = 3;
+
+/** Every assigned test file is returned exactly once, including a partial gate. */
+export function partitionGateSpawnLane(files: readonly string[]): { regular: string[]; spawn: string[] } {
+  const regular: string[] = [];
+  const spawn: string[] = [];
+  const seen = new Set<string>();
+  for (const file of files) {
+    if (seen.has(file)) throw new Error(`duplicate gate test file: ${file}`);
+    seen.add(file);
+    (isGateSpawnLaneFile(file) ? spawn : regular).push(file);
+  }
+  return { regular, spawn };
+}
+
+/** Reserve at most three of the configured shards for real process tests.
+ * Keeping those files out of ordinary shards preserves coverage and leaves
+ * the total shard count unchanged when enough regular files exist. */
+export function planGateSpawnSeparatedShards(files: readonly string[], durations: Map<string, number>, shardCount: number): {
+  shards: Array<{ files: string[]; plannedSeconds: number }>;
+  spawnFiles: string[];
+  spawnShardCount: number;
+} {
+  const { regular, spawn } = partitionGateSpawnLane(files);
+  if (regular.length && spawn.length && shardCount < 2) {
+    throw new Error('gate spawn lane needs at least two shards when regular and spawn tests coexist');
+  }
+  const spawnShardCount = Math.min(GATE_SPAWN_LANE_SHARDS, spawn.length, shardCount - (regular.length ? 1 : 0));
+  const regularCount = regular.length ? shardCount - spawnShardCount : 0;
+  return {
+    shards: [
+      ...(regular.length ? planShards(regular, durations, regularCount) : []),
+      ...(spawn.length ? planShards(spawn, durations, spawnShardCount) : []),
+    ],
+    spawnFiles: spawn,
+    spawnShardCount,
+  };
+}

package/scripts/release-loop/tui-node-checks.ts

@@ -27,6 +27,29 @@ export function tuiChecks(s: TuiScreens, readyLimitMs = 60_000): TuiCheck[] {
   ];
 }
 
+export interface ExecutedTuiCheck { outcome: 'ok' | 'fail' | 'unmeasured'; detail: string }
+
+/** Run the screen-based TUI node, not `--help`: the subprocess boots a PTY, captures first/help/Esc screens and judges them. */
+export async function executeTuiNodeCheck(commit: string, repo: string,
+  command: (cmd: string, args: string[], cwd: string, limitMs?: number) => Promise<{ rc: number; output: string }>): Promise<ExecutedTuiCheck> {
+  const run = await command('bun', ['scripts/release-loop/tui-sim-node.ts', '--commit', commit, '--json'], repo, 300_000);
+  const line = run.output.split(/\r?\n/).find((text) => text.trim().startsWith('{'));
+  let value: Record<string, unknown>;
+  try { value = JSON.parse(line ?? '') as Record<string, unknown>; }
+  catch { return { outcome: 'unmeasured', detail: `TUI screen result missing (rc=${run.rc})` }; }
+  if (run.rc === 0 && reusableTui(withTuiOutcome(run.rc, value), commit))
+    return { outcome: 'ok', detail: `TUI screens: ${value.verdict} · 6 checks` };
+  const ids = ['boot', 'prompt', 'status-bar', 'help-opens', 'help-closes', 'no-error-text'];
+  const measuredFailure = run.rc === 1 && value.commit === commit && value.verdict === 'fail' && value.attempts === 2
+    && Array.isArray(value.checks) && value.checks.length === ids.length
+    && value.checks.every((check: unknown, i: number) => !!check && typeof check === 'object'
+      && (check as TuiCheck).id === ids[i] && typeof (check as TuiCheck).pass === 'boolean'
+      && typeof (check as TuiCheck).detail === 'string')
+    && value.checks.some((check: TuiCheck) => !check.pass);
+  const failed = measuredFailure ? (value.checks as TuiCheck[]).filter((check) => !check.pass).map((check) => check.id) : [];
+  return { outcome: measuredFailure ? 'fail' : 'unmeasured', detail: `TUI screens: ${failed.join(', ') || String(value.verdict)} (rc=${run.rc})` };
+}
+
 export function tuiVerdict(checks: readonly TuiCheck[]): 'pass' | 'fail' {
   return checks.every((c) => c.pass) ? 'pass' : 'fail';
 }

package/scripts/release-loop/tui-sim-node.ts

@@ -12,6 +12,7 @@
  * Exit: 0 = pass or flaky · 1 = fail · 2 = could not run (not macOS, worktree).
  */
 import { spawn, spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 import { copyFileSync, existsSync, mkdtempSync, openSync, symlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
@@ -101,7 +102,7 @@ async function main(): Promise<number> {
   let regress: TuiRegress = { unmeasured: 'worktree를 만들지 못했다' };
   let worktreeReady = false;
   try {
-    const add = spawnSync('git', ['worktree', 'add', '--detach', worktree, commit], { cwd: repo, encoding: 'utf8' });
+    const add = spawnSync('git', ['worktree', 'add', '--detach', worktree, commit], { cwd: repo, encoding: 'utf8', maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     if (add.status !== 0) throw new Error(`worktree add failed: ${(add.stderr ?? '').trim()}`);
     worktreeReady = true;
     symlinkSync(join(repo, 'node_modules'), join(worktree, 'node_modules'));
@@ -119,7 +120,7 @@ async function main(): Promise<number> {
     attempts = [];
   } finally {
     if (worktreeReady) regress = measureTuiRegress(worktree);
-    spawnSync('git', ['worktree', 'remove', '--force', worktree], { cwd: repo });
+    spawnSync('git', ['worktree', 'remove', '--force', worktree], { cwd: repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   }
 
   const out = tuiNodeOutput(commit, attempts, regress, failure);

package/scripts/release-loop/unattended-release.ts

@@ -9,6 +9,7 @@ import { getSchedule } from '../../src/release-loop/release-schedule.js';
 import { isLandingFreezeRefusal, readLandingFreeze, LandingFrozenError } from '../../src/release-loop/landing-freeze.js';
 import { debug } from '../../src/debug/log.js';
 import { runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { baseVersion, isStableVersion, nextPrereleaseVersion, type PrereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
@@ -27,6 +28,10 @@ export interface ReleaseLoopConfig {
   gatePodInstallSlots?: number;
   /** GATE-MEM-ADMIT — seconds a gate shard waits for pool admission (memory headroom) before launching anyway with `admission-timeout` (default 300 · 0 = off). */
   gatePodAdmissionWaitSeconds?: number;
+  /** Maximum simultaneous file-level isolation retries across all gate shards (default 4). */
+  gatePodIsolationConcurrency?: number;
+  /** Final isolated recheck files per window; overflow continues in later windows (default 32). */
+  gateRecheckFileLimit?: number;
   /** GATE-SPEED A3①: gate shard Pod CPU — `2` (request = limit) or `{ request, limit }`. Omitted = request 1 / limit 4. */
   gatePodCpu?: number | string | { request?: number | string; limit?: number | string };
   gateRemote?: string;
@@ -135,6 +140,17 @@ export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDep
 export async function runUnattendedRelease(
   opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps = {},
+): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
+  // A dry run only builds the input and mutates nothing, so it neither creates nor waits on the OP-seat lock.
+  if (opts.dryRun) return runUnattendedReleaseLocked(opts, deps);
+  // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.ledgerRoot` must
+  // not move this run onto a separate lock inode from the steward resync and a manual resume.
+  return withOpSeatFlock(() => runUnattendedReleaseLocked(opts, deps));
+}
+
+async function runUnattendedReleaseLocked(
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  deps: UnattendedReleaseDeps,
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
   // landing freeze. A freeze stays the emergency switch: when one is on, it still stops the run (`--force-freeze` overrides).