elanous 0.2.29 → 0.2.31

package/scripts/release-loop/resume-release.ts

@@ -7,6 +7,7 @@ import { join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
 import { lastJsonObject, runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
 import { changedFilesBetween, clearPartialPlan, planPartialRegate, writePartialPlan } from './gate-partial.js';
@@ -104,9 +105,12 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   }
   // A new tip invalidates everything built from the old one (gate verdict, prepared archive, …): restart no later
   // than the first node that consumed the commit, so each of them runs again on the new tip.
-  const firstConsumer = state.path.indexOf('gate');
+  // The public export now consumes the cut before the gate. Old saved graphs still have export-check after gate,
+  // so use the earliest consumer in this run's recorded path rather than assuming either graph version.
+  const consumers = ['export-check', 'gate'].map((node) => state.path.indexOf(node)).filter((index) => index >= 0);
+  const firstConsumer = consumers.length ? Math.min(...consumers) : -1;
   if (restartAt >= 0 && firstConsumer >= 0 && restartAt > firstConsumer) {
-    throw new Error(`${branch} moved (${recorded.slice(0, 12)} → ${to.slice(0, 12)}): resume at gate or earlier — later nodes were built from the old tip`);
+    throw new Error(`${branch} moved (${recorded.slice(0, 12)} → ${to.slice(0, 12)}): resume at ${state.path[firstConsumer]} or earlier — later nodes were built from the old tip`);
   }
   const stamp = (deps.now?.() ?? new Date()).toISOString().replace(/[:.]/g, '-');
   const backup = `${statePath}.before-tip-${stamp}-${process.pid}-${to.slice(0, 12)}.bak`;
@@ -135,14 +139,20 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
   clearPartialPlan(root, tip.version);
   const auto = opts.partial === undefined;
+  // The current graph checks public export before gate. A moved tip must resume there, so its gate still needs
+  // the diff plan; in older saved graphs export-check followed gate and cannot consume one.
+  const saved = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;
+  const fromIndex = saved.path.indexOf(opts.from);
+  const gateIndex = saved.path.indexOf('gate');
+  const reachesGate = (opts.from === 'gate' || opts.from === 'export-check') && fromIndex >= 0 && gateIndex >= fromIndex;
   // The default applies only where it can help: a gate re-run on a tip that moved. An unchanged tip re-uses its own
   // shard results by commit already.
-  if (opts.partial === false || (auto && (opts.from !== 'gate' || !tip.changed))) return { requested: false };
+  if (opts.partial === false || (auto && (!reachesGate || !tip.changed))) return { requested: false };
   const fallback = (reason: string): PartialOutcome => {
     debug.log('release-loop.resume', 'partial-fallback', { version: tip.version, reason, auto });
     return { requested: true, applied: false, reason, ...(auto ? { auto: true as const } : {}) };
   };
-  if (opts.from !== 'gate') return fallback('--partial only applies to --from gate');
+  if (!reachesGate) return fallback('--partial requires a restart that reaches gate');
   if (!tip.changed) return fallback('release branch tip unchanged — nothing new to re-check');
   let prior: { commit?: unknown; failures?: unknown; errors?: unknown } | undefined;
   for (const location of [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])]) {
@@ -178,6 +188,19 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     closure: (changedCode) => testsReachingChanged(tree, changedCode, tests, { cliEntries: CLI_ENTRIES }) });
   if (!planned.ok) return fallback(planned.reason);
   if (planned.plan.files.length >= tests.length) return fallback(`every test is re-run (${tests.length}) — full gate`);
+  if (planned.plan.kind === 'carry') {
+    // A cut-failures file can exist even when a later gate check errored. Reuse only a completed, clean verdict.
+    const verdicts = [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])].map((location) => join(location, 'release', tip.version, 'gate-verdict.json'));
+    let clean = false;
+    for (const verdictPath of verdicts) {
+      if (!existsSync(verdictPath)) continue;
+      try {
+        const verdict = JSON.parse(readFileSync(verdictPath, 'utf8')) as { commit?: unknown; outcome?: unknown };
+        if (verdict.commit === tip.from && verdict.outcome === 'ok') { clean = true; break; }
+      } catch { return fallback(`unreadable prior gate verdict: ${verdictPath}`); }
+    }
+    if (!clean) return fallback(`no clean gate verdict for ${tip.from.slice(0, 12)} — full gate`);
+  }
   const path = writePartialPlan(root, planned.plan);
   debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
     tests: tests.length, auto, path, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
@@ -195,6 +218,12 @@ function savedGraphPath(statePath: string): string | undefined {
 
 /** Refresh the branch tip, then restart the failed run at `from` with the saved graph snapshot. */
 export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+  // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.root` must not
+  // move this run onto a separate lock inode from the steward resync and the unattended release.
+  return withOpSeatFlock(() => resumeReleaseRunLocked(opts, deps));
+}
+
+async function resumeReleaseRunLocked(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
   // RELEASE-LEDGER-UNIVERSE: decide the universe once; the run lookup and every resumed node use it.
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };

package/scripts/release-loop/resume.ts

@@ -35,7 +35,8 @@ const SWEEP_INCOMPLETE = /^(?:pod sweep incomplete|sweep incomplete|[\w-]+ shard
  * Fail-closed: only three shapes count, each read from what the runner and gate-node actually write:
  *  ① stopped — `graph runs stop` wrote {ok:false, executed:false, exit:null, error:STOPPED_NODE_ERROR} as the run's last record;
  *  ② no verdict — the gate process ended with exit null (signal, idle timeout, or a spawn that failed) and printed no result line at
- *     all (no output line is a JSON object with an `outcome`), so the run went gate → failed. A verdict followed by more
+ *     all (no output line is a JSON object with an `outcome`), so the run went gate → failed (possibly through the
+ *     release-only gate-triage shadow). A verdict followed by more
  *     log lines and then a kill is still a verdict: refused;
  *  ③ sweep incomplete — gate-node printed outcome `error` (no verdict: the baseline comparison never ran, so `introduced`
  *     is still the empty initial list) and the error is an incomplete sweep (stalled shards / no tests ran). The finished
@@ -52,6 +53,14 @@ function printedVerdict(output: unknown): boolean {
   });
 }
 
+/** The only post-gate detour allowed before the terminal failure is the executed, release-only triage shadow. */
+function failedAfterGate(state: GraphRunState, index: number): boolean {
+  if (state.nodes.length !== state.path.length || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed') return false;
+  if (index === state.path.length - 2) return true;
+  return index === state.path.length - 3 && state.path[index + 1] === 'gate-triage'
+    && state.nodes[index + 1]?.nodeId === 'gate-triage' && state.nodes[index + 1]?.executed === true;
+}
+
 export function gateUnmeasuredDetail(state: GraphRunState, index: number): string | undefined {
   const record = state.nodes[index];
   if (!record || record.nodeId !== 'gate' || state.path[index] !== 'gate' || record.ok !== false || record.waiver !== undefined) return undefined;
@@ -60,9 +69,7 @@ export function gateUnmeasuredDetail(state: GraphRunState, index: number): strin
   if (last && record.executed === false && record.exit === null && record.error === STOPPED_NODE_ERROR && record.output === undefined) {
     return `stopped: ${STOPPED_NODE_ERROR}${typeof record.seconds === 'number' ? ` after ${record.seconds}s` : ''}`;
   }
-  const failedAfter = index === state.path.length - 2 && state.path.at(-1) === 'failed' && state.nodes.at(-1)?.nodeId === 'failed'
-    && state.nodes.length === state.path.length;
-  if (!failedAfter || record.executed !== true) return undefined;
+  if (!failedAfterGate(state, index) || record.executed !== true) return undefined;
   const result = lastJsonObject(record.output);
   if (result === undefined) {
     if (record.exit !== null || printedVerdict(record.output)) return undefined;
@@ -105,7 +112,8 @@ export function releaseResumeWaiver(
       [...(opts.acceptedRegressions ?? []), { id: `waive:${opts.waive}`, note: reason }]) };
   }
   if (!unique || state.path.lastIndexOf(opts.waive) !== index || state.nodes[index]?.nodeId !== opts.waive || state.nodes[index]?.ok !== false ||
-    state.nodes[index]?.executed !== true || state.path.at(-2) !== opts.waive || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed') {
+    state.nodes[index]?.executed !== true || (opts.waive === 'gate' ? !failedAfterGate(state, index)
+      : state.path.at(-2) !== opts.waive || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed')) {
     throw new Error(`--waive ${opts.waive} requires the failed executable node on the saved path`);
   }
   // Only user-visible, non-publication checks can become accepted regressions; build, safety and approval gates stay blocking.

package/scripts/release-loop/spawn-lane.ts

@@ -1,4 +1,6 @@
 import { planShards } from './shard-plan';
+import { isGateSpawnLaneFile } from '../../src/self-dev/spawn-lane-files.js';
+export { GATE_SPAWN_LANE_FILES, isGateSpawnLaneFile } from '../../src/self-dev/spawn-lane-files.js';
 
 /**
  * Gate tests that exercise a real process or PTY. Keep them in their own Pod
@@ -9,27 +11,8 @@ import { planShards } from './shard-plan';
  * real child. Add a file only after checking its test body, not merely because
  * its name mentions a process.
  */
-export const GATE_SPAWN_LANE_FILES = [
-  'scripts/lib/tui-runshell-group-e2e.test.ts',
-  'scripts/lib/tui-streaming-e2e.test.ts',
-  'src/agent-mission/doc-guided-install.test.ts',
-  'src/dashboard/first-screen-band-wiring.test.ts',
-  'src/git-fs/spawn-discipline.test.ts',
-  'src/self-implement/run-ledger.test.ts',
-  'src/video-pipeline/recipes/reframe.test.ts',
-  'test/ch5730-watch-delivery.test.ts',
-  'test/cli-dev-command.test.ts',
-  'test/preview-terminal.test.ts',
-] as const;
-
-const SPAWN_FILES = new Set<string>(GATE_SPAWN_LANE_FILES);
-
 export const GATE_SPAWN_LANE_SHARDS = 3;
 
-export function isGateSpawnLaneFile(file: string): boolean {
-  return SPAWN_FILES.has(file);
-}
-
 /** Every assigned test file is returned exactly once, including a partial gate. */
 export function partitionGateSpawnLane(files: readonly string[]): { regular: string[]; spawn: string[] } {
   const regular: string[] = [];

package/scripts/release-loop/tui-sim-node.ts

@@ -12,6 +12,7 @@
  * Exit: 0 = pass or flaky · 1 = fail · 2 = could not run (not macOS, worktree).
  */
 import { spawn, spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 import { copyFileSync, existsSync, mkdtempSync, openSync, symlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
@@ -101,7 +102,7 @@ async function main(): Promise<number> {
   let regress: TuiRegress = { unmeasured: 'worktree를 만들지 못했다' };
   let worktreeReady = false;
   try {
-    const add = spawnSync('git', ['worktree', 'add', '--detach', worktree, commit], { cwd: repo, encoding: 'utf8' });
+    const add = spawnSync('git', ['worktree', 'add', '--detach', worktree, commit], { cwd: repo, encoding: 'utf8', maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     if (add.status !== 0) throw new Error(`worktree add failed: ${(add.stderr ?? '').trim()}`);
     worktreeReady = true;
     symlinkSync(join(repo, 'node_modules'), join(worktree, 'node_modules'));
@@ -119,7 +120,7 @@ async function main(): Promise<number> {
     attempts = [];
   } finally {
     if (worktreeReady) regress = measureTuiRegress(worktree);
-    spawnSync('git', ['worktree', 'remove', '--force', worktree], { cwd: repo });
+    spawnSync('git', ['worktree', 'remove', '--force', worktree], { cwd: repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   }
 
   const out = tuiNodeOutput(commit, attempts, regress, failure);

package/scripts/release-loop/unattended-release.ts

@@ -9,6 +9,7 @@ import { getSchedule } from '../../src/release-loop/release-schedule.js';
 import { isLandingFreezeRefusal, readLandingFreeze, LandingFrozenError } from '../../src/release-loop/landing-freeze.js';
 import { debug } from '../../src/debug/log.js';
 import { runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { baseVersion, isStableVersion, nextPrereleaseVersion, type PrereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
@@ -27,6 +28,10 @@ export interface ReleaseLoopConfig {
   gatePodInstallSlots?: number;
   /** GATE-MEM-ADMIT — seconds a gate shard waits for pool admission (memory headroom) before launching anyway with `admission-timeout` (default 300 · 0 = off). */
   gatePodAdmissionWaitSeconds?: number;
+  /** Maximum simultaneous file-level isolation retries across all gate shards (default 4). */
+  gatePodIsolationConcurrency?: number;
+  /** Final isolated recheck files per window; overflow continues in later windows (default 32). */
+  gateRecheckFileLimit?: number;
   /** GATE-SPEED A3①: gate shard Pod CPU — `2` (request = limit) or `{ request, limit }`. Omitted = request 1 / limit 4. */
   gatePodCpu?: number | string | { request?: number | string; limit?: number | string };
   gateRemote?: string;
@@ -135,6 +140,17 @@ export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDep
 export async function runUnattendedRelease(
   opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps = {},
+): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
+  // A dry run only builds the input and mutates nothing, so it neither creates nor waits on the OP-seat lock.
+  if (opts.dryRun) return runUnattendedReleaseLocked(opts, deps);
+  // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.ledgerRoot` must
+  // not move this run onto a separate lock inode from the steward resync and a manual resume.
+  return withOpSeatFlock(() => runUnattendedReleaseLocked(opts, deps));
+}
+
+async function runUnattendedReleaseLocked(
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  deps: UnattendedReleaseDeps,
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
   // landing freeze. A freeze stays the emergency switch: when one is on, it still stops the run (`--force-freeze` overrides).

package/scripts/test-deterministic.ts

@@ -39,44 +39,15 @@ import * as ts from 'typescript';
 // importing THIS file used to spawn the suite at load time. The runner is now
 // behind `import.meta.main` / `runDeterministicTests()`, but the filter stays
 // in the helper so an untested credential check cannot rot silently.
-import { isCredentialKey } from './lib/deterministic-env.js';
-import { envLiteral } from '../src/platform/env-literal.js';
+import { GIT_LOCATION_ENV_KEYS, prepareIsolatedTestEnv } from './lib/deterministic-env.js';
 
 export const TEMP_ROOT_PREFIX = 'elanous-deterministic-test-';
 export const CHILD_EXIT_GRACE_MS = 2_000;
 
-// A deterministic test child is not a harness executor: these inherited
-// markers would activate write-boundary policy against each test's temp files.
-const HARNESS_TEST_ENV_KEYS = [
-  'ELANOUS_HARNESS_SPACE',
-  'ELANOUS_HARNESS_SPACE_ID',
-  'ELANOUS_HARNESS_BOUNDARY',
-  'ELANOUS_HARNESS_ROLE',
-  'ELANOUS_HARNESS_DETACHED',
-] as const;
-
-// Discovery: rg -n "process\.env\.ELANOUS_(HOST|RUN|ORIGIN|SUPERVISOR|PARENT)" src
-// These are ambient execution identities, not inputs to a deterministic test.
-// debug.log also attributes SUBSTRATE and ARM_ID to every plain-object record.
-export const GIT_LOCATION_ENV_KEYS = [
-  'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE',
-  'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES',
-] as const;
-
-const EXECUTION_ORIGIN_ENV_KEYS = [
-  'ELANOUS_HOST_ID',
-  'ELANOUS_RUN_ID',
-  'ELANOUS_RUN_CONTEXT',
-  'ELANOUS_PARENT_RUN_ID',
-  'ELANOUS_PARENT_PTY_ID',
-  'ELANOUS_PARENT_SELF_DEV_RUNS_DIR',
-  'ELANOUS_SUBSTRATE',
-  'ELANOUS_ARM_ID',
-  // Parent account selection changes CLI rotation assertions in the child.
-  'ELANOUS_CODEX_ACCOUNT',
-  // A parent's derived-root label must not reclassify a test's explicit state dir.
-  'ELANOUS_STATE_DIR_SOURCE',
-] as const;
+// Key lists and the isolated child env live in the side-effect-free `lib/deterministic-env.ts` (R7 · 10-16):
+// the host regate runner needs the same env, and importing this file would pull `typescript`/Bun stream types into
+// graphs (the PWA tsc program) that must not see them.
+export { GIT_LOCATION_ENV_KEYS, prepareIsolatedTestEnv } from './lib/deterministic-env.js';
 
 export type ShutdownSignal = 'SIGINT' | 'SIGTERM';
 
@@ -297,33 +268,6 @@ function gitConfig(cwd: string, args: string[]): string | undefined {
   return args.includes('--get-all') ? result.stdout : result.stdout.trim();
 }
 
-export function prepareIsolatedTestEnv(sourceEnv: NodeJS.ProcessEnv, testRoot: string): NodeJS.ProcessEnv {
-  const env = Object.fromEntries(
-    Object.entries(sourceEnv).filter(([key]) => !isCredentialKey(key)
-      && !HARNESS_TEST_ENV_KEYS.includes(key as typeof HARNESS_TEST_ENV_KEYS[number])
-      && !EXECUTION_ORIGIN_ENV_KEYS.includes(key as typeof EXECUTION_ORIGIN_ENV_KEYS[number])
-      && !GIT_LOCATION_ENV_KEYS.includes(key as typeof GIT_LOCATION_ENV_KEYS[number])),
-  );
-  env.HOME = testRoot;
-  // userConfigPath() warns whenever XDG_CONFIG_HOME is set, including when
-  // config.json is absent. Use its non-XDG path; migrateLegacyXdgUserConfig()
-  // resolves the old path through ELANOUS_TEST_HOME rather than the real home.
-  delete env.XDG_CONFIG_HOME;
-  env.ELANOUS_TEST_HOME = testRoot;
-  // HOME and ELANOUS_STATE_DIR isolate both the state and default config roots.
-  // ELANOUS_CONFIG_DIR is not a config-dir override; discard an inherited value
-  // rather than passing an ignored variable that appears to provide isolation.
-  env.ELANOUS_STATE_DIR = join(testRoot, 'state');
-  delete env.ELANOUS_CONFIG_DIR;
-  // All ambient execution identities are removed by EXECUTION_ORIGIN_ENV_KEYS
-  // above, before the child is spawned; logger API-shape tests need their absence.
-  // ⚠️ No `ELANOUS_TEST_DETERMINISTIC` marker is exported. Nothing reads it yet,
-  // and an env var with no consumer is a surface that looks like a contract
-  // while guaranteeing nothing — a later test could branch on it believing it
-  // means something. The tier work in PLAN-test-suite-diet introduces the
-  // signal together with the code that honours it.
-  return envLiteral(env);
-}
 
 /** Read every stderr line, retaining only Bun's verdict signals. A long test
  * log must not become a second in-memory copy of the full output. */

package/scripts/train-reach-grouping.ts

@@ -0,0 +1,48 @@
+#!/usr/bin/env bun
+import { existsSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { buildTrainReachDecision, type TrainReachInput } from '../src/self-implement/train-reach-grouping.js';
+import { buildTrainScenarioDecision, readTrainTestPopulation, type TrainRiskEvidence } from '../src/self-implement/train-scenario-layers.js';
+
+type ScenarioInput = TrainReachInput & { riskEvidence?: TrainRiskEvidence };
+
+function option(name: string): string {
+  const index = process.argv.indexOf(name);
+  const value = process.argv[index + 1];
+  if (index < 0 || !value || value.startsWith('--') || !isAbsolute(value)) throw new Error(`${name} requires an absolute path`);
+  return value;
+}
+
+let temporary = '';
+let outputPath = '';
+let protectsInput = false;
+try {
+  if (process.argv.length !== 6) throw new Error('usage: train-reach-grouping.ts --input <absolute> --output <absolute>');
+  const inputPath = option('--input');
+  outputPath = option('--output');
+  if (!existsSync(inputPath)) throw new Error('input file missing');
+  protectsInput = resolve(inputPath) === resolve(outputPath)
+    || (existsSync(outputPath) && realpathSync(inputPath) === realpathSync(outputPath));
+  if (protectsInput) throw new Error('input and output paths must differ');
+  const input = JSON.parse(readFileSync(inputPath, 'utf8')) as ScenarioInput;
+  const reach = buildTrainReachDecision(input);
+  const scenario = input.riskEvidence === undefined ? undefined : (() => {
+    if (input.prs.length === 0) throw new Error('scenario has no PR tree for pinned population');
+    const baseTests = readTrainTestPopulation(input.prs[0]!.tree, input.baseSha);
+    const headTests = input.prs.map((candidate) => new Set(readTrainTestPopulation(candidate.tree, candidate.headSha)));
+    const survivingTests = baseTests.filter((test) => headTests.every((present) => present.has(test)));
+    return buildTrainScenarioDecision(input, reach, survivingTests, input.riskEvidence!);
+  })();
+  const result = scenario ? { ...reach, scenario, parallelSafe: scenario.parallelSafe } : reach;
+  temporary = `${outputPath}.tmp-${process.pid}`;
+  writeFileSync(temporary, JSON.stringify(result, null, 2) + '\n', { flag: 'wx' });
+  renameSync(temporary, outputPath);
+  temporary = '';
+  if (!result.parallelSafe) process.exitCode = 2;
+} catch (error) {
+  if (outputPath && !protectsInput) rmSync(outputPath, { force: true }); // never reuse a previous decision after failure
+  console.error(`train reach unmeasured: ${error instanceof Error ? error.message : String(error)}`);
+  process.exitCode = 2;
+} finally {
+  if (temporary) rmSync(temporary, { force: true });
+}

package/scripts/tsc-incremental-cache.ts

@@ -0,0 +1,86 @@
+/** Opt-in compiler graph cache for an exclusive, stable remote gate checkout. */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { hostname } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { normalizedDiagnosticSet } from './tsc-incremental-diagnostics.js';
+
+export interface CachedTscRun { out: string; ran: boolean; why?: string; exitCode?: number }
+type Reference = { schema: 1; key: string; out: string; exitCode: number; decision: boolean; head?: string };
+export interface IncrementalCacheInput<T extends CachedTscRun> {
+  cwd: string;
+  base: string;
+  head?: string;
+  changed: ReadonlySet<string>;
+  config: string;
+  command: string;
+  cacheDir: string;
+  run: (command: string) => T;
+  decision: (result: T) => boolean;
+  log: (message: string) => void;
+}
+
+function compilerOutcome(result: CachedTscRun): 'clean' | 'diagnostics' | 'unmeasured' {
+  if (!result.ran) return 'unmeasured';
+  if (result.exitCode === 0) return 'clean';
+  return result.exitCode === 1 || result.exitCode === 2 ? 'diagnostics' : 'unmeasured';
+}
+
+function equivalent<T extends CachedTscRun>(current: T, baseline: T, decide: (result: T) => boolean): boolean {
+  const a = normalizedDiagnosticSet(current.out);
+  const b = normalizedDiagnosticSet(baseline.out);
+  return a !== null && a === b && compilerOutcome(current) !== 'unmeasured'
+    && compilerOutcome(current) === compilerOutcome(baseline) && decide(current) === decide(baseline);
+}
+
+export function incrementalCacheKey(input: Pick<IncrementalCacheInput<CachedTscRun>, 'cwd' | 'base' | 'changed' | 'config'>): string {
+  const files = [input.config, 'tsconfig.json', 'tsconfig.gate.json', 'tsconfig.pwa-env.json', 'apps/pwa/tsconfig.json', 'bun.lock', 'node_modules/typescript/package.json'];
+  const hash = createHash('sha256');
+  for (const field of [hostname(), input.cwd, input.base, ...[...input.changed].sort()]) hash.update(field + '\0');
+  for (const file of files) {
+    hash.update(file + '\0');
+    try { hash.update(readFileSync(join(input.cwd, file))); }
+    catch { hash.update('<missing>'); }
+    hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+
+/** A cache hit is accepted only when the prior cold reference still has the same diagnostic set and gate decision. */
+export function runIncrementalCachedTsc<T extends CachedTscRun>(input: IncrementalCacheInput<T>): T {
+  if (!isAbsolute(input.cacheDir) || !/^[-\w./]+$/.test(input.cacheDir) || !/^[0-9a-f]{40}$/.test(input.base)) return input.run(input.command);
+  const key = incrementalCacheKey(input);
+  try { mkdirSync(input.cacheDir, { recursive: true, mode: 0o700 }); }
+  catch (cause) {
+    input.log(`[tsc-cache] unavailable key=${key.slice(0, 12)} reason=${cause instanceof Error ? cause.message : String(cause)}; cold`);
+    return input.run(input.command);
+  }
+  const buildInfo = join(input.cacheDir, `${key}.tsbuildinfo`);
+  const metaFile = join(input.cacheDir, `${key}.json`);
+  let reference: Reference | null = null;
+  try {
+    const parsed = JSON.parse(readFileSync(metaFile, 'utf8')) as Reference;
+    if (parsed.schema === 1 && parsed.key === key && typeof parsed.out === 'string'
+      && Number.isInteger(parsed.exitCode) && typeof parsed.decision === 'boolean' && existsSync(buildInfo)) reference = parsed;
+  } catch { /* missing or damaged cache is a cold miss */ }
+  const incremental = input.run(`${input.command} --incremental --tsBuildInfoFile '${buildInfo}'`);
+  const prior = reference ? { out: reference.out, ran: true, exitCode: reference.exitCode } as T : null;
+  if (prior && equivalent(incremental, prior, input.decision) && input.decision(prior) === reference!.decision) {
+    input.log(`[tsc-cache] hit key=${key.slice(0, 12)} warmRc=${incremental.exitCode} coldRc=${prior.exitCode} warmGate=${input.decision(incremental) ? 'PASS' : 'FAIL'} coldGate=${reference!.decision ? 'PASS' : 'FAIL'}`);
+    return incremental;
+  }
+  const cold = input.run(input.command);
+  const matched = equivalent(incremental, cold, input.decision);
+  input.log(`[tsc-cache] ${reference ? 'mismatch-cold' : 'miss-cold'} key=${key.slice(0, 12)} warmRc=${incremental.exitCode ?? 'unknown'} coldRc=${cold.exitCode ?? 'unknown'} warmGate=${incremental.ran ? input.decision(incremental) ? 'PASS' : 'FAIL' : 'unmeasured'} coldGate=${cold.ran ? input.decision(cold) ? 'PASS' : 'FAIL' : 'unmeasured'} normalized=${matched ? 'same' : 'different'}`);
+  if (matched && cold.exitCode !== undefined) {
+    const next: Reference = { schema: 1, key, out: cold.out, exitCode: cold.exitCode, decision: input.decision(cold), head: input.head };
+    const temp = `${metaFile}.${process.pid}.tmp`;
+    try { writeFileSync(temp, JSON.stringify(next), { mode: 0o600 }); renameSync(temp, metaFile); }
+    catch {
+      for (const path of [temp, metaFile, buildInfo]) { try { rmSync(path, { force: true }); } catch { /* next run must cold-check damaged cache */ } }
+    }
+  } else {
+    for (const path of [metaFile, buildInfo]) { try { rmSync(path, { force: true }); } catch { /* invalid metadata remains a cold miss */ } }
+  }
+  return cold;
+}

package/scripts/tsc-incremental-diagnostics.ts

@@ -0,0 +1,76 @@
+/** Diagnostic comparison for the incremental compiler. Only union member order is ignored. */
+
+function atomAt(value: string, start: number): { text: string; end: number } | null {
+  if (value[start] === '"') {
+    const end = value.indexOf('"', start + 1);
+    return end < 0 ? null : { text: value.slice(start, end + 1), end: end + 1 };
+  }
+  const name = /^[A-Za-z_$][\w$]*/.exec(value.slice(start));
+  if (!name) return null;
+  let end = start + name[0].length;
+  if (value[end] === '<') {
+    let depth = 1;
+    let cursor = end + 1;
+    let quoted = false;
+    for (; cursor < value.length; cursor++) {
+      if (value[cursor] === '"' && value[cursor - 1] !== '\\') quoted = !quoted;
+      if (quoted) continue;
+      if (value[cursor] === '<') depth++;
+      else if (value[cursor] === '>' && --depth === 0) break;
+    }
+    if (depth === 0) end = cursor + 1;
+  }
+  const raw = value.slice(start, end);
+  return { text: raw.includes(' | ') && raw.includes('<') && raw.endsWith('>')
+    ? `${name[0]}<${normalizeUnionAtoms(raw.slice(name[0].length + 1, -1))}>` : raw, end };
+}
+
+function normalizeUnionAtoms(line: string): string {
+  let result = '';
+  for (let i = 0; i < line.length;) {
+    const first = atomAt(line, i);
+    if (!first || line.slice(first.end, first.end + 3) !== ' | ') {
+      if (first) { result += first.text; i = first.end; }
+      else { result += line[i]!; i++; }
+      continue;
+    }
+    const parts = [first.text];
+    let end = first.end;
+    while (line.slice(end, end + 3) === ' | ') {
+      const next = atomAt(line, end + 3);
+      if (!next) break;
+      parts.push(next.text);
+      end = next.end;
+    }
+    result += parts.sort().join(' | ');
+    i = end;
+  }
+  return result;
+}
+
+function normalizeDiagnosticLine(line: string): string {
+  // The observed reorder is a TypeScript union containing quoted literal members.
+  // Bare quoted prose such as 'a | b' may be a string value, so keep it byte-exact.
+  return line.replace(/'([^'\n]*\|[^'\n]*)'/g, (quoted, type: string) => type.includes('"') ? `'${normalizeUnionAtoms(type)}'` : quoted);
+}
+
+/** Include continuation lines; the existing gate parser reads only TS header lines. */
+export function normalizedDiagnosticSet(output: string): string | null {
+  const blocks: string[] = [];
+  const other: string[] = [];
+  let block: string[] | null = null;
+  for (const line of output.split(/\r?\n/)) {
+    if (/^.+?\.[cm]?tsx?\(\d+,\d+\): error TS\d+:/.test(line)) {
+      if (block) blocks.push(block.map(normalizeDiagnosticLine).join('\n'));
+      block = [line];
+    } else if (block && /^\s/.test(line)) block.push(line);
+    else {
+      if (block) blocks.push(block.map(normalizeDiagnosticLine).join('\n'));
+      block = null;
+      if (line.trim()) other.push(line);
+    }
+  }
+  if (block) blocks.push(block.map(normalizeDiagnosticLine).join('\n'));
+  if (/error TS\d+/.test(output) && blocks.length === 0) return null;
+  return JSON.stringify({ blocks: blocks.sort(), other });
+}

package/scripts/tsc-main-safety-net.ts

@@ -3,7 +3,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { debug } from '../src/debug/log.js';
 import { effectiveInstanceRoot } from '../src/instance/resolve.js';
-import { GATE_REMOTE_DEFAULTS, isValidGateHost, resolveGateRemoteSettings, runOnRemote, type ExecResult, type RemoteRunOptions, type RemoteRunOutcome } from '../src/self-implement/gate-remote.js';
+import { GATE_REMOTE_DEFAULTS, gateRemoteHostCap, isValidGateHost, resolveGateRemoteSettings, runOnRemote, type ExecResult, type RemoteRunOptions, type RemoteRunOutcome } from '../src/self-implement/gate-remote.js';
 import { getUserConfig } from '../src/user-config.js';
 import { parseTypecheckErrors, tscEnv } from '../src/typecheck-ratchet.js';
 import { compareDiagnostics, normalizeDiagnostics, type NormalizedDiagnostic } from './tsc-baseline-comparison.js';
@@ -143,7 +143,7 @@ export async function runSafetyNet(repo: string, argv: readonly string[] = [], d
       diagnostics = diagnosticsOf(result, worktree);
       if (!diagnostics) reason = 'local tsc did not produce a complete measurement';
     } else {
-      const result = remote({ repo: worktree, host, mirror: settings.mirror, hostCap: settings.hostCap, argv: TSC_ARGV });
+      const result = remote({ repo: worktree, host, mirror: settings.mirror, hostCap: gateRemoteHostCap(settings, host), argv: TSC_ARGV });
       if (result.kind === 'ran') {
         if (result.commit !== commit) throw new Error('remote measured a different commit');
         diagnostics = diagnosticsOf({ rc: result.rc, stdout: result.stdout.toString('utf8'), stderr: result.stderr.toString('utf8') }, worktree);

package/src/acp/client.ts

@@ -692,6 +692,7 @@ export class AcpAgent {
     sessionId: SessionId;
     cwd?: string;
     mcpServers?: McpServer[];
+    _meta?: Record<string, unknown>;
   }): Promise<LoadSessionResponse> {
     if (!this.connection) throw new Error('AcpAgent not started');
     if (!this.peerCapabilities?.loadSession) {
@@ -701,6 +702,7 @@ export class AcpAgent {
       sessionId: req.sessionId,
       cwd: req.cwd ?? this.cwd,
       mcpServers: req.mcpServers ?? [],
+      ...(req._meta ? { _meta: req._meta } : {}),
     });
   }
 
@@ -764,13 +766,14 @@ export class AcpAgent {
 
   /** Begin a new session in the configured cwd. Returns the agent-
    *  assigned sessionId — caller stores this for follow-up turns. */
-  async newSession(): Promise<SessionId> {
+  async newSession(meta?: Record<string, unknown>): Promise<SessionId> {
     if (!this.connection) throw new Error('AcpAgent not started');
     let response;
     try {
       response = await this.connection.newSession({
         cwd: this.cwd,
         mcpServers: [],
+        ...(meta ? { _meta: meta } : {}),
       });
     } catch (error) {
       if (this.spec.id === 'claude'