elanous 0.2.29 → 0.2.32

package/scripts/release-loop/gate-partial.ts

@@ -5,12 +5,15 @@
 // GATE-REUSE-BY-DIFF (0.2.25): a code change no longer forces the full sweep — with the tip's import closure
 // (gate-closure.ts) the plan adds every test that can reach a changed file, and every test whose closure is opaque.
 // `release resume --from gate` now plans this by default when the tip moved (`--no-partial` = full gate).
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, linkSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { CODE_FILE, type ClosureVerdict } from './gate-closure';
 
 export interface PartialPlan {
+  /** A verified docs-only append carries the completed, clean cut without starting a test Pod. */
+  kind?: 'carry' | 'recheck';
   version: string;
   /** Commit the previous (full) gate measured — its recorded failures are carried for every file not re-run. */
   priorCommit: string;
@@ -22,6 +25,80 @@ export interface PartialPlan {
   priorErrors: string[];
 }
 
+/** G1: a second measurement of only the failed files on the very same release commit.
+ * This is deliberately separate from PartialPlan, which compares two different commits. */
+export interface RecheckPlan extends PartialPlan { kind: 'recheck' }
+
+const FULL_SHA = /^[0-9a-f]{40}$/i;
+const RELEASE_VERSION = /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/;
+export const recheckPlanPath = (root: string, version: string) => partialPlanPath(root, version);
+
+/** A recheck never broadens its scope to passing or changed tests. Any uncertain input fails closed. */
+export function planSameCommitRecheck(input: { version: string; measuredCommit: string; forCommit: string;
+  failures: readonly string[]; errors: readonly string[]; existsAtCommit: (file: string) => boolean }):
+  { ok: true; plan: RecheckPlan } | { ok: false; reason: string } {
+  if (!RELEASE_VERSION.test(input.version)) return { ok: false, reason: 'invalid release version' };
+  if (!FULL_SHA.test(input.measuredCommit) || !FULL_SHA.test(input.forCommit)) return { ok: false, reason: 'commit is not a full sha' };
+  if (input.measuredCommit !== input.forCommit) return { ok: false, reason: 'recheck requires the same commit' };
+  let files: string[];
+  try { files = [...new Set([...input.failures, ...input.errors].map(testFileOfId))].sort(); }
+  catch (error) { return { ok: false, reason: String(error instanceof Error ? error.message : error) }; }
+  if (!files.length) return { ok: false, reason: 'no failed test files to recheck' };
+  try {
+    const missing = files.find((file) => !input.existsAtCommit(file));
+    if (missing) return { ok: false, reason: `failed test file missing at commit: ${missing}` };
+  } catch (error) { return { ok: false, reason: `test file existence unreadable: ${String(error)}` }; }
+  return { ok: true, plan: { kind: 'recheck', version: input.version, priorCommit: input.measuredCommit,
+    forCommit: input.forCommit, files, priorFailures: [...input.failures], priorErrors: [...input.errors] } };
+}
+
+export function writeRecheckPlan(root: string, plan: RecheckPlan): string {
+  validateRecheckPlan(plan, plan.version, recheckPlanPath(root, plan.version));
+  const path = recheckPlanPath(root, plan.version);
+  const inspectExisting = (): void => {
+    const existing = JSON.parse(readFileSync(path, 'utf8')) as Partial<RecheckPlan>;
+    if (existing.kind !== 'recheck') throw new Error(`gate partial plan already exists: ${path}`);
+    validateRecheckPlan(existing, plan.version, path);
+    if (existing.forCommit !== plan.forCommit)
+      throw new Error(`gate recheck plan already exists for another commit: ${path}`);
+    if (JSON.stringify(existing) !== JSON.stringify(plan))
+      throw new Error(`different gate recheck plan already exists: ${path}`);
+  };
+  return publishPlanIfVacant(path, plan, inspectExisting);
+}
+
+/** Both writers of gate-partial.json must use the same no-clobber publication rule. */
+function publishPlanIfVacant(path: string, plan: PartialPlan, inspectExisting: () => void): string {
+  if (existsSync(path)) { inspectExisting(); return path; }
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(temp, `${JSON.stringify(plan, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+    // Same-directory hard link publishes a complete file only if the slot is still empty.
+    // renameSync would overwrite a different writer's commit between inspection and publication.
+    try { linkSync(temp, path); }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      inspectExisting();
+    }
+  } finally { rmSync(temp, { force: true }); }
+  return path;
+}
+
+function validateRecheckPlan(raw: Partial<RecheckPlan>, version: string, path: string): asserts raw is RecheckPlan {
+  const invalid = () => { throw new Error(`invalid gate recheck plan: ${path}`); };
+  if (!RELEASE_VERSION.test(version) || raw.kind !== 'recheck' || raw.version !== version ||
+      typeof raw.priorCommit !== 'string' || !FULL_SHA.test(raw.priorCommit) ||
+      typeof raw.forCommit !== 'string' || !FULL_SHA.test(raw.forCommit) || raw.priorCommit !== raw.forCommit ||
+      !Array.isArray(raw.priorFailures) || !raw.priorFailures.every((id) => typeof id === 'string') ||
+      !Array.isArray(raw.priorErrors) || !raw.priorErrors.every((id) => typeof id === 'string') ||
+      !Array.isArray(raw.files) || !raw.files.length || !raw.files.every((file) => typeof file === 'string')) invalid();
+  let expected: string[] = [];
+  try { expected = [...new Set([...raw.priorFailures!, ...raw.priorErrors!].map(testFileOfId))].sort(); }
+  catch { invalid(); }
+  if (JSON.stringify(raw.files) !== JSON.stringify(expected)) invalid();
+}
+
 export const partialPlanPath = (root: string, version: string) => join(root, 'release', version, 'gate-partial.json');
 /** The same test-file set the gate sweep runs (`git ls-files` filtered by this suffix). */
 const TEST_FILE = /^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/;
@@ -31,6 +108,12 @@ const INERT_MD = /\.md$/;
 const TEST_INPUT = /(?:^|\/)(?:test|tests|fixtures|__fixtures__|__snapshots__|__mocks__)\//;
 const isInert = (file: string) => INERT_MD.test(file) && !TEST_INPUT.test(file);
 
+/** Recheck the immutable Git diff at the consumer; a mutable plan file alone cannot authorize a zero-file gate. */
+export function verifyDocsOnlyCarry(repo: string, priorCommit: string, forCommit: string): boolean {
+  const files = changedFilesBetween(repo, priorCommit, forCommit);
+  return files.length > 0 && files.every(isInert);
+}
+
 /** The test file of a failure id (`<file> > <case>`). One rule for the gate and the partial plan: ids come only from the
  *  gate's output parsers, which accept `dir/….test.ts(x)` — anything else (a root file, `..`, no case) is unsafe. */
 export function testFileOfId(id: string): string {
@@ -75,18 +158,22 @@ export function planPartialRegate(input: { version: string; priorCommit: string;
   const gone = failureFiles.filter((file) => !exists(file));
   if (gone.length) return { ok: false, reason: `prior failure file deleted at the tip → full gate: ${list(gone)}` };
   const files = [...new Set([...input.changedFiles.filter((file) => TEST_FILE.test(file) && exists(file)), ...failureFiles, ...reaching])].sort();
-  if (!files.length) return { ok: false, reason: 'nothing to re-run' };
-  return { ok: true, plan: { version: input.version, priorCommit: input.priorCommit, forCommit: input.forCommit, files,
+  // An empty selection is safe only for a genuinely docs-only diff. A deleted test also selects zero files,
+  // but it changes the measured suite and must not masquerade as a carry.
+  if (!files.length && (!input.changedFiles.length || input.changedFiles.some((file) => !isInert(file))))
+    return { ok: false, reason: 'nothing to re-run (not a docs-only append)' };
+  return { ok: true, plan: { ...(!files.length ? { kind: 'carry' as const } : {}), version: input.version, priorCommit: input.priorCommit, forCommit: input.forCommit, files,
     priorFailures: [...input.priorFailures], priorErrors: [...input.priorErrors] }, ...(closure ? { closure } : {}) };
 }
 
 export function writePartialPlan(root: string, plan: PartialPlan): string {
   const path = partialPlanPath(root, plan.version);
-  mkdirSync(dirname(path), { recursive: true });
-  const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync(temp, `${JSON.stringify(plan, null, 2)}\n`, { mode: 0o600 });
-  renameSync(temp, path);
-  return path;
+  return publishPlanIfVacant(path, plan, () => {
+    const existing = JSON.parse(readFileSync(path, 'utf8')) as PartialPlan & { kind?: unknown };
+    if (existing.kind === 'recheck') throw new Error(`gate recheck plan already exists: ${path}`);
+    if (JSON.stringify(existing) !== JSON.stringify(plan))
+      throw new Error(`different gate partial plan already exists: ${path}`);
+  });
 }
 
 export function clearPartialPlan(root: string, version: string): void {
@@ -100,10 +187,20 @@ export function readPartialPlan(roots: readonly string[], version: string, commi
     const path = partialPlanPath(root, version);
     if (!existsSync(path)) continue;
     const raw = JSON.parse(readFileSync(path, 'utf8')) as Partial<PartialPlan>;
+    if ((raw as Partial<RecheckPlan>).kind !== undefined && (raw as Partial<RecheckPlan>).kind !== 'recheck' && raw.kind !== 'carry')
+      throw new Error(`invalid gate partial plan: ${path}`);
+    // Until the gate consumer connects G1, the opt-in recheck plan is a shadow record.
+    // A legacy full gate may run, but it must never interpret a same-commit recheck as a changed-tip partial gate.
+    if ((raw as Partial<RecheckPlan>).kind === 'recheck') {
+      validateRecheckPlan(raw as Partial<RecheckPlan>, version, path);
+      continue;
+    }
     if (raw.version !== version || typeof raw.priorCommit !== 'string' || !/^[0-9a-f]{40}$/i.test(raw.priorCommit)
       || typeof raw.forCommit !== 'string' || !/^[0-9a-f]{40}$/i.test(raw.forCommit) || raw.priorCommit === raw.forCommit
-      || !Array.isArray(raw.files) || raw.files.length === 0 || !raw.files.every((file) => typeof file === 'string' && TEST_FILE.test(file) && !file.split('/').includes('..'))
+      || !Array.isArray(raw.files) || (raw.files.length === 0) !== (raw.kind === 'carry')
+      || !raw.files.every((file) => typeof file === 'string' && TEST_FILE.test(file) && !file.split('/').includes('..'))
       || !Array.isArray(raw.priorFailures) || !Array.isArray(raw.priorErrors)) throw new Error(`invalid gate partial plan: ${path}`);
+    if (raw.kind === 'carry' && (raw.priorFailures.length || raw.priorErrors.length)) throw new Error(`invalid gate partial plan: ${path}`);
     // Every prior failure's file is re-run (planPartialRegate guarantees it) — a plan that would carry a failure it did
     // not re-run is malformed, not «partial».
     const rerun = new Set(raw.files);

package/scripts/release-loop/gate-pr-cache.ts

@@ -0,0 +1,66 @@
+/** Decide whether a standalone train may consume an author's exact-head remote gate. No I/O. */
+export type PrGateCacheDecision = {
+  decision: 'reuse' | 'partial' | 'full'; reason: string; files: string[];
+  head: string; base: string; main: string;
+};
+
+export interface PrGateCacheInput {
+  summary: unknown;
+  head: string;
+  main: string;
+  singlePr: boolean;
+  baseAncestorOfHead: boolean;
+  baseAncestorOfMain: boolean;
+  /** git diff --name-only --no-renames author base..current main; null means unmeasured. */
+  mainChangedFiles: readonly string[] | null;
+  /** True only when every changed inert document was added on main, not modified or deleted. */
+  inertDocsAddedOnly: boolean | null;
+  /** Import-closure result among the author's measured cohort; null means unmeasured. */
+  affectedTests: readonly string[] | null;
+  /** Whether changed main code is in the changed PR source's forward dependency closure. */
+  sourceDependencyOverlap: boolean | null;
+}
+
+const SHA = /^[0-9a-f]{40}$/i;
+const TEST = /\.test\.[cm]?[jt]sx?$/;
+const CODE = /\.[cm]?[jt]sx?$/;
+const INERT_DOC = /\.md$/;
+const TEST_INPUT = /(?:^|\/)(?:test|tests|__tests__|fixtures|__fixtures__|__snapshots__|__mocks__)\//;
+const safePath = (path: unknown): path is string => typeof path === 'string' && !!path
+  && !path.startsWith('/') && !path.split('/').some((part) => !part || part === '.' || part === '..');
+
+export function decidePrGateCache(input: PrGateCacheInput): PrGateCacheDecision {
+  const raw = input.summary && typeof input.summary === 'object' && !Array.isArray(input.summary)
+    ? input.summary as Record<string, unknown> : {};
+  const base = typeof raw.base40 === 'string' ? raw.base40.toLowerCase() : '';
+  const head = input.head.toLowerCase();
+  const main = input.main.toLowerCase();
+  const result = (decision: PrGateCacheDecision['decision'], reason: string, files: string[] = []): PrGateCacheDecision =>
+    ({ decision, reason, files, head, base, main });
+  if (!input.singlePr) return result('full', 'bundle-train');
+  if (![head, base, main].every((sha) => SHA.test(sha))) return result('full', 'identity-unmeasured');
+  if (typeof raw.head40 !== 'string' || raw.head40.toLowerCase() !== head || raw.verdict !== 'passed' || raw.exitCode !== 0
+    || raw.introduced !== 0 || raw.unknown !== 0 || raw.preconditionUnmet !== 0 || raw.unrunImporters !== 0
+    || (raw.remoteHost !== 'node-b' && raw.remoteHost !== 'node-c'))
+    return result('full', 'author-gate-unmeasured-or-incomplete');
+  if (!Array.isArray(raw.cohort) || !raw.cohort.length || !raw.cohort.every((file) => safePath(file) && TEST.test(file)))
+    return result('full', 'author-cohort-unmeasured');
+  const cohort = [...new Set(raw.cohort as string[])];
+  if (!input.baseAncestorOfHead || !input.baseAncestorOfMain) return result('full', 'base-not-ancestor');
+  if (!input.mainChangedFiles || !input.mainChangedFiles.every(safePath)) return result('full', 'main-diff-unmeasured');
+  const changed = [...new Set(input.mainChangedFiles)].sort();
+  if (changed.some((file) => !CODE.test(file) && !(INERT_DOC.test(file) && !TEST_INPUT.test(file))))
+    return result('full', 'main-noncode-change');
+  if (changed.some((file) => INERT_DOC.test(file)) && input.inertDocsAddedOnly !== true)
+    return result('full', 'main-document-change-not-addition');
+  const codeChanged = changed.filter((file) => CODE.test(file));
+  if (!codeChanged.length) return result('reuse', changed.length ? 'main-doc-only-outside-radius' : 'same-content-base');
+  if (input.sourceDependencyOverlap === null) return result('full', 'pr-source-radius-unmeasured');
+  if (!input.affectedTests || !input.affectedTests.every((file) => safePath(file) && cohort.includes(file)))
+    return result('full', 'radius-unmeasured');
+  const affected = [...new Set([...input.affectedTests, ...codeChanged.filter((file) => cohort.includes(file))])].sort();
+  if (input.sourceDependencyOverlap && !affected.length) return result('full', 'pr-source-dependency-without-recheck-test');
+  if (!affected.length) return result('reuse', 'main-change-outside-pr-radius');
+  if (affected.length === cohort.length) return result('full', 'whole-author-cohort-affected');
+  return result('partial', 'main-change-inside-pr-radius', affected);
+}

package/scripts/release-loop/gate-prewarm-plan.ts

@@ -0,0 +1,66 @@
+/**
+ * Decide whether the release gate may prepare a warm worker before the cut.
+ * This module makes no Pod or Git calls; the caller must recheck the same inputs
+ * immediately before starting anything, because pool occupancy can change.
+ */
+
+export const GATE_PREWARM_WINDOW_MS = 30 * 60_000;
+export const GATE_PREWARM_OBSERVATION_MAX_AGE_MS = 30_000;
+
+export interface GatePrewarmInput {
+  nowMs: number;
+  cutAtMs: number;
+  cutSha: string;
+  lockHash: string;
+  /** Observed current source; it must still be the candidate the cut planner named. */
+  sourceSha: string | null;
+  sourceLockHash: string | null;
+  /** null means absent in a measured mirror; undefined means mirror status could not be measured. */
+  mirrorCommitSha: string | null | undefined;
+  /** One snapshot time for source, mirror, occupancy and demand. */
+  observedAtMs: number | null;
+  /** Current Pod count includes any existing warm workers. */
+  occupiedPods: number | null;
+  capacity: number;
+  /** Pending higher-priority requests, including ones not yet represented by a Pod. */
+  gateDemand: number | null;
+  taskDemand: number | null;
+}
+
+export type GatePrewarmPlan =
+  | { action: 'defer'; reason: 'invalid-input' | 'outside-window' | 'unmeasured' | 'stale-observation' | 'identity' | 'higher-priority' | 'no-slot' }
+  | { action: 'prepare-mirror'; cutSha: string; lockHash: string }
+  | { action: 'start-worker'; cutSha: string; lockHash: string; slotAfter: number };
+
+const count = (value: number | null): value is number =>
+  value !== null && Number.isSafeInteger(value) && value >= 0;
+
+/** Gate > task > prewarm. Missing capacity or demand evidence never grants a worker slot. */
+export function planGatePrewarm(input: GatePrewarmInput): GatePrewarmPlan {
+  const { nowMs, cutAtMs, cutSha, lockHash, sourceSha, sourceLockHash, mirrorCommitSha,
+    observedAtMs, occupiedPods, capacity, gateDemand, taskDemand } = input;
+  if (!Number.isSafeInteger(nowMs) || !Number.isSafeInteger(cutAtMs) || !/^[a-f0-9]{40}$/.test(cutSha)
+    || !/^[a-f0-9]{64}$/.test(lockHash) || !Number.isSafeInteger(capacity) || capacity < 1) {
+    return { action: 'defer', reason: 'invalid-input' };
+  }
+  const untilCut = cutAtMs - nowMs;
+  if (untilCut <= 0 || untilCut > GATE_PREWARM_WINDOW_MS) return { action: 'defer', reason: 'outside-window' };
+  if (mirrorCommitSha === undefined || typeof sourceSha !== 'string' || typeof sourceLockHash !== 'string'
+    || typeof observedAtMs !== 'number' || !count(occupiedPods) || !count(gateDemand) || !count(taskDemand)) {
+    return { action: 'defer', reason: 'unmeasured' };
+  }
+  if (mirrorCommitSha !== null && (typeof mirrorCommitSha !== 'string' || !/^[a-f0-9]{40}$/.test(mirrorCommitSha))) {
+    return { action: 'defer', reason: 'invalid-input' };
+  }
+  if (!Number.isSafeInteger(observedAtMs) || observedAtMs > nowMs
+    || nowMs - observedAtMs > GATE_PREWARM_OBSERVATION_MAX_AGE_MS) {
+    return { action: 'defer', reason: 'stale-observation' };
+  }
+  if (sourceSha !== cutSha || sourceLockHash !== lockHash) return { action: 'defer', reason: 'identity' };
+  // A mirror request uses no Pod slot but must not run during higher-priority traffic.
+  if (gateDemand > 0 || taskDemand > 0) return { action: 'defer', reason: 'higher-priority' };
+  // A measured mirror can be absent or hold an older commit; both require the same targeted fetch.
+  if (mirrorCommitSha !== cutSha) return { action: 'prepare-mirror', cutSha, lockHash };
+  if (occupiedPods >= capacity) return { action: 'defer', reason: 'no-slot' };
+  return { action: 'start-worker', cutSha, lockHash, slotAfter: capacity - occupiedPods - 1 };
+}

package/scripts/release-loop/gate-r2-verdict.ts

@@ -0,0 +1,189 @@
+#!/usr/bin/env bun
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { parseXml, type XmlElement } from '../../src/self-dev/shard-aggregate.js';
+
+export type GateR2Verdict = 'introduced' | 'preexisting' | 'interference-candidate' | 'environment-failure' | 'unmeasured';
+export type GateR2Identity = 'exact' | 'renamed-existing-candidate' | 'identity-unmeasured';
+
+export interface GateR2Run {
+  runId: string;
+  head40: string;
+  envKey: string;
+  cohort: string[];
+  rc: number;
+  junitPath: string;
+  resultPath: string;
+}
+export interface GateR2Input {
+  stableTestId: string;
+  head40: string;
+  base40: string;
+  envKey: string;
+  shards: number;
+  cohort: string[];
+  batch: GateR2Run;
+  solo: GateR2Run;
+  baseline: GateR2Run;
+  /** Evidence only: an equal source digest proposes a rename; it never auto-waives a failure. */
+  renameCandidate?: { oldTestId: string; oldDigest: string; newDigest: string; unique: boolean };
+  /** Two independent Pod status artifacts; an arbitrary matching log line is not infrastructure proof. */
+  environmentProof?: { signature: string; batchStatusPath: string; baselineStatusPath: string };
+}
+export interface GateR2Result {
+  verdict: GateR2Verdict;
+  identityStatus: GateR2Identity;
+  stableTestId: string;
+  evidence: { head40: string; base40: string; envKey: string; shards: number; cohort: string[];
+    batchResultPath: string; soloResultPath: string; baselineResultPath: string; reason: string };
+}
+
+type Cases = Map<string, 'pass' | 'fail' | 'error' | 'skipped'>;
+const sha40 = /^[a-f0-9]{40}$/i;
+const testFile = (id: string) => id.split(' > ')[0]?.replace(/^\.\//, '') ?? '';
+/** Read complete Bun JUnit identities; malformed structure or duplicate IDs are unmeasured. */
+export function gateR2JunitCases(xml: string): Cases | null {
+  const root = parseXml(xml);
+  if (root?.name !== 'testsuites' || !root.children.length) return null;
+  const cases: Cases = new Map();
+  let invalid = false;
+  const countMatches = (declared: string | undefined, actual: number) => declared === undefined
+    || (/^(0|[1-9]\d*)$/.test(declared) && Number(declared) === actual);
+  const walkSuite = (suite: XmlElement, parentFile: string | undefined, names: string[]): number => {
+    if (suite.name !== 'testsuite') { invalid = true; return 0; }
+    const file = suite.attrs.file ?? parentFile ?? suite.attrs.name;
+    const nextNames = parentFile ? [...names, suite.attrs.name ?? ''] : names;
+    let count = 0;
+    for (const child of suite.children) {
+      if (child.name === 'testsuite') { count += walkSuite(child, file, nextNames); continue; }
+      if (child.name !== 'testcase') { invalid = true; continue; }
+      count++;
+      const path = child.attrs.file ?? file;
+      const name = [...nextNames, child.attrs.name ?? ''].filter(Boolean).join(' > ');
+      if (!path || !child.attrs.name || !name || child.children.some((marker) => !['failure', 'error', 'skipped', 'system-out', 'system-err'].includes(marker.name))) {
+        invalid = true; continue;
+      }
+      const id = `${path.replace(/^\.\//, '')} > ${name}`;
+      if (cases.has(id)) { invalid = true; continue; }
+      const markers = child.children.filter((marker) => ['failure', 'error', 'skipped'].includes(marker.name));
+      if (markers.length > 1) { invalid = true; continue; }
+      cases.set(id, markers[0]?.name === 'failure' ? 'fail' : markers[0]?.name === 'error' ? 'error'
+        : markers[0]?.name === 'skipped' ? 'skipped' : 'pass');
+    }
+    if (!countMatches(suite.attrs.tests, count)) invalid = true;
+    return count;
+  };
+  const count = root.children.reduce((total, child) => total + walkSuite(child, undefined, []), 0);
+  if (!countMatches(root.attrs.tests, count)) invalid = true;
+  return invalid || cases.size === 0 ? null : cases;
+}
+
+function readSmall(path: string): string {
+  if (!path || statSync(path).size > 16 * 1024 * 1024) throw new Error('artifact missing or too large');
+  return readFileSync(path, 'utf8');
+}
+
+export function classifyGateR2Verdict(input: GateR2Input, read: (path: string) => string = readSmall): GateR2Result {
+  const source = (input && typeof input === 'object' ? input : {}) as Partial<GateR2Input>;
+  const { batch, solo, baseline } = source;
+  const evidence = { head40: source.head40 ?? '', base40: source.base40 ?? '', envKey: source.envKey ?? '', shards: source.shards ?? 0,
+    cohort: Array.isArray(source.cohort) ? [...source.cohort] : [], batchResultPath: batch?.resultPath ?? '', soloResultPath: solo?.resultPath ?? '',
+    baselineResultPath: baseline?.resultPath ?? '', reason: '' };
+  const answer = (verdict: GateR2Verdict, reason: string, identityStatus: GateR2Identity = 'exact'): GateR2Result =>
+    ({ verdict, identityStatus, stableTestId: source.stableTestId ?? '', evidence: { ...evidence, reason } });
+  const unique = (paths: string[]) => paths.length === new Set(paths).size && paths.every((path) =>
+    path.split('/').every((part) => part !== '.' && part !== '..' && /^[\w.-]+$/.test(part))
+    && /\.(test|spec)\.[cm]?[tj]sx?$/.test(path));
+  if (typeof input?.stableTestId !== 'string' || typeof input.head40 !== 'string' || typeof input.base40 !== 'string'
+    || typeof input.envKey !== 'string' || !Array.isArray(input.cohort) || !Array.isArray(batch?.cohort)
+    || !Array.isArray(solo?.cohort) || !Array.isArray(baseline?.cohort)
+    || !sha40.test(input.head40) || !sha40.test(input.base40) || !input.envKey || !Number.isSafeInteger(input.shards) || input.shards < 1
+    || !input.stableTestId.includes(' > ') || !unique(input.cohort) || input.cohort.length < 2
+    || JSON.stringify(input.cohort) !== JSON.stringify([...input.cohort].sort())
+    || !input.cohort.includes(testFile(input.stableTestId)) || !batch || !solo || !baseline)
+    return answer('unmeasured', 'identity or cohort input invalid', 'identity-unmeasured');
+  if (batch.head40 !== input.head40 || solo.head40 !== input.head40 || baseline.head40 !== input.base40
+    || [batch, solo, baseline].some((run) => run.envKey !== input.envKey || !Number.isSafeInteger(run.rc) || run.rc < 0
+      || typeof run.runId !== 'string' || run.runId.length < 8 || !run.resultPath || !run.junitPath)
+    || new Set([batch.runId, solo.runId, baseline.runId]).size !== 3
+    || new Set([batch.junitPath, batch.resultPath, solo.junitPath, solo.resultPath, baseline.junitPath, baseline.resultPath]).size !== 6
+    || JSON.stringify(batch.cohort) !== JSON.stringify(input.cohort)
+    || JSON.stringify(solo.cohort) !== JSON.stringify([testFile(input.stableTestId)])
+    || JSON.stringify(baseline.cohort) !== JSON.stringify([testFile(input.stableTestId)]))
+    return answer('unmeasured', 'head/env/cohort/artifact mismatch', 'identity-unmeasured');
+  let batchCases: Cases, soloCases: Cases, baseCases: Cases;
+  try {
+    const artifactPaths = [batch.junitPath, batch.resultPath, solo.junitPath, solo.resultPath, baseline.junitPath, baseline.resultPath];
+    if (new Set(artifactPaths.map((path) => realpathSync(path))).size !== artifactPaths.length
+      || new Set(artifactPaths.map((path) => { const stat = statSync(path); return `${stat.dev}:${stat.ino}`; })).size !== artifactPaths.length)
+      return answer('unmeasured', 'run artifacts resolve to the same file', 'identity-unmeasured');
+    for (const run of [batch, solo, baseline]) {
+      const result = JSON.parse(read(run.resultPath)) as Partial<GateR2Run>;
+      if (result.head40 !== run.head40 || result.envKey !== run.envKey || result.rc !== run.rc || result.runId !== run.runId
+        || result.resultPath !== run.resultPath
+        || result.junitPath !== run.junitPath || JSON.stringify(result.cohort) !== JSON.stringify(run.cohort))
+        return answer('unmeasured', 'result artifact disagrees with run identity', 'identity-unmeasured');
+    }
+    const parsed = [batch, solo, baseline].map((run) => gateR2JunitCases(read(run.junitPath)));
+    if (parsed.some((cases) => cases === null)) return answer('unmeasured', 'JUnit incomplete or duplicate IDs', 'identity-unmeasured');
+    if ([batch, solo, baseline].some((run, index) => [...parsed[index]!.keys()].some((id) => !run.cohort.includes(testFile(id)))))
+      return answer('unmeasured', 'JUnit testcase outside declared cohort', 'identity-unmeasured');
+    [batchCases, soloCases, baseCases] = parsed as Cases[];
+    if ([batch, solo, baseline].some((run, index) => {
+      const hasFailure = [...parsed[index]!.values()].some((status) => status === 'fail' || status === 'error');
+      return (run.rc === 0) === hasFailure;
+    })) return answer('unmeasured', 'JUnit failures contradict process exit code', 'identity-unmeasured');
+  } catch { return answer('unmeasured', 'JUnit unreadable', 'identity-unmeasured'); }
+  const issue = (value: string | undefined) => value === 'fail' || value === 'error';
+  if (!issue(batchCases.get(input.stableTestId)) || batch.rc === 0)
+    return answer('unmeasured', 'batch failure identity not proved', 'identity-unmeasured');
+  const soloStatus = soloCases.get(input.stableTestId);
+  const baseStatus = baseCases.get(input.stableTestId);
+  const rename = input.renameCandidate;
+  const renameStatus: GateR2Identity = rename?.unique && typeof rename.oldDigest === 'string'
+    && typeof rename.newDigest === 'string' && rename.oldDigest.length >= 8 && rename.oldDigest === rename.newDigest
+    && issue(baseCases.get(rename.oldTestId)) ? 'renamed-existing-candidate' : 'identity-unmeasured';
+  if (!baseStatus) return answer('unmeasured', 'baseline testcase identity absent or ambiguous', renameStatus);
+  if (baseStatus === 'skipped') return answer('unmeasured', 'baseline testcase skipped', 'identity-unmeasured');
+  if (issue(baseStatus) && baseline.rc === 0)
+    return answer('unmeasured', 'baseline JUnit failure contradicts exit code', 'identity-unmeasured');
+  if (!soloStatus || soloStatus === 'skipped') return answer('unmeasured', 'solo testcase identity absent or skipped', 'identity-unmeasured');
+  if (input.environmentProof !== undefined) {
+    try {
+      const { signature, batchStatusPath, baselineStatusPath } = input.environmentProof;
+      if (typeof signature !== 'string' || signature.length < 8 || !batchStatusPath || !baselineStatusPath || baseline.rc === 0)
+        return answer('unmeasured', 'Pod infrastructure proof incomplete', 'identity-unmeasured');
+      const proofPaths = [batchStatusPath, baselineStatusPath];
+      const artifactPaths = [batch.junitPath, batch.resultPath, solo.junitPath, solo.resultPath, baseline.junitPath, baseline.resultPath];
+      const allPaths = [...artifactPaths, ...proofPaths];
+      if (new Set(allPaths.map((path) => realpathSync(path))).size !== allPaths.length
+        || new Set(allPaths.map((path) => { const stat = statSync(path); return `${stat.dev}:${stat.ino}`; })).size !== allPaths.length)
+        return answer('unmeasured', 'Pod status artifacts are not independent', 'identity-unmeasured');
+      const batchStatus = JSON.parse(read(batchStatusPath)) as Record<string, unknown>;
+      const baseStatusProof = JSON.parse(read(baselineStatusPath)) as Record<string, unknown>;
+      const valid = (proof: Record<string, unknown>, head: string, runId: string) => proof.kind === 'pod-infrastructure'
+        && proof.head40 === head && proof.envKey === input.envKey && proof.signature === signature && proof.runId === runId;
+      if (!valid(batchStatus, input.head40, batch.runId) || !valid(baseStatusProof, input.base40, baseline.runId))
+        return answer('unmeasured', 'Pod infrastructure proof conflicts with result run IDs', 'identity-unmeasured');
+      if (!issue(baseStatus)) return answer('unmeasured', 'Pod infrastructure proof does not explain baseline target', 'identity-unmeasured');
+      return answer('environment-failure', 'independent Pod infrastructure status at base and head');
+    } catch { return answer('unmeasured', 'Pod infrastructure proof unreadable', 'identity-unmeasured'); }
+  }
+  if (soloStatus === 'pass' && solo.rc === 0) return answer('interference-candidate', 'batch failed, same-head/env solo passed');
+  if (!issue(soloStatus) || solo.rc === 0) return answer('unmeasured', 'solo result missing or inconsistent', 'identity-unmeasured');
+  if (issue(baseStatus) && baseline.rc !== 0) return answer('preexisting', 'same stable ID failed at base and head');
+  if (baseStatus === 'pass') return answer('introduced', 'same stable ID passed at base and failed in solo head');
+  return answer('unmeasured', 'baseline testcase identity absent or ambiguous', renameStatus);
+}
+
+export async function gateR2Main(args: string[] = process.argv.slice(2), write: (value: string) => void = console.log): Promise<number> {
+  const path = args[0] === '--input' ? args[1] : undefined;
+  if (!path || (args.length !== 2 && !(args.length === 3 && args[2] === '--json'))) { write('usage: gate-r2-verdict --input <json-file> --json'); return 2; }
+  try {
+    const result = classifyGateR2Verdict(JSON.parse(readSmall(path)) as GateR2Input);
+    write(JSON.stringify(result));
+    return result.verdict === 'unmeasured' ? 3 : 0;
+  } catch (error) { write(JSON.stringify({ verdict: 'unmeasured', identityStatus: 'identity-unmeasured', stableTestId: '',
+    evidence: { head40: '', base40: '', envKey: '', shards: 0, cohort: [], batchResultPath: '', soloResultPath: '', baselineResultPath: '', reason: String(error) } })); return 3; }
+}
+
+if (import.meta.main) process.exitCode = await gateR2Main();

package/scripts/release-loop/gate-recheck-plan-node.ts

@@ -0,0 +1,52 @@
+#!/usr/bin/env bun
+// Shadow node: prepare a same-commit, failed-files-only plan. The gate consumer is a separate TC change.
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { planSameCommitRecheck, writeRecheckPlan } from './gate-partial';
+
+export interface RecheckInput {
+  version: string;
+  commit: string;
+  measuredCommit: string;
+  failures: string[];
+  errors: string[];
+  ledgerRoot: string;
+}
+
+/** Only a Git blob is a runnable test file; `cat-file -e` also accepts trees. */
+export function existsTestFileAtCommit(repo: string, commit: string, file: string): boolean {
+  // git-spawn-allow: read-only object type check at the exact measured release commit.
+  const found = spawnSync('git', ['cat-file', '-t', `${commit}:${file}`], { cwd: repo, encoding: 'utf8' });
+  if (found.error) throw found.error;
+  return found.status === 0 && found.stdout.trim() === 'blob';
+}
+
+export function prepareGateRecheck(input: RecheckInput, existsAtCommit: (file: string) => boolean):
+  { outcome: 'ok'; planPath: string; files: string[]; summary: string } |
+  { outcome: 'fail'; planPath: null; files: string[]; summary: string } {
+  const fail = (summary: string) => ({ outcome: 'fail' as const, planPath: null, files: [], summary });
+  if (!input || typeof input !== 'object' || typeof input.ledgerRoot !== 'string' || !input.ledgerRoot.trim() ||
+      !Array.isArray(input.failures) || !input.failures.every((id) => typeof id === 'string') ||
+      !Array.isArray(input.errors) || !input.errors.every((id) => typeof id === 'string')) return fail('invalid recheck input');
+  const planned = planSameCommitRecheck({ version: input.version, measuredCommit: input.measuredCommit,
+    forCommit: input.commit, failures: input.failures, errors: input.errors, existsAtCommit });
+  if (!planned.ok) return fail(planned.reason);
+  try {
+    const planPath = writeRecheckPlan(input.ledgerRoot, planned.plan);
+    return { outcome: 'ok', planPath, files: planned.plan.files, summary: `${planned.plan.files.length} failed test files planned on same commit` };
+  } catch (error) { return fail(String(error instanceof Error ? error.message : error)); }
+}
+
+function main(): void {
+  const contextPath = process.env.ELANOUS_GRAPH_CONTEXT;
+  if (!contextPath) throw new Error('ELANOUS_GRAPH_CONTEXT required');
+  const context = JSON.parse(readFileSync(contextPath, 'utf8')) as { input?: RecheckInput };
+  const repo = resolve(import.meta.dir, '../..');
+  const input = context.input as RecheckInput;
+  const result = prepareGateRecheck(input, (file) => existsTestFileAtCommit(repo, input.commit, file));
+  console.log(JSON.stringify(result));
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) main();