elanous 0.2.29 → 0.2.32

package/scripts/release-loop/gate-warm-artifacts.ts

@@ -0,0 +1,253 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { parseFailures } from './gate-diff.js';
+import { isCompleteOneFileGateJunit, parseXml, type XmlElement } from '../../src/self-dev/shard-aggregate.js';
+import type { WarmWorkerFileResult } from '../../src/task-orchestrator/surfaces/pod-warm-worker-protocol.js';
+
+const relative = (path: string) => path.replace(/^(?:\.\.\/)*\/?home\/ubuntu\/repo\//, '').replace(/^\.\//, '');
+const lastCount = (log: string, name: string): number | null => {
+  let count: number | null = null;
+  for (const match of log.matchAll(new RegExp(`(?:^|\\n)\\s*(\\d+) ${name}s?\\s*(?=\\n|$)`, 'g'))) count = Number(match[1]);
+  return count;
+};
+const validXmlCodePoint = (code: number): boolean => Number.isSafeInteger(code)
+  && (code === 9 || code === 10 || code === 13 || code >= 0x20 && code <= 0xd7ff
+    || code >= 0xe000 && code <= 0xfffd || code >= 0x10000 && code <= 0x10ffff);
+const numericXmlEntitiesValid = (value: string): boolean => [...value.matchAll(/&#(x[0-9a-fA-F]+|[0-9]+);/g)]
+  .every((match) => validXmlCodePoint(match[1]!.startsWith('x') ? parseInt(match[1]!.slice(1), 16) : parseInt(match[1]!, 10)));
+const xmlText = (value: string): string => value.replace(/&#(x[0-9a-fA-F]+|[0-9]+);|&(amp|lt|gt|quot|apos);/g, (match, numeric: string | undefined, named: string | undefined) => {
+  if (numeric) {
+    const code = numeric.startsWith('x') ? parseInt(numeric.slice(1), 16) : parseInt(numeric, 10);
+    return validXmlCodePoint(code) ? String.fromCodePoint(code) : match;
+  }
+  return ({ amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" } as Record<string, string>)[named ?? ''] ?? match;
+});
+const failureDetail = (value: string): string => xmlText(value).replace(/\x1b\[[0-9;]*[A-Za-z]/g, '').replace(/\r\n/g, '\n').trim();
+function junitFailureDetails(xml: string): Map<string, string> {
+  const details = new Map<string, string>();
+  const root = parseXml(xml);
+  if (!root) return details;
+  const walkSuite = (suite: XmlElement, file: string, names: string[]): void => {
+    const suiteFile = file || suite.attrs.file || suite.attrs.name || '';
+    const nestedNames = file ? [...names, suite.attrs.name ?? ''] : names;
+    for (const child of suite.children) {
+      if (child.name === 'testsuite') { walkSuite(child, suiteFile, nestedNames); continue; }
+      if (child.name !== 'testcase') continue;
+      const id = `${relative(child.attrs.file ?? suiteFile)} > ${[...nestedNames, child.attrs.name ?? ''].join(' > ')}`;
+      const failures = child.children.filter((element) => element.name === 'failure');
+      // One log failure line cannot identify which of several JUnit failure
+      // elements it belongs to. Leave the case unmeasured instead of allowing
+      // a later element to overwrite an earlier, different diagnostic.
+      if (failures.length > 1) { details.set(id, ''); continue; }
+      for (const failure of failures) {
+        const diagnostic = failure.attrs.message === undefined ? '' : failureDetail(failure.attrs.message);
+        const bodyLines = failure.text.split(/\r?\n/);
+        const stackAt = bodyLines.findIndex(line => /^\s*at\s/.test(line));
+        const body = failureDetail((stackAt < 0 ? bodyLines : bodyLines.slice(0, stackAt)).join('\n')
+          .replace(new RegExp(`^${(failure.attrs.type ?? 'Error').replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}:[ \\t]*`), ''));
+        details.set(id, body && body !== diagnostic ? '' : diagnostic);
+      }
+    }
+  };
+  if (root.name === 'testsuite') walkSuite(root, '', []);
+  else if (root.name === 'testsuites') for (const suite of root.children) if (suite.name === 'testsuite') walkSuite(suite, '', []);
+  return details;
+}
+function logFailureDetails(log: string): Map<string, string> | null {
+  const details = new Map<string, string>();
+  let file = '';
+  let block: string[] = [];
+  let errorCount = 0;
+  let unboundError = false;
+  for (const raw of log.split(/\r?\n/)) {
+    const line = raw.trim();
+    const header = /^(?:\.\/)?((?:[\w.-]+\/)+[\w.-]+\.test\.tsx?):(?:\s|$)/.exec(line);
+    if (header) { if (errorCount > 0) unboundError = true; file = relative(header[1]!); block = []; errorCount = 0; continue; }
+    const failed = /\(fail\)\s+(.+?)(?:\s+\[[\d.]+(?:ms|s)\])?$/.exec(line);
+    if (failed && file) {
+      // Bun's JUnit message includes multiline assertion diffs but excludes
+      // the stack. Compare the complete normalized diagnostic, never a prefix.
+      const stackAt = block.findIndex(item => /^\s*at\s/.test(item));
+      const diagnostic = stackAt < 0 ? block : block.slice(0, stackAt);
+      details.set(`${file} > ${failed[1]!.trim()}`, errorCount === 1 ? failureDetail(diagnostic.join('\n')) : '');
+      block = []; errorCount = 0;
+      continue;
+    }
+    if (/^error:\s*/i.test(line)) { block = [raw.replace(/^\s*error:\s*/i, '')]; errorCount++; }
+    else if (errorCount > 0 && !/^\(pass\)/.test(line)) block.push(raw);
+    else if (/^\(pass\)/.test(line)) { if (errorCount > 0) unboundError = true; block = []; errorCount = 0; }
+  }
+  // An error after the last named failure has no JUnit testcase to bind it.
+  // Bun can omit the numeric `errors` summary, so the open diagnostic itself
+  // must make the reference unmeasured.
+  return unboundError || errorCount > 0 ? null : details;
+}
+function junitCases(root: XmlElement): Array<{ file: string; id: string; failed: boolean; error: boolean; skipped: boolean }> {
+  const cases: Array<{ file: string; id: string; failed: boolean; error: boolean; skipped: boolean }> = [];
+  const walkSuite = (suite: XmlElement, file: string, names: string[]): void => {
+    const suiteFile = file || suite.attrs.file || suite.attrs.name || '';
+    const nestedNames = file ? [...names, suite.attrs.name ?? ''] : names;
+    for (const child of suite.children) {
+      if (child.name === 'testsuite') { walkSuite(child, suiteFile, nestedNames); continue; }
+      if (child.name !== 'testcase') continue;
+      const caseFile = relative(child.attrs.file ?? suiteFile);
+      cases.push({ file: caseFile, id: `${caseFile} > ${[...nestedNames, child.attrs.name ?? ''].join(' > ')}`,
+        failed: child.children.some((element) => element.name === 'failure'),
+        error: child.children.some((element) => element.name === 'error'),
+        skipped: child.children.some((element) => element.name === 'skipped') });
+    }
+  };
+  if (root.name === 'testsuite') walkSuite(root, '', []);
+  else if (root.name === 'testsuites') for (const suite of root.children) if (suite.name === 'testsuite') walkSuite(suite, '', []);
+  return cases;
+}
+function logPassIds(log: string): string[] {
+  const ids: string[] = [];
+  let file = '';
+  for (const raw of log.split(/\r?\n/)) {
+    const line = raw.trim();
+    const header = /^(?:\.\/)?((?:[\w.-]+\/)+[\w.-]+\.test\.tsx?):(?:\s|$)/.exec(line);
+    if (header) { file = relative(header[1]!); continue; }
+    const passed = /^\(pass\)\s+(.+?)(?:\s+\[[\d.]+(?:ms|s)\])?$/.exec(line);
+    if (passed && file) ids.push(`${file} > ${passed[1]!.trim()}`);
+  }
+  return ids.sort();
+}
+const MAX_WARM_ARTIFACT_BYTES = 64 * 1024 * 1024;
+const readMaybe = (path: string): Buffer | null => {
+  try { return statSync(path).size <= MAX_WARM_ARTIFACT_BYTES ? readFileSync(path) : null; }
+  catch { return null; }
+};
+const sha256 = (value: Buffer): string => createHash('sha256').update(value).digest('hex');
+
+/** Bind a completed one-file Job's collected outbox to its host metadata. */
+export function writeWarmJobManifest(prefix: string, file: string, cutSha: string, attemptId: string): boolean {
+  const meta = readMaybe(`${prefix}.json`);
+  const log = readMaybe(`${prefix}.log`);
+  const junit = readMaybe(`${prefix}.junit.xml`);
+  const rcBytes = readMaybe(`${prefix}.rc`);
+  if (!meta || !log || !junit || !rcBytes || !file || !cutSha || !attemptId) return false;
+  let row: Record<string, unknown>;
+  try { row = JSON.parse(meta.toString('utf8')) as Record<string, unknown>; } catch { return false; }
+  if (!row || typeof row !== 'object' || Array.isArray(row) || row.commit !== cutSha
+    || row.attemptId !== attemptId || !Array.isArray(row.files) || row.files.length !== 1 || row.files[0] !== file
+    || (row.rc !== 0 && row.rc !== 1) || row.jobFailed !== false || row.jobExitCode !== 0
+    || rcBytes.toString('utf8').trim() !== String(row.rc)) return false;
+  writeFileSync(`${prefix}.warm-manifest.json`, JSON.stringify({ protocol: 1, cutSha, attemptId, file, rc: row.rc,
+    logSha256: sha256(log), junitSha256: sha256(junit), metaSha256: sha256(meta), rcSha256: sha256(rcBytes) }) + '\n', { mode: 0o600 });
+  return true;
+}
+
+/** Convert only a cut/attempt-bound, complete one-file artifact set. */
+export function warmReferenceFromJobArtifacts(prefix: string, file: string, expected: { cutSha: string; attemptId: string }): WarmWorkerFileResult | null {
+  if (!file || !expected?.cutSha || !expected?.attemptId
+    || !existsSync(`${prefix}.log`)
+    || !existsSync(`${prefix}.junit.xml`) || !existsSync(`${prefix}.json`)
+    || !existsSync(`${prefix}.rc`) || !existsSync(`${prefix}.warm-manifest.json`)) return null;
+  let rc: number;
+  const metadata = readMaybe(`${prefix}.json`);
+  if (metadata === null) return null;
+  {
+    let meta: unknown;
+    try { meta = JSON.parse(metadata.toString('utf8')); } catch { return null; }
+    if (!meta || typeof meta !== 'object' || Array.isArray(meta)) return null;
+    const row = meta as Record<string, unknown>;
+    if ((row.rc !== 0 && row.rc !== 1) || row.jobFailed !== false || row.jobExitCode !== 0
+      || !Array.isArray(row.files) || row.files.length !== 1 || row.files[0] !== file
+      || row.commit !== expected.cutSha || row.attemptId !== expected.attemptId) return null;
+    rc = row.rc;
+  }
+  const logBytes = readMaybe(`${prefix}.log`);
+  const xmlBytes = readMaybe(`${prefix}.junit.xml`);
+  const rcBytes = readMaybe(`${prefix}.rc`);
+  if (logBytes === null || xmlBytes === null || rcBytes === null || rcBytes.toString('utf8').trim() !== String(rc)) return null;
+  {
+    let manifest: unknown;
+    try { manifest = JSON.parse(readMaybe(`${prefix}.warm-manifest.json`)?.toString('utf8') ?? ''); } catch { return null; }
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) return null;
+    const bound = manifest as Record<string, unknown>;
+    if (bound.protocol !== 1 || bound.cutSha !== expected.cutSha || bound.attemptId !== expected.attemptId
+      || bound.file !== file || bound.rc !== rc || bound.logSha256 !== sha256(logBytes)
+      || bound.junitSha256 !== sha256(xmlBytes) || bound.metaSha256 !== sha256(metadata)
+      || bound.rcSha256 !== sha256(rcBytes)) return null;
+  }
+  const log = logBytes.toString('utf8').replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
+  const xml = xmlBytes.toString('utf8');
+  if (!numericXmlEntitiesValid(xml)) return null;
+  const sourceBindings = [...log.matchAll(/^\[warm-worker\] cut=([^\s]+) attempt=([^\s]+)$/gm)];
+  if (sourceBindings.length !== 1 || sourceBindings[0]![1] !== expected.cutSha
+    || sourceBindings[0]![2] !== expected.attemptId
+    || sourceBindings[0]!.index! > log.indexOf('bun test v')) return null;
+  // The one-file shell writes the JUnit digest into its log before collection.
+  // A new host manifest cannot legitimize a JUnit from another Job whose
+  // message matches but exception type or stack location differs.
+  const junitBindings = [...log.matchAll(/^\[warm-worker\] junit-sha256=([0-9a-f]{64})$/gm)];
+  if (junitBindings.length !== 1 || junitBindings[0]![1] !== sha256(xmlBytes)) return null;
+  // Bind the run command to the requested file before comparing result names.
+  // Legacy one-shot Jobs record the wrapper invocation; the resident worker
+  // writes a dedicated header.
+  const workerSources = [...log.matchAll(/^\[warm-worker\] file=([^\s]+)$/gm)].map(match => match[1]);
+  const jobSources = [...log.matchAll(/^\$ bun run scripts\/test-deterministic\.ts[^\n]*$/gm)].map(match => match[0]);
+  const bunSources = [...log.matchAll(/^(?:\.\/)?([A-Za-z0-9_./-]+\.test\.tsx?):(?:\r?\n|$)/gm)].map(match => relative(match[1]!));
+  const escapedFile = file.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const invokedFile = jobSources[0] && new RegExp(`(?:^|[\\s"'])(?:\\.\\/)?${escapedFile}(?=$|[\\s"'])`).test(jobSources[0]);
+  if (workerSources.length > 1 || jobSources.length > 1
+    || (workerSources.length === 1 && workerSources[0] !== file)
+    || (jobSources.length === 1 && !invokedFile)
+    || (workerSources.length === 1 && (bunSources.length !== 1 || bunSources[0] !== file))
+    || (jobSources.length === 1 && bunSources.some(source => source !== file))
+    || (workerSources.length === 0 && jobSources.length === 0)) return null;
+  const runStarts = [...log.matchAll(/(?:^|\n)bun test v[^\n]*/g)];
+  const runSummaries = [...log.matchAll(/Ran (\d+) tests? across (\d+) files?/g)];
+  if (runSummaries.length !== 1 || (existsSync(`${prefix}.json`) && runStarts.length !== 1)) return null;
+  const root = parseXml(xml);
+  const cases = root ? junitCases(root) : [];
+  const declared = root ? Number(root.attrs.tests) : NaN;
+  if (!root || !isCompleteOneFileGateJunit(xml, file) || !cases.length || !Number.isSafeInteger(declared) || declared !== cases.length
+    || cases.some(item => item.file !== file || item.error || item.skipped)) return null;
+  const failureIds = cases.filter(item => item.failed).map(item => item.id).sort();
+  // Dots-only success logs lack test identities. A same-file, same-count
+  // JUnit can then be rebound with a fresh manifest, so fail closed.
+  {
+    const allIds = cases.map(item => item.id).sort();
+    // A duplicate name cannot identify which JUnit case matches which log
+    // line, even when the counts and diagnostics happen to agree.
+    if (new Set(allIds).size !== allIds.length) return null;
+    const fromXml = allIds.filter(id => !failureIds.includes(id));
+    const fromLog = logPassIds(log);
+    if (fromXml.length !== cases.length - failureIds.length || fromLog.length !== fromXml.length
+      || fromXml.some((id, index) => id !== fromLog[index])) return null;
+  }
+  // A manifest can be rebound after mixing two complete runs. Match each
+  // failure's content, not only its test name, against the captured log.
+  const xmlDetails = junitFailureDetails(xml);
+  const logDetails = logFailureDetails(log);
+  if (!logDetails || xmlDetails.size !== failureIds.length || logDetails.size !== failureIds.length
+    || [...xmlDetails].some(([id, message]) => !message || logDetails.get(id) !== message)) return null;
+  const loggedFailureIds = parseFailures(log).map(id => {
+    const at = id.indexOf(' > ');
+    return at < 0 ? id : `${relative(id.slice(0, at))}${id.slice(at)}`;
+  });
+  if (failureIds.length !== loggedFailureIds.length
+    || failureIds.some(id => !loggedFailureIds.includes(id))) return null;
+  const passes = lastCount(log, 'pass');
+  const fails = lastCount(log, 'fail');
+  // Bun omits the error counter entirely when it is zero.
+  const errors = lastCount(log, 'error') ?? 0;
+  const ran = runSummaries[0];
+  const ranEnd = ran === undefined ? -1 : ran.index! + ran[0].length;
+  const tail = ranEnd < 0 ? '' : log.slice(ranEnd);
+  const runTail = junitBindings.length === 1
+    ? tail.replace(/\s*\[warm-worker\] junit-sha256=[0-9a-f]{64}\s*$/, '') : tail;
+  // A completed one-file run may only end with Bun's duration line. Any
+  // partial next-run prefix (including a truncated `bun te`) is unmeasured.
+  if (!/^\.?\s*(?:\[[\d.]+(?:ms|s)\])?\s*$/.test(runTail)) return null;
+  // Bun's unhandled errors are absent from testcase JUnit. With no second
+  // diagnostic channel to bind them, a reused worker must treat them as unknown.
+  if (passes === null || fails === null || errors !== 0 || !ran || Number(ran[1]) !== cases.length || Number(ran[2]) !== 1
+    || passes + fails !== cases.length
+    || failureIds.length !== fails || new Set(failureIds).size !== failureIds.length
+    || failureIds.some(id => !id.startsWith(`${file} > `))
+    || (rc === 0 ? fails !== 0 : fails === 0)) return null;
+  return { file, rc, failureIds, errorIds: [], junitComplete: true };
+}

package/scripts/release-loop/import-graph-scc-run.ts

@@ -0,0 +1,54 @@
+// Bind the shared gate selector to the committed-tree SCC report at one exact HEAD.
+import { spawnSync } from 'node:child_process';
+import { selectGateTestFiles } from '../../src/self-implement/gate-cli.js';
+import { gitClosureTree } from './gate-closure.js';
+import { analyzeImportGraphScc, type ImportGraphSccReport } from './import-graph-scc.js';
+
+export type ImportGraphGateResult =
+  | { readonly ok: false; readonly reason: string }
+  | { readonly ok: true; readonly head40: string; readonly base40: string; readonly changedFiles: readonly string[]; readonly report: ImportGraphSccReport };
+
+function git(repo: string, args: readonly string[]): { status: number | null; stdout: string; stderr: string } {
+  // git-spawn-allow: read-only HEAD/cleanliness checks; no checkout or mutation.
+  const result = spawnSync('git', [...args], { cwd: repo, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}
+
+/** Run only from a clean checkout. Selector and closure reader then observe the same committed HEAD. */
+export function reportImportGraphSccForGate(repo: string, base40: string): ImportGraphGateResult {
+  if (!/^[0-9a-f]{40}$/i.test(base40)) return { ok: false, reason: 'base must be a full commit SHA' };
+  const head = git(repo, ['rev-parse', '--verify', 'HEAD']);
+  const head40 = head.stdout.trim();
+  if (head.status !== 0 || !/^[0-9a-f]{40}$/i.test(head40)) return { ok: false, reason: 'HEAD unreadable' };
+  if (git(repo, ['merge-base', '--is-ancestor', base40, head40]).status !== 0) return { ok: false, reason: 'base is not an ancestor of HEAD' };
+  const status = git(repo, ['status', '--porcelain', '--untracked-files=normal']);
+  if (status.status !== 0 || status.stdout.trim()) return { ok: false, reason: 'working tree is not clean' };
+
+  let selection: ReturnType<typeof selectGateTestFiles>;
+  try {
+    selection = selectGateTestFiles(repo, { base: base40, includeImporterTests: true });
+  } catch (error) {
+    return { ok: false, reason: `gate selector failed: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  if (selection.baseRef !== base40) return { ok: false, reason: 'gate selector base mismatch' };
+  const afterHead = git(repo, ['rev-parse', '--verify', 'HEAD']);
+  const afterStatus = git(repo, ['status', '--porcelain', '--untracked-files=normal']);
+  if (afterHead.status !== 0 || afterHead.stdout.trim() !== head40 || afterStatus.status !== 0 || afterStatus.stdout.trim()) {
+    return { ok: false, reason: 'HEAD or working tree changed during gate selection' };
+  }
+  const issues: string[] = [];
+  if (selection.lookupFailed) issues.push(`importer lookup failed: ${selection.lookupFailed}`);
+  if (selection.unrunImporterTotal === null) issues.push('unrun importer count unknown');
+  else if (selection.unrunImporterTotal > 0) issues.push(`unrun importer tests: ${selection.unrunImporterTotal}`);
+  if (selection.routeLookupFailures.length) issues.push(`route lookup failures: ${selection.routeLookupFailures.length}`);
+  if (selection.callerTestsOverflow.length) issues.push(`caller tests overflow: ${selection.callerTestsOverflow.length}`);
+  if (selection.alwaysIncludeMissing.length) issues.push(`always-include missing: ${selection.alwaysIncludeMissing.length}`);
+  if (selection.unverified.length) issues.push(`changed paths unverified: ${selection.unverified.length}`);
+  let report: ImportGraphSccReport;
+  try {
+    report = analyzeImportGraphScc(gitClosureTree(repo, head40), selection.testFiles, { complete: issues.length === 0, issues }, {}, selection.changedFiles);
+  } catch (error) {
+    return { ok: false, reason: `committed closure unreadable: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  return { ok: true, head40, base40, changedFiles: selection.changedFiles, report };
+}

package/scripts/release-loop/import-graph-scc.ts

@@ -0,0 +1,215 @@
+// IMPORT-GRAPH-SCC: report cycles in the static import graph reached by the gate's selected test files.
+// The graph comes from the same committed-tree reader as gate-closure. A cycle report is diagnostic;
+// opaque or absent inputs remain unmeasured and cannot authorize a smaller gate or concurrent train.
+import { isTestPath } from '../../src/self-implement/importer-test-index.js';
+import { buildClosureGraph, type ClosureGraph, type ClosureOptions, type ClosureTree } from './gate-closure.js';
+
+export interface ChangedFileImpact {
+  readonly file: string;
+  /** Definite reverse-dependency reach, including the test file itself. */
+  readonly affectedTests: readonly string[];
+  readonly affectedTestCount: number;
+  /** Tests with an opaque dependency can also be affected; they are never counted as definitely unaffected. */
+  readonly possibleTests: readonly string[];
+  readonly possibleTestCount: number;
+  readonly measured: boolean;
+  readonly issues: readonly string[];
+}
+
+function changedFileImpacts(graph: ClosureGraph, preload: readonly string[], changedFiles: readonly string[]): ChangedFileImpact[] {
+  const tests = [...graph.tracked].filter(isTestPath).sort();
+  const reverse = new Map<string, string[]>();
+  for (const [from, dependencies] of graph.forward) for (const dependency of dependencies) {
+    const importers = reverse.get(dependency) ?? [];
+    importers.push(from);
+    reverse.set(dependency, importers);
+  }
+  const reverseReach = (seeds: readonly string[]): Set<string> => {
+    const seen = new Set(seeds);
+    const queue = [...seeds];
+    for (let at = 0; at < queue.length; at++) for (const importer of reverse.get(queue[at]!) ?? []) {
+      if (seen.has(importer)) continue;
+      seen.add(importer);
+      queue.push(importer);
+    }
+    return seen;
+  };
+  const uncertainTests = reverseReach([...graph.opaque.keys()]);
+  const preloadClosure = new Set<string>();
+  const pending = [...preload];
+  while (pending.length) {
+    const file = pending.pop()!;
+    if (preloadClosure.has(file)) continue;
+    preloadClosure.add(file);
+    pending.push(...(graph.staticImports.get(file) ?? []));
+  }
+  const preloadOpaque = [...preloadClosure].some((file) => graph.opaque.has(file) || !graph.tracked.has(file));
+  return [...new Set(changedFiles)].sort().map((file) => {
+    const issues: string[] = [];
+    if (!graph.tracked.has(file)) issues.push('changed file missing at HEAD');
+    if (preloadOpaque) issues.push('preload closure opaque or missing');
+    const reached = preloadClosure.has(file) ? new Set(tests) : reverseReach([file]);
+    const affectedTests = tests.filter((test) => reached.has(test));
+    const possibleTests = tests.filter((test) => reached.has(test) || uncertainTests.has(test) || preloadOpaque || !graph.tracked.has(file));
+    if (possibleTests.length > affectedTests.length) issues.push('unresolved reach may affect more tests');
+    return { file, affectedTests, affectedTestCount: affectedTests.length, possibleTests,
+      possibleTestCount: possibleTests.length, measured: issues.length === 0, issues };
+  });
+}
+
+export interface ImportCutCandidate {
+  /** Removing these DFS back edges would make this SCC acyclic; the set is deterministic, not minimal. */
+  readonly from: string;
+  readonly to: string;
+  readonly sccSize: number;
+  /** Reverse dependency closure of `from` within the selected-test graph, including literal dynamic imports. */
+  readonly impactedFiles: readonly string[];
+  readonly impactedTests: readonly string[];
+}
+
+export interface ImportGraphSccReport {
+  readonly scope: 'selected-tests-static-imports';
+  readonly measured: boolean;
+  readonly selectedTests: readonly string[];
+  readonly reachableFiles: number;
+  readonly cycleCount: number;
+  readonly largestScc: number;
+  readonly cutCandidateTotal: number;
+  readonly cutCandidates: readonly ImportCutCandidate[];
+  readonly opaqueFiles: readonly string[];
+  readonly missingTests: readonly string[];
+  readonly selectionIssues: readonly string[];
+  readonly unmeasuredCount: number;
+  readonly changedFileImpacts: readonly ChangedFileImpact[];
+}
+
+export interface ImportGraphSelectionStatus {
+  /** True only after #28000 reports a complete lookup, with no overflow or unrunnable test. */
+  readonly complete: boolean;
+  readonly issues: readonly string[];
+}
+
+/** Read-only structural report. Call with #28000's exact selected test paths at the same HEAD. */
+export function analyzeImportGraphScc(
+  tree: ClosureTree,
+  selectedTests: readonly string[],
+  selectionStatus: ImportGraphSelectionStatus,
+  options: ClosureOptions = {},
+  changedFiles: readonly string[] = [],
+): ImportGraphSccReport {
+  const graph = buildClosureGraph(tree, options);
+  const changedFileImpactsReport = changedFileImpacts(graph, tree.preload, changedFiles);
+  const tests = [...new Set(selectedTests)].sort();
+  const missingTests = tests.filter((test) => !graph.staticImports.has(test));
+  const reachable = new Set<string>();
+  const pending = tests.filter((test) => graph.staticImports.has(test));
+  while (pending.length) {
+    const file = pending.pop()!;
+    if (reachable.has(file)) continue;
+    reachable.add(file);
+    pending.push(...(graph.staticImports.get(file) ?? []));
+  }
+  // The SCC is intentionally static, but certainty must follow every dependency the closure reader knows:
+  // a dynamic import can reach an opaque file even when that file is outside the static SCC graph.
+  const closureReachable = new Set<string>();
+  const closurePending = tests.filter((test) => graph.forward.has(test));
+  while (closurePending.length) {
+    const file = closurePending.pop()!;
+    if (closureReachable.has(file)) continue;
+    closureReachable.add(file);
+    closurePending.push(...(graph.forward.get(file) ?? []));
+  }
+  const opaqueFiles = [...closureReachable].filter((file) => graph.opaque.has(file)).sort();
+  // An empty selection does not prove that no test can observe a change.
+  const issues = [...new Set(selectionStatus.issues.length ? selectionStatus.issues
+    : selectionStatus.complete ? [] : ['selection incomplete'])].sort();
+  const measured = tests.length > 0 && missingTests.length === 0 && opaqueFiles.length === 0 && issues.length === 0;
+  const edges = new Map<string, string[]>();
+  const reverse = new Map<string, string[]>();
+  const impactReverse = new Map<string, string[]>();
+  for (const file of closureReachable) for (const next of graph.forward.get(file) ?? []) {
+    if (closureReachable.has(next)) impactReverse.set(next, [...(impactReverse.get(next) ?? []), file]);
+  }
+  for (const file of reachable) {
+    const neighbors = [...(graph.staticImports.get(file) ?? []), ...(graph.selfStaticImports.has(file) ? [file] : [])]
+      .filter((next) => reachable.has(next)).sort();
+    edges.set(file, neighbors);
+    for (const next of neighbors) reverse.set(next, [...(reverse.get(next) ?? []), file]);
+  }
+  for (const importers of reverse.values()) importers.sort();
+
+  // Iterative Kosaraju avoids a JS call-stack limit on a large repository SCC.
+  const visited = new Set<string>();
+  const order: string[] = [];
+  for (const root of [...reachable].sort()) {
+    if (visited.has(root)) continue;
+    const stack: { file: string; exit: boolean }[] = [{ file: root, exit: false }];
+    while (stack.length) {
+      const { file, exit } = stack.pop()!;
+      if (exit) { order.push(file); continue; }
+      if (visited.has(file)) continue;
+      visited.add(file);
+      stack.push({ file, exit: true });
+      for (const next of [...(edges.get(file) ?? [])].reverse()) if (!visited.has(next)) stack.push({ file: next, exit: false });
+    }
+  }
+  const assigned = new Set<string>();
+  const components: string[][] = [];
+  for (const root of order.reverse()) {
+    if (assigned.has(root)) continue;
+    const component: string[] = [];
+    const stack = [root];
+    assigned.add(root);
+    while (stack.length) {
+      const file = stack.pop()!;
+      component.push(file);
+      for (const next of reverse.get(file) ?? []) if (!assigned.has(next)) { assigned.add(next); stack.push(next); }
+    }
+    if (component.length > 1 || graph.selfStaticImports.has(component[0]!)) components.push(component.sort());
+  }
+  components.sort((a, b) => b.length - a.length || a[0]!.localeCompare(b[0]!));
+
+  const cutEdges: { from: string; to: string; sccSize: number }[] = [];
+  for (const component of components) {
+    const members = new Set(component);
+    const seen = new Set<string>();
+    const active = new Set<string>();
+    for (const root of component) {
+      if (seen.has(root)) continue;
+      const stack: { file: string; next: number; neighbors: string[] }[] = [];
+      const enter = (file: string): void => {
+        seen.add(file);
+        active.add(file);
+        stack.push({ file, next: 0, neighbors: (edges.get(file) ?? []).filter((next) => members.has(next)) });
+      };
+      enter(root);
+      while (stack.length) {
+        const frame = stack[stack.length - 1]!;
+        const next = frame.neighbors[frame.next++];
+        if (next === undefined) { active.delete(frame.file); stack.pop(); continue; }
+        if (active.has(next)) cutEdges.push({ from: frame.file, to: next, sccSize: component.length });
+        else if (!seen.has(next)) enter(next);
+      }
+    }
+  }
+  const testSet = new Set(tests);
+  const cutCandidates = cutEdges.slice(0, 10).map(({ from, to, sccSize }) => {
+    const impact = new Set<string>();
+    const stack = [from];
+    while (stack.length) {
+      const file = stack.pop()!;
+      if (impact.has(file)) continue;
+      impact.add(file);
+      stack.push(...(impactReverse.get(file) ?? []));
+    }
+    const impactedFiles = [...impact].sort();
+    return { from, to, sccSize, impactedFiles, impactedTests: impactedFiles.filter((file) => testSet.has(file)) };
+  });
+  return {
+    scope: 'selected-tests-static-imports', measured, selectedTests: tests,
+    reachableFiles: reachable.size, cycleCount: components.length, largestScc: components[0]?.length ?? 0,
+    cutCandidateTotal: cutEdges.length, cutCandidates, opaqueFiles, missingTests,
+    selectionIssues: issues, unmeasuredCount: opaqueFiles.length + missingTests.length + issues.length + (tests.length === 0 ? 1 : 0),
+    changedFileImpacts: changedFileImpactsReport,
+  };
+}

package/scripts/release-loop/node-verdict.ts

@@ -8,6 +8,7 @@ export type NodeOutcome = 'ok' | 'fail' | 'error';
 export type NodeVerdict = 'pass' | 'flaky' | 'fail';
 export interface GraphContext {
   nodeId?: string;
+  runId?: string;
   input: { version: string; previousVersion: string; [key: string]: unknown };
   outputs: Record<string, Record<string, unknown>>;
 }
@@ -22,6 +23,7 @@ export function readGraphContext(env: NodeJS.ProcessEnv = process.env): GraphCon
   if (!input || typeof input.version !== 'string' || !isReleaseVersion(input.version)
     || typeof input.previousVersion !== 'string' || !/^\d+\.\d+\.\d+$/.test(input.previousVersion)) throw new Error('version and previousVersion required');
   return { ...(typeof context.nodeId === 'string' ? { nodeId: context.nodeId } : {}),
+    ...(typeof context.runId === 'string' ? { runId: context.runId } : {}),
     input: input as GraphContext['input'], outputs: context.outputs && typeof context.outputs === 'object' ? context.outputs as GraphContext['outputs'] : {} };
 }