elanous 0.2.29 → 0.2.32

package/scripts/release-loop/prepare-node.ts

@@ -1,19 +1,117 @@
 #!/usr/bin/env bun
-import { existsSync } from 'node:fs';
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
 import { errorResult, finishNode, lastResult, nodeOutput, readGraphContext, runCommand, type CommandRunner } from './node-verdict.js';
+import { isReleaseVersion } from './release-version.js';
 
-export function runPrepare(run: CommandRunner = runCommand) {
+/** Apparent bytes of the preserved archive; never follow a symlink out of its private directory. */
+function archiveBytes(path: string): number {
+  const entry = lstatSync(path);
+  if (!entry.isDirectory()) return entry.size;
+  return readdirSync(path).reduce((sum, name) => sum + archiveBytes(join(path, name)), 0);
+}
+
+function readRegularManifest(path: string): Buffer {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    if (!fstatSync(fd).isFile()) throw new Error(`prepared manifest is not a regular file: ${path}`);
+    return readFileSync(fd);
+  } finally { closeSync(fd); }
+}
+
+export function runPrepare(run: CommandRunner = runCommand, move: typeof renameSync = renameSync) {
   const context = readGraphContext();
   const { version, previousVersion } = context.input;
+  if (!isReleaseVersion(version)) throw new Error(`invalid release version: ${version}`);
   const commit = nodeOutput(context, 'version-release', 'commit');
   for (const node of ['gate', 'pwa']) if (context.outputs[node]?.outcome !== 'ok') throw new Error(`${node} did not pass`);
-  const out = join(effectiveInstanceRoot(), 'release', version, 'prepared');
-  if (existsSync(out)) throw new Error(`prepare output already exists: ${out}`);
+  const root = effectiveInstanceRoot();
+  const out = join(root, 'release', version, 'prepared');
+  if ([join(root, 'release'), join(root, 'release', version)]
+    .some((path) => lstatSync(path, { throwIfNoEntry: false })?.isSymbolicLink()))
+    throw new Error(`prepare output escapes release root: ${out}`);
+  let staleSource: string | undefined;
+  let staleManifestBytes: Buffer | undefined;
+  let staleParents: Array<{ path: string; dev: number; ino: number; real: string }> | undefined;
+  const occupied = lstatSync(out, { throwIfNoEntry: false });
+  if (occupied) {
+    // Only a tip refresh can prove that this archive belongs to the prior commit. An incomplete or unknown
+    // archive is left untouched for investigation; never erase it merely because the path is occupied.
+    const old = context.outputs['version-release']?.refreshedFrom;
+    const manifestPath = join(out, 'release.json');
+    if (typeof old !== 'string' || !/^[0-9a-f]{40}$/i.test(old) || old === commit
+      || !occupied.isDirectory() || !existsSync(manifestPath) || !lstatSync(manifestPath).isFile())
+      throw new Error(`prepare output already exists with unverified source: ${out}`);
+    if (realpathSync(out) !== join(realpathSync(root), 'release', version, 'prepared'))
+      throw new Error(`prepare output escapes release root: ${out}`);
+    let manifest: { version?: unknown; sourceCommit?: unknown };
+    try { staleManifestBytes = readRegularManifest(manifestPath); manifest = JSON.parse(staleManifestBytes.toString('utf8')) as typeof manifest; }
+    catch { throw new Error(`prepare output already exists with unreadable manifest: ${out}`); }
+    if (manifest.version !== version || manifest.sourceCommit !== old)
+      throw new Error(`prepare output already exists for another source: ${out}`);
+    staleParents = [join(root, 'release'), join(root, 'release', version)].map((path) => {
+      const stat = lstatSync(path);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error(`prepare output escapes release root: ${out}`);
+      return { path, dev: stat.dev, ino: stat.ino, real: realpathSync(path) };
+    });
+    staleSource = old;
+  }
   const ref = `v${previousVersion}^{commit}`;
   const prev = run('git', ['rev-parse', '--verify', ref]);
   if (prev.status !== 0 || !/^[0-9a-f]{40}\s*$/i.test(prev.stdout)) throw new Error(`previous release ref unavailable: ${ref}`);
+  if (staleSource) {
+    const current = lstatSync(out, { throwIfNoEntry: false });
+    const manifestPath = join(out, 'release.json');
+    if (!current?.isDirectory() || current.dev !== occupied?.dev || current.ino !== occupied?.ino
+      || !lstatSync(manifestPath, { throwIfNoEntry: false })?.isFile()
+      || [join(root, 'release'), join(root, 'release', version)]
+        .some((path) => lstatSync(path, { throwIfNoEntry: false })?.isSymbolicLink()))
+      throw new Error(`prepared output changed before cleanup: ${out}`);
+    if (realpathSync(out) !== join(realpathSync(root), 'release', version, 'prepared'))
+      throw new Error(`prepare output escapes release root: ${out}`);
+    let manifestBytes: Buffer;
+    try { manifestBytes = readRegularManifest(manifestPath); }
+    catch { throw new Error(`prepared manifest changed before cleanup: ${out}`); }
+    if (!staleManifestBytes?.equals(manifestBytes))
+      throw new Error(`prepared manifest changed before cleanup: ${out}`);
+    // Rename is atomic on this filesystem. Preserve the moved inode even if it differs from the checked one;
+    // no later operation deletes a quarantine directory or follows a link inside the archive.
+    const quarantine = mkdtempSync(join(realpathSync(root), '.prepared-cleanup-'));
+    const moved = join(quarantine, 'prepared');
+    move(out, moved);
+    const movedStat = lstatSync(moved);
+    let movedManifestBytes: Buffer | undefined;
+    try { movedManifestBytes = readRegularManifest(join(moved, 'release.json')); }
+    catch { /* preserve the quarantined archive for inspection */ }
+    if (!movedStat.isDirectory() || movedStat.dev !== occupied?.dev || movedStat.ino !== occupied?.ino
+      || !staleManifestBytes || !movedManifestBytes?.equals(staleManifestBytes))
+      throw new Error(`prepared output changed during cleanup; preserved at ${moved}`);
+    const receipt = join(quarantine, 'receipt.json');
+    const record = { version, old: staleSource, commit, from: out, to: moved, movedAt: new Date().toISOString(),
+      bytes: null as number | null, sizeStatus: 'pending' as 'pending' | 'measured' | 'unmeasured', sizeError: undefined as string | undefined };
+    try { writeFileSync(receipt, JSON.stringify(record, null, 2) + '\n', { flag: 'wx', mode: 0o600 }); }
+    catch (error) { throw new Error(`prepared archive preserved at ${moved}; receipt write failed: ${String(error)}`); }
+    try { record.bytes = archiveBytes(moved); record.sizeStatus = 'measured'; }
+    catch (error) { record.sizeStatus = 'unmeasured'; record.sizeError = String(error).slice(0, 200); }
+    const receiptNext = join(quarantine, 'receipt.next.json');
+    try {
+      writeFileSync(receiptNext, JSON.stringify(record, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+      renameSync(receiptNext, receipt);
+    } catch (error) { throw new Error(`prepared archive preserved at ${moved}; receipt update failed: ${String(error)}`); }
+    debug.log('release-loop.prepare', 'stale-prepared-quarantined', { version, old: staleSource, commit,
+      from: out, to: moved, bytes: record.bytes, sizeStatus: record.sizeStatus, receipt });
+    const parentsStable = staleParents?.every(({ path, dev, ino, real }) => {
+      try {
+        const stat = lstatSync(path);
+        return stat.isDirectory() && !stat.isSymbolicLink() && stat.dev === dev && stat.ino === ino
+          && realpathSync(path) === real;
+      } catch { return false; }
+    });
+    if (!parentsStable || lstatSync(out, { throwIfNoEntry: false }))
+      throw new Error(`prepare parent changed after quarantine; preserved at ${moved}`);
+  }
   const command = run('bun', ['bin/elanous.mjs', 'release', 'prepare', '--version', version, '--source', commit, '--notes-from', prev.stdout.trim(), '--out', out, '--json']);
   if (command.stderr) process.stderr.write(command.stderr);
   const manifest = lastResult(command)?.manifest as { version?: string; sourceCommit?: string; distDir?: string } | undefined;

package/scripts/release-loop/probe-pod-host-dirs-live.ts

@@ -0,0 +1,113 @@
+#!/usr/bin/env bun
+// Run on a host with kubectl access. Each arm launches a real k3d Job; no test seam replaces kubectl.
+import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { runPodCommand } from '../../src/task-orchestrator/surfaces/pod-command-job';
+import { PodPoolScheduler, type PodPoolMember } from '../../src/task-orchestrator/surfaces/pod-pool';
+import { prepareHostDirsOnce, resetHostDirsPrepMemo } from '../../src/task-orchestrator/surfaces/pod-install-slots';
+
+type Probe = { arm: 'node-prepared' | 'init-fallback'; job: string; exitCode: number; prep: Record<string, unknown> | null;
+  hostPaths: string[]; initContainers: string[]; node: string; childWritable: boolean; artifactsError: string | null };
+
+function option(name: string, fallback?: string): string {
+  const index = process.argv.indexOf(`--${name}`);
+  const value = index < 0 ? fallback : process.argv[index + 1];
+  if (!value || value.startsWith('--')) throw new Error(`--${name} required`);
+  return value;
+}
+
+async function main(): Promise<void> {
+  const context = option('context');
+  const host = option('host');
+  const cluster = option('cluster', 'elanous-pool');
+  const image = option('image');
+  const namespace = option('namespace', 'elanous-test');
+  const cacheBase = option('cache', '/var/lib/elanous/gate-probe-cache');
+  const slotsBase = option('slots', '/var/lib/elanous/gate-probe-slots');
+  for (const path of [cacheBase, slotsBase]) {
+    if (!/^\/[A-Za-z0-9._/-]+$/.test(path) || path.split('/').includes('..')) throw new Error(`unsafe host path: ${path}`);
+  }
+  const member: PodPoolMember = { context, sshHost: host, k3dCluster: cluster, capacity: 1 };
+  const kubectl = (args: readonly string[], input?: string) => {
+    const run = spawnSync('kubectl', args, { input, encoding: 'utf8', timeout: 30_000, maxBuffer: 4 * 1024 * 1024 });
+    return { status: run.status ?? 1, stdout: run.stdout ?? '', stderr: run.stderr ?? String(run.error ?? '') };
+  };
+  const check = kubectl(['--context', context, '-n', namespace, 'get', 'namespace', namespace]);
+  if (check.status !== 0) throw new Error(`cluster/namespace unreadable: ${check.stderr.trim()}`);
+  const artifactRoot = mkdtempSync(join(tmpdir(), 'gate-host-dirs-live-'));
+  const nonce = `${Date.now().toString(36)}-${process.pid}`;
+  const sourceCommit = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: resolve(import.meta.dir, '../..'), encoding: 'utf8', maxBuffer: SPAWN_SYNC_MAX_BUFFER }).stdout?.trim() || null;
+  const results: Probe[] = [];
+  try {
+    for (const arm of ['node-prepared', 'init-fallback'] as const) {
+      const name = `gate-host-dirs-${arm}-${Date.now().toString(36)}`;
+      // Distinct absent paths: the fallback arm cannot pass merely because the first arm already chowned its dirs.
+      const cache = join(cacheBase, `${arm}-${nonce}`);
+      const slots = join(slotsBase, `${arm}-${nonce}`);
+      let prep: Record<string, unknown> | null = null;
+      let completed = false;
+      try {
+        const result = await runPodCommand({
+          command: ['sh', '-c', 'printf cache-ok > /bun-cache/.host-dir-probe && printf slots-ok > /gate-install-slots/.host-dir-probe && test "$(cat /bun-cache/.host-dir-probe)" = cache-ok && test "$(cat /gate-install-slots/.host-dir-probe)" = slots-ok && rm /bun-cache/.host-dir-probe /gate-install-slots/.host-dir-probe && echo HOST_DIRS_WRITTEN'],
+          name,
+          namespace, image, imageCommit: null, deadlineSeconds: 120, pollMs: 1_000, statusUnreadableMs: 30_000,
+          memoryLimit: '2Gi',
+          bunCache: cache, installSlots: slots, env: { NODE_ENV: 'test' }, configHostMirror: () => undefined,
+          poolScheduler: new PodPoolScheduler([member]), artifactsRoot: artifactRoot,
+          // The exact image was selected by the operator. This probe does not build or sync it.
+          syncImages: async () => new Map([[context, { ok: true, action: 'fresh' as const, detail: 'operator-selected image', ms: 0 }]]),
+          prepareHostDirs: arm === 'node-prepared'
+            ? async (args) => prepareHostDirsOnce(args)
+            : async () => ({ host, ok: false, ms: 0, detail: 'forced init fallback probe' }),
+          kubectl,
+          log: (_category, event, data) => { if (event === 'host-dirs-prep') prep = data; },
+        });
+        const job = kubectl(['--context', context, '-n', namespace, 'get', 'job', result.job, '-o', 'json']);
+        if (job.status !== 0) throw new Error(`applied Job unreadable: ${job.stderr.trim()}`);
+        const applied = JSON.parse(job.stdout) as { spec?: { template?: { spec?: {
+          initContainers?: Array<{ name: string }>;
+          containers?: Array<{ name: string; volumeMounts?: Array<{ name: string; mountPath: string }> }>;
+          volumes?: Array<{ name: string; hostPath?: { path: string } }>;
+        } } } };
+        const podSpec = applied.spec?.template?.spec;
+        const childMounts = podSpec?.containers?.find((item) => item.name === 'child')?.volumeMounts ?? [];
+        const mountedPath = (name: string, mountPath: string): string | null => {
+          if (!childMounts.some((mount) => mount.name === name && mount.mountPath === mountPath)) return null;
+          return podSpec?.volumes?.find((volume) => volume.name === name)?.hostPath?.path ?? null;
+        };
+        const appliedCache = mountedPath('bun-cache', '/bun-cache');
+        const appliedSlots = mountedPath('install-slots', '/gate-install-slots');
+        if (appliedCache !== cache || appliedSlots !== slots) {
+          throw new Error(`applied Job hostPath mismatch: cache=${appliedCache} slots=${appliedSlots}`);
+        }
+        const pod = kubectl(['--context', context, '-n', namespace, 'get', 'pod', '-l', `job-name=${result.job}`, '-o', 'jsonpath={.items[0].spec.nodeName}']);
+        const child = readFileSync(join(result.artifactsDir, 'child.log'), 'utf8');
+        results.push({ arm, job: result.job, exitCode: result.exitCode, prep, hostPaths: [appliedCache, appliedSlots],
+          initContainers: applied.spec?.template?.spec?.initContainers?.map((item) => item.name) ?? [],
+          node: pod.status === 0 ? pod.stdout.trim() : '',
+          childWritable: child.includes('HOST_DIRS_WRITTEN'), artifactsError: result.artifacts?.error ?? null });
+        completed = true;
+      } finally {
+        if (completed) {
+          const deleted = kubectl(['--context', context, '-n', namespace, 'delete', 'job', name, '--ignore-not-found']);
+          if (deleted.status !== 0) throw new Error(`probe Job cleanup failed: ${name}: ${deleted.stderr.trim()}`);
+        } else console.error(`probe incomplete; retained Job for triage: ${name}`);
+      }
+    }
+    const [warm, fallback] = results;
+    const ok = warm?.prep?.ok === true && warm.initContainers.length === 0 && warm.exitCode === 0 && warm.childWritable && warm.artifactsError === null &&
+      fallback?.prep?.ok === false && fallback.initContainers.includes('host-dirs') && fallback.exitCode === 0 && fallback.childWritable && fallback.artifactsError === null &&
+      Boolean(warm.node && fallback.node);
+    console.log(JSON.stringify({ verdict: ok ? 'pass' : 'fail', measuredAt: new Date().toISOString(), sourceCommit,
+      context, namespace, image, results }));
+    if (!ok) process.exitCode = 1;
+  } finally {
+    resetHostDirsPrepMemo();
+    rmSync(artifactRoot, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) main().catch((error) => { console.error(String(error)); process.exitCode = 2; });

package/scripts/release-loop/resume-release.ts

@@ -7,6 +7,7 @@ import { join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
 import { lastJsonObject, runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
 import { changedFilesBetween, clearPartialPlan, planPartialRegate, writePartialPlan } from './gate-partial.js';
@@ -104,9 +105,12 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   }
   // A new tip invalidates everything built from the old one (gate verdict, prepared archive, …): restart no later
   // than the first node that consumed the commit, so each of them runs again on the new tip.
-  const firstConsumer = state.path.indexOf('gate');
+  // The public export now consumes the cut before the gate. Old saved graphs still have export-check after gate,
+  // so use the earliest consumer in this run's recorded path rather than assuming either graph version.
+  const consumers = ['export-check', 'gate'].map((node) => state.path.indexOf(node)).filter((index) => index >= 0);
+  const firstConsumer = consumers.length ? Math.min(...consumers) : -1;
   if (restartAt >= 0 && firstConsumer >= 0 && restartAt > firstConsumer) {
-    throw new Error(`${branch} moved (${recorded.slice(0, 12)} → ${to.slice(0, 12)}): resume at gate or earlier — later nodes were built from the old tip`);
+    throw new Error(`${branch} moved (${recorded.slice(0, 12)} → ${to.slice(0, 12)}): resume at ${state.path[firstConsumer]} or earlier — later nodes were built from the old tip`);
   }
   const stamp = (deps.now?.() ?? new Date()).toISOString().replace(/[:.]/g, '-');
   const backup = `${statePath}.before-tip-${stamp}-${process.pid}-${to.slice(0, 12)}.bak`;
@@ -135,14 +139,20 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
   clearPartialPlan(root, tip.version);
   const auto = opts.partial === undefined;
+  // The current graph checks public export before gate. A moved tip must resume there, so its gate still needs
+  // the diff plan; in older saved graphs export-check followed gate and cannot consume one.
+  const saved = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;
+  const fromIndex = saved.path.indexOf(opts.from);
+  const gateIndex = saved.path.indexOf('gate');
+  const reachesGate = (opts.from === 'gate' || opts.from === 'export-check') && fromIndex >= 0 && gateIndex >= fromIndex;
   // The default applies only where it can help: a gate re-run on a tip that moved. An unchanged tip re-uses its own
   // shard results by commit already.
-  if (opts.partial === false || (auto && (opts.from !== 'gate' || !tip.changed))) return { requested: false };
+  if (opts.partial === false || (auto && (!reachesGate || !tip.changed))) return { requested: false };
   const fallback = (reason: string): PartialOutcome => {
     debug.log('release-loop.resume', 'partial-fallback', { version: tip.version, reason, auto });
     return { requested: true, applied: false, reason, ...(auto ? { auto: true as const } : {}) };
   };
-  if (opts.from !== 'gate') return fallback('--partial only applies to --from gate');
+  if (!reachesGate) return fallback('--partial requires a restart that reaches gate');
   if (!tip.changed) return fallback('release branch tip unchanged — nothing new to re-check');
   let prior: { commit?: unknown; failures?: unknown; errors?: unknown } | undefined;
   for (const location of [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])]) {
@@ -178,6 +188,19 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     closure: (changedCode) => testsReachingChanged(tree, changedCode, tests, { cliEntries: CLI_ENTRIES }) });
   if (!planned.ok) return fallback(planned.reason);
   if (planned.plan.files.length >= tests.length) return fallback(`every test is re-run (${tests.length}) — full gate`);
+  if (planned.plan.kind === 'carry') {
+    // A cut-failures file can exist even when a later gate check errored. Reuse only a completed, clean verdict.
+    const verdicts = [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])].map((location) => join(location, 'release', tip.version, 'gate-verdict.json'));
+    let clean = false;
+    for (const verdictPath of verdicts) {
+      if (!existsSync(verdictPath)) continue;
+      try {
+        const verdict = JSON.parse(readFileSync(verdictPath, 'utf8')) as { commit?: unknown; outcome?: unknown };
+        if (verdict.commit === tip.from && verdict.outcome === 'ok') { clean = true; break; }
+      } catch { return fallback(`unreadable prior gate verdict: ${verdictPath}`); }
+    }
+    if (!clean) return fallback(`no clean gate verdict for ${tip.from.slice(0, 12)} — full gate`);
+  }
   const path = writePartialPlan(root, planned.plan);
   debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
     tests: tests.length, auto, path, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
@@ -195,6 +218,12 @@ function savedGraphPath(statePath: string): string | undefined {
 
 /** Refresh the branch tip, then restart the failed run at `from` with the saved graph snapshot. */
 export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+  // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.root` must not
+  // move this run onto a separate lock inode from the steward resync and the unattended release.
+  return withOpSeatFlock(() => resumeReleaseRunLocked(opts, deps));
+}
+
+async function resumeReleaseRunLocked(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
   // RELEASE-LEDGER-UNIVERSE: decide the universe once; the run lookup and every resumed node use it.
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };

package/scripts/release-loop/resume.ts

@@ -35,7 +35,8 @@ const SWEEP_INCOMPLETE = /^(?:pod sweep incomplete|sweep incomplete|[\w-]+ shard
  * Fail-closed: only three shapes count, each read from what the runner and gate-node actually write:
  *  ① stopped — `graph runs stop` wrote {ok:false, executed:false, exit:null, error:STOPPED_NODE_ERROR} as the run's last record;
  *  ② no verdict — the gate process ended with exit null (signal, idle timeout, or a spawn that failed) and printed no result line at
- *     all (no output line is a JSON object with an `outcome`), so the run went gate → failed. A verdict followed by more
+ *     all (no output line is a JSON object with an `outcome`), so the run went gate → failed (possibly through the
+ *     release-only gate-triage shadow). A verdict followed by more
  *     log lines and then a kill is still a verdict: refused;
  *  ③ sweep incomplete — gate-node printed outcome `error` (no verdict: the baseline comparison never ran, so `introduced`
  *     is still the empty initial list) and the error is an incomplete sweep (stalled shards / no tests ran). The finished
@@ -52,6 +53,14 @@ function printedVerdict(output: unknown): boolean {
   });
 }
 
+/** The only post-gate detour allowed before the terminal failure is the executed, release-only triage shadow. */
+function failedAfterGate(state: GraphRunState, index: number): boolean {
+  if (state.nodes.length !== state.path.length || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed') return false;
+  if (index === state.path.length - 2) return true;
+  return index === state.path.length - 3 && state.path[index + 1] === 'gate-triage'
+    && state.nodes[index + 1]?.nodeId === 'gate-triage' && state.nodes[index + 1]?.executed === true;
+}
+
 export function gateUnmeasuredDetail(state: GraphRunState, index: number): string | undefined {
   const record = state.nodes[index];
   if (!record || record.nodeId !== 'gate' || state.path[index] !== 'gate' || record.ok !== false || record.waiver !== undefined) return undefined;
@@ -60,9 +69,7 @@ export function gateUnmeasuredDetail(state: GraphRunState, index: number): strin
   if (last && record.executed === false && record.exit === null && record.error === STOPPED_NODE_ERROR && record.output === undefined) {
     return `stopped: ${STOPPED_NODE_ERROR}${typeof record.seconds === 'number' ? ` after ${record.seconds}s` : ''}`;
   }
-  const failedAfter = index === state.path.length - 2 && state.path.at(-1) === 'failed' && state.nodes.at(-1)?.nodeId === 'failed'
-    && state.nodes.length === state.path.length;
-  if (!failedAfter || record.executed !== true) return undefined;
+  if (!failedAfterGate(state, index) || record.executed !== true) return undefined;
   const result = lastJsonObject(record.output);
   if (result === undefined) {
     if (record.exit !== null || printedVerdict(record.output)) return undefined;
@@ -105,7 +112,8 @@ export function releaseResumeWaiver(
       [...(opts.acceptedRegressions ?? []), { id: `waive:${opts.waive}`, note: reason }]) };
   }
   if (!unique || state.path.lastIndexOf(opts.waive) !== index || state.nodes[index]?.nodeId !== opts.waive || state.nodes[index]?.ok !== false ||
-    state.nodes[index]?.executed !== true || state.path.at(-2) !== opts.waive || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed') {
+    state.nodes[index]?.executed !== true || (opts.waive === 'gate' ? !failedAfterGate(state, index)
+      : state.path.at(-2) !== opts.waive || state.path.at(-1) !== 'failed' || state.nodes.at(-1)?.nodeId !== 'failed')) {
     throw new Error(`--waive ${opts.waive} requires the failed executable node on the saved path`);
   }
   // Only user-visible, non-publication checks can become accepted regressions; build, safety and approval gates stay blocking.

package/scripts/release-loop/spawn-lane.ts

@@ -1,4 +1,6 @@
 import { planShards } from './shard-plan';
+import { isGateSpawnLaneFile } from '../../src/self-dev/spawn-lane-files.js';
+export { GATE_SPAWN_LANE_FILES, isGateSpawnLaneFile } from '../../src/self-dev/spawn-lane-files.js';
 
 /**
  * Gate tests that exercise a real process or PTY. Keep them in their own Pod
@@ -9,27 +11,8 @@ import { planShards } from './shard-plan';
  * real child. Add a file only after checking its test body, not merely because
  * its name mentions a process.
  */
-export const GATE_SPAWN_LANE_FILES = [
-  'scripts/lib/tui-runshell-group-e2e.test.ts',
-  'scripts/lib/tui-streaming-e2e.test.ts',
-  'src/agent-mission/doc-guided-install.test.ts',
-  'src/dashboard/first-screen-band-wiring.test.ts',
-  'src/git-fs/spawn-discipline.test.ts',
-  'src/self-implement/run-ledger.test.ts',
-  'src/video-pipeline/recipes/reframe.test.ts',
-  'test/ch5730-watch-delivery.test.ts',
-  'test/cli-dev-command.test.ts',
-  'test/preview-terminal.test.ts',
-] as const;
-
-const SPAWN_FILES = new Set<string>(GATE_SPAWN_LANE_FILES);
-
 export const GATE_SPAWN_LANE_SHARDS = 3;
 
-export function isGateSpawnLaneFile(file: string): boolean {
-  return SPAWN_FILES.has(file);
-}
-
 /** Every assigned test file is returned exactly once, including a partial gate. */
 export function partitionGateSpawnLane(files: readonly string[]): { regular: string[]; spawn: string[] } {
   const regular: string[] = [];

package/scripts/release-loop/tui-sim-node.ts

@@ -12,6 +12,7 @@
  * Exit: 0 = pass or flaky · 1 = fail · 2 = could not run (not macOS, worktree).
  */
 import { spawn, spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 import { copyFileSync, existsSync, mkdtempSync, openSync, symlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
@@ -101,7 +102,7 @@ async function main(): Promise<number> {
   let regress: TuiRegress = { unmeasured: 'worktree를 만들지 못했다' };
   let worktreeReady = false;
   try {
-    const add = spawnSync('git', ['worktree', 'add', '--detach', worktree, commit], { cwd: repo, encoding: 'utf8' });
+    const add = spawnSync('git', ['worktree', 'add', '--detach', worktree, commit], { cwd: repo, encoding: 'utf8', maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     if (add.status !== 0) throw new Error(`worktree add failed: ${(add.stderr ?? '').trim()}`);
     worktreeReady = true;
     symlinkSync(join(repo, 'node_modules'), join(worktree, 'node_modules'));
@@ -119,7 +120,7 @@ async function main(): Promise<number> {
     attempts = [];
   } finally {
     if (worktreeReady) regress = measureTuiRegress(worktree);
-    spawnSync('git', ['worktree', 'remove', '--force', worktree], { cwd: repo });
+    spawnSync('git', ['worktree', 'remove', '--force', worktree], { cwd: repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   }
 
   const out = tuiNodeOutput(commit, attempts, regress, failure);

package/scripts/release-loop/unattended-release.ts

@@ -9,6 +9,7 @@ import { getSchedule } from '../../src/release-loop/release-schedule.js';
 import { isLandingFreezeRefusal, readLandingFreeze, LandingFrozenError } from '../../src/release-loop/landing-freeze.js';
 import { debug } from '../../src/debug/log.js';
 import { runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { baseVersion, isStableVersion, nextPrereleaseVersion, type PrereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
@@ -27,6 +28,10 @@ export interface ReleaseLoopConfig {
   gatePodInstallSlots?: number;
   /** GATE-MEM-ADMIT — seconds a gate shard waits for pool admission (memory headroom) before launching anyway with `admission-timeout` (default 300 · 0 = off). */
   gatePodAdmissionWaitSeconds?: number;
+  /** Maximum simultaneous file-level isolation retries across all gate shards (default 4). */
+  gatePodIsolationConcurrency?: number;
+  /** Final isolated recheck files per window; overflow continues in later windows (default 32). */
+  gateRecheckFileLimit?: number;
   /** GATE-SPEED A3①: gate shard Pod CPU — `2` (request = limit) or `{ request, limit }`. Omitted = request 1 / limit 4. */
   gatePodCpu?: number | string | { request?: number | string; limit?: number | string };
   gateRemote?: string;
@@ -135,6 +140,17 @@ export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDep
 export async function runUnattendedRelease(
   opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps = {},
+): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
+  // A dry run only builds the input and mutates nothing, so it neither creates nor waits on the OP-seat lock.
+  if (opts.dryRun) return runUnattendedReleaseLocked(opts, deps);
+  // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.ledgerRoot` must
+  // not move this run onto a separate lock inode from the steward resync and a manual resume.
+  return withOpSeatFlock(() => runUnattendedReleaseLocked(opts, deps));
+}
+
+async function runUnattendedReleaseLocked(
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  deps: UnattendedReleaseDeps,
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
   // landing freeze. A freeze stays the emergency switch: when one is on, it still stops the run (`--force-freeze` overrides).

package/scripts/test-deterministic.ts

@@ -39,44 +39,15 @@ import * as ts from 'typescript';
 // importing THIS file used to spawn the suite at load time. The runner is now
 // behind `import.meta.main` / `runDeterministicTests()`, but the filter stays
 // in the helper so an untested credential check cannot rot silently.
-import { isCredentialKey } from './lib/deterministic-env.js';
-import { envLiteral } from '../src/platform/env-literal.js';
+import { GIT_LOCATION_ENV_KEYS, prepareIsolatedTestEnv } from './lib/deterministic-env.js';
 
 export const TEMP_ROOT_PREFIX = 'elanous-deterministic-test-';
 export const CHILD_EXIT_GRACE_MS = 2_000;
 
-// A deterministic test child is not a harness executor: these inherited
-// markers would activate write-boundary policy against each test's temp files.
-const HARNESS_TEST_ENV_KEYS = [
-  'ELANOUS_HARNESS_SPACE',
-  'ELANOUS_HARNESS_SPACE_ID',
-  'ELANOUS_HARNESS_BOUNDARY',
-  'ELANOUS_HARNESS_ROLE',
-  'ELANOUS_HARNESS_DETACHED',
-] as const;
-
-// Discovery: rg -n "process\.env\.ELANOUS_(HOST|RUN|ORIGIN|SUPERVISOR|PARENT)" src
-// These are ambient execution identities, not inputs to a deterministic test.
-// debug.log also attributes SUBSTRATE and ARM_ID to every plain-object record.
-export const GIT_LOCATION_ENV_KEYS = [
-  'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE',
-  'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES',
-] as const;
-
-const EXECUTION_ORIGIN_ENV_KEYS = [
-  'ELANOUS_HOST_ID',
-  'ELANOUS_RUN_ID',
-  'ELANOUS_RUN_CONTEXT',
-  'ELANOUS_PARENT_RUN_ID',
-  'ELANOUS_PARENT_PTY_ID',
-  'ELANOUS_PARENT_SELF_DEV_RUNS_DIR',
-  'ELANOUS_SUBSTRATE',
-  'ELANOUS_ARM_ID',
-  // Parent account selection changes CLI rotation assertions in the child.
-  'ELANOUS_CODEX_ACCOUNT',
-  // A parent's derived-root label must not reclassify a test's explicit state dir.
-  'ELANOUS_STATE_DIR_SOURCE',
-] as const;
+// Key lists and the isolated child env live in the side-effect-free `lib/deterministic-env.ts` (R7 · 10-16):
+// the host regate runner needs the same env, and importing this file would pull `typescript`/Bun stream types into
+// graphs (the PWA tsc program) that must not see them.
+export { GIT_LOCATION_ENV_KEYS, prepareIsolatedTestEnv } from './lib/deterministic-env.js';
 
 export type ShutdownSignal = 'SIGINT' | 'SIGTERM';
 
@@ -297,33 +268,6 @@ function gitConfig(cwd: string, args: string[]): string | undefined {
   return args.includes('--get-all') ? result.stdout : result.stdout.trim();
 }
 
-export function prepareIsolatedTestEnv(sourceEnv: NodeJS.ProcessEnv, testRoot: string): NodeJS.ProcessEnv {
-  const env = Object.fromEntries(
-    Object.entries(sourceEnv).filter(([key]) => !isCredentialKey(key)
-      && !HARNESS_TEST_ENV_KEYS.includes(key as typeof HARNESS_TEST_ENV_KEYS[number])
-      && !EXECUTION_ORIGIN_ENV_KEYS.includes(key as typeof EXECUTION_ORIGIN_ENV_KEYS[number])
-      && !GIT_LOCATION_ENV_KEYS.includes(key as typeof GIT_LOCATION_ENV_KEYS[number])),
-  );
-  env.HOME = testRoot;
-  // userConfigPath() warns whenever XDG_CONFIG_HOME is set, including when
-  // config.json is absent. Use its non-XDG path; migrateLegacyXdgUserConfig()
-  // resolves the old path through ELANOUS_TEST_HOME rather than the real home.
-  delete env.XDG_CONFIG_HOME;
-  env.ELANOUS_TEST_HOME = testRoot;
-  // HOME and ELANOUS_STATE_DIR isolate both the state and default config roots.
-  // ELANOUS_CONFIG_DIR is not a config-dir override; discard an inherited value
-  // rather than passing an ignored variable that appears to provide isolation.
-  env.ELANOUS_STATE_DIR = join(testRoot, 'state');
-  delete env.ELANOUS_CONFIG_DIR;
-  // All ambient execution identities are removed by EXECUTION_ORIGIN_ENV_KEYS
-  // above, before the child is spawned; logger API-shape tests need their absence.
-  // ⚠️ No `ELANOUS_TEST_DETERMINISTIC` marker is exported. Nothing reads it yet,
-  // and an env var with no consumer is a surface that looks like a contract
-  // while guaranteeing nothing — a later test could branch on it believing it
-  // means something. The tier work in PLAN-test-suite-diet introduces the
-  // signal together with the code that honours it.
-  return envLiteral(env);
-}
 
 /** Read every stderr line, retaining only Bun's verdict signals. A long test
  * log must not become a second in-memory copy of the full output. */

package/scripts/train-reach-grouping.ts

@@ -0,0 +1,48 @@
+#!/usr/bin/env bun
+import { existsSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { buildTrainReachDecision, type TrainReachInput } from '../src/self-implement/train-reach-grouping.js';
+import { buildTrainScenarioDecision, readTrainTestPopulation, type TrainRiskEvidence } from '../src/self-implement/train-scenario-layers.js';
+
+type ScenarioInput = TrainReachInput & { riskEvidence?: TrainRiskEvidence };
+
+function option(name: string): string {
+  const index = process.argv.indexOf(name);
+  const value = process.argv[index + 1];
+  if (index < 0 || !value || value.startsWith('--') || !isAbsolute(value)) throw new Error(`${name} requires an absolute path`);
+  return value;
+}
+
+let temporary = '';
+let outputPath = '';
+let protectsInput = false;
+try {
+  if (process.argv.length !== 6) throw new Error('usage: train-reach-grouping.ts --input <absolute> --output <absolute>');
+  const inputPath = option('--input');
+  outputPath = option('--output');
+  if (!existsSync(inputPath)) throw new Error('input file missing');
+  protectsInput = resolve(inputPath) === resolve(outputPath)
+    || (existsSync(outputPath) && realpathSync(inputPath) === realpathSync(outputPath));
+  if (protectsInput) throw new Error('input and output paths must differ');
+  const input = JSON.parse(readFileSync(inputPath, 'utf8')) as ScenarioInput;
+  const reach = buildTrainReachDecision(input);
+  const scenario = input.riskEvidence === undefined ? undefined : (() => {
+    if (input.prs.length === 0) throw new Error('scenario has no PR tree for pinned population');
+    const baseTests = readTrainTestPopulation(input.prs[0]!.tree, input.baseSha);
+    const headTests = input.prs.map((candidate) => new Set(readTrainTestPopulation(candidate.tree, candidate.headSha)));
+    const survivingTests = baseTests.filter((test) => headTests.every((present) => present.has(test)));
+    return buildTrainScenarioDecision(input, reach, survivingTests, input.riskEvidence!);
+  })();
+  const result = scenario ? { ...reach, scenario, parallelSafe: scenario.parallelSafe } : reach;
+  temporary = `${outputPath}.tmp-${process.pid}`;
+  writeFileSync(temporary, JSON.stringify(result, null, 2) + '\n', { flag: 'wx' });
+  renameSync(temporary, outputPath);
+  temporary = '';
+  if (!result.parallelSafe) process.exitCode = 2;
+} catch (error) {
+  if (outputPath && !protectsInput) rmSync(outputPath, { force: true }); // never reuse a previous decision after failure
+  console.error(`train reach unmeasured: ${error instanceof Error ? error.message : String(error)}`);
+  process.exitCode = 2;
+} finally {
+  if (temporary) rmSync(temporary, { force: true });
+}