elanous 0.2.31 → 0.2.32

package/src/display/resize-listener.ts

@@ -10,14 +10,31 @@
 // overlays catch up too. Both calls are wrapped in try/catch so a
 // transient paint error doesn't kill the listener.
 //
+// (3) TUI-PICKER-RESIZE-SHRINK (#76 · 2026-10-17) — then ask the
+// coordinator for one FORCED frame. Steps (1)+(2) bypass the
+// coordinator flush, so the prompt chrome repaint in (2) writes the
+// input divider straight over the bottom row of an open overlay (the
+// slash picker's `╰` sits on the divider row) and nothing re-emits the
+// overlay afterwards — the picker lost its bottom border until it was
+// closed and reopened. A coordinator frame runs onRender → afterRender
+// (chrome) → flushOverlay (modals on top), so the overlay lands last.
+// `force` matters: the overlay byte-equality cache would otherwise
+// skip a re-emit whose bytes match the last coordinator frame
+// (e.g. 80 → 120 → 80 with no coordinator flush in between).
+//
 // Non-goals (stay out of IDX-1 territory):
-//   - Do NOT touch coordinator.flushOverlay cache state.
-//   - Do NOT recompute modal bounds (mount-time snapshot preserved).
+//   - Do NOT touch coordinator.flushOverlay cache state directly.
 //   - Do NOT reach into chat.ts textInput loop internals.
 
+import { debug } from '../debug/log.js';
+
 export interface ResizeListenerDeps {
   draw: (opts?: { force?: boolean }) => void;
   promptCtl: { repaint: () => void };
+  /** Request one forced coordinator frame so modal overlays are
+   *  re-emitted on top of the chrome the prompt repaint just wrote.
+   *  Optional: hosts without a coordinator keep the legacy two-step. */
+  requestOverlayFrame?: () => void;
 }
 
 /** Registers the resize listener and returns a dispose fn that
@@ -28,6 +45,20 @@ export function installResizeListener(deps: ResizeListenerDeps): () => void {
   const handler = (): void => {
     try { deps.draw({ force: true }); } catch { /* swallow — paint errors shouldn't break resize */ }
     try { deps.promptCtl.repaint(); } catch { /* swallow */ }
+    let overlayFrame: 'requested' | 'absent' | 'failed' = 'absent';
+    if (deps.requestOverlayFrame) {
+      try {
+        deps.requestOverlayFrame();
+        overlayFrame = 'requested';
+      } catch {
+        overlayFrame = 'failed';
+      }
+    }
+    debug.log('display.resize', 'repaint', {
+      cols: process.stdout.columns ?? null,
+      rows: process.stdout.rows ?? null,
+      overlayFrame,
+    });
   };
   process.stdout.on('resize', handler);
   return (): void => {

package/src/fold-stack.ts

@@ -216,8 +216,9 @@ export class FoldStack {
   /** Toggle the latest-pushed static target whose range contains
    *  `lineIndex`. Returns true when a target was toggled, false
    *  when none contained the line (live targets are never chosen).
-   *  Reuses the single-target splice/cascade path. */
-  toggleAtLine(lineIndex: number): boolean {
+   *  Reuses the single-target splice/cascade path. `logContext` (the
+   *  click's screen frame) is merged into the expanded/recollapsed line. */
+  toggleAtLine(lineIndex: number, logContext: Record<string, unknown> = {}): boolean {
     const t = this.findLatestStaticContaining(lineIndex);
     if (!t) {
       this.logToggleAtLineMiss(lineIndex);
@@ -236,6 +237,7 @@ export class FoldStack {
         lineIndex,
         lineStart,
         lineEnd,
+        ...logContext,
       });
     }
     return toggled;

package/src/git-fs/index.ts

@@ -9,7 +9,7 @@
 // on its own cadence (dashboard throttles to ~2s).
 
 import { resolve } from 'node:path';
-import { spawnSync } from 'node:child_process';
+import { execFile, spawnSync } from 'node:child_process';
 import { findGitDir, type LocatedGit } from './locate.js';
 import { readGitHead } from './read-head.js';
 import { GitFileWatcher } from './watcher.js';
@@ -31,13 +31,62 @@ export { probeDirty, probeAheadBehind, parsePorcelain } from './dirty.js';
 const SNAPSHOT_TIMEOUT_MS = 5_000;
 const SNAPSHOT_STATUS_MAX_CHARS = 2_000;
 const GIT_SNAPSHOT_TTL_MS = 3_000;
+/** A cached snapshot older than this is rebuilt in the background on the next periodic dirty tick. */
+const GIT_SNAPSHOT_KEEP_WARM_MS = 30_000;
 
 interface GitSnapshotCacheEntry {
   at: number;
+  /** Monotonic store ordering — `at` can flip within the same millisecond. */
+  version: number;
   value: string | null;
 }
 
 const gitSnapshotCache = new Map<string, GitSnapshotCacheEntry>();
+/** The entry an invalidation (known write · HEAD move) just evicted. Only the
+ *  stale-while-revalidate turn path reads it, and only while it is younger than
+ *  its window: the turn is served the last snapshot (its header states when it
+ *  was taken) while the background rebuild runs, instead of rebuilding
+ *  synchronously on the event loop. Any later store supersedes it. */
+const gitSnapshotLastKnown = new Map<string, GitSnapshotCacheEntry>();
+
+function storeGitSnapshot(key: string, entry: Omit<GitSnapshotCacheEntry, 'version'>): void {
+  gitSnapshotCache.set(key, { ...entry, version: bumpGitSnapshotVersion(key) });
+  gitSnapshotLastKnown.delete(key);
+}
+
+function evictGitSnapshot(key: string): boolean {
+  const entry = gitSnapshotCache.get(key);
+  if (!entry) return false;
+  gitSnapshotCache.delete(key);
+  gitSnapshotLastKnown.set(key, entry);
+  return true;
+}
+/** One background snapshot rebuild per cwd and invalidation generation. */
+const gitSnapshotInFlight = new Map<string, { generation: string; promise: Promise<string | null> }>();
+
+/** Per-key monotonic store version: async rebuilds never overwrite a newer
+ *  sync value, not even when both land in the same millisecond (`at`
+ *  comparisons can flip). Generation guards invalidation races instead. */
+const gitSnapshotVersion = new Map<string, number>();
+
+function gitSnapshotVersionOf(key: string): number {
+  return gitSnapshotVersion.get(key) ?? 0;
+}
+
+function bumpGitSnapshotVersion(key: string): number {
+  const version = gitSnapshotVersionOf(key) + 1;
+  gitSnapshotVersion.set(key, version);
+  return version;
+}
+
+/** Test-only hold seam (production null): parks an async rebuild after its
+ *  reads and before its store, so «a write during a rebuild wins» is provable
+ *  deterministically instead of by racing timers. */
+let gitSnapshotRebuildHold: (() => void | Promise<void>) | null = null;
+
+export function __setGitSnapshotRebuildHoldForTest(hold: (() => void | Promise<void>) | null): void {
+  gitSnapshotRebuildHold = hold;
+}
 
 interface CacheEntry {
   located: LocatedGit;
@@ -97,8 +146,15 @@ function ensureEntry(cwd: string): CacheEntry | null {
   // Re-read HEAD + retarget watcher whenever a watched file changes.
   // One handler covers all listeners so we don't race each subscriber.
   watcher.subscribe(() => {
+    const before = entry.head;
     entry.head = readGitHead(entry.located);
     entry.watcher.retargetForHead(entry.head);
+    // A branch/ref move makes every cached snapshot's branch + log lines wrong. Only a real
+    // move: macOS fs.watch also replays the ref write that happened just before the watch was
+    // installed (measured: refs/heads/main «change» right after the first build), and that
+    // spurious event must not evict a fresh snapshot.
+    if (headMoved(before, entry.head)) invalidateAllGitSnapshots();
+    else debug.log('git-fs.snapshot', 'watch-event-head-unchanged', { root: entry.located.root });
     for (const fn of entry.listeners) {
       try { fn(); } catch { /* noop */ }
     }
@@ -179,8 +235,8 @@ function viewOf(entry: CacheEntry): GitStatusView {
 /** Non-blocking twin of `refreshDirty` for the TUI: the probes run as
  *  async subprocesses so a slow `git status` (large worktree, loaded
  *  host) never stalls key input. Same throttle; concurrent calls share
- *  one probe, except that `force` (a known write just happened) never
- *  reuses a probe that started before it. */
+ *  one probe. `force` also marks cached LLM snapshots stale and rebuilds
+ *  them in the background — a known write happened. */
 export function refreshDirtyAsync(
   cwd: string,
   opts: { minIntervalMs?: number; force?: boolean } = {},
@@ -188,26 +244,40 @@ export function refreshDirtyAsync(
   let entry: CacheEntry | null;
   try { entry = ensureEntry(cwd); } catch (error) { return Promise.reject(error); }
   if (!entry) return Promise.resolve({ head: null, dirty: null, aheadBehind: null, lastDirtyProbeAt: 0 });
-  // An in-flight probe (possibly a forced, post-write one) is newer than the last stored view.
+  // An in-flight probe (possibly a forced, post-write one) is newer than the last stored view —
+  // a throttled call joins it instead of returning the pre-write view (#27493 contract).
   const running = dirtyInFlight.get(entry);
   if (running && !opts.force) return running;
   const min = opts.minIntervalMs ?? 2_000;
   if (!opts.force && entry.lastDirtyProbeAt > 0 && Date.now() - entry.lastDirtyProbeAt < min) {
     return Promise.resolve(viewOf(entry));
   }
-  const target = entry;
-  const root = target.located.root;
+  const probe = probeDirtyAsyncFor(entry, { fresh: !!opts.force });
+  // After the post-write probe is queued, so the snapshot rebuild joins it instead of an older one.
+  if (opts.force) invalidateGitSnapshots(cwd);
+  // Keep-warm: the dashboard's periodic (non-forced) dirty tick also re-warms a snapshot that is in
+  // use, so a turn typed after an idle stretch is served within the stale window instead of falling
+  // back to the synchronous build. Only snapshots already cached are kept warm.
+  else if (gitSnapshotCache.has(resolve(cwd)) || gitSnapshotLastKnown.has(resolve(cwd))) void refreshGitSnapshotAsync(cwd, { ifOlderThanMs: GIT_SNAPSHOT_KEEP_WARM_MS });
+  return probe;
+}
+
+/** Share the in-flight probe, unless the caller needs one that started after
+ *  now (`fresh`: a known write just happened) — then queue a new probe behind it. */
+function probeDirtyAsyncFor(entry: CacheEntry, opts: { fresh: boolean }): Promise<GitStatusView> {
+  const running = dirtyInFlight.get(entry);
+  if (running && !opts.fresh) return running;
+  const root = entry.located.root;
   const start = (): Promise<GitStatusView> => Promise.all([probeDirtyAsync(root), probeAheadBehindAsync(root)])
     .then(([dirty, aheadBehind]) => {
-      target.dirty = dirty;
-      target.aheadBehind = aheadBehind;
-      target.lastDirtyProbeAt = Date.now();
-      return viewOf(target);
+      entry.dirty = dirty;
+      entry.aheadBehind = aheadBehind;
+      entry.lastDirtyProbeAt = Date.now();
+      return viewOf(entry);
     });
-  // A forced probe queues behind the running one so it reads the post-write tree.
   const probe = (running ? running.then(start, start) : start())
-    .finally(() => { if (dirtyInFlight.get(target) === probe) dirtyInFlight.delete(target); });
-  dirtyInFlight.set(target, probe);
+    .finally(() => { if (dirtyInFlight.get(entry) === probe) dirtyInFlight.delete(entry); });
+  dirtyInFlight.set(entry, probe);
   return probe;
 }
 
@@ -217,7 +287,7 @@ export function refreshDirtyAsync(
  *  fresh state after mutations. Returns null outside a git repo. */
 export function buildGitSnapshot(
   cwd: string,
-  opts: { now?: () => number; ttlMs?: number } = {},
+  opts: { now?: () => number; ttlMs?: number; staleWhileRevalidateMs?: number } = {},
 ): string | null {
   const now = opts.now ?? Date.now;
   const ttlMs = opts.ttlMs ?? GIT_SNAPSHOT_TTL_MS;
@@ -228,41 +298,157 @@ export function buildGitSnapshot(
     debug.log('git-fs.snapshot', 'cache-hit', { cwd, ageMs: at - cached.at });
     return cached.value;
   }
+  // Stale-while-revalidate (TUI turn path): serve the recent snapshot now
+  // and rebuild it off the event loop for the next turn.
+  if (cached && opts.staleWhileRevalidateMs !== undefined && at - cached.at < opts.staleWhileRevalidateMs) {
+    debug.log('git-fs.snapshot', 'stale-hit', { cwd, ageMs: at - cached.at });
+    void refreshGitSnapshotAsync(cwd);
+    return cached.value;
+  }
+  // Invalidated (known write · HEAD move) and the background rebuild has not
+  // stored yet: serve the evicted snapshot rather than a synchronous rebuild —
+  // the TYPING-LAG this path exists to remove. Bounded by the same window.
+  const evicted = !cached ? gitSnapshotLastKnown.get(key) : undefined;
+  if (evicted && opts.staleWhileRevalidateMs !== undefined && at - evicted.at < opts.staleWhileRevalidateMs) {
+    debug.log('git-fs.snapshot', 'stale-after-invalidate', { cwd, ageMs: at - evicted.at, rebuilding: gitSnapshotInFlight.has(key) });
+    void refreshGitSnapshotAsync(cwd);
+    return evicted.value;
+  }
 
   const view = refreshDirty(cwd, { force: true });
   let value: string | null = null;
   if (view.head) {
-    const branch = view.head.branch ?? `HEAD@${view.head.sha?.slice(0, 7) ?? 'unknown'}`;
-    const mainBranch = detectDefaultBranch(cwd);
-    const status = runGit(cwd, ['status', '--short']);
-    const recentLog = runGit(cwd, ['log', '--oneline', '-n', '5']);
-    const userName = runGit(cwd, ['config', 'user.name']);
-    const truncatedStatus = status.length > SNAPSHOT_STATUS_MAX_CHARS
-      ? `${status.slice(0, SNAPSHOT_STATUS_MAX_CHARS)}\n... (truncated; run git status for more)`
-      : status;
-
-    const parts = [
-      'This is the git status at the start of this turn. It is a snapshot and will not update during the turn.',
-      `Current branch: ${branch}${view.head.isWorktree ? ' (worktree)' : ''}`,
-      mainBranch ? `Main branch: ${mainBranch}` : '',
-      userName ? `Git user: ${userName}` : '',
-      view.aheadBehind
-        ? `Upstream: ahead ${view.aheadBehind.ahead}, behind ${view.aheadBehind.behind}`
-        : '',
-      `Status:\n${truncatedStatus || '(clean)'}`,
-      `Recent commits:\n${recentLog || '(none)'}`,
-    ].filter(Boolean);
-    value = parts.join('\n\n');
+    value = composeGitSnapshot(view, {
+      mainBranch: detectDefaultBranch(cwd),
+      status: runGit(cwd, ['status', '--short']),
+      recentLog: runGit(cwd, ['log', '--oneline', '-n', '5']),
+      userName: runGit(cwd, ['config', 'user.name']),
+      generatedAt: at,
+    });
   }
 
-  gitSnapshotCache.set(key, { at, value });
+  storeGitSnapshot(key, { at, value });
   debug.log('git-fs.snapshot', 'built', { cwd, ageMs: 0 });
   return value;
 }
 
+function composeGitSnapshot(
+  view: GitStatusView,
+  git: { mainBranch: string | null; status: string; recentLog: string; userName: string; generatedAt: number },
+): string {
+  const head = view.head!;
+  const branch = head.branch ?? `HEAD@${head.sha?.slice(0, 7) ?? 'unknown'}`;
+  const truncatedStatus = git.status.length > SNAPSHOT_STATUS_MAX_CHARS
+    ? `${git.status.slice(0, SNAPSHOT_STATUS_MAX_CHARS)}\n... (truncated; run git status for more)`
+    : git.status;
+  const parts = [
+    `This is the git status as of ${new Date(git.generatedAt).toISOString()}. It is a snapshot and will not update during the turn.`,
+    `Current branch: ${branch}${head.isWorktree ? ' (worktree)' : ''}`,
+    git.mainBranch ? `Main branch: ${git.mainBranch}` : '',
+    git.userName ? `Git user: ${git.userName}` : '',
+    view.aheadBehind
+      ? `Upstream: ahead ${view.aheadBehind.ahead}, behind ${view.aheadBehind.behind}`
+      : '',
+    `Status:\n${truncatedStatus || '(clean)'}`,
+    `Recent commits:\n${git.recentLog || '(none)'}`,
+  ].filter(Boolean);
+  return parts.join('\n\n');
+}
+
+/** Rebuild the snapshot for `cwd` with async subprocesses and store it.
+ *  Concurrent calls share one rebuild. Never throws. `ifOlderThanMs` turns it
+ *  into a keep-warm tick: a cached snapshot younger than that is left alone. */
+export function refreshGitSnapshotAsync(cwd: string, opts: { ifOlderThanMs?: number } = {}): Promise<string | null> {
+  const key = resolve(cwd);
+  const cached = gitSnapshotCache.get(key);
+  if (cached && opts.ifOlderThanMs !== undefined && Date.now() - cached.at < opts.ifOlderThanMs) {
+    return Promise.resolve(cached.value);
+  }
+  const generation = snapshotGeneration(key);
+  const running = gitSnapshotInFlight.get(key);
+  if (running && running.generation === generation) return running.promise;
+  const startedAt = Date.now();
+  const startVersion = gitSnapshotVersionOf(key);
+  const rebuild = (async (): Promise<string | null> => {
+    const entry = ensureEntry(cwd);
+    // Joins the in-flight probe; callers that need a post-write/post-move probe queue a fresh one first.
+    const view = entry ? await probeDirtyAsyncFor(entry, { fresh: false }) : getGitStatusView(cwd);
+    let value: string | null = null;
+    if (view.head) {
+      const [mainBranch, status, recentLog, userName] = await Promise.all([
+        detectDefaultBranchAsync(cwd),
+        runGitAsync(cwd, ['status', '--short']),
+        runGitAsync(cwd, ['log', '--oneline', '-n', '5']),
+        runGitAsync(cwd, ['config', 'user.name']),
+      ]);
+      // «as of» = when the reads finished, not when the rebuild was queued.
+      value = composeGitSnapshot(view, { mainBranch, status, recentLog, userName, generatedAt: Date.now() });
+    }
+    // Test-only hold seam: reads are done, the store decision is next.
+    if (gitSnapshotRebuildHold) await gitSnapshotRebuildHold();
+    // An invalidation that landed mid-rebuild wins: keep the entry stale.
+    // A newer entry (e.g. a synchronous build that overlapped this rebuild) is
+    // kept — ordered by monotonic version, never by `at` (same-ms flips).
+    const current = gitSnapshotCache.get(key);
+    if (snapshotGeneration(key) === generation && !(current && current.version > startVersion)) {
+      storeGitSnapshot(key, { at: startedAt, value });
+    }
+    debug.log('git-fs.snapshot', 'rebuilt-async', { cwd, ms: Date.now() - startedAt });
+    return value;
+  })()
+    .catch(() => null)
+    .finally(() => { if (gitSnapshotInFlight.get(key)?.promise === rebuild) gitSnapshotInFlight.delete(key); });
+  gitSnapshotInFlight.set(key, { generation, promise: rebuild });
+  return rebuild;
+}
+
+/** Invalidation generations: a rebuild only stores its result when no
+ *  invalidation (per cwd or global) landed while it was running. */
+const gitSnapshotGeneration = new Map<string, number>();
+let allGitSnapshotsGeneration = 0;
+
+function snapshotGeneration(key: string): string {
+  return `${allGitSnapshotsGeneration}:${gitSnapshotGeneration.get(key) ?? 0}`;
+}
+
+function invalidateAllGitSnapshots(): void {
+  // Snapshots that were in use (cached or being rebuilt) are re-warmed for the next turn.
+  const inUse = new Set([...gitSnapshotCache.keys(), ...gitSnapshotInFlight.keys()]);
+  for (const key of [...gitSnapshotCache.keys()]) evictGitSnapshot(key);
+  allGitSnapshotsGeneration += 1;
+  // Probes already running read the old ref's upstream — queue one fresh probe per repo behind
+  // them, so the rebuilds below join it instead.
+  const entries = new Set<CacheEntry>();
+  for (const key of inUse) {
+    const entry = ensureEntry(key);
+    if (entry) entries.add(entry);
+  }
+  for (const entry of entries) void probeDirtyAsyncFor(entry, { fresh: true });
+  for (const key of inUse) void refreshGitSnapshotAsync(key);
+}
+
+/** A known write happened: the cached snapshot must not be served again.
+ *  When a snapshot was in use (cached or being rebuilt), rebuild it in the
+ *  background so the next turn usually still hits. */
+function invalidateGitSnapshots(cwd: string): void {
+  const key = resolve(cwd);
+  const wasCached = evictGitSnapshot(key);
+  const wasRebuilding = gitSnapshotInFlight.has(key);
+  gitSnapshotGeneration.set(key, (gitSnapshotGeneration.get(key) ?? 0) + 1);
+  // An in-flight rebuild of the old generation will be discarded — schedule its replacement.
+  if (wasCached || wasRebuilding) void refreshGitSnapshotAsync(cwd);
+}
+
+function headMoved(before: GitHeadInfo | null | undefined, after: GitHeadInfo | null | undefined): boolean {
+  if (!before || !after) return before !== after;
+  return before.branch !== after.branch || before.sha !== after.sha || before.detached !== after.detached;
+}
+
 /** Explicitly discard cached git snapshots, including cached non-repositories. */
 export function clearGitSnapshotCache(): void {
   gitSnapshotCache.clear();
+  gitSnapshotLastKnown.clear();
+  allGitSnapshotsGeneration += 1;
 }
 
 function detectDefaultBranch(cwd: string): string | null {
@@ -281,6 +467,34 @@ function detectDefaultBranch(cwd: string): string | null {
   return null;
 }
 
+async function detectDefaultBranchAsync(cwd: string): Promise<string | null> {
+  const symbolic = await runGitAsync(cwd, ['symbolic-ref', 'refs/remotes/origin/HEAD']);
+  if (symbolic.startsWith('refs/remotes/origin/')) {
+    return symbolic.slice('refs/remotes/origin/'.length).trim() || null;
+  }
+  for (const candidate of ['main', 'master', 'develop']) {
+    if (await gitSucceeds(cwd, ['show-ref', '--verify', '--quiet', `refs/heads/${candidate}`])) return candidate;
+  }
+  return null;
+}
+
+function gitSucceeds(cwd: string, args: string[]): Promise<boolean> {
+  return new Promise((resolveOk) => {
+    try { execFile('git', args, { cwd, timeout: SNAPSHOT_TIMEOUT_MS }, (error) => resolveOk(!error)); }
+    catch { resolveOk(false); }
+  });
+}
+
+function runGitAsync(cwd: string, args: string[]): Promise<string> {
+  return new Promise((resolveOut) => {
+    try {
+      execFile('git', args, { cwd, encoding: 'utf8', timeout: SNAPSHOT_TIMEOUT_MS, maxBuffer: 2 * 1024 * 1024 }, (error, stdout) => {
+        resolveOut(error ? '' : String(stdout ?? '').trim());
+      });
+    } catch { resolveOut(''); }
+  });
+}
+
 function runGit(cwd: string, args: string[]): string {
   const res = spawnSync('git', args, {
     cwd,
@@ -292,10 +506,23 @@ function runGit(cwd: string, args: string[]): string {
   return String(res.stdout ?? '').trim();
 }
 
+/** Test helper — the cached snapshot for `cwd` without building one. */
+export function __peekGitSnapshot(cwd: string): string | null | undefined {
+  return gitSnapshotCache.get(resolve(cwd))?.value;
+}
+
+/** Test helper — what a HEAD move does to cached snapshots. */
+export function __invalidateAllGitSnapshotsForTest(): void {
+  invalidateAllGitSnapshots();
+}
+
 /** Test helper — drop the cache + dispose every watcher. */
 export function __resetGitFsCache(): void {
   for (const [, entry] of cache) entry.watcher.dispose();
   cache.clear();
   clearGitSnapshotCache();
+  gitSnapshotInFlight.clear();
   dirtyInFlight.clear();
+  gitSnapshotGeneration.clear();
+  gitSnapshotVersion.clear();
 }

package/src/harness/gate-reserve.ts

@@ -0,0 +1,87 @@
+import { execFile } from 'node:child_process';
+import { promises as fs } from 'node:fs';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+import type { QueueSeat } from './harness-queue.js';
+
+/** Shadow calculation only: reserve one of the configured per-seat gate slots while the release gate runs. */
+export function gateReserve({ releaseGateActive, seat, configuredGateCap }: {
+  releaseGateActive: boolean; seat: QueueSeat; configuredGateCap: number;
+}): { active: boolean; wouldCap: number } {
+  void seat;
+  return { active: releaseGateActive, wouldCap: releaseGateActive ? Math.max(0, configuredGateCap - 1) : configuredGateCap };
+}
+
+const execFileAsync = promisify(execFile);
+const MAX_LEDGER_READS = 32;
+const MAX_PROBE_MS = 1_500;
+
+/** Read-only, bounded process and graph-run probe; unavailable or incomplete observation is inactive. */
+export async function detectReleaseGateActive(deps: {
+  processes?: () => string | Promise<string>;
+  runsRoot?: string;
+  read?: (path: string) => string | Promise<string>;
+  list?: (path: string) => string[] | Promise<string[]>;
+  modifiedAt?: (path: string) => number | Promise<number>;
+  /** Test seam for the shared probe deadline; production defaults to 1.5 seconds. */
+  timeoutMs?: number;
+} = {}): Promise<boolean> {
+  const controller = new AbortController();
+  const timeoutMs = deps.timeoutMs ?? MAX_PROBE_MS;
+  const deadline = Date.now() + timeoutMs;
+  let timeoutId: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_, reject) => {
+    timeoutId = setTimeout(() => {
+      controller.abort();
+      reject(new Error('release gate observation timed out'));
+    }, timeoutMs);
+  });
+  const bounded = <T>(operation: T | Promise<T>): Promise<T> => Promise.race([Promise.resolve(operation), timeout]);
+  try {
+    const argv = await bounded((deps.processes ?? (async () => {
+      const result = await execFileAsync('ps', ['-eo', 'pid=,args='],
+        { encoding: 'utf8', timeout: 1_000, maxBuffer: 4 * 1024 * 1024, signal: controller.signal });
+      return result.stdout;
+    }))());
+    if (Date.now() >= deadline) return false;
+    const pids = new Set(argv.split('\n').flatMap((line) => {
+      const match = /^\s*(\d+)\s+(.+)$/.exec(line);
+      // Same release run/resume argv fingerprint as RAIL-SAFE, bound here to the graph-run owner's PID.
+      return match && /(?:^|\s)(?:\S*\/)?elanous\.mjs\s+(?:(?:--test(?:=\S+)?|--config-dir\s+\S+)\s+)*release\s+(?:run|resume)(?=\s|$)/.test(match[2]!)
+        ? [Number(match[1])] : [];
+    }));
+    if (!pids.size) return false;
+    const dir = join(deps.runsRoot ?? releaseLedgerRoot(), 'graph-runs', 'release-loop');
+    let files: string[];
+    try { files = await bounded(deps.list ? deps.list(dir) : fs.readdir(dir)); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false; throw error; }
+    // Inspect metadata for every ledger before choosing the newest: directory order is not recency.
+    // A slow or huge directory expires the common deadline, then fails open without scanning further.
+    const candidates = files.filter((file) => /^[A-Za-z0-9][A-Za-z0-9._-]*\.json$/.test(file));
+    const modifiedAt = deps.modifiedAt ?? (async (path: string) => (await fs.stat(path)).mtimeMs);
+    const recent: { file: string; at: number }[] = [];
+    for (let offset = 0; offset < candidates.length && Date.now() < deadline; offset += 32) {
+      const batch = candidates.slice(offset, offset + 32);
+      const times = await bounded(Promise.all(batch.map(async (file) => {
+        try { return await modifiedAt(join(dir, file)); } catch { return -1; }
+      })));
+      for (let i = 0; i < batch.length; i++) if (times[i]! >= 0) recent.push({ file: batch[i]!, at: times[i]! });
+    }
+    recent.sort((a, b) => b.at - a.at);
+    for (const { file } of recent.slice(0, MAX_LEDGER_READS)) {
+      if (Date.now() >= deadline) return false;
+      let run: {
+        pid?: number; status?: string; currentNode?: { nodeId: string }; path?: string[]; nodes?: { nodeId: string; ok: boolean }[];
+      };
+      try { run = JSON.parse(await bounded((deps.read ?? ((path: string) => fs.readFile(path,
+        { encoding: 'utf8', signal: controller.signal })))(join(dir, file)))) as typeof run; }
+      catch { continue; }
+      if (run?.status === 'running' && run.pid && pids.has(run.pid)
+        && run.currentNode?.nodeId === 'gate' && run.path?.at(-1) === 'gate'
+        && Array.isArray(run.nodes) && run.path.length === run.nodes.length + 1) return true;
+    }
+    return false;
+  } catch { return false; }
+  finally { clearTimeout(timeoutId); controller.abort(); }
+}

package/src/harness/harness-incidents.ts

@@ -180,6 +180,19 @@ export function detectBursts(rows: readonly RunExit[], { windowMs = 60_000, thre
   return bursts.sort((a, b) => Date.parse(a.firstAt) - Date.parse(b.firstAt) || a.reason.localeCompare(b.reason));
 }
 
+/** Common-cause candidates: same hostname+reason exits within a 60-minute window, across seats and entrances; hostless rows stay unobserved. */
+export function detectCommonCauseBursts(rows: readonly RunExit[]): IncidentBurst[] {
+  const unique = uniqueRunExits(rows).filter((row) => row.hostname);
+  const bursts: IncidentBurst[] = [];
+  for (const group of groupRunExits(unique, (row) => JSON.stringify([row.reason, row.hostname]))) {
+    const hostname = group[0]!.hostname;
+    for (const members of burstMemberWindows(group, HOSTNAME_BURST_WINDOW_MS, 3)) {
+      bursts.push(burstFromMembers(members, { ...(hostname ? { hostname } : {}) }));
+    }
+  }
+  return bursts.sort((a, b) => Date.parse(a.firstAt) - Date.parse(b.firstAt) || a.reason.localeCompare(b.reason));
+}
+
 export function recentBurst(root: string, now: Date | number, { lookbackMs = 15 * 60_000, seat, entrance }: {
   lookbackMs?: number; seat?: string; entrance?: string;
 } = {}): IncidentBurst | null {

package/src/harness/harness-queue.ts

@@ -21,6 +21,7 @@ import { hostLeaseCounts, leaseHasPendingPod } from '../pod-lease/host-lease.js'
 import { leaseKubectl, measurePoolLease } from '../task-orchestrator/surfaces/pod-lease.js';
 import { parsePodPool, podPoolHostLease, resolvePodPoolSpec } from '../task-orchestrator/surfaces/pod-pool.js';
 import { writeHarnessQueueReceipt } from './harness-queue-child.js';
+import { detectReleaseGateActive, gateReserve } from './gate-reserve.js';
 import { adviseLaunch, compareLaunchAdvice, type LaunchAdvice } from './launch-advice.js';
 import { finishAdvice, measureFinish, recordFinishHistory, type FinishMetrics } from '../loops/orchestrator/finish-rate.js';
 import { collectDraftMetrics, DRAFT_NEEDS_OWNER_SEAT_CAP, shouldHoldSeatNewLaunch, type DraftMetrics } from '../self-dev/draft-sweep.js';
@@ -85,6 +86,8 @@ export interface HarnessQueueDeps {
   pool?: () => QueuePool;
   /** Shadow-only advice seam; exceptions must not affect the queue decision. */
   advice?: typeof adviseLaunch;
+  /** Gate-reserve observation only; never changes seatCapDetails or decideSpawn inputs. */
+  releaseGateActive?: () => boolean | Promise<boolean>;
   launch?: (item: QueueItem, args: string[], root: string) => Promise<number>;
   /** Test seam: runs after a direct CLI call enqueued its row and before that call's own tick (race tests). */
   afterEnqueue?: (item: QueueItem) => void | Promise<void>;
@@ -1495,6 +1498,10 @@ async function tickHarnessQueueOnce(deps: HarnessQueueDeps, requestedId: string
       }
       return waiting();
     }
+    // Shadow measurement runs outside the approval path. One async probe serves all candidates in this tick.
+    const gateActivePromise = !childUniverses?.unreadable.length
+      ? Promise.resolve().then(() => (deps.releaseGateActive ?? detectReleaseGateActive)()).catch(() => false)
+      : undefined;
     // NEEDS-OWNER-CENSUS: one draft census per tick, shared by every candidate. A full census pages all
     // open drafts, the 48h closed cohort, and one claim-comment gh call per open draft — re-running it
     // per candidate multiplied those calls by the seat count and raced the rate limit the seat-loop tick
@@ -1516,6 +1523,14 @@ async function tickHarnessQueueOnce(deps: HarnessQueueDeps, requestedId: string
       const injectedCap = deps.cap?.(item.seat);
       const details = seatCapDetails({ seat: item.seat, caps, gate, injectedCap });
       const active = seatActive(item.seat);
+      // An unreadable child universe makes the running count incomplete; do not emit a misleading cap sample.
+      if (gateActivePromise) void gateActivePromise.then((gateActive) => {
+        try {
+          const reserve = gateReserve({ releaseGateActive: gateActive === true, seat: item.seat, configuredGateCap: gate?.[item.seat] ?? 4 });
+          debug.log('harness.queue', 'gate-reserve-shadow', { seat: item.seat, active: reserve.active, wouldCap: reserve.wouldCap,
+            cap: details.cap, running: active });
+        } catch { /* Shadow observation cannot affect the decision. */ }
+      });
       if (active >= details.cap) { blocked.set(item.seat, { reason: seatLine(item.seat, active, details), active }); continue; }
       if (!pool && !poolReason) {
         try { pool = (deps.pool ?? readHarnessQueuePool)(); }