elanous 0.2.32 → 0.2.35

package/scripts/release-loop/gate-node.ts

@@ -1,10 +1,10 @@
 #!/usr/bin/env bun
 import { spawn, spawnSync } from 'node:child_process';
-import { appendFileSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { appendFileSync, chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { hostname, tmpdir } from 'node:os';
 import { createHash, randomUUID } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
-import { debug } from '../../src/debug/log.js';
+import { debug, redactSecretText } from '../../src/debug/log.js';
 import { registerStandaloneLogSink } from '../../src/domains/standalone-log-sink.js';
 import { landingFreezeMessage, readLandingFreeze } from '../../src/release-loop/landing-freeze.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
@@ -13,7 +13,12 @@ import { diffFailures, junitFailures, parseFailures, parseTimedOutFailures } fro
 import { loadEnvKnownFailures, splitKnownEnv } from './env-known-failures';
 import { loadGateBatchSafe } from './gate-batch-safe';
 import { baselineFromCutLogs } from './baseline-from-logs';
-import { mergePartialFailures, readPartialPlan, testFileOfId, verifyDocsOnlyCarry } from './gate-partial';
+import { mergePartialFailures, readPartialPlanResult, testFileOfId, verifyDocsOnlyCarry } from './gate-partial';
+import { planGateRadiusShadow, shadowActual, writeGateRadiusShadow, type GateRadiusShadowPlan } from './gate-radius-shadow';
+import { planHardRehearsalRadius, partialGateImagesMatch, preflightGateImageDigest } from './gate-radius-live';
+import { actualGatePodImageDigest, gateBaselineReceipt, gateEnvFingerprint, gateGraphPins, gateSourcePins,
+  POD_SWEEP_INTEGRATION_ONLY } from './gate-baseline-receipt';
+export { POD_SWEEP_INTEGRATION_ONLY } from './gate-baseline-receipt';
 import { logPlanWalltime, planDurations, readFileMemory } from './shard-plan';
 import { defaultGateHostMirrorReaders, resolveGateHostMirror, type GateHostMirror, type GateHostMirrorReaders } from './gate-host-mirror';
 import { isGateSpawnLaneFile, planGateSpawnSeparatedShards } from './spawn-lane';
@@ -28,19 +33,61 @@ import { POD_BUN_CACHE_HOST_PATH, parseInstallSeconds, podBunCacheVolume } from
 import { PodPoolScheduler, parsePodPool, checkPodPool, defaultRemoteRun, type PodPoolMember } from '../../src/task-orchestrator/surfaces/pod-pool.js';
 import { POD_INSTALL_SLOTS_DEFAULT, POD_INSTALL_SLOTS_HOST_PATH, installSlotScript } from '../../src/task-orchestrator/surfaces/pod-install-slots.js';
 import { gateDepsInstallScript, parseGateDeps } from '../../src/task-orchestrator/surfaces/pod-gate-deps.js';
-import { writeWarmJobManifest } from './gate-warm-artifacts.js';
+import { warmReferenceFromJobArtifacts, writeWarmJobManifest } from './gate-warm-artifacts.js';
+import { assessWarmWorkerShadow, parseWarmWorkerReply, type WarmWorkerCommand, type WarmWorkerFileResult, type WarmWorkerKey } from '../../src/task-orchestrator/surfaces/pod-warm-worker-protocol.js';
+import type { WarmPodTransportResult } from '../../src/task-orchestrator/surfaces/pod-warm-worker-pod.js';
+import { requestWarmPodReplay, finalizeWarmPodReplay, quarantineWarmPodReplay, type WarmReplayResult } from '../../src/task-orchestrator/surfaces/pod-warm-worker-provider.js';
+import { resolveWarmPoolProfile } from '../../src/self-implement/pod-warm-pool-profile.js';
+import { decideWarmReuse, type WarmReuseSwitchConfig, type WarmReuseEvidence } from '../../src/task-orchestrator/surfaces/pod-warm-switch.js';
+import { getUserConfig } from '../../src/user-config.js';
 import { gateShardsPath, recordGateShardsVerdict, writeGateShards, type GateShard } from '../../src/release-loop/gate-shards.js';
 import { defaultKubectl } from '../../src/task-orchestrator/surfaces/self-implement-pod.js';
 import { executeTuiNodeCheck, type ExecutedTuiCheck } from './tui-node-checks.js';
+import { runWithReleaseGateTraffic } from './gate-traffic-mode.js';
 import { emitPodLifecycle, gatePodLifecycleEvent, gatePodOutcome } from '../../src/task-orchestrator/surfaces/pod-lifecycle-stages.js';
 import { gateHostReservationRoot, reserveReleaseGateHosts } from '../../src/release-loop/gate-host-reservation.js';
 import { normRoot } from '../../src/instance/resolve.js';
 
+export interface WarmShadowObservation {
+  files: string[];
+  attemptId: string;
+  reason: string;
+  status: 'observed' | 'fallback' | 'unmeasured';
+  quarantined: 'yes' | 'no' | 'failed' | 'unavailable';
+  finalized?: boolean;
+  /** Exact producer identity; absent on an old verdict means the sample cannot enable reuse. */
+  cutSha?: string;
+  baselineSha?: string;
+  workerKey?: WarmWorkerKey;
+}
+
+/** A provider may fill only lease identity; it cannot rewrite the Job attempt being compared. */
+export function warmCommandMatchesRequest(command: WarmWorkerCommand, request: Omit<WarmWorkerCommand, 'leaseId' | 'generation' | 'workerId' | 'key'>): boolean {
+  return command.protocol === request.protocol && command.runId === request.runId
+    && command.attemptId === request.attemptId && command.cutSha === request.cutSha
+    && command.baselineSha === request.baselineSha && command.deadlineAt === request.deadlineAt
+    && command.envProfile === request.envProfile && command.files.length === request.files.length
+    && command.files.every((file, index) => file === request.files[index]);
+}
+
 interface CommandResult { rc: number; output: string; passedIds?: string[]; stalledEnv?: Array<{ file: string; reason: 'no-output' }>; timedOut?: boolean;
+  /** Identity and complete selected inventory of this Pod sweep; only the producer may issue it. */
+  podSweep?: { id: string; shards: number; files: string[] };
+  /** Complete, source-bound one-file Job result for shadow comparison; absent means unmeasured. */
+  warmReference?: WarmWorkerFileResult | null;
+  warmAttemptId?: string;
+  warmShadow?: WarmShadowObservation;
   /** GATE-POD-STALL-FAILFAST ① — shard Pods whose tests the mid-run watch aborted in this sweep. */
   abortedShards?: number;
   /** Each contributing Pod leaf already passed failuresOf; repeated printed ids cannot add new failures. */
   validatedShards?: boolean }
+function redactedGateLogTail(input: string): string {
+  // Redact before trimming: a truncated token might no longer match the redaction rule.
+  const bytes = Buffer.from(redactSecretText(input), 'utf8');
+  let start = Math.max(0, bytes.length - 16_384);
+  while (start < bytes.length && (bytes[start]! & 0xc0) === 0x80) start++;
+  return bytes.subarray(start).toString('utf8');
+}
 export interface GateRunner {
   command(cmd: string, args: string[], cwd: string, limitMs?: number): Promise<CommandResult>;
   localCommand(cmd: string, args: string[], cwd: string, limitMs?: number): Promise<CommandResult>;
@@ -59,6 +106,10 @@ export interface GateRunner {
 }
 export interface GateOptions {
   commit: string;
+  /** The graph run that launched this gate; direct hard rehearsal instead pins source bytes explicitly. */
+  graphRunId?: string;
+  /** Only a direct hard rehearsal may pin graph bytes from its measured Git commit. */
+  rehearsalBaseline?: boolean;
   forceFreeze?: boolean;
   version: string;
   baselineVersion?: string;
@@ -76,6 +127,22 @@ export interface GateOptions {
   recheckFileLimit?: number;
   /** freshShards — GATE-SHARD-RESUME off: every shard starts a Pod even when this logDir already holds its result. */
   pod?: { pool: string; shards?: number; shardTimeoutSeconds?: number; durationSource?: string; bunCache?: string; freshShards?: boolean;
+    /** Opt-in gate shadow: provider fills the fenced lease identity. The Job remains authoritative. */
+    warmReplay?: (input: Omit<WarmWorkerCommand, 'leaseId' | 'generation' | 'workerId' | 'key'>) => Promise<{ command: WarmWorkerCommand | null; transport: WarmPodTransportResult }>;
+    warmQuarantine?: (command: WarmWorkerCommand, reason: string) => Promise<void>;
+    warmFinalize?: (command: WarmWorkerCommand) => Promise<void>;
+    /** Set only on the cut recheck; baseline Jobs never consume the cut worker. */
+    warmCutSha?: string;
+    warmBaselineSha?: string;
+    warmReuseConfig?: WarmReuseSwitchConfig;
+    /** At most three cut isolation files may request a shadow replay per verdict. */
+    warmEligible?: boolean;
+    /** An explicitly excluded file cannot race for the shared replay budget. */
+    warmReplayOwner?: boolean;
+    /** Internal budget shared by every recheck in one gate verdict, including timeout retries. */
+    warmShadowScope?: { requested: boolean; attempts?: number };
+    /** Internal shadow wait cap; a stuck provider cannot hold the Job verdict (tests may lower it). */
+    warmShadowTimeoutMs?: number;
     /** Maximum concurrent file-isolation fallback Jobs across the entire sweep; omitted = 4. */
     isolationConcurrency?: number;
     /** GATE-SKIP-KNOWN-RETRY — failure ids the previous release already had (and env-known ones): a shard that fails only
@@ -104,6 +171,9 @@ export interface GateOptions {
     liveLog?: (job: { name: string; context?: string }) => string | null;
     /** false = the stop did not take; the watch asks again every poll until it does (void = taken). */
     stopJob?: (job: { name: string; context?: string }) => boolean | void;
+    /** Failure-only Pod status and log reader; injected tests never call the live cluster. */
+    failureEvidence?: (job: { name: string; context?: string }) => { podName?: string; termination?: { reason?: string; message?: string; exitCode?: number; finishedAt?: string }; logTail?: string; error?: string };
+    failureKubectl?: typeof defaultKubectl;
     /** How often the stall watch reads the live log (ms); omitted = {@link GATE_POD_STALL_POLL_MS}. */
     stallPollMs?: number;
     /** GATE-POD-STALL-FAILFAST ① — seconds a shard may go without its part logs growing once test output began, before
@@ -124,6 +194,16 @@ export interface GateOptions {
     /** GATE-WARM-BOOT-SCAN — observation only: the sweep's test selection (list · filter · duration plan · shard plan) time. */
     onSelectionTimed?: (timed: { ms: number; files: number }) => void };
 }
+
+/** Gate-profile opt-in wires the producer only for the process entry, never a test runner seam. */
+export function withWarmGateHooks(opts: GateOptions, config: unknown, injectedRunner = false): GateOptions {
+  if (injectedRunner || !opts.pod || resolveWarmPoolProfile(config) !== 'gate') return opts;
+  const warmReuseConfig = config && typeof config === 'object' && 'pod' in config
+    && config.pod && typeof config.pod === 'object' && 'warmReuse' in config.pod
+    ? config.pod.warmReuse as WarmReuseSwitchConfig : undefined;
+  return { ...opts, pod: { ...opts.pod, warmReplay: requestWarmPodReplay,
+    warmFinalize: finalizeWarmPodReplay, warmQuarantine: quarantineWarmPodReplay, warmReuseConfig } };
+}
 export interface GateResult {
   outcome: 'ok' | 'regression' | 'error';
   commit: string;
@@ -137,6 +217,8 @@ export interface GateResult {
   rcNonzeroNoFailures: Array<{ file: string; rc: number; pass: number; baseline: 'same' | 'clean' | 'missing' }>;
   /** Files left unmeasured after isolated recheck; these cannot seed a reusable baseline. */
   unmeasuredRecheckFiles?: string[];
+  /** Shadow only: Job verdict is unchanged even on a worker mismatch or failed quarantine. */
+  warmShadow?: WarmShadowObservation[];
   /** GATE-POD-STALL-FAILFAST ① — cut sweep shard Pods ended by the mid-run abort (their files went the timeout way). */
   abortedShards?: number;
   baselineSource?: 'ledger' | 'instance' | 'cut-logs' | 'swept';
@@ -149,9 +231,17 @@ export interface GateResult {
   selectionMs?: number;
   error?: string;
   stalledShards?: Array<{ shard: number; files: string[]; reason: 'incomplete' | 'no-output' | 'job-failed' | 'exit-code' | 'unattributed' | 'timeout'; lastFile?: string; summaryFailures?: number; namedFailures?: number; detail?: string;
+    /** Pool member that ran the final unmeasured attempt; enables a bounded cross-host tail remeasure. */
+    lastHost?: string;
+    /** Failure of the optional cross-host tail attempt; original stall fields remain authoritative. */
+    tailRemeasure?: { reason: string; host?: string; detail?: string };
     /** GATE-POD-STALL-FAILFAST — the shard (and its one fresh retry) printed no test output within the stall window: unmeasured. */
     stall?: { seconds: number; sinceCheckoutMs: number } }>;
   partialSummary?: { pass: number; fail: number; errors: number; ran: number; files: number };
+  /** Number of complete shards retained when an incomplete sweep is resumed. */
+  preservedShardCount?: number;
+  /** Completed shard measurements retained when another shard stalled, so same-commit resume can reuse them safely. */
+  partialFailures?: SweepFailures;
   /** GATE-PARTIAL — this verdict re-ran only these files and carried the prior gate's results for the rest. */
   partial?: { priorCommit: string; files: number };
   /** GATE-INTRO-RECHECK — new failures that were only the «timed out» shape and passed one isolated re-run with a
@@ -169,6 +259,124 @@ const versionPattern = /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/;
 const failureFile = (root: string, version: string) => join(root, 'release', version, 'gate-failures.json');
 /** Judged identities live beside the machine release ledger; gate-failures.json keeps its raw baseline schema. */
 const verdictFile = (root: string, version: string) => join(root, 'release', version, 'gate-verdict.json');
+const WARM_VERDICT_HISTORY_LIMIT = 5;
+const WARM_REPLAY_BUDGET = 3;
+interface WarmVerdictSample { version: string; commit: string; baselineCommit: string; warmShadow: WarmShadowObservation[] }
+const recordValue = (value: unknown): Record<string, unknown> | null =>
+  value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : null;
+/** The verdict is atomically replaced; carry a bounded prior-verdict window in that same SSOT. */
+function readWarmVerdictHistory(path: string): WarmVerdictSample[] | undefined {
+  if (!existsSync(path)) return [];
+  try {
+    const current = recordValue(JSON.parse(readFileSync(path, 'utf8')));
+    if (!current || !Array.isArray(current.warmHistory)) return undefined;
+    const history = [...current.warmHistory, { version: current.version, commit: current.commit,
+      baselineCommit: current.baselineCommit, warmShadow: current.warmShadow }].slice(-WARM_VERDICT_HISTORY_LIMIT);
+    if (history.some((entry) => { const row = recordValue(entry);
+      return !row || typeof row.version !== 'string' || typeof row.commit !== 'string'
+        || typeof row.baselineCommit !== 'string' || !Array.isArray(row.warmShadow); })) return undefined;
+    return history as WarmVerdictSample[];
+  } catch { return undefined; }
+}
+/** Every counted match has a measured, finalized worker with this exact cut, baseline and lock. */
+export function warmEvidenceFromVerdicts(history: readonly WarmVerdictSample[] | undefined,
+  version: string, head: string, baseline: string, lock: string): WarmReuseEvidence | undefined {
+  if (!history?.length || !lock) return undefined;
+  const rows = history.flatMap((verdict) => {
+    if (verdict.version !== version || verdict.commit !== head || verdict.baselineCommit !== baseline
+      || !Array.isArray(verdict.warmShadow)) return [null];
+    return verdict.warmShadow.length ? verdict.warmShadow : [null];
+  });
+  const attempts = new Set<string>();
+  const key = rows.at(-1)?.workerKey;
+  if (rows.some((entry) => {
+    if (entry === null || !recordValue(entry) || !Array.isArray(entry.files) || !recordValue(entry.workerKey)) return true;
+    if (typeof entry.attemptId !== 'string' || !entry.attemptId || attempts.has(entry.attemptId)
+      || entry.files.length !== 1 || typeof entry.files[0] !== 'string'
+      || !/^(?:[\w.-]+\/)*[\w.-]+\.test\.[cm]?[jt]sx?$/.test(entry.files[0])
+      || entry.files[0].split('/').some((part) => part === '.' || part === '..')) return true;
+    attempts.add(entry.attemptId);
+    return entry.cutSha !== head || entry.baselineSha !== baseline || entry.workerKey?.lockHash !== lock
+      || typeof entry.workerKey.context !== 'string' || !entry.workerKey.context
+      || typeof entry.workerKey.imageDigest !== 'string' || !entry.workerKey.imageDigest
+      || typeof entry.workerKey.architecture !== 'string' || !entry.workerKey.architecture
+      || entry.workerKey.context !== key?.context || entry.workerKey.imageDigest !== key?.imageDigest
+      || entry.workerKey.architecture !== key?.architecture
+      || (entry.reason === 'match' && (entry.status !== 'observed' || entry.finalized !== true || entry.quarantined !== 'no'));
+  })) return undefined;
+  const recentMismatchCount = rows.filter((entry) => entry!.reason !== 'match').length;
+  let consecutiveMatchSamples = 0;
+  for (const row of [...rows].reverse()) {
+    if (row!.status !== 'observed' || row!.reason !== 'match' || row!.finalized !== true) break;
+    consecutiveMatchSamples++;
+  }
+  const latest = rows.at(-1)!;
+  return { consecutiveMatchSamples, recentMismatchCount,
+    leaseValid: latest!.finalized === true,
+    canaryPassed: latest!.status === 'observed' && latest!.reason === 'match' && latest!.finalized === true,
+    // A release cut is the pinned main commit; baselineSha is checked separately above.
+    expected: { head, main: head, lock }, worker: { head: latest!.cutSha, main: latest!.cutSha, lock: latest!.workerKey!.lockHash } };
+}
+/** Live reuse is serial and opt-in. Any uncertain lease, reply, or cleanup returns to the fresh Job. */
+async function tryWarmGateAdoption(file: string, cutSha: string, baselineSha: string, expectedKey: WarmWorkerKey,
+  pod: NonNullable<GateOptions['pod']>): Promise<CommandResult | undefined> {
+  if (!pod.warmReplay || !pod.warmFinalize || !pod.warmQuarantine || !pod.warmShadowScope
+    || (pod.warmShadowScope.attempts ?? 0) >= WARM_REPLAY_BUDGET) return undefined;
+  pod.warmShadowScope.attempts = (pod.warmShadowScope.attempts ?? 0) + 1;
+  pod.warmShadowScope.requested = true;
+  const waitMs = pod.warmShadowTimeoutMs ?? 150_000;
+  const deadline = Date.now() + waitMs;
+  const request = { protocol: 1 as const, runId: randomUUID(), attemptId: randomUUID(), cutSha,
+    baselineSha, deadlineAt: deadline - 1_000, files: [file], envProfile: 'gate-v1' };
+  let command: WarmWorkerCommand | null = null;
+  let timedOut = false;
+  const bounded = async <T>(operation: () => Promise<T>): Promise<T> => {
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) throw new Error('warm adoption timeout');
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try { return await Promise.race([Promise.resolve().then(operation), new Promise<never>((_, reject) => {
+      timer = setTimeout(() => reject(new Error('warm adoption timeout')), remainingMs);
+    })]); } finally { if (timer) clearTimeout(timer); }
+  };
+  try {
+    const pending = Promise.resolve().then(() => pod.warmReplay!(request));
+    void pending.then((late) => {
+      if (timedOut && late.command) void pod.warmQuarantine!(late.command, 'late-adoption-after-timeout')
+        .catch((error) => debug.log('release-loop.gate', 'warm-adoption-late-quarantine-failed', { file, error: String(error) }));
+    }, () => undefined);
+    let replay: WarmReplayResult;
+    try { replay = await bounded(() => pending); }
+    catch (error) { timedOut = true; throw error; }
+    command = replay.command;
+    if (!command || replay.transport.status !== 'observed' || replay.transport.reason !== 'complete'
+      || !warmCommandMatchesRequest(command, request) || command.key.context !== expectedKey.context
+      || command.key.imageDigest !== expectedKey.imageDigest || command.key.lockHash !== expectedKey.lockHash
+      || command.key.architecture !== expectedKey.architecture) throw new Error('warm adoption lease or identity');
+    const reply = parseWarmWorkerReply(replay.transport.reply);
+    const part = reply?.files[0];
+    if (!reply || !part || reply.files.length !== 1 || part.file !== file || part.rc !== 0 || part.junitComplete !== true
+      || part.failureIds.length !== 0 || part.errorIds.length !== 0
+      || reply.runId !== command.runId || reply.attemptId !== command.attemptId || reply.cutSha !== cutSha
+      || reply.baselineSha !== baselineSha || reply.leaseId !== command.leaseId || reply.generation !== command.generation
+      || reply.workerId !== command.workerId || reply.envProfile !== command.envProfile
+      || reply.key.context !== command.key.context || reply.key.imageDigest !== command.key.imageDigest
+      || reply.key.lockHash !== command.key.lockHash || reply.key.architecture !== command.key.architecture
+      || reply.finishedAt < reply.startedAt || reply.finishedAt > command.deadlineAt) throw new Error('warm adoption result');
+    await bounded(() => pod.warmFinalize!(command!));
+    debug.log('release-loop.gate', 'warm-adopted-recheck', { file, cutSha, attemptId: command.attemptId });
+    return { rc: 0, output: `${file}:\n(pass) warm isolated recheck\n1 pass\n0 fail\nRan 1 test across 1 file.\n` };
+  } catch (error) {
+    if (command) {
+      let quarantineTimer: ReturnType<typeof setTimeout> | undefined;
+      try { await Promise.race([pod.warmQuarantine!(command, 'adoption-fallback'),
+        new Promise<never>((_, reject) => { quarantineTimer = setTimeout(() => reject(new Error('warm quarantine timeout')), 10_000); })]); }
+      catch (fenceError) { debug.log('release-loop.gate', 'warm-adoption-quarantine-failed', { file, error: String(fenceError) }); }
+      finally { if (quarantineTimer) clearTimeout(quarantineTimer); }
+    }
+    debug.log('release-loop.gate', 'warm-adoption-fresh-job', { file, reason: String(error) });
+    return undefined;
+  }
+}
 const quote = (s: string) => `'${s.replaceAll("'", "'\\''")}'`;
 const defaultRemoteMirror = '~/mirror/elanous-agent.git';
 
@@ -787,7 +995,7 @@ export function readShardArtifacts(dir: string, parts: readonly (readonly string
 export const gateUnfinishedHint = (relativePath: string, bytes: number) => `[gate] unfinished: ${relativePath} · ${bytes}B (진행 중 part 출력은 그 파일)`;
 
 // review-model-ab: Pod 에서 출력 없이 멈춤 2/2(10-04 0.2.11 · 로컬 단독 4/0 · 1.7s) — GATE-STALL 수리 전까지 Pod 밖.
-export const POD_SWEEP_INTEGRATION_ONLY: readonly string[] = ['scripts/install.test.ts', 'scripts/review-model-ab.test.ts'];
+// The shared exclusion list lives in gate-baseline-receipt so radius verification uses the producer's rule.
 /** Nightly-only whole-repository cases; gate runs the fixture cases in these same files. */
 export const GATE_NIGHTLY_AUDITS: readonly string[] = [
   // Replaces F12's real-repo bucket B apps/pwa scope check and its whole-repo export partition check.
@@ -948,7 +1156,8 @@ export function readIsolatedRun(run: CommandResult, label: string, file: string)
 }
 
 class StalledPodShards extends Error {
-  constructor(readonly stalledShards: NonNullable<GateResult['stalledShards']>, readonly partialSummary: NonNullable<GateResult['partialSummary']>, readonly abortedShards = 0) {
+  constructor(readonly stalledShards: NonNullable<GateResult['stalledShards']>, readonly partialSummary: NonNullable<GateResult['partialSummary']>,
+    readonly partialFailures: SweepFailures, readonly preservedShardCount: number, readonly abortedShards = 0) {
     const unmeasured = stalledShards.filter((item) => item.stall);
     const exitCode = stalledShards.filter((item) => item.reason === 'exit-code');
     super(`pod sweep incomplete: stalled shards ${stalledShards.map(({ shard }) => shard).join(', ')}`
@@ -958,6 +1167,33 @@ class StalledPodShards extends Error {
   }
 }
 
+/** Read completed shard failures without letting one malformed shard hide the stalled-shard verdict. */
+export function partialFailuresOf(runs: readonly (CommandResult & { files: number })[]): SweepFailures {
+  return runs.reduce<SweepFailures>((sum, run) => {
+    try {
+      const parsed = failuresOf({ rc: run.rc, output: run.output, validatedShards: true }, `pod partial shard ${run.files}`);
+      sum.failures.push(...parsed.failures);
+      sum.errors.push(...parsed.errors);
+    } catch (error) {
+      debug.log('release-loop.gate', 'pod-partial-failures-unreadable', {
+        files: run.files,
+        reason: error instanceof Error ? error.message : String(error),
+      }, { level: 'warn' });
+    }
+    return sum;
+  }, { failures: [], errors: [] });
+}
+
+class WarmRecheckIncomplete extends Error {
+  constructor(message: string, readonly file: string, readonly shadow: WarmShadowObservation) { super(message); }
+}
+
+class SettledRecheckFailures extends Error {
+  constructor(readonly failures: unknown[]) {
+    super(failures[0] instanceof Error ? failures[0].message : String(failures[0]));
+  }
+}
+
 /** Isolated re-runs (host stall re-run · cut and baseline re-checks) are time-limited; sweeps and installs keep their full time. */
 export const GATE_ISOLATED_TIMEOUT_MS = 300_000;
 /** Default final recheck window size; overflow continues in later windows. */
@@ -1098,6 +1334,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     }
     : localCommand);
   const podSweep = async (tree: string, logDir: string | undefined, pod: NonNullable<GateOptions['pod']>, only?: readonly string[]): Promise<CommandResult> => {
+    const sweepId = randomUUID();
     const shardCount = pod.shards ?? 24;
     const isolationConcurrency = pod.isolationConcurrency ?? 4;
     // GATE-TIMEOUT-HEAL ①: the configured value is the floor; each shard's own deadline is shardDeadlineSeconds(planned).
@@ -1212,6 +1449,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     let abortedShards = 0;
     // GATE-MULTI-HOST: members found unreachable during this gate — skipped for placement while any other member is left.
     const downMembers = new Set<string>();
+    let tailPlacedHost: string | undefined;
     const multiHost = poolScheduler.members.length > 1;
     const probeMember = pod.probeMember ?? (poolOverride ? undefined : defaultGateMemberProbe);
     const memberUnreadableSeconds = pod.memberUnreadableSeconds ?? GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT;
@@ -1239,6 +1477,33 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       }
       return '';
     };
+    const failureEvidence = pod.failureEvidence ?? ((job: { name: string; context?: string }) => {
+      if (!job.context) return { error: '수거 실패 · Job 배치 context 없음' };
+      const prefix = ['--context', job.context, '--request-timeout=5s', '-n', 'elanous-test'];
+      const errors: string[] = [];
+      let termination: { reason?: string; message?: string; exitCode?: number; finishedAt?: string } | undefined;
+      let podName: string | undefined;
+      let latestEndedAt = -Infinity;
+      const status = (pod.failureKubectl ?? defaultKubectl)([...prefix, 'get', 'pods', '-l', `job-name=${job.name}`, '-o', 'json']);
+      if (status.status !== 0) errors.push(`Pod 상태: ${status.stderr.trim() || `kubectl rc=${status.status}`}`);
+      else try {
+        const pods = JSON.parse(status.stdout) as { items?: Array<{ metadata?: { name?: string; creationTimestamp?: string }; status?: { containerStatuses?: Array<{ name?: string; state?: { terminated?: typeof termination } }> } }> };
+        for (const item of pods.items ?? []) {
+          const child = item.status?.containerStatuses?.find((container) => container.name === 'child');
+          const ended = child?.state?.terminated;
+          if (!ended || !item.metadata?.name) continue;
+          const endedAt = Date.parse(ended.finishedAt ?? item.metadata.creationTimestamp ?? '');
+          const rank = Number.isFinite(endedAt) ? endedAt : -Infinity;
+          if (!termination || rank > latestEndedAt) { podName = item.metadata.name; termination = ended; latestEndedAt = rank; }
+        }
+        if (!termination) errors.push('Pod 상태: child 종료 사유 없음');
+      } catch (error) { errors.push(`Pod 상태 JSON: ${String(error)}`); }
+      const logs = podName ? (pod.failureKubectl ?? defaultKubectl)([...prefix, 'logs', `pod/${podName}`, '-c', 'child', '--tail=100']) : undefined;
+      if (!logs) errors.push('로그: 종료된 Pod 이름 없음');
+      else if (logs.status !== 0) errors.push(`로그: ${logs.stderr.trim() || `kubectl rc=${logs.status}`}`);
+      return { ...(podName ? { podName } : {}), ...(termination ? { termination } : {}), ...(logs?.status === 0 ? { logTail: logs.stdout } : {}),
+        ...(errors.length ? { error: `수거 실패 · ${errors.join(' · ')}` } : {}) };
+    });
     type ShardRun = { output: string; rc: number; pass: number; fail: number; errors: number; ran: number; files: number; passedIds: string[] };
     type ShardReason = NonNullable<GateResult['stalledShards']>[number]['reason'];
     // 깊이 끝 OOM 조각은 «조각 전체»를 파일 하나씩 격리한다 — 상한 40 이면 나머지가 못 잰 채 남았다(09-30 ① 7번 조각 110 파일).
@@ -1287,12 +1552,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     /** The gate's scheduler, seen through one shard: a slot wait and the Pod start become row states. */
     // GATE-MEM-ADMIT: `placed` releases the shard's admission once a member is chosen — from then on the Job is
     // Pending/Running in the cluster and the next admission reading counts it, so holding the lease would count it twice.
-    const trackedPool = (shard: number, retry: boolean, placed: (member: NonNullable<Awaited<ReturnType<PodPoolScheduler['tryAcquire']>>>) => void = () => {}): PodPoolScheduler => ({
+    const trackedPool = (shard: number, retry: boolean, placed: (member: NonNullable<Awaited<ReturnType<PodPoolScheduler['tryAcquire']>>>) => void = () => {}, skipMembers: ReadonlySet<string> = new Set()): PodPoolScheduler => ({
       members: poolScheduler.members,
       tryAcquire: async (...[skip, onEmpty, mode]: Parameters<PodPoolScheduler['tryAcquire']>) => {
         // GATE-MULTI-HOST: a lost member is skipped while another member is left (all lost = the old behaviour).
         const anyLeft = poolScheduler.members.some((m) => !downMembers.has(m.context));
-        const member = await poolScheduler.tryAcquire(downMembers.size && anyLeft ? new Set([...(skip ?? []), ...downMembers]) : skip, onEmpty, mode);
+        const excluded = new Set([...(skip ?? []), ...skipMembers, ...(downMembers.size && anyLeft ? downMembers : [])]);
+        const member = await poolScheduler.tryAcquire(excluded.size ? excluded : undefined, onEmpty, mode);
         if (member) placed(member);
         if (member) markShard(shard, { state: retry ? 'retry' : 'running', startedAt: board[shard]?.startedAt ?? new Date().toISOString(), host: member.context }, ['waitReason']);
         else markShard(shard, { waitReason: 'Pod 자리 대기' });
@@ -1300,7 +1566,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       },
       release: (member: Parameters<PodPoolScheduler['release']>[0]) => poolScheduler.release(member),
     }) as unknown as PodPoolScheduler;
-    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string, hostRetries = 0, batchIsolation = false): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
+    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string, hostRetries = 0, batchIsolation = false, skipMembers: ReadonlySet<string> = new Set(), singleShotTail = false): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
       // 파일별 소요는 junit 으로 남긴다 — 콘솔 요약(판정 원천)은 그대로이고, 느린 시험 목록(K10 D4)·계층 분리(D2)의 자가 된다.
       // GATE-TIMEOUT-HEAL: parts (each with its own junit) under a soft deadline inside this shard's own Job deadline.
       const shardDeadline = shardDeadlineSeconds(batchIsolation ? Math.max(...paths.map((file) => estimated([file]))) * Math.ceil(paths.length / batchWidth) : estimated(paths), deadlineSeconds);
@@ -1317,6 +1583,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       const stamp = (phase: string) => { phaseTimes[phase] = new Date().toISOString(); };
       let podStages: Record<string, number> | undefined;
       let podLifecycle: Record<string, string> | undefined;
+      let imageDigest: string | null = null;
       let podJobName: string | undefined;
       let batchArtifactsComplete = true;
       let junit: string | undefined;
@@ -1326,6 +1593,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       let lastFile: string | undefined;
       let jobFailed = false;
       let jobError = '';
+      let failureCapture: ReturnType<NonNullable<NonNullable<GateOptions['pod']>['failureEvidence']>> | undefined;
+      let jobNameForCapture: string | undefined;
+      let jobContextForCapture: string | undefined;
+      const captureFailure = () => {
+        try { failureCapture = failureEvidence({ name: jobNameForCapture ?? 'unplaced', context: jobContextForCapture }); }
+        catch (error) { failureCapture = { error: `수거 실패 · ${String(error)}` }; }
+      };
       /** GATE-MULTI-HOST — the member this shard's Job was placed on (recorded in the shard json / log / board). */
       let placedOn: string | undefined;
       let timedOut = false;
@@ -1356,7 +1630,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       if (descent === 'retry') {
         // «descend» is only the way down; «resumed» comes from each leaf whose log reads cleanly (review r4).
         debug.log('release-loop.gate', 'pod-shard-descend', { shard, branch, files: paths.length, via: 'retry' });
-        return runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId, hostRetries, batchIsolation);
+        return runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId, hostRetries, batchIsolation, skipMembers);
       }
       if (descent === 'split') {
         output = undefined;
@@ -1376,6 +1650,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         // The admission wait is not the shard's run time: deadline/timeout judgment and the measured duration start here.
         start = Date.now();
         const jobName = `gate-${randomUUID()}`;
+        jobNameForCapture = jobName;
         // The member's context is known once the Job is placed; the live log is read (and the Job stopped) there.
         let jobContext: string | undefined;
         const liveJob = () => ({ name: jobName, ...(jobContext ? { context: jobContext } : {}) });
@@ -1397,7 +1672,17 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           } : {}) }) : undefined;
         const placed = admitted.release;
         const job = await podCommand({
-          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => { stamp('poolPlaced'); jobContext = member.context; placedOn = member.context; placed(); }), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
+          provenanceGate: true,
+          provenance: { actorKind: process.env.ELANOUS_SEAT ? 'seat' : 'loop', actor: process.env.ELANOUS_SEAT || 'release-loop',
+            character: 'gate-shard-runner', launchHost: hostname(), entrance: process.env.ELANOUS_RELEASE_ENTRANCE?.trim() || 'release-run',
+            kind: 'gate-shard', run: process.env.ELANOUS_RUN_ID || sweepId, phase: 'release-gate', requestedAt: new Date().toISOString(),
+            graphNode: 'gate', version: pod.shardsFile?.version, commit, shard: `${shard + 1}-of-${shards.length}`,
+            reason: `release gate shard ${shard + 1}/${shards.length}`, pool: pod.pool, cpuReq: cpu.request,
+            memReq: memoryLimit ?? POD_ISOLATION_MEMORY_LIMIT, warmReused: false },
+          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => {
+            stamp('poolPlaced'); jobContext = member.context; jobContextForCapture = member.context; placedOn = member.context; placed();
+            if (branch === '-tail') tailPlacedHost = member.context;
+          }, skipMembers), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
           ...gateHostMirror(pod),
           ...(multiHost ? { statusUnreadableMs: memberUnreadableSeconds * 1000 } : {}),
           ...(bunCache ? { bunCache } : {}),
@@ -1410,13 +1695,20 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         }).finally(() => watch?.stop());
         stamp('jobReturned');
         podJobName = job.job;
+        // poolOverride is the injected scheduler used by isolated tests; it has no authenticated kubectl
+        // context. Those sweeps intentionally cannot mint a valid baseline receipt (missing observed digest).
+        // Production pool sweeps always use this Kubernetes lookup; lookup failure is receipt-invalid only.
         if (!poolOverride && placedOn) {
           try {
             const got = defaultKubectl(['--context', placedOn, '-n', 'elanous-test', 'get', 'pods', '-l', `job-name=${job.job}`, '-o', 'json']);
-            if (got.status === 0) podLifecycle = readGatePodLifecycle(got.stdout);
+            if (got.status === 0) {
+              podLifecycle = readGatePodLifecycle(got.stdout);
+              imageDigest = actualGatePodImageDigest(got.stdout);
+            }
           } catch { /* timings never change the verdict */ }
         }
         jobExitCode = job.exitCode;
+        if (job.exitCode !== 0) captureFailure();
         batchArtifactDir = job.artifactsDir;
         const read = readShardArtifacts(job.artifactsDir, parts);
         batchArtifactsComplete = !batchIsolation || parts.every((_, index) =>
@@ -1450,6 +1742,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       } catch (error) {
         jobFailed = true;
         jobError = error instanceof Error ? error.message : String(error);
+        if (!failureCapture) captureFailure();
       }
       // A launch that failed before placement still gives its admission back (release is idempotent).
       admitted?.release();
@@ -1484,9 +1777,20 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (unfinishedLog !== undefined) writeFileSync(unfinishedDestination, unfinishedLog, { mode: 0o600 });
         else rmSync(unfinishedDestination, { force: true });
         writeFileSync(join(logDir, `pod-${shard}${branch}.json`), JSON.stringify({ durationMs, rc: rc ?? null,
-          ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed, ...(placedOn ? { host: placedOn } : {}),
+          ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, sweepId, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed, ...(placedOn ? { host: placedOn } : {}),
           ...(Object.keys(phaseTimes).length ? { phaseTimes } : {}), ...(podStages ? { podStages } : {}),
           ...(podLifecycle && Object.keys(podLifecycle).length ? { podLifecycle } : {}),
+          ...(failureCapture ? { failureCapture: {
+            ...(failureCapture.podName ? { podName: failureCapture.podName } : {}),
+            ...(failureCapture.termination ? { termination: {
+              ...failureCapture.termination,
+              ...(failureCapture.termination.reason ? { reason: redactSecretText(failureCapture.termination.reason) } : {}),
+              ...(failureCapture.termination.message ? { message: redactSecretText(failureCapture.termination.message) } : {}),
+            } } : {}),
+            ...(failureCapture.logTail !== undefined ? { logTail: redactedGateLogTail(failureCapture.logTail) } : {}),
+            ...(failureCapture.error ? { error: redactSecretText(failureCapture.error) } : {}),
+          } } : {}),
+          ...(imageDigest ? { imageDigest } : {}),
           ...(fileSeconds !== undefined ? { fileSeconds, testSeconds } : {}), ...(testWallSeconds !== undefined ? { testWallSeconds } : {}),
           ...(podOverheadSeconds !== undefined ? { podOverheadSeconds } : {}),
           ...(unfinishedLogBytes !== undefined ? { unfinishedLogBytes } : {}),
@@ -1560,14 +1864,14 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       // A reused result that the current tool cannot read cleanly is not a verdict: run that shard for real.
       if (reused && reason) {
         debug.log('release-loop.gate', 'pod-shard-resume-miss', { shard, branch, reason });
-        return runShard(paths, shard, depth, branch, retriedNoOutput, true, parentAttempt, hostRetries, batchIsolation);
+        return runShard(paths, shard, depth, branch, retriedNoOutput, true, parentAttempt, hostRetries, batchIsolation, skipMembers, singleShotTail);
       }
       // GATE-MULTI-HOST: the Job failed because its member is gone (launch failed · status unreadable) — not the shard's
       // fault, so no split: the same files run again on the members left. Bounded by the roster size.
-      if (jobFailed && placedOn && hostRetries < poolScheduler.members.length && memberLost(placedOn, shard, jobError)
+      if (!singleShotTail && jobFailed && placedOn && hostRetries < poolScheduler.members.length && memberLost(placedOn, shard, jobError)
         && poolScheduler.members.some((m) => !downMembers.has(m.context))) {
         debug.log('release-loop.gate', 'pod-shard-host-retry', { shard, branch, files: paths.length, lostMember: placedOn, attempt: hostRetries + 1 }, { level: 'warn' });
-        return runShard(paths, shard, depth, `${branch}-h${hostRetries}`, retriedNoOutput, undefined, attemptId, hostRetries + 1, batchIsolation);
+        return runShard(paths, shard, depth, `${branch}-h${hostRetries}`, retriedNoOutput, undefined, attemptId, hostRetries + 1, batchIsolation, skipMembers, singleShotTail);
       }
       // GATE-TIMEOUT-HEAL ④: a Pod that died before any test ran (no outbox · jobExitCode≠0 — 0.2.19: isolated retries
       // ending with exit 5, the source checkout) gets the same one fresh retry as «no output» instead of stalling the sweep.
@@ -1575,13 +1879,18 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       const diedBeforeTests = reason === 'job-failed' && output === undefined && !jobFailed && jobExitCode !== undefined && jobExitCode !== 0
         && jobExitCode !== 137 && (paths.length === 1 || jobExitCode === 5);
       if ((reason === 'no-output' || diedBeforeTests) && !retriedNoOutput) {
-        const retry = await runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId, hostRetries, batchIsolation);
+        const retry = await runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId, hostRetries, batchIsolation, skipMembers);
         debug.log('release-loop.gate', 'pod-shard-retry', { shard, files: paths, reason, outcome: retry.stalled[0]?.reason ?? 'ok' });
         return retry;
       }
       // GATE-POD-STALL-FAILFAST: a stall after the fresh retry is unmeasured — no split, no isolation: smaller Pods on the
       // same stalled node only re-measure the stall (10-10: retries and splits repeated it for 2h+).
-      if (stall && reason === 'no-output') return { runs: [], stalled: [{ shard, files: paths, reason, stall }] };
+      if (stall && reason === 'no-output') return { runs: [], stalled: [{ shard, files: paths, reason, stall, ...(placedOn ? { lastHost: placedOn } : {}) }] };
+      // GATE-STALLED-TAIL-REMEASURE: the alternate-host probe is a single observation. Do not split, isolate, or
+      // retry its failed result; the sweep retains the original stall and records this attempt separately.
+      if (singleShotTail && reason) return { runs: [], stalled: [{ shard, files: paths, reason,
+        ...(lastFile ? { lastFile } : {}), ...(placedOn ? { lastHost: placedOn } : {}),
+        ...(reason === 'unattributed' ? { summaryFailures: fails, namedFailures, ...(unattributedDetail ? { detail: unattributedDetail } : {}) } : {}) }] };
       // A shared Job may finish some file parts before another part loses its JUnit/log/rc. Keep every complete part's
       // original verdict, including a failure, and rerun only parts without the full artifact trio.
       if (batchIsolation && !batchArtifactsComplete && batchArtifactDir && reason) {
@@ -1714,8 +2023,43 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const rejected = settled.find((result): result is PromiseRejectedResult => result.status === 'rejected');
     if (rejected) throw rejected.reason;
     const results = settled.flatMap((result) => result.status === 'fulfilled' ? [result.value] : []);
-    const stalledShards = results.flatMap((result) => result.stalled);
+    let stalledShards = results.flatMap((result) => result.stalled);
     const measured = results.flatMap((result) => result.runs);
+    // GATE-STALLED-TAIL-REMEASURE: after the sweep, give only a one-file no-output leaf one fresh attempt on a different
+    // pool member. Keep the original unmeasured evidence if no alternate is available or the remeasure is incomplete.
+    const remainingStalls: typeof stalledShards = [];
+    for (const stalled of stalledShards) {
+      const alternatives = stalled.lastHost
+        ? poolScheduler.members.filter((member) => member.context !== stalled.lastHost && !downMembers.has(member.context))
+        : [];
+      if (!stalled.stall || stalled.reason !== 'no-output' || stalled.files.length !== 1 || !stalled.lastHost || !alternatives.length) {
+        remainingStalls.push(stalled);
+        continue;
+      }
+      debug.log('release-loop.gate', 'pod-stalled-tail-remeasure-start', { shard: stalled.shard, file: stalled.files[0], fromHost: stalled.lastHost,
+        availableHosts: alternatives.map((member) => member.context) });
+      try {
+        tailPlacedHost = undefined;
+        const tail = await runShard(stalled.files, stalled.shard, 0, '-tail', true, true, undefined, 0, false, new Set([stalled.lastHost]), true);
+        if (tail.stalled.length) {
+          const unresolved = tail.stalled[0]!;
+          remainingStalls.push({ ...stalled, tailRemeasure: { reason: unresolved.reason,
+            ...(unresolved.lastHost ?? tailPlacedHost ? { host: unresolved.lastHost ?? tailPlacedHost } : {}),
+            ...(unresolved.detail ? { detail: unresolved.detail } : {}) } });
+          debug.log('release-loop.gate', 'pod-stalled-tail-remeasure-incomplete', { shard: stalled.shard, file: stalled.files[0],
+            fromHost: stalled.lastHost, toHost: unresolved.lastHost ?? null, reason: unresolved.reason }, { level: 'warn' });
+        } else {
+          measured.push(...tail.runs);
+          debug.log('release-loop.gate', 'pod-stalled-tail-remeasure-complete', { shard: stalled.shard, file: stalled.files[0],
+            fromHost: stalled.lastHost, toHost: tailPlacedHost ?? null });
+        }
+      } catch (error) {
+        remainingStalls.push({ ...stalled, tailRemeasure: { reason: 'error', ...(tailPlacedHost ? { host: tailPlacedHost } : {}), detail: String(error).slice(0, 500) } });
+        debug.log('release-loop.gate', 'pod-stalled-tail-remeasure-error', { shard: stalled.shard, file: stalled.files[0],
+          fromHost: stalled.lastHost, error: String(error).slice(0, 500) }, { level: 'warn' });
+      }
+    }
+    stalledShards = remainingStalls;
     const total = measured.reduce((sum, run) => ({ pass: sum.pass + run.pass, fail: sum.fail + run.fail,
       errors: sum.errors + run.errors, ran: sum.ran + run.ran, files: sum.files + run.files }),
     { pass: 0, fail: 0, errors: 0, ran: 0, files: 0 });
@@ -1724,15 +2068,35 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       stallSeconds, measuredFiles: total.files }, { level: 'warn' });
     // An unmeasured (stalled) shard is never handed to the host re-run as an environment stall: the gate fails now.
     if (abortedShards) debug.log('release-loop.gate', 'pod-sweep-aborted', { shards: abortedShards, midRunStallSeconds }, { level: 'warn' });
-    if (stalledShards.some((item) => item.reason !== 'no-output' || item.files.length !== 1 || item.stall)) throw new StalledPodShards(stalledShards, total, abortedShards);
+    if (stalledShards.some((item) => item.reason !== 'no-output' || item.files.length !== 1 || item.stall)) {
+      const measuredFailures = partialFailuresOf(measured);
+      throw new StalledPodShards(stalledShards, total, measuredFailures,
+        results.filter((item) => item.stalled.length === 0).length, abortedShards);
+    }
     if (total.ran === 0 && total.errors === 0 && !stalledShards.length) throw new Error('sweep incomplete: no tests ran');
     const outputs = measured.map((run) => run.output.replace(/(?:^|\n)\s*\d+ (?:pass|fail|errors?)\s*(?=\n|$)/g, '\n').replace(/Ran \d+ tests? across \d+ files?\.?/g, ''));
     return { rc: total.fail + total.errors ? 1 : 0, output: outputs.join('\n') + `\n${total.pass} pass\n${total.fail} fail\n${total.errors} errors\nRan ${total.ran} tests across ${total.files} files.\n`, validatedShards: true,
+      podSweep: { id: sweepId, shards: shards.length, files: assignable },
       passedIds: [...new Set(measured.flatMap((run) => run.passedIds))].sort(),
       stalledEnv: stalledShards.flatMap((item) => item.files.map((file) => ({ file, reason: 'no-output' as const }))),
       ...(abortedShards ? { abortedShards } : {}) };
   };
   const runPodRecheckBatch = async (files: readonly string[], commit: string, pod: NonNullable<GateOptions['pod']>, timeoutMs: number, relaxed = false): Promise<Map<string, CommandResult>> => {
+    const warmShadowScope = pod.warmShadowScope ?? { requested: false };
+    const shadowTimeoutMs = pod.warmShadowTimeoutMs ?? 150_000;
+    if (!Number.isSafeInteger(shadowTimeoutMs) || shadowTimeoutMs < 1 || shadowTimeoutMs > 150_000)
+      throw new Error('invalid warm shadow timeout');
+    let shadowDeadline = 0;
+    const boundedShadow = async <T>(phase: string, operation: () => Promise<T>): Promise<T> => {
+      const remainingMs = shadowDeadline - Date.now();
+      if (remainingMs <= 0) throw new Error(`warm ${phase} timeout after ${shadowTimeoutMs}ms`);
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      try {
+        return await Promise.race([Promise.resolve().then(operation), new Promise<never>((_resolve, reject) => {
+          timer = setTimeout(() => reject(new Error(`warm ${phase} timeout after ${shadowTimeoutMs}ms`)), remainingMs);
+        })]);
+      } finally { if (timer) clearTimeout(timer); }
+    };
     if (!files.length || files.length > GATE_RECHECK_POD_BATCH_FILES || new Set(files).size !== files.length
       || files.some((file) => !/^(?:[\w.-]+\/)*[\w.-]+\.test\.[cm]?[jt]sx?$/.test(file)
         || file.split('/').some((part) => part === '.' || part === '..')))
@@ -1741,12 +2105,19 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const installSlots = pod.installSlots ?? POD_INSTALL_SLOTS_DEFAULT;
     if (!Number.isSafeInteger(installSlots) || installSlots < 0) throw new Error('invalid pod recheck install slots');
     const bunCache = pod.bunCache?.trim() || process.env[POD_BUN_CACHE_HOST_PATH]?.trim();
+    const attemptId = randomUUID();
     const partLimitSeconds = Math.ceil(timeoutMs / 1000);
     const deadlineSeconds = partLimitSeconds * Math.ceil(files.length / 2) + POD_SHARD_EMIT_RESERVE_SECONDS + 60;
     const shell = gateShardShell({ parts: files.map((file) => [file]), cdpPatterns: [], softSeconds: softDeadlineSeconds(deadlineSeconds),
       cachePrefix: bunCache ? podBunCacheVolume(bunCache).shellPrefix : '', installSlots, parallelParts: files.length > 1 ? 2 : 1,
-      partLimitSeconds, ...(relaxed ? { testTimeoutMs: GATE_TIMEOUT_RECHECK_MS } : {}) });
+      partLimitSeconds, sourceBinding: { cutSha: commit, attemptId }, ...(relaxed ? { testTimeoutMs: GATE_TIMEOUT_RECHECK_MS } : {}) });
     const job = await podCommand({ pool: pod.pool, ...(poolOverride ? { poolScheduler: poolOverride } : {}), clone: true,
+      provenanceGate: true,
+      provenance: { actorKind: process.env.ELANOUS_SEAT ? 'seat' : 'loop', actor: process.env.ELANOUS_SEAT || 'release-loop',
+        character: 'gate-shard-runner', launchHost: hostname(), entrance: 'release-recheck', kind: 'gate-recheck',
+        run: process.env.ELANOUS_RUN_ID || attemptId, phase: 'release-gate', requestedAt: new Date().toISOString(),
+        graphNode: 'gate-triage', commit, reason: `release gate recheck ${files.length} files`, pool: pod.pool,
+        memReq: POD_ISOLATION_MEMORY_LIMIT, warmReused: false },
       source: { kind: 'commit', sha: commit }, deadlineSeconds, ...(bunCache ? { bunCache } : {}), ...gateHostMirror(pod),
       ...(installSlots > 0 ? { installSlots: POD_INSTALL_SLOTS_HOST_PATH } : {}), ...(pod.cpu ? { cpu: pod.cpu } : {}),
       memoryLimit: POD_ISOLATION_MEMORY_LIMIT, name: `gate-recheck-${randomUUID()}`, command: ['bash', '-lc', shell] });
@@ -1755,8 +2126,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       return existsSync(path) ? readFileSync(path, 'utf8') : undefined;
     };
     const installed = artifact('install.rc')?.trim() === '0';
+    const warmEligible = files.length === 1 && pod.warmEligible === true && !!pod.warmReplay && !!pod.warmQuarantine && !!pod.warmFinalize
+      && pod.warmCutSha === commit;
+    const incomplete = (message: string, file: string): Error => warmEligible
+      ? new WarmRecheckIncomplete(message, file, { files: [file], attemptId, status: 'unmeasured', reason: 'reference-unmeasured', quarantined: 'no' })
+      : new Error(message);
     if (!installed || job.exitCode !== 0)
-      throw new Error(`pod isolated recheck setup incomplete: ${commit.slice(0, 9)} job=${job.job} exit=${job.exitCode} install=${installed}`);
+      throw incomplete(`pod isolated recheck setup incomplete: ${commit.slice(0, 9)} job=${job.job} exit=${job.exitCode} install=${installed}`, files[0]!);
     const timedOut = artifact('shard.timeout') !== undefined;
     const results = new Map<string, CommandResult>();
     for (const [index, file] of files.entries()) {
@@ -1765,11 +2141,105 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       const rc = rcText && /^\d+$/.test(rcText) ? Number(rcText) : undefined;
       const partTimedOut = artifact(`part-${index}.timeout`) !== undefined;
       if (rc === undefined || output === undefined || partTimedOut) {
-        if (!timedOut && !partTimedOut) throw new Error(`pod isolated recheck incomplete: ${file} @${commit.slice(0, 9)} job=${job.job} rc=${rc ?? 'missing'}`);
+        if (!timedOut && !partTimedOut) throw incomplete(`pod isolated recheck incomplete: ${file} @${commit.slice(0, 9)} job=${job.job} rc=${rc ?? 'missing'}`, file);
         results.set(file, { rc: 124, output: output ?? '', timedOut: true });
-      } else results.set(file, { rc, output });
+      } else {
+        // The comparator only accepts a complete JUnit/log pair tied to this exact Job attempt.
+        // A missing or damaged artifact leaves the existing Job verdict authoritative.
+        let warmReference: WarmWorkerFileResult | null = null;
+        if (warmEligible) {
+          try {
+            const prefix = join(job.artifactsDir, `recheck-${index}`);
+            const part = (suffix: string) => join(job.artifactsDir, `part-${index}.${suffix}`);
+            for (const suffix of ['log', 'rc', 'junit.xml']) if (existsSync(part(suffix))) copyFileSync(part(suffix), `${prefix}.${suffix}`);
+            writeFileSync(`${prefix}.json`, JSON.stringify({ commit, attemptId, files: [file], rc,
+              jobFailed: false, jobExitCode: job.exitCode }) + '\n', { mode: 0o600 });
+            if (writeWarmJobManifest(prefix, file, commit, attemptId))
+              warmReference = warmReferenceFromJobArtifacts(prefix, file, { cutSha: commit, attemptId });
+          } catch (error) {
+            debug.log('release-loop.gate', 'warm-reference-unmeasured', { file, attemptId, error: String(error) });
+          }
+        }
+        results.set(file, { rc, output, warmReference, warmAttemptId: attemptId });
+      }
       debug.log('release-loop.gate', 'pod-isolated-recheck', { file, commit, job: job.job, rc: rc ?? 124, relaxed });
     }
+    if (warmEligible && pod.warmReplay && pod.warmQuarantine && pod.warmFinalize) {
+      shadowDeadline = Date.now() + shadowTimeoutMs;
+      const first = results.get(files[0]!)!;
+      const reference = first.warmReference;
+      if (!reference) {
+        first.warmShadow = { files: [...files], attemptId, status: 'unmeasured', reason: 'reference-unmeasured', quarantined: 'no' };
+        debug.log('release-loop.gate', 'warm-shadow-recheck', first.warmShadow);
+      } else if (pod.warmReplayOwner !== false && (warmShadowScope.attempts ?? (warmShadowScope.requested ? 1 : 0)) < WARM_REPLAY_BUDGET) {
+        warmShadowScope.attempts = (warmShadowScope.attempts ?? (warmShadowScope.requested ? 1 : 0)) + 1;
+        warmShadowScope.requested = true;
+        let observation: WarmShadowObservation;
+        try {
+          const request = { protocol: 1 as const, runId: randomUUID(), attemptId, cutSha: commit,
+            ...(pod.warmBaselineSha ? { baselineSha: pod.warmBaselineSha } : {}),
+            deadlineAt: Math.min(Date.now() + timeoutMs * files.length + 60_000, shadowDeadline - 1_000),
+            files, envProfile: 'gate-v1' };
+          // The producer honors deadlineAt. An injected/slow producer may still settle after our wait cap:
+          // fence any late lease before it can be mistaken for a reusable worker.
+          let replayTimedOut = false;
+          const pendingReplay = Promise.resolve().then(() => pod.warmReplay!(request));
+          void pendingReplay.then((late) => {
+            if (replayTimedOut && late.command) void Promise.resolve().then(() => pod.warmQuarantine!(late.command!, 'late-replay-after-timeout'))
+              .catch((error) => debug.log('release-loop.gate', 'warm-shadow-late-quarantine-failed', { attemptId, error: String(error) }));
+          }, (error) => {
+            if (replayTimedOut) debug.log('release-loop.gate', 'warm-shadow-late-replay-failed', { attemptId, error: String(error) });
+          });
+          let replay: WarmReplayResult;
+          try { replay = await boundedShadow('replay', () => pendingReplay); }
+          catch (error) { replayTimedOut = true; throw error; }
+          if (!replay.command) {
+            observation = { files: [...files], attemptId, status: 'fallback', reason: replay.transport.reason, quarantined: 'no' };
+          } else if (replay.transport.status !== 'observed') {
+            let quarantined: WarmShadowObservation['quarantined'] = 'yes';
+            try { await boundedShadow('quarantine', () => pod.warmQuarantine!(replay.command!, `transport-${replay.transport.reason}`)); }
+            catch (error) {
+              quarantined = 'failed';
+              debug.log('release-loop.gate', 'warm-shadow-quarantine-failed', { attemptId,
+                reason: replay.transport.reason, error: String(error) });
+            }
+            observation = { files: [...files], attemptId, status: 'fallback', reason: replay.transport.reason, quarantined };
+          } else {
+            const bound = warmCommandMatchesRequest(replay.command, request);
+            const decision = bound ? assessWarmWorkerShadow(replay.command, [reference], replay.transport.reply)
+              : { reason: 'identity' as const, quarantineWorker: true };
+            let reason: string = decision.reason;
+            let status: WarmShadowObservation['status'] = 'observed';
+            let quarantined: WarmShadowObservation['quarantined'] = 'no';
+            let finalized = false;
+            if (decision.reason === 'match') {
+              try { await boundedShadow('finalize', () => pod.warmFinalize!(replay.command!)); finalized = true; }
+              catch (error) {
+                reason = 'finalize-failed';
+                status = 'fallback';
+                debug.log('release-loop.gate', 'warm-shadow-finalize-failed', { attemptId, error: String(error) });
+              }
+            }
+            if (!finalized) {
+              try { await boundedShadow('quarantine', () => pod.warmQuarantine!(replay.command!, reason)); quarantined = 'yes'; }
+              catch (error) {
+                quarantined = 'failed';
+                debug.log('release-loop.gate', 'warm-shadow-quarantine-failed', { attemptId, reason, error: String(error) });
+              }
+            }
+            observation = { files: [...files], attemptId, status, reason, quarantined, finalized,
+              cutSha: replay.command.cutSha, baselineSha: replay.command.baselineSha, workerKey: replay.command.key };
+          }
+        } catch (error) {
+          observation = { files: [...files], attemptId, status: 'unmeasured', reason: String(error), quarantined: 'unavailable' };
+        }
+        first.warmShadow = observation;
+        debug.log('release-loop.gate', 'warm-shadow-recheck', observation);
+      } else {
+        first.warmShadow = { files: [...files], attemptId, status: 'fallback', reason: 'replay-budget-exhausted', quarantined: 'no' };
+        debug.log('release-loop.gate', 'warm-shadow-recheck', first.warmShadow);
+      }
+    }
     return results;
   };
   return {
@@ -1941,8 +2411,11 @@ export function saveBaselineFileCache(ledger: string, commit: string, rows: Base
   } finally { if (existsSync(temp)) rmSync(temp); }
 }
 
-export async function judgeGate(opts: GateOptions, runner: GateRunner = createGateRunner(opts.repo ?? process.cwd(), opts.remote)): Promise<GateResult> {
+export async function judgeGate(opts: GateOptions, runner: GateRunner = createGateRunner(opts.repo ?? process.cwd(), opts.remote),
+  imageProbe: typeof preflightGateImageDigest = preflightGateImageDigest): Promise<GateResult> {
   const start = Date.now();
+  if (opts.pod?.warmReplay) opts = { ...opts, pod: { ...opts.pod,
+    warmShadowScope: { requested: false, attempts: 0 } } };
   const explicitConfig = getElanousConfigDirOverride();
   const root = explicitConfig ? effectiveInstanceRoot() : (opts.instanceRoot ?? effectiveInstanceRoot());
   // The freeze is read from the same root the gate runs in (a config-dir override must not move it elsewhere).
@@ -1969,17 +2442,28 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
   };
   const repo = resolve(opts.repo ?? process.cwd());
   const result: GateResult = { outcome: 'error', commit: opts.commit, introduced: [], preexisting: 0, fixed: 0, knownEnv: 0, knownEnvCleared: [], stalledEnv: [], rcNonzeroNoFailures: [], durationMs: 0 };
+  let baselineCommitForVerdict = opts.baselineCommit ?? '';
   const preexistingIds: string[] = [];
   let knownEnvIds: string[] = [];
   let work: string | undefined;
   let baseSnapshot = false;
   let cutFailures: SweepFailures | undefined;
+  let cutSweepUsable = false;
+  let cutSweepRc: number | null = null;
+  let radiusShadow: GateRadiusShadowPlan | undefined;
   const trees: string[] = [];
   try {
     if (!sha.test(opts.commit) || !versionPattern.test(opts.version)
       || (opts.baselineVersion && !versionPattern.test(opts.baselineVersion))
       || (opts.baselineCommit && !sha.test(opts.baselineCommit))) throw new Error('invalid commit or version');
     if (!opts.baselineVersion) throw new Error('previous release version required (--baseline-version)');
+    if (opts.rehearsalBaseline && (opts.graphRunId || !opts.pod || !/-rc\.\d+$/.test(opts.version)))
+      throw new Error('rehearsal baseline requires a direct Pod gate with an isolated rc version');
+    // Observation only. Failure to plan cannot change the gate selector or verdict.
+    try { radiusShadow = planGateRadiusShadow({ repo, ledgerRoot: ledger, version: opts.version,
+      baselineVersion: opts.baselineVersion, forCommit: opts.commit, instanceRoot: root,
+      expectedBaselineCommit: opts.baselineCommit }); }
+    catch (error) { debug.log('release-loop.gate', 'radius-shadow-unavailable', { reason: String(error) }); }
     if (!Number.isSafeInteger(opts.recheckFileLimit ?? GATE_HOST_RECHECK_FILE_LIMIT) || (opts.recheckFileLimit ?? GATE_HOST_RECHECK_FILE_LIMIT) < 1)
       throw new Error('invalid gate recheck file limit');
     if (opts.pod && (!opts.pod.pool || !Number.isSafeInteger(opts.pod.shards ?? 24) || (opts.pod.shards ?? 24) < 1
@@ -2023,12 +2507,31 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     for (const dir of [cutTree, join(cutTree, 'apps/pwa')]) check(await runner.command('bun', ['install'], dir), `bun install ${dir}`);
     // GATE-PARTIAL: a plan made by `release resume --from gate --partial` for exactly this commit re-runs only its files.
     // Its logs go to cut-partial/ — the full cut/ logs stay whole (the next release reads them as a baseline source).
-    const partial = readPartialPlan(roots, opts.version, opts.commit);
-    if (partial) debug.log('release-loop.gate', 'partial-regate', { version: opts.version, priorCommit: partial.priorCommit, commit: opts.commit, files: partial.files.length });
+    const partialRead = readPartialPlanResult(roots, opts.version, opts.commit);
+    const explicitPartial = partialRead.plan;
+    const rehearsalStampPresent = ['hard-5h', 'hard-mid'].some((step) =>
+      existsSync(join(root, 'release', opts.version, 'rehearsal', `${step}.json`)));
+    const currentImage = !explicitPartial && opts.graphRunId && opts.pod && rehearsalStampPresent
+      ? imageProbe(opts.pod.pool) : null;
+    const radius = !explicitPartial && opts.graphRunId && opts.pod && rehearsalStampPresent
+      ? planHardRehearsalRadius({ root, repo, version: opts.version, forCommit: opts.commit,
+        graphPins: gateGraphPins(root, opts.graphRunId), envFingerprint: gateEnvFingerprint(process.env), imageDigest: currentImage })
+      : null;
+    if (radius) debug.log('release-loop.gate', 'radius-live-plan', { version: opts.version, reason: radius.reason,
+      files: radius.plan?.files.length ?? null, rehearsalRunId: radius.rehearsalRunId ?? null });
+    let partial = explicitPartial ?? radius?.plan ?? null;
+    debug.log('release-loop.gate', partial ? 'partial-regate' : 'partial-fallback', {
+      version: opts.version, priorCommit: partial?.priorCommit ?? null, commit: opts.commit,
+      planKind: partial?.kind ?? 'full', remeasureFileCount: partial?.files.length ?? 0,
+      preservedShardCount: partial?.kind === 'recheck' && 'preservedShardCount' in partial
+        && typeof partial.preservedShardCount === 'number' ? partial.preservedShardCount : 0,
+      fallbackReason: partial ? undefined : partialRead.fallbackReason,
+    });
     if (partial?.kind === 'carry') {
+      const carryPriorCommit = partial.priorCommit;
       // The plan alone is not evidence: the old cut and its verdict must still be complete and clean at this SHA.
-      if (!verifyDocsOnlyCarry(repo, partial.priorCommit, opts.commit))
-        throw new Error(`carry plan diff is not docs-only: ${partial.priorCommit}..${opts.commit}`);
+      if (!verifyDocsOnlyCarry(repo, carryPriorCommit, opts.commit))
+        throw new Error(`carry plan diff is not docs-only: ${carryPriorCommit}..${opts.commit}`);
       const trusted = roots.some((location) => {
         const dir = join(location, 'release', opts.version);
         const failuresPath = join(dir, 'gate-failures.json');
@@ -2036,11 +2539,11 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         if (!existsSync(failuresPath) || !existsSync(verdictPath)) return false;
         const failures = JSON.parse(readFileSync(failuresPath, 'utf8')) as { commit?: unknown; failures?: unknown; errors?: unknown };
         const verdict = JSON.parse(readFileSync(verdictPath, 'utf8')) as { commit?: unknown; outcome?: unknown };
-        return failures.commit === partial.priorCommit && Array.isArray(failures.failures) && failures.failures.length === 0
+        return failures.commit === carryPriorCommit && Array.isArray(failures.failures) && failures.failures.length === 0
           && (failures.errors === undefined || (Array.isArray(failures.errors) && failures.errors.length === 0))
-          && verdict.commit === partial.priorCommit && verdict.outcome === 'ok';
+          && verdict.commit === carryPriorCommit && verdict.outcome === 'ok';
       });
-      if (!trusted) throw new Error(`carry plan has no complete clean gate at ${partial.priorCommit}`);
+      if (!trusted) throw new Error(`carry plan has no complete clean gate at ${carryPriorCommit}`);
     }
     // GATE-SKIP-KNOWN-RETRY — the ids the verdict will not count as introduced (the recorded baseline ⊕ env-known), read
     // before the sweep so a shard failing only with them skips its isolation retries. No recorded baseline = no skip.
@@ -2055,12 +2558,26 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       } catch (error) { debug.log('release-loop.gate', 'known-failures-unavailable', { error: String(error) }); }
     }
     const durationSource = join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut');
-    const cutRun = partial?.kind === 'carry' ? undefined : await runner.sweep(cutTree, join(root, 'release', opts.version, 'gate-logs', partial ? 'cut-partial' : 'cut'),
+    const runCut = (selected: typeof partial) => selected?.kind === 'carry' ? undefined : runner.sweep(cutTree,
+      join(root, 'release', opts.version, 'gate-logs', selected ? 'cut-partial' : 'cut'),
       opts.pod ? { ...opts.pod, durationSource, ...(knownFailures.length ? { knownFailures } : {}), onSelectionTimed: ({ ms }) => { result.selectionMs = ms; },
         // GATE-LIVE-OBS: the release ledger's shards.json (UX #24782) — never the run tree's universe; an explicit
         // --ledger-root (tests) keeps it in that ledger.
         shardsFile: { path: opts.ledgerRoot ? gateShardsPath(opts.version, opts.ledgerRoot) : gateShardsPath(opts.version), version: opts.version } } : undefined,
-      partial?.files);
+      selected?.files);
+    let cutRun = await runCut(partial);
+    const radiusSelectionMatched = partial?.files && cutRun?.podSweep?.files
+      && JSON.stringify([...partial.files].sort()) === JSON.stringify([...cutRun.podSweep.files].sort());
+    if (radius?.plan && (!radiusSelectionMatched
+      || !partialGateImagesMatch(root, opts.version, currentImage!, opts.commit, cutRun?.podSweep))) {
+      debug.log('release-loop.gate', 'radius-live-image-drift', { version: opts.version,
+        rehearsalRunId: radius.rehearsalRunId, action: 'full-sweep' }, { level: 'warn' });
+      partial = null;
+      cutRun = await runCut(null);
+    }
+    cutSweepRc = cutRun?.rc ?? null;
+    cutSweepUsable = !!cutRun && (cutRun.rc === 0 || cutRun.rc === 1) && !cutRun.timedOut
+      && !cutRun.abortedShards && !cutRun.stalledEnv?.length;
     if (cutRun?.abortedShards) result.abortedShards = cutRun.abortedShards;
     const localStalled = async (run: CommandResult, tree: string, commit: string, label: string) => {
       const stalled = run.stalledEnv ?? [];
@@ -2145,6 +2662,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     if (partial) result.partial = { priorCommit: partial.priorCommit, files: partial.files.length };
     cutFailures = cut;
     const baseSha = opts.baselineCommit ?? baselineReleaseCommit(opts.baselineVersion);
+    baselineCommitForVerdict = baseSha;
     const cached = cachedBaseline(opts.baselineVersion, baseSha);
     const recorded = cached ? undefined : baselineFromCutLogs(join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut'), baseSha);
     const trusted = cached?.saved ?? (recorded?.complete ? recorded : undefined);
@@ -2221,6 +2739,29 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       catch (error) { debug.log('release.gate', 'baseline-cache-write-failed', { commit: row.commit, file: row.file, error: String(error) }); }
     };
     const recheckFiles = [...newFailureFiles].sort();
+    const eligible = recheckFiles.filter((file) => !cutHostFailed.has(file) && !prefetchedCut.has(file));
+    const warmEligibleFiles = new Set(opts.pod?.warmReplay && opts.pod.warmQuarantine && opts.pod.warmFinalize
+      ? eligible.slice(0, WARM_REPLAY_BUDGET) : []);
+    // The source-bound lock comes from the cut commit itself, never from the producer's claim.
+    const history = readWarmVerdictHistory(verdictFile(ledger, opts.version));
+    let warmLockHash = '';
+    if (opts.pod?.warmReuseConfig?.gateRecheck && history?.length) {
+      try {
+        const lock = await runner.localCommand('git', ['show', `${opts.commit}:bun.lock`], repo);
+        if (lock.rc === 0 && lock.output) warmLockHash = createHash('sha256').update(lock.output).digest('hex');
+      } catch { /* Unmeasured evidence keeps reuse off. */ }
+    }
+    const warmEvidence = warmEvidenceFromVerdicts(history, opts.version, opts.commit, baseSha, warmLockHash);
+    const warmDecision = decideWarmReuse('gate-recheck', opts.pod?.warmReuseConfig,
+      warmEvidence ? { 'gate-recheck': warmEvidence } : undefined);
+    const verifiedWorkerKey = history?.at(-1)?.warmShadow.at(-1)?.workerKey;
+    if (warmDecision.live && verifiedWorkerKey && opts.pod && runner.recheckPod) {
+      // Only the first two files may adopt; replay them serially before scheduling fresh fallbacks.
+      for (const file of eligible.slice(0, 2)) {
+        const adopted = await tryWarmGateAdoption(file, opts.commit, baseSha, verifiedWorkerKey, opts.pod);
+        if (adopted) prefetchedCut.set(file, adopted);
+      }
+    }
     const recheckLimit = opts.recheckFileLimit ?? GATE_HOST_RECHECK_FILE_LIMIT;
     const recheckConcurrency = opts.pod?.isolationConcurrency ?? 4;
     if (opts.pod && (!Number.isSafeInteger(recheckConcurrency) || recheckConcurrency < 1)) throw new Error('invalid pod recheck concurrency');
@@ -2230,13 +2771,19 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       concurrency: opts.pod && runner.recheckPod ? recheckConcurrency : 1, executor: opts.pod && runner.recheckPod ? 'pod' : 'host',
       remote: opts.remote ?? null, podBatchFiles: opts.pod && runner.recheckPod && runner.recheckPodBatch ? GATE_RECHECK_POD_BATCH_FILES : 1 });
     const recheckStartedAt = Date.now();
+    const recordWarmShadow = (shadow?: WarmShadowObservation) => {
+      if (shadow && !result.warmShadow?.some((entry) => entry.attemptId === shadow.attemptId))
+        (result.warmShadow ??= []).push(shadow);
+    };
     const recheckFile = async (file: string, index: number) => {
       debug.log('release-loop.gate', 'isolated-recheck-progress',
         { index: index + 1, total: recheckFiles.length, file, elapsedSec: Math.round((Date.now() - recheckStartedAt) / 1000) });
       // 0.2.15: the cut re-check of a new-failure file (InsidePage.test.tsx · headless Chrome) hung for good — limit it like the host re-run.
       const cutCheck = cutHostFailed.has(file) ? undefined : prefetchedCut.get(file) ?? (opts.pod && runner.recheckPod
-        ? await runner.recheckPod(file, opts.commit, opts.pod, GATE_ISOLATED_TIMEOUT_MS)
+          ? await runner.recheckPod(file, opts.commit, { ...opts.pod, warmCutSha: opts.commit, warmBaselineSha: baseSha,
+            warmEligible: warmEligibleFiles.has(file) }, GATE_ISOLATED_TIMEOUT_MS)
         : await runner.command('bun', ['run', 'test:deterministic', asPath(file)], cutTree, GATE_ISOLATED_TIMEOUT_MS));
+      recordWarmShadow(cutCheck?.warmShadow);
       if (cutCheck?.timedOut) {
         debug.log('release-loop.gate', 'isolated-timeout', { file, label: 'cut isolated', limitMs: GATE_ISOLATED_TIMEOUT_MS });
         result.stalledEnv.push({ file, reason: 'isolated-timeout', local: 'timeout' });
@@ -2258,8 +2805,10 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       const shaped = candidates.filter((id) => timedOut.has(id) && isolatedCut.failures.includes(id));
       if (shaped.length) {
         const relaxed = opts.pod && runner.recheckPod
-          ? await runner.recheckPod(file, opts.commit, opts.pod, GATE_ISOLATED_TIMEOUT_MS, true)
+          ? await runner.recheckPod(file, opts.commit, { ...opts.pod, warmCutSha: opts.commit, warmBaselineSha: baseSha,
+            warmEligible: warmEligibleFiles.has(file) }, GATE_ISOLATED_TIMEOUT_MS, true)
           : await runner.command('bun', ['run', 'test:deterministic', asPath(file), '--timeout', String(GATE_TIMEOUT_RECHECK_MS)], cutTree, GATE_ISOLATED_TIMEOUT_MS);
+        recordWarmShadow(relaxed.warmShadow);
         let flaky: string[] = [];
         let recheck: 'read' | 'timeout' | 'unreadable' = 'read';
         if (relaxed.timedOut) recheck = 'timeout';
@@ -2329,20 +2878,51 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     const cap = opts.pod && runner.recheckPod ? recheckConcurrency : 1;
     const settleStarted = async <T>(jobs: Promise<T>[]): Promise<T[]> => {
       const settled = await Promise.allSettled(jobs);
-      const rejected = settled.find((item): item is PromiseRejectedResult => item.status === 'rejected');
-      if (rejected) throw rejected.reason;
+      const rejected = settled.filter((item): item is PromiseRejectedResult => item.status === 'rejected');
+      if (rejected.length) throw new SettledRecheckFailures(rejected.map((item) => item.reason));
       return settled.map((item) => (item as PromiseFulfilledResult<T>).value);
     };
+    // Always attempt both eligible references before a failed Job can end the verdict. A cap of one
+    // still runs the second Job, and successes retain their shadow if a peer throws.
+    if (warmEligibleFiles.size && opts.pod && runner.recheckPod) {
+      const completed = new Map<string, CommandResult>();
+      const failures: unknown[] = [];
+      const warmFiles = [...warmEligibleFiles].filter((file) => !prefetchedCut.has(file));
+      for (let start = 0; start < warmFiles.length; start += cap) {
+        const settled = await Promise.allSettled(warmFiles.slice(start, start + cap).map(async (file) => {
+          const pod = { ...opts.pod!, warmCutSha: opts.commit, warmBaselineSha: baseSha, warmEligible: true,
+            warmReplayOwner: true };
+          return runner.recheckPodBatch
+            ? (await runner.recheckPodBatch([file], opts.commit, pod, GATE_ISOLATED_TIMEOUT_MS)).get(file)
+            : await runner.recheckPod!(file, opts.commit, pod, GATE_ISOLATED_TIMEOUT_MS);
+        }));
+        for (const [index, item] of settled.entries()) {
+          if (item.status === 'rejected') failures.push(item.reason);
+          else if (item.value) completed.set(warmFiles[start + index]!, item.value);
+          else failures.push(new Error(`pod isolated recheck missing result: ${warmFiles[start + index]}`));
+        }
+      }
+      for (const [file, run] of completed) {
+        recordWarmShadow(run.warmShadow);
+        prefetchedCut.set(file, run);
+      }
+      if (failures.length) throw new SettledRecheckFailures(failures);
+    }
     for (let start = 0; start < recheckFiles.length; start += recheckLimit) {
       const window = recheckFiles.slice(start, start + recheckLimit);
       debug.log('release-loop.gate', 'isolated-recheck-window', { start, files: window.length, total: recheckFiles.length });
       if (opts.pod && runner.recheckPod && runner.recheckPodBatch) {
         const pending = window.filter((file) => !cutHostFailed.has(file) && !prefetchedCut.has(file));
-        const groups = Array.from({ length: Math.ceil(pending.length / GATE_RECHECK_POD_BATCH_FILES) }, (_, index) =>
-          pending.slice(index * GATE_RECHECK_POD_BATCH_FILES, (index + 1) * GATE_RECHECK_POD_BATCH_FILES));
+        const warmSingles = pending.filter((file) => warmEligibleFiles.has(file)).length;
+        const groups = [
+          ...pending.slice(0, warmSingles).map((file) => [file]),
+          ...Array.from({ length: Math.ceil((pending.length - warmSingles) / GATE_RECHECK_POD_BATCH_FILES) }, (_, index) =>
+            pending.slice(warmSingles + index * GATE_RECHECK_POD_BATCH_FILES, warmSingles + (index + 1) * GATE_RECHECK_POD_BATCH_FILES)),
+        ];
         for (let next = 0; next < groups.length; next += cap) {
           const batches = await settleStarted(groups.slice(next, next + cap).map((files) =>
-            runner.recheckPodBatch!(files, opts.commit, opts.pod!, GATE_ISOLATED_TIMEOUT_MS)));
+            runner.recheckPodBatch!(files, opts.commit, { ...opts.pod!, warmCutSha: opts.commit, warmBaselineSha: baseSha,
+              warmEligible: files.length === 1 && warmEligibleFiles.has(files[0]!) }, GATE_ISOLATED_TIMEOUT_MS)));
           for (const batch of batches) for (const [file, run] of batch) prefetchedCut.set(file, run);
         }
       }
@@ -2375,9 +2955,18 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     }
   } catch (error) {
     result.error = error instanceof Error ? error.message : String(error);
+    const warmFailures = (error instanceof SettledRecheckFailures ? error.failures : [error])
+      .filter((failure): failure is WarmRecheckIncomplete => failure instanceof WarmRecheckIncomplete);
+    if (warmFailures.length) {
+      (result.warmShadow ??= []).push(...warmFailures.map((failure) => failure.shadow));
+      result.unmeasuredRecheckFiles = [...new Set([...(result.unmeasuredRecheckFiles ?? []),
+        ...warmFailures.map((failure) => failure.file)])].sort();
+    }
     if (error instanceof StalledPodShards) {
       result.stalledShards = error.stalledShards;
       result.partialSummary = error.partialSummary;
+      result.partialFailures = error.partialFailures;
+      result.preservedShardCount = error.preservedShardCount;
       if (error.abortedShards) result.abortedShards = error.abortedShards;
     }
   } finally {
@@ -2416,6 +3005,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     }
   }
   {
+    const baselineCommit = baselineCommitForVerdict;
     const ids = {
       introduced: [...result.introduced].sort(),
       knownEnv: [...knownEnvIds].sort(),
@@ -2425,7 +3015,15 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       ...(result.unmeasuredErrors?.length ? { unmeasuredErrors: result.unmeasuredErrors } : {}),
       ...(result.interferenceErrors?.length ? { interferenceErrors: [...result.interferenceErrors].sort() } : {}),
     };
-    const observed = result.selectionMs !== undefined ? { selectionMs: result.selectionMs } : {};
+    const observed = { ...(result.selectionMs !== undefined ? { selectionMs: result.selectionMs } : {}),
+      ...(result.warmShadow?.length ? { warmShadow: result.warmShadow } : {}) };
+    // Receipt is advisory for a later radius gate. Missing identity makes reuse invalid, never this gate's verdict.
+    const baselineReceipt = gateBaselineReceipt({ root, version: opts.version, commit: opts.commit,
+      graphPins: gateGraphPins(root, opts.graphRunId) ?? (opts.rehearsalBaseline ? gateSourcePins(repo, opts.commit) : null),
+      envFingerprint: gateEnvFingerprint(process.env),
+      fullSweep: result.outcome === 'ok' && cutSweepUsable && !result.partial && !!cutFailures
+        && !result.rcNonzeroNoFailures.length && !result.stalledShards?.length && !result.stalledEnv.length
+        && !result.unmeasuredRecheckFiles?.length && !result.unmeasuredErrors?.length });
     try {
       for (const location of roots) {
         const path = verdictFile(location, opts.version);
@@ -2436,7 +3034,10 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         mkdirSync(dirname(path), { recursive: true });
         const temp = join(dirname(path), `.gate-verdict-${process.pid}-${randomUUID()}.tmp`);
         try {
-          writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit, outcome: result.outcome, ...ids, ...observed }, null, 2) + '\n', { mode: 0o600 });
+          const warmHistory = readWarmVerdictHistory(path) ?? [];
+          writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit,
+            outcome: result.outcome, ...ids, ...observed, baselineReceipt,
+            ...(opts.pod?.warmReplay ? { baselineCommit, warmHistory } : {}) }, null, 2) + '\n', { mode: 0o600 });
           chmodSync(temp, 0o600);
           renameSync(temp, path);
         } finally { if (existsSync(temp)) rmSync(temp); }
@@ -2449,7 +3050,10 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         mkdirSync(dirname(path), { recursive: true });
         const temp = join(dirname(path), `.gate-verdict-${process.pid}-${randomUUID()}.tmp`);
         try {
-          writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit, outcome: result.outcome, ...ids, ...observed }, null, 2) + '\n', { mode: 0o600 });
+          const warmHistory = readWarmVerdictHistory(path) ?? [];
+          writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit,
+            outcome: result.outcome, ...ids, ...observed, baselineReceipt,
+            ...(opts.pod?.warmReplay ? { baselineCommit, warmHistory } : {}) }, null, 2) + '\n', { mode: 0o600 });
           chmodSync(temp, 0o600);
           renameSync(temp, path);
         } finally { if (existsSync(temp)) rmSync(temp); }
@@ -2465,6 +3069,20 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       ...(result.outcome === 'error' ? { error: result.error } : {}),
     });
   }
+  if (radiusShadow) {
+    try {
+      const record = { plan: radiusShadow, recordedAt: new Date().toISOString(),
+        actual: shadowActual({ plan: radiusShadow, outcome: result.outcome,
+          introduced: result.introduced, cutFailures: cutFailures?.failures ?? [], cutErrors: cutFailures?.errors ?? [], cutRc: cutSweepRc,
+          fullSweep: cutSweepUsable && !result.partial && !!cutFailures && result.outcome !== 'error'
+            && !result.rcNonzeroNoFailures.length && !result.stalledShards?.length
+            && !result.stalledEnv.length && !result.unmeasuredRecheckFiles?.length
+            && !result.unmeasuredErrors?.length }) };
+      const path = writeGateRadiusShadow(ledger, record);
+      debug.log('release-loop.gate', 'radius-shadow-recorded', { path, proposed: radiusShadow.proposed,
+        missedIntroduced: record.actual.missedIntroduced.length });
+    } catch (error) { debug.log('release-loop.gate', 'radius-shadow-unavailable', { reason: String(error) }); }
+  }
   // GATE-LIVE-OBS-RC-WORDING ⓒ — the shards board says «판정 전» until this lands; then «새 실패 N» only (UX · gate-shards.ts).
   // Same ledger as the board's own writes (sweep's shardsFile). A write failure is logged and never changes the verdict.
   if (result.outcome !== 'error' && opts.pod) {
@@ -2563,6 +3181,7 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
     const arg = args[i];
     if (arg === '--help') return 'help';
     if (arg === '--json') continue;
+    if (arg === '--rehearsal-baseline') { opts.rehearsalBaseline = true; continue; }
     // Applied after the loop and only to a Pod gate — on its own it must not turn a local gate into a Pod one (review r5).
     if (arg === '--fresh-shards') { freshShards = true; continue; }
     if (arg === '--rehearsal-tui') { opts.rehearsalTui = true; continue; }
@@ -2606,19 +3225,26 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
 
 /** The node's run: judge, emit the graph result line, and return the process exit code (ok 0 · regression 1 · else 2).
  *  `runner` is a seam for tests; the process entry passes none. */
-export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner?: GateRunner): Promise<number> {
+export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner?: GateRunner,
+  judge: (opts: GateOptions, runner?: GateRunner) => Promise<GateResult> = judgeGate): Promise<number> {
   const start = Date.now();
   let result: GateResult;
   let version = '';
   let placement: { executor: string | null; host: string | null } | undefined;
   try {
-    const opts = parseOptions(argv, env);
+    const parsed = parseOptions(argv, env);
+    let config: unknown = null;
+    if (parsed !== 'help' && !runner && parsed.pod) {
+      try { config = getUserConfig(); }
+      catch (error) { debug.log('release-loop.gate', 'warm-profile-unavailable', { error: String(error) }); }
+    }
+    const opts = parsed === 'help' ? parsed : withWarmGateHooks(parsed, config, !!runner);
     if (opts !== 'help') {
       placement = gateExecutorOf(opts);
       debug.log('release-loop.gate', 'executor', { version: opts.version, ...placement, requested: opts.executor ?? null });
     }
     if (opts === 'help') {
-      console.log('Usage: bun scripts/release-loop/gate-node.ts --commit <sha> --version <v> [--baseline-version <prev>] [--baseline-commit <sha>] [--remote <ssh-host>] [--remote-mirror <path>] [--pod-pool <pool>] [--pod-shards <n>] [--pod-shard-timeout-seconds <n>] [--recheck-file-limit <n>] [--fresh-shards] [--executor <pod|host>] [--json]\nWithout flags, input.commit, input.version and input.previousVersion come from the JSON file at ELANOUS_GRAPH_CONTEXT.\n--executor host (input.gateExecutor) ignores every pod option and sweeps on --remote (input.gateRemote, required).');
+      console.log('Usage: bun scripts/release-loop/gate-node.ts --commit <sha> --version <v> [--baseline-version <prev>] [--baseline-commit <sha>] [--remote <ssh-host>] [--remote-mirror <path>] [--pod-pool <pool>] [--pod-shards <n>] [--pod-shard-timeout-seconds <n>] [--recheck-file-limit <n>] [--fresh-shards] [--executor <pod|host>] [--rehearsal-baseline] [--json]\nWithout flags, input.commit, input.version and input.previousVersion come from the JSON file at ELANOUS_GRAPH_CONTEXT.\n--executor host (input.gateExecutor) ignores every pod option and sweeps on --remote (input.gateRemote, required).\n--rehearsal-baseline pins source graph bytes only for a direct Pod gate on an isolated rc version.');
       return 0;
     }
     version = opts.version;
@@ -2631,7 +3257,7 @@ export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner
       throw new Error('release gate host reservation requires graph runId and pinned state root');
     const releaseHosts = context && hosts.length
       ? reserveReleaseGateHosts(reservationRoot!, context.runId!, hosts) : () => undefined;
-    try { result = await (runner ? judgeGate(opts, runner) : judgeGate(opts)); }
+    try { result = await judge(context?.runId ? { ...opts, graphRunId: context.runId } : opts, runner); }
     finally { releaseHosts(); }
   } catch (error) {
     result = { outcome: 'error', commit: '', introduced: [], preexisting: 0, fixed: 0, knownEnv: 0, knownEnvCleared: [], stalledEnv: [], rcNonzeroNoFailures: [], durationMs: Date.now() - start, error: String(error) };
@@ -2647,5 +3273,5 @@ if (import.meta.main) {
   // The graph spawns this file as its own process, which inherits no daemon sink — without this every
   // `release-loop.gate`/`release.gate`/`pod.pool` event stayed in the file trail and `elanous logs` read 0 rows.
   await registerStandaloneLogSink('release-loop');
-  process.exitCode = await runGateNode(process.argv.slice(2), process.env);
+  process.exitCode = await runWithReleaseGateTraffic(process.env, () => runGateNode(process.argv.slice(2), process.env));
 }