elanous 0.2.32 → 0.2.35

package/scripts/release-loop/resume-release.ts

@@ -6,13 +6,14 @@ import { constants, copyFileSync, existsSync, readFileSync, renameSync, writeFil
 import { join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
-import { lastJsonObject, runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { lastJsonObject, runGraph, verifyReleaseCommandRoot, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
-import { changedFilesBetween, clearPartialPlan, planPartialRegate, writePartialPlan } from './gate-partial.js';
-import { gitClosureTree, testsReachingChanged, type ClosureTree } from './gate-closure.js';
-import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { changedFilesBetween, clearPartialPlan, planPartialRegate, planStalledShardRecheck, writePartialPlan, writeRecheckPlan } from './gate-partial.js';
+import { gitClosureTree, testsReachingChanged, TRACEABLE_RELEASE_JSON, type ClosureTree } from './gate-closure.js';
+import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { reserveReleaseResumeAttempt } from './resume-cap.js';
 
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
@@ -33,6 +34,20 @@ export interface ResumeReleaseDeps {
   ledgerRoot?: string;
   /** GATE-REUSE-BY-DIFF: the tip tree for the import closure — default read from git objects of the tip commit. */
   closureTree?: (commit: string) => ClosureTree;
+  /** Source observation before the first resumed node. */
+  onSource?: (line: string) => void;
+}
+
+export interface ResumeReleaseOptions {
+  runId: string; from: string; partial?: boolean; waive?: string; reason?: string;
+  acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string; gatePodPool?: string;
+  commandRoot?: string;
+}
+
+export interface ResumeReleasePlan {
+  runId: string; version: string; fromNode: string; commandRoot: string; tip: TipRefresh;
+  partial: PartialOutcome; gatePlan: { mode: 'not-run' | 'partial' | 'full'; reason?: string };
+  nextAttempt: number; attemptLimit: 2; preflight: 'passed';
 }
 
 /** CLI entry files: a production file that only names one (help text, a goal's command line) does not run it. */
@@ -66,6 +81,10 @@ function safeRunId(runId: string): string {
 
 /** Point the saved version-release output at the current release/<v> tip (fast-forward of the recorded commit only). */
 export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps = {}, from?: string, waiverCommit?: string): TipRefresh {
+  return refreshReleaseBranchTipInternal(runId, deps, from, waiverCommit, false);
+}
+
+function refreshReleaseBranchTipInternal(runId: string, deps: ResumeReleaseDeps, from: string | undefined, waiverCommit: string | undefined, dryRun: boolean): TipRefresh {
   const root = deps.root ?? effectiveInstanceRoot();
   const statePath = join(root, 'graph-runs', 'release-loop', `${safeRunId(runId)}.json`);
   const state = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
@@ -89,8 +108,14 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   const git = deps.git ?? gitRunner(deps.repo ?? process.cwd());
   const advertised = git(['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]).split(/\s+/)[0] ?? '';
   if (!/^[0-9a-f]{40}$/i.test(advertised)) throw new Error(`${branch} is not on origin — this run was not cut as a release branch`);
-  git(['fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
-  const to = git(['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
+  let to: string;
+  if (dryRun) {
+    // Use the advertised object id directly: a preflight must not create/update local remote-tracking refs.
+    to = advertised;
+  } else {
+    git(['fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
+    to = git(['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
+  }
   if (waiverCommit && (recorded.toLowerCase() !== waiverCommit.toLowerCase() || to.toLowerCase() !== waiverCommit.toLowerCase() || advertised.toLowerCase() !== waiverCommit.toLowerCase())) {
     throw new Error('release branch moved — re-gate the new tip before waiving a node');
   }
@@ -114,6 +139,7 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   }
   const stamp = (deps.now?.() ?? new Date()).toISOString().replace(/[:.]/g, '-');
   const backup = `${statePath}.before-tip-${stamp}-${process.pid}-${to.slice(0, 12)}.bak`;
+  if (dryRun) return { version, branch, from: recorded, to, changed: true, statePath };
   // Exclusive: a retry never overwrites an earlier backup.
   copyFileSync(statePath, backup, constants.COPYFILE_EXCL);
   const refreshed = { ...output, commit: to, refreshedFrom: recorded };
@@ -134,10 +160,10 @@ export type PartialOutcome = { requested: false }
 
 /** Build (or clear) the partial re-gate plan for the new tip. Fail-closed: any doubt leaves a full gate.
  *  GATE-REUSE-BY-DIFF: `--from gate` on a moved tip plans by default (`partial: undefined`); `partial: false` opts out. */
-function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean }, deps: ResumeReleaseDeps): PartialOutcome {
+function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean }, deps: ResumeReleaseDeps, dryRun = false): PartialOutcome {
   const root = deps.root ?? effectiveInstanceRoot();
   // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
-  clearPartialPlan(root, tip.version);
+  if (!dryRun) clearPartialPlan(root, tip.version);
   const auto = opts.partial === undefined;
   // The current graph checks public export before gate. A moved tip must resume there, so its gate still needs
   // the diff plan; in older saved graphs export-check followed gate and cannot consume one.
@@ -147,13 +173,50 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   const reachesGate = (opts.from === 'gate' || opts.from === 'export-check') && fromIndex >= 0 && gateIndex >= fromIndex;
   // The default applies only where it can help: a gate re-run on a tip that moved. An unchanged tip re-uses its own
   // shard results by commit already.
-  if (opts.partial === false || (auto && (!reachesGate || !tip.changed))) return { requested: false };
+  if (opts.partial === false || (auto && (!reachesGate || (!tip.changed && opts.from !== 'gate')))) return { requested: false };
   const fallback = (reason: string): PartialOutcome => {
-    debug.log('release-loop.resume', 'partial-fallback', { version: tip.version, reason, auto });
+    debug.log('release-loop.resume', 'partial-fallback', { version: tip.version, reason, auto,
+      planKind: 'full', remeasureFileCount: 0, preservedShardCount: 0, fallbackReason: reason });
     return { requested: true, applied: false, reason, ...(auto ? { auto: true as const } : {}) };
   };
   if (!reachesGate) return fallback('--partial requires a restart that reaches gate');
-  if (!tip.changed) return fallback('release branch tip unchanged — nothing new to re-check');
+  if (!tip.changed) {
+    if (opts.from !== 'gate') return fallback('same-commit stalled-shard recheck requires --from gate');
+    const saved = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;
+    const gateRecord = saved.nodes.find((node) => node.nodeId === 'gate');
+    const previousGate = gateRecord ? lastJsonObject(gateRecord.output) as Record<string, unknown> | undefined : undefined;
+    const stalled = previousGate?.stalledShards;
+    const summary = previousGate?.partialSummary as { pass?: unknown; fail?: unknown; errors?: unknown; ran?: unknown; files?: unknown } | undefined;
+    const measured = previousGate?.partialFailures as { failures?: unknown; errors?: unknown } | undefined;
+    if (previousGate?.outcome !== 'error' || previousGate.commit !== tip.to || !Array.isArray(stalled) || !stalled.length || !summary || !measured
+      || !['pass', 'fail', 'errors', 'ran', 'files'].every((key) => Number.isSafeInteger(summary[key as keyof typeof summary]) && Number(summary[key as keyof typeof summary]) >= 0)
+      || !Array.isArray(measured.failures) || !measured.failures.every((id) => typeof id === 'string')
+      || !Array.isArray(measured.errors) || !measured.errors.every((id) => typeof id === 'string')
+      || measured.failures.length !== Number(summary.fail) || measured.errors.length !== Number(summary.errors))
+      return fallback('same-commit gate has no complete stalled-shard measurement record');
+    const stalledFiles: string[] = [];
+    for (const item of stalled) {
+      if (!item || typeof item !== 'object' || !Array.isArray((item as { files?: unknown }).files)
+        || !(item as { files: unknown[] }).files.every((file) => typeof file === 'string')
+        || !['incomplete', 'no-output', 'job-failed', 'exit-code', 'unattributed', 'timeout'].includes(String((item as { reason?: unknown }).reason)))
+        return fallback('stalled-shard record is malformed');
+      stalledFiles.push(...(item as { files: string[] }).files);
+    }
+    const closure = (deps.closureTree ?? ((commit: string) => gitClosureTree(deps.repo ?? process.cwd(), commit)))(tip.to);
+    const tracked = new Set(closure.files);
+    const preservedShardCount = Number.isSafeInteger(previousGate?.preservedShardCount)
+      && Number(previousGate?.preservedShardCount) >= 0 ? Number(previousGate?.preservedShardCount) : undefined;
+    const planned = planStalledShardRecheck({ version: tip.version, measuredCommit: tip.to, forCommit: tip.to,
+      failures: measured.failures as string[], errors: measured.errors as string[], stalledFiles,
+      ...(preservedShardCount === undefined ? {} : { preservedShardCount }),
+      existsAtCommit: (file) => tracked.has(file) });
+    if (!planned.ok) return fallback(planned.reason);
+    const path = writeRecheckPlan(root, planned.plan);
+    debug.log('release-loop.resume', 'stalled-recheck-planned', { version: tip.version, commit: tip.to,
+      planKind: planned.plan.kind, remeasureFileCount: planned.plan.files.length,
+      preservedShardCount: planned.plan.preservedShardCount ?? 0, fallbackReason: null, path });
+    return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.to, ...(auto ? { auto: true as const } : {}) };
+  }
   let prior: { commit?: unknown; failures?: unknown; errors?: unknown } | undefined;
   for (const location of [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])]) {
     const path = join(location, 'release', tip.version, 'gate-failures.json');
@@ -182,6 +245,18 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   catch (error) { return fallback(`tip tree unreadable: ${String(error instanceof Error ? error.message : error).slice(0, 200)}`); }
   const tracked = new Set(tree.files);
   const tests = tree.files.filter((file) => GATE_TEST.test(file));
+  if (changed.includes(TRACEABLE_RELEASE_JSON)) {
+    // The one JSON exception is safe only while both the production reader and a test name this exact file at the tip.
+    // A renamed, computed or unreadable reader returns to the full gate instead of trusting a stale dependency map.
+    const reader = tree.read('scripts/release-loop/known-issues-node.ts');
+    if (!reader || !/readFileSync\(join\(import\.meta\.dir,\s*['"]known-issues-0\.2\.33-approved\.json['"]\)/.test(reader)) {
+      return fallback('known-issues JSON reader not statically verified — full gate');
+    }
+    const readerClosure = testsReachingChanged(tree, ['scripts/release-loop/known-issues-node.ts'], tests, { cliEntries: CLI_ENTRIES });
+    if (!readerClosure.ok || readerClosure.reached === 0) return fallback('known-issues JSON production reader reaches no verified test — full gate');
+    const jsonClosure = testsReachingChanged(tree, [TRACEABLE_RELEASE_JSON], tests, { cliEntries: CLI_ENTRIES });
+    if (!jsonClosure.ok || jsonClosure.reached === 0) return fallback('known-issues JSON reaches no verified test — full gate');
+  }
   const planned = planPartialRegate({ version: tip.version, priorCommit: tip.from, forCommit: tip.to, changedFiles: changed,
     priorFailures: prior.failures as string[], priorErrors: (prior.errors ?? []) as string[],
     existsAtTip: (file) => tracked.has(file),
@@ -201,9 +276,9 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     }
     if (!clean) return fallback(`no clean gate verdict for ${tip.from.slice(0, 12)} — full gate`);
   }
-  const path = writePartialPlan(root, planned.plan);
+  const path = dryRun ? undefined : writePartialPlan(root, planned.plan);
   debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
-    tests: tests.length, auto, path, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
+    tests: tests.length, auto, ...(path ? { path } : {}), dryRun, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
   return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.from,
     ...(auto ? { auto: true as const } : {}), ...(planned.closure ? { closure: planned.closure } : {}) };
 }
@@ -217,34 +292,87 @@ function savedGraphPath(statePath: string): string | undefined {
 }
 
 /** Refresh the branch tip, then restart the failed run at `from` with the saved graph snapshot. */
-export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+export async function resumeReleaseRun(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.root` must not
   // move this run onto a separate lock inode from the steward resync and the unattended release.
   return withOpSeatFlock(() => resumeReleaseRunLocked(opts, deps));
 }
 
-async function resumeReleaseRunLocked(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+/** Validate a resume without changing the saved run, attempt ledger, or partial-gate plan. */
+export async function planResumeReleaseRun(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps = {}): Promise<ResumeReleasePlan> {
+  return withOpSeatFlock(() => planResumeReleaseRunLocked(opts, deps));
+}
+
+async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps): Promise<ResumeReleasePlan> {
+  if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
+  deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
+  const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
+  const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+  if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
+  if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
+  const hasOverrides = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined
+    || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined;
+  const original = hasOverrides ? savedRun : undefined;
+  if (original && opts.gateExecutor !== undefined) releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost });
+  if (original && opts.gatePodPool !== undefined) releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool });
+  const waiver = original && (opts.waive !== undefined || opts.reason !== undefined) ? releaseResumeWaiver(original, opts) : undefined;
+  if (original && opts.acceptedRegressions !== undefined && !waiver)
+    releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from);
+  const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true, noDecision: true });
+  let waiverCommit: string | undefined;
+  if (waiver) {
+    const output = lastJsonObject(savedRun.nodes.find((node) => node.nodeId === 'version-release')?.output);
+    const version = output?.version, recorded = output?.commit;
+    if (typeof version !== 'string' || typeof recorded !== 'string' || !isReleaseVersion(version) || !/^[0-9a-f]{40}$/i.test(recorded)) throw new Error('release waiver requires a recorded release commit');
+    const git = deps.git ?? gitRunner(deps.repo ?? process.cwd());
+    const branch = `release/${version}`;
+    const advertised = git(['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]).split(/\s+/)[0];
+    if (advertised?.toLowerCase() !== recorded.toLowerCase()) throw new Error('release branch moved — re-gate the new tip before waiving a node');
+    waiverCommit = recorded;
+  }
+  const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
+  const partial = preparePartial(tip, opts, deps, true);
+  const fromIndex = savedRun.path.indexOf(opts.from);
+  const gateIndex = savedRun.path.indexOf('gate');
+  const gateWillRun = fromIndex >= 0 && gateIndex >= fromIndex;
+  const gatePlan = !gateWillRun ? { mode: 'not-run' as const }
+    : partial.requested && partial.applied ? { mode: 'partial' as const }
+      : { mode: 'full' as const, reason: partial.requested ? partial.reason : opts.partial === false ? 'partial recheck disabled' : 'no partial plan applies' };
+  return { runId: opts.runId, version: tip.version, fromNode: opts.from, commandRoot, tip, partial,
+    gatePlan, nextAttempt: attempt.attempt, attemptLimit: 2, preflight: 'passed' };
+}
+
+async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
   // RELEASE-LEDGER-UNIVERSE: decide the universe once; the run lookup and every resumed node use it.
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
   const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
+  const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
   let waiverCommit: string | undefined;
   if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
-  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined
-    ? JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState : undefined;
+  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined
+    ? savedRun : undefined;
   // GATE-HOST-EXECUTOR: checked before the tip refresh writes anything; the runner checks it again under the resume lock.
   const gateExecutor = original && opts.gateExecutor !== undefined
     ? releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost }) : undefined;
+  const gatePodPool = original && opts.gatePodPool !== undefined
+    ? releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool }) : undefined;
   if (gateExecutor) debug.log('release-loop.resume', 'gate-executor', { runId: opts.runId, from: opts.from, executor: gateExecutor.set.gateExecutor, host: gateExecutor.set.gateRemote ?? null, previous: gateExecutor.previous });
+  if (gatePodPool) debug.log('release-loop.resume', 'gate-pod-pool', {
+    runId: opts.runId, from: opts.from, pool: gatePodPool.set.gatePodPool, previous: gatePodPool.previous,
+  });
   const waiver = original && (opts.waive !== undefined || opts.reason !== undefined)
     ? releaseResumeWaiver(original, opts) : undefined;
   if (waiver) debug.log('release-loop.resume', 'waiver', { runId: opts.runId, node: waiver.nodeId, reason: waiver.reason, unmeasured: waiver.unmeasured ?? null });
   const acceptedRegressions = original && opts.acceptedRegressions !== undefined && !waiver
     ? releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from) : undefined;
+  if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
+  // Validate request arguments before the cap, then block the third attempt before tip refresh.
+  reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true });
   // A waived verdict may reuse its original commit. A moved tip still requires a full re-gate.
   if (waiver) {
-    const saved = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
-    const versionRecord = saved.nodes.find((node) => node.nodeId === 'version-release');
+    const versionRecord = savedRun.nodes.find((node) => node.nodeId === 'version-release');
     const output = lastJsonObject(versionRecord?.output);
     const version = output?.version;
     const recorded = output?.commit;
@@ -257,13 +385,21 @@ async function resumeReleaseRunLocked(opts: { runId: string; from: string; parti
   }
   // Check the refreshed tip before refresh writes a new version-release record or backup.
   const tip = refreshReleaseBranchTip(opts.runId, deps, opts.from, waiverCommit);
+  const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
   const partial = preparePartial(tip, opts, deps);
+  // A failed preflight does not consume one of the two release resume attempts.
+  const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now });
+  debug.log('release-loop.resume', 'attempt', { runId: opts.runId, attempt: attempt.attempt, limit: 2, ledger: attempt.path });
   // Resume the graph at the path it was started from (its snapshot is used); only tests inject another path.
   const graphPath = deps.graphPath ?? savedGraphPath(tip.statePath) ?? GRAPH;
+  const savedSource = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;
+  deps.onSource?.(`레시피 출처: graph=${graphPath} · graph sha=${savedSource.graphSnapshot?.graphSha?.slice(0, 12) ?? 'legacy'} · recipes sha=${savedSource.graphSnapshot?.recipesSha?.slice(0, 12) ?? 'legacy'} · command-root=${commandRoot} · 컷 tip=${tip.to.slice(0, 12)}`);
   const state = await (deps.graph ?? runGraph)(graphPath, { resumeRunId: opts.runId, fromNodeId: opts.from, pinChildUniverse: true,
+    releaseCommandSource: { root: commandRoot, cutTip: tip.to, ...(deps.git ? { git: deps.git } : {}) },
     ...(waiver ? { releaseWaiver: { ...waiver, requestedRegressions: opts.acceptedRegressions ?? [] } } : {}),
     ...(acceptedRegressions ? { releaseAcceptedRegressions: { requested: opts.acceptedRegressions!, acceptedRegressions } } : {}),
     ...(gateExecutor ? { releaseGateExecutor: { executor: gateExecutor.set.gateExecutor, ...(opts.gateHost !== undefined ? { host: opts.gateHost } : {}) } } : {}),
+    ...(gatePodPool ? { releaseGatePodPool: gatePodPool.set.gatePodPool } : {}),
     deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
   return { tip, partial, state };
 }

package/scripts/release-loop/resume.ts

@@ -137,6 +137,28 @@ export interface GateExecutorOverride {
   previous: { gateExecutor: unknown; gateRemote: unknown };
 }
 
+/** RESUME-GATE-POOL-OVERRIDE — replace the saved pool for a gate that will be re-run. */
+export interface GatePodPoolOverride {
+  kind: 'gate-pod-pool';
+  at: string;
+  from: string;
+  set: { gatePodPool: string };
+  previous: { gatePodPool: unknown };
+}
+
+export function releaseResumeGatePodPool(state: GraphRunState, opts: { from: string; pool: unknown; at?: string }): GatePodPoolOverride {
+  const input = state.input;
+  if (!input || typeof input !== 'object' || Array.isArray(input) || typeof (input as { version?: unknown }).version !== 'string') throw new Error('release run has no input');
+  if (typeof opts.pool !== 'string' || !opts.pool.trim()) throw new Error('--gate-pod-pool must not be empty');
+  const start = state.path.indexOf(opts.from);
+  if (start < 0) throw new Error(`--from ${opts.from} is not a node on the saved path`);
+  const gate = state.path.indexOf('gate');
+  if (gate >= 0 && start > gate) throw new Error('--gate-pod-pool needs a resume that re-runs gate (--from gate or earlier)');
+  const saved = input as { gatePodPool?: unknown };
+  return { kind: 'gate-pod-pool', at: opts.at ?? new Date().toISOString(), from: opts.from,
+    set: { gatePodPool: opts.pool.trim() }, previous: { gatePodPool: saved.gatePodPool ?? null } };
+}
+
 /**
  * Switch the gate executor of a resumed release run. Not a waiver: the gate node runs again (the restart must be at or
  * before gate) and produces a normal verdict; only where its sweep runs changes.
@@ -156,7 +178,8 @@ export function releaseResumeGateExecutor(state: GraphRunState, opts: { from: st
   // A restart after gate keeps the recorded verdict — switching its executor there would record a choice nothing used.
   if (gate >= 0 && start > gate) throw new Error('--gate-executor needs a resume that re-runs gate (--from gate or earlier)');
   // Back to pod: restore the gateRemote the run started with (an earlier host override replaced it).
-  const firstHost = choice.executor === 'pod' ? state.inputOverrides?.find((item) => item.kind === 'gate-executor' && item.set.gateRemote !== undefined) : undefined;
+  const firstHost = choice.executor === 'pod' ? state.inputOverrides?.find((item): item is GateExecutorOverride =>
+    item.kind === 'gate-executor' && item.set.gateRemote !== undefined) : undefined;
   const restored = firstHost ? firstHost.previous.gateRemote : undefined;
   return {
     kind: 'gate-executor', at: opts.at ?? new Date().toISOString(), from: opts.from,

package/scripts/release-loop/tui-sim-node.ts

@@ -16,7 +16,7 @@ import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 import { copyFileSync, existsSync, mkdtempSync, openSync, symlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
-import { parseTuiRegress, regressWarning, tuiChecks, tuiVerdict, type TuiCheck, type TuiRegress } from './tui-node-checks';
+import { parseTuiRegress, regressWarning, tuiChecks, tuiVerdict, validatedTuiRegress, type TuiCheck, type TuiRegress } from './tui-node-checks';
 
 const log = (msg: string) => process.stderr.write(`[tui-node] ${msg}\n`);
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
@@ -83,7 +83,13 @@ export function measureTuiRegress(worktree: string, runner: typeof spawnSync = s
 export function tuiNodeOutput(commit: string, attempts: Array<{ checks: TuiCheck[]; png?: string }>, regress: TuiRegress, failure?: string) {
   const last = attempts.at(-1);
   const verdict = !last ? 'error' : tuiVerdict(last.checks) === 'fail' ? 'fail' : attempts.length > 1 ? 'flaky' : 'pass';
-  return { verdict, commit, attempts: attempts.length, checks: last?.checks ?? [], png: last?.png, regress, ...(failure ? { error: failure } : {}) };
+  const measured = validatedTuiRegress(regress);
+  const regressSummary = 'unmeasured' in measured
+    ? `regress unmeasured: ${measured.unmeasured}`
+    : `regress ${measured.pass} pass / ${measured.fail} fail${measured.fail ? ` (${measured.results.filter((r) => !r.ok).map((r) => r.id).join(',')})` : ''}`;
+  const checks = last?.checks ?? [];
+  const summary = `TUI ${verdict}: basic ${checks.filter((check) => check.pass).length}/${checks.length} · ${regressSummary}`;
+  return { verdict, summary, commit, attempts: attempts.length, checks, png: last?.png, regress: measured, ...(failure ? { error: failure } : {}) };
 }
 
 async function main(): Promise<number> {

package/scripts/release-loop/unattended-release.ts

@@ -10,6 +10,7 @@ import { isLandingFreezeRefusal, readLandingFreeze, LandingFrozenError } from '.
 import { debug } from '../../src/debug/log.js';
 import { runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
+import { ReleaseRunClaimConflict, findActiveReleaseRun } from '../../src/cli/release-single-flight.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { baseVersion, isStableVersion, nextPrereleaseVersion, type PrereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
@@ -19,6 +20,8 @@ const VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
 export interface ReleaseLoopConfig {
+  /** Mid-cycle full-gate rehearsal, hours before cut (default 12; 0 disables). */
+  rehearsalHardIntervalHours?: number;
   gatePodPool?: string;
   gatePodBunCache?: string;
   gatePodShards?: number;
@@ -36,6 +39,8 @@ export interface ReleaseLoopConfig {
   gatePodCpu?: number | string | { request?: number | string; limit?: number | string };
   gateRemote?: string;
   gateRemoteMirror?: string;
+  /** RELEASE-PWA-NODE-RESILIENCE ① — SSH host the `pwa` node runs its scenario suite on (e.g. `node-b`); absent = this machine. No fallback. */
+  pwaRemote?: string;
   opsHosts?: string[];
   internalDist?: string;
   opsRestart?: boolean;
@@ -138,7 +143,7 @@ export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDep
 
 /** Fail closed at the entry boundary, before any graph node can change a release. */
 export async function runUnattendedRelease(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps = {},
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // A dry run only builds the input and mutates nothing, so it neither creates nor waits on the OP-seat lock.
@@ -149,7 +154,7 @@ export async function runUnattendedRelease(
 }
 
 async function runUnattendedReleaseLocked(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps,
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
@@ -188,6 +193,9 @@ async function runUnattendedReleaseLocked(
   if (beforeGraph && !opts.forceFreeze) throw new LandingFrozenError(beforeGraph);
   // RELEASE-LEDGER-UNIVERSE: one universe for the run ledger, the release ledger and every node subprocess.
   const root = releaseRunUniverse({ root: deps.ledgerRoot });
+  // Resume and fresh runs share the OP-seat flock. Recheck under that flock so a
+  // resume that began after CLI preflight cannot slip between the ledger scan and graph start.
+  if (!opts.forceNew && findActiveReleaseRun(version, root)) throw new ReleaseRunClaimConflict();
   const state = await (deps.graph ?? runGraph)(GRAPH, { input, pinChildUniverse: true, deps: { root } });
   // A freeze switched on while the graph ran stops gate or publish inside it. Only a failed gate/publish node whose own
   // record is the freeze refusal is reported as the freeze; any other failure keeps its own reason.

package/scripts/test-diet/lib.ts

@@ -93,7 +93,12 @@ export type Verdict = 'keep' | 'failing' | 'review';
 export type Proposal = 'delete' | 'shrink' | 'rewrite-cheap' | 'move-out-of-gate' | 'investigate';
 export interface Td1Disposition { disposition: string; alternative: string; guards: string; why_slow: string }
 export interface Judged extends Measurement { caught90: number; flags: string[]; verdict: Verdict; effectiveness?: Effectiveness; proposal?: Proposal | null; basis?: string | null }
-export interface LedgerLine { at: string; range: string; start: number; end: number; next: number; total: number; commit: string; budgetSecs: number; results: Judged[]; sweepVisited?: number; sweepCostSecs?: number; sweepSlices?: number }
+export interface LedgerLine {
+  at: string; range: string; start: number; end: number; next: number; total: number; commit: string; budgetSecs: number; results: Judged[];
+  /** Exact non-contiguous selection; `range` encodes these indices in selection order. */
+  selectedFiles?: string[]; selectedIndices?: number[];
+  sweepVisited?: number; sweepCostSecs?: number; sweepSlices?: number;
+}
 
 /** `file\tsecs\t…` (TD1 whole-gate TSV) → seconds per file. */
 export function costTable(tsv: string): Map<string, number> {