elanous 0.2.34 → 0.2.36

package/scripts/release-loop/gate-node.ts

@@ -4,7 +4,7 @@ import { appendFileSync, chmodSync, copyFileSync, existsSync, mkdirSync, mkdtemp
 import { hostname, tmpdir } from 'node:os';
 import { createHash, randomUUID } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
-import { debug } from '../../src/debug/log.js';
+import { debug, redactSecretText } from '../../src/debug/log.js';
 import { registerStandaloneLogSink } from '../../src/domains/standalone-log-sink.js';
 import { landingFreezeMessage, readLandingFreeze } from '../../src/release-loop/landing-freeze.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
@@ -12,9 +12,14 @@ import { getElanousConfigDirOverride } from '../../src/elanous-config-dir.js';
 import { diffFailures, junitFailures, parseFailures, parseTimedOutFailures } from './gate-diff';
 import { loadEnvKnownFailures, splitKnownEnv } from './env-known-failures';
 import { loadGateBatchSafe } from './gate-batch-safe';
+import { gateHistory } from './gate-history.js';
 import { baselineFromCutLogs } from './baseline-from-logs';
-import { mergePartialFailures, readPartialPlan, testFileOfId, verifyDocsOnlyCarry } from './gate-partial';
+import { mergePartialFailures, readPartialPlanResult, testFileOfId, verifyDocsOnlyCarry } from './gate-partial';
 import { planGateRadiusShadow, shadowActual, writeGateRadiusShadow, type GateRadiusShadowPlan } from './gate-radius-shadow';
+import { planHardRehearsalRadius, partialGateImagesMatch, preflightGateImageDigest } from './gate-radius-live';
+import { actualGatePodImageDigest, gateBaselineReceipt, gateEnvFingerprint, gateGraphPins, gateSourcePins,
+  POD_SWEEP_INTEGRATION_ONLY } from './gate-baseline-receipt';
+export { POD_SWEEP_INTEGRATION_ONLY } from './gate-baseline-receipt';
 import { logPlanWalltime, planDurations, readFileMemory } from './shard-plan';
 import { defaultGateHostMirrorReaders, resolveGateHostMirror, type GateHostMirror, type GateHostMirrorReaders } from './gate-host-mirror';
 import { isGateSpawnLaneFile, planGateSpawnSeparatedShards } from './spawn-lane';
@@ -67,6 +72,8 @@ export function warmCommandMatchesRequest(command: WarmWorkerCommand, request: O
 }
 
 interface CommandResult { rc: number; output: string; passedIds?: string[]; stalledEnv?: Array<{ file: string; reason: 'no-output' }>; timedOut?: boolean;
+  /** Identity and complete selected inventory of this Pod sweep; only the producer may issue it. */
+  podSweep?: { id: string; shards: number; files: string[] };
   /** Complete, source-bound one-file Job result for shadow comparison; absent means unmeasured. */
   warmReference?: WarmWorkerFileResult | null;
   warmAttemptId?: string;
@@ -74,7 +81,35 @@ interface CommandResult { rc: number; output: string; passedIds?: string[]; stal
   /** GATE-POD-STALL-FAILFAST ① — shard Pods whose tests the mid-run watch aborted in this sweep. */
   abortedShards?: number;
   /** Each contributing Pod leaf already passed failuresOf; repeated printed ids cannot add new failures. */
-  validatedShards?: boolean }
+  validatedShards?: boolean
+  /** GATE-RISK-LANE — the watch-list shard this sweep ran first, with its plan and measurement (observation only). */
+  riskLane?: GateRiskLaneRecord }
+function redactedGateLogTail(input: string): string {
+  // Redact before trimming: a truncated token might no longer match the redaction rule.
+  const bytes = Buffer.from(redactSecretText(input), 'utf8');
+  let start = Math.max(0, bytes.length - 16_384);
+  while (start < bytes.length && (bytes[start]! & 0xc0) === 0x80) start++;
+  return bytes.subarray(start).toString('utf8');
+}
+/**
+ * GATE-FLOW-SIM — the gate's outside world as one seam: a scenario hands in the repo's fake clock
+ * (`src/ux-sim/fake-clock.ts`) plus fake Pod/kubectl/ssh tools, and the production entry hands in nothing.
+ * Every field falls back to the real tool, so an absent seam is today's behaviour byte for byte.
+ */
+export interface GateTools {
+  /** Wall clock the gate measures with; absent = `Date.now`. */
+  now?: () => number;
+  /** The Pod Job runner (the fake Pod stage of a scenario); absent = the positional `podCommand`, else `runPodCommand`. */
+  podCommand?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
+  /** Kubernetes client (pool readiness · Pod lifecycle · Job log tail · failure evidence); absent = `defaultKubectl`. */
+  kubectl?: typeof defaultKubectl;
+  /** SSH transport behind {@link GateRunner.command} on a remote host; absent = a real `ssh` child. */
+  ssh?: (host: string, script: string, limitMs?: number) => { rc: number; output: string; timedOut?: boolean };
+  /** SSH reachability probe of a multi-host roster; absent = `defaultRemoteRun`. */
+  remoteRun?: typeof defaultRemoteRun;
+  /** Pool admission a shard waits on (leases ⊕ a cluster reading); absent = the gate's own pool admission. */
+  admission?: GateAdmission;
+}
 export interface GateRunner {
   command(cmd: string, args: string[], cwd: string, limitMs?: number): Promise<CommandResult>;
   localCommand(cmd: string, args: string[], cwd: string, limitMs?: number): Promise<CommandResult>;
@@ -90,9 +125,15 @@ export interface GateRunner {
   removeSnapshot(tree: string): Promise<void>;
   /** Absolute remote bare mirror path, set before preparing the remote trees. */
   remoteMirror?: string;
+  /** GATE-FLOW-SIM — the clock this runner measures with (the injected fake clock in a scenario); absent = `Date.now`. */
+  now?(): number;
 }
 export interface GateOptions {
   commit: string;
+  /** The graph run that launched this gate; direct hard rehearsal instead pins source bytes explicitly. */
+  graphRunId?: string;
+  /** Only a direct hard rehearsal may pin graph bytes from its measured Git commit. */
+  rehearsalBaseline?: boolean;
   forceFreeze?: boolean;
   version: string;
   baselineVersion?: string;
@@ -113,6 +154,8 @@ export interface GateOptions {
     /** Opt-in gate shadow: provider fills the fenced lease identity. The Job remains authoritative. */
     warmReplay?: (input: Omit<WarmWorkerCommand, 'leaseId' | 'generation' | 'workerId' | 'key'>) => Promise<{ command: WarmWorkerCommand | null; transport: WarmPodTransportResult }>;
     warmQuarantine?: (command: WarmWorkerCommand, reason: string) => Promise<void>;
+    /** Explicit gate-profile producer handoff; shadow-only callers keep their Job path. */
+    warmProducerEnabled?: boolean;
     warmFinalize?: (command: WarmWorkerCommand) => Promise<void>;
     /** Set only on the cut recheck; baseline Jobs never consume the cut worker. */
     warmCutSha?: string;
@@ -154,6 +197,9 @@ export interface GateOptions {
     liveLog?: (job: { name: string; context?: string }) => string | null;
     /** false = the stop did not take; the watch asks again every poll until it does (void = taken). */
     stopJob?: (job: { name: string; context?: string }) => boolean | void;
+    /** Failure-only Pod status and log reader; injected tests never call the live cluster. */
+    failureEvidence?: (job: { name: string; context?: string }) => { podName?: string; termination?: { reason?: string; message?: string; exitCode?: number; finishedAt?: string }; logTail?: string; error?: string };
+    failureKubectl?: typeof defaultKubectl;
     /** How often the stall watch reads the live log (ms); omitted = {@link GATE_POD_STALL_POLL_MS}. */
     stallPollMs?: number;
     /** GATE-POD-STALL-FAILFAST ① — seconds a shard may go without its part logs growing once test output began, before
@@ -165,6 +211,8 @@ export interface GateOptions {
     abortTests?: (job: { name: string; context?: string }, reason: string) => boolean | void;
     /** GATE-LIVE-OBS — the shard state file (`gateShardsPath(version)`) this sweep keeps current; absent = not written. */
     shardsFile?: { path: string; version: string };
+    /** GATE-RISK-LANE — the ledgers `gateHistory` reads its watch list from; absent = no risk lane (the sweep plans as before). */
+    riskWatch?: { instanceRoots: readonly string[]; ledgerRoots: readonly string[] };
     /** GATE-MULTI-HOST — is this pool member reachable (kubectl ns ⊕ ssh)? Injected by tests; absent = the real probe on
      *  the gate's own pool · an injected pool without it never marks a member down (unchanged). */
     probeMember?: (member: PodPoolMember) => boolean;
@@ -182,7 +230,7 @@ export function withWarmGateHooks(opts: GateOptions, config: unknown, injectedRu
     && config.pod && typeof config.pod === 'object' && 'warmReuse' in config.pod
     ? config.pod.warmReuse as WarmReuseSwitchConfig : undefined;
   return { ...opts, pod: { ...opts.pod, warmReplay: requestWarmPodReplay,
-    warmFinalize: finalizeWarmPodReplay, warmQuarantine: quarantineWarmPodReplay, warmReuseConfig } };
+    warmFinalize: finalizeWarmPodReplay, warmQuarantine: quarantineWarmPodReplay, warmProducerEnabled: true, warmReuseConfig } };
 }
 export interface GateResult {
   outcome: 'ok' | 'regression' | 'error';
@@ -218,6 +266,10 @@ export interface GateResult {
     /** GATE-POD-STALL-FAILFAST — the shard (and its one fresh retry) printed no test output within the stall window: unmeasured. */
     stall?: { seconds: number; sinceCheckoutMs: number } }>;
   partialSummary?: { pass: number; fail: number; errors: number; ran: number; files: number };
+  /** Number of complete shards retained when an incomplete sweep is resumed. */
+  preservedShardCount?: number;
+  /** Completed shard measurements retained when another shard stalled, so same-commit resume can reuse them safely. */
+  partialFailures?: SweepFailures;
   /** GATE-PARTIAL — this verdict re-ran only these files and carried the prior gate's results for the rest. */
   partial?: { priorCommit: string; files: number };
   /** GATE-INTRO-RECHECK — new failures that were only the «timed out» shape and passed one isolated re-run with a
@@ -507,6 +559,71 @@ export function shardParts(paths: readonly string[], seconds: (file: string) =>
   if (current.length) parts.push(current);
   return parts;
 }
+/** GATE-RISK-LANE — the watched files this sweep ran first, and how that shard was planned and measured. */
+export interface GateRiskLaneRecord { files: string[]; plannedSeconds: number; durationMs: number; rc: 0 | 1 | null }
+
+/** GATE-RISK-LANE — the shard plan plus the risk shard it may have placed first. */
+export interface GateRiskLanePlan {
+  /** Execution order: the risk shard first (absent when nothing is watched), then the current plan unchanged. */
+  shards: Array<{ files: string[]; plannedSeconds: number }>;
+  /** Assignable files this plan treated as risk — exactly `shards[0].files`; empty means «the current plan». */
+  riskFiles: string[];
+  riskPlannedSeconds: number;
+  spawnFiles: string[];
+  spawnShardCount: number;
+}
+
+/**
+ * GATE-RISK-LANE — the watch list the gate-history table already keeps (`gateHistory().watchList`: introduced or flaky
+ * in at least two of the last three releases). Reading it never blocks a gate: an unreadable ledger set is «no list».
+ */
+export function readGateRiskWatchList(o: { instanceRoots: readonly string[]; ledgerRoots: readonly string[] }): string[] {
+  try { return gateHistory({ instanceRoots: o.instanceRoots, ledgerRoots: o.ledgerRoots }).watchList; }
+  catch (error) {
+    debug.log('release-loop.gate', 'risk-lane-watch-unavailable', { reason: String(error) });
+    return [];
+  }
+}
+
+/**
+ * GATE-RISK-LANE (0.2.36) — the next full sweep runs the files the watch list names in its first shard, so a repeat
+ * regression breaks before the general shards spend their deadline. Only the order changes:
+ * - a watched heavy file already runs alone at the isolation limit, and a watched spawn file keeps its own lane (a part
+ *   mixing real child/PTY files with regular ones is refused by {@link gateShardShell}) — neither joins the risk shard;
+ * - every assignable file is assigned exactly once: the risk files leave the lane they would have been balanced into;
+ * - with no watch list, or one that names no file of this sweep, the plan is today's plan byte for byte;
+ * - when the watch list hits, the sweep runs exactly one more shard than configured (the risk shard in front), which is
+ *   the same trade the configuration already makes for spawning a Pool Job.
+ */
+export function planGateRiskLaneShards(o: { assignable: readonly string[]; durations: Map<string, number>; shardCount: number;
+  heavy: ReadonlySet<string>; watchList: readonly string[] }): GateRiskLanePlan {
+  const light = o.assignable.filter((file) => !o.heavy.has(file));
+  const watched = new Set(o.watchList);
+  const riskFiles = [...new Set(light)].filter((file) => watched.has(file) && !isGateSpawnLaneFile(file)).sort();
+  const heavyShards = [...o.heavy].map((file) => ({ files: [file], plannedSeconds: o.durations.get(file) ?? 0 }));
+  const planWith = (files: readonly string[]) => planGateSpawnSeparatedShards(files, o.durations, o.shardCount);
+  if (!riskFiles.length) {
+    const current = planWith(light);
+    return { shards: [...current.shards, ...heavyShards], riskFiles: [], riskPlannedSeconds: 0,
+      spawnFiles: current.spawnFiles, spawnShardCount: current.spawnShardCount };
+  }
+  const risk = new Set(riskFiles);
+  const rest = planWith(light.filter((file) => !risk.has(file)));
+  // An unmeasured file takes the same median weight planShards gives it, so the shard's plan stays comparable.
+  const known = o.assignable.map((file) => o.durations.get(file))
+    .filter((value): value is number => value !== undefined && Number.isFinite(value) && value >= 0).sort((a, b) => a - b);
+  const median = known.length ? (known[Math.floor((known.length - 1) / 2)]! + known[Math.floor(known.length / 2)]!) / 2 : 1;
+  const plannedSeconds = riskFiles.reduce((sum, file) => {
+    const value = o.durations.get(file);
+    return sum + (value !== undefined && Number.isFinite(value) && value >= 0 ? value : median);
+  }, 0);
+  return {
+    shards: [{ files: [...riskFiles], plannedSeconds }, ...rest.shards, ...heavyShards],
+    riskFiles: [...riskFiles], riskPlannedSeconds: plannedSeconds,
+    spawnFiles: rest.spawnFiles, spawnShardCount: rest.spawnShardCount,
+  };
+}
+
 /**
  * GATE-ENV-BASELINE (W5 · 10-15) — the gate shard Pod's deterministic test env, exported before anything runs.
  * 0.2.29 gate failures were the Pod's «environment», not the code: no LLM provider · `man` stubbed · CLI spawn timeouts.
@@ -530,7 +647,8 @@ export function gateEnvBaselineLine(env: Readonly<Record<string, string>> = gate
  * `shard.timeout` so the artifact reader does not mistake an unfinished child for a test verdict.
  * A part without `.rc` did not finish. The shell itself always exits 0 (as before).
  */
-export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPatterns: readonly string[]; softSeconds: number; cachePrefix: string; installSlots: number; depsDir?: string; beatSeconds?: number; parallelParts?: number; testTimeoutMs?: number; partLimitSeconds?: number; sourceBinding?: { cutSha: string; attemptId: string } }): string {
+export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPatterns: readonly string[]; softSeconds: number; cachePrefix: string; installSlots: number; depsDir?: string; beatSeconds?: number; parallelParts?: number; testTimeoutMs?: number; partLimitSeconds?: number; rulesBaseSha?: string; sourceBinding?: { cutSha: string; attemptId: string } }): string {
+  if (o.rulesBaseSha !== undefined && !/^[0-9a-f]{40}$/.test(o.rulesBaseSha)) throw new Error('invalid rules gate base SHA');
   // The planner keeps spawn files in their own shards; reject a mixed part rather than silently lose its limit.
   for (const part of o.parts) {
     if (part.some(isGateSpawnLaneFile) && !part.every(isGateSpawnLaneFile)) throw new Error('gate spawn lane part mixed with regular tests');
@@ -573,6 +691,7 @@ export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPa
     ...(o.beatSeconds ? gateBeatScript(o.beatSeconds, o.installSlots > 0) : []),
     ...(o.cachePrefix ? [o.cachePrefix] : []),
     gateEnvBaselineLine(),
+    ...(o.rulesBaseSha ? [`export ELANOUS_GATE_BASE_SHA=${quote(o.rulesBaseSha)}`] : []),
     // Seconds since this container's PID 1 started (the clone ran before this shell) — 0 when /proc cannot tell.
     `pod_age=$(awk -v t="$(cut -d' ' -f22 /proc/1/stat 2>/dev/null)" -v hz="$(getconf CLK_TCK 2>/dev/null)" '{ if (t > 0 && hz > 0) print int($1 - t / hz); else print 0 }' /proc/uptime 2>/dev/null)`,
     'case "$pod_age" in ""|*[!0-9]*) pod_age=0;; esac',
@@ -971,7 +1090,7 @@ export function readShardArtifacts(dir: string, parts: readonly (readonly string
 export const gateUnfinishedHint = (relativePath: string, bytes: number) => `[gate] unfinished: ${relativePath} · ${bytes}B (진행 중 part 출력은 그 파일)`;
 
 // review-model-ab: Pod 에서 출력 없이 멈춤 2/2(10-04 0.2.11 · 로컬 단독 4/0 · 1.7s) — GATE-STALL 수리 전까지 Pod 밖.
-export const POD_SWEEP_INTEGRATION_ONLY: readonly string[] = ['scripts/install.test.ts', 'scripts/review-model-ab.test.ts'];
+// The shared exclusion list lives in gate-baseline-receipt so radius verification uses the producer's rule.
 /** Nightly-only whole-repository cases; gate runs the fixture cases in these same files. */
 export const GATE_NIGHTLY_AUDITS: readonly string[] = [
   // Replaces F12's real-repo bucket B apps/pwa scope check and its whole-repo export partition check.
@@ -1132,7 +1251,8 @@ export function readIsolatedRun(run: CommandResult, label: string, file: string)
 }
 
 class StalledPodShards extends Error {
-  constructor(readonly stalledShards: NonNullable<GateResult['stalledShards']>, readonly partialSummary: NonNullable<GateResult['partialSummary']>, readonly abortedShards = 0) {
+  constructor(readonly stalledShards: NonNullable<GateResult['stalledShards']>, readonly partialSummary: NonNullable<GateResult['partialSummary']>,
+    readonly partialFailures: SweepFailures, readonly preservedShardCount: number, readonly abortedShards = 0) {
     const unmeasured = stalledShards.filter((item) => item.stall);
     const exitCode = stalledShards.filter((item) => item.reason === 'exit-code');
     super(`pod sweep incomplete: stalled shards ${stalledShards.map(({ shard }) => shard).join(', ')}`
@@ -1142,6 +1262,23 @@ class StalledPodShards extends Error {
   }
 }
 
+/** Read completed shard failures without letting one malformed shard hide the stalled-shard verdict. */
+export function partialFailuresOf(runs: readonly (CommandResult & { files: number })[]): SweepFailures {
+  return runs.reduce<SweepFailures>((sum, run) => {
+    try {
+      const parsed = failuresOf({ rc: run.rc, output: run.output, validatedShards: true }, `pod partial shard ${run.files}`);
+      sum.failures.push(...parsed.failures);
+      sum.errors.push(...parsed.errors);
+    } catch (error) {
+      debug.log('release-loop.gate', 'pod-partial-failures-unreadable', {
+        files: run.files,
+        reason: error instanceof Error ? error.message : String(error),
+      }, { level: 'warn' });
+    }
+    return sum;
+  }, { failures: [], errors: [] });
+}
+
 class WarmRecheckIncomplete extends Error {
   constructor(message: string, readonly file: string, readonly shadow: WarmShadowObservation) { super(message); }
 }
@@ -1225,9 +1362,9 @@ export const gateAdmissionWaitText = (reading: string | null) => `메모리 여
  * the shard runs again on the others — one dead host no longer stops the gate. One-member pools keep the old behaviour.
  */
 export const GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT = 600;
-export function defaultGateMemberProbe(member: PodPoolMember): boolean {
-  if (!checkPodPool([member], defaultKubectl).ok) return false;
-  return !member.sshHost || defaultRemoteRun(member.sshHost, 'true').status === 0;
+export function defaultGateMemberProbe(member: PodPoolMember, tools: GateTools = {}): boolean {
+  if (!checkPodPool([member], tools.kubectl ?? defaultKubectl).ok) return false;
+  return !member.sshHost || (tools.remoteRun ?? defaultRemoteRun)(member.sshHost, 'true').status === 0;
 }
 
 export function poolGateAdmission(pool: PodPoolScheduler): GateAdmission {
@@ -1261,8 +1398,27 @@ export async function admitGateShard(admission: GateAdmission | undefined, o: {
   }
 }
 
-export function createGateRunner(repo: string, remote?: string, commandOverride?: GateRunner['command'], podCommand: (options: RunPodCommandOptions) => Promise<PodCommandResult> = runPodCommand, poolOverride?: PodPoolScheduler, podLogTail?: (job: PodCommandResult) => string): GateRunner {
+/**
+ * The real `ssh` transport behind {@link GateRunner.command} on a remote host. A scenario replaces it through
+ * {@link GateTools.ssh} so the gate flow can run without any remote call.
+ */
+export function defaultSshCommand(host: string, script: string, limitMs?: number): { rc: number; output: string; timedOut?: boolean } {
+  // Start in /tmp, not the caller checkout. macOS resolves that symlink to /private/tmp before the child sees it;
+  // the remote command still `cd`s to the quoted path, so either spelling is the same directory.
+  const run = spawnSync('ssh', [host, script],
+    { cwd: '/tmp', encoding: 'utf8', maxBuffer: 128 * 1024 * 1024, ...(limitMs ? { timeout: limitMs + 60_000, killSignal: 'SIGKILL' as const } : {}) });
+  const timedOut = !!limitMs && (run.status === 124 || run.status === 137 || (run.error as NodeJS.ErrnoException | undefined)?.code === 'ETIMEDOUT');
+  return { rc: run.status ?? 2, output: `${run.stdout ?? ''}\n${run.stderr ?? ''}${run.error ? `\n${run.error}` : ''}`, ...(timedOut ? { timedOut } : {}) };
+}
+
+export function createGateRunner(repo: string, remote?: string, commandOverride?: GateRunner['command'], podCommand: (options: RunPodCommandOptions) => Promise<PodCommandResult> = runPodCommand, poolOverride?: PodPoolScheduler, podLogTail?: (job: PodCommandResult) => string, tools: GateTools = {}): GateRunner {
   let remoteMirror: string | undefined;
+  // GATE-FLOW-SIM: the one place the real outside world is named — an injected seam replaces it, absent = today's tools.
+  const clock = tools.now ?? Date.now;
+  const kubectl = tools.kubectl ?? defaultKubectl;
+  const ssh = tools.ssh ?? defaultSshCommand;
+  const remoteRun = tools.remoteRun ?? defaultRemoteRun;
+  const runPod = tools.podCommand ?? podCommand;
   // GATE-HOSTMIRROR-EXPLICIT: resolved once per runner and handed to every podCommand (shard · retry · recheck).
   let gateMirror: GateHostMirror | undefined;
   const gateHostMirror = (pod: NonNullable<GateOptions['pod']>): { hostMirror?: string } => {
@@ -1283,15 +1439,21 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       // GNU timeout signals its own process group: -s KILL would kill timeout too (ssh 255), so TERM first then KILL after 10s (124 / 137).
       // No coreutils timeout on the remote → run unlimited there and rely on the local ssh deadline.
       const limitPrefix = limitMs ? `$(command -v timeout >/dev/null 2>&1 && echo 'timeout -k 10 ${Math.ceil(limitMs / 1000)}') ` : '';
-      // Start in /tmp, not the caller checkout. macOS resolves that symlink to /private/tmp before the child sees it;
-      // the remote command still `cd`s to the quoted path, so either spelling is the same directory.
-      const run = spawnSync('ssh', [remote, `PATH=$HOME/.bun/bin:/opt/homebrew/bin:$PATH; export PATH; cd ${quote(cwd)} && ${limitPrefix}${[cmd, ...args].map(quote).join(' ')}`],
-        { cwd: '/tmp', encoding: 'utf8', maxBuffer: 128 * 1024 * 1024, ...(limitMs ? { timeout: limitMs + 60_000, killSignal: 'SIGKILL' as const } : {}) });
-      const timedOut = !!limitMs && (run.status === 124 || run.status === 137 || (run.error as NodeJS.ErrnoException | undefined)?.code === 'ETIMEDOUT');
-      return { rc: run.status ?? 2, output: `${run.stdout ?? ''}\n${run.stderr ?? ''}${run.error ? `\n${run.error}` : ''}`, ...(timedOut ? { timedOut } : {}) };
+      return ssh(remote, `PATH=$HOME/.bun/bin:/opt/homebrew/bin:$PATH; export PATH; cd ${quote(cwd)} && ${limitPrefix}${[cmd, ...args].map(quote).join(' ')}`, limitMs);
     }
     : localCommand);
+  const rulesGateBaseFor = async (commit: string, files: readonly string[]): Promise<string | undefined> => {
+    if (!files.includes('test/rules-contract.test.ts')) return undefined;
+    // The gate mirror only receives pinned commit refs, so its Pod checkout has no origin/main.
+    // Resolve the same merge-base in the source repository and pass the exact commit to the Pod.
+    const resolved = await localCommand('git', ['merge-base', commit, 'origin/main'], repo);
+    if (resolved.rc !== 0) throw new Error(`rules gate base unavailable for ${commit.slice(0, 12)}: ${tail40(resolved.output)}`);
+    const base = resolved.output.trim();
+    if (!/^[0-9a-f]{40}$/.test(base)) throw new Error(`rules gate base invalid for ${commit.slice(0, 12)}: ${base}`);
+    return base;
+  };
   const podSweep = async (tree: string, logDir: string | undefined, pod: NonNullable<GateOptions['pod']>, only?: readonly string[]): Promise<CommandResult> => {
+    const sweepId = randomUUID();
     const shardCount = pod.shards ?? 24;
     const isolationConcurrency = pod.isolationConcurrency ?? 4;
     // GATE-TIMEOUT-HEAL ①: the configured value is the floor; each shard's own deadline is shardDeadlineSeconds(planned).
@@ -1303,7 +1465,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     check(head, 'cut tree HEAD');
     const commit = head.output.trim();
     if (!/^[0-9a-f]{40}$/.test(commit)) throw new Error('invalid cut tree HEAD');
-    const selectionStart = Date.now();
+    const selectionStart = clock();
     const listed = await command('git', ['ls-files', '*.test.*'], tree);
     check(listed, 'git ls-files tests');
     const allFiles = listed.output.split(/\r?\n/).filter((file) => /\.test\.(?:tsx?|jsx?|mts|cts)$/.test(file)).sort();
@@ -1313,6 +1475,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const missing = only?.filter((file) => !allFiles.includes(file)) ?? [];
     if (missing.length) throw new Error(`partial plan file missing at this commit: ${missing.slice(0, 5).join(', ')}`);
     const files = onlySet ? allFiles.filter((file) => onlySet.has(file)) : allFiles;
+    const rulesBaseSha = await rulesGateBaseFor(commit, files);
     if (files.some((file) => file.startsWith('-') || file.startsWith('/') || file.startsWith('./')
       || file.split('/').some((part) => !part || part === '.' || part === '..') || /[\r\n]/.test(file))) throw new Error('unsafe pod test path');
     if (new Set(files).size !== files.length) throw new Error('duplicate pod test path');
@@ -1332,12 +1495,14 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     // The TD1 measurements predate the fixture-only gate; do not isolate those five files at their old 2–13 GB peaks.
     const fixtureOnly = new Set([...GATE_NIGHTLY_AUDITS, 'test/guardian/dispatch-surface-contract.test.ts', 'test/user-config-mcp.test.ts']);
     const heavy = new Set(assignable.filter((file) => !fixtureOnly.has(file) && (memory.get(file) ?? 0) >= POD_HEAVY_FILE_MB));
-    const { shards: lightShards, spawnFiles: spawnLane, spawnShardCount } = planGateSpawnSeparatedShards(assignable.filter((file) => !heavy.has(file)), durations, shardCount);
-    const shards = [
-      ...lightShards,
-      ...[...heavy].map((file) => ({ files: [file], plannedSeconds: durations.get(file) ?? 0 })),
-    ];
-    if (spawnLane.length) debug.log('release-loop.gate', 'pod-spawn-lane', { files: spawnLane, shards: spawnShardCount });
+    // GATE-RISK-LANE — the failure history this sweep already keeps (`gateHistory().watchList`) puts its watched files in
+    // the first shard; heavy files stay solo and spawn files keep their own lane, so the rest of the plan is unchanged.
+    const watchList = pod.riskWatch ? readGateRiskWatchList(pod.riskWatch) : [];
+    const riskPlan = planGateRiskLaneShards({ assignable, durations, shardCount, heavy, watchList });
+    const shards = riskPlan.shards;
+    if (riskPlan.spawnFiles.length) debug.log('release-loop.gate', 'pod-spawn-lane', { files: riskPlan.spawnFiles, shards: riskPlan.spawnShardCount });
+    if (riskPlan.riskFiles.length) debug.log('release-loop.gate', 'pod-risk-lane-plan', { files: riskPlan.riskFiles, shard: 0,
+      plannedSeconds: riskPlan.riskPlannedSeconds, shards: shards.length, watch: watchList.length });
     logPlanWalltime(planWall, shards);
     if (heavy.size) debug.log('release-loop.gate', 'pod-heavy-alone', { files: [...heavy], thresholdMb: POD_HEAVY_FILE_MB, memoryLimit: POD_ISOLATION_MEMORY_LIMIT });
     const known = assignable.filter((file) => durations.has(file)).length;
@@ -1346,14 +1511,14 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       maxPlannedSeconds: Math.max(...shards.map((shard) => shard.plannedSeconds)),
       source: durations.size ? pod.durationSource : 'none',
     });
-    reportSelectionTimed(Date.now() - selectionStart, assignable.length, pod.onSelectionTimed);
+    reportSelectionTimed(clock() - selectionStart, assignable.length, pod.onSelectionTimed);
     // GATE-SPEED A3①: shard Pod CPU (`release.loop.gatePodCpu` · default request 1 / limit 4) — shards × request must fit the pool.
     const cpu = resolvePodCpu(pod.cpu);
     // Only evidence-backed opt-in files reach this batch; every other file retains its own Pod below.
     const batchWidth = Math.max(1, Math.min(4, Math.floor(podCpuMillis(cpu.limit)! / 1000)));
     debug.log('release-loop.gate', 'shard-resources', { shards: shards.length, cpuRequest: cpu.request, cpuLimit: cpu.limit, cpuSource: pod.cpu ? 'config' : 'default' });
     debug.log('release-loop.gate', 'isolation-batch-width', { batchWidth, cpuLimit: cpu.limit });
-    const ready = poolOverride ? undefined : checkPodPool(parsePodPool(pod.pool), defaultKubectl);
+    const ready = poolOverride ? undefined : checkPodPool(parsePodPool(pod.pool), kubectl);
     if (ready && !ready.ok) throw new Error('pod command: 풀의 노드가 하나도 준비되지 않았다');
     const poolScheduler = poolOverride ?? new PodPoolScheduler(ready!.ready);
     const configCache = typeof pod.bunCache === 'string' ? pod.bunCache.trim() : '';
@@ -1369,7 +1534,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const admissionWaitSeconds = pod.admissionWaitSeconds ?? GATE_ADMISSION_WAIT_SECONDS_DEFAULT;
     if (!Number.isSafeInteger(admissionWaitSeconds) || admissionWaitSeconds < 0) throw new Error('invalid pod sweep options');
     // An injected pool (tests) runs without admission unless `pod.admission` is passed; the gate's own pool asks it.
-    const gateAdmission = pod.admission ?? (poolOverride ? undefined : poolGateAdmission(poolScheduler));
+    const gateAdmission = pod.admission ?? tools.admission ?? (poolOverride ? undefined : poolGateAdmission(poolScheduler));
     debug.log('release-loop.gate', 'pod-admission', { waitSeconds: admissionWaitSeconds, source: pod.admissionWaitSeconds !== undefined ? 'config' : 'default', enabled: !!gateAdmission && admissionWaitSeconds > 0 });
     // GATE-POD-STALL-FAILFAST: a shard with no test output within the stall window is stopped and recorded unmeasured.
     const stallSeconds = pod.stallSeconds ?? GATE_POD_STALL_SECONDS_DEFAULT;
@@ -1378,14 +1543,14 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     // An injected pool (tests) runs without the watch unless `pod.liveLog` is passed — never a real kubectl from a test.
     const liveLog = pod.liveLog ?? (poolOverride ? undefined : (job: { name: string; context?: string }) => {
       if (!job.context) return null;
-      const logs = defaultKubectl(['--context', job.context, '-n', 'elanous-test', 'logs', `job/${job.name}`, '-c', 'child', '--tail=400']);
+      const logs = kubectl(['--context', job.context, '-n', 'elanous-test', 'logs', `job/${job.name}`, '-c', 'child', '--tail=400']);
       return logs.status === 0 ? logs.stdout : null;
     });
     const stopJob = pod.stopJob ?? ((job: { name: string; context?: string }) => {
       // Not `delete job`: runPodCommand would poll a missing Job forever. A 1 s deadline makes the Job fail now and
       // runPodCommand returns through its normal path (logs · exit code · Secret cleanup).
       if (!job.context) return false;
-      const patched = defaultKubectl(['--context', job.context, '-n', 'elanous-test', 'patch', 'job', job.name, '--type=merge', '-p', JSON.stringify({ spec: { activeDeadlineSeconds: 1 } })]);
+      const patched = kubectl(['--context', job.context, '-n', 'elanous-test', 'patch', 'job', job.name, '--type=merge', '-p', JSON.stringify({ spec: { activeDeadlineSeconds: 1 } })]);
       if (patched.status !== 0) debug.log('release-loop.gate', 'pod-shard-stall-stop-failed', { job: job.name, error: patched.stderr.trim().slice(0, 300) }, { level: 'warn' });
       return patched.status === 0;
     });
@@ -1396,7 +1561,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     if (!Number.isFinite(midRunStallSeconds) || midRunStallSeconds < 0) throw new Error('invalid pod sweep options');
     const abortTests = pod.abortTests ?? (poolOverride ? undefined : (job: { name: string; context?: string }, reason: string) => {
       if (!job.context) return false;
-      const ran = defaultKubectl(['--context', job.context, '-n', 'elanous-test', 'exec', `job/${job.name}`, '-c', 'child', '--', 'bash', '-c', gateShardAbortScript(reason)]);
+      const ran = kubectl(['--context', job.context, '-n', 'elanous-test', 'exec', `job/${job.name}`, '-c', 'child', '--', 'bash', '-c', gateShardAbortScript(reason)]);
       if (ran.status !== 0) debug.log('release-loop.gate', 'shard-abort-failed', { job: job.name, rc: ran.status, out: `${ran.stdout}${ran.stderr}`.trim().slice(0, 300) }, { level: 'warn' });
       return ran.status === 0;
     });
@@ -1408,7 +1573,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const downMembers = new Set<string>();
     let tailPlacedHost: string | undefined;
     const multiHost = poolScheduler.members.length > 1;
-    const probeMember = pod.probeMember ?? (poolOverride ? undefined : defaultGateMemberProbe);
+    const probeMember = pod.probeMember ?? (poolOverride ? undefined : (member: PodPoolMember) => defaultGateMemberProbe(member, { kubectl, remoteRun }));
     const memberUnreadableSeconds = pod.memberUnreadableSeconds ?? GATE_MEMBER_UNREADABLE_SECONDS_DEFAULT;
     if (!Number.isFinite(memberUnreadableSeconds) || memberUnreadableSeconds < 0) throw new Error('invalid pod sweep options');
     debug.log('release-loop.gate', 'pod-roster', { members: poolScheduler.members.map((m) => ({ context: m.context, host: m.sshHost ?? null, capacity: m.capacity })),
@@ -1429,11 +1594,38 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const jobLogTail = (job: PodCommandResult): string => {
       if (podLogTail) return podLogTail(job);
       for (const member of poolScheduler.members.filter((m) => !downMembers.has(m.context))) {
-        const logs = defaultKubectl(['--context', member.context, '-n', 'elanous-test', 'logs', `job/${job.job}`, '-c', 'child', '--tail=200']);
+        const logs = kubectl(['--context', member.context, '-n', 'elanous-test', 'logs', `job/${job.job}`, '-c', 'child', '--tail=200']);
         if (logs.status === 0 && logs.stdout) return logs.stdout;
       }
       return '';
     };
+    const failureEvidence = pod.failureEvidence ?? ((job: { name: string; context?: string }) => {
+      if (!job.context) return { error: '수거 실패 · Job 배치 context 없음' };
+      const prefix = ['--context', job.context, '--request-timeout=5s', '-n', 'elanous-test'];
+      const errors: string[] = [];
+      let termination: { reason?: string; message?: string; exitCode?: number; finishedAt?: string } | undefined;
+      let podName: string | undefined;
+      let latestEndedAt = -Infinity;
+      const status = (pod.failureKubectl ?? kubectl)([...prefix, 'get', 'pods', '-l', `job-name=${job.name}`, '-o', 'json']);
+      if (status.status !== 0) errors.push(`Pod 상태: ${status.stderr.trim() || `kubectl rc=${status.status}`}`);
+      else try {
+        const pods = JSON.parse(status.stdout) as { items?: Array<{ metadata?: { name?: string; creationTimestamp?: string }; status?: { containerStatuses?: Array<{ name?: string; state?: { terminated?: typeof termination } }> } }> };
+        for (const item of pods.items ?? []) {
+          const child = item.status?.containerStatuses?.find((container) => container.name === 'child');
+          const ended = child?.state?.terminated;
+          if (!ended || !item.metadata?.name) continue;
+          const endedAt = Date.parse(ended.finishedAt ?? item.metadata.creationTimestamp ?? '');
+          const rank = Number.isFinite(endedAt) ? endedAt : -Infinity;
+          if (!termination || rank > latestEndedAt) { podName = item.metadata.name; termination = ended; latestEndedAt = rank; }
+        }
+        if (!termination) errors.push('Pod 상태: child 종료 사유 없음');
+      } catch (error) { errors.push(`Pod 상태 JSON: ${String(error)}`); }
+      const logs = podName ? (pod.failureKubectl ?? kubectl)([...prefix, 'logs', `pod/${podName}`, '-c', 'child', '--tail=100']) : undefined;
+      if (!logs) errors.push('로그: 종료된 Pod 이름 없음');
+      else if (logs.status !== 0) errors.push(`로그: ${logs.stderr.trim() || `kubectl rc=${logs.status}`}`);
+      return { ...(podName ? { podName } : {}), ...(termination ? { termination } : {}), ...(logs?.status === 0 ? { logTail: logs.stdout } : {}),
+        ...(errors.length ? { error: `수거 실패 · ${errors.join(' · ')}` } : {}) };
+    });
     type ShardRun = { output: string; rc: number; pass: number; fail: number; errors: number; ran: number; files: number; passedIds: string[] };
     type ShardReason = NonNullable<GateResult['stalledShards']>[number]['reason'];
     // 깊이 끝 OOM 조각은 «조각 전체»를 파일 하나씩 격리한다 — 상한 40 이면 나머지가 못 잰 채 남았다(09-30 ① 7번 조각 110 파일).
@@ -1502,17 +1694,18 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       const shardDeadline = shardDeadlineSeconds(batchIsolation ? Math.max(...paths.map((file) => estimated([file]))) * Math.ceil(paths.length / batchWidth) : estimated(paths), deadlineSeconds);
       const parts = batchIsolation ? paths.map((file) => [file]) : shardParts(paths, (file) => estimated([file]));
       const memoryLimit = batchIsolation || paths.length === 1 && (depth >= 1 || heavy.has(paths[0]!)) ? POD_ISOLATION_MEMORY_LIMIT : undefined;
-      const shellOptions = { parts, cdpPatterns, softSeconds: softDeadlineSeconds(shardDeadline), cachePrefix, installSlots, ...(batchIsolation ? { parallelParts: batchWidth } : {}) };
+      const shellOptions = { parts, cdpPatterns, softSeconds: softDeadlineSeconds(shardDeadline), cachePrefix, installSlots, ...(rulesBaseSha ? { rulesBaseSha } : {}), ...(batchIsolation ? { parallelParts: batchWidth } : {}) };
       const keyShell = gateShardShell(shellOptions);
       // The stall beat only reports; runKey keeps hashing the shell without it, so earlier results stay reusable.
       const runKey = createHash('sha256').update(JSON.stringify({ pool: pod.pool, podShell: keyShell, memoryLimit: memoryLimit ?? null, deadlineSeconds: shardDeadline, bunCache: bunCache ?? null })).digest('hex');
-      let start = Date.now();
+      let start = clock();
       let admitted: GateAdmissionResult | undefined;
       let output: string | undefined;
       const phaseTimes: Record<string, string> = {};
       const stamp = (phase: string) => { phaseTimes[phase] = new Date().toISOString(); };
       let podStages: Record<string, number> | undefined;
       let podLifecycle: Record<string, string> | undefined;
+      let imageDigest: string | null = null;
       let podJobName: string | undefined;
       let batchArtifactsComplete = true;
       let junit: string | undefined;
@@ -1522,6 +1715,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       let lastFile: string | undefined;
       let jobFailed = false;
       let jobError = '';
+      let failureCapture: ReturnType<NonNullable<NonNullable<GateOptions['pod']>['failureEvidence']>> | undefined;
+      let jobNameForCapture: string | undefined;
+      let jobContextForCapture: string | undefined;
+      const captureFailure = () => {
+        try { failureCapture = failureEvidence({ name: jobNameForCapture ?? 'unplaced', context: jobContextForCapture }); }
+        catch (error) { failureCapture = { error: `수거 실패 · ${String(error)}` }; }
+      };
       /** GATE-MULTI-HOST — the member this shard's Job was placed on (recorded in the shard json / log / board). */
       let placedOn: string | undefined;
       let timedOut = false;
@@ -1570,8 +1770,9 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (admitted.outcome !== 'off') debug.log('release-loop.gate', 'shard-admission', { shard, branch, outcome: admitted.outcome, waitedMs: admitted.waitedMs, ...(admitted.reason ? { reason: admitted.reason } : {}) },
           admitted.outcome === 'granted' ? undefined : { level: 'warn' });
         // The admission wait is not the shard's run time: deadline/timeout judgment and the measured duration start here.
-        start = Date.now();
+        start = clock();
         const jobName = `gate-${randomUUID()}`;
+        jobNameForCapture = jobName;
         // The member's context is known once the Job is placed; the live log is read (and the Job stopped) there.
         let jobContext: string | undefined;
         const liveJob = () => ({ name: jobName, ...(jobContext ? { context: jobContext } : {}) });
@@ -1592,9 +1793,16 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
             },
           } : {}) }) : undefined;
         const placed = admitted.release;
-        const job = await podCommand({
+        const job = await runPod({
+          provenanceGate: true,
+          provenance: { actorKind: process.env.ELANOUS_SEAT ? 'seat' : 'loop', actor: process.env.ELANOUS_SEAT || 'release-loop',
+            character: 'gate-shard-runner', launchHost: hostname(), entrance: process.env.ELANOUS_RELEASE_ENTRANCE?.trim() || 'release-run',
+            kind: 'gate-shard', run: process.env.ELANOUS_RUN_ID || sweepId, phase: 'release-gate', requestedAt: new Date().toISOString(),
+            graphNode: 'gate', version: pod.shardsFile?.version, commit, shard: `${shard + 1}-of-${shards.length}`,
+            reason: `release gate shard ${shard + 1}/${shards.length}`, pool: pod.pool, cpuReq: cpu.request,
+            memReq: memoryLimit ?? POD_ISOLATION_MEMORY_LIMIT, warmReused: false },
           pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', (member) => {
-            stamp('poolPlaced'); jobContext = member.context; placedOn = member.context; placed();
+            stamp('poolPlaced'); jobContext = member.context; jobContextForCapture = member.context; placedOn = member.context; placed();
             if (branch === '-tail') tailPlacedHost = member.context;
           }, skipMembers), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
           ...gateHostMirror(pod),
@@ -1609,13 +1817,20 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         }).finally(() => watch?.stop());
         stamp('jobReturned');
         podJobName = job.job;
+        // poolOverride is the injected scheduler used by isolated tests; it has no authenticated kubectl
+        // context. Those sweeps intentionally cannot mint a valid baseline receipt (missing observed digest).
+        // Production pool sweeps always use this Kubernetes lookup; lookup failure is receipt-invalid only.
         if (!poolOverride && placedOn) {
           try {
-            const got = defaultKubectl(['--context', placedOn, '-n', 'elanous-test', 'get', 'pods', '-l', `job-name=${job.job}`, '-o', 'json']);
-            if (got.status === 0) podLifecycle = readGatePodLifecycle(got.stdout);
+            const got = kubectl(['--context', placedOn, '-n', 'elanous-test', 'get', 'pods', '-l', `job-name=${job.job}`, '-o', 'json']);
+            if (got.status === 0) {
+              podLifecycle = readGatePodLifecycle(got.stdout);
+              imageDigest = actualGatePodImageDigest(got.stdout);
+            }
           } catch { /* timings never change the verdict */ }
         }
         jobExitCode = job.exitCode;
+        if (job.exitCode !== 0) captureFailure();
         batchArtifactDir = job.artifactsDir;
         const read = readShardArtifacts(job.artifactsDir, parts);
         batchArtifactsComplete = !batchIsolation || parts.every((_, index) =>
@@ -1640,7 +1855,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (abort?.taken) abortedShards++;
         if (stalledAt && !finished.length && rc === undefined) stall = { seconds: stallSeconds, sinceCheckoutMs: stalledAt.sinceCheckoutMs };
         // A Job the cluster cut at its own deadline leaves no outbox at all: past the deadline with nothing is a timeout too.
-        if (!timedOut && output === undefined && job.exitCode !== 0 && Date.now() - start >= shardDeadline * 1000) timedOut = true;
+        if (!timedOut && output === undefined && job.exitCode !== 0 && clock() - start >= shardDeadline * 1000) timedOut = true;
         lastFile = output === undefined && unfinishedLog === undefined ? undefined : lastStartedTestFile(`${output ?? ''}\n${unfinishedLog ?? ''}`, paths);
         if (!lastFile && (job.exitCode !== 0 || rc === undefined || (rc !== 0 && rc !== 1))) {
           try { lastFile = lastStartedTestFile(jobLogTail(job).split(/\r?\n/).slice(-200).join('\n'), paths); }
@@ -1649,10 +1864,11 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       } catch (error) {
         jobFailed = true;
         jobError = error instanceof Error ? error.message : String(error);
+        if (!failureCapture) captureFailure();
       }
       // A launch that failed before placement still gives its admission back (release is idempotent).
       admitted?.release();
-      const durationMs = Date.now() - start;
+      const durationMs = clock() - start;
       const fileSeconds = junit === undefined ? undefined : Object.fromEntries(readJunitFileSeconds(junit));
       const testSeconds = fileSeconds === undefined ? undefined : Object.values(fileSeconds).reduce((sum, seconds) => sum + seconds, 0);
       const testWallSeconds = batchIsolation
@@ -1683,13 +1899,25 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (unfinishedLog !== undefined) writeFileSync(unfinishedDestination, unfinishedLog, { mode: 0o600 });
         else rmSync(unfinishedDestination, { force: true });
         writeFileSync(join(logDir, `pod-${shard}${branch}.json`), JSON.stringify({ durationMs, rc: rc ?? null,
-          ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed, ...(placedOn ? { host: placedOn } : {}),
+          ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, sweepId, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed, ...(placedOn ? { host: placedOn } : {}),
           ...(Object.keys(phaseTimes).length ? { phaseTimes } : {}), ...(podStages ? { podStages } : {}),
           ...(podLifecycle && Object.keys(podLifecycle).length ? { podLifecycle } : {}),
+          ...(failureCapture ? { failureCapture: {
+            ...(failureCapture.podName ? { podName: failureCapture.podName } : {}),
+            ...(failureCapture.termination ? { termination: {
+              ...failureCapture.termination,
+              ...(failureCapture.termination.reason ? { reason: redactSecretText(failureCapture.termination.reason) } : {}),
+              ...(failureCapture.termination.message ? { message: redactSecretText(failureCapture.termination.message) } : {}),
+            } } : {}),
+            ...(failureCapture.logTail !== undefined ? { logTail: redactedGateLogTail(failureCapture.logTail) } : {}),
+            ...(failureCapture.error ? { error: redactSecretText(failureCapture.error) } : {}),
+          } } : {}),
+          ...(imageDigest ? { imageDigest } : {}),
           ...(fileSeconds !== undefined ? { fileSeconds, testSeconds } : {}), ...(testWallSeconds !== undefined ? { testWallSeconds } : {}),
           ...(podOverheadSeconds !== undefined ? { podOverheadSeconds } : {}),
           ...(unfinishedLogBytes !== undefined ? { unfinishedLogBytes } : {}),
-          ...(admitted && admitted.outcome !== 'off' ? { admission: admitted.outcome, admissionWaitMs: admitted.waitedMs } : {}),
+          ...(admitted && admitted.outcome !== 'off' ? { admission: admitted.outcome, admissionWaitMs: admitted.waitedMs,
+            ...(admitted.reason ? { admissionReason: admitted.reason } : {}) } : {}),
           ...(abort ? { abort: { reason: `abort: ${abort.reason}`, at: abort.at, by: abort.by, sinceLastOutputMs: abort.sinceLastOutputMs, taken: abort.taken } } : {}),
           stallWatch: shardStallWatchRecord(stallSeconds, !!liveLog, stallWatchState) }) + '\n', { mode: 0o600 });
         if (paths.length === 1 && (rc === 0 || rc === 1) && !jobFailed && jobExitCode === 0
@@ -1904,9 +2132,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         ran: Number(ran![1]), files: Number(ran![2]), passedIds: junit ? junitPassedIds(junit) : [] }], stalled: [] };
     };
     // 모든 조각이 끝난 뒤 판정한다 — 한 조각의 예외로 먼저 돌아가면 다른 Pod 가 도는 채로 정리가 시작된다(#22002 리뷰 R3).
+    // GATE-RISK-LANE — the risk shard's own wall time (planned vs measured in its log line); it never changes a verdict.
+    const shardDurations: number[] = [];
     const settled = await Promise.allSettled(shards.map(async (item, shard) => {
+      const shardStartedAt = clock();
       try {
         const done = await runShard(item.files, shard);
+        shardDurations[shard] = clock() - shardStartedAt;
         const state = !done.stalled.length ? 'done' as const : done.stalled.some((stall) => stall.reason === 'timeout') ? 'timeout' as const : 'failed' as const;
         markShard(shard, { state, endedAt: new Date().toISOString() }, ['waitReason']);
         return done;
@@ -1918,6 +2150,16 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const rejected = settled.find((result): result is PromiseRejectedResult => result.status === 'rejected');
     if (rejected) throw rejected.reason;
     const results = settled.flatMap((result) => result.status === 'fulfilled' ? [result.value] : []);
+    // GATE-RISK-LANE — planned vs measured for the shard that ran first, with its own result. Its Pods are ordinary
+    // shard Pods: their runs join `measured` below, so the sweep's summary and every later judgment are unchanged.
+    let riskLane: GateRiskLaneRecord | undefined;
+    if (riskPlan.riskFiles.length) {
+      const riskRuns = results[0]?.runs ?? [];
+      riskLane = { files: [...riskPlan.riskFiles], plannedSeconds: riskPlan.riskPlannedSeconds,
+        durationMs: shardDurations[0] ?? 0, rc: riskRuns.length ? (riskRuns.some((run) => run.fail + run.errors > 0) ? 1 : 0) : null };
+      debug.log('release-loop.gate', 'pod-risk-lane', { files: riskLane.files, shard: 0, plannedSeconds: riskLane.plannedSeconds,
+        durationMs: riskLane.durationMs, rc: riskLane.rc, ...(results[0]?.stalled[0] ? { reason: results[0].stalled[0]!.reason } : {}) });
+    }
     let stalledShards = results.flatMap((result) => result.stalled);
     const measured = results.flatMap((result) => result.runs);
     // GATE-STALLED-TAIL-REMEASURE: after the sweep, give only a one-file no-output leaf one fresh attempt on a different
@@ -1963,13 +2205,19 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       stallSeconds, measuredFiles: total.files }, { level: 'warn' });
     // An unmeasured (stalled) shard is never handed to the host re-run as an environment stall: the gate fails now.
     if (abortedShards) debug.log('release-loop.gate', 'pod-sweep-aborted', { shards: abortedShards, midRunStallSeconds }, { level: 'warn' });
-    if (stalledShards.some((item) => item.reason !== 'no-output' || item.files.length !== 1 || item.stall)) throw new StalledPodShards(stalledShards, total, abortedShards);
+    if (stalledShards.some((item) => item.reason !== 'no-output' || item.files.length !== 1 || item.stall)) {
+      const measuredFailures = partialFailuresOf(measured);
+      throw new StalledPodShards(stalledShards, total, measuredFailures,
+        results.filter((item) => item.stalled.length === 0).length, abortedShards);
+    }
     if (total.ran === 0 && total.errors === 0 && !stalledShards.length) throw new Error('sweep incomplete: no tests ran');
     const outputs = measured.map((run) => run.output.replace(/(?:^|\n)\s*\d+ (?:pass|fail|errors?)\s*(?=\n|$)/g, '\n').replace(/Ran \d+ tests? across \d+ files?\.?/g, ''));
     return { rc: total.fail + total.errors ? 1 : 0, output: outputs.join('\n') + `\n${total.pass} pass\n${total.fail} fail\n${total.errors} errors\nRan ${total.ran} tests across ${total.files} files.\n`, validatedShards: true,
+      podSweep: { id: sweepId, shards: shards.length, files: assignable },
       passedIds: [...new Set(measured.flatMap((run) => run.passedIds))].sort(),
       stalledEnv: stalledShards.flatMap((item) => item.files.map((file) => ({ file, reason: 'no-output' as const }))),
-      ...(abortedShards ? { abortedShards } : {}) };
+      ...(abortedShards ? { abortedShards } : {}),
+      ...(riskLane ? { riskLane } : {}) };
   };
   const runPodRecheckBatch = async (files: readonly string[], commit: string, pod: NonNullable<GateOptions['pod']>, timeoutMs: number, relaxed = false): Promise<Map<string, CommandResult>> => {
     const warmShadowScope = pod.warmShadowScope ?? { requested: false };
@@ -1992,6 +2240,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         || file.split('/').some((part) => part === '.' || part === '..')))
       throw new Error('unsafe pod recheck files');
     if (!sha.test(commit)) throw new Error('invalid pod recheck commit');
+    const rulesBaseSha = await rulesGateBaseFor(commit, files);
     const installSlots = pod.installSlots ?? POD_INSTALL_SLOTS_DEFAULT;
     if (!Number.isSafeInteger(installSlots) || installSlots < 0) throw new Error('invalid pod recheck install slots');
     const bunCache = pod.bunCache?.trim() || process.env[POD_BUN_CACHE_HOST_PATH]?.trim();
@@ -2000,18 +2249,51 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const deadlineSeconds = partLimitSeconds * Math.ceil(files.length / 2) + POD_SHARD_EMIT_RESERVE_SECONDS + 60;
     const shell = gateShardShell({ parts: files.map((file) => [file]), cdpPatterns: [], softSeconds: softDeadlineSeconds(deadlineSeconds),
       cachePrefix: bunCache ? podBunCacheVolume(bunCache).shellPrefix : '', installSlots, parallelParts: files.length > 1 ? 2 : 1,
-      partLimitSeconds, sourceBinding: { cutSha: commit, attemptId }, ...(relaxed ? { testTimeoutMs: GATE_TIMEOUT_RECHECK_MS } : {}) });
-    const job = await podCommand({ pool: pod.pool, ...(poolOverride ? { poolScheduler: poolOverride } : {}), clone: true,
-      source: { kind: 'commit', sha: commit }, deadlineSeconds, ...(bunCache ? { bunCache } : {}), ...gateHostMirror(pod),
+      partLimitSeconds, sourceBinding: { cutSha: commit, attemptId }, ...(rulesBaseSha ? { rulesBaseSha } : {}), ...(relaxed ? { testTimeoutMs: GATE_TIMEOUT_RECHECK_MS } : {}) });
+    const warmEligible = files.length === 1 && pod.warmEligible === true && !!pod.warmReplay && !!pod.warmQuarantine && !!pod.warmFinalize
+      && pod.warmCutSha === commit;
+    const warmRequest = warmEligible && pod.warmProducerEnabled && pod.warmReplayOwner !== false ? { protocol: 1 as const, runId: randomUUID(), attemptId, cutSha: commit,
+      ...(pod.warmBaselineSha ? { baselineSha: pod.warmBaselineSha } : {}), deadlineAt: Date.now() + timeoutMs + 60_000,
+      files, envProfile: 'gate-v1' } : undefined;
+    const replay = warmRequest ? await pod.warmReplay!(warmRequest) : undefined;
+    const leased = replay?.command;
+    let closed = false;
+    const quarantine = async (reason: string) => {
+      if (!leased || closed) return;
+      await pod.warmQuarantine!(leased, reason);
+      closed = true;
+    };
+    let producer: RunPodCommandOptions['warmProducer'];
+    if (leased && replay?.transport.status === 'observed' && replay.transport.reason === 'complete') {
+      if (warmCommandMatchesRequest(leased, warmRequest!) && leased.podName && leased.podUid
+        && leased.podContext && leased.image?.endsWith(`@${leased.key.imageDigest}`)) {
+        producer = { pod: leased.podName, podUid: leased.podUid, context: leased.podContext, image: leased.image,
+          commit, files: ['package.json', 'bun.lock'] };
+      } else await quarantine('gate-producer-identity');
+    }
+    let job: PodCommandResult;
+    try {
+      job = await runPod({ pool: pod.pool, ...(poolOverride ? { poolScheduler: poolOverride } : {}), clone: true,
+      provenanceGate: true,
+      provenance: { actorKind: process.env.ELANOUS_SEAT ? 'seat' : 'loop', actor: process.env.ELANOUS_SEAT || 'release-loop',
+        character: 'gate-shard-runner', launchHost: hostname(), entrance: 'release-recheck', kind: 'gate-recheck',
+        run: process.env.ELANOUS_RUN_ID || attemptId, phase: 'release-gate', requestedAt: new Date().toISOString(),
+        graphNode: 'gate-triage', commit, reason: `release gate recheck ${files.length} files`, pool: pod.pool,
+        memReq: POD_ISOLATION_MEMORY_LIMIT, warmReused: !!producer },
+      source: { kind: 'commit', sha: commit }, deadlineSeconds, ...(producer ? { warmProducer: producer, image: producer.image, imageCommit: commit } : {}),
+      ...(bunCache ? { bunCache } : {}), ...gateHostMirror(pod),
       ...(installSlots > 0 ? { installSlots: POD_INSTALL_SLOTS_HOST_PATH } : {}), ...(pod.cpu ? { cpu: pod.cpu } : {}),
       memoryLimit: POD_ISOLATION_MEMORY_LIMIT, name: `gate-recheck-${randomUUID()}`, command: ['bash', '-lc', shell] });
-    const artifact = (name: string) => {
-      const path = join(job.artifactsDir, name);
-      return existsSync(path) ? readFileSync(path, 'utf8') : undefined;
-    };
+    } catch (error) {
+      await quarantine('gate-job-failed');
+      throw error;
+    }
+    try {
+      const artifact = (name: string) => {
+        const path = join(job.artifactsDir, name);
+        return existsSync(path) ? readFileSync(path, 'utf8') : undefined;
+      };
     const installed = artifact('install.rc')?.trim() === '0';
-    const warmEligible = files.length === 1 && pod.warmEligible === true && !!pod.warmReplay && !!pod.warmQuarantine && !!pod.warmFinalize
-      && pod.warmCutSha === commit;
     const incomplete = (message: string, file: string): Error => warmEligible
       ? new WarmRecheckIncomplete(message, file, { files: [file], attemptId, status: 'unmeasured', reason: 'reference-unmeasured', quarantined: 'no' })
       : new Error(message);
@@ -2048,7 +2330,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       }
       debug.log('release-loop.gate', 'pod-isolated-recheck', { file, commit, job: job.job, rc: rc ?? 124, relaxed });
     }
-    if (warmEligible && pod.warmReplay && pod.warmQuarantine && pod.warmFinalize) {
+    if (warmEligible && !pod.warmProducerEnabled && pod.warmReplay && pod.warmQuarantine && pod.warmFinalize) {
       shadowDeadline = Date.now() + shadowTimeoutMs;
       const first = results.get(files[0]!)!;
       const reference = first.warmReference;
@@ -2124,11 +2406,26 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         debug.log('release-loop.gate', 'warm-shadow-recheck', first.warmShadow);
       }
     }
+    if (producer && leased) {
+      const reference = results.get(files[0]!)?.warmReference;
+      const decision = job.exitCode === 0 && reference && !timedOut
+        ? assessWarmWorkerShadow(leased, [reference], replay!.transport.reply) : null;
+      if (decision?.reason !== 'match') await quarantine(decision?.reason ?? 'reference-unmeasured');
+      else {
+        await pod.warmFinalize!(leased);
+        closed = true;
+      }
+    }
     return results;
+    } catch (error) {
+      await quarantine('gate-job-incomplete');
+      throw error;
+    }
   };
   return {
     command,
     localCommand: commandOverride && !remote ? commandOverride : localCommand,
+    now: clock,
     async recheckPod(file, commit, pod, timeoutMs, relaxed = false) {
       return (await runPodRecheckBatch([file], commit, pod, timeoutMs, relaxed)).get(file)!;
     },
@@ -2295,8 +2592,8 @@ export function saveBaselineFileCache(ledger: string, commit: string, rows: Base
   } finally { if (existsSync(temp)) rmSync(temp); }
 }
 
-export async function judgeGate(opts: GateOptions, runner: GateRunner = createGateRunner(opts.repo ?? process.cwd(), opts.remote)): Promise<GateResult> {
-  const start = Date.now();
+export async function judgeGate(opts: GateOptions, runner: GateRunner = createGateRunner(opts.repo ?? process.cwd(), opts.remote),
+  imageProbe: typeof preflightGateImageDigest = preflightGateImageDigest): Promise<GateResult> {
   if (opts.pod?.warmReplay) opts = { ...opts, pod: { ...opts.pod,
     warmShadowScope: { requested: false, attempts: 0 } } };
   const explicitConfig = getElanousConfigDirOverride();
@@ -2307,6 +2604,10 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     debug.log('release.run', opts.forceFreeze ? 'freeze-forced' : 'frozen', { version: opts.version, reason: frozen.reason, until: frozen.until, node: 'gate' });
     if (!opts.forceFreeze) throw new Error(landingFreezeMessage(frozen));
   }
+  // GATE-FLOW-SIM — the injected clock (absent = `Date.now`), read only after the freeze check: a frozen gate must not
+  // touch its runner at all (a refusal is decided before any side effect).
+  const clock = runner.now ?? Date.now;
+  const start = clock();
   const ledger = explicitConfig ? root : (opts.ledgerRoot ?? releaseLedgerRoot());
   const roots = [...new Set([ledger, root])];
   const cachedBaseline = (version: string, commit: string) => {
@@ -2340,6 +2641,8 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       || (opts.baselineVersion && !versionPattern.test(opts.baselineVersion))
       || (opts.baselineCommit && !sha.test(opts.baselineCommit))) throw new Error('invalid commit or version');
     if (!opts.baselineVersion) throw new Error('previous release version required (--baseline-version)');
+    if (opts.rehearsalBaseline && (opts.graphRunId || !opts.pod || !/-rc\.\d+$/.test(opts.version)))
+      throw new Error('rehearsal baseline requires a direct Pod gate with an isolated rc version');
     // Observation only. Failure to plan cannot change the gate selector or verdict.
     try { radiusShadow = planGateRadiusShadow({ repo, ledgerRoot: ledger, version: opts.version,
       baselineVersion: opts.baselineVersion, forCommit: opts.commit, instanceRoot: root,
@@ -2388,12 +2691,31 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     for (const dir of [cutTree, join(cutTree, 'apps/pwa')]) check(await runner.command('bun', ['install'], dir), `bun install ${dir}`);
     // GATE-PARTIAL: a plan made by `release resume --from gate --partial` for exactly this commit re-runs only its files.
     // Its logs go to cut-partial/ — the full cut/ logs stay whole (the next release reads them as a baseline source).
-    const partial = readPartialPlan(roots, opts.version, opts.commit);
-    if (partial) debug.log('release-loop.gate', 'partial-regate', { version: opts.version, priorCommit: partial.priorCommit, commit: opts.commit, files: partial.files.length });
+    const partialRead = readPartialPlanResult(roots, opts.version, opts.commit);
+    const explicitPartial = partialRead.plan;
+    const rehearsalStampPresent = ['hard-5h', 'hard-mid'].some((step) =>
+      existsSync(join(root, 'release', opts.version, 'rehearsal', `${step}.json`)));
+    const currentImage = !explicitPartial && opts.graphRunId && opts.pod && rehearsalStampPresent
+      ? imageProbe(opts.pod.pool) : null;
+    const radius = !explicitPartial && opts.graphRunId && opts.pod && rehearsalStampPresent
+      ? planHardRehearsalRadius({ root, repo, version: opts.version, forCommit: opts.commit,
+        graphPins: gateGraphPins(root, opts.graphRunId), envFingerprint: gateEnvFingerprint(process.env), imageDigest: currentImage })
+      : null;
+    if (radius) debug.log('release-loop.gate', 'radius-live-plan', { version: opts.version, reason: radius.reason,
+      files: radius.plan?.files.length ?? null, rehearsalRunId: radius.rehearsalRunId ?? null });
+    let partial = explicitPartial ?? radius?.plan ?? null;
+    debug.log('release-loop.gate', partial ? 'partial-regate' : 'partial-fallback', {
+      version: opts.version, priorCommit: partial?.priorCommit ?? null, commit: opts.commit,
+      planKind: partial?.kind ?? 'full', remeasureFileCount: partial?.files.length ?? 0,
+      preservedShardCount: partial?.kind === 'recheck' && 'preservedShardCount' in partial
+        && typeof partial.preservedShardCount === 'number' ? partial.preservedShardCount : 0,
+      fallbackReason: partial ? undefined : partialRead.fallbackReason,
+    });
     if (partial?.kind === 'carry') {
+      const carryPriorCommit = partial.priorCommit;
       // The plan alone is not evidence: the old cut and its verdict must still be complete and clean at this SHA.
-      if (!verifyDocsOnlyCarry(repo, partial.priorCommit, opts.commit))
-        throw new Error(`carry plan diff is not docs-only: ${partial.priorCommit}..${opts.commit}`);
+      if (!verifyDocsOnlyCarry(repo, carryPriorCommit, opts.commit))
+        throw new Error(`carry plan diff is not docs-only: ${carryPriorCommit}..${opts.commit}`);
       const trusted = roots.some((location) => {
         const dir = join(location, 'release', opts.version);
         const failuresPath = join(dir, 'gate-failures.json');
@@ -2401,11 +2723,11 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         if (!existsSync(failuresPath) || !existsSync(verdictPath)) return false;
         const failures = JSON.parse(readFileSync(failuresPath, 'utf8')) as { commit?: unknown; failures?: unknown; errors?: unknown };
         const verdict = JSON.parse(readFileSync(verdictPath, 'utf8')) as { commit?: unknown; outcome?: unknown };
-        return failures.commit === partial.priorCommit && Array.isArray(failures.failures) && failures.failures.length === 0
+        return failures.commit === carryPriorCommit && Array.isArray(failures.failures) && failures.failures.length === 0
           && (failures.errors === undefined || (Array.isArray(failures.errors) && failures.errors.length === 0))
-          && verdict.commit === partial.priorCommit && verdict.outcome === 'ok';
+          && verdict.commit === carryPriorCommit && verdict.outcome === 'ok';
       });
-      if (!trusted) throw new Error(`carry plan has no complete clean gate at ${partial.priorCommit}`);
+      if (!trusted) throw new Error(`carry plan has no complete clean gate at ${carryPriorCommit}`);
     }
     // GATE-SKIP-KNOWN-RETRY — the ids the verdict will not count as introduced (the recorded baseline ⊕ env-known), read
     // before the sweep so a shard failing only with them skips its isolation retries. No recorded baseline = no skip.
@@ -2420,12 +2742,30 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       } catch (error) { debug.log('release-loop.gate', 'known-failures-unavailable', { error: String(error) }); }
     }
     const durationSource = join(ledger, 'release', opts.baselineVersion, 'gate-logs', 'cut');
-    const cutRun = partial?.kind === 'carry' ? undefined : await runner.sweep(cutTree, join(root, 'release', opts.version, 'gate-logs', partial ? 'cut-partial' : 'cut'),
+    const runCut = (selected: typeof partial) => selected?.kind === 'carry' ? undefined : runner.sweep(cutTree,
+      join(root, 'release', opts.version, 'gate-logs', selected ? 'cut-partial' : 'cut'),
       opts.pod ? { ...opts.pod, durationSource, ...(knownFailures.length ? { knownFailures } : {}), onSelectionTimed: ({ ms }) => { result.selectionMs = ms; },
+        // GATE-RISK-LANE — the watch list is read from this gate's own ledgers (the instance root ⊕ the machine ledger);
+        // the cut sweep puts those files first, the baseline sweep keeps its plan.
+        riskWatch: { instanceRoots: roots, ledgerRoots: roots },
         // GATE-LIVE-OBS: the release ledger's shards.json (UX #24782) — never the run tree's universe; an explicit
         // --ledger-root (tests) keeps it in that ledger.
         shardsFile: { path: opts.ledgerRoot ? gateShardsPath(opts.version, opts.ledgerRoot) : gateShardsPath(opts.version), version: opts.version } } : undefined,
-      partial?.files);
+      selected?.files);
+    let cutRun = await runCut(partial);
+    const radiusSelectionMatched = partial?.files && cutRun?.podSweep?.files
+      && JSON.stringify([...partial.files].sort()) === JSON.stringify([...cutRun.podSweep.files].sort());
+    if (radius?.plan && (!radiusSelectionMatched
+      || !partialGateImagesMatch(root, opts.version, currentImage!, opts.commit, cutRun?.podSweep))) {
+      debug.log('release-loop.gate', 'radius-live-image-drift', { version: opts.version,
+        rehearsalRunId: radius.rehearsalRunId, action: 'full-sweep' }, { level: 'warn' });
+      partial = null;
+      cutRun = await runCut(null);
+    }
+    if (radius?.plan && partial === radius.plan) debug.log('release-loop.gate', 'baseline-consumed', {
+      version: opts.version, baselineCommit: radius.plan.priorCommit, commit: opts.commit,
+      selectedFiles: radius.plan.files.length, rehearsalRunId: radius.rehearsalRunId,
+    });
     cutSweepRc = cutRun?.rc ?? null;
     cutSweepUsable = !!cutRun && (cutRun.rc === 0 || cutRun.rc === 1) && !cutRun.timedOut
       && !cutRun.abortedShards && !cutRun.stalledEnv?.length;
@@ -2621,7 +2961,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     debug.log('release-loop.gate', 'isolated-recheck-plan', { files: recheckFiles.length, window: recheckLimit,
       concurrency: opts.pod && runner.recheckPod ? recheckConcurrency : 1, executor: opts.pod && runner.recheckPod ? 'pod' : 'host',
       remote: opts.remote ?? null, podBatchFiles: opts.pod && runner.recheckPod && runner.recheckPodBatch ? GATE_RECHECK_POD_BATCH_FILES : 1 });
-    const recheckStartedAt = Date.now();
+    const recheckStartedAt = clock();
     const recordWarmShadow = (shadow?: WarmShadowObservation) => {
       if (shadow && !result.warmShadow?.some((entry) => entry.attemptId === shadow.attemptId))
         (result.warmShadow ??= []).push(shadow);
@@ -2784,6 +3124,11 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     result.introduced.sort();
     preexistingIds.sort();
     result.loadFlaky?.sort();
+    // GATE-RISK-LANE — did the shard that ran first carry this gate's new failures? Observation only: the outcome above
+    // is the existing aggregation, and the counts (introduced · preexisting) are the same ones the verdict writes.
+    if (cutRun?.riskLane) debug.log('release-loop.gate', 'risk-lane-introduced', { files: cutRun.riskLane.files,
+      plannedSeconds: cutRun.riskLane.plannedSeconds, durationMs: cutRun.riskLane.durationMs, rc: cutRun.riskLane.rc,
+      introduced: result.introduced.filter((id) => cutRun!.riskLane!.files.includes(fileOf(id))).length });
     result.preexisting = preexistingIds.length;
     result.baselineCache = cacheStats;
     debug.log('release.gate', 'baseline-cache', { hits: cacheStats.hits, misses: cacheStats.misses, commit: baseSha });
@@ -2816,6 +3161,8 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     if (error instanceof StalledPodShards) {
       result.stalledShards = error.stalledShards;
       result.partialSummary = error.partialSummary;
+      result.partialFailures = error.partialFailures;
+      result.preservedShardCount = error.preservedShardCount;
       if (error.abortedShards) result.abortedShards = error.abortedShards;
     }
   } finally {
@@ -2834,7 +3181,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       } catch (error) { result.outcome = 'error'; result.error = `cleanup: ${String(error)}`; }
     }
     if (opts.remote) runner.remoteMirror = undefined;
-    result.durationMs = Date.now() - start;
+    result.durationMs = clock() - start;
   }
   if (cutFailures && !result.stalledShards?.length && !result.stalledEnv.length && !result.unmeasuredRecheckFiles?.length) {
     try {
@@ -2866,6 +3213,13 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
     };
     const observed = { ...(result.selectionMs !== undefined ? { selectionMs: result.selectionMs } : {}),
       ...(result.warmShadow?.length ? { warmShadow: result.warmShadow } : {}) };
+    // Receipt is advisory for a later radius gate. Missing identity makes reuse invalid, never this gate's verdict.
+    const baselineReceipt = gateBaselineReceipt({ root, version: opts.version, commit: opts.commit,
+      graphPins: gateGraphPins(root, opts.graphRunId) ?? (opts.rehearsalBaseline ? gateSourcePins(repo, opts.commit) : null),
+      envFingerprint: gateEnvFingerprint(process.env),
+      fullSweep: result.outcome === 'ok' && cutSweepUsable && !result.partial && !!cutFailures
+        && !result.rcNonzeroNoFailures.length && !result.stalledShards?.length && !result.stalledEnv.length
+        && !result.unmeasuredRecheckFiles?.length && !result.unmeasuredErrors?.length });
     try {
       for (const location of roots) {
         const path = verdictFile(location, opts.version);
@@ -2878,7 +3232,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         try {
           const warmHistory = readWarmVerdictHistory(path) ?? [];
           writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit,
-            outcome: result.outcome, ...ids, ...observed,
+            outcome: result.outcome, ...ids, ...observed, baselineReceipt,
             ...(opts.pod?.warmReplay ? { baselineCommit, warmHistory } : {}) }, null, 2) + '\n', { mode: 0o600 });
           chmodSync(temp, 0o600);
           renameSync(temp, path);
@@ -2894,7 +3248,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         try {
           const warmHistory = readWarmVerdictHistory(path) ?? [];
           writeFileSync(temp, JSON.stringify({ version: opts.version, commit: opts.commit,
-            outcome: result.outcome, ...ids, ...observed,
+            outcome: result.outcome, ...ids, ...observed, baselineReceipt,
             ...(opts.pod?.warmReplay ? { baselineCommit, warmHistory } : {}) }, null, 2) + '\n', { mode: 0o600 });
           chmodSync(temp, 0o600);
           renameSync(temp, path);
@@ -3023,6 +3377,7 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
     const arg = args[i];
     if (arg === '--help') return 'help';
     if (arg === '--json') continue;
+    if (arg === '--rehearsal-baseline') { opts.rehearsalBaseline = true; continue; }
     // Applied after the loop and only to a Pod gate — on its own it must not turn a local gate into a Pod one (review r5).
     if (arg === '--fresh-shards') { freshShards = true; continue; }
     if (arg === '--rehearsal-tui') { opts.rehearsalTui = true; continue; }
@@ -3085,7 +3440,7 @@ export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner
       debug.log('release-loop.gate', 'executor', { version: opts.version, ...placement, requested: opts.executor ?? null });
     }
     if (opts === 'help') {
-      console.log('Usage: bun scripts/release-loop/gate-node.ts --commit <sha> --version <v> [--baseline-version <prev>] [--baseline-commit <sha>] [--remote <ssh-host>] [--remote-mirror <path>] [--pod-pool <pool>] [--pod-shards <n>] [--pod-shard-timeout-seconds <n>] [--recheck-file-limit <n>] [--fresh-shards] [--executor <pod|host>] [--json]\nWithout flags, input.commit, input.version and input.previousVersion come from the JSON file at ELANOUS_GRAPH_CONTEXT.\n--executor host (input.gateExecutor) ignores every pod option and sweeps on --remote (input.gateRemote, required).');
+      console.log('Usage: bun scripts/release-loop/gate-node.ts --commit <sha> --version <v> [--baseline-version <prev>] [--baseline-commit <sha>] [--remote <ssh-host>] [--remote-mirror <path>] [--pod-pool <pool>] [--pod-shards <n>] [--pod-shard-timeout-seconds <n>] [--recheck-file-limit <n>] [--fresh-shards] [--executor <pod|host>] [--rehearsal-baseline] [--json]\nWithout flags, input.commit, input.version and input.previousVersion come from the JSON file at ELANOUS_GRAPH_CONTEXT.\n--executor host (input.gateExecutor) ignores every pod option and sweeps on --remote (input.gateRemote, required).\n--rehearsal-baseline pins source graph bytes only for a direct Pod gate on an isolated rc version.');
       return 0;
     }
     version = opts.version;
@@ -3098,7 +3453,7 @@ export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner
       throw new Error('release gate host reservation requires graph runId and pinned state root');
     const releaseHosts = context && hosts.length
       ? reserveReleaseGateHosts(reservationRoot!, context.runId!, hosts) : () => undefined;
-    try { result = await judge(opts, runner); }
+    try { result = await judge(context?.runId ? { ...opts, graphRunId: context.runId } : opts, runner); }
     finally { releaseHosts(); }
   } catch (error) {
     result = { outcome: 'error', commit: '', introduced: [], preexisting: 0, fixed: 0, knownEnv: 0, knownEnvCleared: [], stalledEnv: [], rcNonzeroNoFailures: [], durationMs: Date.now() - start, error: String(error) };