elanous 0.2.37 → 0.2.40

package/scripts/release-loop/gate-partial.ts

@@ -5,7 +5,7 @@
 // GATE-REUSE-BY-DIFF (0.2.25): a code change no longer forces the full sweep — with the tip's import closure
 // (gate-closure.ts) the plan adds every test that can reach a changed file, and every test whose closure is opaque.
 // `release resume --from gate` now plans this by default when the tip moved (`--no-partial` = full gate).
-import { existsSync, linkSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, linkSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
@@ -23,6 +23,64 @@ export interface PartialPlan {
   files: string[];
   priorFailures: string[];
   priorErrors: string[];
+  /** Per-shard executed container imageID digest (never a Job image ref/tag). Present only when every shard recorded one. */
+  shardImageDigests?: string[];
+}
+
+/** A Pod shard result's executed image ID digest. Job image refs/tags are not this field. */
+export interface PartialPlanShardImage {
+  imageDigest?: string | null;
+}
+
+export type PartialPlanImageDigestDecision =
+  { reuse: 1; reason: 'executed-pod-image-digest-match' }
+  | { reuse: 0; reason: 'executed-pod-image-digest-missing' | 'executed-pod-image-digest-mismatch' };
+
+const IMAGE_DIGEST = /^sha256:[0-9a-f]{64}$/i;
+
+function executedImageDigest(value: unknown): string | null {
+  return typeof value === 'string' && IMAGE_DIGEST.test(value) ? value.toLowerCase() : null;
+}
+
+function shardExecutedDigests(shards: readonly PartialPlanShardImage[]): Array<string | null> {
+  return shards.map((shard) => executedImageDigest(shard.imageDigest));
+}
+
+/** Reuse is allowed only when every shard digest is present and equal. Missing vs mismatch are distinct reasons. */
+export function partialPlanImageDigestsMatch(
+  prior: readonly PartialPlanShardImage[],
+  current?: readonly PartialPlanShardImage[],
+): PartialPlanImageDigestDecision {
+  const left = shardExecutedDigests(prior);
+  if (!left.length || left.some((digest) => !digest)) return { reuse: 0, reason: 'executed-pod-image-digest-missing' };
+  const first = left[0]!;
+  if (left.some((digest) => digest !== first)) return { reuse: 0, reason: 'executed-pod-image-digest-mismatch' };
+  if (current !== undefined) {
+    const right = shardExecutedDigests(current);
+    if (!right.length || right.some((digest) => !digest)) return { reuse: 0, reason: 'executed-pod-image-digest-missing' };
+    if (right.some((digest) => digest !== first)) return { reuse: 0, reason: 'executed-pod-image-digest-mismatch' };
+  }
+  return { reuse: 1, reason: 'executed-pod-image-digest-match' };
+}
+
+function planImageDigestDecision(digests: readonly unknown[]): PartialPlanImageDigestDecision {
+  return partialPlanImageDigestsMatch(digests.map((imageDigest) => ({ imageDigest: typeof imageDigest === 'string' ? imageDigest : null })));
+}
+
+/** Every executed root/retry Pod row. Reads `imageDigest` (container imageID); Job `image` ref/tag is ignored. */
+export function collectExecutedPodShardImages(dir: string, commit?: string): PartialPlanShardImage[] {
+  if (!existsSync(dir)) return [];
+  try {
+    return readdirSync(dir).filter((name) => /^pod-\d+(?:-[\w-]+)?\.json$/.test(name))
+      .sort((a, b) => Number(/^pod-(\d+)/.exec(a)![1]) - Number(/^pod-(\d+)/.exec(b)![1]) || a.localeCompare(b))
+      .map((name) => {
+        try {
+          const row = JSON.parse(readFileSync(join(dir, name), 'utf8')) as { commit?: string; imageDigest?: string };
+          if (commit && row.commit !== commit) return { imageDigest: null };
+          return { imageDigest: row.imageDigest ?? null };
+        } catch { return { imageDigest: null }; }
+      });
+  } catch { return []; }
 }
 
 /** G1: a second measurement of only the failed files on the very same release commit.
@@ -172,10 +230,22 @@ export function planPartialRegate(input: { version: string; priorCommit: string;
   closure?: (changedCode: string[]) => ClosureVerdict;
   /** Tracked at the tip — a deleted changed test is not re-run (nothing to run); a deleted prior-failure file is a full
    *  gate (its failure can be neither re-measured nor carried). Without it every changed test is planned. */
-  existsAtTip?: (file: string) => boolean }):
+  existsAtTip?: (file: string) => boolean;
+  /** Executed Pod shard imageID digests from the prior full gate. A Job image ref/tag is not this field. */
+  priorShards?: readonly PartialPlanShardImage[];
+  /** Executed Pod shard imageID digests of the current sweep, when already measured. */
+  currentShards?: readonly PartialPlanShardImage[];
+  /** Directory of prior full-gate `pod-N.json` rows; collected when `priorShards` is omitted. */
+  priorCutLogs?: string;
+  /** Directory of current-sweep `pod-N.json` rows; collected when `currentShards` is omitted. */
+  currentCutLogs?: string }):
   { ok: true; plan: PartialPlan; closure?: { reached: number; opaque: number } } | { ok: false; reason: string } {
   if (!/^[0-9a-f]{40}$/i.test(input.priorCommit) || !/^[0-9a-f]{40}$/i.test(input.forCommit)) return { ok: false, reason: 'commit is not a full sha' };
   if (input.priorCommit === input.forCommit) return { ok: false, reason: 'no new commit since the prior gate' };
+  const priorShards = input.priorShards ?? (input.priorCutLogs ? collectExecutedPodShardImages(input.priorCutLogs, input.priorCommit) : undefined);
+  const currentShards = input.currentShards ?? (input.currentCutLogs ? collectExecutedPodShardImages(input.currentCutLogs, input.forCommit) : undefined);
+  const imageIdentity = priorShards ? partialPlanImageDigestsMatch(priorShards, currentShards) : undefined;
+  if (imageIdentity && imageIdentity.reuse === 0) return { ok: false, reason: imageIdentity.reason };
   const source = input.changedFiles.filter((file) => !TEST_FILE.test(file) && !isInert(file));
   const list = (files: string[]) => `${files.slice(0, 5).join(', ')}${files.length > 5 ? ` (+${files.length - 5})` : ''}`;
   // Only code is followed through the closure: a changed fixture, JSON, lockfile, config or script is a full gate.
@@ -204,8 +274,12 @@ export function planPartialRegate(input: { version: string; priorCommit: string;
   // but it changes the measured suite and must not masquerade as a carry.
   if (!files.length && (!input.changedFiles.length || input.changedFiles.some((file) => !isInert(file))))
     return { ok: false, reason: 'nothing to re-run (not a docs-only append)' };
+  const shardImageDigests = imageIdentity?.reuse === 1
+    ? shardExecutedDigests(priorShards!).filter((digest): digest is string => !!digest)
+    : undefined;
   return { ok: true, plan: { ...(!files.length ? { kind: 'carry' as const } : {}), version: input.version, priorCommit: input.priorCommit, forCommit: input.forCommit, files,
-    priorFailures: [...input.priorFailures], priorErrors: [...input.priorErrors] }, ...(closure ? { closure } : {}) };
+    priorFailures: [...input.priorFailures], priorErrors: [...input.priorErrors],
+    ...(shardImageDigests ? { shardImageDigests } : {}) }, ...(closure ? { closure } : {}) };
 }
 
 export function writePartialPlan(root: string, plan: PartialPlan): string {
@@ -259,6 +333,11 @@ export function readPartialPlanResult(roots: readonly string[], version: string,
     catch { throw new Error(`invalid gate partial plan: ${path}`); }
     if (failureFiles.some((file) => !rerun.has(file))) throw new Error(`invalid gate partial plan (prior failure not re-run): ${path}`);
     if (raw.forCommit !== commit) { fallbackReason = 'plan-commit-mismatch'; continue; }
+    if (raw.shardImageDigests !== undefined) {
+      if (!Array.isArray(raw.shardImageDigests)) throw new Error(`invalid gate partial plan: ${path}`);
+      const identity = planImageDigestDecision(raw.shardImageDigests);
+      if (identity.reuse === 0) { fallbackReason = identity.reason; continue; }
+    }
     return { plan: raw as PartialPlan, fallbackReason: null };
   }
   return { plan: null, fallbackReason };

package/scripts/release-loop/gate-prewarm-plan.ts

@@ -32,6 +32,41 @@ export type GatePrewarmPlan =
   | { action: 'prepare-mirror'; cutSha: string; lockHash: string }
   | { action: 'start-worker'; cutSha: string; lockHash: string; slotAfter: number };
 
+/** A cut observation names the intended gate profile without granting a Pod slot. */
+export function planGatePrewarmCutShadow(input: GatePrewarmInput | { cutSha: string }, warmMemberCount: number | null):
+  { profile: 'gate'; transition: 'shadow'; plan: GatePrewarmPlan; reason?: 'warm-members-exceed-occupied' } {
+  const shadow = { profile: 'gate' as const, transition: 'shadow' as const };
+  if (!('nowMs' in input) || warmMemberCount === null) {
+    return { ...shadow, plan: { action: 'defer', reason: 'unmeasured' } };
+  }
+  if (input.occupiedPods !== null && warmMemberCount > input.occupiedPods) {
+    return { ...shadow, plan: { action: 'defer', reason: 'unmeasured' }, reason: 'warm-members-exceed-occupied' };
+  }
+  return { ...shadow, plan: planGatePrewarm(input) };
+}
+
+type WarmMemberSnapshot = Record<string, readonly unknown[]>;
+
+/** Compare the same observed cut on both sides of a read-only profile decision. */
+export function observeGatePrewarmCutShadow(input: GatePrewarmInput | { cutSha: string },
+  readWarmMembers: () => WarmMemberSnapshot | null, readPlacement: () => Record<string, number>) {
+  const placementBefore = readPlacement();
+  const membersBefore = readWarmMembers();
+  const memberCountBefore = membersBefore ? Object.values(membersBefore).reduce((n, rows) => n + rows.length, 0) : null;
+  const shadow = planGatePrewarmCutShadow(input, memberCountBefore);
+  const membersAfter = readWarmMembers();
+  const placementAfter = readPlacement();
+  const memberCountAfter = membersAfter ? Object.values(membersAfter).reduce((n, rows) => n + rows.length, 0) : null;
+  const stable = membersBefore !== null && membersAfter !== null
+    && JSON.stringify(membersBefore) === JSON.stringify(membersAfter)
+    && JSON.stringify(placementBefore) === JSON.stringify(placementAfter);
+  if (!stable) return { profile: 'gate' as const, transition: 'shadow' as const, status: 'unmeasured' as const,
+    plan: { action: 'defer' as const, reason: 'unmeasured' as const }, reason: 'warm-members-unmeasured-or-changed' as const,
+    memberCountBefore, memberCountAfter, membersBefore, membersAfter, placementBefore, placementAfter };
+  return { ...shadow, status: shadow.plan.action === 'defer' && shadow.plan.reason === 'unmeasured' ? 'unmeasured' as const : 'observed' as const,
+    memberCountBefore, memberCountAfter, membersBefore, membersAfter, placementBefore, placementAfter };
+}
+
 const count = (value: number | null): value is number =>
   value !== null && Number.isSafeInteger(value) && value >= 0;
 

package/scripts/release-loop/gate-radius-live.ts

@@ -152,8 +152,10 @@ export function planHardRehearsalRadius(input: { root: string; repo: string; ver
       const planned = planPartialRegate({ version: input.version, priorCommit: stamp.sha, forCommit: input.forCommit,
         changedFiles: effective, priorFailures: failures.failures, priorErrors: failures.errors ?? [],
         existsAtTip: (file) => tree.files.includes(file),
-        closure: (code) => testsReachingChanged(tree, code, tests) });
-      if (!planned.ok && effective.length) return full(planned.reason);
+        closure: (code) => testsReachingChanged(tree, code, tests),
+        priorCutLogs: join(dir, 'gate-logs', 'cut') });
+      if (!planned.ok && (effective.length || planned.reason.startsWith('executed-pod-image-digest-')))
+        return full(planned.reason);
       let fileSet: string[];
       let base: PartialPlan;
       if (planned.ok) {

package/scripts/release-loop/gate-shard-dispatch.ts

@@ -0,0 +1,128 @@
+/** Pure, fail-closed planning for a release gate measured across hosts. No host command runs here. */
+export interface GateShardIdentity {
+  id: string;
+  files: string[];
+  /** Execution requirement, never a concrete host identity. */
+  requiredOs?: 'darwin' | 'linux';
+}
+
+export interface GateShardReceipt extends GateShardIdentity {
+  head40: string;
+  base40: string;
+  host: string;
+  envKey: string;
+  status: 'complete' | 'unmeasured';
+  /** A complete measurement can contain existing or introduced failures. */
+  failureIds: string[];
+  errorIds: string[];
+  /** Relative path to the measurement artifact, checked by the caller before reuse. */
+  evidencePath: string;
+  evidenceSha256: string;
+  measuredAt: string;
+  attempt: number;
+}
+
+export interface GateShardHost {
+  id: string;
+  platform: 'darwin' | 'linux' | 'other';
+  available: boolean;
+  reserved: boolean;
+}
+
+export interface GateShardDispatchInput {
+  head40: string;
+  base40: string;
+  shards: readonly GateShardIdentity[];
+  receipts: readonly GateShardReceipt[];
+  hosts: readonly GateShardHost[];
+  rerouteShard?: string | 'auto';
+  shardHost?: string;
+  /** IDs known to pass on macOS, supplied by the caller's env-known policy. */
+  macPassShardIds?: readonly string[];
+}
+
+export type GateShardAction =
+  | { shardId: string; files: string[]; kind: 'reuse'; receipt: GateShardReceipt }
+  | { shardId: string; files: string[]; kind: 'run'; host: string; replacing?: GateShardReceipt }
+  | { shardId: string; files: string[]; kind: 'unmeasured'; reason: string };
+
+const SHA40 = /^[a-f0-9]{40}$/i;
+const safeId = (id: string) => /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(id);
+const sameFiles = (a: readonly string[], b: readonly string[]) => a.length === b.length && a.every((file, i) => file === b[i]);
+
+export function validGateShardIdentity(head40: string, base40: string, shards: readonly GateShardIdentity[]): boolean {
+  if (!SHA40.test(head40) || !SHA40.test(base40) || shards.length === 0) return false;
+  const ids = new Set<string>();
+  const files = new Set<string>();
+  for (const shard of shards) {
+    if (!safeId(shard.id) || ids.has(shard.id) || shard.files.length === 0
+      || (shard.requiredOs !== undefined && shard.requiredOs !== 'darwin' && shard.requiredOs !== 'linux')) return false;
+    ids.add(shard.id);
+    for (const file of shard.files) {
+      if (!/^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/.test(file) || file.split('/').includes('..') || files.has(file)) return false;
+      files.add(file);
+    }
+  }
+  return true;
+}
+
+export function eligibleGateShardReceipt(
+  receipt: GateShardReceipt,
+  shard: GateShardIdentity,
+  head40: string,
+  base40: string,
+): boolean {
+  return receipt.status === 'complete' && receipt.id === shard.id
+      && receipt.head40 === head40 && receipt.base40 === base40 && sameFiles(receipt.files, shard.files)
+      && receipt.envKey.trim().length > 0 && receipt.host.trim().length > 0
+      && receipt.evidencePath.trim().length > 0 && /^[a-f0-9]{64}$/i.test(receipt.evidenceSha256)
+      && Number.isSafeInteger(receipt.attempt) && receipt.attempt > 0
+      && Array.isArray(receipt.failureIds) && receipt.failureIds.every((id) => typeof id === 'string')
+      && Array.isArray(receipt.errorIds) && receipt.errorIds.every((id) => typeof id === 'string');
+}
+
+/** Reuse only exact complete measurements. A requested remeasure replaces one shard, not the whole sweep. */
+export function planGateShardDispatch(input: GateShardDispatchInput): GateShardAction[] {
+  if (!validGateShardIdentity(input.head40, input.base40, input.shards)) throw new Error('invalid gate shard identity');
+  if (input.rerouteShard && input.rerouteShard !== 'auto' && !input.shards.some((s) => s.id === input.rerouteShard))
+    throw new Error(`unknown reroute shard: ${input.rerouteShard}`);
+  if (input.shardHost && !input.hosts.some((host) => host.id === input.shardHost)) throw new Error(`unknown shard host: ${input.shardHost}`);
+  const hosts = input.hosts.filter((host) => host.available && !host.reserved);
+  const macPass = new Set(input.macPassShardIds ?? []);
+  let nextHost = 0;
+  return input.shards.map((shard) => {
+    const receipt = [...input.receipts].reverse().find((r) => eligibleGateShardReceipt(r, shard, input.head40, input.base40));
+    const prior = [...input.receipts].reverse().find((r) => r.id === shard.id && r.head40 === input.head40 && r.base40 === input.base40 && sameFiles(r.files, shard.files));
+    const forced = input.rerouteShard === shard.id;
+    const auto = input.rerouteShard === 'auto' && (prior?.status === 'unmeasured'
+      || (macPass.has(shard.id) && !!prior && (prior.failureIds.length > 0 || prior.errorIds.length > 0)));
+    const receiptHost = hosts.find((host) => host.id === receipt?.host);
+    if (receipt && !forced && !auto && (!shard.requiredOs || receiptHost?.platform === shard.requiredOs))
+      return { shardId: shard.id, files: [...shard.files], kind: 'reuse', receipt };
+    let candidates = hosts.filter((host) => !shard.requiredOs || host.platform === shard.requiredOs);
+    if (input.shardHost && (forced || auto)) candidates = candidates.filter((host) => host.id === input.shardHost);
+    else if (auto && macPass.has(shard.id)) candidates = candidates.filter((host) => host.platform === 'darwin');
+    if ((forced || auto) && prior && candidates.some((host) => host.id !== prior.host)) candidates = candidates.filter((host) => host.id !== prior.host);
+    if (!candidates.length) return { shardId: shard.id, files: [...shard.files], kind: 'unmeasured', reason: 'no eligible host' };
+    const host = candidates[nextHost++ % candidates.length]!;
+    return { shardId: shard.id, files: [...shard.files], kind: 'run', host: host.id, ...(prior ? { replacing: prior } : {}) };
+  });
+}
+
+export type GateShardReduction =
+  | { status: 'complete'; failureIds: string[]; errorIds: string[]; receipts: GateShardReceipt[] }
+  | { status: 'unmeasured'; reason: string };
+
+/** Require exactly one exact, complete receipt per expected shard; classification remains with judgeGate. */
+export function reduceGateShardReceipts(input: { head40: string; base40: string; shards: readonly GateShardIdentity[]; receipts: readonly GateShardReceipt[] }): GateShardReduction {
+  if (!validGateShardIdentity(input.head40, input.base40, input.shards)) return { status: 'unmeasured', reason: 'invalid gate shard identity' };
+  const selected: GateShardReceipt[] = [];
+  for (const shard of input.shards) {
+    const matched = input.receipts.filter((r) => eligibleGateShardReceipt(r, shard, input.head40, input.base40));
+    if (matched.length !== 1) return { status: 'unmeasured', reason: `${shard.id}: expected one complete receipt, found ${matched.length}` };
+    selected.push(matched[0]!);
+  }
+  return { status: 'complete', receipts: selected,
+    failureIds: [...new Set(selected.flatMap((r) => r.failureIds))].sort(),
+    errorIds: [...new Set(selected.flatMap((r) => r.errorIds))].sort() };
+}

package/scripts/release-loop/gate-shard-receipts.ts

@@ -0,0 +1,89 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { eligibleGateShardReceipt, type GateShardIdentity, type GateShardReceipt } from './gate-shard-dispatch.js';
+
+export interface GateShardSavedRun {
+  output: string;
+  rc: number;
+  pass: number;
+  fail: number;
+  errors: number;
+  ran: number;
+  files: number;
+  passedIds: string[];
+}
+
+export interface GateShardSavedResult {
+  receipt: GateShardReceipt;
+  runs: GateShardSavedRun[];
+}
+
+export function gateShardReceiptPath(root: string, shardId: string): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(shardId)) throw new Error('invalid shard id');
+  return join(root, `${shardId}.receipt.json`);
+}
+
+export function nextGateShardAttempt(root: string, shardId: string): number {
+  try {
+    const previous = JSON.parse(readFileSync(gateShardReceiptPath(root, shardId), 'utf8')) as { attempt?: unknown };
+    return Number.isSafeInteger(previous.attempt) && (previous.attempt as number) > 0 ? (previous.attempt as number) + 1 : 1;
+  } catch { return 1; }
+}
+
+/** Planning may inspect an unmeasured predecessor; only readGateShardResult authorizes reuse. */
+export function readGateShardManifest(root: string, shardId: string): GateShardReceipt | null {
+  try {
+    const value = JSON.parse(readFileSync(gateShardReceiptPath(root, shardId), 'utf8')) as GateShardReceipt;
+    return value && value.id === shardId && Array.isArray(value.files)
+      && Array.isArray(value.failureIds) && value.failureIds.every((id) => typeof id === 'string')
+      && Array.isArray(value.errorIds) && value.errorIds.every((id) => typeof id === 'string')
+      && (value.status === 'complete' || value.status === 'unmeasured') ? value : null;
+  } catch { return null; }
+}
+
+function atomicJson(path: string, value: unknown): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = join(dirname(path), `.${basename(path)}-${process.pid}-${randomUUID()}.tmp`);
+  try { writeFileSync(temp, JSON.stringify(value) + '\n', { mode: 0o600 }); renameSync(temp, path); }
+  finally { if (existsSync(temp)) rmSync(temp); }
+}
+
+/** A new attempt invalidates an old success before host execution starts. */
+export function markGateShardUnmeasured(root: string, receipt: GateShardReceipt): void {
+  atomicJson(gateShardReceiptPath(root, receipt.id), { ...receipt, status: 'unmeasured' });
+}
+
+/** Save the actual measured bytes and bind their digest to the manifest. */
+export function saveGateShardResult(root: string, result: GateShardSavedResult): GateShardReceipt {
+  const { receipt, runs } = result;
+  if (!eligibleGateShardReceipt(receipt, receipt, receipt.head40, receipt.base40) || !runs.length
+    || runs.some((run) => !Number.isSafeInteger(run.ran) || run.ran < 0 || !Number.isSafeInteger(run.files) || run.files < 1))
+    throw new Error('incomplete gate shard result');
+  const payloadName = `${receipt.id}.attempt-${receipt.attempt}-${randomUUID()}.result.json`;
+  const payloadBody = { runs, failureIds: receipt.failureIds, errorIds: receipt.errorIds };
+  const payload = JSON.stringify(payloadBody) + '\n';
+  const digest = createHash('sha256').update(payload).digest('hex');
+  atomicJson(join(root, payloadName), payloadBody);
+  const saved = { ...receipt, evidencePath: payloadName, evidenceSha256: digest };
+  atomicJson(gateShardReceiptPath(root, receipt.id), saved);
+  return saved;
+}
+
+/** No manifest, stale identity, missing bytes or digest mismatch can become a reused pass. */
+export function readGateShardResult(root: string, expected: { shard: GateShardIdentity; head40: string; base40: string; envKey: string }): GateShardSavedResult | null {
+  try {
+    const receipt = JSON.parse(readFileSync(gateShardReceiptPath(root, expected.shard.id), 'utf8')) as GateShardReceipt;
+    if (!eligibleGateShardReceipt(receipt, expected.shard, expected.head40, expected.base40) || receipt.envKey !== expected.envKey
+      || !/^[A-Za-z0-9][A-Za-z0-9._-]*\.result\.json$/.test(receipt.evidencePath)) return null;
+    const payload = readFileSync(join(root, receipt.evidencePath), 'utf8');
+    if (createHash('sha256').update(payload).digest('hex') !== receipt.evidenceSha256) return null;
+    const parsed = JSON.parse(payload) as { runs?: GateShardSavedRun[]; failureIds?: string[]; errorIds?: string[] };
+    if (!Array.isArray(parsed.runs) || parsed.runs.length === 0 || parsed.runs.some((run) =>
+      typeof run.output !== 'string' || !Number.isSafeInteger(run.rc) || !Number.isSafeInteger(run.ran)
+      || !Number.isSafeInteger(run.files) || !Array.isArray(run.passedIds))
+      || JSON.stringify(parsed.failureIds) !== JSON.stringify(receipt.failureIds)
+      || JSON.stringify(parsed.errorIds) !== JSON.stringify(receipt.errorIds)) return null;
+    return { receipt, runs: parsed.runs };
+  } catch { return null; }
+}

package/scripts/release-loop/gate-wall.ts

@@ -79,12 +79,12 @@ function attempt(dir: string, commit: string, pods: TimedPod[]): GateWallAttempt
 const SHARDS_WINDOW_SLACK_MS = 5 * 60_000;
 /**
  * shards.json is a snapshot of the latest attempt, not an archive of every commit, and has no attempt identity.
- * A row is attributed to the attempt only when its root id is one of the attempt's roots AND
+ * A row is attributed to the attempt only when its id is one of the attempt's pod records AND
  * a row starts inside the attempt's pod-record window (from 5 min before its first start to its last end) — a
  * previous attempt's snapshot reusing `pod-0` started earlier and is rejected. The end is free: a longer
  * snapshot is exactly the disagreement this report keeps.
  */
-function shardsSpan(dir: string, rootNames: Set<string>, window: { start: number; end: number }): number | 'outside-attempt-window' | null {
+function shardsSpan(dir: string, podNames: Set<string>, window: { start: number; end: number }): number | 'outside-attempt-window' | null {
   try {
     const file: unknown = JSON.parse(readFileSync(join(dir, 'shards.json'), 'utf8'));
     if (!file || typeof file !== 'object' || !('shards' in file) || !Array.isArray(file.shards)) return null;
@@ -94,7 +94,7 @@ function shardsSpan(dir: string, rootNames: Set<string>, window: { start: number
     const ends: number[] = [];
     for (const row of rows) {
       if (!row || typeof row !== 'object' || !('id' in row) || typeof row.id !== 'string'
-        || !rootNames.has(`${row.id}.json`)) return null;
+        || !podNames.has(`${row.id}.json`)) return null;
       const start = 'startedAt' in row && typeof row.startedAt === 'string' ? Date.parse(row.startedAt) : NaN;
       const end = 'endedAt' in row && typeof row.endedAt === 'string' ? Date.parse(row.endedAt) : NaN;
       if (!Number.isFinite(start) || !Number.isFinite(end) || end < start) return null;
@@ -134,10 +134,10 @@ export function gateWall(dir: string, opts: { commit?: string; targetMin?: numbe
   const chosen = matching.find(([, pods]) => pods.some((p) => p.root));
   const attempts = ordered.map(([commit, pods]) => attempt(dir, commit, pods));
   const selected = chosen && attempts.find((a) => a.commit === chosen[0]);
-  // The snapshot has no commit field. Only the latest recorded attempt can own it; require its root row IDs too.
+  // The snapshot has no commit field. Only the latest recorded attempt can own it; require every row's pod record.
   const latest = chosen !== undefined && ordered[0]?.[0] === chosen[0];
   const span = chosen && latest
-    ? shardsSpan(dir, new Set(chosen[1].filter((p) => p.root).map((p) => p.name)),
+    ? shardsSpan(dir, new Set(chosen[1].map((p) => p.name)),
       { start: Math.min(...chosen[1].map((p) => p.start)), end: Math.max(...chosen[1].map((p) => p.end)) }) : null;
   const snapshot = typeof span === 'number' ? span : null;
   const shardsWallMin = snapshot;

package/scripts/release-loop/preflight.ts

@@ -106,10 +106,14 @@ export async function scanOriginMainExport(): Promise<{ mainSha: string; files:
     try { code = runPublicExport(['--leak-check', '--json'], snapshot); }
     finally { console.log = originalLog; console.error = originalError; }
     const report = JSON.parse(output.trim()) as {
-      files?: number; leaks?: number; hits?: Array<{ marker: string }>; codeLiterals?: { hits?: number };
+      files?: number; leaks?: number; hits?: Array<{ marker: string; file?: string; line?: number }>; codeLiterals?: { hits?: number };
       privateRedactions?: { loaded?: boolean };
     };
-    if (report.privateRedactions?.loaded !== true) throw new Error('개인 치환표를 읽지 못해 export 누수 검사를 완결할 수 없다');
+    if (report.privateRedactions?.loaded !== true) {
+      const failure = report.hits?.find((hit) => hit.marker.startsWith('private-redaction-'));
+      if (failure) throw new Error(`공개 export 개인 치환 실패: ${failure.marker} ${failure.file ?? ''}:${failure.line ?? 0}`);
+      throw new Error('개인 치환표를 읽지 못해 export 누수 검사를 완결할 수 없다');
+    }
     if (typeof report.files !== 'number' || typeof report.leaks !== 'number') throw new Error('public-export 검사 결과가 완전하지 않다');
     if (code !== (report.leaks > 0 ? 1 : 0)) throw new Error(`public-export 종료 코드와 누수 결과 불일치: rc=${code} leaks=${report.leaks}`);
     return { mainSha, files: report.files, leaks: report.leaks, codeLiterals: report.codeLiterals?.hits ?? 0 };

package/scripts/release-loop/resume-cap.ts

@@ -27,7 +27,8 @@ export function reserveReleaseResumeAttempt(state: GraphRunState, root: string,
   const priorCountKnown = hadLedger ? saved.priorCountKnown !== false : !state.resume;
   if (options.checkOnly) return { attempt: saved.attempts.length + 1, path, priorCountKnown };
   const at = (options.now ?? (() => new Date()))().toISOString();
-  const next = { version, runId: state.runId, priorCountKnown, attempts: [...saved.attempts, at] };
+  // `...saved` keeps fields this function does not own (RELEASE-RECOVER-ONE-CMD stage results) across a resume.
+  const next = { ...saved, version, runId: state.runId, priorCountKnown, attempts: [...saved.attempts, at] };
   mkdirSync(dirname(path), { recursive: true });
   const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
   try { writeFileSync(temp, `${JSON.stringify(next)}\n`, { mode: 0o600 }); renameSync(temp, path); }