elanous 0.2.38 → 0.2.41

package/src/self-implement/gate-receipt-registry.ts

@@ -0,0 +1,180 @@
+/**
+ * GATE-ONCE-PER-HEAD (0.2.40 첫 조각 · OP 10-27 23:0x 지시) — host-regate 통과 영수증의 지속 등록부.
+ *
+ * S: 같은 PR head 의 자식 gate 뒤 host-regate 와 착지 게이트가 같은 시험을 다시 실행해 Pod 와 호스트 자원을 소모한다.
+ * C: 통과 사실이 어디에도 남지 않아 매 호출이 전 검사를 다시 돌릴 수밖에 없다.
+ * Q: 정확히 같은 통합 입력과 측정 범위에 대해 이미 통과한 게이트만 승계할 수 있는가?
+ * A: 통과 영수증을 이 등록부에 원자적으로 기록하고, runHostRegate 가 재검증·통합 후보 구성 뒤 현재 key 와
+ *    일치하는 통과 영수증만 승계한다. 불일치·결손·불완전·실패/측정불가 영수증은 원래 검사를 실행한다.
+ *
+ * 원본 영수증 없이 통과 판정 금지: 승계는 저장된 영수증 행 하나를 통해서만 일어나고, 그 행의 key 는
+ * 행 스스로의 필드에서 다시 계산되어야 한다(gateReceiptSelfKey). key 가 필드와 맞지 않는 행은 저장도
+ * 승계도 거절한다.
+ *
+ * 원자성: saveGateReceipts 는 임시 파일에 온전히 쓴 뒤 rename(2) 로 바꾼다 — 부분 쓰기는 관측될 수 없다.
+ * 프로세스끼리의 동시 저장은 각자 온전한 등록부를 남긴다(늦은 쪽이 이긴다). 잃은 영수증은 다음 호출을
+ * 원래 검사로 되돌릴 뿐, 잘못된 통과를 만들지 않는다 — 실패 방향으로 열린다.
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { gateTestBaseline } from '../../scripts/lib/gate-test-env.js';
+
+export const GATE_RECEIPT_SCHEMA = 1;
+export type GateReceiptVerdict = 'passed' | 'failed' | 'unmeasured';
+
+const SHA40 = /^[0-9a-f]{40}$/i;
+const SHA256 = /^[0-9a-f]{64}$/i;
+
+/** 한 번의 host-regate 측정을 정체 짓는 입력. 판정(verdict)은 identity 가 아니라 key 계산에 들어간다. */
+export interface GateReceiptIdentity {
+  /** 40자 PR head SHA */
+  headCommit: string;
+  /** 40자 실제 측정 base SHA — PR 에 기록된 baseRefOid 가 아니라 얹어 잰 끝 */
+  baseCommit: string;
+  /** 검사를 실행한 Bun 식별값(bun --version) */
+  bunVersion: string;
+  /** 검사가 설치·실행한 lockfile 의 SHA-256(bun.lock/bun.lockb 바이트) — 없으면 'absent' */
+  lockfileHash: string;
+  /** 정규화된 radius 파일 집합(병합 후보 기준 변경 파일 — 중복 제거·정렬) */
+  radiusFiles: readonly string[];
+  /** 이 영수증이 통과한 검사 토큰(종류 ⊕ 측정 범위 — 중복 제거·정렬) */
+  checks: readonly string[];
+  /** 실행 환경 지문(gateEnvFingerprint) */
+  envFingerprint: string;
+}
+
+export interface GateReceipt extends GateReceiptIdentity {
+  schema: typeof GATE_RECEIPT_SCHEMA;
+  key: string;
+  verdict: GateReceiptVerdict;
+  savedAt: string;
+}
+
+export type GateReceiptRegistry = Record<string, GateReceipt>;
+
+/**
+ * 검사 종류·판정·환경까지 포함한 정준 직렬화의 SHA-256. 같은 측정·같은 판정만 같은 key 를 받는다.
+ * head/base 는 40자 hex 여야 한다 — 그보다 못한 입력으로 영수증을 만들 수 없게 문을 닫는다.
+ */
+export function computeReceiptKey(identity: GateReceiptIdentity, verdict: GateReceiptVerdict): string {
+  if (!SHA40.test(identity.headCommit)) throw new Error('gate receipt head SHA is not 40 hex characters');
+  if (!SHA40.test(identity.baseCommit)) throw new Error('gate receipt base SHA is not 40 hex characters');
+  const canonical = JSON.stringify({
+    schema: GATE_RECEIPT_SCHEMA,
+    head: identity.headCommit.toLowerCase(),
+    base: identity.baseCommit.toLowerCase(),
+    bun: identity.bunVersion,
+    lockfile: identity.lockfileHash,
+    radius: [...new Set(identity.radiusFiles)].sort(),
+    checks: [...new Set(identity.checks)].sort(),
+    env: identity.envFingerprint,
+    verdict,
+  });
+  return createHash('sha256').update(canonical).digest('hex');
+}
+
+/** 행의 key 를 행 스스로의 필드에서 다시 계산한다 — 위조·불일치 행은 저장된 key 와 어긋난다. */
+export function gateReceiptSelfKey(receipt: GateReceipt): string {
+  return computeReceiptKey(receipt, receipt.verdict);
+}
+
+function isGateReceipt(value: unknown): value is GateReceipt {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const row = value as Partial<GateReceipt>;
+  return row.schema === GATE_RECEIPT_SCHEMA && typeof row.key === 'string' && SHA256.test(row.key)
+    && (row.verdict === 'passed' || row.verdict === 'failed' || row.verdict === 'unmeasured')
+    && SHA40.test(row.headCommit ?? '') && SHA40.test(row.baseCommit ?? '')
+    && typeof row.bunVersion === 'string' && typeof row.lockfileHash === 'string'
+    && Array.isArray(row.radiusFiles) && row.radiusFiles.every((file) => typeof file === 'string')
+    && Array.isArray(row.checks) && row.checks.every((check) => typeof check === 'string')
+    && typeof row.envFingerprint === 'string' && typeof row.savedAt === 'string';
+}
+
+/**
+ * 결손·손상 파일은 빈 등록부로 복구한다 — 못 읽은 영수증은 «없다» 로 취급해 원래 검사를 실행한다.
+ * 모양이 어긋나거나 행의 key 가 맵 키와 다른 행은 버린다.
+ */
+export function loadGateReceipts(path: string): GateReceiptRegistry {
+  let raw: string;
+  try { raw = readFileSync(path, 'utf8'); }
+  catch { return {}; }
+  let parsed: unknown;
+  try { parsed = JSON.parse(raw); }
+  catch { return {}; }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return {};
+  const registry: GateReceiptRegistry = {};
+  for (const [key, value] of Object.entries(parsed as Record<string, unknown>)) {
+    if (!isGateReceipt(value) || value.key !== key) continue;
+    registry[key] = value;
+  }
+  return registry;
+}
+
+/** write-then-rename 원자적 기록 — 부분 쓰기 노출 금지. 임시 파일은 같은 디렉터리에 무작위 이름으로 둔다. */
+export function saveGateReceipts(path: string, registry: GateReceiptRegistry): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = join(dirname(path), `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
+  writeFileSync(tmp, `${JSON.stringify(registry, null, 2)}\n`);
+  try { renameSync(tmp, path); }
+  catch (error) {
+    try { unlinkSync(tmp); } catch { /* 최선의 정리 — 원래 오류를 지운다 */ }
+    throw error;
+  }
+}
+
+/** 통과 영수증을 지속 등록부에 원자적으로 병합 기록한다. key 가 필드와 맞지 않는 행은 쓰기 단계에서 거절한다. */
+export function saveGateReceipt(path: string, receipt: GateReceipt): void {
+  if (gateReceiptSelfKey(receipt) !== receipt.key) throw new Error('gate receipt key does not match its own fields');
+  const registry = loadGateReceipts(path);
+  registry[receipt.key] = receipt;
+  saveGateReceipts(path, registry);
+}
+
+/**
+ * 승계 거절 사유. 불일치(head/base/env/Bun·lockfile/radius)·결손·불완전(현재 측정 범위 미커버)·
+ * 실패/측정불가 판정을 가려 한 줄로 남긴다 — debug.log 의 decline 이유가 된다.
+ */
+export function describeGateReceiptDecline(probe: GateReceiptIdentity, registry: GateReceiptRegistry): string {
+  const receipts = Object.values(registry);
+  if (!receipts.length) return 'gate receipt registry empty';
+  const sameHeadBase = receipts.filter((receipt) => receipt.headCommit.toLowerCase() === probe.headCommit.toLowerCase()
+    && receipt.baseCommit.toLowerCase() === probe.baseCommit.toLowerCase());
+  if (!sameHeadBase.length) return `no receipt for head ${probe.headCommit.slice(0, 12)} base ${probe.baseCommit.slice(0, 12)}`;
+  for (const receipt of sameHeadBase) {
+    const differs: string[] = [];
+    if (receipt.verdict !== 'passed') differs.push(`verdict=${receipt.verdict}`);
+    if (receipt.envFingerprint !== probe.envFingerprint) differs.push('env fingerprint differs');
+    if (receipt.bunVersion !== probe.bunVersion || receipt.lockfileHash !== probe.lockfileHash) differs.push('bun/lockfile differs');
+    if ([...new Set(receipt.radiusFiles)].sort().join('\n') !== [...new Set(probe.radiusFiles)].sort().join('\n')) differs.push('changed-file radius differs');
+    const current = [...new Set(probe.checks)].sort();
+    const stored = [...new Set(receipt.checks)].sort();
+    if (stored.join('\n') !== current.join('\n')) {
+      const missing = current.filter((check) => !stored.includes(check));
+      differs.push(missing.length && stored.every((check) => current.includes(check))
+        ? `receipt does not cover: ${missing.join(',')}`
+        : `receipt checks differ (stored ${stored.join(',')})`);
+    }
+    if (differs.length) return `receipt ${receipt.key.slice(0, 12)} ${differs.join(' · ')}`;
+  }
+  return 'no stored receipt matches this measurement key';
+}
+
+/** 실행 환경 지문: 플랫폼 ⊕ 게이트 시험 baseline(TZ·locale·fake-LLM 스위치)의 정준 직렬화 SHA-256. */
+export function gateEnvFingerprint(env: NodeJS.ProcessEnv): string {
+  const baseline = gateTestBaseline(env);
+  const canonical = JSON.stringify({
+    platform: process.platform,
+    env: Object.fromEntries(Object.entries(baseline).sort(([a], [b]) => a.localeCompare(b))),
+  });
+  return createHash('sha256').update(canonical).digest('hex');
+}
+
+/** 후보 워크트리가 실제로 설치·실행한 lockfile 의 SHA-256. 둘 다 없으면 'absent'. */
+export function gateLockfileHash(worktree: string): string {
+  for (const name of ['bun.lock', 'bun.lockb']) {
+    if (!existsSync(join(worktree, name))) continue;
+    return createHash('sha256').update(readFileSync(join(worktree, name))).digest('hex');
+  }
+  return 'absent';
+}

package/src/self-implement/gate-remote.ts

@@ -7,7 +7,7 @@ import { existsSync, lstatSync, realpathSync } from 'node:fs';
 import { loadavg } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { debug } from '../debug/log.js';
-import { gateHostReservationRoot, inspectReleaseGateHost } from '../release-loop/gate-host-reservation.js';
+import { gateHostReservationRoot, inspectReleaseGateHost, readGateHostResourcesForHost, type GateHostResourceReading } from '../release-loop/gate-host-reservation.js';
 import type { GateRemoteConfig } from '../user-config.js';
 
 export type GateRemoteTool = 'self-gate' | 'ci-typecheck-changed' | 'public-export-test-run';
@@ -97,6 +97,7 @@ export function remoteSelfGateArgv(input: {
   shardConcurrency?: number;
   fixedShardDistribution?: boolean;
   includeImporters?: boolean;
+  noInherit?: boolean;
   artifactDir?: string;
 }, sha: (ref: string) => string): string[] {
   const shards = input.shards ?? (input.includeImporters ? 2 : undefined);
@@ -106,6 +107,7 @@ export function remoteSelfGateArgv(input: {
     ...(input.shardConcurrency !== undefined ? ['--shard-concurrency', String(input.shardConcurrency)] : []),
     ...(input.fixedShardDistribution ? ['--fixed-shard-distribution'] : []),
     ...(input.includeImporters ? ['--include-importers'] : []),
+    ...(input.noInherit ? ['--no-inherit'] : []),
     ...(input.artifactDir ? ['--artifact-dir', input.artifactDir] : [])];
 }
 
@@ -131,6 +133,8 @@ export function decideGateDispatch(input: { flags: Pick<GateRemoteFlags, 'remote
 
 export const SLOT_DIR = '/tmp/elanous-gate-remote-slots';
 const BUSY = '__GATE_REMOTE_BUSY';
+const HEARTBEAT = '__GATE_REMOTE_HEARTBEAT=';
+const REMOTE_RUN_LIMIT_SECONDS = 105 * 60;
 
 /** Shell lines that run "$W/run.sh" under the first free of `cap` slot locks, or print the busy marker and exit 98.
  *  run.sh must create "$W/started" first: that is how a lock refusal is told apart from the run's own exit code. */
@@ -138,14 +142,14 @@ export type SlotLockTool = 'flock' | 'lockf';
 const SLOT_LOCK = { flock: 'flock -n', lockf: 'lockf -k -s -t 0' } as const;
 
 /** `tools` is the preference order (default: Linux flock, then BSD/macOS lockf); a test can pin one path. */
-function hostSlotScriptWithSlot(cap: number, dir: string, tools: readonly SlotLockTool[], passSlot: boolean): string[] {
+function hostSlotScriptWithSlot(cap: number, dir: string, tools: readonly SlotLockTool[], passSlot: boolean, supervised = false): string[] {
   const n = Math.min(MAX_HOST_CAP, Math.max(1, Math.floor(cap)));
   const pick = tools.map((tool, i) => `${i ? 'elif' : 'if'} command -v ${tool} >/dev/null 2>&1; then GL="${SLOT_LOCK[tool]}"; `).join('');
   return [
     `GS=${quote(dir)}; mkdir -p "$GS" || infra slots`,
     `${pick}else infra lock-tool; fi`,
     'load1() { if [ -r /proc/loadavg ]; then awk \'NR==1 {print $1}\' /proc/loadavg; elif command -v sysctl >/dev/null 2>&1; then sysctl -n vm.loadavg 2>/dev/null | awk \'{gsub(/[{}]/, ""); print $1}\'; else echo unknown; fi; }',
-    `n=1; while [ $n -le ${n} ]; do $GL "$GS/slot$n" ${passSlot ? 'env GATE_REMOTE_SLOT="$n" ' : ''}sh "$W/run.sh"; s=$?; [ -f "$W/started" ] && exit $s; n=$((n+1)); done`,
+    `n=1; while [ $n -le ${n} ]; do $GL "$GS/slot$n" ${passSlot ? 'env GATE_REMOTE_SLOT="$n" ' : ''}sh "$W/${supervised ? 'supervise.sh' : 'run.sh'}"; s=$?; ${supervised ? '[ -f "$W/supervisor-timeout" ] && infra run-timeout; [ -f "$W/supervisor-infra" ] && infra supervisor-lost; ' : ''}[ -f "$W/started" ] && exit $s; n=$((n+1)); done`,
     `echo "${BUSY}=$((n-1));load1=$(load1)" >&2; exit 98`,
   ];
 }
@@ -154,6 +158,53 @@ export function hostSlotScript(cap: number, dir = SLOT_DIR, tools: readonly Slot
   return hostSlotScriptWithSlot(cap, dir, tools, false);
 }
 
+/** A slot holder owns exactly one new process group. On a lost SSH shell or wall limit it signals only that group,
+ *  after checking its unreaped direct child's PGID. The heartbeat also detects a severed SSH output pipe while
+ *  a silent test is running; runOnRemote removes only these transport lines from the tool's stderr. */
+export function remoteSupervisorScript(limitSeconds = REMOTE_RUN_LIMIT_SECONDS): string {
+  const limit = Number.isSafeInteger(limitSeconds) && limitSeconds > 0 ? limitSeconds : REMOTE_RUN_LIMIT_SECONDS;
+  return [
+    '#!/bin/sh',
+    'child=',
+    'ready=0',
+    'owned_group() {',
+    '  [ -n "$child" ] && kill -0 "$child" 2>/dev/null && [ "$(ps -p "$child" -o pgid= 2>/dev/null | tr -d " ")" = "$child" ] || return 1',
+    '}',
+    'reap() {',
+    // Our direct child stays unreaped until the caller waits, so its PID/PGID cannot be reused here.
+    '  [ "$ready" -eq 1 ] && owned_group || return 0',
+    '  kill -TERM -- "-$child" 2>/dev/null || kill -TERM "-$child" 2>/dev/null || :',
+    '  sleep 2',
+    // The leader remains our unreaped child until the caller waits, so its PGID cannot be reused here. A TERM-ignoring
+    // grandchild may outlive the leader; rechecking only the leader would miss that member of the same owned group.
+    '  kill -KILL -- "-$child" 2>/dev/null || kill -KILL "-$child" 2>/dev/null || :',
+    '}',
+    'trap \'reap\' HUP INT TERM EXIT',
+    'perl -MPOSIX -e \'POSIX::setpgid(0,0) == 0 or die "setpgid: $!"; exec @ARGV\' sh "$W/run.sh" &',
+    'child=$!',
+    // Set this only after spawning the worker so the worker keeps its normal SIGPIPE behavior.
+    'trap \'\' PIPE',
+    // The SSH parent can disappear before the child has called setpgid. Wait briefly for the ownership proof first.
+    'ready=0; attempt=0',
+    'while [ "$attempt" -lt 20 ] && kill -0 "$child" 2>/dev/null; do',
+    '  if owned_group; then ready=1; break; fi',
+    '  attempt=$((attempt+1)); sleep 1',
+    'done',
+    'if [ "$ready" -eq 0 ] && kill -0 "$child" 2>/dev/null; then kill -TERM "$child" 2>/dev/null || :; wait "$child" 2>/dev/null || :; : > "$W/supervisor-infra"; exit 125; fi',
+    'started=$(date +%s)',
+    'while kill -0 "$child" 2>/dev/null; do',
+    '  if [ "$(($(date +%s) - started))" -ge ' + limit + ' ]; then reap; wait "$child" 2>/dev/null || :; : > "$W/supervisor-timeout"; exit 124; fi',
+    '  if ! kill -0 "$GATE_REMOTE_SSH_SHELL" 2>/dev/null; then reap; wait "$child" 2>/dev/null || :; : > "$W/supervisor-infra"; exit 125; fi',
+    '  if ! printf "\\n' + HEARTBEAT + '%s\\n" "$W" >&2; then reap; wait "$child" 2>/dev/null || :; : > "$W/supervisor-infra"; exit 125; fi',
+    '  sleep 5',
+    'done',
+    'wait "$child"; rc=$?',
+    'trap - HUP INT TERM EXIT',
+    'exit "$rc"',
+    '',
+  ].join('\n');
+}
+
 // ── remote execution ───────────────────────────────────────────────
 
 export interface ExecResult { rc: number | null; stdout: string; stderr: string; error?: string }
@@ -217,7 +268,7 @@ export interface PayloadFile { env: string; content: string }
 export type RemoteArgv = string[] | ((sha: (ref: string) => string) => string[]);
 
 /** Build the remote shell script (exported for tests). Every setup failure ends in an INFRA marker, the tool's rc in an RC marker. */
-export function remoteScript(input: { mirror: string; commit: string; fetchShas: string[]; mainSha?: string; argv: string[]; installPwa: boolean; stableCheckout?: boolean; payloadFiles?: PayloadFile[]; hostCap?: number; slotDir?: string }): string {
+export function remoteScript(input: { mirror: string; commit: string; fetchShas: string[]; mainSha?: string; argv: string[]; installPwa: boolean; stableCheckout?: boolean; payloadFiles?: PayloadFile[]; hostCap?: number; slotDir?: string; runLimitSeconds?: number }): string {
   const mirror = input.mirror.startsWith('~/') ? `"$HOME"/${quote(input.mirror.slice(2))}` : quote(input.mirror);
   const fetches = input.fetchShas.map((sha) => `refs/elanous/gate/${sha}:refs/elanous/gate/${sha}`).join(' ');
   const payloads = (input.payloadFiles ?? []).filter((file) => /^[A-Z_][A-Z0-9_]*$/.test(file.env));
@@ -280,11 +331,16 @@ export function remoteScript(input: { mirror: string; commit: string; fetchShas:
     'W=$(mktemp -d /var/tmp/elanous-gate-remote-XXXXXXXX) || infra mktemp',
     'export W',
     'trap \'rm -rf "$W"\' EXIT',
+    'command -v perl >/dev/null 2>&1 && command -v ps >/dev/null 2>&1 || infra supervisor-tool',
+    'GATE_REMOTE_SSH_SHELL=$$; export GATE_REMOTE_SSH_SHELL',
     ...payloadLines,
     `cat > "$W/run.sh" <<'${RUN}' || infra run-script`,
     ...work,
     RUN,
-    ...hostSlotScriptWithSlot(input.hostCap ?? GATE_REMOTE_DEFAULTS.hostCap, input.slotDir ?? SLOT_DIR, ['flock', 'lockf'], !!input.stableCheckout),
+    'cat > "$W/supervise.sh" <<\'__GATE_REMOTE_SUPERVISE__\' || infra supervise-script',
+    remoteSupervisorScript(input.runLimitSeconds),
+    '__GATE_REMOTE_SUPERVISE__',
+    ...hostSlotScriptWithSlot(input.hostCap ?? GATE_REMOTE_DEFAULTS.hostCap, input.slotDir ?? SLOT_DIR, ['flock', 'lockf'], !!input.stableCheckout, true),
     '}',
     '',
   ].join('\n');
@@ -340,11 +396,22 @@ export function runOnRemote(opts: RemoteRunOptions, runner: GateRemoteRunner = r
     env: { ...process.env, GIT_SSH_COMMAND: 'ssh -o BatchMode=yes -o ConnectTimeout=10', GIT_TERMINAL_PROMPT: '0' },
   });
   if (push.rc !== 0 || push.error) return { kind: 'infra', stage: 'push', rc: push.rc, stderr: push.stderr || push.error || '', reason: `push-failed rc=${push.rc}: ${(push.stderr || push.error || '').trim().split('\n').slice(-2).join(' | ')}` };
-  const script = remoteScript({ mirror: opts.mirror, commit, fetchShas: shas, mainSha, argv, installPwa: opts.installPwa ?? false, stableCheckout: opts.stableCheckout, payloadFiles: opts.payloadFiles, hostCap: opts.hostCap, slotDir: opts.slotDir });
-  const run = runner.ssh(opts.host, script, opts.timeoutMs ?? 120 * 60_000);
+  const sshTimeoutMs = opts.timeoutMs ?? 120 * 60_000;
+  const script = remoteScript({ mirror: opts.mirror, commit, fetchShas: shas, mainSha, argv, installPwa: opts.installPwa ?? false, stableCheckout: opts.stableCheckout, payloadFiles: opts.payloadFiles, hostCap: opts.hostCap, slotDir: opts.slotDir,
+    runLimitSeconds: Math.min(REMOTE_RUN_LIMIT_SECONDS, Math.max(1, Math.floor((sshTimeoutMs - 30_000) / 1000))) });
+  const run = runner.ssh(opts.host, script, sshTimeoutMs);
   // The script prints "\n<marker><rc>\n": everything before that leading newline is the tool's own stderr, byte for byte.
   const stdoutBytes = Buffer.from(run.stdout);
-  const stderrBytes = Buffer.from(run.stderr);
+  const rawStderr = Buffer.from(run.stderr);
+  // Transport heartbeats may arrive after the RC marker when a short run races the supervisor's final poll.
+  // Strip only complete, run-scoped heartbeat lines as bytes so arbitrary tool stderr stays byte-identical.
+  const heartbeatLine = /\n__GATE_REMOTE_HEARTBEAT=\/var\/tmp\/elanous-gate-remote-[A-Za-z0-9]+\n/g;
+  const heartbeatRanges = [...rawStderr.toString('latin1').matchAll(heartbeatLine)].map((match) => [match.index!, match.index! + match[0].length] as const);
+  let previous = 0;
+  const kept: Buffer[] = [];
+  for (const [from, to] of heartbeatRanges) { kept.push(rawStderr.subarray(previous, from)); previous = to; }
+  kept.push(rawStderr.subarray(previous));
+  const stderrBytes = Buffer.concat(kept);
   const stderrText = stderrBytes.toString('utf8');
   const marker = stderrBytes.lastIndexOf(Buffer.from(`\n${RC}`));
   // Busy (98) and setup failure (97) are the script's own exits, each with its marker as the last stderr line. A completed
@@ -450,6 +517,11 @@ export interface DispatchOptions {
   reportRemoteHost?: boolean;
   /** Release gate host reservations shared by self gate and changed typecheck. */
   reservationRoot?: string;
+  /** Self gate only: hosts to try when the first host holds a release reservation (default: `host-e-wsl` for
+   *  `node-b`, the same alternative the unmeasured hint names — a reservation is never a local fallback). */
+  reservationAltHosts?: string[];
+  /** Self gate only: bounded wait for the reservation release, in seconds (default: `settings.slotWaitSeconds`). */
+  reservationWaitSeconds?: number;
   runLocal: () => number | Promise<number>;
   /** Called once with the final remote outcome (never on a local decision), before its output passes through or the
    *  local fallback runs — e.g. `self gate --artifact-dir` fetches (ran) or removes (infra) the host-side artifact dir.
@@ -466,9 +538,31 @@ export interface DispatchDeps {
   now?: () => number;
   /** Test seam for gate.remote events; production defaults to the structured debug log. */
   log?: (event: string, data: Record<string, unknown>) => void;
+  /** Read-only host-resource probe; production reads Pod pool ledgers, tests inject the same measured snapshot. */
+  readHostResources?: (host: string) => GateHostResourceReading;
   write?: { out: (data: string | Uint8Array) => void; err: (data: string | Uint8Array) => void };
 }
 
+/** Hosts a reserved self gate may fall back to: an explicit list wins, otherwise `node-b` (the only host the old
+ *  unmeasured hint named an alternative for) falls back to `host-e-wsl`. Invalid or duplicate entries are dropped. */
+export function gateReservationAlternateHosts(reservedHost: string, explicit?: string[]): string[] {
+  const candidates = explicit ?? (reservedHost === 'node-b' ? ['host-e-wsl'] : []);
+  const seen = new Set<string>([reservedHost]);
+  const hosts: string[] = [];
+  for (const candidate of candidates) {
+    if (!candidate || seen.has(candidate) || !isValidGateHost(candidate)) continue;
+    seen.add(candidate);
+    hosts.push(candidate);
+  }
+  return hosts;
+}
+
+/** Reservation diagnostics stamp — ISO 시각 printed next to the claim owner (runId). Claims written before
+ *  `reservedAt` existed fall back to the gate's own observation time. */
+export function formatReservationStamp(ms: number): string {
+  return new Date(ms).toISOString();
+}
+
 async function loadSettings(): Promise<GateRemoteSettings> {
   try {
     const { getUserConfig } = await import('../user-config.js');
@@ -498,26 +592,75 @@ export async function dispatchHeavyCheck(opts: DispatchOptions, deps: DispatchDe
     return opts.runLocal();
   }
   let host = decision.host!;
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? Date.now;
   const reservationRoot = opts.tool === 'self-gate' || opts.tool === 'ci-typecheck-changed'
     ? opts.reservationRoot ?? (deps.runner ? undefined : gateHostReservationRoot()) : undefined;
   if (reservationRoot) {
+    const resourceStatus = (target: string) => {
+      if (!deps.readHostResources && deps.runner) return null; // fake runners keep tests hermetic unless the producer is explicitly exercised
+      return (deps.readHostResources ?? ((selected) => readGateHostResourcesForHost(selected, env)))(target.split('@').at(-1)!);
+    };
+    const inspect = (target: string) => {
+      const claim = inspectReleaseGateHost(reservationRoot, target);
+      const resources = resourceStatus(target);
+      if (!resources) return claim;
+      if (resources.status === 'unmeasurable') {
+        // Keep a concrete release owner visible even if the independent Pod ledgers cannot be read.
+        if (claim.status === 'reserved') return claim;
+        return { status: 'unknown' as const, reason: `resource probe unmeasurable: ${resources.reason}` };
+      }
+      if (!resources.empty) return { status: 'reserved' as const, reason: `Pod resource pool occupied (${resources.reservations} reservations)` };
+      return claim;
+    };
     const reservationHost = host.split('@').at(-1)!;
-    const first = inspectReleaseGateHost(reservationRoot, reservationHost);
+    const first = inspect(reservationHost);
     if (first.status !== 'free') {
-      // Changed typecheck has a fixed node-b placement; a release reservation makes it unmeasured.
-      const alternate = opts.tool === 'self-gate' && reservationHost === 'node-b' ? 'node-c' : null;
-      const other = alternate ? inspectReleaseGateHost(reservationRoot, alternate) : null;
-      if (alternate && other?.status === 'free') {
-        debug.log('gate.remote', 'host-reserved-reroute', { from: host, to: alternate, reason: first.reason, status: first.status });
-        write.err(`[gate.remote] ${host} reserved (${first.reason}) — using ${alternate}\n`);
-        host = alternate;
+      // A reserved host is never a reason to run this check locally (반증: 예약 상태에서 --local 무거운 시험 금지).
+      // Self gate first tries another remote host, then waits bounded for the release, then ends unmeasured with
+      // the owner and the observation stamp.
+      const observedAt = formatReservationStamp(now());
+      const owner = first.runId || 'unknown';
+      // Owner (runId) plus 시각: the claim's own reservedAt when recorded, else the moment this gate observed it.
+      const stamp = first.reservedAt !== undefined
+        ? `reserved-at=${formatReservationStamp(first.reservedAt)}`
+        : `observed-at=${observedAt}`;
+      const alternates = opts.tool === 'self-gate'
+        ? gateReservationAlternateHosts(reservationHost, opts.reservationAltHosts) : [];
+      const alternate = alternates.find((candidate) => inspect(candidate).status === 'free');
+      if (alternate) {
+        const rerouted = host.includes('@') ? `${host.slice(0, host.lastIndexOf('@'))}@${alternate}` : alternate;
+        debug.log('gate.remote', 'host-reserved-reroute', { tool: opts.tool, from: host, to: rerouted, owner, reason: first.reason, reservedAt: first.reservedAt, observedAt });
+        write.err(`[gate.remote] host-reserved: ${host} (${first.reason}) owner=${owner} ${stamp} — rerouting to ${rerouted}\n`);
+        host = rerouted;
       } else {
-        const reason = `host-reserved: ${host} (${first.reason}); alternate ${alternate ?? '(none)'} ${other?.status ?? 'unavailable'}`;
-        debug.log('gate.remote', 'host-reserved-unmeasured', { host, reason });
-        write.err(opts.tool === 'self-gate'
-          ? `[gate.remote] remote unmeasured on ${host} (stage=host-reserved, rc=unknown) — ${reason}\n`
-          : `[gate.remote] remote unmeasured — ${reason}\n`);
-        return 1;
+        const waitSeconds = opts.tool === 'self-gate' ? opts.reservationWaitSeconds ?? settings.slotWaitSeconds : 0;
+        const waitStart = now();
+        const deadline = waitStart + Math.max(0, waitSeconds) * 1000;
+        let latest = inspect(reservationHost);
+        while (waitSeconds > 0 && latest.status !== 'free') {
+          const left = deadline - now();
+          if (left <= 0) break;
+          write.err(`[gate.remote] waiting for host-reserved release on ${host} — owner=${owner} ${stamp} elapsed=${Math.floor(Math.max(0, now() - waitStart) / 1000)}s/${waitSeconds}s\n`);
+          const before = now();
+          await sleep(Math.min(15_000, left));
+          if (now() <= before) break; // a frozen test clock must not spin past the bound
+          latest = inspect(reservationHost);
+        }
+        const waitedMs = Math.max(0, now() - waitStart);
+        if (latest.status === 'free') {
+          debug.log('gate.remote', 'host-reserved-released', { tool: opts.tool, host, owner, waitedMs });
+          write.err(`[gate.remote] host-reserved released on ${host} after ${Math.floor(waitedMs / 1000)}s — proceeding remotely\n`);
+        } else {
+          const reason = `host-reserved: ${host} (${latest.reason})`;
+          const manualAlternative = reservationHost === 'node-b'
+            ? '; if available, non-PWA checks may explicitly select --remote host-e-wsl' : '';
+          debug.log('gate.remote', 'host-reserved-unmeasured', { host, reason, owner, reservedAt: latest.reservedAt ?? first.reservedAt, observedAt, waitedMs, alternates: alternates.length });
+          write.err(opts.tool === 'self-gate'
+            ? `[gate.remote] remote unmeasured on ${host} (stage=host-reserved, rc=unknown) — ${reason}; owner=${owner} ${stamp} waited=${Math.floor(waitedMs / 1000)}s${manualAlternative}\n`
+            : `[gate.remote] remote unmeasured — ${reason}\n`);
+          return 1;
+        }
       }
     }
   }
@@ -535,8 +678,6 @@ export async function dispatchHeavyCheck(opts: DispatchOptions, deps: DispatchDe
   };
   if (opts.localOnlyReason) return fallback(opts.localOnlyReason, { stage: 'reproducibility', rc: null });
   const hostCap = gateRemoteHostCap(settings, host);
-  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
-  const now = deps.now ?? Date.now;
   const deadline = now() + settings.slotWaitSeconds * 1000;
   let waitStartedAt: number | undefined;
   const logWait = deps.log ?? ((event: string, data: Record<string, unknown>) => debug.log('gate.remote', event, data));