elanous 0.2.38 → 0.2.41

package/scripts/public-copy-lint.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 /** Warning-only public-copy shadow scan. It never edits source or exposes private candidate text. */
-import { existsSync, readFileSync } from 'node:fs';
-import { extname, normalize, relative, resolve, sep } from 'node:path';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { extname, join, normalize, relative, resolve, sep } from 'node:path';
 import { PatentLedger } from '../src/patents/ledger.js';
 import { checkBrandText } from './brand/check.js';
 
@@ -10,7 +10,8 @@ export type PublicCopyFinding = { source: string; line: number; rule: string };
 export type PatentLineMatcher = (text: string) => number[];
 export type PublicCopyScan = {
   findings: PublicCopyFinding[];
-  excludedSources: Array<{ source: string; reason: 'internal-goal-document' }>;
+  excludedSources: Array<{ source: string; reason: 'internal-goal-document' | 'internal-marketing-source' | 'asset-manifest' }>;
+  documents: Array<{ source: string; findings: number; companyNameMentions: number; placeholderMentions: number }>;
   brandRulesAvailable: boolean;
   patentLedgerAvailable: boolean;
 };
@@ -23,9 +24,113 @@ function normalizedLabel(label: string): string | undefined {
   return normalized;
 }
 
+function publicCopyExclusion(normalized: string): PublicCopyScan['excludedSources'][number]['reason'] | undefined {
+  if (normalized.startsWith('docs/goals/')) return 'internal-goal-document';
+  if (!normalized.startsWith('docs/marketing/')) return undefined;
+  const relativePath = normalized.slice('docs/marketing/'.length);
+  const basename = relativePath.split('/').at(-1) ?? '';
+  // These files are published records or release-specific source notes, not
+  // current copy candidates. Preserve their exact product names and evidence.
+  if (/^(?:BLOG-02-the-agent-drives-the-agent-|BLOG-03-it-drives-the-terminal-itself-|DRAFT-0\.2\.(?:7|8)-announcement-|DRAFT-0\.2\.7-known-issues-public-wording-|DRAFT-0\.2\.10-announcement-|PRFAQ-release-0\.2\.4-|SCRIPT-ax-demo-1008-|VO-teaser-v2-)/i.test(basename)
+    || /^docs\/marketing\/launch\/(?:0\.2\.8-loop-final\/|0\.2\.8-rehearsal\/PRFAQ-generated\.md$|0\.2\.11-cut-)/i.test(normalized)) {
+    return 'internal-marketing-source';
+  }
+  if (normalized.startsWith('docs/marketing/') && /^(?:BRIEF-|DOCS-|EVENT-|GUIDE-|MANUAL-|MAP-|MATURITY-|PLAN-|RESEARCH-|RFC-|SCENARIO-|STORYBOARD-|STORYLINE-|STRATEGY-|SOURCES-)/i.test(basename)) {
+    return 'internal-marketing-source';
+  }
+  if (normalized.startsWith('docs/marketing/') && /^DRAFT-persona-/i.test(basename)) return 'internal-marketing-source';
+  if (/^docs\/marketing\/teaser-v\d+\/MANIFEST\.md$/i.test(normalized) || normalized === 'docs/marketing/decks/media/README.md') {
+    return 'asset-manifest';
+  }
+  return undefined;
+}
+
+function isRequestedPublicCopyPath(normalized: string): boolean {
+  return normalized === 'README.md' || normalized.startsWith('docs/marketing/');
+}
+
+function maskSpan(text: string, start: number, end: number): string {
+  return text.slice(start, end).replace(/[^\r\n]/g, ' ');
+}
+
+/** Keep line offsets while limiting brand checks to visible prose, not code, comments, metadata, or link targets. */
+function visibleMarkdownProse(text: string): string {
+  let visible = text;
+  const masks: RegExp[] = [
+    /^---\r?\n[\s\S]*?\r?\n---\s*$/gm,
+    /<!--[\s\S]*?-->/g,
+    /^\s*(```|~~~)[^\r\n]*\r?\n[\s\S]*?^\s*\1\s*$/gm,
+    /`[^`\r\n]*`/g,
+    /\]\((?:\\.|[^)])*\)/g,
+    /^>\s*🧾\s*\*\*공개 전 할 일\*\*[\s\S]*?(?=^[^>\r\n]|$(?![\s\S]))/gm,
+    /^##\s*(?:\d+\.\s*)?(?:칸|출처 목록|sources|evidence|게시 직전 다시 잴 것|기준선|올리기 전 확인)(?:\s|$)[\s\S]*?(?=^##\s|$(?![\s\S]))/gim,
+    /^>\s*✏️\s*\*\*착지·실측된 것만\.[^\r\n]*$/gm,
+    /https?:\/\/[^\s)>]+/gi,
+    /\b(?:[A-Za-z0-9-]+\.)+[A-Za-z]{2,}(?:\/[^\s)>]*)?/g,
+  ];
+  for (const pattern of masks) {
+    const matches = [...visible.matchAll(pattern)].map((match) => ({ start: match.index!, end: match.index! + match[0].length }));
+    for (const match of matches.reverse()) visible = visible.slice(0, match.start) + maskSpan(visible, match.start, match.end) + visible.slice(match.end);
+  }
+  return visible;
+}
+
+const PUBLIC_COMPANY_NAMES = /\b(?:OpenAI|ChatGPT|Codex|Claude(?:\s+Code)?|Anthropic|Gemini|Google|Grok|xAI|Devin|Cognition|OpenHands|Replit(?:\s+Agent(?:\s+\d+)?)?|Factory(?:\s+AI)?|Hermes|OpenClaw|Manus)\b/gi;
+const PUBLIC_PLACEHOLDER = /\b(?:another coding agent|another agent platform)\b/gi;
+const PUBLIC_PLACEHOLDER_LIST = /\ba coding tool\s*[,·]\s*the coding CLI\s*[,·]\s*an AI model\s*[,·]\s*a model provider\b/gi;
+const UNSUPPORTED_COMPARISON = /\b(?:better|faster|cheaper|safer|worse|superior|inferior)\s+than\b|\b(?:vs\.?|versus|compared\s+(?:with|to))\b|(?:보다\s*(?:낫|빠르|저렴|좋|강력|안전|우수))/i;
+
+function companyNameMentions(text: string): number {
+  return [...text.matchAll(PUBLIC_COMPANY_NAMES)].length;
+}
+
+function placeholderMentions(text: string): number {
+  return [...text.matchAll(PUBLIC_PLACEHOLDER)].length + [...text.matchAll(PUBLIC_PLACEHOLDER_LIST)].length;
+}
+
+function hasSupportedComparisonEvidence(text: string): boolean {
+  const hasSource = /\b(?:source|citation)\b|출처/i.test(text);
+  const hasMeasurement = /\b(?:measur|benchmark|tested|test conditions?)\w*\b|실측|측정|측정 조건/i.test(text);
+  return hasSource && hasMeasurement;
+}
+
+function measuredScopeMatchesClaim(claim: string): boolean {
+  const quantity = String.raw`(\d+(?:\.\d+)?)`;
+  const unit = String.raw`(jobs?|tasks?|workflows?|items?|건|개|작업)`;
+  const claimScope = new RegExp(String.raw`(?:completes?|processes?|handles?|완료|처리)\s*${quantity}\s*${unit}`, 'i').exec(claim);
+  const measuredScope = new RegExp(String.raw`(?:measured|measurement|실측|측정).*?(?:scope|range|범위).*?(?:limited to|only|한정|범위 내)\s*${quantity}\s*${unit}`, 'i').exec(claim);
+  if (!claimScope || !measuredScope) return false;
+  const normalizeUnit = (value: string): string => {
+    const normalized = value.toLowerCase();
+    if (normalized === 'job' || normalized === 'jobs' || normalized === 'task' || normalized === 'tasks' || normalized === 'workflow' || normalized === 'workflows' || normalized === 'item' || normalized === 'items') return normalized.replace(/s$/, '');
+    return normalized;
+  };
+  return claimScope[1] === measuredScope[1] && normalizeUnit(claimScope[2]!) === normalizeUnit(measuredScope[2]!);
+}
+
+function oneClickFindings(text: string, source: string): PublicCopyFinding[] {
+  const lines = text.split(/\r?\n/);
+  const findings: PublicCopyFinding[] = [];
+  for (let index = 0; index < lines.length; index++) {
+    const claims = lines[index]!.split(/(?<=[.!?。！？;；])\s*/).filter((segment) => /\bone[ -]click\b|원\s*클릭/i.test(segment));
+    for (const claim of claims) {
+      const hasLimitedClaimScope = !/(?:every|all|entire|unlimited|모든|전체|무제한)/i.test(claim)
+        && /(?:completes?|processes?|handles?|완료|처리)/i.test(claim)
+        && /\b\d+(?:\.\d+)?\s+(?:jobs?|tasks?|workflows?|items?)\b|\d+(?:\.\d+)?\s*(?:건|개|작업)/i.test(claim);
+      const hasMeasuredScope = hasLimitedClaimScope
+        && measuredScopeMatchesClaim(claim)
+        && !/(?:no|not|without|unmeasured|측정되지 않|범위 없음|범위가 없|한정되지 않)/i.test(claim);
+      if (!hasMeasuredScope) findings.push({ source, line: index + 1, rule: 'ONE-CLICK-MEASURED-SCOPE' });
+      const hasPublicationApprovalStatus = /(?:approved for publication|publication approved|publication approval pending|publication not approved|not approved for publication|unapproved|pending|게시\s*승인(?:됨|완료)?|게시\s*미승인|게시\s*승인\s*보류|게시\s*승인\s*상태\s*:\s*(?:승인|미승인|보류)|승인되지 않)/i.test(claim);
+      if (!hasPublicationApprovalStatus) findings.push({ source, line: index + 1, rule: 'ONE-CLICK-APPROVAL-STATUS' });
+    }
+  }
+  return findings;
+}
+
 function allowedNormalizedLabel(normalized: string | undefined): boolean {
   if (!normalized) return false;
-  if (normalized === 'PR-BODY') return true;
+  if (normalized === 'PR-BODY' || normalized === 'README.md') return true;
   if (normalized.split('/').some((part) => part === '..' || part === '')) return false;
   if (!['.md', '.mdx', '.txt', '.html', '.htm'].includes(extname(normalized).toLowerCase())) return false;
   return ['docs/', 'release/public/docs/', 'blog/', 'posts/', 'content/blog/', 'content/posts/']
@@ -36,30 +141,49 @@ function allowedNormalizedLabel(normalized: string | undefined): boolean {
 export function scanPublicCopy(inputs: readonly PublicCopyInput[], matchPrivateCandidate: PatentLineMatcher, rulesPath?: string): PublicCopyScan {
   const findings: PublicCopyFinding[] = [];
   const excludedSources: PublicCopyScan['excludedSources'] = [];
+  const documents: PublicCopyScan['documents'] = [];
   let brandRulesAvailable = true;
   let patentLedgerAvailable = true;
   for (const input of inputs) {
     const label = normalizedLabel(input.label);
     if (!allowedNormalizedLabel(label)) throw new Error(`공개 문면 입력 경로가 허용 목록 밖입니다: ${input.label}`);
-    // Goal specs are internal execution artifacts, not customer-facing copy.
-    // Counting their acceptance criteria as marketing measurements created a
-    // high false-positive rate in the 30-PR audit.
-    if (label?.startsWith('docs/goals/')) {
-      excludedSources.push({ source: input.label, reason: 'internal-goal-document' });
+    const excludedReason = label ? publicCopyExclusion(label) : undefined;
+    if (excludedReason) {
+      excludedSources.push({ source: input.label, reason: excludedReason });
       continue;
     }
+    const before = findings.length;
+    const prose = visibleMarkdownProse(input.text);
+    if (label && isRequestedPublicCopyPath(label)) findings.push(...oneClickFindings(prose, input.label));
     try {
-      const brandFindings = checkBrandText(input.text, input.label, 'public-docs', rulesPath);
+      const brandFindings = checkBrandText(prose, input.label, 'public-docs', rulesPath)
+        .filter((hit) => hit.id !== 'BRAND-COMPETITOR-NAME');
       // Publication-specific promise/measurement rules apply to this explicit
       // shadow scan without changing the existing generic brand-check scopes.
-      const publicationFindings = checkBrandText(input.text, input.label, 'release-notes', rulesPath)
+      const publicationFindings = checkBrandText(prose, input.label, 'release-notes', rulesPath)
         .filter((hit) => hit.id === 'BRAND-SOON' || hit.id === 'B4-NUMBER-SOURCE');
-      for (const hit of [...brandFindings, ...publicationFindings]) {
-        findings.push({ source: input.label, line: hit.line, rule: hit.id });
+      const brandLines = new Set([...brandFindings, ...publicationFindings].map((hit) => `${hit.line}:${hit.id}`));
+      for (const line of prose.split(/\r?\n/).map((text, index) => ({ text, line: index + 1 }))) {
+        if (UNSUPPORTED_COMPARISON.test(line.text) && PUBLIC_COMPANY_NAMES.test(line.text)
+          && !hasSupportedComparisonEvidence(line.text)) {
+          brandLines.add(`${line.line}:BRAND-UNSUPPORTED-COMPARISON`);
+        }
+        PUBLIC_COMPANY_NAMES.lastIndex = 0;
+        UNSUPPORTED_COMPARISON.lastIndex = 0;
+        if (PUBLIC_PLACEHOLDER.test(line.text) || PUBLIC_PLACEHOLDER_LIST.test(line.text)) {
+          brandLines.add(`${line.line}:PUBLIC-COPY-PLACEHOLDER`);
+        }
+        PUBLIC_PLACEHOLDER.lastIndex = 0;
+        PUBLIC_PLACEHOLDER_LIST.lastIndex = 0;
+      }
+      for (const key of brandLines) {
+        const [line, rule] = key.split(':');
+        findings.push({ source: input.label, line: Number(line), rule: rule! });
       }
     } catch { brandRulesAvailable = false; }
     try { for (const line of matchPrivateCandidate(input.text)) findings.push({ source: input.label, line, rule: 'PRIVATE-PATENT-CANDIDATE' }); }
     catch { patentLedgerAvailable = false; }
+    documents.push({ source: input.label, findings: findings.length - before, companyNameMentions: companyNameMentions(prose), placeholderMentions: placeholderMentions(prose) });
   }
   if (inputs.length === 0 || excludedSources.length === inputs.length) {
     // No scanner ran, so availability must not claim a successful measurement.
@@ -69,6 +193,7 @@ export function scanPublicCopy(inputs: readonly PublicCopyInput[], matchPrivateC
   return {
     findings: findings.sort((a, b) => a.source.localeCompare(b.source) || a.line - b.line || a.rule.localeCompare(b.rule)),
     excludedSources,
+    documents,
     brandRulesAvailable, patentLedgerAvailable,
   };
 }
@@ -77,6 +202,26 @@ export function lintPublicCopy(inputs: readonly PublicCopyInput[], matchPrivateC
   return scanPublicCopy(inputs, matchPrivateCandidate).findings;
 }
 
+function collectPublicCopyFiles(paths: readonly string[], root: string): string[] {
+  const collected = new Set<string>();
+  const visit = (path: string): void => {
+    const absolute = resolve(root, path);
+    const stat = statSync(absolute);
+    if (stat.isDirectory()) {
+      for (const entry of readdirSync(absolute, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+        if (entry.isDirectory()) visit(relative(root, join(absolute, entry.name)));
+        else if (entry.isFile() && ['.md', '.mdx', '.txt', '.html', '.htm'].includes(extname(entry.name).toLowerCase())) {
+          collected.add(relative(root, join(absolute, entry.name)));
+        }
+      }
+      return;
+    }
+    collected.add(relative(root, absolute));
+  };
+  for (const path of paths) visit(path);
+  return [...collected].sort();
+}
+
 export function run(argv: readonly string[], root = process.cwd(), ledger = new PatentLedger()): number {
   const files: string[] = [];
   let bodyFile: string | undefined;
@@ -97,15 +242,14 @@ export function run(argv: readonly string[], root = process.cwd(), ledger = new
     } else throw new Error(`알 수 없는 옵션: ${arg}`);
   }
   if (!files.length && !bodyFile) throw new Error('usage: bun scripts/public-copy-lint.ts [--files <docs...>] [--pr-body-file <file> [--pr-body-label <repo-relative-label>]] [--json]');
-  const inputs: PublicCopyInput[] = files.map((file) => ({
-    label: relative(root, resolve(root, file)).split(sep).join('/'), text: readFileSync(resolve(root, file), 'utf8'),
+  const inputs: PublicCopyInput[] = collectPublicCopyFiles(files, root).map((file) => ({
+    label: file.split(sep).join('/'), text: readFileSync(resolve(root, file), 'utf8'),
   }));
   if (bodyFile) inputs.push({ label: bodyLabel, text: readFileSync(resolve(root, bodyFile), 'utf8') });
-  const matchPrivateCandidate: PatentLineMatcher = (text) => {
-    return ledger.unapprovedCandidateLineNumbers(text);
-  };
+  const matchPrivateCandidate: PatentLineMatcher = (text) => ledger.unapprovedCandidateLineNumbers(text);
+  // The CLI caller uses the same scope-aware production scanner covered by focused tests.
   const scan = scanPublicCopy(inputs, matchPrivateCandidate);
-  if (json) console.log(JSON.stringify({ mode: 'warning-only', ...scan }));
+  if (json) console.log(JSON.stringify({ mode: 'warning-only', documentsScanned: scan.documents.length, ...scan }));
   else {
     for (const finding of scan.findings) console.log(`${finding.source}:${finding.line}:WARN:${finding.rule}`);
     for (const excluded of scan.excludedSources) console.log(`${excluded.source}:SKIP:${excluded.reason}`);

package/scripts/public-export.ts

@@ -109,15 +109,23 @@ class PrivateRedactionError extends Error {
 
 function codeIdentifierRanges(file: string, text: string): Array<{ start: number; end: number; name: string }> {
   if (!CODE_FILE.test(file)) return [];
-  const scanner = ts.createScanner(ts.ScriptTarget.Latest, false,
-    /\.(?:tsx|jsx)$/iu.test(file) ? ts.LanguageVariant.JSX : ts.LanguageVariant.Standard, text);
+  // A raw scanner cannot track template-expression braces without rescanning. It can
+  // report words in later strings/comments as identifiers after a template literal.
+  // The parsed token tree has already resolved those boundaries.
+  const kind = /\.(?:tsx|jsx)$/iu.test(file) ? ts.ScriptKind.TSX
+    : /\.(?:js|mjs|cjs)$/iu.test(file) ? ts.ScriptKind.JS : ts.ScriptKind.TS;
+  const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, false, kind);
   const ranges: Array<{ start: number; end: number; name: string }> = [];
-  for (let token = scanner.scan(); token !== ts.SyntaxKind.EndOfFileToken; token = scanner.scan()) {
-    if (token === ts.SyntaxKind.Identifier || token === ts.SyntaxKind.PrivateIdentifier
-      || token >= ts.SyntaxKind.FirstKeyword && token <= ts.SyntaxKind.LastKeyword) {
-      ranges.push({ start: scanner.getTokenPos(), end: scanner.getTextPos(), name: scanner.getTokenText() });
+  const visit = (node: ts.Node): void => {
+    if (ts.isJSDoc(node)) return;
+    if (node.kind === ts.SyntaxKind.Identifier || node.kind === ts.SyntaxKind.PrivateIdentifier
+      || node.kind >= ts.SyntaxKind.FirstKeyword && node.kind <= ts.SyntaxKind.LastKeyword) {
+      ranges.push({ start: node.getStart(source), end: node.getEnd(), name: node.getText(source) });
+      return;
     }
-  }
+    for (const child of node.getChildren(source)) visit(child);
+  };
+  visit(source);
   return ranges;
 }
 

package/scripts/ratchets/train-side-invariants.sh

@@ -6,7 +6,6 @@ set -u
 
 files=(
   scripts/ratchets/test-interference-patterns.test.ts
-  scripts/ratchets/next-tui-entry-budget.test.ts
   src/domains/finance-cli.test.ts
   src/instance/state-dir-provenance-ratchet.test.ts
   src/self-implement/graph-yaml.test.ts

package/scripts/release-loop/export-check-node.ts

@@ -46,9 +46,27 @@ export function runExportCheck(run: CommandRunner = runCommand, repoRoot = proce
             step = 'build';
             const publicDir = join(out, 'export');
             symlinkSync(join(modulesRoot, 'node_modules'), join(publicDir, 'node_modules'), 'dir');
-            const pwaModules = join(modulesRoot, 'apps', 'pwa', 'node_modules');
-            if (!existsSync(pwaModules)) result = failed('build', 'PWA dependencies missing; run bun install --cwd apps/pwa in the release-loop repository');
-            else {
+            let pwaModules = join(root, 'apps', 'pwa', 'node_modules');
+            let pwaReady = existsSync(pwaModules);
+            if (!pwaReady) {
+              const installed = run('bun', ['install', '--cwd', join(root, 'apps', 'pwa'), '--frozen-lockfile'], root);
+              if (installed.status !== 0) {
+                // This path was absent before install. Remove partial output so a later retry cannot mistake it for a complete install.
+                let cleanupFailed = false;
+                try { rmSync(pwaModules, { recursive: true, force: true }); }
+                catch (error) {
+                  cleanupFailed = true;
+                  result = failed('build', `PWA dependency install partial-output cleanup: ${error instanceof Error ? error.message : String(error)}`, installed);
+                }
+                if (!cleanupFailed) result = failed('build', 'PWA dependency install', installed);
+              }
+              else {
+                pwaReady = existsSync(pwaModules);
+                if (!pwaReady) result = failed('build', 'PWA dependency install did not create apps/pwa/node_modules', installed);
+              }
+            }
+            if (pwaReady) {
+              pwaModules = realpathSync(pwaModules);
               if (existsSync(join(publicDir, 'apps', 'pwa'))) symlinkSync(pwaModules, join(publicDir, 'apps', 'pwa', 'node_modules'), 'dir');
               const built = run('bun', ['bin/elanous.mjs', 'nexus', 'build'], publicDir);
               result = built.status === 0 && existsSync(join(publicDir, 'apps', 'pwa', 'out', 'index.html'))

package/scripts/release-loop/gate-autoheal.ts

@@ -0,0 +1,117 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { acquireLockSync } from '../../src/storage/file-lock.js';
+
+/** Deterministic recovery policy for release gate incidents. Side effects are supplied by callers. */
+export type GateAutohealCause = 'shard-pod-death' | 'timeout' | 'host-down' | 'interference' | 'true-regression' | 'environment';
+export type GateAutohealAction = 'reroute-shard' | 'retry-shard' | 'partial-resume' | 'host-switch' | 'hitl';
+
+export interface GateAutohealInput {
+  cause: GateAutohealCause;
+  signature: string;
+  shardElapsedMs: number;
+  overallElapsedMs: number;
+  priorSameSignatureCount?: number;
+  shardKeys?: readonly string[];
+}
+
+export interface GateAutohealDecision {
+  action: GateAutohealAction;
+  cause: GateAutohealCause;
+  signature: string;
+  reason: string;
+  shardElapsedMs: number;
+  overallElapsedMs: number;
+  shardKey?: string;
+}
+
+export interface GateResultForAutoheal {
+  outcome: 'ok' | 'regression' | 'error';
+  introduced?: readonly string[];
+  error?: string;
+  durationMs: number;
+  stalledShards?: readonly { shard: number; files: readonly string[]; reason: string; detail?: string; stall?: { sinceCheckoutMs: number } }[];
+  interferenceErrors?: readonly string[];
+  loadFlaky?: readonly string[];
+}
+
+interface GateAutohealLedger {
+  schema: 1;
+  overallElapsedMs: number;
+  shards: Record<string, number>;
+  signatures: Record<string, number>;
+}
+
+const emptyLedger = (): GateAutohealLedger => ({ schema: 1, overallElapsedMs: 0, shards: {}, signatures: {} });
+
+/** Persist the incident budget across graph-node process restarts, keyed by release version and run id. */
+export function decideAndRecordGateAutoheal(input: GateAutohealInput & { version: string; runId: string; shardKey: string; storeRoot: string }): GateAutohealDecision {
+  const path = join(input.storeRoot, 'release', input.version, 'gate-autoheal', `${input.runId.replace(/[^a-zA-Z0-9_.-]/g, '_')}.json`);
+  mkdirSync(dirname(path), { recursive: true });
+  const unlock = acquireLockSync(`${path}.lock`, { breakDeadHolder: true });
+  try {
+    let ledger = emptyLedger();
+    if (existsSync(path)) {
+      try {
+      const parsed = JSON.parse(readFileSync(path, 'utf8')) as GateAutohealLedger;
+      if (parsed.schema !== 1 || !Number.isFinite(parsed.overallElapsedMs) || !parsed.shards || !parsed.signatures) throw new Error('invalid ledger');
+      ledger = parsed;
+      } catch {
+        return { action: 'hitl', cause: input.cause, signature: input.signature, reason: 'autoheal history unreadable; refusing another automatic action', shardElapsedMs: 0, overallElapsedMs: 0, shardKey: input.shardKey };
+      }
+    }
+    const shardKeys = [...new Set(input.shardKeys?.length ? input.shardKeys : [input.shardKey])];
+    const signatureKey = `${input.shardKey}:${input.signature}`;
+    const priorSameSignatureCount = ledger.signatures[signatureKey] ?? 0;
+    const elapsed = Math.max(0, input.shardElapsedMs);
+    const shards = { ...ledger.shards };
+    for (const key of shardKeys) shards[key] = (shards[key] ?? 0) + elapsed;
+    const shardElapsedMs = Math.max(0, ...shardKeys.map((key) => shards[key] ?? 0));
+    const overallElapsedMs = ledger.overallElapsedMs + Math.max(0, input.overallElapsedMs);
+    const decision = decideGateAutoheal({ ...input, shardElapsedMs, overallElapsedMs, priorSameSignatureCount });
+    ledger = { schema: 1, overallElapsedMs, shards,
+      signatures: { ...ledger.signatures, [signatureKey]: priorSameSignatureCount + 1 } };
+    const temp = `${path}.${process.pid}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(ledger, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temp, path);
+    return { ...decision, shardKey: input.shardKey };
+  } finally { unlock(); }
+}
+
+export const GATE_AUTOHEAL_SHARD_CAP_MS = 60 * 60 * 1000;
+export const GATE_AUTOHEAL_OVERALL_CAP_MS = 90 * 60 * 1000;
+
+/** One signature may be acted on once; seeing it again, or crossing either timebox, stops in HITL. */
+export function decideGateAutoheal(input: GateAutohealInput): GateAutohealDecision {
+  const shardElapsedMs = Math.max(0, input.shardElapsedMs);
+  const overallElapsedMs = Math.max(0, input.overallElapsedMs);
+  let action: GateAutohealAction;
+  let reason: string;
+  if (shardElapsedMs >= GATE_AUTOHEAL_SHARD_CAP_MS) {
+    action = 'hitl'; reason = 'per-shard timebox exceeded';
+  } else if (overallElapsedMs >= GATE_AUTOHEAL_OVERALL_CAP_MS) {
+    action = 'hitl'; reason = 'overall timebox exceeded';
+  } else if ((input.priorSameSignatureCount ?? 0) >= 1) {
+    action = 'hitl'; reason = 'same incident signature repeated';
+  } else {
+    switch (input.cause) {
+      case 'shard-pod-death': action = 'reroute-shard'; reason = 'replace failed shard Pod'; break;
+      case 'timeout': action = 'retry-shard'; reason = 'retry the timed-out shard within its budget'; break;
+      case 'host-down': action = 'host-switch'; reason = 'move the gate to a healthy host'; break;
+      case 'interference': action = 'partial-resume'; reason = 'resume only the unmeasured or affected work'; break;
+      case 'true-regression': action = 'hitl'; reason = 'measured regression requires a human decision'; break;
+      case 'environment': action = 'hitl'; reason = 'environment cause is not safe to repair automatically'; break;
+    }
+  }
+  return { action, cause: input.cause, signature: input.signature, reason, shardElapsedMs, overallElapsedMs };
+}
+
+export function gateAutohealCause(result: GateResultForAutoheal): GateAutohealCause | undefined {
+  if (result.outcome === 'ok') return undefined;
+  if (result.outcome === 'regression' && (result.introduced?.length ?? 0) > 0) return 'true-regression';
+  if (/host.*(?:down|unreachable)|(?:down|unreachable).*host|ssh.*(?:failed|timeout)/i.test(result.error ?? '')) return 'host-down';
+  if (result.stalledShards?.some((shard) => /timeout/.test(shard.reason))) return 'timeout';
+  if ((result.interferenceErrors?.length ?? 0) > 0 || (result.loadFlaky?.length ?? 0) > 0) return 'interference';
+  if (result.stalledShards?.some((shard) => /pod.*(?:deleted|evicted|terminated|lost|not found)|(?:pod-dead|pod-evicted|pod-deleted)/i.test(`${shard.reason} ${shard.detail ?? ''}`))) return 'shard-pod-death';
+  return 'environment';
+}

package/scripts/release-loop/gate-baseline-receipt.ts

@@ -35,6 +35,7 @@ export interface GateBaselineReceipt {
   imageDigest: string | null;
   files: number;
   shards: number;
+  attributionRecheck?: { summary: number; observed: number; identified: number; baselineResult: string; targetFiles: string[] };
 }
 
 /** A direct hard rehearsal has no graph run state. Pin the graph and recipe bytes at its Git SHA. */
@@ -83,11 +84,17 @@ export function gateGraphPins(root: string, runId: string | undefined): { graphS
 }
 
 export function gateBaselineReceipt(input: { root: string; version: string; commit: string; fullSweep: boolean;
-  graphPins: { graphSha: string; recipeSha: string } | null; envFingerprint: string }): GateBaselineReceipt {
+  graphPins: { graphSha: string; recipeSha: string } | null; envFingerprint: string;
+  attributionRecheck?: { summary: number; observed: number; identified: number; baselineResult: string; targetFiles: string[] } }): GateBaselineReceipt {
   const { root, version, commit, graphPins, envFingerprint } = input;
   const base = { schema: 1 as const, version, commit, graphSha: graphPins?.graphSha ?? null,
     recipeSha: graphPins?.recipeSha ?? null, envFingerprint, imageDigest: null as string | null, files: 0, shards: 0 };
   const invalid = (reason: string): GateBaselineReceipt => ({ ...base, valid: false, reason });
+  if (input.attributionRecheck) {
+    const evidence = input.attributionRecheck;
+    return { ...invalid(`failure attribution unresolved after baseline recheck (${evidence.baselineResult}): summary=${evidence.summary}, observed=${evidence.observed}, identified=${evidence.identified}`),
+      attributionRecheck: { ...evidence, targetFiles: [...evidence.targetFiles].sort() } };
+  }
   if (!input.fullSweep) return invalid('gate was not a complete clean full sweep');
   if (!graphPins) return invalid('pinned graph or recipe SHA absent');
   if (!SHA256.test(envFingerprint)) return invalid('gate environment fingerprint absent');

package/scripts/release-loop/gate-diff.ts

@@ -4,9 +4,28 @@ export interface FailureDiff {
   common: string[];
 }
 
+/** One failure identity may be printed more than once when a host retries or concatenates a test run. */
+export function collapseGateFailureAttempts(ids: readonly string[]): { failures: string[]; observed: number; collapsed: number } {
+  const failures = [...new Set(ids)].sort();
+  return { failures, observed: ids.length, collapsed: ids.length - failures.length };
+}
+
+export class GateFailureAttributionMismatch extends Error {
+  constructor(readonly label: string, readonly summary: number, readonly observed: number,
+    readonly identified: number, readonly collapsed: number, readonly failures: readonly string[]) {
+    super(`${label} incomplete (failure attribution mismatch: summary=${summary}, observed=${observed}, identified=${identified})`);
+    this.name = 'GateFailureAttributionMismatch';
+  }
+}
+
 /** Bun's file header followed by `(fail) name` lines is the identity source. */
 export function parseFailures(output: string): string[] {
-  const failures = new Set<string>();
+  return [...new Set(parseFailureAttempts(output))].sort();
+}
+
+/** Raw reporter rows, retaining repeated identities so gate attribution can distinguish retries from missing names. */
+export function parseFailureAttempts(output: string): string[] {
+  const failures: string[] = [];
   let file: string | undefined;
   for (const raw of output.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '').split(/\r?\n/)) {
     const line = raw.trim();
@@ -14,9 +33,9 @@ export function parseFailures(output: string): string[] {
     if (header) { file = header[1]; continue; }
     // Line-start only: a title/body `(fail)` is not a reporter row. Trailing CR is still a real Bun fail row.
     const failed = /^\(fail\)[ \t]+(.+?)(?:[ \t]+\[[\d.]+(?:ms|s)\])?[ \t]*\r?$/.exec(raw);
-    if (failed && file) failures.add(`${file} > ${failed[1]!.trim()}`);
+    if (failed && file) failures.push(`${file} > ${failed[1]!.trim()}`);
   }
-  return [...failures].sort();
+  return failures;
 }
 
 /** GATE-INTRO-RECHECK (0.2.19) — the failures that are bun's «timed out» shape: a `(fail) name` line whose next line is