elanous 0.2.38 → 0.2.41

package/scripts/release-loop/gate-node.ts

@@ -9,7 +9,7 @@ import { registerStandaloneLogSink } from '../../src/domains/standalone-log-sink
 import { landingFreezeMessage, readLandingFreeze } from '../../src/release-loop/landing-freeze.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
 import { getElanousConfigDirOverride } from '../../src/elanous-config-dir.js';
-import { diffFailures, junitFailures, parseFailures, parseTimedOutFailures } from './gate-diff';
+import { collapseGateFailureAttempts, diffFailures, GateFailureAttributionMismatch, junitFailures, parseFailureAttempts, parseFailures, parseTimedOutFailures } from './gate-diff';
 import { loadEnvKnownFailures, splitKnownEnv } from './env-known-failures';
 import { loadGateBatchSafe } from './gate-batch-safe';
 import { observeGatePrewarmCutShadow, type GatePrewarmInput } from './gate-prewarm-plan.js';
@@ -43,12 +43,17 @@ import { resolveWarmPoolProfile } from '../../src/self-implement/pod-warm-pool-p
 import { decideWarmReuse, type WarmReuseSwitchConfig, type WarmReuseEvidence } from '../../src/task-orchestrator/surfaces/pod-warm-switch.js';
 import { getUserConfig } from '../../src/user-config.js';
 import { beginGateShardAttempt, finalizeTerminalGateShards, gateShardsPath, recordGateShardsVerdict, writeGateShards, type GateJobTerminal, type GateShard } from '../../src/release-loop/gate-shards.js';
+import { appendGateShardLedger, gateShardLedgerPath, type GateShardLedgerRow } from '../../src/release-loop/gate-shard-ledger.js';
+import { markGateShardUnmeasured, nextGateShardAttempt, readGateShardManifest, readGateShardResult, saveGateShardResult } from './gate-shard-receipts.js';
+import { planGateShardDispatch, type GateShardReceipt } from './gate-shard-dispatch.js';
 import { defaultKubectl } from '../../src/task-orchestrator/surfaces/self-implement-pod.js';
 import { executeTuiNodeCheck, type ExecutedTuiCheck } from './tui-node-checks.js';
 import { runWithReleaseGateTraffic } from './gate-traffic-mode.js';
 import { emitPodLifecycle, gatePodLifecycleEvent, gatePodOutcome } from '../../src/task-orchestrator/surfaces/pod-lifecycle-stages.js';
 import { gateHostReservationRoot, reserveReleaseGateHosts } from '../../src/release-loop/gate-host-reservation.js';
 import { normRoot } from '../../src/instance/resolve.js';
+import { cleanRetryVerdict, junitFailedCaseIds, junitTestcaseCount, junitTestcaseFiles } from './gate-shard-load-flaky.js';
+import { decideAndRecordGateAutoheal, gateAutohealCause, type GateAutohealDecision } from './gate-autoheal.js';
 
 export interface WarmShadowObservation {
   files: string[];
@@ -73,6 +78,10 @@ export function warmCommandMatchesRequest(command: WarmWorkerCommand, request: O
 }
 
 interface CommandResult { rc: number; output: string; passedIds?: string[]; stalledEnv?: Array<{ file: string; reason: 'no-output' }>; timedOut?: boolean;
+  /** Same-Pod per-file retry passed with complete log/JUnit evidence; these original ids are excluded from introduced. */
+  loadFlaky?: string[];
+  /** Files already given their one same-Pod retry; prevent the later timeout-only path from retrying them again. */
+  loadFlakyAttemptedFiles?: string[];
   /** Identity and complete selected inventory of this Pod sweep; only the producer may issue it. */
   podSweep?: { id: string; shards: number; files: string[] };
   /** Complete, source-bound one-file Job result for shadow comparison; absent means unmeasured. */
@@ -218,6 +227,12 @@ export interface GateOptions {
   recheckFileLimit?: number;
   /** freshShards — GATE-SHARD-RESUME off: every shard starts a Pod even when this logDir already holds its result. */
   pod?: { pool: string; shards?: number; shardTimeoutSeconds?: number; durationSource?: string; bunCache?: string; freshShards?: boolean;
+    /** Remeasure one named shard, or all incomplete shards with auto. Complete siblings keep their receipts. */
+    rerouteShard?: string | 'auto';
+    /** Pool context for the rerouted shard; the planner otherwise distributes missing shards over pool contexts. */
+    shardHost?: string;
+    /** Shard capability requirements are independent of host names; placement resolves them at run time. */
+    shardCapabilities?: Readonly<Record<string, { os?: 'darwin' | 'linux' }>>;
     /** Opt-in gate shadow: provider fills the fenced lease identity. The Job remains authoritative. */
     warmReplay?: (input: Omit<WarmWorkerCommand, 'leaseId' | 'generation' | 'workerId' | 'key'>) => Promise<{ command: WarmWorkerCommand | null; transport: WarmPodTransportResult }>;
     warmQuarantine?: (command: WarmWorkerCommand, reason: string) => Promise<void>;
@@ -253,8 +268,8 @@ export interface GateOptions {
     hostMirrorReaders?: GateHostMirrorReaders;
     /** GATE-INSTALL-CACHE — concurrent `bun install`s per node (`release.loop.gatePodInstallSlots`); omitted = 4 · 0 = off. */
     installSlots?: number;
-    /** GATE-MEM-ADMIT — seconds a shard waits for pool admission (memory headroom) before it launches anyway with
-     *  `admission-timeout` (`release.loop.gatePodAdmissionWaitSeconds`); omitted = {@link GATE_ADMISSION_WAIT_SECONDS_DEFAULT} · 0 = off. */
+    /** GATE-MEM-ADMIT — seconds an active shard waits for pool admission. Root shards beyond the pool cap queue
+     *  outside this timer; an exhausted wait stays unmeasured (`release.loop.gatePodAdmissionWaitSeconds`); 0 = off. */
     admissionWaitSeconds?: number;
     /** GATE-MEM-ADMIT — an injected admission (tests · embedders); config never sets it. Absent = the gate's own pool's. */
     admission?: GateAdmission;
@@ -279,7 +294,8 @@ export interface GateOptions {
      *  of {@link gateShardAbortScript} on the gate's own pool; an injected pool without it runs without the mid-run watch. */
     abortTests?: (job: { name: string; context?: string }, reason: string) => boolean | void;
     /** GATE-LIVE-OBS — the shard state file (`gateShardsPath(version)`) this sweep keeps current; absent = not written. */
-    shardsFile?: { path: string; version: string };
+    shardsFile?: { path: string; version: string; ledgerPath?: string; envFingerprint?: string;
+      receiptRoot?: string; base40?: string; expectedImageDigest?: string | null };
     /** GATE-RISK-LANE — the ledgers `gateHistory` reads its watch list from; absent = no risk lane (the sweep plans as before). */
     riskWatch?: { instanceRoots: readonly string[]; ledgerRoots: readonly string[] };
     /** GATE-MULTI-HOST — is this pool member reachable (kubectl ns ⊕ ssh)? Injected by tests; absent = the real probe on
@@ -321,6 +337,9 @@ export interface GateResult {
   baselineSource?: 'ledger' | 'instance' | 'cut-logs' | 'swept';
   /** GATE-BASELINE-CACHE — isolated baseline files answered from the ledger (hits) or run now (misses). */
   baselineCache?: { hits: number; misses: number };
+  /** A residual summary/name mismatch triggers an explicit baseline rerun before the gate stays fail-closed. */
+  attributionRecheck?: { summary: number; observed: number; identified: number; collapsed: number;
+    targetFiles: string[]; baselineResult: 'completed' | 'failed' | 'timeout' };
   /** GATE-SPEED A4 — a swept baseline ran only the cut's failing files that exist at the previous release. */
   baselineDeferred?: { cutFiles: number; swept: number };
   durationMs: number;
@@ -341,14 +360,16 @@ export interface GateResult {
   partialFailures?: SweepFailures;
   /** GATE-PARTIAL — this verdict re-ran only these files and carried the prior gate's results for the rest. */
   partial?: { priorCommit: string; files: number };
-  /** GATE-INTRO-RECHECK — new failures that were only the «timed out» shape and passed one isolated re-run with a
-   *  {@link GATE_TIMEOUT_RECHECK_MS} per-test limit: a warning (flaky under load), not an introduced regression. */
+  /** A failure that passed an evidence-checked isolated re-run: warning (flaky under load), not an introduced regression. */
   loadFlaky?: string[];
   /** File-level unhandled errors that reproduced or could not be measured in isolation. They keep the gate red. */
   unmeasuredErrors?: Array<{ file: string; reason: 'reproduced' | 'timeout' | 'unreadable'; ids: string[] }>;
   /** Shard-only unhandled errors whose file-level replay completed cleanly. */
   interferenceErrors?: string[];
   rehearsalTui?: ExecutedTuiCheck;
+  /** Recovery recommendation is persisted with the failed graph node so the resume coordinator can act on it. */
+  autoheal?: GateAutohealDecision;
+  autoheals?: GateAutohealDecision[];
 }
 
 const sha = /^[0-9a-f]{7,40}$/i;
@@ -523,6 +544,31 @@ const lastMatch = (output: string, pattern: RegExp): RegExpExecArray | null => {
   return last;
 };
 const summaryCount = (output: string, label: string) => Number(lastMatch(output, new RegExp(`(?:^|\\n)\\s*(\\d+) ${label}s?\\s*(?=\\n|$)`))?.[1] ?? NaN);
+/** `test:deterministic` runs several Bun commands. Its final clean command is not the verdict for earlier commands. */
+function deterministicSubrunCounts(output: string): { fail: number; error: number } | undefined {
+  if (!/error: script "test:deterministic" exited with code 1/.test(output)) return undefined;
+  const lines = output.split(/\r?\n/).map((line) => line.trim());
+  const runs: Array<{ fail: number; error: number }> = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    if (!/^Ran \d+ tests? across [1-9]\d* files?\./.test(lines[i]!)) continue;
+    let pass: number | undefined;
+    let fail: number | undefined;
+    let error = 0;
+    for (let j = i - 1; j >= Math.max(0, i - 8); j -= 1) {
+      const line = lines[j]!;
+      const count = /^(\d+) (pass|fail|skip|errors?|expect\(\) calls)$/.exec(line);
+      if (!line) continue;
+      if (!count) break;
+      if (count[2] === 'pass') { pass = Number(count[1]); break; }
+      if (count[2] === 'fail') fail = Number(count[1]);
+      if (count[2] === 'error' || count[2] === 'errors') error = Number(count[1]);
+    }
+    if (pass === undefined || fail === undefined) return undefined;
+    runs.push({ fail, error });
+  }
+  if (runs.length < 2) return undefined;
+  return runs.reduce((sum, run) => ({ fail: sum.fail + run.fail, error: sum.error + run.error }), { fail: 0, error: 0 });
+}
 /** bun reads a bare positional as a substring filter (`test` matches every *.test.ts); `./` makes it a path. */
 const asPath = (path: string) => path.startsWith('./') || path.startsWith('/') ? path : `./${path}`;
 /** A Pod path (`~/repo/src/…` · `../..~/repo/src/…`) as a repository-relative one. */
@@ -733,7 +779,8 @@ export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPa
     // run_part body changes the shell hash once for this feature; keeping the
     // multi-file invocation unchanged avoids another cache-key change.
     const warmFile = part.length === 1 ? `WARM_REFERENCE_FILE=${quote(part[0]!)} ` : '';
-    return `${warmFile}run_part ${index} ${[...runner, ...(o.testTimeoutMs !== undefined ? ['--timeout', String(o.testTimeoutMs)] : spawnParts.includes(index) ? ['--timeout=120000'] : []), ...ignores, ...part.map(asPath)].map(quote).join(' ')}`;
+    const manifest = `printf '%s\\n' ${part.map(quote).join(' ')} > "$O/part-${index}.files"; `;
+    return `${manifest}${warmFile}run_part ${index} ${[...runner, ...(o.testTimeoutMs !== undefined ? ['--timeout', String(o.testTimeoutMs)] : spawnParts.includes(index) ? ['--timeout=120000'] : []), ...ignores, ...part.map(asPath)].map(quote).join(' ')}`;
   });
   // Only file-isolation batches use this path. A bounded group shares one clone/install, but every test process gets
   // its own HOME, state and tmp directory; part logs/JUnit remain separate and the existing artifact reader judges them.
@@ -791,6 +838,24 @@ export function gateShardShell(o: { parts: readonly (readonly string[])[]; cdpPa
     ...(spawnParts.length ? ['  local test_start; test_start=$(date +%s)'] : []),
     `  { if [ -n "\${WARM_REFERENCE_FILE:-}" ]; then printf "[warm-worker] file=%s\\n" "$WARM_REFERENCE_FILE"; ${o.sourceBinding ? `printf "[warm-worker] cut=%s attempt=%s\\n" ${quote(o.sourceBinding.cutSha)} ${quote(o.sourceBinding.attemptId)}; ` : ''}fi; "\${run_env[@]}" timeout -k 10 "$left" "$@" --reporter=junit --reporter-outfile="$O/part-$i.junit.xml"; } > "$O/part-$i.log" 2>&1`,
     '  local prc=$?',
+    '  if [ -s "$O/part-$i.junit.xml" ]; then',
+    '    if bun run scripts/release-loop/gate-shard-load-flaky.ts "$O/part-$i.junit.xml" "$O/part-$i.retry-files" "$O/part-$i.files"; then',
+    '      local retry_index=0 retry_left retry_rc retry_file',
+    '      while IFS= read -r retry_file; do',
+    '        [ -n "$retry_file" ] || continue',
+    '        retry_left=$(( gate_end - $(date +%s) ))',
+    '        [ "$retry_left" -gt 0 ] || break',
+    '        [ "$retry_left" -le 120 ] || retry_left=120',
+    '        stage "part-$i-retry-$retry_index-start"',
+    '        : > "$O/part-$i.retry-$retry_index.started"',
+    '        timeout -k 10 "$retry_left" "${run_env[@]}" bun run scripts/test-deterministic.ts "$retry_file" --timeout 120000 --reporter=junit --reporter-outfile="$O/part-$i.retry-$retry_index.junit.xml" > "$O/part-$i.retry-$retry_index.log" 2>&1',
+    '        retry_rc=$?',
+    '        echo "$retry_rc" > "$O/part-$i.retry-$retry_index.rc"',
+    '        stage "part-$i-retry-$retry_index-end"',
+    '        retry_index=$(( retry_index + 1 ))',
+    '      done < "$O/part-$i.retry-files"',
+    '    fi',
+    '  fi',
     '  if [ -n "${WARM_REFERENCE_FILE:-}" ] && [ -f "$O/part-$i.junit.xml" ]; then',
     '    local junit_sha; junit_sha=$(sha256sum "$O/part-$i.junit.xml" 2>/dev/null | awk \'{print $1}\')',
     '    if [ -z "$junit_sha" ]; then junit_sha=$(shasum -a 256 "$O/part-$i.junit.xml" 2>/dev/null | awk \'{print $1}\'); fi',
@@ -1045,20 +1110,29 @@ export function gateShardAbortScript(reason: string, graceSeconds = GATE_SHARD_A
   return [
     `reason=${quote(reason.replace(/[^\w .:-]/g, '_'))}`,
     `only=${quote(outbox ?? '')}`,
-    "pg_of() { sed 's/^.*) //' \"/proc/$1/stat\" 2>/dev/null | cut -d' ' -f3; }",
+    // Read after the final ')' because comm can itself contain spaces and ')'. starttime is field 20 in the suffix
+    // (field 22 in proc stat); pairing it with PID prevents a recycled PID from validating an old group number.
+    "proc_identity() { sed 's/^.*) //' \"/proc/$1/stat\" 2>/dev/null | awk '{print $3, $20}'; }",
+    "pg_of() { proc_identity \"$1\" | awk '{print $1}'; }",
     'root_pg=$(pg_of 1); my_pg=$(pg_of $$); found=0',
     'for d in /proc/[0-9]*; do',
     '  pid=${d#/proc/}',
     "  out=$(tr '\\0' '\\n' < \"$d/cmdline\" 2>/dev/null | grep -m1 -E '^--reporter-outfile=.*/outbox/part-[0-9]+\\.junit\\.xml$') || continue",
     '  if [ -n "$only" ]; then case "$out" in "--reporter-outfile=$only/part-"*) ;; *) continue;; esac; fi',
-    '  pg=$(pg_of "$pid")',
-    '  case "$pg" in ""|*[!0-9]*) continue;; esac',
+    '  identity=$(proc_identity "$pid")',
+    '  pg=${identity%% *}; started=${identity#* }',
+    '  case "$pg:$started" in *[!0-9:]*|:|*:|:*) continue;; esac',
     '  if [ "$pg" != "$pid" ] || [ "$pg" -le 1 ] || [ "$pg" = "$root_pg" ] || [ "$pg" = "$my_pg" ]; then continue; fi',
+    // Re-read the process identity immediately before signaling. The same check guards delayed KILL so a PID/PGID
+    // that disappeared and was reused during the grace interval is never signaled as if it were the original test.
+    '  [ "$(proc_identity "$pid")" = "$identity" ] || continue',
     '  out=${out#--reporter-outfile=}; dir=${out%/part-*}; part=${out##*/part-}; part=${part%.junit.xml}',
-    '  printf "%s\\n" "$reason" > "$dir/part-$part.abort"',
-    '  [ -f "$dir/shard.timeout" ] || echo "$part" > "$dir/shard.timeout"',
-    '  if kill -TERM -- "-$pg" 2>/dev/null; then found=$((found + 1)); echo "ELANOUS_GATE_ABORT part=$part pgid=$pg"; fi',
-    `  ( sleep ${Math.max(1, Math.floor(graceSeconds))}; kill -KILL -- "-$pg" 2>/dev/null ) >/dev/null 2>&1 </dev/null &`,
+    '  if [ "$(proc_identity "$pid")" = "$identity" ] && kill -TERM -- "-$pg" 2>/dev/null; then',
+    '    printf "%s\\n" "$reason" > "$dir/part-$part.abort"',
+    '    [ -f "$dir/shard.timeout" ] || echo "$part" > "$dir/shard.timeout"',
+    '    found=$((found + 1)); echo "ELANOUS_GATE_ABORT part=$part pgid=$pg"',
+    `    ( sleep ${Math.max(1, Math.floor(graceSeconds))}; [ "$(proc_identity "$pid")" = "$identity" ] && kill -KILL -- "-$pg" 2>/dev/null ) >/dev/null 2>&1 </dev/null &`,
+    '  fi',
     'done',
     'echo "ELANOUS_GATE_ABORT signalled=$found"',
     '[ "$found" -gt 0 ]',
@@ -1092,6 +1166,10 @@ export interface ShardArtifacts {
   finished: string[];
   /** Raw logs of the parts that did not finish (diagnostics · last started file). */
   unfinishedLog?: string;
+  /** Original failure ids whose one same-Pod standalone retry completed cleanly. */
+  loadFlaky?: string[];
+  /** Files for which a same-Pod retry completed, even if it remained failing. */
+  loadFlakyAttemptedFiles?: string[];
 }
 /** Reads a shard Pod's outbox: the part layout ({@link gateShardShell}) or the older single-run one (shard.log · shard.rc · junit.xml). */
 export function readShardArtifacts(dir: string, parts: readonly (readonly string[])[]): ShardArtifacts {
@@ -1106,12 +1184,17 @@ export function readShardArtifacts(dir: string, parts: readonly (readonly string
   }
   const timedOut = read('shard.timeout') !== undefined;
   if (installRc !== 0) return { output: install, ...(installRc !== undefined ? { rc: installRc } : {}), timedOut, finished: [] };
-  const good: Array<{ log: string; junit?: string; rc: 0 | 1; files: readonly string[] }> = [];
+  const good: Array<{ log: string; junit?: string; rc: 0 | 1; files: readonly string[]; loadFlaky?: string[]; loadFlakyAttemptedFiles?: string[] }> = [];
   const bad: string[] = [];
   const exitAnomaly: string[] = [];
+  const attemptedFiles = new Set<string>();
   let otherBad = false;
   let badRc: number | undefined;
   parts.forEach((files, index) => {
+    const retryManifest = (read(`part-${index}.retry-files`) ?? '').split(/\r?\n/).filter(Boolean);
+    retryManifest.forEach((file, retryIndex) => {
+      if (files.includes(file) && read(`part-${index}.retry-${retryIndex}.started`) !== undefined) attemptedFiles.add(file);
+    });
     const log = read(`part-${index}.log`);
     const rc = rcOf(read(`part-${index}.rc`));
     const clean = log?.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
@@ -1122,9 +1205,32 @@ export function readShardArtifacts(dir: string, parts: readonly (readonly string
       otherBad = true;
       return;
     }
-    if (clean !== undefined && (rc === 0 || rc === 1) && lastMatch(clean, /Ran (\d+) tests? across (\d+) files?/)) {
+    const summary = clean === undefined ? undefined : lastMatch(clean, /Ran (\d+) tests? across (\d+) files?/);
+    const summaryTests = Number(summary?.[1] ?? NaN);
+    const summaryPass = clean === undefined ? NaN : summaryCount(clean, 'pass');
+    const summaryFail = clean === undefined ? NaN : summaryCount(clean, 'fail');
+    const summaryErrors = clean === undefined ? NaN : summaryCount(clean, 'error');
+    const partJunit = read(`part-${index}.junit.xml`) ?? '';
+    const testcaseFiles = junitTestcaseFiles(partJunit);
+    const expectedFiles = [...files].sort();
+    const timedOutComplete = rc === 124 && summary !== undefined && summary !== null && Number(summary[2]) === files.length
+      && summaryPass + summaryFail + (Number.isNaN(summaryErrors) ? 0 : summaryErrors) === summaryTests
+      && junitTestcaseCount(partJunit) === summaryTests
+      && testcaseFiles !== null && testcaseFiles.length === expectedFiles.length && expectedFiles.every((file, fileIndex) => testcaseFiles[fileIndex] === file);
+    if (clean !== undefined && ((rc === 0 || rc === 1) || timedOutComplete) && summary) {
       const junit = read(`part-${index}.junit.xml`);
-      good.push({ log: clean, rc, files, ...(junit !== undefined ? { junit } : {}) });
+      const retryFiles = retryManifest;
+      const loadFlaky = retryFiles.flatMap((file, retryIndex) => {
+        if (!files.includes(file)) return [];
+        const retryRc = rcOf(read(`part-${index}.retry-${retryIndex}.rc`));
+        const retryLog = read(`part-${index}.retry-${retryIndex}.log`);
+        const retryJunit = read(`part-${index}.retry-${retryIndex}.junit.xml`);
+        const originalFailures = (junitFailedCaseIds(junit ?? '') ?? []).filter((id) => fileOf(id) === file);
+        const verdict = cleanRetryVerdict(retryRc, retryLog, retryJunit, file, originalFailures);
+        if (!verdict.clean) return [];
+        return originalFailures;
+      });
+      good.push({ log: clean, rc: rc === 0 ? 0 : 1, files, ...(junit !== undefined ? { junit } : {}), ...(loadFlaky.length ? { loadFlaky } : {}) });
       return;
     }
     if (log !== undefined) bad.push(`# part ${index} (${rc === undefined ? 'unfinished' : `rc=${rc}`})\n${log}`);
@@ -1150,6 +1256,9 @@ export function readShardArtifacts(dir: string, parts: readonly (readonly string
     ...(rc !== undefined ? { rc } : {}),
     timedOut: !complete && timedOut && badRc === undefined,
     finished: good.flatMap((part) => [...part.files]),
+    ...([ ...new Set(good.flatMap((part) => part.loadFlaky ?? [])) ].length
+      ? { loadFlaky: [...new Set(good.flatMap((part) => part.loadFlaky ?? []))].sort() } : {}),
+    ...(attemptedFiles.size ? { loadFlakyAttemptedFiles: [...attemptedFiles].sort() } : {}),
     ...(bad.length ? { unfinishedLog: bad.join('\n') } : {}),
     ...(exitAnomaly.length && !otherBad ? { exitCodeOnly: exitAnomaly } : {}),
   };
@@ -1190,8 +1299,8 @@ const lastStartedTestFile = (output: string, paths: string[]): string | undefine
  *  split shape follows from depth and size alone, so the same plan reaches the same child names (TC 09:30 review ②).
  *  `runKey` hashes where and how the Pod ran the shard (pool · command · ignores · memory · deadline · Bun cache): a fix on the Pod side
  *  makes every old result a miss instead of re-reading an old failure as introduced (TC 09:48 review). */
-export function previousShardDescent(logDir: string, name: string, commit: string, files: readonly string[], runKey: string, parentAttempt?: string, splitChild?: string): { way: 'retry' | 'split'; attemptId: string } | undefined {
-  const meta = (file: string): { commit?: unknown; files?: unknown; rc?: unknown; runKey?: unknown; attemptId?: unknown; parentAttempt?: unknown } | undefined => {
+export function previousShardDescent(logDir: string, name: string, commit: string, files: readonly string[], runKey: string, parentAttempt?: string, splitChild?: string): { way: 'retry' | 'split' | 'file-fanout'; attemptId: string } | undefined {
+  const meta = (file: string): { commit?: unknown; files?: unknown; rc?: unknown; reason?: unknown; runKey?: unknown; attemptId?: unknown; parentAttempt?: unknown } | undefined => {
     try { return JSON.parse(readFileSync(join(logDir, `${file}.json`), 'utf8')); } catch { return undefined; }
   };
   const own = meta(name);
@@ -1208,6 +1317,8 @@ export function previousShardDescent(logDir: string, name: string, commit: strin
       && (!whole || row.files.length === files.length);
   };
   if (child(`${name}-retry`, true)) return { way: 'retry', attemptId };
+  // A stalled multi-file parent may have descended directly to one Pod per file. Keep that shape on resume.
+  if (own.reason === 'stall' && files.length > 1 && child(`${name}-file-0`, false)) return { way: 'file-fanout', attemptId };
   // Only the first child of the split the caller takes now (`-file-0` · `-c0` · `-0` · review r3): a record of another
   // split shape is not followed.
   return splitChild !== undefined && child(`${name}${splitChild}`, false) ? { way: 'split', attemptId } : undefined;
@@ -1239,10 +1350,11 @@ function failuresOf(run: CommandResult, label: string): SweepFailures {
   const output = stripPodRepoRoot(run.output.replace(/\x1b\[[0-9;]*[A-Za-z]/g, ''));
   const ran = lastMatch(output, /Ran (\d+) tests? across ([1-9]\d*) files?/);
   const reportedErrors = summaryCount(output, 'error');
-  const errorCount = Number.isNaN(reportedErrors) ? 0 : reportedErrors;
-  const incomplete = (reason: string) => new Error(`${label} incomplete (rc=${run.rc}; Ran=${ran ? ran[0] : 'missing'}; errors=${Number.isNaN(reportedErrors) ? 'missing' : errorCount}; ${reason})\n${tail40(output)}`);
-  const count = summaryCount(output, 'fail');
-  const failures = parseFailures(output);
+  // Validated Pod shards were checked separately before their logs were joined; only the host sweep needs subrun totals.
+  const subruns = !run.validatedShards && run.rc === 1 ? deterministicSubrunCounts(output) : undefined;
+  const errorCount = subruns?.error ?? (Number.isNaN(reportedErrors) ? 0 : reportedErrors);
+  const incomplete = (reason: string) => new Error(`${label} incomplete (rc=${run.rc}; Ran=${ran ? ran[0] : 'missing'}; errors=${subruns || !Number.isNaN(reportedErrors) ? errorCount : 'missing'}; ${reason})\n${tail40(output)}`);
+  const count = subruns?.fail ?? summaryCount(output, 'fail');
   // Bun repeats failed test names under "N tests failed:". A validated Pod sweep joins
   // separately checked shards, so a summary in one shard can precede real failures
   // from later shards. Remove each repeated block, not everything after the last one.
@@ -1253,6 +1365,11 @@ function failuresOf(run: CommandResult, label: string): SweepFailures {
     ? output.replace(/^\d+ tests? failed:\r?\n(?:\(fail\)[^\r\n]*(?:\r?\n|$))*(?:[ \t]*\r?\n)*/gm, '')
     : failureSummary ? output.slice(0, failureSummary.index) : output;
   const occurrences = [...executionOutput.matchAll(/^[ \t]*\(fail\)[ \t]+.+?(?:[ \t]+\[[\d.]+(?:ms|s)\])?[ \t]*\r?$/gm)].length;
+  const collapsed = collapseGateFailureAttempts(parseFailureAttempts(executionOutput));
+  const failures = collapsed.failures;
+  if (collapsed.collapsed > 0) debug.log('release-loop.gate', 'failure-attribution-deduplicated', {
+    label, summary: count, observed: occurrences, identified: collapsed.failures.length, collapsed: collapsed.collapsed,
+  });
   // A test that leaves process.exitCode set leaks a non-zero exit into a run whose own summary is complete and clean
   // (0.2.7 gate: agent-cli at v0.2.6 · 12 pass · 0 fail · rc 2). The summary is the verdict; read that exit as clean.
   const leakedExit = !!ran && run.rc !== 0 && run.rc !== 1 && count === 0 && errorCount === 0 && occurrences === 0
@@ -1271,7 +1388,11 @@ function failuresOf(run: CommandResult, label: string): SweepFailures {
     }
   }
   if (errors.length !== errorCount) throw incomplete(`error attribution identified=${errors.length}`);
-  if (!Number.isFinite(count) || (count !== occurrences && !(run.validatedShards && occurrences > count && failures.length === count)) || (count > 0 && failures.length === 0)
+  const retryDuplicatesExplainCount = occurrences > count && collapsed.observed === occurrences && failures.length === count;
+  if (Number.isFinite(count) && (failures.length !== count || (occurrences !== count && !retryDuplicatesExplainCount))) {
+    throw new GateFailureAttributionMismatch(label, count, occurrences, failures.length, collapsed.collapsed, failures);
+  }
+  if (!Number.isFinite(count) || (count > 0 && failures.length === 0)
     || (rc === 1 && count === 0 && errorCount === 0) || (rc === 0 && count + errorCount > 0)) {
     throw incomplete(`failure attribution incomplete: summary=${count}, identified=${failures.length}`);
   }
@@ -1298,7 +1419,7 @@ export function readIsolatedRun(run: CommandResult, label: string, file: string)
   if (!cleanNonzero) {
     const read = failuresOf(run, label);
     // Two (fail) lines folding into one id would undercount the file's failures: unreadable, not fewer.
-    const failCount = summaryCount(output, 'fail');
+    const failCount = deterministicSubrunCounts(output)?.fail ?? summaryCount(output, 'fail');
     if (Number.isFinite(failCount) && read.failures.length !== failCount)
       throw new Error(`${label} incomplete (rc=${run.rc}; failure attribution summary=${failCount}, identified=${read.failures.length})`);
     return { kind: 'read', ...read };
@@ -1360,6 +1481,7 @@ class SettledRecheckFailures extends Error {
 
 /** Isolated re-runs (host stall re-run · cut and baseline re-checks) are time-limited; sweeps and installs keep their full time. */
 export const GATE_ISOLATED_TIMEOUT_MS = 300_000;
+export const GATE_ATTRIBUTION_RECHECK_FILE_LIMIT = 64;
 /** Default final recheck window size; overflow continues in later windows. */
 export const GATE_HOST_RECHECK_FILE_LIMIT = 32;
 /** Two isolated test processes in each of four Pods = eight at most, with one checkout/install per eight files. */
@@ -1419,7 +1541,40 @@ export interface GateAdmission {
   /** The pool-wide reading admission waits on (recommended · limitedBy · memorySlots); null before any reading. */
   waitReason(): string | null;
 }
-export const GATE_ADMISSION_WAIT_SECONDS_DEFAULT = 300;
+export const GATE_ADMISSION_WAIT_SECONDS_DEFAULT = 1800;
+/** Queue pressure scales the default wait but never creates an unbounded admission timer. */
+export function gateAdmissionWaitSeconds(shards: number, slots: number): number {
+  return Math.max(GATE_ADMISSION_WAIT_SECONDS_DEFAULT, Math.min(3600,
+    Math.ceil(shards / Math.max(1, slots)) * 300));
+}
+export function createGateRootLimiter(slots: number): <T>(run: () => Promise<T>) => Promise<T> {
+  if (!Number.isSafeInteger(slots) || slots < 1) throw new Error('invalid gate root slots');
+  let active = 0;
+  const waiters: Array<() => void> = [];
+  return async <T>(run: () => Promise<T>): Promise<T> => {
+    if (active >= slots) await new Promise<void>((resolve) => waiters.push(resolve));
+    else active++;
+    try { return await run(); }
+    finally {
+      const next = waiters.shift();
+      if (next) next(); // transfer the occupied slot before another caller can enter
+      else active--;
+    }
+  };
+}
+/** A direct gate has no preflight image pin. Its measured receipt still carries its own image digest. */
+export function gateReceiptReuseKey(receipt: GateShardReceipt | null, fingerprint: string, expectedImageDigest: string | null | undefined,
+  hosts: ReadonlySet<string>): { envKey?: string; reason: string } {
+  if (!receipt) return { reason: 'receipt-missing' };
+  if (receipt.status !== 'complete') return { reason: 'receipt-unmeasured' };
+  if (!hosts.has(receipt.host)) return { reason: 'receipt-host-outside-pool' };
+  if (expectedImageDigest) return receipt.envKey === `${fingerprint}:${expectedImageDigest}`
+    ? { envKey: receipt.envKey, reason: 'image-pinned' } : { reason: 'receipt-image-or-env-drift' };
+  const prefix = `${fingerprint}:`;
+  if (!receipt.envKey.startsWith(prefix)) return { reason: 'receipt-env-drift' };
+  return /^sha256:[a-f0-9]{64}$/i.test(receipt.envKey.slice(prefix.length))
+    ? { envKey: receipt.envKey, reason: 'measured-image' } : { reason: 'receipt-image-unmeasured' };
+}
 export type GateAdmissionOutcome = 'granted' | 'admission-timeout' | 'admission-error' | 'off';
 export interface GateAdmissionResult { outcome: GateAdmissionOutcome; waitedMs: number; reason?: string; release: () => void }
 export const gateAdmissionWaitText = (reading: string | null) => `메모리 여유 대기(admission) · ${reading ?? '측정 전'}`.slice(0, 160);
@@ -1569,6 +1724,10 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const watchList = pod.riskWatch ? readGateRiskWatchList(pod.riskWatch) : [];
     const riskPlan = planGateRiskLaneShards({ assignable, durations, shardCount, heavy, watchList });
     const shards = riskPlan.shards;
+    const receiptRoot = pod.shardsFile?.receiptRoot;
+    const base40 = pod.shardsFile?.base40;
+    const envFingerprint = pod.shardsFile?.envFingerprint;
+    const expectedImageDigest = pod.shardsFile?.expectedImageDigest;
     if (riskPlan.spawnFiles.length) debug.log('release-loop.gate', 'pod-spawn-lane', { files: riskPlan.spawnFiles, shards: riskPlan.spawnShardCount });
     if (riskPlan.riskFiles.length) debug.log('release-loop.gate', 'pod-risk-lane-plan', { files: riskPlan.riskFiles, shard: 0,
       plannedSeconds: riskPlan.riskPlannedSeconds, shards: shards.length, watch: watchList.length });
@@ -1590,6 +1749,56 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     const ready = poolOverride ? undefined : checkPodPool(parsePodPool(pod.pool), kubectl);
     if (ready && !ready.ok) throw new Error('pod command: 풀의 노드가 하나도 준비되지 않았다');
     const poolScheduler = poolOverride ?? new PodPoolScheduler(ready!.ready);
+    const receiptChecks = shards.map((item, shard) => {
+      if (pod.freshShards) return { reason: 'fresh-shards' };
+      if (!receiptRoot || !base40 || !envFingerprint) return { reason: 'receipt-context-missing' };
+      const prior = readGateShardManifest(receiptRoot, `pod-${shard}`);
+      const key = gateReceiptReuseKey(prior, envFingerprint, expectedImageDigest,
+        new Set(poolScheduler.members.map((member) => member.context)));
+      if (!key.envKey) return { reason: key.reason };
+      const result = readGateShardResult(receiptRoot, { shard: { id: `pod-${shard}`, files: item.files },
+        head40: commit, base40, envKey: key.envKey });
+      return result ? { reason: key.reason, result } : { reason: 'receipt-identity-or-evidence-invalid' };
+    });
+    const receipts = receiptChecks.flatMap((check) => check.result ? [check.result.receipt] : []);
+    const requiredOs = pod.shardCapabilities ?? {};
+    const envKnownIds = loadEnvKnownFailures(tree);
+    const envKnownFiles = new Set([...envKnownIds].map(fileOf));
+    const macPassShardIds = shards.flatMap((shard, index) => {
+      const prior = receipts.find((receipt) => receipt.id === `pod-${index}`);
+      if (!prior) return [];
+      const knownFailure = [...prior.failureIds, ...prior.errorIds].some((id) => envKnownIds.has(id));
+      const knownUnmeasuredFile = prior.status === 'unmeasured' && shard.files.some((file) => envKnownFiles.has(file));
+      return knownFailure || knownUnmeasuredFile ? [`pod-${index}`] : [];
+    });
+    for (const id of Object.keys(requiredOs)) if (!/^pod-\d+$/.test(id) || Number(id.slice(4)) >= shards.length)
+      throw new Error(`unknown shard capability target: ${id}`);
+    const needsPlatform = Object.values(requiredOs).some((value) => value.os)
+      || (pod.rerouteShard === 'auto' && macPassShardIds.length > 0);
+    const hosts = poolScheduler.members.map((member) => {
+      let platform: 'darwin' | 'linux' | 'other' = 'other';
+      if (needsPlatform) {
+        const system = member.sshHost ? remoteRun(member.sshHost, 'uname -s') :
+          { status: 0, stdout: process.platform, stderr: '' };
+        if (system.status === 0) platform = /^(?:darwin)$/i.test(system.stdout.trim()) ? 'darwin'
+          : /^(?:linux)$/i.test(system.stdout.trim()) ? 'linux' : 'other';
+      }
+      return { id: member.context, platform, available: true, reserved: false };
+    });
+    const hostPlan = planGateShardDispatch({ head40: commit, base40: base40 ?? commit,
+      shards: shards.map((item, shard) => ({ id: `pod-${shard}`, files: item.files,
+        ...(requiredOs[`pod-${shard}`]?.os ? { requiredOs: requiredOs[`pod-${shard}`]!.os } : {}) })), receipts,
+      hosts,
+      macPassShardIds,
+      ...(pod.rerouteShard ? { rerouteShard: pod.rerouteShard } : {}), ...(pod.shardHost ? { shardHost: pod.shardHost } : {}) });
+    // Leave ordinary shards to the live free-slot scheduler. A static plan can pick a busy member
+    // while another is idle; pin only a capability or a deliberate cross-host replacement.
+    const hostPins = new Map(hostPlan.flatMap((item) => item.kind === 'run'
+      && (requiredOs[item.shardId]?.os || (pod.rerouteShard === 'auto' && macPassShardIds.includes(item.shardId))
+        || (item.replacing && item.host !== item.replacing.host)
+        || (pod.shardHost && item.host === pod.shardHost)) ? [[item.shardId, item.host] as const] : []));
+    const unavailable = hostPlan.find((item) => item.kind === 'unmeasured');
+    if (unavailable) throw new Error(`gate shard ${unavailable.shardId} unmeasured: ${unavailable.reason}`);
     const configCache = typeof pod.bunCache === 'string' ? pod.bunCache.trim() : '';
     const envCache = process.env[POD_BUN_CACHE_HOST_PATH]?.trim();
     const bunCache = configCache || envCache || undefined;
@@ -1600,11 +1809,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     if (!Number.isSafeInteger(installSlots) || installSlots < 0) throw new Error('invalid pod sweep options');
     debug.log('release-loop.gate', 'pod-install-slots', { slots: installSlots, source: pod.installSlots !== undefined ? 'config' : 'default' });
     // GATE-MEM-ADMIT: every shard Job (retries and splits too) asks pool admission before it is placed.
-    const admissionWaitSeconds = pod.admissionWaitSeconds ?? GATE_ADMISSION_WAIT_SECONDS_DEFAULT;
+    const rootSlots = Math.max(1, poolScheduler.members.reduce((total, member) => total + member.capacity, 0));
+    const admissionWaitSeconds = pod.admissionWaitSeconds ?? gateAdmissionWaitSeconds(shards.length, rootSlots);
     if (!Number.isSafeInteger(admissionWaitSeconds) || admissionWaitSeconds < 0) throw new Error('invalid pod sweep options');
     // An injected pool (tests) runs without admission unless `pod.admission` is passed; the gate's own pool asks it.
     const gateAdmission = pod.admission ?? tools.admission ?? (poolOverride ? undefined : poolGateAdmission(poolScheduler));
-    debug.log('release-loop.gate', 'pod-admission', { waitSeconds: admissionWaitSeconds, source: pod.admissionWaitSeconds !== undefined ? 'config' : 'default', enabled: !!gateAdmission && admissionWaitSeconds > 0 });
+    debug.log('release-loop.gate', 'pod-admission', { waitSeconds: admissionWaitSeconds, source: pod.admissionWaitSeconds !== undefined ? 'config' : 'default', enabled: !!gateAdmission && admissionWaitSeconds > 0,
+      rootSlots, shards: shards.length });
     // GATE-POD-STALL-FAILFAST: a shard with no test output within the stall window is stopped and recorded unmeasured.
     const stallSeconds = pod.stallSeconds ?? GATE_POD_STALL_SECONDS_DEFAULT;
     const stallPollMs = pod.stallPollMs ?? GATE_POD_STALL_POLL_MS;
@@ -1695,7 +1906,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       return { ...(podName ? { podName } : {}), ...(termination ? { termination } : {}), ...(logs?.status === 0 ? { logTail: logs.stdout } : {}),
         ...(errors.length ? { error: `수거 실패 · ${errors.join(' · ')}` } : {}) };
     });
-    type ShardRun = { output: string; rc: number; pass: number; fail: number; errors: number; ran: number; files: number; passedIds: string[] };
+    type ShardRun = { output: string; rc: number; pass: number; fail: number; errors: number; ran: number; files: number; passedIds: string[]; loadFlaky?: string[]; loadFlakyAttemptedFiles?: string[] };
     type ShardReason = NonNullable<GateResult['stalledShards']>[number]['reason'];
     // 깊이 끝 OOM 조각은 «조각 전체»를 파일 하나씩 격리한다 — 상한 40 이면 나머지가 못 잰 채 남았다(09-30 ① 7번 조각 110 파일).
     const isolationRemaining = shards.map((item) => item.files.length);
@@ -1722,29 +1933,88 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     }, 0);
     const knownTimes = assignable.map((file) => durations.get(file)).filter((value): value is number => value !== undefined && Number.isFinite(value) && value >= 0).sort((a, b) => a - b);
     const unknownSeconds = knownTimes.length ? (knownTimes[Math.floor((knownTimes.length - 1) / 2)]! + knownTimes[Math.floor(knownTimes.length / 2)]!) / 2 : 1;
-    // GATE-LIVE-OBS — one row per root shard in the release ledger's shards.json (UX contract · src/release-loop/gate-shards.ts).
-    // Retries and splits of a shard update its row. A write failure is logged and never stops the gate.
+    // GATE-LIVE-OBS — root rows stay stable; each recursive split/retry and tail gets its own row.
+    // Otherwise a finished root Job can hide a still-running child (or tail) behind 80/80 done.
     const board: GateShard[] = shards.map((item, index) => ({ id: `pod-${index}`, state: 'pending', plannedMin: Math.round(item.plannedSeconds / 6) / 10 }));
+    const filesById = new Map(shards.map((item, index) => [`pod-${index}`, [...item.files]]));
+    const detailsById = new Map<string, Partial<GateShardLedgerRow>>();
+    const observeShard = (row: GateShard) => {
+      if (!pod.shardsFile?.ledgerPath || !pod.shardsFile.envFingerprint) return;
+      const detail = detailsById.get(row.id) ?? {};
+      const logName = row.resultFile?.replace(/\.json$/, '') ?? null;
+      const logPath = logName && logDir ? join(logDir, `${logName}.log`) : null;
+      const junitPath = logName && logDir ? join(logDir, `${logName}.junit.xml`) : null;
+      try {
+        appendGateShardLedger(pod.shardsFile.ledgerPath, {
+          v: 1, version: pod.shardsFile.version, phase: 'cut', shardId: row.id,
+          files: filesById.get(row.id) ?? [], host: row.host ?? null, executor: 'pod',
+          imageDigest: detail.imageDigest ?? null, commit, envFingerprint: pod.shardsFile.envFingerprint,
+          startedAt: row.startedAt ?? null, endedAt: row.endedAt ?? null, observedAt: new Date().toISOString(),
+          state: row.state, rc: row.rc ?? null, pass: detail.pass ?? null, fail: detail.fail ?? null,
+          errors: detail.errors ?? null, ran: detail.ran ?? null,
+          failureIds: detail.failureIds ?? null, errorIds: detail.errorIds ?? null,
+          attribution: detail.attribution ?? 'unmeasured', logPath, junitPath,
+          stopReason: detail.stopReason ?? row.waitReason ?? null, attemptId: row.attemptId ?? null,
+        });
+      } catch (error) { debug.log('release-loop.gate', 'shard-ledger-write-failed', { shard: row.id, error: String(error) }, { level: 'warn' }); }
+    };
     const flushBoard = () => {
       if (!pod.shardsFile) return;
       try { writeGateShards(pod.shardsFile.path, { v: 1, version: pod.shardsFile.version, updatedAt: new Date().toISOString(), shards: board }); }
       catch (error) { debug.log('release-loop.gate', 'shards-write-failed', { path: pod.shardsFile.path, error: String(error) }); }
     };
-    const markShard = (shard: number, patch: Partial<GateShard>, clear: Array<keyof GateShard> = []) => {
-      const row = board[shard];
+    const rowIndex = (shard: number, branch = '') => branch ? board.findIndex((row) => row.id === `pod-${shard}${branch}`) : shard;
+    const markShard = (shard: number, patch: Partial<GateShard>, clear: Array<keyof GateShard> = [], branch = '') => {
+      const index = rowIndex(shard, branch);
+      const row = board[index];
       if (!row) return;
       const next: GateShard = { ...row, ...patch };
       for (const key of clear) delete next[key];
       if (JSON.stringify(next) === JSON.stringify(row)) return;
-      board[shard] = next;
+      board[index] = next;
+      observeShard(next);
       flushBoard();
     };
-    const resetShardAttempt = (shard: number) => {
-      const row = board[shard];
+    const resetShardAttempt = (shard: number, branch = '', plannedMin?: number) => {
+      if (branch && rowIndex(shard, branch) < 0) board.push({ id: `pod-${shard}${branch}`, state: 'pending', ...(plannedMin !== undefined ? { plannedMin } : {}) });
+      const index = rowIndex(shard, branch);
+      const row = board[index];
       if (!row) return;
-      board[shard] = beginGateShardAttempt(row);
+      board[index] = beginGateShardAttempt(row);
+      delete board[index]!.rc;
+      delete board[index]!.installSec;
+      // The root is a logical aggregate while its descendants run, not the terminal state of its first Job.
+      if (branch) {
+        board[shard] = beginGateShardAttempt(board[shard]!);
+        delete board[shard]!.rc;
+        delete board[shard]!.installSec;
+        observeShard(board[shard]!);
+      }
+      detailsById.delete(row.id);
+      observeShard(board[index]!);
       flushBoard();
     };
+    const recordShardResult = (id: string, done: { runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }) => {
+      const index = board.findIndex((row) => row.id === id);
+      if (index < 0) return;
+      const counts = done.runs.reduce((sum, run) => ({ pass: sum.pass + run.pass, fail: sum.fail + run.fail,
+        errors: sum.errors + run.errors, ran: sum.ran + run.ran }), { pass: 0, fail: 0, errors: 0, ran: 0 });
+      const failureIds: string[] = [];
+      const errorIds: string[] = [];
+      let attributed = done.stalled.length === 0 && done.runs.length > 0;
+      for (const run of done.runs) {
+        try {
+          const parsed = failuresOf({ rc: run.rc, output: run.output, validatedShards: true }, `ledger ${id}`);
+          failureIds.push(...parsed.failures); errorIds.push(...parsed.errors);
+        } catch { attributed = false; }
+      }
+      const detail: Partial<GateShardLedgerRow> = { ...(detailsById.get(id) ?? {}), ...counts, failureIds: attributed ? [...new Set(failureIds)].sort() : null,
+        errorIds: attributed ? [...new Set(errorIds)].sort() : null, attribution: attributed ? 'complete' : 'unmeasured',
+        stopReason: done.stalled.map((item) => item.reason).join(', ') || null };
+      detailsById.set(id, detail);
+      observeShard(board[index]!);
+    };
+    for (const row of board) observeShard(row);
     flushBoard();
     // A result collector can lose its callback after the Kubernetes Job has already completed. Reconcile
     // the public shard board independently so a finished Job cannot remain «running» indefinitely.
@@ -1758,6 +2028,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           const index = board.findIndex((shard) => shard.id === item.shard);
           if (index < 0) continue;
           board[index] = reconciled.board.find((shard) => shard.id === item.shard)!;
+          observeShard(board[index]!);
           debug.log('release.gate', 'shard-stale-finalized', item);
         }
         flushBoard();
@@ -1768,22 +2039,25 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     /** The gate's scheduler, seen through one shard: a slot wait and the Pod start become row states. */
     // GATE-MEM-ADMIT: `placed` releases the shard's admission once a member is chosen — from then on the Job is
     // Pending/Running in the cluster and the next admission reading counts it, so holding the lease would count it twice.
-    const trackedPool = (shard: number, retry: boolean, jobName: string, resultFile: string, attemptId: string, placed: (member: NonNullable<Awaited<ReturnType<PodPoolScheduler['tryAcquire']>>>) => void = () => {}, skipMembers: ReadonlySet<string> = new Set()): PodPoolScheduler => ({
+    const trackedPool = (shard: number, branch: string, jobName: string, resultFile: string, attemptId: string, placed: (member: NonNullable<Awaited<ReturnType<PodPoolScheduler['tryAcquire']>>>) => void = () => {}, skipMembers: ReadonlySet<string> = new Set(), allowPin = false): PodPoolScheduler => ({
       members: poolScheduler.members,
       tryAcquire: async (...[skip, onEmpty, mode]: Parameters<PodPoolScheduler['tryAcquire']>) => {
         // GATE-MULTI-HOST: a lost member is skipped while another member is left (all lost = the old behaviour).
         const anyLeft = poolScheduler.members.some((m) => !downMembers.has(m.context));
-        const excluded = new Set([...(skip ?? []), ...skipMembers, ...(downMembers.size && anyLeft ? downMembers : [])]);
+        // Only the first placement follows the plan; retries and unavailable hosts can move.
+        const planned = allowPin && !skip?.size ? hostPins.get(`pod-${shard}`) : undefined;
+        const pin = planned && !downMembers.has(planned) ? planned : undefined;
+        const excluded = new Set([...(skip ?? []), ...skipMembers, ...(downMembers.size && anyLeft ? downMembers : []),
+          ...(pin ? poolScheduler.members.filter((m) => m.context !== pin).map((m) => m.context) : [])]);
         const member = await poolScheduler.tryAcquire(excluded.size ? excluded : undefined, onEmpty, mode);
         if (member) placed(member);
-        if (member) markShard(shard, { state: retry ? 'retry' : 'running', startedAt: board[shard]?.startedAt ?? new Date().toISOString(), host: member.context, job: jobName, resultFile, attemptId }, ['waitReason']);
-        else markShard(shard, { waitReason: 'Pod 자리 대기' });
+        if (member) markShard(shard, { state: 'running', startedAt: board[rowIndex(shard, branch)]?.startedAt ?? new Date().toISOString(), host: member.context, job: jobName, resultFile, attemptId }, ['waitReason'], branch);
+        else markShard(shard, { waitReason: 'Pod 자리 대기' }, [], branch);
         return member;
       },
       release: (member: Parameters<PodPoolScheduler['release']>[0]) => poolScheduler.release(member),
     }) as unknown as PodPoolScheduler;
-    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string, hostRetries = 0, batchIsolation = false, skipMembers: ReadonlySet<string> = new Set(), singleShotTail = false): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
-      if (branch || depth > 0 || parentAttempt !== undefined || hostRetries > 0) resetShardAttempt(shard);
+    const runShardImpl = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false, fresh = pod.freshShards === true, parentAttempt?: string, hostRetries = 0, batchIsolation = false, skipMembers: ReadonlySet<string> = new Set(), singleShotTail = false): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
       // 파일별 소요는 junit 으로 남긴다 — 콘솔 요약(판정 원천)은 그대로이고, 느린 시험 목록(K10 D4)·계층 분리(D2)의 자가 된다.
       // GATE-TIMEOUT-HEAL: parts (each with its own junit) under a soft deadline inside this shard's own Job deadline.
       const shardDeadline = shardDeadlineSeconds(batchIsolation ? Math.max(...paths.map((file) => estimated([file]))) * Math.ceil(paths.length / batchWidth) : estimated(paths), deadlineSeconds);
@@ -1805,6 +2079,8 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       let batchArtifactsComplete = true;
       let junit: string | undefined;
       let rc: number | undefined;
+      let shardLoadFlaky: string[] = [];
+      let shardLoadFlakyAttemptedFiles: string[] = [];
       let jobExitCode: number | undefined;
       let batchArtifactDir: string | undefined;
       let lastFile: string | undefined;
@@ -1847,13 +2123,13 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       if (descent === 'retry') {
         // «descend» is only the way down; «resumed» comes from each leaf whose log reads cleanly (review r4).
         debug.log('release-loop.gate', 'pod-shard-descend', { shard, branch, files: paths.length, via: 'retry' });
-        resetShardAttempt(shard);
+        resetShardAttempt(shard, branch);
         return runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId, hostRetries, batchIsolation, skipMembers);
       }
-      if (descent === 'split') {
-        resetShardAttempt(shard);
+      if (descent === 'split' || descent === 'file-fanout') {
+        resetShardAttempt(shard, branch);
         output = undefined;
-        debug.log('release-loop.gate', 'pod-shard-descend', { shard, branch, files: paths.length, via: 'split' });
+        debug.log('release-loop.gate', 'pod-shard-descend', { shard, branch, files: paths.length, via: descent });
       } else if (reused) {
         output = reused.output;
         junit = reused.junit;
@@ -1862,7 +2138,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         lastFile = lastStartedTestFile(output, paths);
       } else try {
         stamp('admissionStart');
-        admitted = await admitGateShard(gateAdmission, { waitMs: admissionWaitSeconds * 1000, onWait: (reason) => markShard(shard, { waitReason: reason }) });
+        admitted = await admitGateShard(gateAdmission, { waitMs: admissionWaitSeconds * 1000, onWait: (reason) => markShard(shard, { waitReason: reason }, [], branch) });
         stamp('admissionEnd');
         if (admitted.outcome !== 'off') debug.log('release-loop.gate', 'shard-admission', { shard, branch, outcome: admitted.outcome, waitedMs: admitted.waitedMs, ...(admitted.reason ? { reason: admitted.reason } : {}) },
           admitted.outcome === 'granted' ? undefined : { level: 'warn' });
@@ -1903,10 +2179,10 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
             graphNode: 'gate', version: pod.shardsFile?.version, commit, shard: `${shard + 1}-of-${shards.length}`,
             reason: `release gate shard ${shard + 1}/${shards.length}`, pool: pod.pool, cpuReq: cpu.request,
             memReq: memoryLimit ?? POD_ISOLATION_MEMORY_LIMIT, warmReused: false },
-          pool: pod.pool, poolScheduler: trackedPool(shard, depth > 0 || branch !== '', jobName, resultFile, attemptId, (member) => {
+          pool: pod.pool, poolScheduler: trackedPool(shard, branch, jobName, resultFile, attemptId, (member) => {
             stamp('poolPlaced'); jobContext = member.context; jobContextForCapture = member.context; placedOn = member.context; placed();
             if (branch === '-tail') tailPlacedHost = member.context;
-          }, skipMembers), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
+          }, skipMembers, depth === 0 && branch === '' && hostRetries === 0 && !retriedNoOutput && !batchIsolation && skipMembers.size === 0), clone: true, source: { kind: 'commit', sha: commit }, deadlineSeconds: shardDeadline,
           ...gateHostMirror(pod),
           ...(multiHost ? { statusUnreadableMs: memberUnreadableSeconds * 1000 } : {}),
           ...(bunCache ? { bunCache } : {}),
@@ -1935,6 +2211,31 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (job.exitCode !== 0) captureFailure();
         batchArtifactDir = job.artifactsDir;
         const read = readShardArtifacts(job.artifactsDir, parts);
+        if (logDir) {
+          mkdirSync(logDir, { recursive: true });
+          let retryArtifactIndex = 0;
+          const retryEvidence = parts.flatMap((files, partIndex) => {
+            const path = join(job.artifactsDir, `part-${partIndex}.retry-files`);
+            if (!existsSync(path)) return [];
+            const retryFiles = readFileSync(path, 'utf8').split(/\r?\n/).filter((file) => file && files.includes(file));
+            return retryFiles.map((file, retryIndex) => {
+              const prefix = `part-${partIndex}.retry-${retryIndex}`;
+              const persisted: Record<string, unknown> = { file, started: existsSync(join(job.artifactsDir, `${prefix}.started`)), rc: existsSync(join(job.artifactsDir, `${prefix}.rc`))
+                ? readFileSync(join(job.artifactsDir, `${prefix}.rc`), 'utf8').trim() : null };
+              for (const suffix of ['log', 'junit.xml'] as const) {
+                const source = join(job.artifactsDir, `${prefix}.${suffix}`);
+                if (!existsSync(source)) continue;
+                const targetName = `pod-${shard}${branch}.retry-${retryArtifactIndex}.${suffix}`;
+                copyFileSync(source, join(logDir, targetName)); chmodSync(join(logDir, targetName), 0o600);
+                persisted[suffix === 'log' ? 'log' : 'junit'] = targetName;
+              }
+              retryArtifactIndex++;
+              return persisted;
+            });
+          });
+          if (retryEvidence.length) writeFileSync(join(logDir, `pod-${shard}${branch}.retries.json`), JSON.stringify(retryEvidence, null, 2) + '\n', { mode: 0o600 });
+          else rmSync(join(logDir, `pod-${shard}${branch}.retries.json`), { force: true });
+        }
         batchArtifactsComplete = !batchIsolation || parts.every((_, index) =>
           ['rc', 'log', 'junit.xml'].every((suffix) => existsSync(join(job.artifactsDir, `part-${index}.${suffix}`))));
         const stagesPath = join(job.artifactsDir, 'stages.tsv');
@@ -1949,6 +2250,8 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           }
         }
         stamp('artifactsRead');
+        shardLoadFlaky = read.loadFlaky ?? [];
+        shardLoadFlakyAttemptedFiles = read.loadFlakyAttemptedFiles ?? [];
         ({ output, junit, rc, timedOut, finished, unfinishedLog, exitCodeOnly } = read);
         // A stall counts only when the Job also left no verdict (a failed stop can let a late shard finish after all).
         const stalledAt = watch?.stalled();
@@ -2001,6 +2304,8 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         if (unfinishedLog !== undefined) writeFileSync(unfinishedDestination, unfinishedLog, { mode: 0o600 });
         else rmSync(unfinishedDestination, { force: true });
         writeFileSync(join(logDir, `pod-${shard}${branch}.json`), JSON.stringify({ completed: true, jobName: jobNameForCapture, durationMs, rc: rc ?? null,
+          ...(shardLoadFlakyAttemptedFiles.length ? { samePodRetryFiles: shardLoadFlakyAttemptedFiles } : {}),
+          ...(shardLoadFlaky.length ? { loadFlaky: shardLoadFlaky } : {}),
           ...(stall ? { reason: 'stall', finishedFiles: 0, stallSeconds: stall.seconds, sinceCheckoutMs: stall.sinceCheckoutMs } : timedOut ? { reason: 'timeout', finishedFiles: finished.length } : {}), files: paths, plannedSeconds: estimated(paths), deadlineSeconds: shardDeadline, shardCount: shards.length, sweepId, commit, runKey, attemptId, ...(parentAttempt ? { parentAttempt } : {}), jobExitCode: jobExitCode ?? null, jobFailed, ...(placedOn ? { host: placedOn } : {}),
           ...(Object.keys(phaseTimes).length ? { phaseTimes } : {}), ...(podStages ? { podStages } : {}),
           ...(podLifecycle && Object.keys(podLifecycle).length ? { podLifecycle } : {}),
@@ -2029,6 +2334,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
         }
       }
       const installSeconds = parseInstallSeconds(output ?? '');
+      if (imageDigest) detailsById.set(`pod-${shard}${branch}`, { ...(detailsById.get(`pod-${shard}${branch}`) ?? {}), imageDigest });
       // GATE-TIMEOUT-HEAL ③: a cut shard is «reason: timeout» (with the files that still finished), not a bare rc=null.
       if (!reused && !descent) debug.log('release-loop.gate', 'pod-shard', { shard, files: paths, durationMs, rc: rc ?? null, attempt: depth + 1, installSeconds, gateDeps: parseGateDeps(output ?? ''), deadlineSeconds: shardDeadline, parts: parts.length, ...(placedOn ? { host: placedOn } : {}),
         ...(testSeconds !== undefined ? { testSeconds } : {}),
@@ -2037,7 +2343,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       // only for a Job that came back (a launch that failed before the Job returned has no Pod to describe).
       if (!reused && !descent && podJobName !== undefined) emitPodLifecycle(gatePodLifecycleEvent({ runId: process.env.ELANOUS_RUN_ID ?? null, podJob: podJobName, host: placedOn ?? null,
         shard: `pod-${shard}${branch}`, attemptId, phaseTimes, podStages, podLifecycle, outcome: gatePodOutcome({ jobFailed, stalled: !!stall, timedOut, rc }) }));
-      if (!reused && !descent) markShard(shard, { ...(installSeconds !== null ? { installSec: installSeconds } : {}), ...(rc !== undefined ? { rc } : {}), ...(timedOut ? { state: 'timeout' as const } : {}) });
+      if (!reused && !descent) markShard(shard, { ...(installSeconds !== null ? { installSec: installSeconds } : {}), ...(rc !== undefined ? { rc } : {}), ...(timedOut ? { state: 'timeout' as const } : {}) }, [], branch);
       let clean = output?.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
       const ran = clean && lastMatch(clean, /Ran (\d+) tests? across (\d+) files?/);
       const passes = clean === undefined ? NaN : summaryCount(clean, 'pass');
@@ -2103,6 +2409,22 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       // 137 (killed · OOM) keeps the isolation path: re-running an OOM file only re-measures the same kill.
       const diedBeforeTests = reason === 'job-failed' && output === undefined && !jobFailed && jobExitCode !== undefined && jobExitCode !== 0
         && jobExitCode !== 137 && (paths.length === 1 || jobExitCode === 5);
+      // A watched stall in a multi-file Job has already spent its first deadline. Measure each file on its own
+      // under the sweep-wide isolation permit pool instead of paying for another whole-bundle Job and split tree.
+      // The same descent is replayed after a cut resume when the parent and first child records are attributed.
+      if (reason === 'no-output' && paths.length > 1 && !singleShotTail && (stall || descent === 'file-fanout')) {
+        const count = Math.min(paths.length, isolationRemaining[shard]!);
+        isolationRemaining[shard]! -= count;
+        debug.log('release-loop.gate', 'pod-stall-file-fanout', { shard, branch, files: paths.length, launched: count,
+          resumed: descent === 'file-fanout', limit: isolationConcurrency });
+        const children = await Promise.all(paths.slice(0, count).map((file, index) => isolatedFile(() =>
+          runShard([file], shard, depth + 1, `${branch}-file-${index}`, false, undefined, attemptId))));
+        return { runs: children.flatMap((child) => child.runs), stalled: [
+          ...children.flatMap((child) => child.stalled),
+          ...(paths.length > count ? [{ shard, files: paths.slice(count), reason: 'no-output' as const,
+            ...(placedOn ? { lastHost: placedOn } : {}) }] : []),
+        ] };
+      }
       if ((reason === 'no-output' || diedBeforeTests) && !retriedNoOutput) {
         const retry = await runShard(paths, shard, depth, `${branch}-retry`, true, undefined, attemptId, hostRetries, batchIsolation, skipMembers);
         debug.log('release-loop.gate', 'pod-shard-retry', { shard, files: paths, reason, outcome: retry.stalled[0]?.reason ?? 'ok' });
@@ -2231,11 +2553,33 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       if (reused) debug.log('release-loop.gate', 'pod-shard-resumed', { shard, branch, files: paths.length, rc, durationMs: reused.durationMs ?? null });
       return { runs: [{ output: clean!, rc: rc!, pass: passes, fail: fails,
         errors: Number.isNaN(errors) ? 0 : errors,
-        ran: Number(ran![1]), files: Number(ran![2]), passedIds: junit ? junitPassedIds(junit) : [] }], stalled: [] };
+        ran: Number(ran![1]), files: Number(ran![2]), passedIds: junit ? junitPassedIds(junit) : [],
+        ...(shardLoadFlaky.length ? { loadFlaky: shardLoadFlaky } : {}),
+        ...(shardLoadFlakyAttemptedFiles.length ? { loadFlakyAttemptedFiles: shardLoadFlakyAttemptedFiles } : {}) }], stalled: [] };
+    };
+    const runShard = async (...args: Parameters<typeof runShardImpl>): ReturnType<typeof runShardImpl> => {
+      const [paths, shard, depth = 0, branch = '', , , parentAttempt, hostRetries = 0] = args;
+      filesById.set(`pod-${shard}${branch}`, [...paths]);
+      if (branch || depth > 0 || parentAttempt !== undefined || hostRetries > 0) {
+        resetShardAttempt(shard, branch, Math.round(estimated(paths) / 6) / 10);
+      }
+      try {
+        const done = await runShardImpl(...args);
+        if (branch) markShard(shard, { state: !done.stalled.length ? 'done' : done.stalled.some((stall) => stall.reason === 'timeout') ? 'timeout' : 'failed', endedAt: new Date().toISOString() }, ['waitReason'], branch);
+        if (branch) recordShardResult(`pod-${shard}${branch}`, done);
+        return done;
+      } catch (error) {
+        if (branch) markShard(shard, { state: 'failed', endedAt: new Date().toISOString() }, ['waitReason'], branch);
+        throw error;
+      }
     };
     // 모든 조각이 끝난 뒤 판정한다 — 한 조각의 예외로 먼저 돌아가면 다른 Pod 가 도는 채로 정리가 시작된다(#22002 리뷰 R3).
     // GATE-RISK-LANE — the risk shard's own wall time (planned vs measured in its log line); it never changes a verdict.
     const shardDurations: number[] = [];
+    // Keep root shards outside the timed Pod admission until a gate slot is available.
+    // Otherwise a wide sweep starts every admission clock together and later waves expire before placement.
+    const withRootSlot = createGateRootLimiter(rootSlots);
+    debug.log('release-loop.gate', 'pod-root-concurrency', { limit: rootSlots, shards: shards.length });
     let settled: Array<PromiseSettledResult<Awaited<ReturnType<typeof runShard>>>>;
     if (shardsFile) {
       reconcileTimer = setInterval(reconcileTick, 30_000);
@@ -2245,10 +2589,59 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       settled = await Promise.allSettled(shards.map(async (item, shard) => {
         const shardStartedAt = clock();
         try {
-          const done = await runShard(item.files, shard);
+          const shardId = `pod-${shard}`;
+          const expected = hostPlan[shard]?.kind === 'reuse' ? receiptChecks[shard]?.result : null;
+          if (expected) {
+            const done = { runs: expected.runs, stalled: [] };
+            shardDurations[shard] = 0;
+            detailsById.set(shardId, { ...(detailsById.get(shardId) ?? {}), imageDigest: expected.receipt.envKey.slice(envFingerprint!.length + 1) });
+            markShard(shard, { state: 'done', rc: done.runs.some((run) => run.fail || run.errors) ? 1 : 0,
+              startedAt: expected.receipt.measuredAt, endedAt: new Date().toISOString(), host: expected.receipt.host }, ['waitReason']);
+            recordShardResult(shardId, done);
+            debug.log('release-loop.gate', 'shard-receipt-reused', { shard: shardId, host: expected.receipt.host, files: item.files.length });
+            return done;
+          }
+          debug.log('release-loop.gate', 'shard-receipt-not-reused', { shard: shardId,
+            reason: pod.rerouteShard === shardId ? 'reroute-requested'
+              : receiptChecks[shard]?.result && pod.rerouteShard === 'auto' ? 'auto-reroute'
+                : receiptChecks[shard]?.result ? 'dispatch-remeasure-required'
+                  : receiptChecks[shard]?.reason ?? 'receipt-unavailable',
+            plan: hostPlan[shard]?.kind ?? 'none' });
+          const receiptAttempt = receiptRoot ? nextGateShardAttempt(receiptRoot, shardId) : 1;
+          if (receiptRoot && base40 && envFingerprint) {
+            try {
+              markGateShardUnmeasured(receiptRoot, { id: shardId, files: [...item.files], head40: commit, base40,
+                host: 'pending', envKey: `${envFingerprint}:${expectedImageDigest ?? 'unmeasured'}`, status: 'unmeasured',
+                failureIds: [], errorIds: [], evidencePath: 'pending', evidenceSha256: '0'.repeat(64),
+                measuredAt: new Date().toISOString(), attempt: receiptAttempt });
+            } catch (error) {
+              debug.log('release-loop.gate', 'shard-receipt-invalidate-failed', { shard: shardId, error: String(error) }, { level: 'warn' });
+              throw error;
+            }
+          }
+          // A missing or deliberately replaced receipt must execute a new Job. The older log-only resume
+          // has no base/environment/image binding and cannot authorize this cross-host measurement.
+          // The sixth runShardImpl argument is `fresh`: a missing receipt must launch a new Job.
+          const freshForReceipt = !!receiptRoot || pod.freshShards === true;
+          const done = await withRootSlot(() => runShard(item.files, shard, 0, '', false, freshForReceipt));
           shardDurations[shard] = clock() - shardStartedAt;
           const state = !done.stalled.length ? 'done' as const : done.stalled.some((stall) => stall.reason === 'timeout') ? 'timeout' as const : 'failed' as const;
-          markShard(shard, { state, endedAt: new Date().toISOString() }, ['waitReason']);
+          markShard(shard, { state, rc: done.stalled.length || done.runs.some((run) => run.fail || run.errors) ? 1 : 0, endedAt: new Date().toISOString() }, ['waitReason']);
+          recordShardResult(`pod-${shard}`, done);
+          if (receiptRoot && base40 && envFingerprint && !done.stalled.length) {
+            const imageDigest = detailsById.get(shardId)?.imageDigest;
+            const attribution = detailsById.get(shardId)?.attribution;
+            const row = board[shard];
+            if (imageDigest && row?.host && attribution === 'complete') {
+              try {
+                saveGateShardResult(receiptRoot, { receipt: { id: shardId, files: [...item.files], head40: commit, base40,
+                  host: row.host, envKey: `${envFingerprint}:${imageDigest}`, status: 'complete',
+                  failureIds: detailsById.get(shardId)?.failureIds ?? [], errorIds: detailsById.get(shardId)?.errorIds ?? [],
+                  evidencePath: 'pending', evidenceSha256: '0'.repeat(64), measuredAt: new Date().toISOString(),
+                  attempt: receiptAttempt }, runs: done.runs });
+              } catch (error) { debug.log('release-loop.gate', 'shard-receipt-write-failed', { shard: shardId, error: String(error) }, { level: 'warn' }); }
+            }
+          }
           return done;
         } catch (error) {
           markShard(shard, { state: 'failed', endedAt: new Date().toISOString() }, ['waitReason']);
@@ -2274,6 +2667,8 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     // GATE-STALLED-TAIL-REMEASURE: after the sweep, give only a one-file no-output leaf one fresh attempt on a different
     // pool member. Keep the original unmeasured evidence if no alternate is available or the remeasure is incomplete.
     const remainingStalls: typeof stalledShards = [];
+    const tailTouched = new Set<number>();
+    const tailRc = new Map<number, number>();
     for (const stalled of stalledShards) {
       const alternatives = stalled.lastHost
         ? poolScheduler.members.filter((member) => member.context !== stalled.lastHost && !downMembers.has(member.context))
@@ -2284,6 +2679,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       }
       debug.log('release-loop.gate', 'pod-stalled-tail-remeasure-start', { shard: stalled.shard, file: stalled.files[0], fromHost: stalled.lastHost,
         availableHosts: alternatives.map((member) => member.context) });
+      tailTouched.add(stalled.shard);
       try {
         tailPlacedHost = undefined;
         const tail = await runShard(stalled.files, stalled.shard, 0, '-tail', true, true, undefined, 0, false, new Set([stalled.lastHost]), true);
@@ -2296,6 +2692,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
             fromHost: stalled.lastHost, toHost: unresolved.lastHost ?? null, reason: unresolved.reason }, { level: 'warn' });
         } else {
           measured.push(...tail.runs);
+          tailRc.set(stalled.shard, tail.runs.some((run) => run.fail || run.errors) ? 1 : 0);
           debug.log('release-loop.gate', 'pod-stalled-tail-remeasure-complete', { shard: stalled.shard, file: stalled.files[0],
             fromHost: stalled.lastHost, toHost: tailPlacedHost ?? null });
         }
@@ -2306,6 +2703,10 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       }
     }
     stalledShards = remainingStalls;
+    for (const shard of tailTouched) {
+      const unresolved = stalledShards.some((item) => item.shard === shard);
+      markShard(shard, { state: unresolved ? 'failed' : 'done', rc: unresolved ? 1 : tailRc.get(shard) ?? 0, endedAt: new Date().toISOString() }, ['waitReason']);
+    }
     const total = measured.reduce((sum, run) => ({ pass: sum.pass + run.pass, fail: sum.fail + run.fail,
       errors: sum.errors + run.errors, ran: sum.ran + run.ran, files: sum.files + run.files }),
     { pass: 0, fail: 0, errors: 0, ran: 0, files: 0 });
@@ -2324,6 +2725,10 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     return { rc: total.fail + total.errors ? 1 : 0, output: outputs.join('\n') + `\n${total.pass} pass\n${total.fail} fail\n${total.errors} errors\nRan ${total.ran} tests across ${total.files} files.\n`, validatedShards: true,
       podSweep: { id: sweepId, shards: shards.length, files: assignable },
       passedIds: [...new Set(measured.flatMap((run) => run.passedIds))].sort(),
+      ...(measured.some((run) => run.loadFlaky?.length)
+        ? { loadFlaky: [...new Set(measured.flatMap((run) => run.loadFlaky ?? []))].sort() } : {}),
+      ...(measured.some((run) => run.loadFlakyAttemptedFiles?.length)
+        ? { loadFlakyAttemptedFiles: [...new Set(measured.flatMap((run) => run.loadFlakyAttemptedFiles ?? []))].sort() } : {}),
       stalledEnv: stalledShards.flatMap((item) => item.files.map((file) => ({ file, reason: 'no-output' as const }))),
       ...(abortedShards ? { abortedShards } : {}),
       ...(riskLane ? { riskLane } : {}) };
@@ -2819,6 +3224,11 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       existsSync(join(root, 'release', opts.version, 'rehearsal', `${step}.json`)));
     const currentImage = !explicitPartial && opts.graphRunId && opts.pod && rehearsalStampPresent
       ? imageProbe(opts.pod.pool) : null;
+    const receiptImage = currentImage ?? (opts.graphRunId && opts.pod && process.env.ELANOUS_GRAPH_CONTEXT
+      ? imageProbe(opts.pod.pool) : null);
+    const receiptBase = opts.baselineCommit ?? (opts.baselineVersion && roots.some((location) =>
+      existsSync(join(location, 'release', opts.baselineVersion!, 'release.json')))
+      ? baselineReleaseCommit(opts.baselineVersion) : undefined);
     const radius = !explicitPartial && opts.graphRunId && opts.pod && rehearsalStampPresent
       ? planHardRehearsalRadius({ root, repo, version: opts.version, forCommit: opts.commit,
         graphPins: gateGraphPins(root, opts.graphRunId), envFingerprint: gateEnvFingerprint(process.env), imageDigest: currentImage })
@@ -2879,8 +3289,12 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
         // the cut sweep puts those files first, the baseline sweep keeps its plan.
         riskWatch: { instanceRoots: roots, ledgerRoots: roots },
         // GATE-LIVE-OBS: the release ledger's shards.json (UX #24782) — never the run tree's universe; an explicit
-        // --ledger-root (tests) keeps it in that ledger.
-        shardsFile: { path: opts.ledgerRoot ? gateShardsPath(opts.version, opts.ledgerRoot) : gateShardsPath(opts.version), version: opts.version } } : undefined,
+        // --ledger-root or an explicit test instance keeps it in that ledger.
+        shardsFile: { path: gateShardsPath(opts.version, ledger), version: opts.version,
+          ledgerPath: gateShardLedgerPath(opts.version, ledger), envFingerprint: gateEnvFingerprint(process.env),
+          receiptRoot: join(ledger, 'release', opts.version, 'gate-logs', 'cut', 'receipts'),
+          base40: receiptBase,
+          expectedImageDigest: receiptImage } } : undefined,
       selected?.files);
     let cutRun = await runCut(partial);
     const radiusSelectionMatched = partial?.files && cutRun?.podSweep?.files
@@ -2945,7 +3359,45 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       debug.log('release-loop.gate', 'pod-shard-stalled-env', { files: stalled.map(({ file, reason }) => ({ file, reason })), local });
       return measured;
     };
-    const measuredCut = cutRun ? await localStalled(cutRun, cutTree, opts.commit, 'cut') : { failures: [], errors: [] };
+    let measuredCut: SweepFailures;
+    try {
+      measuredCut = cutRun ? await localStalled(cutRun, cutTree, opts.commit, 'cut') : { failures: [], errors: [] };
+    } catch (error) {
+      if (!(error instanceof GateFailureAttributionMismatch) || error.label !== 'cut sweep') throw error;
+      const targetFiles = [...new Set(error.failures.map(fileOf))].sort();
+      const attribution = { summary: error.summary, observed: error.observed, identified: error.identified,
+        collapsed: error.collapsed, targetFiles,
+        baselineResult: 'failed' as 'completed' | 'failed' | 'timeout' };
+      result.attributionRecheck = attribution;
+      debug.log('release-loop.gate', 'failure-attribution-baseline-recheck', { ...attribution, phase: 'started' });
+      try {
+        if (!targetFiles.length || targetFiles.length > GATE_ATTRIBUTION_RECHECK_FILE_LIMIT)
+          throw new Error(`baseline recheck target count ${targetFiles.length} outside safe bound 1..${GATE_ATTRIBUTION_RECHECK_FILE_LIMIT}`);
+        if (!work) throw new Error('gate workspace missing before baseline attribution recheck');
+        const recheckTree = join(work, 'baseline-attribution-recheck');
+        trees.push(recheckTree);
+        const baseShaForRecheck = opts.baselineCommit ?? baselineReleaseCommit(opts.baselineVersion);
+        await runner.add(recheckTree, baseShaForRecheck);
+        for (const dir of [recheckTree, join(recheckTree, 'apps/pwa')])
+          check(await runner.command('bun', ['install'], dir), `bun install ${dir}`);
+        const rechecked = await runner.sweep(recheckTree,
+          join(root, 'release', opts.version, 'gate-logs', 'baseline-attribution-recheck'),
+          opts.pod ? { ...opts.pod, durationSource } : undefined,
+          targetFiles);
+        if (rechecked.timedOut || rechecked.abortedShards || rechecked.stalledEnv?.length) {
+          attribution.baselineResult = 'timeout';
+          throw new Error('baseline sweep timed out or stalled');
+        }
+        failuresOf(rechecked, 'baseline attribution recheck');
+        attribution.baselineResult = 'completed';
+      } catch (recheckError) {
+        debug.log('release-loop.gate', 'failure-attribution-baseline-recheck', { ...attribution, phase: 'failed', error: String(recheckError) });
+        throw new Error(`baseline recheck ${attribution.baselineResult}; cut attribution unresolved (summary=${attribution.summary}, identified=${attribution.identified})`);
+      }
+      debug.log('release-loop.gate', 'failure-attribution-baseline-recheck', { ...attribution, phase: 'completed',
+        disposition: 'cut names remain unresolved; baseline success cannot identify unnamed cut failures; fail closed' });
+      throw new Error(`baseline recheck completed; cut attribution still unresolved (summary=${attribution.summary}, identified=${attribution.identified})`);
+    }
     // A between-tests error proves only that the shared process failed. Re-run each affected file by itself using the
     // same isolated path as ordinary new-failure rechecks, even when the error was present in the baseline ledger.
     // Replace that file's shard observations with its isolated observations before the existing regression comparison.
@@ -2986,6 +3438,21 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       }
     }
     const cut = partial ? mergePartialFailures(partial, measuredCut) : measuredCut;
+    const samePodFlaky = [...new Set(cutRun?.loadFlaky ?? [])].sort();
+    if (samePodFlaky.length) {
+      const flaky = new Set(samePodFlaky);
+      cut.failures = cut.failures.filter((id) => !flaky.has(id));
+      cut.errors = cut.errors.filter((id) => !flaky.has(id));
+      result.loadFlaky = [...new Set([...(result.loadFlaky ?? []), ...samePodFlaky])].sort();
+      debug.log('release-loop.gate', 'same-pod-load-flaky', { ids: samePodFlaky, files: [...new Set(samePodFlaky.map(fileOf))].sort() });
+      try {
+        const path = loadFlakyCensusPath(ledger);
+        mkdirSync(dirname(path), { recursive: true });
+        const at = new Date().toISOString();
+        appendFileSync(path, samePodFlaky.map((id) => JSON.stringify({ at, version: opts.version, commit: opts.commit, id,
+          host: opts.pod ? `pod:${opts.pod.pool}` : opts.remote ?? 'local', retry: 'same-pod-standalone' }) + '\n').join(''), { mode: 0o600 });
+      } catch (error) { debug.log('release-loop.gate', 'load-flaky-census-write-failed', { ids: samePodFlaky, error: String(error) }); }
+    }
     if (partial) result.partial = { priorCommit: partial.priorCommit, files: partial.files.length };
     cutFailures = cut;
     const baseSha = opts.baselineCommit ?? baselineReleaseCommit(opts.baselineVersion);
@@ -3129,7 +3596,8 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       // per-test limit, on the same runner (node-b when the gate is remote). Passing there = flaky under load (warning);
       // an assertion failure, a failure again, or a run that cannot be read stays introduced.
       const timedOut = cutCheck === undefined ? new Set<string>() : new Set(parseTimedOutFailures(stripPodRepoRoot(cutCheck.output)));
-      const shaped = candidates.filter((id) => timedOut.has(id) && isolatedCut.failures.includes(id));
+      const samePodRetried = new Set(cutRun?.loadFlakyAttemptedFiles ?? []);
+      const shaped = candidates.filter((id) => timedOut.has(id) && isolatedCut.failures.includes(id) && !samePodRetried.has(fileOf(id)));
       if (shaped.length) {
         const relaxed = opts.pod && runner.recheckPod
           ? await runner.recheckPod(file, opts.commit, { ...opts.pod, warmCutSha: opts.commit, warmBaselineSha: baseSha,
@@ -3348,11 +3816,13 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
       ...(result.interferenceErrors?.length ? { interferenceErrors: [...result.interferenceErrors].sort() } : {}),
     };
     const observed = { ...(result.selectionMs !== undefined ? { selectionMs: result.selectionMs } : {}),
-      ...(result.warmShadow?.length ? { warmShadow: result.warmShadow } : {}) };
+      ...(result.warmShadow?.length ? { warmShadow: result.warmShadow } : {}),
+      ...(result.attributionRecheck ? { attributionRecheck: result.attributionRecheck } : {}) };
     // Receipt is advisory for a later radius gate. Missing identity makes reuse invalid, never this gate's verdict.
     const baselineReceipt = gateBaselineReceipt({ root, version: opts.version, commit: opts.commit,
       graphPins: gateGraphPins(root, opts.graphRunId) ?? (opts.rehearsalBaseline ? gateSourcePins(repo, opts.commit) : null),
       envFingerprint: gateEnvFingerprint(process.env),
+      ...(result.attributionRecheck ? { attributionRecheck: result.attributionRecheck } : {}),
       fullSweep: result.outcome === 'ok' && cutSweepUsable && !result.partial && !!cutFailures
         && !result.rcNonzeroNoFailures.length && !result.stalledShards?.length && !result.stalledEnv.length
         && !result.unmeasuredRecheckFiles?.length && !result.unmeasuredErrors?.length });
@@ -3418,7 +3888,7 @@ export async function judgeGate(opts: GateOptions, runner: GateRunner = createGa
   // GATE-LIVE-OBS-RC-WORDING ⓒ — the shards board says «판정 전» until this lands; then «새 실패 N» only (UX · gate-shards.ts).
   // Same ledger as the board's own writes (sweep's shardsFile). A write failure is logged and never changes the verdict.
   if (result.outcome !== 'error' && opts.pod) {
-    const path = opts.ledgerRoot ? gateShardsPath(opts.version, opts.ledgerRoot) : gateShardsPath(opts.version);
+    const path = gateShardsPath(opts.version, ledger);
     try {
       const written = recordGateShardsVerdict(path, { introduced: result.introduced.length, preexisting: result.preexisting });
       debug.log('release-loop.gate', 'shards-verdict', { version: opts.version, path, written, introduced: result.introduced.length, preexisting: result.preexisting });
@@ -3433,7 +3903,7 @@ export function graphGateResult(result: GateResult, graph: boolean) {
     summary: (result.partial ? `부분 재검 ${result.partial.files}파일(앞 게이트 ${result.partial.priorCommit.slice(0, 9)} 결과 이음) · ` : '')
       + (result.outcome === 'ok' ? `새 회귀 ${result.introduced.length} · 기존 ${result.preexisting} · 고침 ${result.fixed ?? '못 셈(기준선 미루기)'}` : `게이트 ${result.outcome}: ${result.error ?? result.introduced.length + ' new regressions'}`) + ` · 환경 알려진 실패 ${result.knownEnv}`
       + (result.rcNonzeroNoFailures.length ? ` · ⚠ 종료코드만 비영 ${result.rcNonzeroNoFailures.length}` : '')
-      + (result.loadFlaky?.length ? ` · ⚠ 부하 흔들림 ${result.loadFlaky.length}(시간 초과 꼴 · ${GATE_TIMEOUT_RECHECK_MS / 1000}s 재실행 통과 · 막지 않음)` : '')
+      + (result.loadFlaky?.length ? ` · ⚠ 부하 흔들림 ${result.loadFlaky.length}(독립 재실행 통과 · 막지 않음)` : '')
       + (result.stalledEnv.length ? ` · 환경 멈춤 ${result.stalledEnv.length} (Pod 밖 통과 ${result.stalledEnv.filter((item) => item.local === 'passed').length})` : '')
       + (result.abortedShards ? ` · 중단 조각 ${result.abortedShards}(중간 매달림 · 시험만 끊고 재확인)` : '') };
 }
@@ -3483,6 +3953,12 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
   if (fromGraph.gateExecutor !== undefined && !isGateExecutor(fromGraph.gateExecutor)) throw new Error(`gateExecutor must be pod or host: ${String(fromGraph.gateExecutor)}`);
   // GATE-HOST-EXECUTOR: a host gate never reads the pod settings (a bad pod value must not block the fallback executor).
   const hostExecutor = fromGraph.gateExecutor === 'host';
+  const graphCapabilities = fromGraph.gateShardCapabilities;
+  if (!hostExecutor && graphCapabilities !== undefined && (!graphCapabilities || typeof graphCapabilities !== 'object'
+    || Array.isArray(graphCapabilities) || Object.entries(graphCapabilities).some(([id, value]) =>
+      !/^pod-\d+$/.test(id) || !value || typeof value !== 'object' || Array.isArray(value)
+      || !['darwin', 'linux'].includes((value as { os?: string }).os ?? ''))))
+    throw new Error('gateShardCapabilities must map pod-N to {os: darwin|linux}');
   const opts: GateOptions = {
     rehearsalTui: fromGraph.rehearsalTui === true,
     recheckFileLimit: fromGraph.gateRecheckFileLimit !== undefined ? Number(fromGraph.gateRecheckFileLimit) : undefined,
@@ -3504,11 +3980,16 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
       ...(fromGraph.gatePodStallSeconds !== undefined ? { stallSeconds: Number(fromGraph.gatePodStallSeconds) } : {}),
       ...(fromGraph.gatePodMidRunStallSeconds !== undefined ? { midRunStallSeconds: Number(fromGraph.gatePodMidRunStallSeconds) } : {}),
       ...(fromGraph.gatePodFreshShards === true ? { freshShards: true } : {}),
+      ...(typeof fromGraph.gateRerouteShard === 'string' ? { rerouteShard: fromGraph.gateRerouteShard } : {}),
+      ...(typeof fromGraph.gateShardHost === 'string' ? { shardHost: fromGraph.gateShardHost } : {}),
+      ...(graphCapabilities ? { shardCapabilities: graphCapabilities as Record<string, { os: 'darwin' | 'linux' }> } : {}),
       ...((cpu) => cpu ? { cpu } : {})(parsePodCpu(fromGraph.gatePodCpu, 'release.loop.gatePodCpu')),
     } : undefined,
   };
   if (isGateExecutor(fromGraph.gateExecutor)) opts.executor = fromGraph.gateExecutor;
   let freshShards = false;
+  let rerouteShard: string | undefined;
+  let shardHost: string | undefined;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (arg === '--help') return 'help';
@@ -3516,6 +3997,18 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
     if (arg === '--rehearsal-baseline') { opts.rehearsalBaseline = true; continue; }
     // Applied after the loop and only to a Pod gate — on its own it must not turn a local gate into a Pod one (review r5).
     if (arg === '--fresh-shards') { freshShards = true; continue; }
+    if (arg === '--reroute-shard') {
+      const value = args[++i];
+      if (!value || !/^(?:auto|pod-\d+)$/.test(value)) throw new Error('--reroute-shard requires auto or pod-N');
+      rerouteShard = value;
+      continue;
+    }
+    if (arg === '--shard-host') {
+      const value = args[++i];
+      if (!value || value.startsWith('--')) throw new Error('--shard-host requires a pool context');
+      shardHost = value;
+      continue;
+    }
     if (arg === '--rehearsal-tui') { opts.rehearsalTui = true; continue; }
     if (arg === '--recheck-file-limit') {
       const value = args[++i];
@@ -3544,6 +4037,11 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
     else if (key === 'remoteMirror') opts.remoteMirror = value;
   }
   if (freshShards && opts.pod) opts.pod = { ...opts.pod, freshShards: true };
+  if ((rerouteShard || shardHost) && !opts.pod?.pool) throw new Error('shard reroute requires a Pod pool');
+  if (shardHost && !rerouteShard) throw new Error('--shard-host requires --reroute-shard');
+  if (opts.pod && rerouteShard) opts.pod = { ...opts.pod, rerouteShard, ...(shardHost ? { shardHost } : {}) };
+  if (opts.pod?.rerouteShard && !/^(?:auto|pod-\d+)$/.test(opts.pod.rerouteShard)) throw new Error('gateRerouteShard must be auto or pod-N');
+  if (opts.pod?.shardHost && !opts.pod.rerouteShard) throw new Error('gateShardHost requires gateRerouteShard');
   // GATE-HOST-EXECUTOR: the host executor is the existing non-pod sweep on gateRemote — a configured pool must not pull it
   // back into Pods, and without a host it would silently sweep on the runner's own machine.
   if (opts.executor === 'host') {
@@ -3558,10 +4056,13 @@ export function parseOptions(args: string[], env: NodeJS.ProcessEnv): GateOption
 /** The node's run: judge, emit the graph result line, and return the process exit code (ok 0 · regression 1 · else 2).
  *  `runner` is a seam for tests; the process entry passes none. */
 export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner?: GateRunner,
-  judge: (opts: GateOptions, runner?: GateRunner) => Promise<GateResult> = judgeGate): Promise<number> {
+  judge: (opts: GateOptions, runner?: GateRunner, imageProbe?: typeof preflightGateImageDigest) => Promise<GateResult> = judgeGate,
+  imageProbe: typeof preflightGateImageDigest = preflightGateImageDigest): Promise<number> {
   const start = Date.now();
   let result: GateResult;
   let version = '';
+  let graphRunId: string | null = null;
+  let autohealStoreRoot = '';
   let placement: { executor: string | null; host: string | null } | undefined;
   try {
     const parsed = parseOptions(argv, env);
@@ -3576,12 +4077,14 @@ export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner
       debug.log('release-loop.gate', 'executor', { version: opts.version, ...placement, requested: opts.executor ?? null });
     }
     if (opts === 'help') {
-      console.log('Usage: bun scripts/release-loop/gate-node.ts --commit <sha> --version <v> [--baseline-version <prev>] [--baseline-commit <sha>] [--remote <ssh-host>] [--remote-mirror <path>] [--pod-pool <pool>] [--pod-shards <n>] [--pod-shard-timeout-seconds <n>] [--recheck-file-limit <n>] [--fresh-shards] [--executor <pod|host>] [--rehearsal-baseline] [--json]\nWithout flags, input.commit, input.version and input.previousVersion come from the JSON file at ELANOUS_GRAPH_CONTEXT.\n--executor host (input.gateExecutor) ignores every pod option and sweeps on --remote (input.gateRemote, required).\n--rehearsal-baseline pins source graph bytes only for a direct Pod gate on an isolated rc version.');
+      console.log('Usage: bun scripts/release-loop/gate-node.ts --commit <sha> --version <v> [--baseline-version <prev>] [--baseline-commit <sha>] [--remote <ssh-host>] [--remote-mirror <path>] [--pod-pool <pool>] [--pod-shards <n>] [--pod-shard-timeout-seconds <n>] [--recheck-file-limit <n>] [--fresh-shards] [--reroute-shard <pod-N|auto>] [--shard-host <pool-context>] [--executor <pod|host>] [--rehearsal-baseline] [--json]\nWithout flags, input.commit, input.version and input.previousVersion come from the JSON file at ELANOUS_GRAPH_CONTEXT.\n--executor host (input.gateExecutor) ignores every pod option and sweeps on --remote (input.gateRemote, required).\n--rehearsal-baseline pins source graph bytes only for a direct Pod gate on an isolated rc version.');
       return 0;
     }
     version = opts.version;
+    autohealStoreRoot = opts.ledgerRoot ?? releaseLedgerRoot();
     // The graph's existing gate-node execution path delegates verdict classification and persistence here.
     const context = usesGraphContext(argv, env) ? readGraphContext(env) : undefined;
+    graphRunId = context?.runId ?? null;
     // Let the gate's existing SSH host validation report an invalid host before any reservation is published.
     const hosts = opts.remote && !/^(?:[\w.-]+@)?[\w.-]+$/.test(opts.remote) ? [] : reservedGateHosts(opts);
     const reservationRoot = context ? gateHostReservationRoot() : undefined;
@@ -3589,12 +4092,28 @@ export async function runGateNode(argv: string[], env: NodeJS.ProcessEnv, runner
       throw new Error('release gate host reservation requires graph runId and pinned state root');
     const releaseHosts = context && hosts.length
       ? reserveReleaseGateHosts(reservationRoot!, context.runId!, hosts) : () => undefined;
-    try { result = await judge(context?.runId ? { ...opts, graphRunId: context.runId } : opts, runner); }
+    try { result = await judge(context?.runId ? { ...opts, graphRunId: context.runId } : opts, runner, imageProbe); }
     finally { releaseHosts(); }
   } catch (error) {
     result = { outcome: 'error', commit: '', introduced: [], preexisting: 0, fixed: 0, knownEnv: 0, knownEnvCleared: [], stalledEnv: [], rcNonzeroNoFailures: [], durationMs: Date.now() - start, error: String(error) };
     placement ??= requestedGateExecutor(argv, env);
   }
+  if (versionPattern.test(version) && result.stalledShards?.length) {
+    result.autoheals = result.stalledShards.map((shard, index) => {
+      const shardKey = `pod-${shard.shard}`;
+      const signature = createHash('sha256').update(JSON.stringify({ shard: shard.shard,
+        files: [...shard.files].sort(), reason: shard.reason })).digest('hex');
+      const cause = gateAutohealCause({ outcome: result.outcome, introduced: result.introduced, durationMs: result.durationMs,
+        error: result.error, stalledShards: [shard], interferenceErrors: result.interferenceErrors, loadFlaky: result.loadFlaky }) ?? 'environment';
+      const decision = decideAndRecordGateAutoheal({ cause, signature, version, runId: graphRunId ?? 'direct', shardKey,
+        shardKeys: [shardKey], shardElapsedMs: result.durationMs,
+        overallElapsedMs: index === 0 ? result.durationMs : 0,
+        storeRoot: autohealStoreRoot || releaseLedgerRoot() });
+      debug.log('release-loop.gate-autoheal', 'decision', { runId: graphRunId, version, ...decision });
+      return decision;
+    });
+    result.autoheal = result.autoheals.find((decision) => decision.action === 'hitl') ?? result.autoheals[0];
+  }
   if (result.error) console.error(result.error);
   debug.log('release-loop.gate', 'result', { version, outcome: result.outcome, ...(placement ?? {}) });
   emitNodeResult({ ...graphGateResult(result, !!env.ELANOUS_GRAPH_CONTEXT), ...(placement ?? {}) });