elanous 0.2.41 → 0.2.43

package/scripts/release-loop/gate-pod-image-sticky-plan.ts

@@ -0,0 +1,99 @@
+interface StickyGatePool { id?: string | null; available: boolean; imageDigest: string | null }
+interface StickyGateShard { id?: string | null; files?: string[] | null }
+interface StickyGateReceipt { shardId: string; status: 'complete' | 'stalled'; pool?: string | null; imageDigest: string }
+interface StickyGateShardAction {
+  shardId: string; files: string[]; kind: 'reuse' | 'run' | 'unmeasured'; pool?: string; imageDigest?: string;
+}
+interface StickyGatePlan {
+  mode: 'full' | 'partial' | 'HOLD'; pinnedDigest: string | null; excludedPools: string[];
+  shards: StickyGateShardAction[]; reason?: string;
+}
+interface StickyGatePlanInput {
+  phase: 'start' | 'resume'; pools: readonly StickyGatePool[]; shards: readonly StickyGateShard[];
+  pinnedDigest?: string | null; receipts?: readonly StickyGateReceipt[];
+}
+
+const DIGEST = /^sha256:[a-f0-9]{64}$/i;
+const validDigest = (value: string | null | undefined): value is string => typeof value === 'string' && DIGEST.test(value);
+const normalizeDigest = (value: string | null | undefined): string | null => validDigest(value) ? value.toLowerCase() : null;
+const validPoolIdentity = (value: string | null | undefined): value is string => typeof value === 'string' && value.trim().length > 0;
+
+function hold(input: StickyGatePlanInput, pinnedDigest: string | null, reason: string, excludedPools: string[] = []): StickyGatePlan {
+  return { mode: 'HOLD', pinnedDigest, excludedPools, reason,
+    shards: input.shards.map((shard, index) => ({
+      shardId: validPoolIdentity(shard?.id) ? shard.id : `unmeasured-${index}`,
+      files: Array.isArray(shard?.files) ? [...shard.files] : [], kind: 'unmeasured',
+    })) };
+}
+
+function isValidPool(pool: StickyGatePool | null | undefined): pool is StickyGatePool & { id: string } {
+  return !!pool && validPoolIdentity(pool.id);
+}
+
+function isValidShard(shard: StickyGateShard | null | undefined): shard is StickyGateShard & { id: string; files: string[] } {
+  return !!shard && validPoolIdentity(shard.id) && Array.isArray(shard.files) && shard.files.length > 0
+    && shard.files.every((file) => typeof file === 'string') && new Set(shard.files).size === shard.files.length;
+}
+
+/**
+ * Deterministic E4 planning simulation. A production caller must persist the chosen digest at run start
+ * and pass it unchanged on resume; this module itself never runs a host command or pulls an image.
+ */
+export function planStickyGateImages(input: StickyGatePlanInput): StickyGatePlan {
+  if (!input.shards.length || !input.pools.length) return hold(input, null, 'empty pool or shard inventory');
+  const pools = input.pools.filter(isValidPool);
+  const validShards = input.shards.filter(isValidShard);
+  if (pools.length !== input.pools.length || new Set(pools.map((pool) => pool.id)).size !== pools.length
+    || validShards.length !== input.shards.length || new Set(validShards.map((shard) => shard.id)).size !== validShards.length)
+    return hold(input, null, 'invalid pool or shard identity');
+
+  let pinnedDigest: string | null = null;
+  if (input.phase === 'resume') {
+    pinnedDigest = normalizeDigest(input.pinnedDigest);
+    if (!pinnedDigest) return hold(input, null, 'run image digest missing');
+  } else if (input.pinnedDigest !== undefined && input.pinnedDigest !== null) {
+    pinnedDigest = normalizeDigest(input.pinnedDigest);
+    if (!pinnedDigest) return hold(input, null, 'invalid pinned image digest');
+  } else {
+    pinnedDigest = pools.map((pool) => pool.available ? normalizeDigest(pool.imageDigest) : null)
+      .find((digest): digest is string => digest !== null) ?? null;
+    if (!pinnedDigest) return hold(input, null, 'no available pool has a valid image digest');
+  }
+
+  const excludedPools = pools.filter((pool) => !pool.available || normalizeDigest(pool.imageDigest) !== pinnedDigest)
+    .map((pool) => pool.id);
+  const eligiblePools = pools.filter((pool) => pool.available && normalizeDigest(pool.imageDigest) === pinnedDigest);
+  if (!eligiblePools.length) return hold(input, pinnedDigest, 'no available pool has the pinned digest', excludedPools);
+
+  const receipts = input.receipts ?? [];
+  const shardIds = new Set(validShards.map((shard) => shard.id));
+  if (receipts.some((receipt) => !shardIds.has(receipt.shardId))
+    || new Set(receipts.map((receipt) => receipt.shardId)).size !== receipts.length)
+    return hold(input, pinnedDigest, 'receipt inventory does not match the shard plan', excludedPools);
+
+  const receiptByShard = new Map(receipts.map((receipt) => [receipt.shardId, receipt]));
+  const completedReceipts = input.phase === 'resume' ? receipts.filter((receipt) => receipt.status === 'complete') : [];
+  const mismatchedCompleteDigest = completedReceipts.some((receipt) => normalizeDigest(receipt.imageDigest) !== pinnedDigest);
+  const missingCompletePool = completedReceipts.some((receipt) => !validPoolIdentity(receipt.pool));
+  const mixedCompleteReceipt = mismatchedCompleteDigest || missingCompletePool;
+  const fullSweep = input.phase === 'start' || mixedCompleteReceipt
+    || !validShards.some((shard) => receiptByShard.get(shard.id)?.status === 'complete');
+  const mode: StickyGatePlan['mode'] = fullSweep ? 'full' : 'partial';
+  const shards: StickyGateShardAction[] = [];
+  let nextPool = 0;
+  for (const shard of validShards) {
+    const receipt = receiptByShard.get(shard.id);
+    const canReuse = input.phase === 'resume' && !fullSweep && receipt?.status === 'complete'
+      && normalizeDigest(receipt.imageDigest) === pinnedDigest && validPoolIdentity(receipt.pool);
+    if (canReuse) {
+      shards.push({ shardId: shard.id, files: [...shard.files], kind: 'reuse', pool: receipt.pool ?? undefined, imageDigest: pinnedDigest });
+      continue;
+    }
+    const pool = eligiblePools[nextPool++ % eligiblePools.length]!;
+    shards.push({ shardId: shard.id, files: [...shard.files], kind: 'run', pool: pool.id, imageDigest: pinnedDigest });
+  }
+
+  return { mode, pinnedDigest, excludedPools, shards,
+    ...(mixedCompleteReceipt ? { reason: mismatchedCompleteDigest
+      ? 'completed receipts contain a different image digest' : 'completed receipt is missing pool identity' } : {}) };
+}

package/scripts/release-loop/gate-radius-live.ts

@@ -5,9 +5,10 @@ import { join } from 'node:path';
 import { changedFilesBetween, planPartialRegate, testFileOfId, type PartialPlan } from './gate-partial.js';
 import { CODE_FILE, gitClosureTree, testsReachingChanged } from './gate-closure.js';
 import { versionOnlyBumps } from './gate-radius-shadow.js';
-import { gateAssignableTestsAtCommit, gateBaselineReceipt, type GateBaselineReceipt } from './gate-baseline-receipt.js';
-import { parsePodPool, remoteImageId } from '../../src/task-orchestrator/surfaces/pod-pool.js';
+import { gateAssignableTestsAtCommit, gateBaselineReceipt, gateEnvFingerprint, type GateBaselineReceipt, type GatePodRuntimeIdentity } from './gate-baseline-receipt.js';
+import { defaultRemoteRun, NODE_REGISTRY, parsePodPool } from '../../src/task-orchestrator/surfaces/pod-pool.js';
 import { podCommandImageFor } from '../../src/task-orchestrator/surfaces/pod-command-job.js';
+import { gateTestBaseline } from '../lib/gate-test-env.js';
 import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
@@ -27,18 +28,91 @@ export function hardRehearsalGateArgs(version: string, runId: string, commit: st
 
 export interface LiveRadiusDecision { plan: PartialPlan | null; reason: string; rehearsalRunId?: string }
 
-/** Read the image ID on every candidate host before deciding. A later Job must still prove its actual image. */
-export function preflightGateImageDigest(pool: string): string | null {
+export interface GatePodExecutionIdentity extends GatePodRuntimeIdentity { imageDigest: string }
+
+const shellQuote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
+
+/** Registry v2 manifest digest is the identity Kubernetes reports in containerStatuses.imageID. */
+export function parseGateRepoDigestResponse(headers: string): string | null {
+  const match = /^docker-content-digest:\s*(sha256:[0-9a-f]{64})\s*$/im.exec(headers);
+  return match?.[1]?.toLowerCase() ?? null;
+}
+
+export interface GateRepoDigestProbeRequest { url: string; acceptHeader: string; command: string }
+
+export function gateRepoDigestProbeRequest(registry: string, image: string, commit: string): GateRepoDigestProbeRequest | null {
+  const port = /:(\d+)$/.exec(registry)?.[1];
+  if (!port || !SHA.test(commit)) return null;
+  const imageName = image.startsWith('elanous-harness-lite:') ? 'elanous-harness-lite' : 'elanous-harness';
+  const tag = commit.slice(0, 12);
+  const url = `http://localhost:${port}/v2/${imageName}/manifests/${tag}`;
+  const accept = 'application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json';
+  const acceptHeader = `Accept: ${accept}`;
+  return { url, acceptHeader, command: `curl -fsS --max-time 8 -D - -o /dev/null -H ${shellQuote(acceptHeader)} ${shellQuote(url)}` };
+}
+
+function probeGateRepoDigest(member: ReturnType<typeof parsePodPool>[number], image: string, commit: string): string | null {
+  const registry = member.registry ?? NODE_REGISTRY;
+  const request = gateRepoDigestProbeRequest(registry, image, commit);
+  if (!request) return null;
+  const result = member.sshHost
+    ? defaultRemoteRun(member.sshHost, request.command)
+    : spawnSync('curl', ['-fsS', '--max-time', '8', '-D', '-', '-o', '/dev/null', '-H', request.acceptHeader, request.url],
+      { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  return result.status === 0 ? parseGateRepoDigestResponse(result.stdout) : null;
+}
+
+function gateRegistryHostImage(member: ReturnType<typeof parsePodPool>[number], image: string, commit: string): string | null {
+  const registry = member.registry ?? NODE_REGISTRY;
+  const port = /:(\d+)$/.exec(registry)?.[1];
+  if (!port) return null;
+  const imageName = image.startsWith('elanous-harness-lite:') ? 'elanous-harness-lite' : 'elanous-harness';
+  return `localhost:${port}/${imageName}:${commit.slice(0, 12)}`;
+}
+
+/** Read the immutable pushed image manifest on every candidate host. Local Docker Image IDs are diagnostic only. */
+export function preflightGateImageDigest(pool: string, commit?: string): string | null {
+  try {
+    if (!commit || !SHA.test(commit)) return null;
+    const image = podCommandImageFor([], true);
+    const members = parsePodPool(pool);
+    if (!members.length) return null;
+    const digests = members.map((member) => probeGateRepoDigest(member, image, commit));
+    return digests.every((digest) => digest && DIGEST.test(digest) && digest === digests[0]) ? digests[0]! : null;
+  } catch { return null; }
+}
+
+/** Probe each candidate's exact gate image/runtime and deterministic environment without a Kubernetes Job. */
+export function preflightGateExecutionIdentity(pool: string, env: NodeJS.ProcessEnv, commit?: string): GatePodExecutionIdentity | null {
   try {
+    if (!commit || !SHA.test(commit)) return null;
     const image = podCommandImageFor([], true);
     const members = parsePodPool(pool);
     if (!members.length) return null;
-    const ids = members.map((member) => {
-      if (member.sshHost) return remoteImageId(member, image);
-      const result = spawnSync('docker', ['image', 'inspect', image, '--format', '{{.Id}}'], { encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
-      return result.status === 0 ? result.stdout.trim() : null;
+    const baseline = gateTestBaseline(env);
+    const expectedEnvFingerprint = gateEnvFingerprint(env);
+    const script = "const {createHash}=require('node:crypto');const keys=['ELANOUS_TEST_FAKE_LLM','LANG','LC_ALL','TZ'];const e=Object.fromEntries(keys.sort().map(k=>[k,process.env[k]??'']));const envFingerprint=createHash('sha256').update(JSON.stringify(e)).digest('hex');console.log(JSON.stringify({bunVersion:Bun.version,platform:process.platform,architecture:process.arch,envFingerprint}));";
+    const rows = members.map((member): GatePodExecutionIdentity | null => {
+      const imageDigest = probeGateRepoDigest(member, image, commit);
+      if (!imageDigest || !DIGEST.test(imageDigest)) return null;
+      const hostImage = gateRegistryHostImage(member, image, commit);
+      if (!hostImage) return null;
+      const args = ['run', '--rm', '--pull=never', '--network=none', ...Object.entries(baseline).flatMap(([key, value]) => ['-e', `${key}=${value}`]), '--entrypoint', 'bun', hostImage, '-e', script];
+      const result = member.sshHost
+        ? defaultRemoteRun(member.sshHost, `docker ${args.map(shellQuote).join(' ')}`)
+        : spawnSync('docker', args, { encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      if (result.status !== 0) return null;
+      try {
+        const row = JSON.parse(result.stdout.trim()) as Partial<GatePodRuntimeIdentity>;
+        if (typeof row.bunVersion !== 'string' || typeof row.platform !== 'string' || typeof row.architecture !== 'string'
+          || row.envFingerprint !== expectedEnvFingerprint) return null;
+        return { imageDigest, bunVersion: row.bunVersion, platform: row.platform, architecture: row.architecture,
+          envFingerprint: row.envFingerprint };
+      } catch { return null; }
     });
-    return ids.every((id) => id && DIGEST.test(id) && id === ids[0]) ? ids[0]! : null;
+    if (rows.some((row) => row === null)) return null;
+    const first = rows[0]!;
+    return rows.every((row) => JSON.stringify(row) === JSON.stringify(first)) ? first : null;
   } catch { return null; }
 }
 
@@ -82,10 +156,15 @@ export function partialGateImagesMatch(root: string, version: string, digest: st
 /** Every missing or mismatched proof returns a full gate. The caller uses this only when no explicit resume plan exists. */
 export function planHardRehearsalRadius(input: { root: string; repo: string; version: string; forCommit: string;
   graphPins: { graphSha: string; recipeSha: string } | null; envFingerprint: string;
-  imageDigest: string | null }): LiveRadiusDecision {
+  imageDigest: string | null; executionIdentity: GatePodExecutionIdentity | null }): LiveRadiusDecision {
   const full = (reason: string): LiveRadiusDecision => ({ plan: null, reason });
   if (!/^\d+\.\d+\.\d+$/.test(input.version) || !SHA.test(input.forCommit)) return full('invalid release identity');
-  if (!input.graphPins || !/^[0-9a-f]{64}$/i.test(input.envFingerprint) || !input.imageDigest || !DIGEST.test(input.imageDigest))
+  if (!input.graphPins || !/^[0-9a-f]{64}$/i.test(input.envFingerprint) || !input.imageDigest || !DIGEST.test(input.imageDigest)
+    || !input.executionIdentity || input.executionIdentity.imageDigest !== input.imageDigest.toLowerCase()
+    || input.executionIdentity.envFingerprint !== input.envFingerprint
+    || !/^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/.test(input.executionIdentity.bunVersion)
+    || !/^[a-z0-9_-]{1,32}$/.test(input.executionIdentity.platform)
+    || !/^[a-z0-9_-]{1,32}$/.test(input.executionIdentity.architecture))
     return full('current graph, environment or Pod image identity unmeasured');
   try {
     const stamps = ['hard-5h', 'hard-mid'].map((step) => {
@@ -118,14 +197,19 @@ export function planHardRehearsalRadius(input: { root: string; repo: string; ver
       if (verdict.commit !== stamp.sha || verdict.outcome !== 'ok' || failures.commit !== stamp.sha
         || !Array.isArray(failures.failures) || failures.failures.length !== 0
         || !Array.isArray(failures.errors) || failures.errors.length !== 0
-        || !receipt || receipt.schema !== 1 || !receipt.valid || receipt.version !== gateVersion || receipt.commit !== stamp.sha
+        || !receipt || receipt.schema !== 2 || !receipt.valid || receipt.version !== gateVersion || receipt.commit !== stamp.sha
         || receipt.graphSha !== input.graphPins.graphSha || receipt.recipeSha !== input.graphPins.recipeSha
         || receipt.envFingerprint !== input.envFingerprint || receipt.imageDigest !== input.imageDigest.toLowerCase()
+        || !receipt.executionIdentity
+        || JSON.stringify(receipt.executionIdentity) !== JSON.stringify({ bunVersion: input.executionIdentity.bunVersion,
+          platform: input.executionIdentity.platform, architecture: input.executionIdentity.architecture,
+          envFingerprint: input.executionIdentity.envFingerprint })
         || !Number.isSafeInteger(receipt.files) || receipt.files < 1 || !Number.isSafeInteger(receipt.shards) || receipt.shards < 1)
         return full('hard rehearsal receipt or current execution identity differs');
       const recomputed = gateBaselineReceipt({ root: input.root, version: gateVersion, commit: stamp.sha,
         fullSweep: true, graphPins: input.graphPins, envFingerprint: input.envFingerprint });
-      if (!recomputed.valid || recomputed.imageDigest !== receipt.imageDigest || recomputed.files !== receipt.files
+      if (!recomputed.valid || recomputed.imageDigest !== receipt.imageDigest
+        || JSON.stringify(recomputed.executionIdentity) !== JSON.stringify(receipt.executionIdentity) || recomputed.files !== receipt.files
         || recomputed.shards !== receipt.shards) return full(`hard rehearsal Pod proof differs: ${recomputed.reason}`);
       const ancestor = spawnSync('git', ['merge-base', '--is-ancestor', stamp.sha, input.forCommit], { cwd: input.repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
       if (ancestor.status !== 0 || ancestor.error) return full('hard rehearsal commit is not an ancestor');

package/scripts/release-loop/gate-shard-dispatch.ts

@@ -29,6 +29,49 @@ export interface GateShardHost {
   reserved: boolean;
 }
 
+export type GateProgressState = 'pending' | 'running' | 'done' | 'failed' | 'timeout' | 'unmeasured';
+
+/** A host group or planned Pod shard as seen by the release gate's live progress observer. */
+export interface GateProgressGroup {
+  id: string;
+  state: GateProgressState;
+  host?: string;
+  startedAtMs?: number;
+  endedAtMs?: number;
+}
+
+export interface GateProgressSummary {
+  executor: 'host' | 'pod';
+  host: string | null;
+  completed: number;
+  total: number;
+  failed: number;
+  groups: Array<{ id: string; state: GateProgressState; host: string | null; elapsedMs: number | null }>;
+}
+
+/** Keep the progress event shape identical for serial host groups and parallel Pod shards. */
+export function summarizeGateProgress(input: {
+  executor: 'host' | 'pod';
+  groups: readonly GateProgressGroup[];
+  nowMs: number;
+}): GateProgressSummary {
+  const terminal = new Set<GateProgressState>(['done', 'failed', 'timeout', 'unmeasured']);
+  const hosts = [...new Set(input.groups.flatMap((group) => group.host?.trim() ? [group.host.trim()] : []))].sort();
+  return {
+    executor: input.executor,
+    host: hosts.length ? hosts.join(',') : null,
+    completed: input.groups.filter((group) => terminal.has(group.state)).length,
+    total: input.groups.length,
+    failed: input.groups.filter((group) => group.state === 'failed' || group.state === 'timeout').length,
+    groups: input.groups.map((group) => {
+      const end = group.endedAtMs ?? input.nowMs;
+      const elapsedMs = Number.isFinite(group.startedAtMs) && Number.isFinite(end)
+        ? Math.max(0, end - group.startedAtMs!) : null;
+      return { id: group.id, state: group.state, host: group.host?.trim() || null, elapsedMs };
+    }),
+  };
+}
+
 export interface GateShardDispatchInput {
   head40: string;
   base40: string;

package/scripts/release-loop/gate-traffic-mode.ts

@@ -1,11 +1,18 @@
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 
-type TrafficBoard = Record<string, unknown> & { global: string };
+type TrafficBoard = Record<string, unknown> & { global: string; seats?: Record<string, Record<string, unknown>> };
 type PatchResult = { changed: true; previous: string; warning?: string } | { changed: false; current: string };
+type PwaSnapshot = { reason: unknown; hadReason: boolean; updatedAt: unknown; hadUpdatedAt: boolean; activeUpdatedAt: string;
+  heavyLocalBan: unknown; hadHeavyLocalBan: boolean;
+  perCycle: Record<string, { value: unknown; hadValue: boolean }> };
+type PwaPatchResult = { changed: true; previous: PwaSnapshot; warning?: string };
+const RELEASE_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+const PWA_PER_CYCLE = 3;
+const MAX_PWA_TRAFFIC_BACKUPS_PER_KIND = 10;
 
 const defaultTrafficPath = () => join(homedir(), 'elanous-hq', 'seat-state', 'OP', 'traffic.json');
 const trafficPath = (env: NodeJS.ProcessEnv) => env.ELANOUS_TRAFFIC_SIGNAL || defaultTrafficPath();
@@ -21,6 +28,17 @@ function releaseGateContext(env: NodeJS.ProcessEnv): boolean {
   }
 }
 
+function releasePwaContext(env: NodeJS.ProcessEnv): boolean {
+  const source = env.ELANOUS_GRAPH_CONTEXT;
+  if (!source) return false;
+  try {
+    const raw = JSON.parse(source.trimStart().startsWith('{') ? source : readFileSync(source, 'utf8')) as Record<string, unknown>;
+    return raw.graphId === 'release-loop' && raw.nodeId === 'pwa';
+  } catch {
+    return false;
+  }
+}
+
 function withTrafficLock<T>(path: string, action: () => T): T {
   const lock = `${path}.lock.d`;
   const deadline = Date.now() + 10_000;
@@ -86,6 +104,136 @@ function patchGlobal(path: string, next: string, reason: string, onlyIf?: string
   });
 }
 
+function writeTrafficBoard(path: string, after: TrafficBoard, suffix: string): void {
+  const at = new Date();
+  const stamp = [at.getMonth() + 1, at.getDate(), at.getHours(), at.getMinutes(), at.getSeconds()].map(value => String(value).padStart(2, '0')).join('');
+  writeFileSync(`${path}.bak-${stamp}-${randomUUID().slice(0, 8)}-${suffix}`, readFileSync(path));
+  const temp = `${path}.tmp.${process.pid}.${randomUUID()}`;
+  try {
+    writeFileSync(temp, `${JSON.stringify(after, null, 2)}\n`, { mode: statSync(path).mode & 0o777 });
+    renameSync(temp, path);
+  } finally { rmSync(temp, { force: true }); }
+  // Re-read after the atomic rename so a malformed write is visible to the caller.
+  JSON.parse(readFileSync(path, 'utf8')) as TrafficBoard;
+  if (suffix.startsWith('release-pwa-')) {
+    try { pruneTrafficBackups(path, suffix); }
+    catch (error) { debug.log('release-loop.pwa', 'traffic backup pruning failed', { path, suffix, error: String(error) }, { level: 'warn' }); }
+  }
+}
+
+function pruneTrafficBackups(path: string, suffix: string): void {
+  const directory = dirname(path);
+  const prefix = `${basename(path)}.bak-`;
+  const backups = readdirSync(directory)
+    .filter(name => name.startsWith(prefix) && name.endsWith(`-${suffix}`))
+    .map(name => ({ path: join(directory, name), modifiedAt: statSync(join(directory, name)).mtimeMs }))
+    .sort((a, b) => a.modifiedAt - b.modifiedAt);
+  for (const backup of backups.slice(0, Math.max(0, backups.length - MAX_PWA_TRAFFIC_BACKUPS_PER_KIND))) {
+    rmSync(backup.path, { force: true });
+  }
+}
+
+function patchPwaTraffic(path: string): PwaPatchResult {
+  return withTrafficLock(path, () => {
+    if (!existsSync(path)) throw new Error(`traffic board missing: ${path}`);
+    const board = JSON.parse(readFileSync(path, 'utf8')) as TrafficBoard;
+    if (!board || typeof board !== 'object' || Array.isArray(board) || typeof board.global !== 'string'
+      || !board.seats || typeof board.seats !== 'object' || Array.isArray(board.seats)
+      || !RELEASE_SEATS.every(seat => board.seats![seat] && typeof board.seats![seat] === 'object' && !Array.isArray(board.seats![seat]))) {
+      throw new Error(`invalid traffic board for PWA policy: ${path}`);
+    }
+    const activeUpdatedAt = new Date().toISOString();
+    const previous: PwaSnapshot = {
+      hadReason: Object.hasOwn(board, 'reason'), reason: board.reason,
+      hadUpdatedAt: Object.hasOwn(board, 'updatedAt'), updatedAt: board.updatedAt, activeUpdatedAt,
+      hadHeavyLocalBan: Object.hasOwn(board, 'heavyLocalBan'), heavyLocalBan: board.heavyLocalBan,
+      perCycle: Object.fromEntries(RELEASE_SEATS.map(seat => [seat, {
+        hadValue: Object.hasOwn(board.seats![seat]!, 'perCycle'), value: board.seats![seat]!.perCycle,
+      }])),
+    };
+    const updated: TrafficBoard = {
+      ...board,
+      ...(board.heavyLocalBan === true ? {} : { reason: 'release PWA node running (heavy-local banned)' }),
+      heavyLocalBan: true,
+      seats: Object.fromEntries(Object.entries(board.seats).map(([seat, value]) => [seat,
+        RELEASE_SEATS.includes(seat as typeof RELEASE_SEATS[number]) ? { ...value, perCycle: PWA_PER_CYCLE } : value])),
+      updatedAt: activeUpdatedAt,
+    };
+    writeTrafficBoard(path, updated, 'release-pwa-policy');
+    return { changed: true, previous };
+  });
+}
+
+function restorePwaTraffic(path: string, previous: PwaSnapshot): { restored: boolean; reason?: string } {
+  return withTrafficLock(path, () => {
+    const board = JSON.parse(readFileSync(path, 'utf8')) as TrafficBoard;
+    if (!board || typeof board !== 'object' || Array.isArray(board) || !board.seats || typeof board.seats !== 'object') {
+      throw new Error(`invalid traffic board while restoring PWA policy: ${path}`);
+    }
+    // If another writer removed/replaced our marker, that writer owns the current policy.
+    if (board.heavyLocalBan !== true) return { restored: false, reason: 'heavyLocalBan-changed' };
+    const seats = { ...board.seats };
+    for (const seat of RELEASE_SEATS) {
+      const current = seats[seat];
+      const snapshot = previous.perCycle[seat];
+      if (!current || current.perCycle !== PWA_PER_CYCLE) continue;
+      const restored = { ...current };
+      if (snapshot?.hadValue) restored.perCycle = snapshot.value;
+      else delete restored.perCycle;
+      seats[seat] = restored;
+    }
+    const updated: TrafficBoard = { ...board, seats };
+    if (previous.hadHeavyLocalBan) updated.heavyLocalBan = previous.heavyLocalBan;
+    else delete updated.heavyLocalBan;
+    if (updated.reason === 'release PWA node running (heavy-local banned)') {
+      if (previous.hadReason) updated.reason = previous.reason;
+      else delete updated.reason;
+    }
+    if (board.updatedAt === previous.activeUpdatedAt) {
+      if (previous.hadUpdatedAt) updated.updatedAt = previous.updatedAt;
+      else delete updated.updatedAt;
+    }
+    writeTrafficBoard(path, updated, 'release-pwa-restore');
+    return { restored: true };
+  });
+}
+
+/** Apply the release PWA node's temporary half-traffic and heavy-local marker, restoring on every exit. */
+export async function runWithReleasePwaTraffic<T>(env: NodeJS.ProcessEnv, run: () => Promise<T>): Promise<T> {
+  if (!releasePwaContext(env)) return run();
+  const path = trafficPath(env);
+  let started: PwaPatchResult;
+  try { started = patchPwaTraffic(path); }
+  catch (error) {
+    debug.log('release-loop.pwa', 'traffic policy set failed', { path, error: String(error) }, { level: 'warn' });
+    throw new Error(`release PWA traffic policy could not be applied: ${String(error)}`, { cause: error });
+  }
+  if (started.warning) debug.log('release-loop.pwa', 'traffic policy verification failed', { path, error: started.warning }, { level: 'warn' });
+  let restoreResult: Promise<void> | undefined;
+  const restoreOnce = () => restoreResult ??= Promise.resolve().then(() => {
+    try {
+      const restored = restorePwaTraffic(path, started.previous);
+      if (!restored.restored) debug.log('release-loop.pwa', 'traffic policy restore skipped', { path, reason: restored.reason }, { level: 'warn' });
+    } catch (error) { debug.log('release-loop.pwa', 'traffic policy restore failed', { path, error: String(error) }, { level: 'warn' }); }
+  });
+  const interrupt = (signal: NodeJS.Signals) => {
+    void restoreOnce().finally(() => {
+      process.removeListener(signal, signal === 'SIGINT' ? onSigint : onSigterm);
+      process.kill(process.pid, signal);
+    });
+  };
+  const onSigint = () => interrupt('SIGINT');
+  const onSigterm = () => interrupt('SIGTERM');
+  process.once('SIGINT', onSigint);
+  process.once('SIGTERM', onSigterm);
+  try { return await run(); }
+  finally {
+    process.removeListener('SIGINT', onSigint);
+    process.removeListener('SIGTERM', onSigterm);
+    await restoreOnce();
+  }
+}
+
 /** Hold dispatcher traffic at gate only for the release-loop's gate node, then restore conditionally. */
 export async function runWithReleaseGateTraffic<T>(env: NodeJS.ProcessEnv, run: () => Promise<T>): Promise<T> {
   if (!releaseGateContext(env)) return run();

package/scripts/release-loop/gate-train-receipts.ts

@@ -0,0 +1,122 @@
+/** Safe test carry from passed host-regate receipts into a release cut. */
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+import { gateAssignableTestsAtCommit } from './gate-baseline-receipt.js';
+import { gitClosureTree, testsReachingChanged } from './gate-closure.js';
+import { changedFilesBetween } from './gate-partial.js';
+import { gateReceiptSelfKey, loadGateReceipts, type GateReceipt } from '../../src/self-implement/gate-receipt-registry.js';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
+
+const SHA = /^[0-9a-f]{40}$/i;
+const TEST = /^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/;
+const INERT = /\.(?:md|mdx|txt)$/i;
+
+function git(repo: string, args: string[]): string | null {
+  const result = spawnSync('git', args, { cwd: repo, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
+  return result.status === 0 && !result.error ? result.stdout.trim() : null;
+}
+
+function ancestor(repo: string, base: string, head: string): boolean {
+  const result = spawnSync('git', ['merge-base', '--is-ancestor', base, head], { cwd: repo, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  return result.status === 0 && !result.error;
+}
+
+function blob(repo: string, commit: string, file: string): string | null {
+  return git(repo, ['rev-parse', `${commit}:${file}`]);
+}
+
+function candidateTests(tree: ReturnType<typeof gitClosureTree>, receipt: GateReceipt): string[] {
+  // The registry stores the changed-file radius, not the expanded importer/neighbor list that the
+  // host gate selected. Only changed test files are certainly in that measurement; never infer
+  // pass evidence for siblings or importers that the receipt did not persist explicitly.
+  return [...new Set(receipt.radiusFiles.filter((file) => TEST.test(file) && tree.files.includes(file)))].sort();
+}
+
+export interface GateTrainReceiptPlan {
+  priorCommit: string;
+  files: string[];
+  carriedFiles: string[];
+  totalFiles: number;
+  reasons: string[];
+  receipts: string[];
+}
+
+/** Missing/invalid evidence only reduces carry; it never makes a gate pass. */
+export function planGateTrainReceiptCarry(input: {
+  repo: string;
+  commit: string;
+  receiptPath: string;
+  bunVersion: string;
+  lockfileHash: string;
+  envFingerprint: string;
+}): GateTrainReceiptPlan | null {
+  if (!SHA.test(input.commit) || !input.bunVersion || !input.lockfileHash || !/^[0-9a-f]{64}$/i.test(input.envFingerprint)) return null;
+  const tests = gateAssignableTestsAtCommit(input.repo, input.commit);
+  if (!tests?.length) return null;
+  const receipts = Object.values(loadGateReceipts(input.receiptPath));
+  const currentTree = gitClosureTree(input.repo, input.commit);
+  const carried = new Set<string>();
+  const accepted: GateReceipt[] = [];
+  const reasons = new Set<string>();
+  const changedByBase = new Map<string, string[]>();
+
+  for (const receipt of receipts) {
+    if (receipt.verdict !== 'passed' || gateReceiptSelfKey(receipt) !== receipt.key) { reasons.add('invalid-or-non-passing receipt'); continue; }
+    if (!receipt.checks.some((check) => check === 'test-interference:with-neighbours' || check === 'test-interference:changed-only')) {
+      reasons.add('receipt lacks passing test-interference check'); continue;
+    }
+    if (receipt.bunVersion !== input.bunVersion || receipt.lockfileHash !== input.lockfileHash
+      || receipt.envFingerprint !== input.envFingerprint) { reasons.add('bun/lockfile/environment differs'); continue; }
+    if (!ancestor(input.repo, receipt.baseCommit, input.commit)) { reasons.add('receipt base is not an ancestor of cut'); continue; }
+    if (receipt.radiusFiles.some((file) => !currentTree.files.includes(file)
+      || blob(input.repo, receipt.headCommit, file) !== blob(input.repo, input.commit, file))) {
+      reasons.add('receipt radius changed or missing at cut'); continue;
+    }
+    let measuredChanges: string[];
+    try { measuredChanges = changedFilesBetween(input.repo, receipt.baseCommit, receipt.headCommit); }
+    catch { reasons.add('receipt base-to-head diff unavailable'); continue; }
+    if (measuredChanges.some((file) => !receipt.radiusFiles.includes(file))) {
+      reasons.add('receipt radius does not cover base-to-head changes'); continue;
+    }
+    const candidates = candidateTests(currentTree, receipt);
+    if (!candidates?.length) { reasons.add('receipt test radius is empty or opaque'); continue; }
+
+    let changed: string[];
+    try {
+      changed = changedByBase.get(receipt.baseCommit) ?? changedFilesBetween(input.repo, receipt.baseCommit, input.commit);
+      changedByBase.set(receipt.baseCommit, changed);
+    } catch { reasons.add('cut diff from receipt base unavailable'); continue; }
+    const outside = changed.filter((file) => !receipt.radiusFiles.includes(file) && !INERT.test(file));
+    const nonCodeOutside = outside.find((file) => !/\.(?:[cm]?[jt]sx?)$/.test(file));
+    if (nonCodeOutside) {
+      reasons.add(`non-code release input changed outside receipt radius: ${nonCodeOutside}`); continue;
+    }
+    let safeCandidates = candidates;
+    if (outside.length) {
+      const affected = testsReachingChanged(currentTree, outside, candidates);
+      if (!affected.ok) { reasons.add('cut import closure opaque'); continue; }
+      const affectedSet = new Set(affected.tests);
+      safeCandidates = candidates.filter((test) => !affectedSet.has(test));
+      if (!safeCandidates.length) { reasons.add('merge-skew changes reach every receipt test'); continue; }
+    }
+    for (const test of safeCandidates) carried.add(test);
+    accepted.push(receipt);
+  }
+
+  const noCarry = (reason: string): GateTrainReceiptPlan => ({ priorCommit: accepted[0]?.baseCommit ?? input.commit,
+    files: [...tests], carriedFiles: [], totalFiles: tests.length,
+    reasons: [...new Set([...reasons, ...(reason === 'no safe receipt coverage' && reasons.size ? [] : [reason])])].sort(),
+    receipts: accepted.map((receipt) => receipt.key).sort() });
+  if (!carried.size || !accepted.length) return noCarry(receipts.length ? 'no safe receipt coverage' : 'gate receipt registry empty');
+  const selected = tests.filter((file) => !carried.has(file));
+  // The caller falls back to a full sweep rather than skipping all test Pods.
+  if (!selected.length) return noCarry('all tests carried; keep at least one measured sweep');
+  const latest = [...accepted].sort((a, b) => b.savedAt.localeCompare(a.savedAt))[0]!;
+  return { priorCommit: latest.baseCommit, files: selected, carriedFiles: [...carried].sort(), totalFiles: tests.length,
+    reasons: [...reasons].sort(), receipts: accepted.map((receipt) => receipt.key).sort() };
+}
+
+export function gateReceiptRegistryPath(repo: string): string | null {
+  const common = git(repo, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+  return common ? join(common, 'elanous-host-regate', 'gate-receipts.json') : null;
+}