[garrytan]

{
  "schema_version": 1,
  "pr": 3483,
  "head": "020bdefb4124f4dcf037a5997396d701d8bedfe6",
  "version": "1.91.255.0",
  "base": "main",
  "gate": {
    "focused-tests": {
      "pass": 363,
      "fail": 0,
      "skip": 0
    },
    "test-free-shards": {
      "pass": 77,
      "fail": 0,
      "skip": 0
    },
    "typecheck": {
      "pass": 1,
      "fail": 0,
      "skip": 0
    },
    "typecheck-test": {
      "pass": 1,
      "fail": 0,
      "skip": 0
    },
    "remote-free-tier": {
      "pass": 10199,
      "fail": 0,
      "skip": 0
    },
    "windows-curation": {
      "pass": 112,
      "fail": 0,
      "skip": 0
    }
  },
  "spend_usd": 0.26,
  "session_kind": "unattended",
  "pregate": "requires-remote cleared @309f4babb16d (1 checks, current for 020bdefb4124)",
  "requires_remote": [
    "free-tests.yml/macos-named-regressions: https://github.com/garrytan/gstack/actions/runs/40400236429",
    "windows-free-tests.yml/windows-free-shard: https://github.com/garrytan/gstack/actions/runs/40400240927",
    "pregate.json/remote_gate: remote-gate tree=309f4babb16d tests=10199"
  ],
  "issues": {
    "fixes": [],
    "refs": [],
    "flakes": []
  }
}

What changed

The weekly release gate and five lane frictions the merge-train coordinator and its lanes hit in operation, each red before green.

The weekly release accepts a commit a green train merged (scripts/release-cut.ts). Trains merge faster than the main backstop settles, so most main commits end with a neutral (superseded) main-backstop check run, and three dry runs of weekly-release.yml returned NO_GREEN_COMMIT for a week of commits every one of which a green train had gated. A first-parent commit is now gated by either a successful backstop check run or a train record in the notes ref (kind train, state green, merging or merged) whose merged[] lists its sha or its tree. Everything else is unchanged: the required check (free-tests) must have succeeded, a red check run (a red backstop included) is red, a running run is skipped, and an active freeze refuses the cut. The CANDIDATE line says gated by main-backstop or gated by train <nonce>. --required-check, --backstop-check and --notes-ref make the names configurable; weekly-release.yml is untouched (defaults). readTrainNotes replaces activeFreeze (one fetch of the notes ref returns the freeze and the train evidence; nothing else imported it).

Lane frictions.

• lib/issue-links.ts: a parenthesised named reference, (name #N[, #M]…), (name PR #N) or (name issue #N), is a cross-repo reference to name (Refs name#N), never a same-repo Refs line or a promotion candidate. (see #12), (fixes #12), (PR #12) and the other reference words stay bare refs.
• lib/gstack-post.ts: an 11-digit GitHub Actions run id right after a run word on the same line (run, screen, gate, backstop, bisect, rerun, dispatched, failed, passed, workflow, job, attempt, id, …, optional :#=), and every id chained after one through , / and / & / or / / (optionally with (#1234) between), is allowlisted against pii.phone.e164; a bare 11-digit number, a 10-digit number and +14155551234 still report.
• gstack-post pr-body merges by ## section into the PR's current body (read through the same runner): a section in the file replaces the same-titled one in place, the ship-receipt block is a section of its own, sections the file does not rewrite are kept byte for byte, new sections are appended. --replace keeps the old overwrite. An unreadable current body posts nothing (exit 3, naming --replace). The scan runs on the merged bytes.
• lib/pregate/index.ts, lib/ship-queue.ts: gstack-pregate mirrors every record it writes to <state root>/pregate/by-tree/<tree>.json (best effort, never fails the record); ready reads the mirror for the current tree when the checkout's .gstack/tmp/pregate.json is missing or was recorded for another tree, uses it only if it verifies, and says (from <mirror>, recorded by another checkout) on the PREGATE line.
• docs/troubleshooting.md: #redact-run-id-as-phone, #gate-error-no-base, #gstack-post-pr-body-merge; docs/releases.md describes both kinds of release evidence; docs/pregate.md the by-tree mirror.

Why

A release that cannot see train evidence never cuts; the lane frictions each cost a coordinator a hand step (a stripped cross-repo ref, a run id confirmation prompt, a PR body overwritten by /ship's section write, a worktree's pregate lost to another checkout).

Screenshots

The weekly release CANDIDATE line now says which evidence gated the commit: a successful main-backstop run or a green train record in refs/notes/gstack-trains (before: NO_GREEN_COMMIT for a week of train-merged commits).

Before/after as text: The weekly release CANDIDATE line now says which evidence gated the commit: a successful main-backstop run or a green train record in refs/notes/gstack-trains

--- Before · docs/releases.md § Outcomes at 5755601 · source text
+++ After · docs/releases.md § Outcomes on this branch · source text
 ## Outcomes
 | Line | Meaning |
 |---|---|
+| `CANDIDATE: <sha> (<date>) gated by main-backstop|train <nonce>` | the commit that will be (or was) released, and which evidence gated it (`[hotfix: --ref]` before `gated by` on a `--ref` cut) |
-| `CANDIDATE: <sha> (<date>)` | the commit that will be (or was) released |
 | `NOTHING_NEW: origin/main <sha> is already released as v<X>` | nothing merged since the last release; exit 0 |
 | `NO_GREEN_COMMIT: ...` with `SKIPPED:` lines | nothing in the window passed the gate; exit 1 (a dry run exits 0: the skips are its answer) |
 | `REFUSED: non-fast-forward: ...` | the candidate is behind stable; stable only moves forward |

Tests

Focused lanes at b8373e2 (the pushed head), run on this 4-core machine with the suite's 30s per-test timeout (bun test --timeout=30000, the value scripts/test-free-shards.ts passes; a bare bun test at the 5s default times out three pre-existing pregate-invalidation tests here, a launcher artefact, not a product defect):

• bun test --timeout=30000 test/release-cut.test.ts test/ship-issue-intent.test.ts test/gstack-post.test.ts test/gstack-post-cli.test.ts test/gstack-ship-queue.test.ts test/pregate-invalidation.test.ts test/troubleshooting-anchors.test.ts test/parity-suite.test.ts test/bun-entry-isolation.test.ts test/module-size-ratchet.test.ts test/spawnsync-timeout-tripwire.test.ts test/weekly-release-workflow.test.ts test/changelog*.test.ts test/harness-version.test.ts: 361 pass, 0 fail.
• HOME=<private> bun test --timeout=30000 test/test-free-shards.test.ts: 77 pass, 0 fail (a private HOME keeps the evidence wrapper's own ~/.gstack log out of the home-write guard).
• bun run typecheck: exit 0. bun run typecheck:test: 819 known diagnostics, none new.
• Full free tier on the pushed tree 60f60b770c72 (head d08c42c): Ubicloud lane gstack-pregate --stage tests --remote --base main --spend-cap 2 --timeout 2700 → PREGATE_REMOTE: tree=60f60b770c72052e09a70f12737d6248222bb119 tests=10167 failed=0 spent=0.06 (us-east-a2; two earlier attempts in eu-central-h1 failed on my own tree edit during the sync and on vCPU capacity, $0.16, no tests ran). The macOS and Windows platform lanes are cleared from this head's CI runs (Free Tests 40363111696, Windows Free Tests 40363111743); the receipt's requires_remote carries all three.

At the merged head 020bdef (main b004c06 merged, plus the pass-4 fix), the same lanes again: the focused set 363 pass, 0 fail (two tests #3480 added to these files); test/test-free-shards.test.ts 77 pass, 0 fail; the Windows-curation check (test-free-shards, setup-hook-syntax-gate, ubicloud-pregate-remote under a private state root) 112 pass, 0 fail; bun run typecheck exit 0, typecheck:test 819 known, none new. Full free tier on tree 309f4babb16d: PREGATE_REMOTE: tree=309f4babb16d09effd19b105f63dcab66a46ff5c tests=10199 failed=0 spent=0.04 (us-east-a2). Main stamped v1.91.256.0 after the merge, so GitHub schedules no pull_request CI on the CHANGELOG-conflicted head (rule 19); the macOS and Windows lanes are cleared from the dispatched runs at this head (Free Tests 40400236429, Windows Free Tests 40400240927). No flaky case in any lane.

Step 7 coverage audit added five tests, each red at HEAD before its fix and green after: test/gstack-post.test.ts (GitLab merge path; CRLF, duplicate titles, receipt first, no trailing newline; composed-body idempotence), test/pregate-invalidation.test.ts (run and clear mirror byte for byte; an unwritable state root never fails the record), test/release-cut.test.ts (readTrainNotes gating: fetch error, missing ref, junk notes, freeze beside evidence). Review passes added: fence-length closers, info-string closers and the unclosed receipt fence (three merge cases); run-word negative controls; mirror negative rows (--only timing, another base, head policy) and the tests-stage mirror; equal --required-check/--backstop-check names; non-object and malformed notes; closure, filler and version words in parentheses. No existing test was weakened, skipped or deleted; one pass-1 test row (workflow/job/attempt/id/ids run words) moved from the allowlisted set to the controls, which is the behaviour change.

Evals: not run. The diff changes no skill prompt and no paid case reads it; the thread owner forbids paid eval dispatch (recorded as not run).

Pre-Landing Review

Four passes: three to the cap on the branch, plus one delta-only pass on the main merge below. Blocking floor applied by hand: a finding blocks only if it would fail a test, break production, or lose data or secrets.

Pass 1 (whole diff vs origin/main 5755601; six specialists, native adversarial, GPT outside voice, Step 7 coverage audit, QA smoke) found and fixed, all inside the diff (commit 90f08a3):

• gstack-post pr-body: the merge was not idempotent on the body /ship composes, and text after a receipt could replace the intro (coverage audit, security, testing) → text sections are keyed by role.
• gstack-post pr-body: a ``` line inside a four-backtick block or a ```js line closed a fence early and an unclosed receipt fence swallowed ## Approvals (native High; GPT Medium) → CommonMark closers (same character, at least the opener's length, nothing after).
• gstack-post: the pii.phone.e164 allowlist had widened to the generic words id, ids, job, attempt, workflow (native High; security) → dropped; failed/passed stay (receipt vocabulary: failed <run id> | rerun passed <run id>).
• gstack-ship-queue ready: a same-tree record waiting only on a remote receipt never read the mirror (state-machines CRITICAL); mirror reuse was keyed by tree alone, so a --only, other-base or --policy-from head record from any clone counted (GPT Medium; native) → the mirror stands in when the local record is missing, unreadable, another tree, or uncleared, and must hold the tests stage, the same origin/<base> and a reviewed policy; the write is a temp file renamed into place; the PREGATE line names the mirror relative to the state root instead of printing the home path.
• scripts/release-cut.ts: a notes blob that parsed to null crashed the planner (TypeError on r.kind; GPT Low, native Low) → shape-validated; equal --required-check/--backstop-check names let train evidence stand in for the required check (GPT Medium) → no substitution when the names are equal.
• lib/issue-links.ts: (closing #12), (cf. #12), (v1.2 #3) became phantom cross-repo references and vanished from Refs and the fix #N offer (native Medium) → closure, filler and version words added to NOT_A_NAME.

Pass 2 (delta 1543806..90f08a3 only; structured, native adversarial, GPT outside voice) found and fixed (commit b8373e2):

• the unclosed-receipt fallback had made the body from the fence on replaceable leading text, so a posted file with leading prose dropped ## Approvals (GPT CRITICAL, reproduced) and a closed receipt before a later unclosed opener was demoted too → the unclosed tail is one unclosed-receipt section the merge never matches;
• the pass-1 "every check" mirror rule refused the documented lane case, because gstack-pregate --stage tests --remote records checks=[lanes] (structured and native CRITICAL) → the mirror must hold the tests-stage checks;
• tree: ""/sha: "" note entries were stored as evidence and byTree.get('') could hit them → skipped; (v1.2.3-rc1 #301) read as a repository → v\d[\w.-]*.

Pass 3 (delta 90f08a3..b8373e2 only): no blocking finding, which is the exit. GPT outside voice (openai/gpt-6.1-sol): NO FINDINGS, both pass-2 fixes verified closed. Native reviewer: four INFORMATIONAL notes, listed under advisory below: a tests-only mirror certifies READY when the checkout has no record of its own, so preflight (secrets/regen/strays) may never have run for that tree (same as the local path today, where --stage tests --remote overwrites pregate.json with a one-check record); v\d[\w.-]* swallows repository names such as v2ray or v0; an incoming file that itself carries an unclosed receipt fence is added rather than refused (bytes intact, renders as one code block); a mirror that fails verify leaves no trace on the PREGATE line. Then one docs-only commit (d08c42c, two one-line corrections from the documentation audit) with no code change.

Main merge and pass 4 (rule-19 grant from GStack Minder after train build found a real conflict): origin/main b004c06 (v1.91.255.0) merged into the branch as 28b64d7 (merge, not rebase). Two conflicts: CHANGELOG.md, resolved by mergeChangelogs (our entry stays under ## [Unreleased], byte-identical; main's entries intact), and test/pregate-invalidation.test.ts, where #3480 gave the preceding test a 30_000 timeout and this branch appended the mirror test after it (both kept). Pass 4 (delta only, d08c42c..28b64d7; native reviewer plus the GPT outside voice) found one semantic conflict the merge created between two individually correct parents: #3480 makes verifyPregate return PREGATE_ENVIRONMENT for environment-caused incomplete checks, and ready's mirror reader treated only PREGATE_LANE_FAILED and PREGATE_INCOMPLETE as final, so a local record whose secrets scan never finished fell through to a same-tree tests-only mirror and ready passed without a secrets scan (reproduced: expected exit 3, got 0). A gate bypass is at the floor, so it was fixed in 020bdef: PREGATE_ENVIRONMENT is final too, with a regression case in test/gstack-ship-queue.test.ts that is red on the bare merge and green with the fix. No other finding; the scratch-directory fallback from #3480 does not touch pregate/by-tree/.

Gate edits: none detected (no threshold, rubric, trial count, case kind, judge prompt or timeout changed; the --timeout=30000 above is the suite's existing value passed to a focused run, not a change).

Outside review: completed in all three passes (openai/gpt-6.1-sol via a Capy subagent, not the Codex CLI).

Advisory, named and not fixed here (below the blocking floor):

• scripts/release-cut.ts: --required-check, --backstop-check and --notes-ref have no caller besides the tests; weekly-release.yml runs the defaults (simplification).
• Train evidence provenance: anyone with push access to refs/notes/gstack-trains can write an unsigned train record that gates a backstop-less commit (same trust level as pushing to main; native 5). Evidence is not subtracted by a later freeze or red-on-main record for the same commits; an active freeze still refuses the cut (native 6).
• gstack-post pr-body: HTML comments are not tracked by the section splitter (native 3); the read-merge-write has no conflict check against an edit made during a --confirm round trip (native 8); a MEDIUM finding already in a kept section blocks a repost of a clean file (native 9); the stderr summary echoes section titles unsanitised (native 10); ## X ##, CRLF/LF mixing and Unicode heading forms are not normalised (native 11); BLOCK_RE in ship-receipt.ts and the splitter disagree about a receipt inside another fence (native 12).
• lib/issue-links.ts: NOT_A_NAME is a blocklist and cannot be closed ((ticket #12), (reverts #12), (ref. #12) still read as repositories; a repository literally named upstream, tracking or bug is now a same-repo ref). The real fix is a positive rule (require / or a PR/issue keyword), out of this PR's scope.
• gstack-post: failed/passed remain run words and the allowlist is by exact token value across the whole post, so run 40269992077 … 40269992077 exempts the second occurrence too (native).
• gstack-ship-queue ready now fingerprints the tree on every run (60s cap) even without a record (native 14); a tests-only mirror stands in for a missing local record without preflight evidence; a mirror that fails verify is not named on the PREGATE line (pass 3).
• lib/issue-links.ts: v\d[\w.-]* also treats v2ray/v0/v8-engine as version words (pass 3). gstack-post pr-body: an incoming file with an unclosed receipt fence is added as a section rather than refused (pass 3).

Deferred (pre-existing or outside the diff): the header comment of .github/workflows/weekly-release.yml still describes the gate as two check runs (the file is not in this diff); gstack-post cannot detect the host on a Capy checkout whose origin is git.capy.ai (--host github needed; QA ISSUE-001).

Exploratory QA

Step 9.2.1 smoke (report-only, stub gh, fresh state root; .gstack/qa-reports/ship-20261026/functional/report.md): 12 probes, 8 contracts pass (run-id allowlist posts; bare 11-digit number exits 2 with RULE: pii.phone.e164; pr-body merges by section with receipt first and untouched sections byte-identical; unreadable body exits 3 naming --replace; by-tree mirror byte-identical to the record; (gbrain #12, #13) cross-repo; release-cut usage names the three flags). Captures 001-004 superseded (my setup error: no --host github). Materialize verdict inconclusive on that open item only; no product defect found.

Design Review

No frontend files changed — design review skipped.

Eval Results

No prompt-related files changed — evals skipped (and no paid dispatch allowed in this thread).

Greptile Review

No Greptile comments (GREPTILE_SIGNAL: none, early PR not applicable: the PR already existed).

Plan Completion

Step 8 not run: no plan or design file is bound to this branch (PLAN_BINDING: []).

Issues

gstack-issue-links --base main reads (v1.2.3-rc1 #301) in the pass-2 commit message as Refs #301; that token is a test example quoted in the message, not a reference to issue 301, so no Refs line is posted and the receipt's issues carries none.

Verification Results

Step 8.1 obligations: none (no plan). Review-army probes: fence closers, run-word controls, mirror rows, equal check names, junk notes, parenthesised words, each proven red at the prior code and green after (details under Tests).

Documentation

Status: current (two attempts: the first read-only audit returned blocked on two one-line factual corrections, applied in d08c42c; the re-audit at d08c42c is current with no blockers). Scope: CHANGELOG.md, docs/releases.md, docs/pregate.md, docs/troubleshooting.md, docs/ship-policy.md, docs/unattended.md, README.md, ARCHITECTURE.md, ship/sections/pr-body.md.tmpl, checked against scripts/release-cut.ts, lib/issue-links.ts, lib/gstack-post.ts, lib/pregate/index.ts, lib/ship-queue.ts, bin/gstack-gate-diff, bin/gstack-diff-scope and lib/gate-diff/git.ts. Banned terms: none. No diagram drift.

Documentation health: README.md current; ARCHITECTURE.md current; CONTRIBUTING.md current; CHANGELOG.md current (Unreleased entry consistent with the code); docs/releases.md current (both gate kinds, the CANDIDATE row, the three flags); docs/pregate.md current (by-tree mirror and the named-reference paragraph); docs/troubleshooting.md current (#redact-run-id-as-phone, #gstack-post-pr-body-merge, #gate-error-no-base); docs/ship-policy.md, docs/unattended.md, ship/sections/pr-body.md.tmpl current; TODOS.md skipped (out of ship-owned scope).

Debt (not blockers): #gate-error-no-base sits at the end of the Windows section of docs/troubleshooting.md though the failure is platform-agnostic; #pregate-stale and #queue-not-ready do not yet point at the by-tree mirror fallback; docs/pregate.md's By tree paragraph omits the unreadable-record case the CHANGELOG and ready cover; the header comment of .github/workflows/weekly-release.yml still describes the gate as two check runs (YAML comment, outside doc scope).

Test plan

• bun test --timeout=30000 <14 focused files>: 361 pass, 0 fail
• HOME=<private> bun test --timeout=30000 test/test-free-shards.test.ts: 77 pass, 0 fail
• bun run typecheck: clean; bun run typecheck:test: none new
• gstack-pregate run --base main --allow-repo-commands: PREGATE: requires-remote (3 uncleared) tree=60f60b770c72 head=d08c42c16e94 checks=7 (secrets: warn, 70 MEDIUM pii.phone.e164 run-id tokens in CHANGELOG/docs/tests, non-credential)
• gstack-pregate --stage tests --remote --base main --spend-cap 2 --timeout 2700 --allow-repo-commands: PREGATE_REMOTE: tree=60f60b770c72052e09a70f12737d6248222bb119 tests=10167 failed=0 spent=0.06; macOS and Windows lanes cleared with their CI run URLs

Approvals

Ask	Words	By	Scope
Harness phase 2 (ship-queue gaps seen in operation)	"Do it and also improve it: fix the issues all the captains have seen in this Capy project"	Garry, 2026-10-26, via GStack Minder	this PR and its siblings
New command surfaces and result codes (verify --screen, verify --post-merge, train watch, train forget, prune --stale, ready --dispatch-ci, train build --dry-run --stack-tests; QUEUE_SCREEN_RED / QUEUE_SCREEN_NOT_RUN / QUEUE_POST_MERGE_RED / QUEUE_TRAIN_STACK_RED; screen/- branches; a lagging merge ref is no longer QUEUE_SCREEN_STALE_REF)	"Accepted as designed"	GStack Minder (Captain), 2026-10-26	#3478, #3483, #3484

[trunk-io]

😎 This pull request was merged.