ci: add bounded complete release gate

docs/plans/2026-08-18-release-stabilization.md

@@ -419,9 +419,9 @@ checkpoint. Do not infer status from chat history.
 | Slice | Status | Commit(s) | Evidence/gates | Exact next action |
 |---|---|---|---|---|
 | R0 | PLAN ACCEPTED; tracking/owner assignment pending | — | Audit complete at `15539a22`; user started R1 | Track plan+audit artifacts; assign R4 owner |
-| R1 | IMPLEMENTED + REQUIRED GATES PASS; review/commit pending | — | 2026-08-18 checkpoint below; F-009/T-001 resolved in working tree | Review diff, then commit the coherent R1 checkpoint |
-| R2 | NOT STARTED; technically unblocked after R1 review/commit | — | F-010/F-014/F-019 | Start only after R1 checkpoint is accepted |
-| R3 | NOT STARTED | — | T-002–T-016; F-015/F-021/F-022/F-030 | Wait for R2 |
+| R1 | COMPLETE ON CAMPAIGN BRANCH; not yet merged | `0a934cf5` | 2026-08-18 checkpoint below; F-009/T-001 resolved and committed | Preserve while R2 runs; merge through the normal review path |
+| R2 | COMPLETE GATE CHECKPOINT; broader reproducibility work remains; commit pending | — | Checkpoint below; F-014 resolved, F-010/F-019 partially resolved | Review and commit this checkpoint, then choose locked restore/warning work or R3 |
+| R3 | NOT STARTED | — | T-002–T-018; F-015/F-021/F-022/F-030 | Wait for remaining R2 sequencing decision |
 | R4 | NOT STARTED; may run parallel | — | F-001/F-026/F-031/F-034 | Assign owner/legal provenance decision path |
 | R5 | NOT STARTED | — | F-002/F-003/F-006/F-007/F-011/F-020/F-027/F-029/F-032 | Wait for R2–R3 |
 | R6 | NOT STARTED | — | F-004/F-005/F-012/F-016/F-023/F-028 | Wait for R3/R5 |
@@ -433,8 +433,8 @@ checkpoint. Do not infer status from chat history.
 ### R1 implementation checkpoint — 2026-08-18
 
 **Working-tree base:** `15539a22a67f8d915d88f8b1d8126cd55eedda6e`  
-**Commit:** pending; do not describe this checkpoint as merged or durable until
-the source, test, plan, and audit records are committed together.
+**Commit:** `0a934cf5` on `codex/release-stabilization`; the checkpoint is
+durable on that campaign branch but is not yet merged to `main`.
 
 Implementation:
 
@@ -495,9 +495,79 @@ Changed implementation/test files:
 - `src/AcDream.Launcher.Core/Launching/LauncherProcessSupervisor.cs`
 - `tests/AcDream.Launcher.Core.Tests/Launching/LauncherProcessSupervisorTests.cs`
 
-Rollback before commit is the exact reverse of those two file diffs. After a
-future commit, record its hash here and use `git revert <R1-commit>` rather than
-rewriting history.
+Rollback is `git revert 0a934cf5`; do not rewrite branch history.
+
+### R2 complete-gate checkpoint — 2026-08-18
+
+**Working-tree base:** `0a934cf5781c003375c14af9a1f565254df0f9f9`
+**Commit:** pending; the source and evidence records must be committed together
+before this checkpoint is described as durable.
+
+Implemented gate:
+
+- `global.json` pins the accepted .NET 10 SDK feature band at `10.0.300` with
+  `latestPatch` roll-forward and prerelease SDKs disabled. Every existing
+  `actions/setup-dotnet` step now reads that file instead of floating on
+  `10.0.x`.
+- `tools/run-release-gate.ps1` discovers every project under `tests/` that
+  declares `Microsoft.NET.Test.Sdk` or `IsTestProject`, verifies the project is
+  present in `AcDream.slnx`, restores/builds the solution, and runs each test
+  assembly exactly once in its own Release process. It does not retry.
+- Restore, build, and each test process have 600/900/600-second outer bounds.
+  Tests additionally use VSTest's 180-second per-test blame-hang collector with
+  mini dumps. An outer timeout kills the complete process tree and reports exit
+  code 124; GitHub Actions adds a 45-minute job bound.
+- Every run writes exact commands and output, one TRX per assembly, any blame
+  sequence/dumps, `dotnet --info`, configured NuGet sources, commit/branch/RID,
+  aggregate executed/passed/skipped/failed counts, and `SHA256SUMS.txt`.
+- `.github/workflows/release-gate.yml` runs the gate on pull requests, pushes
+  to `main`, and manual dispatch on `windows-latest`, then uploads the evidence
+  even when the gate fails. The focused Windows/Linux portability and Vulkan
+  lanes remain separate and are no longer the only deterministic CI coverage.
+- `docs/release-gate.md` is the repository-owned local/CI runbook.
+
+Test-isolation corrections, with no product behavior change:
+
+- Four `MainWindowViewTests` that call `Show()` now close their window and pump
+  dispatcher cleanup in `finally` on the owning Avalonia test session. The old
+  tests leaked shown, thread-affine compositor state to runner teardown; no
+  suite serialization or retry was added.
+- The complete gate's first evidence run correctly failed
+  `RealChildStderrIsCapturedForTheProcessStartInfoPath`: its live polling helper
+  briefly denied write sharing, so the final async stderr callback observed an
+  `IOException` and the deliberately no-throw capture sink latched off. The
+  helper now reads with `FileShare.ReadWrite | FileShare.Delete`, matching the
+  production status tailer; its assertions and five-second bound are unchanged.
+
+Verification:
+
+- Focused `MainWindowViewTests`: 13 passed / 0 skipped / 0 failed.
+- Three fresh default-parallel whole-solution runs completed inside independent
+  180-second process bounds with 12/12 TRX files and no Avalonia cleanup error:
+  56.719, 56.321, and 58.506 seconds. Each reported 14,748 passed / 77 skipped /
+  0 failed.
+- The stderr ProcessStartInfo test passed 25/25 fresh-process repetitions after
+  the live-reader correction.
+- The actual outer-watchdog function killed a controlled fixture process tree
+  at 2.107 seconds, returned 124, and left no child process.
+- The repository command `pwsh ./tools/run-release-gate.ps1` completed in
+  107.337 seconds on SDK `10.0.300`, RID `win-x64`: 12 assemblies, 14,748
+  executed and passed / 77 skipped / 0 failed. The evidence manifest contains
+  28 verified SHA-256 entries.
+
+Deliberately still open in the wider R2 slice:
+
+- the 26 warnings observed by a clean recompilation, centralized compiler and
+  package settings, package lock files/locked restore, and broken or unsupported
+  tool-project decisions;
+- the known duplicate Core theory row and classification of the 77 skips, which
+  remain R3 work; and
+- stale public headline counts, which must be corrected with the documentation
+  authority work rather than hand-edited as part of this gate checkpoint.
+
+Therefore this checkpoint closes F-014 on the campaign branch and the SDK part
+of F-019, and gives F-010 a truthful machine-readable count. It does not claim
+the broader R2 reproducibility slice or R3 test-quality cleanup is complete.
 
 ## 18. Session start protocol
 
@@ -532,7 +602,7 @@ review, and cross-session ledger entry are all complete.
 
 ## 20. Immediate next action
 
-Review the R1 diff and checkpoint evidence, then commit the source, regression
-test, plan, and audit updates together if accepted. After that, begin R2's
-pinned complete gate; assign the R4 decision owner in parallel. Do not begin
-bulk comment, artifact, or giant-file cleanup first.
+Review and commit the R2 complete-gate checkpoint, then decide whether the next
+bounded goal is the remaining R2 locked-restore/warning/toolchain work or R3's
+truthful test taxonomy. Assign the R4 decision owner in parallel. Do not begin
+bulk comment, artifact, giant-file, or unrelated cleanup first.