release train: automatic milestone triage at T-24h, T-0 and post-tag #3458

kind: code · P1 · milestone: 0.70.0 · Blocked-by: #3445 (closed 2026-09-17T15:00Z by PR #3455 — the gate exists on main; the autopilot does not call it yet, see #3454) · Do not start without an operator ruling.

Why

#3445 blocks a tag on a dirty milestone; without automated triage that means ~100 manual slips per 72 h train (0.69.0: 127→25 took 394 edits). Load 391 vs capacity 116.

Principle

Automate what arithmetic decides; propose what needs judgment (costs are [A], so EV alone never moves a ticket).

T-24h

• Automatic: slip non-must-carry tickets with no linked PR, or whose PR cannot be green by T-0 (now + p95 ci/gate > T-0); pull from the next milestone tickets whose PR is already green, up to cap.
• Proposal only (posted on the train epic): EV re-rank of the next milestone; duplicate groups.

T-0

• Automatic: final slip pass, then the release train: a tag was cut while its milestone had open issues — 0.68.0 shipped with 2 open, one a user-facing P-level defect (#3091) #3445 gate. Open must-carry ⇒ never slipped; T-0 waits (§1.1a), >72 h ⇒ andon.

Post-tag

• Automatic: close the shipped milestone (open ≠ 0 ⇒ RED); create milestone N+4; refill N+1 to cap from overflow by EV; re-measure C (rolling median merged PRs, last 3 trains); record net flow.
• Proposal only: stale-close candidates; [A]→[V] cost for the top C tickets.

Invariants

• no ticket ahead of its blocker
• must-carry never auto-slipped
• milestones not matching the train version pattern never touched
• revert CSV posted before any edit
• dry-run is the default
• deterministic (same inputs ⇒ same plan)
• re-read every batch
• circuit breaker: would move > 2×C tickets or empty the current train ⇒ STOP

Inputs

gh issues/PRs, docs/specifications/06x-release-schedule.md, must-carry lines, p95 ci/gate, C, cap = min(C, 25).

Location

Versioned script in the repo, called by the tag step — never in the out-of-repo autopilot. Current train derived from 06x-release-schedule.md, not milestone title order (subsumes #3457 if its fix is not yet merged).

Reference

The 2026-09-17 session's EV formula and CSV format. Golden fixture: the plan CSV in #3421 (comment) ; pre-triage snapshot (revert CSV): #3421 (comment)

Exit

Dry-run on the pre-triage snapshot (revert CSV) reproduces the mechanical subset of the 394 moves. Mutations RED: slip a must-carry · place a ticket ahead of its blocker · touch a non-train milestone · > 2×C moves · run without revert CSV. Pattern contract same PR; self-test runs in ci / gate. TDD; five-whys line in the PR.

Out of scope

Closing, relabeling, body edits, priority changes.

Targets

• manual milestone edits per train 394 → 0
• current train ≤ cap at T-0
• open tickets in any shipped milestone = 0
• net flow published every train (goal ≥ +10; measured −82 / −57 / −53 over the last three)
• operator time per train < 10 min