feat: release Dever 0.1.5 with direct workers and long transactions

test/ci/README.md

@@ -44,10 +44,27 @@
 
 替换路径，勿直接复制示例运行。下文 CI 字段均位于 `performance.linux_ci`。`inputs` 列出固定原始作者输入及准备好的资产文件/目录，逐文件计 SHA-256；工具、协议产物、CMS manifest/可执行文件/配置和 `performance.network_peer/live_peer` 也自动计摘要，`linux_ci` 对象不作为 peer 路径解析。输出目录不得包含在 inputs 中。报告只存摘要，不复制数据库密码。
 
-`required_inputs` 为 `author`、`native`、`postgres`、`sandbox`、`bounded-perf`、`soak` 各提供非空绝对路径列表，必须落在 `inputs` 声明范围内。缺路径记录 blocked，不算 pass。作者 fixture 的具体固定路径/准备命令仍以 `test/ecosystem-release/prepare.py`、`test/ecosystem-release/build_inputs.py` 和对应 ignored 原因文本为准；gate 不把现存文件冒充由当前源码重建的 provenance。
+`required_inputs` 为 `author`、`native`、`postgres`、`process-runtime`、`bounded-perf`、`soak` 各提供非空绝对路径列表，必须落在 `inputs` 声明范围内。缺路径记录 blocked，不算 pass。作者 fixture 的具体固定路径/准备命令仍以 `test/ecosystem-release/prepare.py`、`test/ecosystem-release/build_inputs.py` 和对应 ignored 原因文本为准；gate 不把现存文件冒充由当前源码重建的 provenance。
 
 显式 LLVM Worker 验收读取 `target/native-release-inputs/component-fixture`：先用当前源码构建 `dever-tests` 的 `component-fixture` bin，再将程序复制到该准备目录，记录源码/程序摘要，并把固定副本列入 `inputs` 和 `required_inputs.native`。不能将 `target/debug/component-fixture` 当作不可变输入：Cargo 在 default/all-feature 组合间会重新链接这个输出。普通 Worker 测试仍使用 Cargo 为各自组合生成的 `CARGO_BIN_EXE_component-fixture`，不改质量门的输入变更拒绝规则。
 
+原生发行验收还需在同一准备目录提供四个独立构建的 `base.a`、`sqlite.a`、`postgres.a`、`both.a`，`core-libraries/` 放与候选编译器对应的完整非系统动态库闭包，`native/` 放 CRT、静态链接库和匹配的 `runtime.a`。这些输入必须为真实文件；不再假定作者容器是某个 Ubuntu/GCC/LLVM 安装布局。`DEVER_PROCESS_RUNTIME` 显式指向已准备的进程 ABI 目录。测试使用自有签名、安装根和守护进程，不改正式信任密钥或现有安装。
+
+同一目录的 `bin/` 准备当前源码构建的 `dever`、`deverd` 和 `native-release`，验收使用这些固定副本而非猜测 Cargo 输出路径。需要在另一容器的自有临时目录执行时，可用 `DEVER_NATIVE_ACCEPTANCE_WORKSPACE` 指向包含相同准备目录及所需 C 夹具的根。显式设置 `DEVER_NATIVE_ACCEPTANCE_OUTPUT` 为不存在的绝对目录，对应验收全部通过后才导出未压缩的签名输入目录、测试公钥与验证结果；测试私钥不导出，不能当作正式发行签名。
+
+保留候选发行附件也必须复用 `sdk/release-assets.py`，不把基础包、语言扩展和验证记录重新合成总安装包。基础 `dever-<平台>.tar.zst` 仅含签名清单的 `artifacts`；Python、Node.js、Go 分别生成 `ext-runtime-pip/npm/go-<目标>.tar.zst`，按需下载。清单和签名为独立附件；测试公钥及验证记录不放进安装包。示例：
+
+```sh
+python3 -B sdk/release-assets.py /absolute/candidate/ecosystems/release \
+  --output /absolute/candidate/assets --zstd /absolute/author/bin/zstd
+```
+
+拆包测试复用 `test/onboarding/test_installer.py`，默认作者工具为 `/usr/bin/zstd`；不同工具位置通过测试专用的 `DEVER_TEST_ZSTD` 显式指定。该测试同时核验三种语言扩展互不混入、基础包内容不变且压缩字节不因新增扩展变化，不安装全局编译器。
+
+完整版本验收使用 `test/onboarding/verify_release_update.py`，显式传入 `--previous-release`、`--release`、`--assets`、`--trusted-key`、`--extension-helper`，以及不存在的绝对 `--work`、`--report` 路径。在独立验证容器中以 root 运行，不挂载业务数据、不启动系统服务；使用容器自有临时空间，不占用正在服务的 dev/deverd 临时卷。它先验证基础包首装、正式项目模板、四档运行库、`long` 和按需语言扩展，再验证真实旧版本升级与回退。旧、新版本必须具有各自实际构建的二进制，不能只改清单版本模拟升级；临时测试密钥的结果也不能算作正式签名验收。
+
+升级核验按签名版本读取旧版原始资源路径和 bootstrap 元数据，不恢复旧沙箱执行；0.1.5 起的新包不得携带已移除的 bootstrap 沙箱配置。旧文件仍须通过原签名中的大小和摘要校验。
+
 `author_outputs` 精确声明 author 会制作的 pack、下载结果和 receipt 路径。author 阶段只将其余原始输入当作不可变输入，另外记录完整输出摘要；后续验收按准备后完整输入摘要绑定。不要把整个作者输入根排除掉。显式 `author_network: true` 才能执行已分类的固定官方下载/源码构建。新 ignored 必须人工更新 `ignored.json`；inventory 核对源码声明及实际 all-feature libtest 名单，执行时一律使用完整 `--exact` 名称。内部 probe 记录 parent-only，只由所属父用例运行。
 
 资源准备归外部托管者：自有空父启用 memory/cpu，限制总 CPU<=2、memory<=4GiB、swap=0；runner/Cargo/负载客户端放 `control` 子组，自有 PostgreSQL 可放兄弟子组，64/128MiB 服务子组由现有 performance owner 创建。gate 只读检查现有父限制与自身归属，不创建/修改主机策略。作者工具所需固定 PATH/动态库路径可由外部托管者显式准备，不写入产品配置。
@@ -64,7 +81,7 @@ python3 -B test/ci/run.py run --stage python
 python3 -B test/ci/run.py run --stage sdk
 python3 -B test/ci/run.py run --stage native
 python3 -B test/ci/run.py run --stage postgres
-python3 -B test/ci/run.py run --stage sandbox
+python3 -B test/ci/run.py run --stage process-runtime
 python3 -B test/ci/run.py run --stage bounded-perf
 ```
 

test/ci/acceptance.py

@@ -41,7 +41,7 @@ def classify_cases(names, manifest, target):
 
 def audit_classification():
     manifest = json.loads((ROOT / "test/ci/ignored.json").read_text())
-    stages = {"probe", "author", "native", "postgres", "sandbox", "bounded-perf"}
+    stages = {"probe", "author", "native", "postgres", "process-runtime", "bounded-perf"}
     if any(row["stage"] not in stages for row in manifest):
         raise RuntimeError("ignored classification contains an unknown execution stage")
     expected = {(row["source"], row["name"], row["reason"]) for row in manifest}
@@ -292,7 +292,7 @@ def soak_stage(stage, config, directory, result):
 def run_stage(stage, document, config, directory, result):
     if stage == "inventory":
         inventory(config, directory, result)
-    elif stage in ("author", "native", "postgres", "sandbox", "bounded-perf"):
+    elif stage in ("author", "native", "postgres", "process-runtime", "bounded-perf"):
         ignored_stage(stage, document, config, directory, result)
     else:
         soak_stage(stage, config, directory, result)

test/ci/ignored.json

@@ -1,24 +1,8 @@
 [
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "unprivileged_launcher_probe",
-    "reason": "internal non-root launcher probe, invoked by enforces_unprivileged_namespace",
-    "stage": "probe",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/trusted_helper.rs",
-    "name": "rejects_untrusted_helper_paths_bytes_modes_owners_and_capabilities",
-    "reason": "requires root and the prepared static author bwrap; touches only owned target files",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "dever_sandbox"
-  },
   {
     "source": "test/native_runtime_link.rs",
     "name": "canonical_c_header_links_and_executes_the_real_runtime_archive",
-    "reason": "build runtime-abi-only staticlib in target/native-runtime-abi before running",
+    "reason": "requires an explicit runtime-only DEVER_RUNTIME_ABI_ARCHIVE",
     "stage": "native",
     "package": "dever-backend-bridge",
     "target": "native_runtime_link"
@@ -26,7 +10,7 @@
   {
     "source": "test/native_runtime_link.rs",
     "name": "llvm_object_calls_the_versioned_runtime_abi_without_rust_layouts",
-    "reason": "build runtime-abi-only staticlib in target/native-runtime-abi before running",
+    "reason": "requires an explicit runtime-only DEVER_RUNTIME_ABI_ARCHIVE",
     "stage": "native",
     "package": "dever-backend-bridge",
     "target": "native_runtime_link"
@@ -34,7 +18,7 @@
   {
     "source": "test/native_runtime_link.rs",
     "name": "protocol_poll_rejects_invalid_output_before_advancing_the_operation",
-    "reason": "build runtime-abi-only staticlib in target/native-runtime-abi before running",
+    "reason": "requires an explicit runtime-only DEVER_RUNTIME_ABI_ARCHIVE",
     "stage": "native",
     "package": "dever-backend-bridge",
     "target": "native_runtime_link"
@@ -42,7 +26,7 @@
   {
     "source": "test/native_runtime_link.rs",
     "name": "logger_flush_is_a_stable_native_allocation_barrier",
-    "reason": "build runtime-abi-only staticlib in target/native-runtime-abi before running",
+    "reason": "requires an explicit runtime-only DEVER_RUNTIME_ABI_ARCHIVE",
     "stage": "native",
     "package": "dever-backend-bridge",
     "target": "native_runtime_link"
@@ -50,7 +34,7 @@
   {
     "source": "test/native_runtime_link.rs",
     "name": "wire_codecs_validate_slots_before_callback_and_release_partial_values",
-    "reason": "build runtime-abi-only staticlib in target/native-runtime-abi before running",
+    "reason": "requires an explicit runtime-only DEVER_RUNTIME_ABI_ARCHIVE",
     "stage": "native",
     "package": "dever-backend-bridge",
     "target": "native_runtime_link"
@@ -58,7 +42,7 @@
   {
     "source": "test/native_runtime_link.rs",
     "name": "database_abi_preserves_typed_owners_and_rejects_invalid_slots_without_io",
-    "reason": "build a runtime-sqlite or runtime-postgres staticlib in target/native-runtime-abi before running",
+    "reason": "requires a runtime-sqlite or runtime-postgres DEVER_RUNTIME_ABI_ARCHIVE",
     "stage": "native",
     "package": "dever-backend-bridge",
     "target": "native_runtime_link"
@@ -641,8 +625,8 @@
   },
   {
     "source": "test/llvm_job_test_source.rs",
-    "name": "timed_out_job_drains_children_and_rolls_back_before_retry",
-    "reason": "requires explicit runtime archive; bounded task cancellation inside owned SQLite transactions",
+    "name": "timed_out_job_drains_children_and_preserves_committed_stages",
+    "reason": "requires explicit runtime archive; bounded cancellation between committed SQLite stages",
     "stage": "native",
     "package": "dever-backend-bridge",
     "target": "llvm_job_test_source"
@@ -1287,110 +1271,6 @@
     "package": "dever-backend-bridge",
     "target": "llvm_application_source"
   },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "enforces_files_network_process_and_threads",
-    "reason": "requires explicitly prepared target/sandbox-inputs assets; owns only test processes",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "pins_grants_against_directory_replacement",
-    "reason": "requires explicitly prepared sandbox assets; mutates only owned fixture paths",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "pinned_grant_probe",
-    "reason": "internal sandbox descriptor-pinning probe",
-    "stage": "probe",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "rejects_writable_aliases_of_executable_inputs",
-    "reason": "requires explicitly prepared sandbox assets",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "prepared_python_and_node_run_without_host_files_or_process_creation",
-    "reason": "requires explicitly prepared signed-release Python/Node inputs and sandbox assets",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "enforces_unprivileged_namespace",
-    "reason": "requires explicitly prepared assets and host permission for unprivileged user namespaces",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "restricted_probe",
-    "reason": "internal sandbox probe, invoked only inside an owned namespace",
-    "stage": "probe",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "terminates_detached_descendants_on_kill",
-    "reason": "requires explicitly prepared assets; kills only this test's namespace",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "tree_probe",
-    "reason": "internal sandbox process-tree probe",
-    "stage": "probe",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "descendant_probe",
-    "reason": "internal sandbox descendant probe",
-    "stage": "probe",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "granted_probe",
-    "reason": "internal sandbox probe, invoked only inside an owned namespace",
-    "stage": "probe",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "rejects_missing_dependency_before_host_loader_can_supply_it",
-    "reason": "requires explicitly prepared target/sandbox-inputs assets",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
-  {
-    "source": "test/dever-sandbox-tests/isolation.rs",
-    "name": "kernel_rejects_namespace_ptrace_and_truncated_ioctl_requests",
-    "reason": "requires explicit assets and the prepared C syscall probe",
-    "stage": "sandbox",
-    "package": "dever-sandbox",
-    "target": "isolation"
-  },
   {
     "source": "test/dever-cli-tests/llvm_cli.rs",
     "name": "default_llvm_runs_builds_moves_and_reuses_cache_without_host_toolchain",
@@ -1442,14 +1322,14 @@
   {
     "source": "test/dever-cli-tests/external_workers.rs",
     "name": "compiles_go_worker_with_locked_tools_and_runs_without_source_or_go",
-    "reason": "requires explicit Go runtime pack, official UUID proof/archive and sandbox assets",
+    "reason": "requires explicit Go runtime pack, official UUID proof/archive and process_runtime assets",
     "stage": "native",
     "package": "dever-cli",
     "target": "external_workers"
   },
   {
     "source": "test/dever-cli-tests/external_workers.rs",
-    "name": "runs_official_native_python_wheel_in_sandbox",
+    "name": "runs_official_native_python_wheel_as_managed_worker",
     "reason": "requires the explicit official native-wheel and complete Python runtime fixture at target/python-managed",
     "stage": "native",
     "package": "dever-cli",
@@ -1457,7 +1337,7 @@
   },
   {
     "source": "test/dever-cli-tests/external_workers.rs",
-    "name": "runs_official_python_source_build_in_sandbox",
+    "name": "runs_official_python_source_build_as_managed_worker",
     "reason": "requires explicitly prepared official PEP517 source build at target/source-build",
     "stage": "native",
     "package": "dever-cli",
@@ -1538,7 +1418,7 @@
   {
     "source": "test/dever-tests/tests/external_resources.rs",
     "name": "packaged_exec_runs_without_source_worker_or_inherited_environment",
-    "reason": "requires explicitly prepared sandbox assets and the private Rust bootstrap compiler",
+    "reason": "requires explicitly prepared process_runtime assets and the private Rust bootstrap compiler",
     "stage": "native",
     "package": "dever-tests",
     "target": "external_resources"
@@ -1623,6 +1503,14 @@
     "package": "dever-cli",
     "target": "native_release"
   },
+  {
+    "source": "test/dever-cli-tests/native_release/ecosystem_acceptance.rs",
+    "name": "signed_zero_lib_ecosystems_run_and_build_in_the_current_container",
+    "reason": "requires explicit native and zero-Lib ecosystem packs; uses an owned root installation and daemon",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "native_release"
+  },
   {
     "source": "test/dever-cli-tests/native_release/ecosystem_acceptance.rs",
     "name": "signed_ecosystems_build_and_run_without_system_language_installations",
@@ -1698,7 +1586,7 @@
   {
     "source": "test/dever-cli-tests/external_libs/npm_build.rs",
     "name": "builds_official_npm_addon_with_locked_lifecycle",
-    "reason": "explicit official npm native source build; network only in registry resolver, never in lifecycle sandbox",
+    "reason": "explicit official npm native source build; network only in registry resolver, never in lifecycle process_runtime",
     "stage": "author",
     "package": "dever-cli",
     "target": "external_libs"
@@ -1734,5 +1622,93 @@
     "stage": "author",
     "package": "dever-cli",
     "target": "external_libs"
+  },
+  {
+    "source": "test/dever-process-tests/execution.rs",
+    "name": "direct_child_probe",
+    "reason": "internal direct-process probe",
+    "stage": "probe",
+    "package": "dever-process",
+    "target": "execution"
+  },
+  {
+    "source": "test/dever-cli-tests/external_workers/ffi.rs",
+    "name": "real_c_abi_packages_compiles_and_checks_the_generated_protocol",
+    "reason": "requires explicit DEVER_FFI_CC, DEVER_PROCESS_RUNTIME inputs",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "external_workers"
+  },
+  {
+    "source": "test/dever-cli-tests/external_workers/ffi.rs",
+    "name": "real_c_abi_direct_worker_errors_deadlines_and_cancellation",
+    "reason": "requires explicit DEVER_FFI_CC and DEVER_PROCESS_RUNTIME inputs",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "external_workers"
+  },
+  {
+    "source": "test/dever-cli-tests/llvm_cli.rs",
+    "name": "llvm_test_controls_preserve_indices_prefix_boundaries_and_timeout_continuation",
+    "reason": "requires an explicitly prepared runtime pack adjacent to CARGO_BIN_EXE_dever; owned short-lived cases only",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "llvm_cli"
+  },
+  {
+    "source": "test/dever-cli-tests/native_release/command_acceptance.rs",
+    "name": "signed_cli_runs_and_packages_ordinary_command_with_private_library",
+    "reason": "requires explicit current runtime archive, author C/LLVM inputs and owned daemon/process_runtime",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "native_release"
+  },
+  {
+    "source": "test/dever-cli-tests/native_release/cross_acceptance.rs",
+    "name": "signed_host_compiler_builds_arm_profiles_and_runs_standalone_under_qemu",
+    "reason": "requires prepared x86/ARM four-profile runtime archives and private QEMU; starts only an owned daemon",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "native_release"
+  },
+  {
+    "source": "test/dever-cli-tests/native_release/cross_ecosystems.rs",
+    "name": "signed_arm_ecosystems_build_offline_standalone_apps_for_system_guest",
+    "reason": "requires explicit ARM runtimes/dependencies/process_runtime and native archives; builds with an owned host daemon and exports apps for ARM system QEMU",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "native_release"
+  },
+  {
+    "source": "test/dever-cli-tests/native_release/cross_ecosystems.rs",
+    "name": "signed_arm_python_worker_rebuilds_with_current_sdk",
+    "reason": "requires explicit ARM inputs; rebuilds only Python for SDK shutdown regression under the ARM guest",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "native_release"
+  },
+  {
+    "source": "test/dever-cli-tests/shared_toolchain.rs",
+    "name": "active_skill_is_readable_by_other_machine_users_without_install_lock_access",
+    "reason": "requires root; drops only an owned skill client to an unprivileged uid",
+    "stage": "native",
+    "package": "dever-cli",
+    "target": "shared_toolchain"
+  },
+  {
+    "source": "test/llvm_database_source.rs",
+    "name": "sqlite_long_command_preserves_commit_on_encoding_failure",
+    "reason": "requires explicit runtime archive; committed long-entry SQLite stages",
+    "stage": "native",
+    "package": "dever-backend-bridge",
+    "target": "llvm_database_source"
+  },
+  {
+    "source": "test/llvm_external_source.rs",
+    "name": "command_binary_io_and_exit_status_use_real_typed_llvm_calls",
+    "reason": "requires fresh runtime-external archive, command-fixture and process_runtime assets",
+    "stage": "native",
+    "package": "dever-backend-bridge",
+    "target": "llvm_external_source"
   }
 ]

test/ci/run.py

@@ -17,7 +17,7 @@ sys.modules["linux_gate"] = sys.modules[__name__]
 from settings import configured_peer, write_private_json
 
 STAGES = ("static", "default", "all-features", "features", "python", "sdk",
-          "inventory", "author", "native", "postgres", "sandbox", "bounded-perf",
+          "inventory", "author", "native", "postgres", "process-runtime", "bounded-perf",
           "cms-64", "cms-128", "http2-64", "http2-128", "recovery-64", "recovery-128",
           "live-64", "live-128")
 SOURCE_ROOTS = ("crates", "test", "sdk", "library", "examples", "skills", ".cargo")

test/ci/test_gate.py

@@ -82,8 +82,8 @@ class GateTests(unittest.TestCase):
             gate.check_output("python", {"python_tests": 0}, "OK")
 
     def test_classification_rejects_unknown_duplicate_and_wrong_target(self):
-        row = {"package": "sandbox", "target": "isolation", "name": "restricted_probe", "stage": "probe"}
-        target = {"package": "sandbox", "target": "isolation"}
+        row = {"package": "process-runtime", "target": "isolation", "name": "restricted_probe", "stage": "probe"}
+        target = {"package": "process-runtime", "target": "isolation"}
         self.assertEqual(classify_cases(["restricted_probe"], [row], target)[0]["stage"], "probe")
         for names, rows, owner in ((["unknown"], [row], target), (["restricted_probe"], [row, row], target),
                                    (["restricted_probe"], [row], {**target, "target": "other"}),
@@ -135,8 +135,8 @@ class GateTests(unittest.TestCase):
                         "failed": parent_failed, "ignored": parent_ignored})
 
     def test_exact_ignored_acceptance_requires_one_successful_parent(self):
-        target = {"package": "sandbox", "target": "isolation"}
-        case = {"name": "parent", "exact": "parent", "stage": "sandbox",
+        target = {"package": "process-runtime", "target": "isolation"}
+        case = {"name": "parent", "exact": "parent", "stage": "process-runtime",
                 "target": target, "target_directory": "/unused/target"}
         for counts in ({"passed": 1, "failed": 0, "ignored": 0},
                        {"passed": 0, "failed": 0, "ignored": 0},
@@ -154,7 +154,7 @@ class GateTests(unittest.TestCase):
                 result = {"commands": []}
                 expected = counts == {"passed": 1, "failed": 0, "ignored": 0}
                 with contextlib.nullcontext() if expected else self.assertRaisesRegex(RuntimeError, "one case"):
-                    acceptance.ignored_stage("sandbox", {}, {}, Path("/unused"), result)
+                    acceptance.ignored_stage("process-runtime", {}, {}, Path("/unused"), result)
                 self.assertTrue(execute.call_args.kwargs["single_harness"])
                 self.assertEqual(len(result.get("cases", [])), int(expected))