@@ -18,7 +18,7 @@ superseded_by: 2026-09-07-....md  # when status is superseded
 ---
 ```
 
-360 records.
+361 records.
 
 ## By subject
 
@@ -42,6 +42,10 @@ Records that declare one. Everything else is listed by date below.
 
 - [BMI publication, compiler capacity and active download budgets](2026-11-06-bmi-publication-and-compiler-cap-closeout.md) — active
 
+### ci
+
+- [CI 与发布的时间成本：按测量调度的测试、分片、并行发布](2026-11-14-ci-and-release-time-cost-design.md) — active
+
 ### compiler-scheduling
 
 - [Compiler attempt lifetime and output recovery](2026-11-06-compiler-attempt-recovery.md) — active
@@ -193,6 +197,7 @@ Records that declare one. Everything else is listed by date below.
 
 ### 2026-11
 
+- [CI 与发布的时间成本：按测量调度的测试、分片、并行发布](2026-11-14-ci-and-release-time-cost-design.md) — active
 - [The three-plane platform architecture: mcpp × openkal × xim](2026-11-12-three-plane-platform-architecture-design.md) — superseded by [2026-11-12-ecosystem-architecture-optimization-design.md](2026-11-12-ecosystem-architecture-optimization-design.md)
 - [生态架构优化方案：四个平面的收敛、已合入项的纠正与新系统的准入（mcpp × openkal × xlings）](2026-11-12-ecosystem-architecture-optimization-design.md) — active
 - [测试与依赖解析补充方案：mcpp、mcpp test、mtest、mcpp-ide](2026-11-10-test-and-resolution-supplement-design.md) — active
 
@@ -115,15 +115,26 @@ Tag push 会自动触发 `release.yml` workflow。
 
 ### 4. 监控 Release CI
 
-Release workflow 包含**四个平台**的构建，外加一个生态发布 job：
+Release workflow 的四个平台构建**同时开始**，各自把归档留作 artifact；`create-release`
+在四个构建都通过后一次创建带全部归档的 GitHub release（设计 2026-11-14）：
 
 | Job | 平台 | 产物 | 依赖 |
 |-----|------|------|------|
-| `build-release` | Linux x86_64 | `mcpp-X.Y.Z-linux-x86_64.tar.gz` | 无（先执行） |
-| `build-linux-aarch64` | Linux aarch64（交叉） | `mcpp-X.Y.Z-linux-aarch64.tar.gz` | 等 Linux x86_64 完成 |
-| `build-macos` | macOS ARM64 | `mcpp-X.Y.Z-macosx-arm64.tar.gz` | 等 Linux 完成 |
-| `build-windows` | Windows x86_64 | `mcpp-X.Y.Z-windows-x86_64.zip` | 等 Linux 完成 |
-| `publish-ecosystem` | — | 镜像到 xlings-res 双端 + 开索引 bump PR | 等**全部四个**构建完成 |
+| `canaries` | — | 生态项目（xlings、mcppls）用候选版本构建 | 仅手动发布且勾选 `canaries` 时运行 |
+| `build-release` | Linux x86_64 | `mcpp-X.Y.Z-linux-x86_64.tar.gz`、源码包、`mcpp.lua`、`install.sh` | 无 |
+| `build-linux-aarch64` | Linux aarch64（交叉） | `mcpp-X.Y.Z-linux-aarch64.tar.gz` | 无 |
+| `build-macos` | macOS ARM64 | `mcpp-X.Y.Z-macosx-arm64.tar.gz` | 无 |
+| `build-windows` | Windows x86_64 | `mcpp-X.Y.Z-windows-x86_64.zip` | 无 |
+| `create-release` | — | GitHub release、覆盖全部归档的 `SHA256SUMS` | 四个构建（及运行时的 canaries） |
+| `release-manifest` | — | `mcpp-release.json` | `create-release` |
+| `publish-ecosystem` | — | 镜像到 xlings-res 双端 + 开索引 bump PR | `release-manifest` |
+
+canaries 默认不运行（tag push 与未勾选的手动发布）：xlings 与 mcppls 的构建约 40 分钟，
+由各项目在发布后以自己的 CI 固定新版本验证。需要在创建 release 前验证时，手动发布：
+
+```bash
+gh workflow run release.yml --repo mcpp-community/mcpp -f canaries=true
+```
 
 `build-linux-aarch64` 是两段式的（bootstrap 先构出本 release 的 x86_64 mcpp，再用它交叉构建
 aarch64），因为 bootstrap 装的是**上一个已发布版本**，可能不认新特性。
@@ -138,7 +149,7 @@ gh run view <run-id>
 # 如果失败，下载日志分析
 gh api repos/mcpp-community/mcpp/actions/runs/<run-id>/logs \
   -H "Accept: application/vnd.github+json" > /tmp/release-logs.zip
-unzip -p /tmp/release-logs.zip "build + upload (linux _ x86_64)/8_Smoke-test the bundled tarball.txt"
+unzip -p /tmp/release-logs.zip "build (linux _ x86_64)/8_Smoke-test the bundled tarball.txt"
 ```
 
 ### 5. 验证 Release 产物
@@ -189,7 +200,7 @@ release 规则验证最终资产，不要套用 Linux 的 strip 判断。
 
 ### publish-ecosystem：镜像 + 索引（发布的后半程）
 
-四个构建 job 全绿后自动执行，做两件事：
+`release-manifest` 封存之后自动执行，做两件事：
 
 1. **镜像到 `xlings-res/mcpp` 双端**（GitHub + GitCode），由
    `.github/tools/mirror_res.sh` 完成 —— 单 leg 内资产**并发上传**
 
@@ -0,0 +1,92 @@
+name: e2e-cases
+description: >
+  Named cases of the C++ e2e suite, each held to its `ok` line: a case that is
+  skipped (a capability absent, another platform) or fails fails the step, so a
+  job that exists to run a case cannot pass without running it. The cases run
+  from the test archive build.yml wrote for the host (`mcpp-tests-<host>`,
+  `mcpp test --archive`, docs/08): no job that runs them builds them, and a
+  host with Visual Studio masked could not.
+
+inputs:
+  cases:
+    description: the cases, one `<suite>/<case>` per line
+    required: true
+  mcpp:
+    description: the mcpp that runs the tests
+    required: true
+  host:
+    description: the host of the archive (linux-x86_64, windows-x86_64)
+    required: true
+  from-main:
+    description: >
+      'true': the archive of main's last successful CI run, for a workflow that
+      runs outside it (ci-fresh-install); otherwise this run's.
+    required: false
+    default: 'false'
+  under-test:
+    description: >
+      The mcpp the cases test: MCPP_E2E_MCPP, which the cases' support reads
+      before the archive's program, and MCPP_BIN_MCPP, which an archive written
+      with --no-programs takes. Empty: the archive's own build.
+    required: false
+    default: ''
+  token:
+    description: a token that reads this repository's actions
+    required: false
+    default: ${{ github.token }}
+
+runs:
+  using: composite
+  steps:
+    - name: The tests of this run
+      if: inputs.from-main != 'true'
+      uses: actions/download-artifact@v4
+      with:
+        name: mcpp-tests-${{ inputs.host }}
+        path: ${{ runner.temp }}/mcpp-tests
+
+    - name: The tests of main's last CI run
+      if: inputs.from-main == 'true'
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        HOST: ${{ inputs.host }}
+      run: |
+        set -euo pipefail
+        run=$(gh run list -R "$GITHUB_REPOSITORY" --workflow ci.yml --branch main --status success --limit 1 \
+                --json databaseId -q '.[0].databaseId')
+        [ -n "$run" ] || { echo "::error::no successful CI run of main holds the tests"; exit 1; }
+        rm -rf "$RUNNER_TEMP/mcpp-tests"
+        gh run download "$run" -R "$GITHUB_REPOSITORY" -n "mcpp-tests-$HOST" -D "$RUNNER_TEMP/mcpp-tests"
+        echo "the tests of main's run $run"
+
+    - name: The cases
+      shell: bash
+      env:
+        CASES: ${{ inputs.cases }}
+        RUNNER_MCPP: ${{ inputs.mcpp }}
+        UNDER_TEST: ${{ inputs.under-test }}
+      run: |
+        set -euo pipefail
+        cases=()
+        while IFS= read -r c; do
+          c="${c#"${c%%[![:space:]]*}"}"; c="${c%"${c##*[![:space:]]}"}"
+          if [ -n "$c" ]; then cases+=("$c"); fi
+        done <<< "$CASES"
+        [ "${#cases[@]}" -gt 0 ] || { echo "::error::no case named"; exit 1; }
+        args=(--archive "$RUNNER_TEMP/mcpp-tests/mcpp-tests.tar.gz")
+        for c in "${cases[@]}"; do args+=(--case "$c"); done
+        # The system's own spelling of the path: mcpp reads MCPP_BIN_MCPP
+        # itself, and a Windows mcpp does not read an MSYS path.
+        if [ -n "$UNDER_TEST" ]; then
+          under="$UNDER_TEST"
+          if command -v cygpath >/dev/null 2>&1; then under="$(cygpath -w "$under")"; fi
+          export MCPP_E2E_MCPP="$under" MCPP_BIN_MCPP="$under"
+        fi
+        log="$RUNNER_TEMP/e2e-cases.log"
+        status=0
+        "$RUNNER_MCPP" test "${args[@]}" 2>&1 | tee "$log" || status=$?
+        for c in "${cases[@]}"; do
+          tr -d '\r' < "$log" | grep -qxF "  ok   $c" || { echo "::error::$c did not pass (a skip or a failure; its line above)"; status=1; }
+        done
+        exit "$status"
@@ -9,7 +9,9 @@ description: >
 
 inputs:
   host:
-    description: the host's name in the stores' artifact names (linux, macos, windows)
+    description: >
+      the host's name in the stores' artifact names (linux, macos, windows), or
+      `*` for every host's (the plan of ci.yml)
     required: true
   token:
     description: a token that reads this repository's actions
@@ -55,7 +57,7 @@ runs:
     # Another host's own sources (src/native/windows/...) run on no Linux test,
     # so its suite has no map and every test of it is affected.
     - name: The coverage map
-      if: inputs.host == 'linux'
+      if: inputs.host == 'linux' || inputs.host == '*'
       shell: bash
       env:
         GH_TOKEN: ${{ inputs.token }}
 
@@ -0,0 +1,146 @@
+name: mcpp-unit
+description: >
+  The unit and C++ e2e tests by `mcpp test` (docs/08 "The order of a run";
+  design 2026-11-14): the measured history of main's last CI run taken into the
+  run store, so that the tests run longest first, a part longer than its share
+  runs as groups of its cases (`--split auto`) and `--shard` assigns tests by
+  duration; on a re-run of a failed job, only what its previous attempt failed
+  (`--failed`); the job's own runs kept as `mtest-unit-<name>-a<attempt>`.
+  Run it after use-built-mcpp, from the repository's root.
+
+inputs:
+  name:
+    description: the job's name in the stores' artifact names (linux-1, macos-15, windows)
+    required: true
+  history:
+    description: >
+      the stores of main's last CI run to read the measured durations from
+      (`mtest-unit-<history>*`); empty when the job was given its history
+      (the shards of one run take it from their archive job)
+    required: false
+    default: ''
+  archive:
+    description: the test archive to run (`mcpp test --archive`); empty to build the tests here
+    required: false
+    default: ''
+  shard:
+    description: I/N, this job's shard of the tests (`mcpp test --shard`)
+    required: false
+    default: ''
+  since:
+    description: the commit a pull request's change is read from (`mcpp test --since`)
+    required: false
+    default: ''
+  patterns:
+    description: the tests to run, as `mcpp test` patterns separated by spaces; empty for all
+    required: false
+    default: ''
+  mcpp:
+    description: the mcpp that runs the tests; empty for this commit's (MCPP_FRESH)
+    required: false
+    default: ''
+  timeout:
+    description: the seconds a test may run (`mcpp test --timeout`)
+    required: false
+    default: '1200'
+  stores:
+    description: the stores to keep, relative to the workspace, separated by spaces
+    required: false
+    default: target/mtest
+  token:
+    description: a token that reads this repository's actions
+    required: false
+    default: ${{ github.token }}
+
+runs:
+  using: composite
+  steps:
+    - name: The measured history of main's last CI run
+      if: inputs.history != ''
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        KEY: ${{ inputs.history }}
+      run: |
+        set -uo pipefail
+        py=python3; command -v python3 >/dev/null 2>&1 || py=python
+        run=$(gh run list -R "$GITHUB_REPOSITORY" --workflow ci.yml --branch main --status success --limit 1 \
+                --json databaseId -q '.[0].databaseId' 2>/dev/null || true)
+        if [ -z "$run" ]; then echo "no successful run of main: the tests run in the order they are listed"; exit 0; fi
+        d="$RUNNER_TEMP/unit-history"
+        rm -rf "$d"
+        if ! gh run download "$run" -R "$GITHUB_REPOSITORY" -p "mtest-unit-$KEY*" -D "$d" 2>/dev/null; then
+          echo "main's run $run kept no store for $KEY: the tests run in the order they are listed"; exit 0
+        fi
+        "$py" .github/tools/test_history.py take target/mtest "$d" "$d"/*/
+
+    # A RE-RUN RUNS WHAT FAILED. The store of the attempt before this one, when
+    # it kept one, names what failed; a job that failed before its tests ran
+    # kept none and runs them all again.
+    - name: The attempt before this one
+      if: github.run_attempt != '1'
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        NAME: ${{ inputs.name }}
+      run: |
+        set -uo pipefail
+        py=python3; command -v python3 >/dev/null 2>&1 || py=python
+        prev="mtest-unit-$NAME-a$((GITHUB_RUN_ATTEMPT - 1))"
+        d="$RUNNER_TEMP/unit-previous"
+        rm -rf "$d"
+        if gh run download "$GITHUB_RUN_ID" -R "$GITHUB_REPOSITORY" -n "$prev" -D "$d" 2>/dev/null \
+           && [ -f "$d/index.ndjson" ]; then
+          "$py" .github/tools/test_history.py take target/mtest "$d"
+          echo "MCPP_UNIT_FAILED=1" >> "$GITHUB_ENV"
+          echo "the attempt before kept $prev: what it failed runs again"
+        else
+          echo "the attempt before kept no store: every test runs"
+        fi
+
+    - name: The tests via `mcpp test`
+      shell: bash
+      env:
+        ARCHIVE: ${{ inputs.archive }}
+        SHARD: ${{ inputs.shard }}
+        SINCE: ${{ inputs.since }}
+        PATTERNS: ${{ inputs.patterns }}
+        TIMEOUT: ${{ inputs.timeout }}
+        RUNS: ${{ inputs.mcpp }}
+      run: |
+        set -euo pipefail
+        args=(test --timeout "$TIMEOUT" --split auto)
+        # THE PROGRAM THE TESTS RUN IS THIS COMMIT'S, AS BUILD.YML BUILT IT
+        # (rule R1): it is not built again here (`--no-programs`), and an
+        # archive written without it takes it from the same variable. A native
+        # path: on Windows the variable is read by mcpp and the tests, not bash.
+        fresh="$MCPP_FRESH"
+        if command -v cygpath >/dev/null 2>&1; then fresh="$(cygpath -w "$fresh")"; fi
+        export MCPP_BIN_MCPP="${MCPP_BIN_MCPP:-$fresh}"
+        if [ -n "$ARCHIVE" ]; then args+=(--archive "$ARCHIVE"); else args+=(--no-programs); fi
+        if [ -n "${MCPP_UNIT_FAILED:-}" ]; then
+          args+=(--failed)
+        else
+          [ -z "$SHARD" ] || args+=(--shard "$SHARD")
+          [ -z "$SINCE" ] || args+=(--since "$SINCE")
+          # shellcheck disable=SC2206 -- the patterns are words
+          [ -z "$PATTERNS" ] || args+=($PATTERNS)
+        fi
+        echo "mcpp ${args[*]}"
+        "${RUNS:-$MCPP_FRESH}" "${args[@]}"
+
+    # The job's own runs, and not the history it was given, are kept.
+    - name: The runs of this job
+      if: always()
+      shell: bash
+      env:
+        STORES: ${{ inputs.stores }}
+      run: |
+        py=python3; command -v python3 >/dev/null 2>&1 || py=python
+        for s in $STORES; do [ ! -d "$s" ] || "$py" .github/tools/test_history.py own "$s" "$GITHUB_RUN_ID"; done
+
+    - uses: ./.github/actions/test-report
+      if: always()
+      with:
+        name: mtest-unit-${{ inputs.name }}-a${{ github.run_attempt }}
+        stores: ${{ inputs.stores }}
@@ -88,7 +88,8 @@ if [ -n "$tc" ]; then
 fi
 
 {
-    echo "MCPP_BOOT=$boot"
+    # The released binary install_pinned_mcpp.sh named, when it named one.
+    echo "MCPP_BOOT=${MCPP_BOOT:-$boot}"
     echo "MCPP=$bin"
     echo "MCPP_FRESH=$bin"
     if [ -n "${XLINGS_BIN:-}" ]; then echo "MCPP_VENDORED_XLINGS=$XLINGS_BIN"; fi
 
@@ -1,8 +1,10 @@
 # Release canaries (the 2026-09-28 ecosystem design, WS10).
 #
 # Projects of this ecosystem built with the candidate mcpp before a release is
-# tagged: release.yml runs .github/workflows/release-canaries.yml first, and a
-# canary that fails blocks the tag.
+# created: a release started by hand with `canaries` (release.yml) runs
+# .github/workflows/release-canaries.yml beside its builds, and a canary that
+# fails blocks the release. A tag pushed, or a release started without it,
+# runs none (design 2026-11-14: their build took 48 of 109 minutes).
 #
 # Only the ecosystem's own repositories are canaries. A downstream project (a
 # user's application, or a fork of one) validates a release in its own pull
 
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# THE PROGRAM A BUILD MADE, AS THE BUILD REPORTS IT.
+#
+#   built_artifact.sh <mcpp> <name> [build arguments...]
+#
+# Runs `<mcpp> build --message-format json [arguments]` and prints the absolute
+# path of the artifact named <name>, from the build's `artifact` events
+# (docs/50-machine-output.md §9): one line per product, whose object has one
+# `path`. Read with grep and sed (`-E`, as GNU and BSD sed read it), so that a
+# machine with no JSON reader (the hermetic container) can ask it. The build's narration stays on standard
+# error. A failed build, or one that reports no such artifact, exits non-zero.
+#
+# Instead of a search of target/: a self-hosting build keeps the engine it
+# runs under target/<triple>/<fingerprint>/engine/epoch-N/mcpp, and a search
+# for a file named mcpp took that copy (an x86_64 program) for the product of
+# an aarch64 build (2026-11-14).
+set -euo pipefail
+[ $# -ge 2 ] || { echo "usage: $0 <mcpp> <name> [build arguments...]" >&2; exit 2; }
+mcpp=$1; name=$2; shift 2
+report=$(mktemp)
+trap 'rm -f "$report"' EXIT
+"$mcpp" build --message-format json "$@" > "$report"
+found=$(grep -F '"event":"artifact"' "$report" | grep -F "\"name\":\"$name\"" \
+          | sed -nE 's/.*"path":"(([^"\\]|\\.)*)".*/\1/p' | tail -1 | sed 's/\\\\/\\/g' || true)
+[ -n "$found" ] || { echo "the build reported no artifact named $name" >&2; exit 1; }
+printf '%s\n' "$found"
Original file line number	Diff line number	Diff line change
`@@ -88,7 +88,8 @@ if [ -n "$tc" ]; then`
`88`	`88`	`fi`
`89`	`89`
`90`	`90`	`{`
`91`		`- echo "MCPP_BOOT=$boot"`
	`91`	`+ # The released binary install_pinned_mcpp.sh named, when it named one.`
	`92`	`+ echo "MCPP_BOOT=${MCPP_BOOT:-$boot}"`
`92`	`93`	`echo "MCPP=$bin"`
`93`	`94`	`echo "MCPP_FRESH=$bin"`
`94`	`95`	`if [ -n "${XLINGS_BIN:-}" ]; then echo "MCPP_VENDORED_XLINGS=$XLINGS_BIN"; fi`
Original file line number	Diff line number	Diff line change
`@@ -1,8 +1,10 @@`
`1`	`1`	`# Release canaries (the 2026-09-28 ecosystem design, WS10).`
`2`	`2`	`#`
`3`	`3`	`# Projects of this ecosystem built with the candidate mcpp before a release is`
`4`		`-# tagged: release.yml runs .github/workflows/release-canaries.yml first, and a`
`5`		`-# canary that fails blocks the tag.`
	`4`	+# created: a release started by hand with `canaries` (release.yml) runs
	`5`	`+# .github/workflows/release-canaries.yml beside its builds, and a canary that`
	`6`	`+# fails blocks the release. A tag pushed, or a release started without it,`
	`7`	`+# runs none (design 2026-11-14: their build took 48 of 109 minutes).`
`6`	`8`	`#`
`7`	`9`	`# Only the ecosystem's own repositories are canaries. A downstream project (a`
`8`	`10`	`# user's application, or a fork of one) validates a release in its own pull`