[addisdev]

What the first three nights on 0.9.0 showed (10-15 to 10-17, ultra)

• The tvOS bench ran for the first time and met phase 3's bar, just: Holo4 5/10, Qwen3.8-27B 5/10 (6/10 with the end-state fix here, re-scored from its saved trees). Numbers are in docs/deploy/explore-on-ultra.md.
• The model shelf unloaded Holo4 mid-run four times ("memory pressure: unloaded idle", 03:50 and 04:10 on 10-16, 22:33 on 10-16, 22:23 on 10-17). Later missions ended at step 0 on Invalid model identifier, and the judge filed their untouched start screens as goal findings (explore: overnight exploratory QA (workload, findings, actuators, bug garden, ultra runbook) #70, Bump fastify from 5.12.1 to 5.12.5 in /collector #71).
• Xcode on ultra updated itself to 27.1 on 10-16 without its first-launch install. Every FleetDriver start since then exits 70 with CoreSimulator is out of date. The TV and Apple nights tried every card for about ten minutes a job, failed with "see their rows", and turned model-ladder#night red. The fix needs sudo and is WB-384.
• On 10-17 Holo4 answered in prose with no tool call from step 1. Seven bug-garden missions took two steps between them. The judge filed the screens it abandoned as goal findings.

Changes

• A dropped model is loaded again. explore-night.ts --warm passes its command down as FLEET_EXPLORE_WARM. When the server says the model is gone (Invalid model identifier, Model is unloaded.), the loop runs that command and takes the step again, at most twice per mission. That step does not count against the step budget or the model.
• Only missions that drove the app get judged. A mission the model server or the device cut off is not judged, and neither is one the model abandoned (four replies with no tool call). A cut-off mission goes in a new metric, explore_cut_off (added to result.schema.json), not in explore_missions. A cut-off bench card is not scored unless it had already reached its end state.
• A bench end state is also checked on the model's last look when nothing touched the device after it. Dozehound's channel bar hides six seconds after a press.
• Xcode's first launch is checked up front. --sim asks xcodebuild -checkFirstLaunchStatus before warming the model, and fails with sudo xcodebuild -runFirstLaunch named as the fix. This only runs on macOS, and tests stub it with FLEET_XCODEBUILD. Inside a job, HostNotReadyError stops the device at the first such error.
• A failed explore job puts its device's reason in its own error.
• The explore-night log prefix is now local time.
• changelog-coverage.mjs exempts the release's own pull requests: release/* (read from the merge subject, or from gh for a squash merge) and develop → main. Release 0.9.0 #98 had to be labelled by hand.

The S8+ wake and lock-screen fix is not in this PR. It is in #100.

Test plan

• tsc --noEmit on ultra (~/fr-work/night-1016)
• scripts/check-explore.ts: 239 checks, including new ones for a dropped model, a cut-off mission, an abandoned mission, an auto-hiding end state, Xcode's first launch in the night command, and a reason on a failed job
• node --test scripts/changelog-coverage.test.mjs: 9/9. Against real history (--head origin/develop --tag v0.8.0), Release 0.9.0 #98 is exempt with no network.
• collector npm test on ultra: exit 0, every step green (dashboard build skipped, not installed there)
• A real night on ultra. That waits on WB-384 for TV and Apple; the bug garden runs tonight.

Not verified

• The re-warm path has not run against the real shelf. It is covered by a fake server that drops the model.
• The Xcode preflight has run against ultra's real Xcode only through the tests' first run, where it reported exit 69.

🤖 Generated with Claude Code

[addisdev]

Added the hold: explore-night now sets SHELF_HOLD_PID before warming, so ultra's shelf leaves the model loaded through the night once addisdev/model-ladder#31 is deployed. The re-warm stays as the fallback. check-explore.ts: 240 checks on ultra; tsc clean.

[addisdev]

Self-review: CI green on every lane (collector on 4 platforms, fleet, smokes), mergeable after the #100 merge. Checked: new metric in result.schema.json and metrics.json; changelog bullets carry #101; no API or protocol shape change; docs updated (job.md, explore-on-ultra.md, CONTRIBUTING). Re-warm and the shelf hold are covered by fakes only; first real proof is tonight's nights. Merging.

[addisdev]

Self-review: re-warm on a dropped model (bounded, off-budget), no judging of cut-off/abandoned missions, Xcode first-launch preflight, changelog-coverage exempting release PRs. The new explore_cut_off metric is accepted by a 0.9.1 brain (metrics allow unknown keys), so this deploys to ultra's checkout without a release. Checks green. Merging.