Govern rc.9 release timeout recovery

.github/workflows/create-release.yml

@@ -359,7 +359,7 @@ jobs:
       - frontend_bundle
     if: ${{ needs.prepare.outputs.historical_asset_backfill_only != 'true' }}
     runs-on: ${{ !contains(inputs.version, '-') && 'ubuntu-24.04' || fromJSON('["self-hosted","Linux","X64","pulse-pve-tests"]') }}
-    # The race-enabled API shards can consume more than 18 minutes on the PVE
+    # The rc.9 race-enabled API shards consumed more than 18 minutes on the PVE
     # runner before post-step accounting. Keep enough headroom for runner and
     # checkout cleanup so a passing suite is not recorded as cancelled.
     timeout-minutes: 30

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -756,7 +756,9 @@ artifact-selection behaviour.
    `TestServerInfoEndpointMethodNotAllowed`. The planner fails closed if those
    anchors disappear or reorder, and the manifest records them while
    continuing to prove exact ordered, complete, disjoint coverage. The backend
-   job owns a 20-minute ceiling, while each
+   job owns a 30-minute ceiling, preserving post-step and runner-cleanup
+   headroom above the 1,106-second slowest API shard observed during the first
+   `v6.4.0-rc.9` qualification attempt, while each
    invocation retains the canonical 30-minute Go timeout as protection against
    a stuck package.
    The warm-path release-control performance objective is 15 minutes or less
@@ -1851,6 +1853,18 @@ only after the release owner explicitly confirms that production credentials
 and certificate authorization are ready and a reviewed policy/code change
 restores it.
 
+The initial `v6.4.0-rc.9` qualification attempt used exact source SHA
+`dac72894a2ccaa6af2458ff88f38344cd5ce1abd`. Release run `33130438386`
+passed immutable candidate assembly, exact-version container and Helm smoke,
+asset validation, installer smoke, private Pro staging, and every backend API
+shard. The slowest shard completed in 1,106 seconds, but the 20-minute backend
+job ceiling cancelled the passing step during post-step accounting. That made
+the canonical readiness join skip and kept release `378204006` in draft
+quarantine; convergence run `33131402971` then failed closed without moving
+customer aliases or the paid-runtime broker. The governed backend ceiling is
+30 minutes before the same unpublished `v6.4.0-rc.9` draft is retried from the
+current release-line head.
+
 The preceding `v6.4.0-rc.8` qualification attempt used exact source SHA
 `bac7e5d9526d76a6b4e34738511b07609dda80ed`. Release run `33128595650`
 passed preparation, frontend bundle, Windows installer smoke, release smoke,

docs/releases/V6_CHANGELOG_v6.4.0-rc.9.md

@@ -31,6 +31,7 @@ _The `v6.4.0-rc.8` qualification attempt stopped before a public tag or GitHub r
 - Proxmox backup health, inventory refresh, offline fixtures, and drawer detail presentation retain complete current context.
 - Informational active-alert cards use the blue severity palette, while unknown severity values fail safe to warning presentation.
 - Empty Unraid storage slots no longer make an otherwise healthy array report a degraded state.
+- Release qualification reserves enough backend-runner headroom to record a completed race suite instead of cancelling during post-step accounting.
 
 ## Release Metadata
 

scripts/installtests/build_release_assets_test.go

@@ -2961,6 +2961,9 @@ func TestReleaseBackendRaceGateUsesCompletePVEPartition(t *testing.T) {
 	if !strings.Contains(backendJob, "timeout-minutes: 30") {
 		t.Fatal("release backend job must retain headroom above the measured PVE execution time")
 	}
+	if strings.Contains(backendJob, "timeout-minutes: 20") {
+		t.Fatal("release backend job must not restore the ceiling that cancelled a passing rc.9 suite")
+	}
 	if !strings.Contains(backendJob, "pulse-pve-tests") || !strings.Contains(backendJob, "run-release-backend-tests.sh") {
 		t.Fatal("release backend job must use the dedicated PVE partition runner")
 	}