From 1c65afdd283a5c513add113979f313d260ad4b91 Mon Sep 17 00:00:00 2001
From: Roman Kennke <roman.kennke@datadoghq.com>
Date: Mon, 9 Nov 2026 19:21:28 +0000
Subject: [PATCH 1/3] Trigger the speedlab memory gate from branch pipelines

A manual memory-gate job triggers speedlab's memory gate with this
branch's published snapshot against main's. memory-gate:resolve pins the
candidate to the timestamped build deploy-artifact published, so a later
push cannot change what is measured, and passes it on as a dotenv
variable. The trigger job inherits no global variables, so only its own
reach speedlab. Speedlab posts the warn-only verdict on the PR. Neither job
runs on main, tags or release branches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitlab-ci.yml                                |  2 +
 .gitlab/memory-gate/.gitlab-ci.yml            | 51 +++++++++++++++
 .gitlab/memory-gate/resolve-candidate.sh      | 55 ++++++++++++++++
 .../tests/resolve_candidate_test.sh           | 62 +++++++++++++++++++
 doc/README.md                                 |  2 +-
 doc/building/TestingGuide.md                  | 15 +++++
 6 files changed, 186 insertions(+), 1 deletion(-)
 create mode 100644 .gitlab/memory-gate/.gitlab-ci.yml
 create mode 100755 .gitlab/memory-gate/resolve-candidate.sh
 create mode 100644 .gitlab/memory-gate/tests/resolve_candidate_test.sh

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 17a27d79d9..835f7f4041 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -146,6 +146,7 @@ shell-unit-tests:
     - bash .gitlab/scripts/tests/test_check_stack_top.sh
     - bash .gitlab/jdk-integration/tests/select_test_jdk_test.sh
     - bash .gitlab/dd-trace-integration/tests/post_pr_comment_test.sh
+    - bash .gitlab/memory-gate/tests/resolve_candidate_test.sh
 
 # Shared version detection used by benchmarks and reliability pipelines
 get-versions:
@@ -257,3 +258,4 @@ include:
   - local: .gitlab/dd-trace-integration/.gitlab-ci.yml
   - local: .gitlab/sanitizer-tests/.gitlab-ci.yml
   - local: .gitlab/fuzzing/.gitlab-ci.yml
+  - local: .gitlab/memory-gate/.gitlab-ci.yml
diff --git a/.gitlab/memory-gate/.gitlab-ci.yml b/.gitlab/memory-gate/.gitlab-ci.yml
new file mode 100644
index 0000000000..f4e532967a
--- /dev/null
+++ b/.gitlab/memory-gate/.gitlab-ci.yml
@@ -0,0 +1,51 @@
+# Memory gate: speedlab (DataDog/apm-reliability/speedlab, docs/memory-gate.md)
+# compares spring-petclinic's memory with this branch's java-profiler build against
+# main's, and posts a warn-only verdict on the PR. Manual: play `memory-gate`.
+
+.memory-gate-rules:
+  rules:
+    - !reference [.skip-on-release, rules]
+    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH == "main"'
+      when: never  # main against itself measures nothing
+
+# Pins the snapshot deploy-artifact published, for the trigger job's variables.
+memory-gate:resolve:
+  stage: benchmarks
+  needs:
+    - job: deploy-artifact
+      artifacts: true
+  image: ${PREPARE_IMAGE}
+  tags: ["arch:amd64"]
+  rules:
+    - !reference [.memory-gate-rules, rules]
+    - when: on_success
+  script:
+    - bash .gitlab/memory-gate/resolve-candidate.sh version.txt memory-gate.env
+  artifacts:
+    reports:
+      dotenv: memory-gate.env
+
+memory-gate:
+  stage: benchmarks
+  needs:
+    - job: memory-gate:resolve
+      artifacts: true
+  rules:
+    - !reference [.memory-gate-rules, rules]
+    - when: manual
+      allow_failure: true
+  # Only the variables below reach speedlab: its jobs read ours, and upstream
+  # variables would override their own settings.
+  inherit:
+    variables: false
+  variables:
+    SPEEDLAB_TRIGGER: java-profiler-memory-gate
+    PROFILER_CANDIDATE: $MEMORY_GATE_CANDIDATE
+    PROFILER_BASELINE: branch:main
+    UPSTREAM_PROJECT_NAME: java-profiler
+    UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME
+    UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA
+  trigger:
+    project: DataDog/apm-reliability/speedlab
+    # speedlab's trigger rules are on this branch until DataDog/speedlab#109 merges.
+    branch: rkennke/memory-gate-trigger
diff --git a/.gitlab/memory-gate/resolve-candidate.sh b/.gitlab/memory-gate/resolve-candidate.sh
new file mode 100755
index 0000000000..48c69ffbef
--- /dev/null
+++ b/.gitlab/memory-gate/resolve-candidate.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Copyright 2026, Datadog, Inc.
+#
+# Writes the memory gate's candidate, this pipeline's published snapshot build
+# pinned by its timestamp, as a dotenv file for the speedlab trigger job:
+#   MEMORY_GATE_CANDIDATE=snapshot:1.54.0-my_branch-20261109.101500-3
+# A branch selector would be resolved again in speedlab and could pick a newer
+# push; the timestamped build cannot change.
+#
+# Usage: resolve-candidate.sh <version.txt> <dotenv out> [maven-metadata.xml]
+# version.txt is deploy-artifact's ("com.datadoghq:ddprof:<version>"). The
+# metadata file defaults to the snapshot repository's for that version.
+set -euo pipefail
+
+# The main jar's timestamped build in a snapshot's maven-metadata.xml (stdin):
+# the last <snapshotVersion> with no classifier and extension jar.
+latest_jar_build() {
+  awk '
+    /<snapshotVersion>/ { classifier=""; extension=""; value="" }
+    /<classifier>/ { classifier=$0; gsub(/.*<classifier>|<\/classifier>.*/, "", classifier) }
+    /<extension>/ { extension=$0; gsub(/.*<extension>|<\/extension>.*/, "", extension) }
+    /<value>/ { value=$0; gsub(/.*<value>|<\/value>.*/, "", value) }
+    /<\/snapshotVersion>/ { if (classifier == "" && extension == "jar") last=value }
+    END { print last }
+  '
+}
+
+main() {
+  local version_file=$1 out=$2 metadata=${3:-}
+  local version
+  version=$(sed -n 's/^com\.datadoghq:ddprof://p' "$version_file")
+  if [[ "$version" != *-SNAPSHOT ]]; then
+    echo "ERROR: '${version}' from ${version_file} is not a snapshot version" >&2
+    return 1
+  fi
+  local build
+  if [ -n "$metadata" ]; then
+    build=$(latest_jar_build < "$metadata")
+  else
+    build=$(curl -fsSL --connect-timeout 10 --max-time 30 \
+      "https://central.sonatype.com/repository/maven-snapshots/com/datadoghq/ddprof/${version}/maven-metadata.xml" \
+      | latest_jar_build)
+  fi
+  # The build is the version with -SNAPSHOT replaced by <date>.<time>-<n>.
+  if [[ ! "$build" =~ ^${version%-SNAPSHOT}-[0-9]{8}\.[0-9]{6}-[0-9]+$ ]]; then
+    echo "ERROR: no timestamped jar build of ${version} in the snapshot metadata (got '${build}')" >&2
+    return 1
+  fi
+  echo "MEMORY_GATE_CANDIDATE=snapshot:${build}" > "$out"
+  echo "Memory gate candidate: snapshot:${build}"
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+  main "$@"
+fi
diff --git a/.gitlab/memory-gate/tests/resolve_candidate_test.sh b/.gitlab/memory-gate/tests/resolve_candidate_test.sh
new file mode 100644
index 0000000000..c6b5ffaa1c
--- /dev/null
+++ b/.gitlab/memory-gate/tests/resolve_candidate_test.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Copyright 2026, Datadog, Inc.
+#
+# Tests for .gitlab/memory-gate/resolve-candidate.sh on sample snapshot metadata.
+# Run with: bash .gitlab/memory-gate/tests/resolve_candidate_test.sh
+set -uo pipefail
+
+HERE=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+SCRIPT="${HERE}/../resolve-candidate.sh"
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+FAILED=0
+
+pass() { echo "PASS: $1"; }
+fail() { echo "FAIL: $1"; FAILED=1; }
+
+# Sample maven-metadata.xml: two builds, the newer one listed last, each with a
+# debug and a sources classifier besides the main jar.
+metadata() {
+  cat <<EOF
+<metadata><versioning><snapshotVersions>
+<snapshotVersion><classifier>debug</classifier><extension>jar</extension><value>$1-20261108.090000-1</value></snapshotVersion>
+<snapshotVersion><extension>jar</extension><value>$1-20261108.090000-1</value></snapshotVersion>
+<snapshotVersion><classifier>debug</classifier><extension>jar</extension><value>$1-20261109.101500-2</value></snapshotVersion>
+<snapshotVersion><extension>jar</extension><value>$1-20261109.101500-2</value></snapshotVersion>
+<snapshotVersion><extension>pom</extension><value>$1-20261109.101500-2</value></snapshotVersion>
+<snapshotVersion><classifier>sources</classifier><extension>jar</extension><value>$1-20261109.101500-2</value></snapshotVersion>
+</snapshotVersions></versioning></metadata>
+EOF
+}
+
+echo "com.datadoghq:ddprof:1.54.0-my_branch-SNAPSHOT" > "$TMP/version.txt"
+metadata 1.54.0-my_branch > "$TMP/metadata.xml"
+if bash "$SCRIPT" "$TMP/version.txt" "$TMP/out.env" "$TMP/metadata.xml" >/dev/null &&
+   [ "$(cat "$TMP/out.env")" = "MEMORY_GATE_CANDIDATE=snapshot:1.54.0-my_branch-20261109.101500-2" ]; then
+  pass "pins the newest timestamped main-jar build"
+else
+  fail "pins the newest timestamped main-jar build (got: $(cat "$TMP/out.env" 2>/dev/null))"
+fi
+
+echo "com.datadoghq:ddprof:1.54.0" > "$TMP/release.txt"
+if bash "$SCRIPT" "$TMP/release.txt" "$TMP/release.env" "$TMP/metadata.xml" 2>/dev/null; then
+  fail "rejects a release version"
+else
+  pass "rejects a release version"
+fi
+
+metadata 1.54.0-other_branch > "$TMP/other.xml"
+if bash "$SCRIPT" "$TMP/version.txt" "$TMP/other.env" "$TMP/other.xml" 2>/dev/null; then
+  fail "rejects metadata of another version"
+else
+  pass "rejects metadata of another version"
+fi
+
+echo "<metadata><versioning><snapshotVersions></snapshotVersions></versioning></metadata>" > "$TMP/empty.xml"
+if bash "$SCRIPT" "$TMP/version.txt" "$TMP/empty.env" "$TMP/empty.xml" 2>/dev/null; then
+  fail "rejects metadata without a main jar"
+else
+  pass "rejects metadata without a main jar"
+fi
+
+exit $FAILED
diff --git a/doc/README.md b/doc/README.md
index ee502772a4..cf1fbf22da 100644
--- a/doc/README.md
+++ b/doc/README.md
@@ -38,7 +38,7 @@ All documentation files use **PascalCase** naming (e.g., `BuildSystemGuide.md`).
 - [GradleTasks](building/GradleTasks.md) - Available Gradle tasks reference
 - [JdkUpgrades](building/JdkUpgrades.md) - Two-JDK pattern and JDK upgrade touchpoints
 - [NativeBuildPlugin](building/NativeBuildPlugin.md) - Native C++ compilation plugin
-- [TestingGuide](building/TestingGuide.md) - Test strategy: tiers, sanitizers, CI layout, and local workflows
+- [TestingGuide](building/TestingGuide.md) - Test strategy: tiers, sanitizers, CI layout (including the speedlab memory gate), and local workflows
 - [Versioning](building/Versioning.md) - Version computation from git tags
 
 ### Reference
diff --git a/doc/building/TestingGuide.md b/doc/building/TestingGuide.md
index 8c025ad493..cf4cb82c24 100644
--- a/doc/building/TestingGuide.md
+++ b/doc/building/TestingGuide.md
@@ -15,6 +15,7 @@ they require:
 | **Java functional tests** | GitHub Actions | Every PR/push (debug); nightly (ASan, slow tests) | ASan (nightly or `test:asan` label) | Correctness + memory errors in JVMTI paths |
 | **dd-trace integration** | GitLab | Every branch push (not `release/*`) | None | Compatibility with the tracer agent |
 | **Chaos / reliability** | GitLab | Scheduled pipelines; PRs with `test:reliability` label | None | Long-duration stability and probabilistic crash detection |
+| **Memory gate** | GitLab → speedlab | Manual (`memory-gate` job) on branch pipelines | None | Memory overhead of the branch's build against `main`'s |
 
 ---
 
@@ -264,6 +265,20 @@ run in the `shell-unit-tests` job.
 
 ---
 
+## Memory Gate (speedlab, Manual)
+
+**Pipeline:** `.gitlab/memory-gate/.gitlab-ci.yml`, `benchmarks` stage
+
+`memory-gate:resolve` pins the snapshot `deploy-artifact` just published
+(`resolve-candidate.sh`). The manual `memory-gate` job then triggers speedlab
+(`DataDog/apm-reliability/speedlab`). There, spring-petclinic runs six interleaved
+pairs with this build and `main`'s, in a low-noise allocator setting. Speedlab
+posts a warn-only verdict on the PR: a regression is a 95% interval above zero
+with a mean of at least 3 MiB. It catches about 5 MiB reliably; changes in
+retained free memory show only in part. Setting, calibration and limits are in
+speedlab's `docs/memory-gate.md`. The jobs do not run on `main`, tags or
+`release/*`.
+
 ## Why the Split
 
 | Bug class | Caught by |

From 1155d8a8aa5362d99980d8084dcec2b8d0ea421e Mon Sep 17 00:00:00 2001
From: Roman Kennke <roman.kennke@datadoghq.com>
Date: Mon, 9 Nov 2026 19:54:39 +0000
Subject: [PATCH 2/3] Pin the memory gate candidate in deploy-artifact

deploy-artifact already finds and verifies the snapshot build it publishes,
so deploy.sh now records it as MEMORY_GATE_CANDIDATE in a dotenv report
(write_memory_gate_candidate in includes.sh), and the memory-gate trigger
job reads it from there. This replaces memory-gate:resolve, which re-read
the snapshot metadata in every PR pipeline: it could pin another push's
build from stale metadata, rejected branch names with regex characters,
and could turn the pipeline red although the gate is manual. The trigger
job now also skips merge-queue branches, scheduled and merge-request
pipelines and jdk-integration triggers, like the benchmarks jobs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitlab-ci.yml                                |  1 -
 .gitlab/build-deploy/.gitlab-ci.yml           |  3 +
 .gitlab/memory-gate/.gitlab-ci.yml            | 41 +++++-------
 .gitlab/memory-gate/resolve-candidate.sh      | 55 ----------------
 .../tests/resolve_candidate_test.sh           | 62 -------------------
 .gitlab/scripts/deploy.sh                     |  2 +
 .gitlab/scripts/includes.sh                   |  8 +++
 .gitlab/scripts/tests/includes_test.sh        | 11 ++++
 doc/building/TestingGuide.md                  | 11 ++--
 9 files changed, 45 insertions(+), 149 deletions(-)
 delete mode 100755 .gitlab/memory-gate/resolve-candidate.sh
 delete mode 100644 .gitlab/memory-gate/tests/resolve_candidate_test.sh

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 835f7f4041..a5e057be48 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -146,7 +146,6 @@ shell-unit-tests:
     - bash .gitlab/scripts/tests/test_check_stack_top.sh
     - bash .gitlab/jdk-integration/tests/select_test_jdk_test.sh
     - bash .gitlab/dd-trace-integration/tests/post_pr_comment_test.sh
-    - bash .gitlab/memory-gate/tests/resolve_candidate_test.sh
 
 # Shared version detection used by benchmarks and reliability pipelines
 get-versions:
diff --git a/.gitlab/build-deploy/.gitlab-ci.yml b/.gitlab/build-deploy/.gitlab-ci.yml
index 3b2df7626d..d9127cfaee 100644
--- a/.gitlab/build-deploy/.gitlab-ci.yml
+++ b/.gitlab/build-deploy/.gitlab-ci.yml
@@ -366,6 +366,9 @@ deploy-artifact:
     name: java-profiler-published.zip
     paths:
       - version.txt
+    # MEMORY_GATE_CANDIDATE, the build just published, for the memory-gate trigger.
+    reports:
+      dotenv: memory-gate.env
     expire_in: 7 days
 
 
diff --git a/.gitlab/memory-gate/.gitlab-ci.yml b/.gitlab/memory-gate/.gitlab-ci.yml
index f4e532967a..09cad04cbb 100644
--- a/.gitlab/memory-gate/.gitlab-ci.yml
+++ b/.gitlab/memory-gate/.gitlab-ci.yml
@@ -1,37 +1,26 @@
 # Memory gate: speedlab (DataDog/apm-reliability/speedlab, docs/memory-gate.md)
 # compares spring-petclinic's memory with this branch's java-profiler build against
 # main's, and posts a warn-only verdict on the PR. Manual: play `memory-gate`.
-
-.memory-gate-rules:
-  rules:
-    - !reference [.skip-on-release, rules]
-    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH == "main"'
-      when: never  # main against itself measures nothing
-
-# Pins the snapshot deploy-artifact published, for the trigger job's variables.
-memory-gate:resolve:
-  stage: benchmarks
-  needs:
-    - job: deploy-artifact
-      artifacts: true
-  image: ${PREPARE_IMAGE}
-  tags: ["arch:amd64"]
-  rules:
-    - !reference [.memory-gate-rules, rules]
-    - when: on_success
-  script:
-    - bash .gitlab/memory-gate/resolve-candidate.sh version.txt memory-gate.env
-  artifacts:
-    reports:
-      dotenv: memory-gate.env
-
+# The candidate is the snapshot build deploy-artifact published and verified
+# (MEMORY_GATE_CANDIDATE, its dotenv report), so a later push cannot change it.
 memory-gate:
   stage: benchmarks
   needs:
-    - job: memory-gate:resolve
+    - job: deploy-artifact
       artifacts: true
+  # Where deploy-artifact publishes nothing (no open PR, merge queue, release
+  # branches) or the gate measures nothing (main against itself), as for the
+  # benchmarks jobs in .gitlab/benchmarks/.gitlab-ci.yml.
   rules:
-    - !reference [.memory-gate-rules, rules]
+    - !reference [.skip-on-release, rules]
+    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH == "main"'
+      when: never
+    - if: '$JDK_VERSION != null || $DEBUG_LEVEL != null || $HASH != null || $DOWNSTREAM != null'
+      when: never
+    - if: '$CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH =~ /^mq-working-branch-/'
+      when: never
     - when: manual
       allow_failure: true
   # Only the variables below reach speedlab: its jobs read ours, and upstream
diff --git a/.gitlab/memory-gate/resolve-candidate.sh b/.gitlab/memory-gate/resolve-candidate.sh
deleted file mode 100755
index 48c69ffbef..0000000000
--- a/.gitlab/memory-gate/resolve-candidate.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2026, Datadog, Inc.
-#
-# Writes the memory gate's candidate, this pipeline's published snapshot build
-# pinned by its timestamp, as a dotenv file for the speedlab trigger job:
-#   MEMORY_GATE_CANDIDATE=snapshot:1.54.0-my_branch-20261109.101500-3
-# A branch selector would be resolved again in speedlab and could pick a newer
-# push; the timestamped build cannot change.
-#
-# Usage: resolve-candidate.sh <version.txt> <dotenv out> [maven-metadata.xml]
-# version.txt is deploy-artifact's ("com.datadoghq:ddprof:<version>"). The
-# metadata file defaults to the snapshot repository's for that version.
-set -euo pipefail
-
-# The main jar's timestamped build in a snapshot's maven-metadata.xml (stdin):
-# the last <snapshotVersion> with no classifier and extension jar.
-latest_jar_build() {
-  awk '
-    /<snapshotVersion>/ { classifier=""; extension=""; value="" }
-    /<classifier>/ { classifier=$0; gsub(/.*<classifier>|<\/classifier>.*/, "", classifier) }
-    /<extension>/ { extension=$0; gsub(/.*<extension>|<\/extension>.*/, "", extension) }
-    /<value>/ { value=$0; gsub(/.*<value>|<\/value>.*/, "", value) }
-    /<\/snapshotVersion>/ { if (classifier == "" && extension == "jar") last=value }
-    END { print last }
-  '
-}
-
-main() {
-  local version_file=$1 out=$2 metadata=${3:-}
-  local version
-  version=$(sed -n 's/^com\.datadoghq:ddprof://p' "$version_file")
-  if [[ "$version" != *-SNAPSHOT ]]; then
-    echo "ERROR: '${version}' from ${version_file} is not a snapshot version" >&2
-    return 1
-  fi
-  local build
-  if [ -n "$metadata" ]; then
-    build=$(latest_jar_build < "$metadata")
-  else
-    build=$(curl -fsSL --connect-timeout 10 --max-time 30 \
-      "https://central.sonatype.com/repository/maven-snapshots/com/datadoghq/ddprof/${version}/maven-metadata.xml" \
-      | latest_jar_build)
-  fi
-  # The build is the version with -SNAPSHOT replaced by <date>.<time>-<n>.
-  if [[ ! "$build" =~ ^${version%-SNAPSHOT}-[0-9]{8}\.[0-9]{6}-[0-9]+$ ]]; then
-    echo "ERROR: no timestamped jar build of ${version} in the snapshot metadata (got '${build}')" >&2
-    return 1
-  fi
-  echo "MEMORY_GATE_CANDIDATE=snapshot:${build}" > "$out"
-  echo "Memory gate candidate: snapshot:${build}"
-}
-
-if [ "${BASH_SOURCE[0]}" = "$0" ]; then
-  main "$@"
-fi
diff --git a/.gitlab/memory-gate/tests/resolve_candidate_test.sh b/.gitlab/memory-gate/tests/resolve_candidate_test.sh
deleted file mode 100644
index c6b5ffaa1c..0000000000
--- a/.gitlab/memory-gate/tests/resolve_candidate_test.sh
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2026, Datadog, Inc.
-#
-# Tests for .gitlab/memory-gate/resolve-candidate.sh on sample snapshot metadata.
-# Run with: bash .gitlab/memory-gate/tests/resolve_candidate_test.sh
-set -uo pipefail
-
-HERE=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-SCRIPT="${HERE}/../resolve-candidate.sh"
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-FAILED=0
-
-pass() { echo "PASS: $1"; }
-fail() { echo "FAIL: $1"; FAILED=1; }
-
-# Sample maven-metadata.xml: two builds, the newer one listed last, each with a
-# debug and a sources classifier besides the main jar.
-metadata() {
-  cat <<EOF
-<metadata><versioning><snapshotVersions>
-<snapshotVersion><classifier>debug</classifier><extension>jar</extension><value>$1-20261108.090000-1</value></snapshotVersion>
-<snapshotVersion><extension>jar</extension><value>$1-20261108.090000-1</value></snapshotVersion>
-<snapshotVersion><classifier>debug</classifier><extension>jar</extension><value>$1-20261109.101500-2</value></snapshotVersion>
-<snapshotVersion><extension>jar</extension><value>$1-20261109.101500-2</value></snapshotVersion>
-<snapshotVersion><extension>pom</extension><value>$1-20261109.101500-2</value></snapshotVersion>
-<snapshotVersion><classifier>sources</classifier><extension>jar</extension><value>$1-20261109.101500-2</value></snapshotVersion>
-</snapshotVersions></versioning></metadata>
-EOF
-}
-
-echo "com.datadoghq:ddprof:1.54.0-my_branch-SNAPSHOT" > "$TMP/version.txt"
-metadata 1.54.0-my_branch > "$TMP/metadata.xml"
-if bash "$SCRIPT" "$TMP/version.txt" "$TMP/out.env" "$TMP/metadata.xml" >/dev/null &&
-   [ "$(cat "$TMP/out.env")" = "MEMORY_GATE_CANDIDATE=snapshot:1.54.0-my_branch-20261109.101500-2" ]; then
-  pass "pins the newest timestamped main-jar build"
-else
-  fail "pins the newest timestamped main-jar build (got: $(cat "$TMP/out.env" 2>/dev/null))"
-fi
-
-echo "com.datadoghq:ddprof:1.54.0" > "$TMP/release.txt"
-if bash "$SCRIPT" "$TMP/release.txt" "$TMP/release.env" "$TMP/metadata.xml" 2>/dev/null; then
-  fail "rejects a release version"
-else
-  pass "rejects a release version"
-fi
-
-metadata 1.54.0-other_branch > "$TMP/other.xml"
-if bash "$SCRIPT" "$TMP/version.txt" "$TMP/other.env" "$TMP/other.xml" 2>/dev/null; then
-  fail "rejects metadata of another version"
-else
-  pass "rejects metadata of another version"
-fi
-
-echo "<metadata><versioning><snapshotVersions></snapshotVersions></versioning></metadata>" > "$TMP/empty.xml"
-if bash "$SCRIPT" "$TMP/version.txt" "$TMP/empty.env" "$TMP/empty.xml" 2>/dev/null; then
-  fail "rejects metadata without a main jar"
-else
-  pass "rejects metadata without a main jar"
-fi
-
-exit $FAILED
diff --git a/.gitlab/scripts/deploy.sh b/.gitlab/scripts/deploy.sh
index 689f51bb05..1169b0d593 100755
--- a/.gitlab/scripts/deploy.sh
+++ b/.gitlab/scripts/deploy.sh
@@ -90,6 +90,8 @@ if [ "$MODE" = "publish" ] || [ "$MODE" = "all" ]; then
         JAR_URL="https://central.sonatype.com/repository/maven-snapshots/com/datadoghq/ddprof/${LIB_VERSION}/ddprof-${SNAPSHOT_VER}-debug.jar"
         if curl -fsSL "${CURL_TIMEOUT_OPTS[@]}" -o /dev/null "${JAR_URL}"; then
           echo "Snapshot artifact resolvable: ${JAR_URL}"
+          # For the speedlab memory gate trigger (.gitlab/memory-gate/), as a dotenv report.
+          write_memory_gate_candidate "${SNAPSHOT_VER}" memory-gate.env
           RESOLVED=1
           break
         fi
diff --git a/.gitlab/scripts/includes.sh b/.gitlab/scripts/includes.sh
index 781e1bb463..1e9c1948fe 100755
--- a/.gitlab/scripts/includes.sh
+++ b/.gitlab/scripts/includes.sh
@@ -52,6 +52,14 @@ function is_new_snapshot_version() {
   [ -n "${candidate}" ] && [ "${candidate}" != "${baseline}" ]
 }
 
+# Writes the speedlab memory gate's candidate, the snapshot build deploy.sh just
+# published and verified, as a dotenv line to $2. $1 is that build's version in
+# maven-metadata.xml, e.g. 1.54.0-my_branch-20261109.101500-3.
+function write_memory_gate_candidate() {
+  [ -n "$1" ] || return 1
+  echo "MEMORY_GATE_CANDIDATE=snapshot:$1" > "$2"
+}
+
 function collect_artifacts() {
   local target=$1
   local artifact_type=$2  # "test" or "stresstest"
diff --git a/.gitlab/scripts/tests/includes_test.sh b/.gitlab/scripts/tests/includes_test.sh
index 93a08a3d87..af3e78b64b 100644
--- a/.gitlab/scripts/tests/includes_test.sh
+++ b/.gitlab/scripts/tests/includes_test.sh
@@ -51,4 +51,15 @@ assert_false "empty candidate is rejected" \
 assert_true "non-empty candidate with empty baseline is accepted" \
   is_new_snapshot_version "20260101.120000-5" ""
 
+# The memory gate pins the build deploy.sh published, never an empty selector.
+TMP_ENV=$(mktemp)
+assert_true "writes the published build as the memory gate candidate" \
+  write_memory_gate_candidate "1.54.0-my_branch-20261109.101500-3" "${TMP_ENV}"
+assert_true "the candidate is the build's snapshot selector" \
+  grep -qx "MEMORY_GATE_CANDIDATE=snapshot:1.54.0-my_branch-20261109.101500-3" "${TMP_ENV}"
+: > "${TMP_ENV}"
+assert_false "an empty build is rejected" write_memory_gate_candidate "" "${TMP_ENV}"
+assert_false "an empty build writes nothing" test -s "${TMP_ENV}"
+rm -f "${TMP_ENV}"
+
 exit "${FAILED}"
diff --git a/doc/building/TestingGuide.md b/doc/building/TestingGuide.md
index cf4cb82c24..7d219221e3 100644
--- a/doc/building/TestingGuide.md
+++ b/doc/building/TestingGuide.md
@@ -269,15 +269,16 @@ run in the `shell-unit-tests` job.
 
 **Pipeline:** `.gitlab/memory-gate/.gitlab-ci.yml`, `benchmarks` stage
 
-`memory-gate:resolve` pins the snapshot `deploy-artifact` just published
-(`resolve-candidate.sh`). The manual `memory-gate` job then triggers speedlab
-(`DataDog/apm-reliability/speedlab`). There, spring-petclinic runs six interleaved
+`deploy-artifact` records the snapshot build it published and verified
+(`MEMORY_GATE_CANDIDATE`, a dotenv report written by `deploy.sh`). The manual
+`memory-gate` job then triggers speedlab (`DataDog/apm-reliability/speedlab`)
+with that build, so a later push cannot change what is measured. There, spring-petclinic runs six interleaved
 pairs with this build and `main`'s, in a low-noise allocator setting. Speedlab
 posts a warn-only verdict on the PR: a regression is a 95% interval above zero
 with a mean of at least 3 MiB. It catches about 5 MiB reliably; changes in
 retained free memory show only in part. Setting, calibration and limits are in
-speedlab's `docs/memory-gate.md`. The jobs do not run on `main`, tags or
-`release/*`.
+speedlab's `docs/memory-gate.md`. The job does not run on `main`, tags,
+`release/*`, merge-queue branches or scheduled pipelines.
 
 ## Why the Split
 

From 7383d3e4baf7670b285edaa6cbdd7f7e13cd539c Mon Sep 17 00:00:00 2001
From: Roman Kennke <roman.kennke@datadoghq.com>
Date: Mon, 9 Nov 2026 19:58:07 +0000
Subject: [PATCH 3/3] Make the memory gate candidate write non-fatal and share
 the benchmark skip rules

The publish has already succeeded when deploy.sh records the candidate, so a
failed write now only warns instead of failing deploy-artifact. The trigger
job reuses .benchmarks-skip-rules (including its CANCELLED and merge-queue
rules) and checks main by CI_COMMIT_REF_NAME, which is set for triggered
pipelines too. The docs state that two near-simultaneous pushes to one
branch can record the other push's build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitlab/build-deploy/.gitlab-ci.yml |  1 +
 .gitlab/memory-gate/.gitlab-ci.yml  | 18 ++++++------------
 .gitlab/scripts/deploy.sh           |  4 +++-
 doc/building/TestingGuide.md        | 18 +++++++++++-------
 4 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/.gitlab/build-deploy/.gitlab-ci.yml b/.gitlab/build-deploy/.gitlab-ci.yml
index d9127cfaee..e03584d21d 100644
--- a/.gitlab/build-deploy/.gitlab-ci.yml
+++ b/.gitlab/build-deploy/.gitlab-ci.yml
@@ -367,6 +367,7 @@ deploy-artifact:
     paths:
       - version.txt
     # MEMORY_GATE_CANDIDATE, the build just published, for the memory-gate trigger.
+    # Absent, with an upload warning, where no snapshot is published (tags, no PR).
     reports:
       dotenv: memory-gate.env
     expire_in: 7 days
diff --git a/.gitlab/memory-gate/.gitlab-ci.yml b/.gitlab/memory-gate/.gitlab-ci.yml
index 09cad04cbb..faa5cf6d69 100644
--- a/.gitlab/memory-gate/.gitlab-ci.yml
+++ b/.gitlab/memory-gate/.gitlab-ci.yml
@@ -2,24 +2,18 @@
 # compares spring-petclinic's memory with this branch's java-profiler build against
 # main's, and posts a warn-only verdict on the PR. Manual: play `memory-gate`.
 # The candidate is the snapshot build deploy-artifact published and verified
-# (MEMORY_GATE_CANDIDATE, its dotenv report), so a later push cannot change it.
+# (MEMORY_GATE_CANDIDATE, its dotenv report), not whatever is newest at run time.
 memory-gate:
   stage: benchmarks
   needs:
     - job: deploy-artifact
       artifacts: true
-  # Where deploy-artifact publishes nothing (no open PR, merge queue, release
-  # branches) or the gate measures nothing (main against itself), as for the
-  # benchmarks jobs in .gitlab/benchmarks/.gitlab-ci.yml.
+  # As the benchmarks jobs, plus main (against itself it measures nothing). Rules
+  # cannot see prepare.sh's CANCELLED (a dotenv variable): without an open PR the
+  # job is offered but has no candidate, and speedlab rejects the run.
   rules:
-    - !reference [.skip-on-release, rules]
-    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH == "main"'
-      when: never
-    - if: '$JDK_VERSION != null || $DEBUG_LEVEL != null || $HASH != null || $DOWNSTREAM != null'
-      when: never
-    - if: '$CI_PIPELINE_SOURCE == "schedule" || $CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: never
-    - if: '$CI_COMMIT_BRANCH =~ /^mq-working-branch-/'
+    - !reference [.benchmarks-skip-rules, rules]
+    - if: '$CI_COMMIT_TAG || $CI_COMMIT_REF_NAME == "main"'
       when: never
     - when: manual
       allow_failure: true
diff --git a/.gitlab/scripts/deploy.sh b/.gitlab/scripts/deploy.sh
index 1169b0d593..afb5bc2aeb 100755
--- a/.gitlab/scripts/deploy.sh
+++ b/.gitlab/scripts/deploy.sh
@@ -91,7 +91,9 @@ if [ "$MODE" = "publish" ] || [ "$MODE" = "all" ]; then
         if curl -fsSL "${CURL_TIMEOUT_OPTS[@]}" -o /dev/null "${JAR_URL}"; then
           echo "Snapshot artifact resolvable: ${JAR_URL}"
           # For the speedlab memory gate trigger (.gitlab/memory-gate/), as a dotenv report.
-          write_memory_gate_candidate "${SNAPSHOT_VER}" memory-gate.env
+          # The publish already succeeded: a failed write must not fail the job.
+          write_memory_gate_candidate "${SNAPSHOT_VER}" memory-gate.env \
+            || echo "WARNING: could not record the memory gate candidate"
           RESOLVED=1
           break
         fi
diff --git a/doc/building/TestingGuide.md b/doc/building/TestingGuide.md
index 7d219221e3..98fa3bd096 100644
--- a/doc/building/TestingGuide.md
+++ b/doc/building/TestingGuide.md
@@ -272,13 +272,17 @@ run in the `shell-unit-tests` job.
 `deploy-artifact` records the snapshot build it published and verified
 (`MEMORY_GATE_CANDIDATE`, a dotenv report written by `deploy.sh`). The manual
 `memory-gate` job then triggers speedlab (`DataDog/apm-reliability/speedlab`)
-with that build, so a later push cannot change what is measured. There, spring-petclinic runs six interleaved
-pairs with this build and `main`'s, in a low-noise allocator setting. Speedlab
-posts a warn-only verdict on the PR: a regression is a 95% interval above zero
-with a mean of at least 3 MiB. It catches about 5 MiB reliably; changes in
-retained free memory show only in part. Setting, calibration and limits are in
-speedlab's `docs/memory-gate.md`. The job does not run on `main`, tags,
-`release/*`, merge-queue branches or scheduled pipelines.
+with that build. Two pushes to one branch that publish at nearly the same time
+can make it record the other push's build. There, spring-petclinic runs six
+interleaved pairs with this build and `main`'s, in a low-noise allocator
+setting. Speedlab posts a warn-only verdict on the PR: a regression is a 95%
+interval above zero with a mean of at least 3 MiB. It catches about 5 MiB
+reliably; changes in retained free memory show only in part. Setting,
+calibration and limits are in speedlab's `docs/memory-gate.md`. The job skips
+the cases the benchmarks jobs skip (merge queue, `release/*`, schedules), plus
+`main` and tags; without an open PR there is no candidate to compare.
+
+---
 
 ## Why the Split