BasedHardware
diff --git a/‎backend/scripts/verify_backend_release_vector.py‎
Lines changed: 24 additions & 2 deletions b/‎backend/scripts/verify_backend_release_vector.py‎
Lines changed: 24 additions & 2 deletions
diff --git a/‎backend/tests/unit/test_verify_backend_release_vector.py‎
Lines changed: 59 additions & 0 deletions b/‎backend/tests/unit/test_verify_backend_release_vector.py‎
Lines changed: 59 additions & 0 deletions
@@ -271,8 +271,13 @@ def evaluate_cloud_run_service(
         errors.append(f'cloud_run/{service}: template image is not {expected_image}')
     if require_serving_traffic and (not expected_traffic or _mapping(expected_traffic[0]).get('percent') != 100):
         errors.append(f'cloud_run/{service}: expected revision does not receive 100% traffic')
-    if not require_serving_traffic and any(_mapping(entry).get('percent') != 0 for entry in expected_traffic):
-        errors.append(f'cloud_run/{service}: expected revision carries traffic before promotion')
+    if not require_serving_traffic:
+        for entry in expected_traffic:
+            allocation = _effective_candidate_traffic_percent(_mapping(entry).get('percent'))
+            if allocation is None:
+                errors.append(f'cloud_run/{service}: candidate traffic allocation is ambiguous')
+            elif allocation > 0:
+                errors.append(f'cloud_run/{service}: expected revision carries traffic before promotion')
     timeout = template_spec.get('timeoutSeconds')
     if not isinstance(timeout, int) or timeout < MIN_CLOUD_RUN_TIMEOUT_SECONDS:
         errors.append(f'cloud_run/{service}: timeoutSeconds must be at least {MIN_CLOUD_RUN_TIMEOUT_SECONDS}')
@@ -432,6 +437,23 @@ def _container_env(containers: Sequence[Any]) -> dict[str, str]:
     }
 
 
+def _effective_candidate_traffic_percent(percent: Any) -> float | None:
+    """Effective default-domain allocation for a candidate traffic target.
+
+    Cloud Run omits ``percent`` (serialized as ``null``) on a tagged, no-allocation
+    candidate revision, which carries 0% of serving traffic until promotion. A real
+    non-negative numeric percent is its allocation; any other shape (bool, string,
+    negative) is ambiguous and must not be trusted as zero, so it returns ``None``
+    for the caller to reject. Only ``revisionName``-pinned targets reach this path;
+    ``latestRevision`` remainder targets never match the candidate name.
+    """
+    if percent is None:
+        return 0.0
+    if isinstance(percent, bool) or not isinstance(percent, (int, float)) or percent < 0:
+        return None
+    return float(percent)
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('--commit-sha', required=True)
 
@@ -678,6 +678,65 @@ def test_candidate_evaluation_accepts_ready_revision_before_traffic_promotion()
     assert 'cloud_run/backend: expected revision does not receive 100% traffic' in serving_errors
 
 
+def test_candidate_evaluation_accepts_a_tagged_candidate_with_omitted_percent() -> None:
+    """Regression for run 29891331283: Cloud Run serializes a tagged, no-allocation
+    candidate revision with ``percent: null`` (effective 0%). The verifier must read
+    an omitted/null percent as zero, not as pre-promotion traffic. Mirrors the exact
+    failed-development shape: prior serving revision at 100% plus the Ready candidate
+    with an omitted percent.
+    """
+    expectation = _expectation()
+    documents = _documents(expectation)
+    for service, revision in expectation.revisions.items():
+        documents[f'cloud_run/{service}']['status'].update(
+            {
+                'latestCreatedRevisionName': revision,
+                'latestReadyRevisionName': f'{service}-old',
+                'traffic': [
+                    {'revisionName': f'{service}-old', 'percent': 100},
+                    {'revisionName': revision, 'tag': 'candidate', 'percent': None},
+                ],
+            }
+        )
+        documents[f'cloud_run_revision/{service}'] = _cloud_run_revision_document(
+            image=expectation.image,
+            ready='True',
+            reason='Retired',
+        )
+
+    errors = verifier.evaluate(expectation, documents, require_serving_traffic=False)
+
+    assert errors == []
+
+    # Strict serving verification still rejects the no-traffic candidate until it is promoted to 100%.
+    serving_errors = verifier.evaluate(expectation, documents)
+    assert 'cloud_run/backend: expected revision does not receive 100% traffic' in serving_errors
+
+
+@pytest.mark.parametrize(
+    ('percent', 'expected_error'),
+    (
+        (5, 'cloud_run/backend: expected revision carries traffic before promotion'),
+        (100, 'cloud_run/backend: expected revision carries traffic before promotion'),
+        ('0', 'cloud_run/backend: candidate traffic allocation is ambiguous'),
+        (True, 'cloud_run/backend: candidate traffic allocation is ambiguous'),
+        (-1, 'cloud_run/backend: candidate traffic allocation is ambiguous'),
+    ),
+)
+def test_candidate_evaluation_rejects_positive_or_ambiguous_candidate_traffic(percent, expected_error: str) -> None:
+    expectation = _expectation()
+    documents = _documents(expectation)
+    for service in expectation.revisions:
+        documents[f'cloud_run/{service}']['status']['traffic'] = [
+            {'revisionName': f'{service}-old', 'percent': 100},
+            {'revisionName': expectation.revisions[service], 'percent': percent},
+        ]
+
+    errors = verifier.evaluate(expectation, documents, require_serving_traffic=False)
+
+    assert expected_error in errors
+
+
 @pytest.mark.parametrize(
     ('mutate', 'expected_error'),
     (