elanous 0.2.10 → 0.2.12

package/scripts/release-loop/cut-branch.ts

@@ -0,0 +1,84 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+
+export interface CutBranchOptions { version: string; base: string; pick: string[]; dryRun?: boolean; repoRoot?: string; log?: (line: string) => void }
+
+// git-spawn-allow: release branch operations happen only in an isolated temporary worktree; main is never checked out or changed.
+function git(repo: string, args: string[]): string {
+  const result = spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  if (result.status !== 0 || result.error) throw new Error(`git ${args[0]} failed: ${(result.stderr || result.error || result.stdout || 'no output').toString().trim()}`);
+  return result.stdout.trim();
+}
+
+function ancestor(repo: string, sha: string, ref: string): boolean {
+  const result = spawnSync('git', ['merge-base', '--is-ancestor', sha, ref], { cwd: repo });
+  if (result.status !== 0 && result.status !== 1) throw new Error(`git merge-base failed: ${result.error || result.stderr || 'unknown'}`);
+  return result.status === 0;
+}
+
+export function cutReleaseBranch(opts: CutBranchOptions): { branch: string; commit: string | null; dryRun: boolean } {
+  const repo = resolve(opts.repoRoot ?? process.cwd());
+  const branch = `release/${opts.version}`;
+  const log = opts.log ?? console.log;
+  const report = (event: 'created' | 'refused' | 'conflict', reason?: string, commit?: string) =>
+    debug.log('release-loop.cut-branch', event, { version: opts.version, branch, ...(commit ? { commit } : {}), ...(reason ? { reason } : {}) });
+  try {
+    if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(opts.version)) throw new Error(`invalid release version: ${opts.version}`);
+    if (!opts.pick.length) throw new Error('at least one --pick commit is required');
+    for (const sha of [opts.base, ...opts.pick]) if (!/^[0-9a-f]{7,40}$/i.test(sha)) throw new Error(`invalid commit SHA: ${sha}`);
+    git(repo, ['fetch', 'origin', 'main']);
+    const base = git(repo, ['rev-parse', '--verify', `${opts.base}^{commit}`]);
+    if (!ancestor(repo, base, 'origin/main')) throw new Error(`base ${base} is not an ancestor of origin/main`);
+    const picks = opts.pick.map((sha) => git(repo, ['rev-parse', '--verify', `${sha}^{commit}`]));
+    for (const sha of picks) if (!ancestor(repo, sha, 'origin/main')) throw new Error(`pick ${sha} is not an ancestor of origin/main`);
+    for (const sha of picks) if (ancestor(repo, sha, base)) throw new Error(`pick ${sha} is already in base ${base}`);
+    if (new Set(picks).size !== picks.length) throw new Error('duplicate --pick commit');
+    for (const sha of picks) if (git(repo, ['rev-list', '--parents', '-n', '1', sha]).split(' ').length !== 2) throw new Error(`pick ${sha} must have exactly one parent`);
+    if (git(repo, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`])) throw new Error(`${branch} already exists on origin`);
+    if (spawnSync('git', ['show-ref', '--verify', '--quiet', `refs/heads/${branch}`], { cwd: repo }).status === 0) throw new Error(`${branch} already exists locally`);
+    const pkg = JSON.parse(git(repo, ['show', `${base}:package.json`])) as { version?: unknown };
+    if (pkg.version !== opts.version) throw new Error(`base package.json version ${pkg.version} is not ${opts.version}`);
+    log(`${branch}: ${base} + ${picks.join(' + ')}${opts.dryRun ? ' (dry-run)' : ''}`);
+    if (opts.dryRun) return { branch, commit: null, dryRun: true };
+    const temp = mkdtempSync(join(tmpdir(), 'release-cut-branch-'));
+    const tree = join(temp, 'tree');
+    let added = false;
+    let commit: string | undefined;
+    try {
+      git(repo, ['worktree', 'add', '--detach', tree, base]);
+      added = true;
+      for (const sha of picks) {
+        try { git(tree, ['cherry-pick', sha]); }
+        catch (error) {
+          const files = git(tree, ['diff', '--name-only', '--diff-filter=U']);
+          if (!files) throw error;
+          report('conflict', `cherry-pick ${sha}`);
+          throw new Error(`cherry-pick ${sha} 충돌 — 손으로 풀 곳: ${files.split('\n').join(', ')} (release/${opts.version} 가지는 만들지 않음)`);
+        }
+      }
+      commit = git(tree, ['rev-parse', 'HEAD']);
+      const finalPackage = JSON.parse(git(tree, ['show', 'HEAD:package.json'])) as { version?: unknown };
+      if (finalPackage.version !== opts.version) throw new Error(`picked branch package.json version ${finalPackage.version} is not ${opts.version}`);
+    } finally {
+      try {
+        if (added) git(repo, ['worktree', 'remove', '--force', tree]);
+      } finally { rmSync(temp, { recursive: true, force: true }); }
+    }
+    if (!commit) throw new Error('cherry-pick produced no commit');
+    const push = git(repo, ['push', '--porcelain', `--force-with-lease=refs/heads/${branch}:`, 'origin', `${commit}:refs/heads/${branch}`]);
+    const newBranch = push.split('\n').some((line) => {
+      const [flag, ref, summary] = line.split('\t');
+      return flag === '*' && ref?.endsWith(`:refs/heads/${branch}`) && summary === '[new branch]';
+    });
+    if (!newBranch) throw new Error(`${branch} already exists on origin (push did not create a new branch)`);
+    report('created', undefined, commit);
+    log(`${branch} → ${commit}`);
+    return { branch, commit, dryRun: false };
+  } catch (error) {
+    if (!(error instanceof Error && error.message.includes('충돌'))) report('refused', error instanceof Error ? error.message : String(error));
+    throw error;
+  }
+}

package/scripts/release-loop/gate-node.ts

@@ -124,14 +124,16 @@ export const POD_MEMORY_SOURCE = 'docs/measurements/td1-whole-gate-mechanical-20
 /** GT1 — files per retry chunk when a root shard fails (0.2.7: bundles of 54+ files OOMed at 16Gi, smaller passed). */
 export const POD_SHARD_FILE_CAP = 27;
 
-export const POD_SWEEP_INTEGRATION_ONLY: readonly string[] = ['scripts/install.test.ts'];
-/** Whole-repository audits run alone in the nightly test-diet graph, not in release-gate shards. */
+// review-model-ab: Pod 에서 출력 없이 멈춤 2/2(10-04 0.2.11 · 로컬 단독 4/0 · 1.7s) — GATE-STALL 수리 전까지 Pod 밖.
+export const POD_SWEEP_INTEGRATION_ONLY: readonly string[] = ['scripts/install.test.ts', 'scripts/review-model-ab.test.ts'];
+/** Nightly-only whole-repository cases; gate runs the fixture cases in these same files. */
 export const GATE_NIGHTLY_AUDITS: readonly string[] = [
-  'test/f12-sweep.test.ts', // Sweeps the whole repository; 7.8 GB even after TD1a.
-  'scripts/unwired-exports.test.ts', // Compiles and scans all exports; 9.9 GB.
-  'test/guardian/dispatch-surface-contract.test.ts', // Compiles repository-wide dispatch contracts; 8.3 GB.
-  'test/pwa-build-typecheck.test.ts', // Builds and typechecks the whole PWA; 4.2 GB.
-  'test/user-config-mcp.test.ts', // 2.1 GB peak; keep the gate below the 2 GB audit budget.
+  // Replaces F12's real-repo bucket B apps/pwa scope check and its whole-repo export partition check.
+  'test/f12-sweep.test.ts',
+  // Replaces unwired-exports' real src/oauth caller check and its src/ad-pipeline CLI scan.
+  'scripts/unwired-exports.test.ts',
+  // Replaces pwa-build-typecheck's full root tsc and PWA tsc sweeps (PWA build also runs in the release loop).
+  'test/pwa-build-typecheck.test.ts',
 ];
 const tail40 = (output: string) => output.trimEnd().split(/\r?\n/).slice(-40).join('\n');
 const lastStartedTestFile = (output: string, paths: string[]): string | undefined => {
@@ -219,15 +221,15 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     // CDP 시험은 `test:deterministic` 이 스스로 뺀다 — 조각에 그것만 남으면 bun «시험 없음» exit 1 을 «불완전»으로 읽었다(09-30 G1d 실측 둘).
     // bun 의 탐색은 숨은 디렉터리(`.x/`)를 안 연다 — 사람의 `bun test` 가 한 번도 안 돌리는 빈 픽스처가 조각에 혼자 남아 «Ran 0 tests» 를 «불완전»으로 읽었다(09-30 G1e 5번 조각).
     const assignable = files.filter((file) => !cdpPatterns.includes(file) && !POD_SWEEP_INTEGRATION_ONLY.includes(file)
-      && !GATE_NIGHTLY_AUDITS.includes(file) && !file.split('/').some((part) => part.startsWith('.')));
+      && !file.split('/').some((part) => part.startsWith('.')));
     const integrationOnly = files.filter((file) => POD_SWEEP_INTEGRATION_ONLY.includes(file));
     if (integrationOnly.length) debug.log('release-loop.gate', 'pod-sweep-integration-only', { files: integrationOnly });
-    const nightlyAudits = files.filter((file) => GATE_NIGHTLY_AUDITS.includes(file));
-    if (nightlyAudits.length) debug.log('release-loop.gate', 'pod-sweep-nightly-audit', { files: nightlyAudits });
     if (!assignable.length) throw new Error('sweep incomplete: no tests ran');
     const durations = pod.durationSource ? readFileDurations(pod.durationSource) : new Map<string, number>();
     const memory = readFileMemory(join(tree, POD_MEMORY_SOURCE));
-    const heavy = new Set(assignable.filter((file) => (memory.get(file) ?? 0) >= POD_HEAVY_FILE_MB));
+    // The TD1 measurements predate the fixture-only gate; do not isolate those five files at their old 2–13 GB peaks.
+    const fixtureOnly = new Set([...GATE_NIGHTLY_AUDITS, 'test/guardian/dispatch-surface-contract.test.ts', 'test/user-config-mcp.test.ts']);
+    const heavy = new Set(assignable.filter((file) => !fixtureOnly.has(file) && (memory.get(file) ?? 0) >= POD_HEAVY_FILE_MB));
     const light = assignable.filter((file) => !heavy.has(file));
     const shards = [
       ...(light.length ? planShards(light, durations, shardCount) : []),
@@ -266,7 +268,7 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
     }, 0);
     const knownTimes = assignable.map((file) => durations.get(file)).filter((value): value is number => value !== undefined && Number.isFinite(value) && value >= 0).sort((a, b) => a - b);
     const unknownSeconds = knownTimes.length ? (knownTimes[Math.floor((knownTimes.length - 1) / 2)]! + knownTimes[Math.floor(knownTimes.length / 2)]!) / 2 : 1;
-    const runShard = async (paths: string[], shard: number, depth = 0, branch = ''): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
+    const runShard = async (paths: string[], shard: number, depth = 0, branch = '', retriedNoOutput = false): Promise<{ runs: ShardRun[]; stalled: NonNullable<GateResult['stalledShards']> }> => {
       const ignores = cdpPatterns.filter((pattern) => paths.includes(pattern))
         .flatMap((pattern) => ['--path-ignore-patterns', pattern]);
       // 파일별 소요는 junit 으로 남긴다 — 콘솔 요약(판정 원천)은 그대로이고, 느린 시험 목록(K10 D4)·계층 분리(D2)의 자가 된다.
@@ -353,6 +355,11 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
           }
         }
       }
+      if (reason === 'no-output' && !retriedNoOutput) {
+        const retry = await runShard(paths, shard, depth, `${branch}-retry`, true);
+        debug.log('release-loop.gate', 'pod-shard-retry', { shard, files: paths, reason, outcome: retry.stalled[0]?.reason ?? 'ok' });
+        return retry;
+      }
       if (reason) {
         // 깊이 2 에서 «이름 없는 실패»·«불완전»도 파일 단위로 가른다 — 아니면 149파일 조각의 실패 하나가 끝까지 주인 없이 남는다(09-30 G1e 7번 조각: 요약 28 · 이름 27).
         // 로그 없이 죽은 조각(`no-output` · OOM)도 같다 — 09-30 G1f ② 4-0-0 은 150파일이 격리 0 으로 남았다.
@@ -437,9 +444,9 @@ export function createGateRunner(repo: string, remote?: string, commandOverride?
       const outputs: string[] = [];
       let total = { pass: 0, fail: 0, errors: 0, ran: 0, files: 0 };
       for (const group of groups) {
-        if (!group.paths.length || !files.some((f) => !GATE_NIGHTLY_AUDITS.includes(f) && group.paths.some((p) => f === p || f.startsWith(`${p}/`)))) continue;
+        if (!group.paths.length || !files.some((f) => group.paths.some((p) => f === p || f.startsWith(`${p}/`)))) continue;
         const start = Date.now();
-        const groupIgnores = [...new Set([...cdpPatterns, ...GATE_NIGHTLY_AUDITS])]
+        const groupIgnores = [...new Set(cdpPatterns)]
           .filter((pattern) => files.includes(pattern) && group.paths.some((p) => pattern === p || pattern.startsWith(`${p}/`)))
           .flatMap((pattern) => ['--path-ignore-patterns', pattern]);
         const run = await command('bun', ['run', 'test:deterministic', ...groupIgnores, ...group.paths.map(asPath)], tree);
@@ -508,7 +515,7 @@ function readBaseline(root: string, version: string): { commit: string; failures
   return record;
 }
 
-function baselineCommit(root: string, version: string): string {
+export function baselineCommit(root: string, version: string): string {
   const path = join(root, 'release', version, 'release.json');
   const manifest: unknown = JSON.parse(readFileSync(path, 'utf8'));
   const commit = manifest && typeof manifest === 'object' && 'sourceCommit' in manifest ? manifest.sourceCommit : undefined;

package/scripts/release-loop/mac-smoke-node.ts

@@ -0,0 +1,229 @@
+#!/usr/bin/env bun
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join, posix, resolve } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import { getUserConfig } from '../../src/user-config.js';
+import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
+import { getElanousConfigDirOverride } from '../../src/elanous-config-dir.js';
+import { baselineCommit } from './gate-node.js';
+import { diffFailures, junitFailures } from './gate-diff.js';
+import { finishNode, readGraphContext, runCommand, type CommandResult, type CommandRunner, type GraphContext } from './node-verdict.js';
+
+const sha = /^[a-f0-9]{7,40}$/i;
+const testFile = /\.test\.tsx?$/;
+const hostName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const quote = (s: string) => `'${s.replaceAll("'", "'\\''")}'`;
+
+export interface MacSmokeDeps {
+  context?: GraphContext;
+  configHost?: () => unknown;
+  baseline?: (version: string) => string;
+  changedFiles?: (baseline: string, commit: string) => string[];
+  findImporters?: (sources: string[], commit: string) => string[];
+  repo?: string;
+}
+
+export interface MacSmokeResult extends Record<string, unknown> {
+  outcome: 'ok' | 'fail' | 'error';
+  verdict: 'pass' | 'fail';
+  summary: string;
+  files: number;
+  newFailures: number;
+  preexisting: number;
+  smoke: 'pass' | 'fail' | 'unmeasured' | 'skipped';
+}
+
+function requireOk(result: CommandResult, stage: string): string {
+  if (result.status !== 0) throw new Error(`${stage} 실패`);
+  return result.stdout;
+}
+
+function names(output: string): string[] {
+  return output.split('\0').filter(Boolean);
+}
+
+function safeFile(file: string): boolean {
+  return !file.startsWith('/') && !file.split('/').includes('..') && /^[\w./@+-]+$/.test(file);
+}
+
+function changedTests(run: CommandRunner, repo: string, base: string, cut: string): string[] {
+  return names(requireOk(run('git', ['diff', '--name-only', '-z', `${base}..${cut}`], repo), '변경 파일 조회'));
+}
+
+function importers(run: CommandRunner, repo: string, sources: string[], commit: string): string[] {
+  const picked = new Set<string>();
+  for (const source of sources) {
+    const stem = source.replace(/\.(?:tsx?|jsx?|mjs|cjs)$/, '');
+    const directoryIndex = basename(stem) === 'index' ? posix.dirname(stem) : undefined;
+    const search = run('git', ['grep', '-l', '-z', '-F', '-e', basename(stem), '-e', source, '-e', stem, ...(directoryIndex ? ['-e', directoryIndex] : []), commit, '--', '*.test.ts', '*.test.tsx'], repo);
+    // git grep returns 1 for no matches; other errors mean the selection could not be measured.
+    if (search.status !== 0 && search.status !== 1) throw new Error('시험 import 검색 실패');
+    for (const entry of names(search.stdout)) {
+      if (!entry.startsWith(`${commit}:`)) throw new Error('시험 import 경로 측정 불가');
+      const file = entry.slice(commit.length + 1);
+      if (!safeFile(file) || !testFile.test(file)) throw new Error('시험 import 경로 측정 불가');
+      const contents = requireOk(run('git', ['show', `${commit}:${file}`], repo), '컷 시험 읽기');
+      if (contents.includes(source)) { picked.add(file); continue; }
+      for (const match of contents.matchAll(/(?:\bfrom\s*|\bimport\s*(?:\(\s*)?|\brequire\s*\()\s*['"]([^'"]+)['"]/g)) {
+        const spec = match[1]!;
+        const target = spec.startsWith('.') ? posix.normalize(posix.join(posix.dirname(file), spec)) : spec.replace(/^@\//, '');
+        const targetStem = target.replace(/\.(?:tsx?|jsx?|mjs|cjs)$/, '');
+        if (target === source || targetStem === stem || (directoryIndex && targetStem === directoryIndex)) { picked.add(file); break; }
+      }
+    }
+  }
+  return [...picked];
+}
+
+// Collection proof comes from bun's junit file (one top-level <testsuite file=…> per collected file):
+// non-TTY bun prints no per-file headers when everything passes, so stdout cannot prove which files ran (10-03 real run).
+export function testFailures(result: CommandResult, junit: string | null, selected: string[]): string[] {
+  const output = `${result.stdout}\n${result.stderr}`.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
+  const summary = /Ran \d+ tests? across (\d+) files?/.exec(output);
+  if (junit === null || result.status === null || !summary || Number(summary[1]) !== selected.length) throw new Error('시험 결과 측정 불가');
+  const observed = new Set<string>();
+  let depth = 0;
+  for (const match of junit.matchAll(/<(\/?)testsuite\b([^>]*?)(\/?)>/g)) {
+    const [, closing, attrs, selfClosing] = match;
+    if (closing) { depth = Math.max(0, depth - 1); continue; }
+    if (depth === 0) {
+      const file = /\bfile="([^"]*)"/.exec(attrs!)?.[1] ?? /\bname="([^"]*)"/.exec(attrs!)?.[1];
+      if (file) observed.add(file.replace(/^\.\//, ''));
+    }
+    if (!selfClosing) depth += 1;
+  }
+  const failures = junitFailures(junit);
+  if (observed.size !== selected.length || selected.some((file) => !observed.has(file))
+    || (result.status !== 0 && failures.length === 0)) {
+    throw new Error('시험 결과 측정 불가');
+  }
+  return failures;
+}
+
+export function runMacSmoke(run: CommandRunner = runCommand, deps: MacSmokeDeps = {}): MacSmokeResult {
+  const start = Date.now();
+  let version = '';
+  let host = '';
+  let files = 0;
+  let newFailures = 0;
+  let preexisting = 0;
+  let smoke: MacSmokeResult['smoke'] = 'unmeasured';
+  let result: MacSmokeResult;
+  let work: string | undefined;
+  let cutCreated = false;
+  let baseCreated = false;
+  let remote = '';
+  let remoteAttempt = false;
+  const repo = resolve(deps.repo ?? process.cwd());
+  const command = (cmd: string, args: string[], cwd: string, timeoutMs?: number): CommandResult => host === 'local'
+    ? run(cmd, args, cwd, timeoutMs)
+    : run('ssh', [host, `PATH="$HOME/.bun/bin:$HOME/.local/bin:$PATH"; export PATH; cd ${quote(cwd)} && ${[cmd, ...args].map(quote).join(' ')}`], undefined, timeoutMs);
+  try {
+    const context = deps.context ?? readGraphContext();
+    version = context.input.version;
+    const configured = context.input.macSmokeHost ?? (deps.configHost ?? (() => (getUserConfig().raw.release as { macSmoke?: { host?: unknown } } | undefined)?.macSmoke?.host))();
+    if (configured === undefined || configured === null || configured === '') {
+      smoke = 'skipped';
+      result = { outcome: 'ok', verdict: 'pass', summary: 'macOS 대상 없음 — 건너뜀', files, newFailures, preexisting, smoke };
+    } else {
+      if (typeof configured !== 'string' || !hostName.test(configured)) throw new Error('macSmokeHost 호스트 이름이 유효하지 않음');
+      host = configured;
+      const commit = context.input.commit ?? context.outputs['version-release']?.commit;
+      if (typeof commit !== 'string' || !sha.test(commit)) throw new Error('컷 커밋 없음 또는 유효하지 않음 — 측정 불가');
+      const platform = host === 'local' ? run('uname', ['-s'], repo) : run('ssh', [host, 'uname -s'], repo);
+      if (requireOk(platform, '호스트 플랫폼 확인').trim() !== 'Darwin') throw new Error('macOS 호스트 아님 — 측정 불가');
+      const instance = effectiveInstanceRoot();
+      const root = getElanousConfigDirOverride() ? instance : releaseLedgerRoot();
+      const base = (deps.baseline ?? ((v) => baselineCommit(existsSync(join(root, 'release', v, 'release.json')) ? root : instance, v)))(context.input.previousVersion);
+      if (!sha.test(base)) throw new Error('지난 판 커밋 측정 불가');
+      const changed = (deps.changedFiles ?? ((b, c) => changedTests(run, repo, b, c)))(base, commit);
+      if (!changed.every(safeFile)) throw new Error('변경 파일 경로 측정 불가');
+      const sources = changed.filter((file) => /\.(?:tsx?|jsx?|mjs|cjs)$/.test(file) && !testFile.test(file));
+      const candidates = [...new Set([...changed.filter((file) => testFile.test(file)), ...(deps.findImporters ?? ((paths, revision) => importers(run, repo, paths, revision)))(sources, commit)])].sort();
+      if (!candidates.every(safeFile)) throw new Error('시험 파일 경로 측정 불가');
+      const cutFiles = new Set(requireOk(run('git', ['ls-tree', '-r', '--name-only', '-z', commit], repo), '컷 파일 조회').split('\0'));
+      const selected = candidates.filter((file) => cutFiles.has(file));
+      const clipped = Math.max(0, selected.length - 200);
+      const tests = selected.slice(0, 200);
+      files = tests.length;
+      const baseFiles = new Set(requireOk(run('git', ['ls-tree', '-r', '--name-only', '-z', base], repo), '기준 파일 조회').split('\0'));
+      work = mkdtempSync(join(tmpdir(), 'release-mac-smoke-'));
+      let source = repo;
+      if (host !== 'local') {
+        remoteAttempt = true;
+        remote = requireOk(run('ssh', [host, 'mktemp -d /tmp/release-mac-smoke-XXXXXXXX'], repo), '호스트 연결').trim();
+        if (!/^\/tmp\/release-mac-smoke-[\w-]+$/.test(remote)) throw new Error('원격 임시 경로 측정 불가');
+        requireOk(command('git', ['init', '--bare', `${remote}/mirror.git`], remote), '원격 저장소 생성');
+        for (const revision of new Set([commit, base])) {
+          requireOk(run('git', ['push', `${host}:${remote}/mirror.git`, `${revision}:refs/heads/mac-smoke-${revision}`], repo), '원격 커밋 전송');
+        }
+        requireOk(command('git', ['clone', '-q', '--no-checkout', `${remote}/mirror.git`, `${remote}/repo`], remote), '원격 복제');
+        source = `${remote}/repo`;
+      }
+      const cutTree = host === 'local' ? join(work, 'cut') : `${remote}/cut`;
+      requireOk(command('git', ['-C', source, 'worktree', 'add', '--detach', cutTree, commit], source), '체크아웃');
+      cutCreated = true;
+      requireOk(command('bun', ['install'], cutTree), '설치');
+      const execute = (tree: string, paths: string[]): string[] => {
+        const failures: string[] = [];
+        for (let i = 0; i < paths.length; i += 50) {
+          const batch = paths.slice(i, i + 50);
+          const report = `.mac-smoke-junit-${i}.xml`;
+          // `./` makes each path exact — bare paths are substring filters and also run same-named copies (10-03 nested worktrees).
+          const tested = command('bun', ['test', '--reporter=junit', `--reporter-outfile=${report}`, ...batch.map((file) => `./${file}`)], tree, 1_200_000);
+          const xml = command('cat', [report], tree);
+          failures.push(...testFailures(tested, xml.status === 0 ? xml.stdout : null, batch));
+        }
+        return failures;
+      };
+      const cutFailures = execute(cutTree, tests);
+      const versionSmoke = command('bun', ['bin/elanous.mjs', '--test', '--version'], cutTree);
+      const scheduleSmoke = command('bun', ['bin/elanous.mjs', '--test', 'release', 'schedule', 'list', '--json'], cutTree);
+      smoke = versionSmoke.status === 0 && scheduleSmoke.status === 0 ? 'pass' : 'fail';
+      let baselineFailures: string[] = [];
+      if (cutFailures.length) {
+        const baseTree = host === 'local' ? join(work, 'base') : `${remote}/base`;
+        requireOk(command('git', ['-C', source, 'worktree', 'add', '--detach', baseTree, base], source), '기준 체크아웃');
+        baseCreated = true;
+        requireOk(command('bun', ['install'], baseTree), '기준 설치');
+        baselineFailures = execute(baseTree, tests.filter((file) => baseFiles.has(file)));
+      }
+      const delta = diffFailures(cutFailures, baselineFailures);
+      newFailures = delta.newFailures.length;
+      preexisting = delta.common.length;
+      const outcome = newFailures || smoke !== 'pass' ? 'fail' : 'ok';
+      result = { outcome, verdict: outcome === 'ok' ? 'pass' : 'fail', files, newFailures, preexisting, smoke,
+        summary: `macOS ${outcome} · 새 실패 ${newFailures} · 기존 실패 ${preexisting} · 스모크 ${smoke}${clipped ? ` · 잘림 ${clipped}` : ''}${newFailures ? ` · ${delta.newFailures.slice(0, 5).map((id) => id.split(' > ')[0]).join(', ')}` : ''}` };
+    }
+  } catch {
+    result = { outcome: 'error', verdict: 'fail', summary: 'macOS 측정 불가 (연결·체크아웃·설치·시험 결과 확인 필요)', files, newFailures, preexisting, smoke };
+  } finally {
+    if (remoteAttempt && remote) {
+      try {
+        const cleanup = run('ssh', [host, `rm -rf -- ${quote(remote)}`]);
+        if (cleanup.status !== 0) result = { outcome: 'error', verdict: 'fail', summary: 'macOS 측정 불가 (임시 작업 정리 실패)', files, newFailures, preexisting, smoke };
+      } catch { result = { outcome: 'error', verdict: 'fail', summary: 'macOS 측정 불가 (임시 작업 정리 실패)', files, newFailures, preexisting, smoke }; }
+    }
+    if (work) {
+      if (host === 'local') {
+        for (const tree of [cutCreated && 'cut', baseCreated && 'base'].filter((name): name is string => Boolean(name))) {
+          try {
+            const removed = run('git', ['worktree', 'remove', '--force', join(work, tree)], repo);
+            if (removed.status !== 0) result = { outcome: 'error', verdict: 'fail', summary: 'macOS 측정 불가 (임시 작업 정리 실패)', files, newFailures, preexisting, smoke };
+          } catch { result = { outcome: 'error', verdict: 'fail', summary: 'macOS 측정 불가 (임시 작업 정리 실패)', files, newFailures, preexisting, smoke }; }
+        }
+      }
+      try { rmSync(work, { recursive: true, force: true }); }
+      catch { result = { outcome: 'error', verdict: 'fail', summary: 'macOS 측정 불가 (임시 작업 정리 실패)', files, newFailures, preexisting, smoke }; }
+    }
+    debug.log('release-loop.mac-smoke', 'judged', { version, host, files, newFailures, smoke, outcome: result!.outcome, ms: Date.now() - start });
+  }
+  return result!;
+}
+
+if (import.meta.main) {
+  let version = '';
+  try { version = readGraphContext().input.version; process.exitCode = finishNode('mac-smoke', version, runMacSmoke()); }
+  catch { process.exitCode = finishNode('mac-smoke', version, { outcome: 'error', verdict: 'fail', summary: 'macOS 측정 불가' }); }
+}

package/scripts/release-loop/node-verdict.ts

@@ -33,9 +33,9 @@ export function emitNodeResult<T extends Record<string, unknown>>(result: T & {
 }
 
 export interface CommandResult { status: number | null; stdout: string; stderr: string }
-export type CommandRunner = (command: string, args: string[], cwd?: string) => CommandResult;
-export const runCommand: CommandRunner = (command, args, cwd) => {
-  const result = spawnSync(command, args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+export type CommandRunner = (command: string, args: string[], cwd?: string, timeoutMs?: number) => CommandResult;
+export const runCommand: CommandRunner = (command, args, cwd, timeoutMs) => {
+  const result = spawnSync(command, args, { cwd, timeout: timeoutMs, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
   return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr || (result.error ? String(result.error) : '') };
 };
 

package/scripts/release-loop/ops-upgrade-node.ts

@@ -1,12 +1,43 @@
 #!/usr/bin/env bun
-import { existsSync, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import { existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
 import { join, isAbsolute } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { errorResult, finishNode, lastResult, nodeOutput, readGraphContext, runCommand, type CommandResult, type CommandRunner } from './node-verdict.js';
 
 interface HostResult { host: string; ok: boolean; before: string; after: string; error?: string; skipped?: string; hooks?: string; restart?: 'no-service' }
-interface OpsUpgradeDeps { exists?: (path: string) => boolean; installSource?: () => string | null }
+/** Where the internal feed is packed from: a checkout of the release tag, never the run's working tree. */
+export interface FeedSource { checkout: string; commit: string; cleanup: () => void }
+interface OpsUpgradeDeps { exists?: (path: string) => boolean; installSource?: () => string | null; feedSource?: (version: string) => FeedSource }
+
+/** Detached worktree at refs/tags/v<version> with the PWA built — the feed ships what was released (10-04 0.2.11:
+ *  packing process.cwd() shipped main HEAD ee689ad2 as «0.2.11» to node-b·cloud-vm instead of the cut 31129c91). */
+export function tagFeedSource(run: CommandRunner, repo: string = process.cwd()): (version: string) => FeedSource {
+  return (version) => {
+    const tag = run('git', ['rev-parse', '--verify', `refs/tags/v${version}^{commit}`], repo);
+    const commit = tag.stdout.trim();
+    if (tag.status !== 0 || !/^[0-9a-f]{40,64}$/.test(commit)) throw new Error(`태그 없음: v${version}`);
+    const dir = mkdtempSync(join(tmpdir(), 'ops-feed-'));
+    const tree = join(dir, 'tree');
+    const cleanup = () => {
+      run('git', ['worktree', 'remove', '--force', tree], repo);
+      rmSync(dir, { recursive: true, force: true });
+    };
+    try {
+      const added = run('git', ['worktree', 'add', '--detach', tree, commit], repo);
+      if (added.status !== 0) throw new Error(`태그 체크아웃 실패: ${reason(added)}`);
+      symlinkSync(join(repo, 'node_modules'), join(tree, 'node_modules'));
+      if (existsSync(join(repo, 'apps/pwa/node_modules'))) symlinkSync(join(repo, 'apps/pwa/node_modules'), join(tree, 'apps/pwa/node_modules'));
+      // The feed carries the PWA build (apps/pwa/out is ignored, so a fresh tag checkout has none until built).
+      const built = run('bun', ['bin/elanous.mjs', 'nexus', 'build'], tree, 900_000);
+      if (built.status !== 0) throw new Error(`태그 PWA 빌드 실패: ${reason(built)}`);
+    } catch (error) {
+      cleanup();
+      throw error;
+    }
+    return { checkout: tree, commit, cleanup };
+  };
+}
 
 function localInstallSource(): string | null {
   try {
@@ -54,11 +85,21 @@ export function runOpsUpgrade(run: CommandRunner = runCommand, deps: OpsUpgradeD
     : (deps.exists ?? existsSync)(defaultFeed) ? defaultFeed : undefined;
   let feedError = '';
   if (feedPath !== undefined) {
+    let source: FeedSource | undefined;
     try {
-      const feed = run('bun', ['scripts/publish-internal-dist.ts', '--checkout', process.cwd(), '--out', feedPath]);
-      const data = lastResult(feed);
-      if (feed.status !== 0 || data?.ok !== true || data.version !== version) feedError = `내부 피드 발행 실패: ${feed.status === 0 && data?.ok === true ? `판 불일치 (${String(data.version)})` : reason(feed)}`;
+      source = (deps.feedSource ?? tagFeedSource(run))(version);
+      const released = context.outputs['version-release']?.commit;
+      if (typeof released === 'string' && released && released !== source.commit) {
+        feedError = `내부 피드 발행 실패: 태그 v${version}(${source.commit.slice(0, 12)})가 컷(${released.slice(0, 12)})과 다르다`;
+      } else {
+        const feed = run('bun', ['scripts/publish-internal-dist.ts', '--checkout', source.checkout, '--out', feedPath]);
+        const data = lastResult(feed);
+        if (feed.status !== 0 || data?.ok !== true || data.version !== version) feedError = `내부 피드 발행 실패: ${feed.status === 0 && data?.ok === true ? `판 불일치 (${String(data.version)})` : reason(feed)}`;
+        else if (data.commit !== source.commit) feedError = `내부 피드 발행 실패: 묶은 커밋 ${String(data.commit).slice(0, 12)} ≠ 태그 ${source.commit.slice(0, 12)}`;
+        debug.log('release-loop.ops-upgrade', 'feed-source', { version, commit: source.commit, source: `refs/tags/v${version}`, packed: data?.commit, pwaBuild: data?.pwaBuild });
+      }
     } catch (error) { feedError = `내부 피드 발행 실패: ${firstLine(String(error))}`; }
+    finally { source?.cleanup(); }
   }
   const results: HostResult[] = [];
   for (const host of hosts as string[]) {

package/scripts/release-loop/publish-node.ts

@@ -2,6 +2,7 @@
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { WARNING_ONLY } from './auto-approve-node.js';
 import { errorResult, finishNode, lastResult, nodeOutput, readGraphContext, runCommand, type CommandRunner } from './node-verdict.js';
 
 export function publicNotes(markdown: string, pages: { pages: Array<{ id: string; slug?: string; source?: string }> }): string {
@@ -40,7 +41,9 @@ export function runPublish(run: CommandRunner = runCommand) {
   const auto = context.outputs['auto-approve'];
   if (context.outputs['approve-publish']?.outcome !== 'approved' &&
     !(auto?.outcome === 'ok' && auto.decidedBy === 'release-loop metrics'
-      && Array.isArray(auto.metrics) && auto.metrics.length === 8
+      // The 8 blocking metrics; warning-only rows (tui-regress · mac-smoke) are shown but never counted (V1g · MAC1).
+      && Array.isArray(auto.metrics)
+      && auto.metrics.filter((metric: unknown) => !(metric && typeof metric === 'object' && 'name' in metric && WARNING_ONLY.has(String(metric.name)))).length === 8
       && auto.metrics.every((metric: unknown) => metric && typeof metric === 'object' && 'verdict' in metric && metric.verdict === 'pass'))) {
     return { outcome: 'fail' as const, verdict: 'fail' as const, summary: 'publish blocked: neither auto-approve nor approve-publish approved' };
   }

package/scripts/release-loop/tui-node-checks.ts

@@ -27,3 +27,45 @@ export function tuiChecks(s: TuiScreens, readyLimitMs = 60_000): TuiCheck[] {
 export function tuiVerdict(checks: readonly TuiCheck[]): 'pass' | 'fail' {
   return checks.every((c) => c.pass) ? 'pass' : 'fail';
 }
+
+export type TuiRegress = {
+  pass: number;
+  fail: number;
+  results: Array<{ id: string; title: string; ok: boolean; reason: string }>;
+} | { unmeasured: string };
+
+export function validatedTuiRegress(data: unknown): TuiRegress {
+  const invalid = { unmeasured: 'tui.regress 결과 없음' };
+  if (!data || typeof data !== 'object' || Array.isArray(data)) return invalid;
+  const value = data as Record<string, unknown>;
+  if (typeof value.unmeasured === 'string' && value.unmeasured.trim()) return { unmeasured: value.unmeasured };
+  if (!Array.isArray(value.results) || value.results.length !== 7
+    || !Number.isInteger(value.pass) || !Number.isInteger(value.fail)
+    || (value.pass as number) < 0 || (value.fail as number) < 0
+    || (value.pass as number) + (value.fail as number) !== 7
+    || value.results.some((r: unknown) => !r || typeof r !== 'object'
+      || typeof (r as Record<string, unknown>).id !== 'string'
+      || !/^R[1-7]$/.test((r as Record<string, unknown>).id as string)
+      || typeof (r as Record<string, unknown>).title !== 'string'
+      || typeof (r as Record<string, unknown>).ok !== 'boolean'
+      || typeof (r as Record<string, unknown>).reason !== 'string')
+    || value.pass !== value.results.filter((r: { ok: boolean }) => r.ok).length
+    || value.fail !== value.results.filter((r: { ok: boolean }) => !r.ok).length
+    || new Set(value.results.map((r: { id: string }) => r.id)).size !== 7) return invalid;
+  return value as { pass: number; fail: number; results: Array<{ id: string; title: string; ok: boolean; reason: string }> };
+}
+
+export function parseTuiRegress(stdout: string): TuiRegress {
+  const lines = stdout.trim().split('\n');
+  if (lines.length !== 1) return { unmeasured: 'JSON 한 줄이 아니다' };
+  try { return validatedTuiRegress(JSON.parse(lines[0]!)); }
+  catch { return { unmeasured: 'JSON 결과를 읽을 수 없다' }; }
+}
+
+export function regressWarning(regress: TuiRegress): { level: 'ok' | 'warn' | 'unmeasured'; line: string } {
+  if ('unmeasured' in regress) return { level: 'unmeasured', line: `tui-regress: unmeasured — ${regress.unmeasured}` };
+  const failed = regress.results.filter((result) => !result.ok).map((result) => result.id);
+  return failed.length
+    ? { level: 'warn', line: `tui-regress: warn — ${failed.join(', ')}` }
+    : { level: 'ok', line: `tui-regress: ok — ${regress.pass} pass · 0 fail` };
+}