elanous 0.2.13 → 0.2.14

package/src/release-loop/landing-freeze.ts

@@ -0,0 +1,121 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+
+export interface LandingFreeze {
+  reason: string;
+  startedAt: string;
+  until: string | null;
+  by: string;
+}
+
+export function landingFreezePath(root = effectiveInstanceRoot()): string {
+  return join(root, 'landing-freeze.json');
+}
+
+export function readLandingFreeze(root = effectiveInstanceRoot(), now = new Date()): LandingFreeze | null {
+  const path = landingFreezePath(root);
+  let text: string;
+  // Read without an existence pre-check: a concurrent `freeze off` between the two would surface as ENOENT.
+  try { text = readFileSync(path, 'utf8'); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null; throw error; }
+  const record: unknown = JSON.parse(text);
+  if (!record || typeof record !== 'object' || Array.isArray(record)) throw new Error(`invalid landing freeze: ${path}`);
+  const freeze = record as Partial<LandingFreeze>;
+  if (typeof freeze.reason !== 'string' || typeof freeze.by !== 'string' ||
+      typeof freeze.startedAt !== 'string' || !Number.isFinite(Date.parse(freeze.startedAt)) ||
+      !(freeze.until === null || (typeof freeze.until === 'string' && Number.isFinite(Date.parse(freeze.until))))) {
+    throw new Error(`invalid landing freeze: ${path}`);
+  }
+  // An expired freeze reads as «off». The file is left alone: deleting it here could race a concurrent `freeze on`
+  // that just wrote a new one (only `freeze off` removes it; the next `freeze on` overwrites it).
+  if (freeze.until && Date.parse(freeze.until) <= now.getTime()) return null;
+  return freeze as LandingFreeze;
+}
+
+export function enableLandingFreeze(opts: { reason?: string; until?: string; by?: string }, root = effectiveInstanceRoot(), now = new Date()): LandingFreeze {
+  const until = opts.until === undefined ? null : opts.until;
+  if (until !== null && (!/^\d{4}-\d\d-\d\dT\d\d:\d\d(?::\d\d(?:\.\d+)?)?(?:Z|[+-]\d\d:\d\d)$/.test(until) || !Number.isFinite(Date.parse(until)) || Date.parse(until) <= now.getTime())) {
+    throw new Error('--until must be a future ISO timestamp with timezone');
+  }
+  const freeze: LandingFreeze = { reason: opts.reason?.trim() || 'operator freeze', startedAt: now.toISOString(), until: until === null ? null : new Date(until).toISOString(), by: opts.by?.trim() || process.env.ELANOUS_TRACK || process.env.USER || 'cli' };
+  const path = landingFreezePath(root);
+  mkdirSync(root, { recursive: true });
+  const tmp = `${path}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    writeFileSync(tmp, `${JSON.stringify(freeze, null, 2)}\n`, { mode: 0o600 });
+    renameSync(tmp, path);
+  } finally { rmSync(tmp, { force: true }); }
+  return freeze;
+}
+
+export function disableLandingFreeze(root = effectiveInstanceRoot()): void {
+  rmSync(landingFreezePath(root), { force: true });
+}
+
+/** In-flight merge markers: a merger writes its marker «before» reading the freeze file, and `freeze on` writes the
+ *  freeze file «before» counting markers — so either the merger sees the freeze or the freeze waits for the merger. */
+function mergesDir(root: string): string { return join(root, 'landing-merges'); }
+
+export interface LandingMergeGuard { frozen: LandingFreeze | null; end: () => void }
+
+export function beginLandingMerge(root = effectiveInstanceRoot(), now = new Date()): LandingMergeGuard {
+  const dir = mergesDir(root);
+  mkdirSync(dir, { recursive: true });
+  const marker = join(dir, `${process.pid}-${randomUUID()}.json`);
+  writeFileSync(marker, `${JSON.stringify({ pid: process.pid, startedAt: now.toISOString() })}\n`, { mode: 0o600 });
+  const end = () => { rmSync(marker, { force: true }); };
+  let frozen: LandingFreeze | null;
+  try { frozen = readLandingFreeze(root, now); } catch (error) { end(); throw error; }
+  if (frozen) { end(); return { frozen, end: () => {} }; }
+  return { frozen: null, end };
+}
+
+/** Live in-flight merges; markers of dead processes are removed. */
+export function inFlightLandingMerges(root = effectiveInstanceRoot()): number {
+  const dir = mergesDir(root);
+  let names: string[];
+  try { names = readdirSync(dir); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return 0; throw error; }
+  let live = 0;
+  for (const name of names) {
+    const pid = Number(name.split('-')[0]);
+    let alive = false;
+    if (Number.isSafeInteger(pid) && pid > 0) {
+      try { process.kill(pid, 0); alive = true; } catch (error) { alive = (error as NodeJS.ErrnoException).code === 'EPERM'; }
+    }
+    if (alive) live++; else rmSync(join(dir, name), { force: true });
+  }
+  return live;
+}
+
+/** `freeze on` completes only after merges that passed their freeze check have finished (or the wait runs out). */
+export async function awaitLandingMergesDrained(
+  root = effectiveInstanceRoot(),
+  opts: { timeoutMs?: number; pollMs?: number; sleep?: (ms: number) => Promise<void> } = {},
+): Promise<{ drained: boolean; pending: number }> {
+  const timeoutMs = opts.timeoutMs ?? 600_000, pollMs = opts.pollMs ?? 1_000;
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const pending = inFlightLandingMerges(root);
+    if (pending === 0) return { drained: true, pending: 0 };
+    if (Date.now() >= deadline) return { drained: false, pending };
+    await sleep(pollMs);
+  }
+}
+
+/** Thrown where a release run stops for a freeze, so the scheduled `--if-ready` path can defer instead of failing. */
+export class LandingFrozenError extends Error {
+  constructor(readonly freeze: LandingFreeze) { super(landingFreezeMessage(freeze)); this.name = 'LandingFrozenError'; }
+}
+
+const FREEZE_MESSAGE_HEAD = '동결 중 · ';
+
+/** True when a node's recorded output or error is the freeze refusal written by {@link landingFreezeMessage}. */
+export function isLandingFreezeRefusal(text: string): boolean { return text.includes(FREEZE_MESSAGE_HEAD); }
+
+export function landingFreezeMessage(freeze: LandingFreeze): string {
+  return `${FREEZE_MESSAGE_HEAD}${freeze.reason} · 끝 시각 ${freeze.until ?? '미지정'}`;
+}

package/src/release-loop/placement.ts

@@ -0,0 +1,242 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { CliUserError } from '../cli/cli-user-error.js';
+import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { userConfigPath } from '../user-config.js';
+import { addItem, listChecklist, ownerMatches, parseOwner, setItem, type ChecklistItem } from './checklist.js';
+import { move, releasedVersion } from './feature-store.js';
+import { listSchedules, type ReleaseSchedule } from './release-schedule.js';
+
+export type PlacementPriority = 'P0' | 'P1' | 'P2';
+export interface PlacementCell { id: string; title: string; owner: string; priority: PlacementPriority; predecessors: string[]; deadlineVersion?: string }
+export interface PlacementDecision { id: string; from: string | null; version: string; reason: string; displaced: Array<{ id: string; from: string; to: string; reason: string }> }
+export interface PlacementDeps {
+  now?: Date;
+  schedules?: ReleaseSchedule[];
+  merged24h?: number;
+  seatCap?: Record<string, number>;
+  checklist?: typeof listChecklist;
+  released?: string;
+  dryRun?: boolean;
+  by?: string;
+  /** Backlog releases are a source of cells, never a placement target (default {@link BACKLOG_VERSIONS}). */
+  backlog?: readonly string[];
+}
+
+/** 0.9.0 is the backlog bucket: cells are pulled out of it, never placed into it. */
+export const BACKLOG_VERSIONS: readonly string[] = ['0.9.0'];
+
+function versionOrder(a: string, b: string): number {
+  const left = a.split('.').map(Number), right = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) if (left[i] !== right[i]) return left[i]! - right[i]!;
+  return 0;
+}
+
+/** The merged PR list is a first-class GitHub query, not a count inferred from checklist status. */
+export function mergedPrsLast24h(now = new Date()): number {
+  const since = new Date(now.getTime() - 86_400_000).toISOString();
+  const r = spawnSync('gh', ['pr', 'list', '--state', 'merged', '--search', `merged:>=${since.slice(0, 10)}`, '--limit', '1000', '--json', 'number,mergedAt'], { encoding: 'utf8' });
+  if (r.status !== 0) throw new CliUserError(`병합 PR 속도 조회 실패: ${(r.stderr || r.error || '').toString().trim()}`);
+  let rows: Array<{ number: number; mergedAt: string }>;
+  try { rows = JSON.parse(r.stdout) as typeof rows; }
+  catch { throw new CliUserError('병합 PR 속도 응답이 JSON 이 아니다'); }
+  if (!Array.isArray(rows) || rows.length >= 1000 || rows.some((row) => typeof row.number !== 'number' || typeof row.mergedAt !== 'string' || !Number.isFinite(Date.parse(row.mergedAt))))
+    throw new CliUserError('병합 PR 속도 조회가 잘렸거나 잘못됐다');
+  return rows.filter((row) => Date.parse(row.mergedAt) >= Date.parse(since) && Date.parse(row.mergedAt) <= now.getTime()).length;
+}
+
+export function placementSeatCap(): Record<string, number> {
+  const path = getElanousConfigDirOverride() ? join(effectiveInstanceRoot(), 'config.json') : userConfigPath();
+  if (!existsSync(path)) return {};
+  const raw = JSON.parse(readFileSync(path, 'utf8')) as { release?: { placement?: { seatCap?: Record<string, number> } } };
+  return raw.release?.placement?.seatCap ?? {};
+}
+
+function dependencyViolation(
+  snapshots: Map<string, { items: ChecklistItem[] }>,
+  locations: Map<string, string>,
+  overrides: Map<string, string>,
+  input: PlacementCell,
+): string | null {
+  for (const [version, snapshot] of snapshots) for (const item of snapshot.items) {
+    const dependentVersion = overrides.get(item.id) ?? version;
+    const predecessors = item.id === input.id ? input.predecessors : item.predecessors ?? [];
+    for (const predecessor of predecessors) {
+      const predecessorVersion = overrides.get(predecessor) ?? locations.get(predecessor);
+      if (!predecessorVersion || versionOrder(dependentVersion, predecessorVersion) <= 0)
+        return `의존 칸 ${item.id}은 선행 칸 ${predecessor} 이후 판이어야 한다`;
+    }
+  }
+  if (!locations.has(input.id)) for (const predecessor of input.predecessors) {
+    const predecessorVersion = overrides.get(predecessor) ?? locations.get(predecessor);
+    const dependentVersion = overrides.get(input.id);
+    if (!predecessorVersion || !dependentVersion || versionOrder(dependentVersion, predecessorVersion) <= 0)
+      return `의존 칸 ${input.id}은 선행 칸 ${predecessor} 이후 판이어야 한다`;
+  }
+  return null;
+}
+
+/** A freeze window holds operational rollout only; the release still exists and takes cells (OP 10-04 19:39). */
+function available(row: ReleaseSchedule, now: number, backlog: readonly string[]): boolean {
+  if (backlog.includes(row.version)) return false;
+  return Date.parse(row.landBy ?? row.cutAt) > now;
+}
+
+export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): PlacementDecision {
+  if (!input.id.trim() || !input.title.trim()) throw new CliUserError('칸 id 와 제목이 필요하다');
+  if (!Array.isArray(input.predecessors) || input.predecessors.some((id) => typeof id !== 'string' || !id.trim() || id === input.id)) throw new CliUserError('선행 칸 id 가 잘못됐다');
+  const seat = parseOwner(input.owner).seat;
+  if (!['P0', 'P1', 'P2'].includes(input.priority)) throw new CliUserError(`잘못된 우선순위: ${input.priority}`);
+  const now = (deps.now ?? new Date()).getTime();
+  const schedules = [...(deps.schedules ?? listSchedules())].sort((a, b) => versionOrder(a.version, b.version));
+  const released = deps.released ?? releasedVersion();
+  const backlog = deps.backlog ?? BACKLOG_VERSIONS;
+  const open = schedules.filter((row) => (!released || versionOrder(row.version, released) > 0) && row.landBy && available(row, now, backlog));
+  const sources = [...new Set([...schedules.map((row) => row.version), ...backlog])];
+  const snapshots = new Map(sources.map((version) => [version, (deps.checklist ?? listChecklist)(version)]));
+  const locations = new Map<string, string>();
+  for (const [version, snapshot] of snapshots) for (const item of snapshot.items) {
+    if (backlog.includes(version)) continue;
+    if (locations.has(item.id)) throw new CliUserError(`여러 판의 같은 칸: ${item.id}`);
+    locations.set(item.id, version);
+  }
+  // A backlog copy never outranks a scheduled cell with the same id.
+  for (const version of backlog) for (const item of snapshots.get(version)?.items ?? []) if (!locations.has(item.id)) locations.set(item.id, version);
+  const from = locations.get(input.id) ?? null;
+  const existing = from ? snapshots.get(from)!.items.find((item) => item.id === input.id)! : null;
+  if (from && released && versionOrder(from, released) <= 0) throw new CliUserError(`이미 발행된 판의 칸은 배치하지 않는다: ${input.id}`);
+  if (existing?.status === 'done') throw new CliUserError(`끝난 칸은 배치하지 않는다: ${input.id}`);
+  if (existing && (existing.title !== input.title || existing.owner !== input.owner)) throw new CliUserError(`기존 칸 제목·담당 불일치: ${input.id}`);
+  const predecessors = input.predecessors.map((id) => {
+    const version = locations.get(id);
+    if (!version) throw new CliUserError(`없는 선행 칸: ${id}`);
+    if (backlog.includes(version)) throw new CliUserError(`선행 칸 ${id} 이 백로그 ${version} 에 있다 — 먼저 배치하라`);
+    return version;
+  });
+  const rate = deps.merged24h ?? mergedPrsLast24h(new Date(now));
+  if (!Number.isInteger(rate) || rate < 0) throw new CliUserError('24시간 병합 PR 수가 잘못됐다');
+  const caps = deps.seatCap ?? placementSeatCap();
+  for (const [configuredSeat, limit] of Object.entries(caps)) if (!Number.isInteger(limit) || limit < 0) throw new CliUserError(`잘못된 자리 용량: ${configuredSeat}`);
+  const seatLimit = caps[seat] ?? Infinity;
+  const first = open[0];
+  const deadlineVersion = input.priority === 'P0' ? undefined : input.deadlineVersion ?? existing?.deadlineVersion;
+  if (input.priority === 'P1' && !deadlineVersion) throw new CliUserError(`P1 칸의 마감 판이 없다: ${input.id}`);
+  if (input.priority !== 'P0' && deadlineVersion && !schedules.some((row) => row.version === deadlineVersion)) throw new CliUserError(`없는 마감 판: ${deadlineVersion}`);
+  const eligible = open.filter((row) => predecessors.every((v) => versionOrder(row.version, v) > 0));
+  const candidates = input.priority === 'P0' ? eligible.filter((row) => row.version === first?.version)
+    : input.priority === 'P1' ? eligible.filter((row) => row.version === deadlineVersion)
+      : eligible.filter((row) => !deadlineVersion || versionOrder(row.version, deadlineVersion) <= 0);
+
+  const occupied = (version: string) => snapshots.get(version)!.items.filter((item) => item.status !== 'done' && item.id !== input.id);
+  const capacity = (row: ReleaseSchedule) => Math.floor(rate * (Date.parse(row.landBy!) - now) / 86_400_000 * 0.7);
+  const displaced: PlacementDecision['displaced'] = [];
+  let chosen: ReleaseSchedule | undefined;
+  for (const row of candidates) {
+    const placement = new Map([[input.id, row.version]]);
+    if (dependencyViolation(snapshots, locations, placement, input)) continue;
+    const items = occupied(row.version);
+    const seatItems = items.filter((item) => ownerMatches(item.owner, seat));
+    if (items.length < capacity(row) && seatItems.length < seatLimit) { chosen = row; break; }
+    if (input.priority !== 'P1' || from === row.version) continue;
+    const next = open.find((later) => versionOrder(later.version, row.version) > 0);
+    if (!next || items.length - 1 >= capacity(row)) continue;
+    const p2 = [...items].reverse().find((item) => {
+      if (item.priority !== 'P2' || dependencyViolation(snapshots, locations, new Map([...placement, [item.id, next.version]]), input)) return false;
+      if (item.deadlineVersion && versionOrder(next.version, item.deadlineVersion) > 0) return false;
+      if (items.length < capacity(row) && !(seatItems.length >= seatLimit && ownerMatches(item.owner, seat))) return false;
+      if (!item.owner) return false;
+      const shiftedSeat = parseOwner(item.owner).seat;
+      return occupied(next.version).length < capacity(next) && occupied(next.version).filter((other) => ownerMatches(other.owner, shiftedSeat)).length < (caps[shiftedSeat] ?? Infinity);
+    });
+    if (p2 && (seatItems.length < seatLimit || (ownerMatches(p2.owner, seat) && seatItems.length - 1 < seatLimit))) {
+      displaced.push({ id: p2.id, from: row.version, to: next.version, reason: `P1 ${input.id} 마감 판 ${row.version} 용량 확보를 위해 P2 이월` });
+      chosen = row;
+      break;
+    }
+  }
+  if (!chosen) throw new CliUserError(`${input.id} 배치할 판이 없다 — 용량·선행·마감·동결을 확인하라`);
+  const reason = `${input.priority} ${input.priority === 'P0' ? '사고·회귀·발행 막음: 다음 판' : input.priority === 'P1' ? `지시·행사 마감 판 ${deadlineVersion}` : '착지 마감 내 가장 이른 여유 판'} · PR/24h ${rate} · 용량 ${capacity(chosen)} · 자리 ${seatLimit}`;
+  const decision = { id: input.id, from, version: chosen.version, reason, displaced };
+  if (!deps.dryRun) {
+    const by = deps.by ?? 'OP';
+    for (const shifted of displaced) move(shifted.id, shifted.from, shifted.to, by, undefined, undefined, shifted.reason);
+    if (from && from !== chosen.version) move(input.id, from, chosen.version, by, undefined, undefined, reason);
+    if (from && (existing?.priority !== input.priority || JSON.stringify(existing.predecessors ?? []) !== JSON.stringify(input.predecessors) || (input.deadlineVersion !== undefined && existing.deadlineVersion !== input.deadlineVersion)))
+      setItem(chosen.version, input.id, { priority: input.priority, predecessors: input.predecessors, ...(input.deadlineVersion ? { deadlineVersion: input.deadlineVersion } : {}) }, by);
+    if (!from) addItem(chosen.version, { id: input.id, title: input.title, owner: input.owner, priority: input.priority, predecessors: input.predecessors, deadlineVersion });
+  }
+  return decision;
+}
+
+function moveConstraint(
+  item: ChecklistItem, to: ReleaseSchedule, backlog: readonly string[],
+  snapshots: Map<string, ChecklistItem[]>, now: number, rate: number, caps: Record<string, number>,
+): string | null {
+  if (!to.landBy || !available(to, now, backlog)) return '착지 마감이 지났거나 백로그 판이라 이동 불가';
+  if (item.deadlineVersion && versionOrder(to.version, item.deadlineVersion) > 0) return '마감 판 뒤로 이월 불가';
+  if (!item.owner) return '담당 없는 칸은 이동 불가';
+  const seat = parseOwner(item.owner).seat;
+  const destination = snapshots.get(to.version) ?? [];
+  if (destination.filter((cell) => cell.status !== 'done').length >= Math.floor(rate * (Date.parse(to.landBy) - now) / 86_400_000 * 0.7)) return '다음 판 PR 용량 초과';
+  if (destination.filter((cell) => cell.status !== 'done' && ownerMatches(cell.owner, seat)).length >= (caps[seat] ?? Infinity)) return '다음 판 자리 용량 초과';
+  const locations = new Map<string, string>();
+  for (const [version, items] of snapshots) for (const cell of items) {
+    if (locations.has(cell.id)) return `여러 판의 같은 칸: ${cell.id}`;
+    locations.set(cell.id, version);
+  }
+  for (const predecessor of item.predecessors ?? []) {
+    const location = locations.get(predecessor);
+    if (!location || versionOrder(to.version, location) <= 0) return `선행 칸 ${predecessor} 이후 판으로만 이동 가능`;
+  }
+  for (const [version, items] of snapshots) for (const dependent of items) {
+    if (dependent.id !== item.id && dependent.predecessors?.includes(item.id) && versionOrder(version, to.version) <= 0)
+      return `의존 칸 ${dependent.id} 이전 판으로만 이동 가능`;
+  }
+  return null;
+}
+
+/** Only unstarted cells inside the two-hour pre-deadline window move; a dry run never writes. */
+export function rebalance(version: string, deps: PlacementDeps = {}): PlacementDecision[] {
+  const rows = [...(deps.schedules ?? listSchedules())].sort((a, b) => versionOrder(a.version, b.version));
+  const current = rows.find((row) => row.version === version);
+  if (!current?.landBy) throw new CliUserError(`착지 마감이 없는 판: ${version}`);
+  const now = (deps.now ?? new Date()).getTime();
+  if (Date.parse(current.landBy) - now > 7_200_000 || Date.parse(current.landBy) <= now) return [];
+  const backlog = deps.backlog ?? BACKLOG_VERSIONS;
+  const next = rows.find((row) => versionOrder(row.version, version) > 0 && !backlog.includes(row.version));
+  const snapshots = new Map(rows.map((row) => [row.version, [...(deps.checklist ?? listChecklist)(row.version).items]]));
+  const unstarted = snapshots.get(version)!.filter((item) => item.status === 'yellow' && !item.evidence);
+  if (unstarted.length && !next) throw new CliUserError(`${version} 다음 판이 없다`);
+  if (!unstarted.length) return [];
+  const rate = deps.merged24h ?? mergedPrsLast24h(new Date(now));
+  const caps = deps.seatCap ?? placementSeatCap();
+  const decisions: PlacementDecision[] = [];
+  for (const item of unstarted) {
+    if (moveConstraint(item, next!, backlog, snapshots, now, rate, caps)) continue;
+    const reason = `${version} 착지 마감 2시간 전 미시작 칸 이월`;
+    decisions.push({ id: item.id, from: version, version: next!.version, reason, displaced: [] });
+    snapshots.set(version, snapshots.get(version)!.filter((cell) => cell.id !== item.id));
+    snapshots.get(next!.version)!.push(item);
+  }
+  if (!deps.dryRun) for (const decision of decisions) move(decision.id, version, decision.version, deps.by ?? 'OP', undefined, undefined, decision.reason);
+  return decisions;
+}
+
+/** A seat may defer its own cell one release, never pull another owner's cell forward. */
+export function seatMove(id: string, from: string, to: string, by: string, reason: string, deps: PlacementDeps = {}): void {
+  if (!reason.trim()) throw new CliUserError('이동 이유가 필요하다');
+  const rows = [...(deps.schedules ?? listSchedules())].sort((a, b) => versionOrder(a.version, b.version));
+  const backlog = deps.backlog ?? BACKLOG_VERSIONS;
+  const next = rows.find((row) => versionOrder(row.version, from) > 0 && !backlog.includes(row.version));
+  const snapshots = new Map(rows.map((row) => [row.version, (deps.checklist ?? listChecklist)(row.version).items]));
+  const item = snapshots.get(from)?.find((cell) => cell.id === id);
+  if (!item) throw new CliUserError(`없는 칸: ${id}`);
+  if (!ownerMatches(item.owner, parseOwner(by).seat) || next?.version !== to) throw new CliUserError('남의 칸 당기기 거부 — COO 에 요청');
+  const now = (deps.now ?? new Date()).getTime();
+  const rate = deps.merged24h ?? mergedPrsLast24h(new Date(now));
+  const violation = moveConstraint(item, next, backlog, snapshots, now, rate, deps.seatCap ?? placementSeatCap());
+  if (violation) throw new CliUserError(`${id}: ${violation}`);
+  if (!deps.dryRun) move(id, from, to, by, undefined, undefined, reason);
+}

package/src/release-loop/release-schedule.ts

@@ -35,10 +35,12 @@ export function listSchedules(root?: string): ReleaseSchedule[] {
   return schedules;
 }
 
-export function setSchedule(version: string, patch: { cutAt?: string; landBy?: string }, by: string, root?: string): ReleaseSchedule {
+export function setSchedule(version: string, patch: { cutAt?: string; landBy?: string; freezeFrom?: string; freezeUntil?: string }, by: string, root?: string): ReleaseSchedule {
   const schedule = writeSchedule(version, {
     ...(patch.cutAt !== undefined ? { cutAt: utcIso(patch.cutAt) } : {}),
     ...(patch.landBy !== undefined ? { landBy: utcIso(patch.landBy) } : {}),
+    ...(patch.freezeFrom !== undefined ? { freezeFrom: utcIso(patch.freezeFrom) } : {}),
+    ...(patch.freezeUntil !== undefined ? { freezeUntil: utcIso(patch.freezeUntil) } : {}),
   }, by, root);
   debug.log('release.schedule', 'set', { version, cutAt: schedule.cutAt, landBy: schedule.landBy });
   return schedule;

package/src/seat-dispatch/ceo-commands.ts

@@ -52,7 +52,7 @@ export interface CeoTaskExtra {
   attachments?: Array<{ name: string; path: string }>;
   /** Paths supplied by callers that do not have attachment names. */
   attachmentPaths?: readonly string[];
-  via?: 'telegram' | 'discord' | 'pwa';
+  via?: 'telegram' | 'discord' | 'pwa' | 'tui';
   /** Request ref written into the message body; with `deps.hasMessage` it makes delivery idempotent per request. */
   ref?: string;
 }
@@ -90,7 +90,7 @@ async function postToChannel(seat: string, task: string, deps: CeoCommandDeps, e
   if (!target) return deps.replyTarget ? 'decisions.replyGhPr 형식이 owner/repo#N 이 아님' : 'decisions.replyGhPr 미설정';
   try {
     const attachmentCount = (extra.attachments?.length ?? 0) + (extra.attachmentPaths?.length ?? 0);
-    const code = await deps.runGh(['pr', 'comment', target[2]!, '--repo', target[1]!, '--body-file', '-'], `${ceoTaskLine(seat, task, deps.now?.() ?? new Date())}${attachmentCount ? ` · 첨부 ${attachmentCount}` : ''}${extra.via === 'pwa' ? ' (PWA)' : ''}`);
+    const code = await deps.runGh(['pr', 'comment', target[2]!, '--repo', target[1]!, '--body-file', '-'], `${ceoTaskLine(seat, task, deps.now?.() ?? new Date())}${attachmentCount ? ` · 첨부 ${attachmentCount}` : ''}${extra.via === 'pwa' ? ' (PWA)' : extra.via === 'tui' ? ' (TUI)' : ''}`);
     return code === 0 ? null : `gh 종료 코드 ${code}`;
   } catch (error) {
     return error instanceof Error ? error.message.slice(0, 80) : 'gh 실행 실패';

package/src/seat-dispatch/seat-ask.ts

@@ -8,10 +8,11 @@ import type { SeatId } from './seat-questions.js';
 export type AskOrigin =
   | { channel: 'telegram'; chatId: number | string; messageId: number; threadId?: number; botId?: string }
   | { channel: 'discord'; channelId: string; messageId: string; threadId?: string }
-  | { channel: 'pwa'; clientId: string };
+  | { channel: 'pwa'; clientId: string }
+  | { channel: 'tui'; clientId: string };
 
 export const DEFAULT_ASK_TIMEOUT_MS = 2 * 60 * 60 * 1000;
-export const parseSeatAsk = (text: string): string | null => /^\s*CTO\s*에게\s*물어봐\s*[:：]\s*(\S[\s\S]*)$/i.exec(text)?.[1]?.trim() ?? null;
+export const parseSeatAsk = (text: string): string | null => /^\s*CTO\s*에게\s*물어봐(?:\s*[:：]\s*|\s+)(\S[\s\S]*)$/i.exec(text)?.[1]?.trim() ?? null;
 
 interface AskRow { id: string; seat: string; origin: string; deadline: number; timeout_minutes: number; answer: string | null; answered_at: number | null }
 
@@ -53,6 +54,17 @@ export function recordSeatAskShadow(root: string, ask: SeatAskShadow, now: numbe
   } finally { store.close(); }
 }
 
+/** A TUI restart must keep the same return address as its prior questions. The instance's
+ * message database owns this identity, so test and production instances cannot share it. */
+export function getTuiSeatAskClientId(open: () => MsgStore = openMsgStore): string {
+  const store = open();
+  try {
+    store.db.exec('CREATE TABLE IF NOT EXISTS seat_ask_clients (channel TEXT PRIMARY KEY, client_id TEXT NOT NULL)');
+    store.db.query('INSERT OR IGNORE INTO seat_ask_clients (channel, client_id) VALUES (?, ?)').run('tui', randomUUID());
+    return (store.db.query('SELECT client_id FROM seat_ask_clients WHERE channel = ?').get('tui') as { client_id: string }).client_id;
+  } finally { store.close(); }
+}
+
 export interface SeatAskDeps {
   open?: () => MsgStore;
   now?: () => number;
@@ -133,7 +145,7 @@ export async function deliverSeatAnswers(deps: SeatAskDeps): Promise<void> {
     for (const ask of pending) {
       const origin = JSON.parse(ask.origin) as AskOrigin;
       if (deps.channel && origin.channel !== deps.channel) continue;
-      if (origin.channel === 'pwa' && deps.clientId !== origin.clientId) continue;
+      if ((origin.channel === 'pwa' || origin.channel === 'tui') && deps.clientId !== origin.clientId) continue;
       if (origin.channel === 'telegram' && origin.botId && origin.botId !== deps.botId) continue;
       const status = decide(ask.id, (deps.now ?? Date.now)());
       if (status) debug.log('seat.ask', status, { seat: ask.seat, id: ask.id, via: origin.channel });
@@ -147,6 +159,7 @@ export async function deliverSeatAnswers(deps: SeatAskDeps): Promise<void> {
         if (deps.clientId === origin.clientId) await deps.send(origin, item.text);
         continue; // A browser poll is not a receipt; only its explicit acknowledgement consumes the answer.
       }
+      if (origin.channel === 'tui' && deps.clientId !== origin.clientId) continue;
       const token = randomUUID();
       const now = Date.now();
       // SQLite's conditional write is the claim across concurrent bot loops and processes.

package/src/seat-dispatch/seat-questions.ts

@@ -73,6 +73,64 @@ export function seatQuestions(root: string, seat: SeatId): Message[] {
   } finally { store.close(); }
 }
 
+export type CrossCheckJudgment = { agree: boolean; note: string; resolves: boolean };
+
+export function askCrossCheck(root: string, from: SeatId, to: SeatId, draft: string, key: string): Message {
+  if (from === to || !draft.trim() || !key.trim()) throw new Error('cross-check requires another seat, a draft and a key');
+  return deliverOnce(root, key, { from, to, body: draft.trim(), kind: 'seat-xcheck' });
+}
+
+export function seatCrossChecks(root: string, seat: SeatId): Message[] {
+  const store = storeAt(root);
+  try {
+    const found: Message[] = [];
+    let cursor = 0;
+    while (true) {
+      const batch = store.listByRecipient(seat, cursor, 1000);
+      found.push(...batch.filter((message) => message.kind === 'seat-xcheck' && isSeatId(message.from) && message.from !== seat));
+      if (batch.length < 1000) return found;
+      cursor = batch[batch.length - 1]!.id;
+    }
+  } finally { store.close(); }
+}
+
+export function answerCrossCheck(root: string, question: Message, judgment: CrossCheckJudgment): Message {
+  if (question.kind !== 'seat-xcheck' || !isSeatId(question.to) || !isSeatId(question.from)
+    || typeof judgment.agree !== 'boolean' || typeof judgment.resolves !== 'boolean'
+    || typeof judgment.note !== 'string' || !judgment.note.trim()) throw new Error('invalid cross-check answer');
+  return deliverOnce(root, `xcheck-answer:${question.id}`, {
+    from: question.to, to: question.from,
+    body: JSON.stringify({ questionId: question.id, agree: judgment.agree, note: judgment.note.trim(), resolves: judgment.resolves }),
+    kind: 'seat-xcheck-answer',
+  });
+}
+
+export function crossCheckAnswer(root: string, question: Message): CrossCheckJudgment | null {
+  if (question.kind !== 'seat-xcheck' || !isSeatId(question.to) || !isSeatId(question.from)) return null;
+  const store = storeAt(root);
+  try {
+    let cursor = 0;
+    while (true) {
+      const batch = store.listByRecipient(question.from, cursor, 1000);
+      for (const message of batch) {
+        if (message.kind !== 'seat-xcheck-answer' || message.from !== question.to) continue;
+        try {
+          const value: unknown = JSON.parse(message.body);
+          if (value && typeof value === 'object' && !Array.isArray(value)) {
+            const answer = value as Record<string, unknown>;
+            if (answer.questionId === question.id && typeof answer.agree === 'boolean'
+              && typeof answer.resolves === 'boolean' && typeof answer.note === 'string' && answer.note.trim()) {
+              return { agree: answer.agree, note: answer.note, resolves: answer.resolves };
+            }
+          }
+        } catch { /* Ignore unrelated malformed messages. */ }
+      }
+      if (batch.length < 1000) return null;
+      cursor = batch[batch.length - 1]!.id;
+    }
+  } finally { store.close(); }
+}
+
 export function answerSeat(root: string, question: Message, answer: string): Message {
   if (question.kind !== 'seat-question' || !isSeatId(question.to) || !isSeatId(question.from) || !answer.trim()) {
     throw new Error('invalid seat answer');