elanous 0.2.17 → 0.2.19

package/src/release-loop/feature-store.ts

@@ -5,6 +5,8 @@ import { Database } from 'bun:sqlite';
 import { releaseLedgerRoot } from '../instance/resolve.js';
 import { CliUserError } from '../cli/cli-user-error.js';
 import { debug } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
+import { hqSeenGenerationPath, readHqLease, readSeenGeneration } from '../hq/hq.js';
 import { devVersion, type Checklist, type ChecklistHistory, type ChecklistItem } from './checklist.js';
 
 export function validateVersion(version: string): void {
@@ -32,8 +34,8 @@ export function releasedVersion(ledgerRoot = releaseLedgerRoot()): string {
 const walWait = new Int32Array(new SharedArrayBuffer(4));
 const SCHEMA_COLUMNS: Record<string, readonly string[]> = {
   imported_versions: ['json_hash', 'imported_at'],
-  events: ['reason'],
-  assignments: ['priority', 'predecessors', 'deadline_version', 'ceo_minutes', 'ceo_date', 'accelerator'],
+  events: ['reason', 'generation'],
+  assignments: ['priority', 'predecessors', 'deadline_version', 'ceo_minutes', 'ceo_date', 'accelerator', 'refs'],
   release_schedules: ['freeze_from', 'freeze_until'],
 };
 function schemaCurrent(db: Database): boolean {
@@ -72,10 +74,12 @@ function open(root = releaseLedgerRoot()): Database {
       const columns = db.query('PRAGMA table_info(imported_versions)').all() as Array<{ name: string }>;
       if (!columns.some((column) => column.name === 'json_hash')) db.exec('ALTER TABLE imported_versions ADD COLUMN json_hash TEXT');
       if (!columns.some((column) => column.name === 'imported_at')) db.exec('ALTER TABLE imported_versions ADD COLUMN imported_at TEXT');
-      if (!(db.query('PRAGMA table_info(events)').all() as Array<{ name: string }>).some((column) => column.name === 'reason')) db.exec('ALTER TABLE events ADD COLUMN reason TEXT');
+      const eventColumns = db.query('PRAGMA table_info(events)').all() as Array<{ name: string }>;
+      if (!eventColumns.some((column) => column.name === 'reason')) db.exec('ALTER TABLE events ADD COLUMN reason TEXT');
+      if (!eventColumns.some((column) => column.name === 'generation')) db.exec('ALTER TABLE events ADD COLUMN generation INTEGER');
       db.exec('CREATE TABLE IF NOT EXISTS release_schedules (version TEXT PRIMARY KEY, cut_at TEXT NOT NULL, land_by TEXT, updated_at TEXT NOT NULL, updated_by TEXT NOT NULL)');
       const assignmentColumns = db.query('PRAGMA table_info(assignments)').all() as Array<{ name: string }>;
-      for (const [name, sql] of [['priority', 'TEXT'], ['predecessors', 'TEXT'], ['deadline_version', 'TEXT'], ['ceo_minutes', 'INTEGER'], ['ceo_date', 'TEXT'], ['accelerator', 'INTEGER']] as const) {
+      for (const [name, sql] of [['priority', 'TEXT'], ['predecessors', 'TEXT'], ['deadline_version', 'TEXT'], ['ceo_minutes', 'INTEGER'], ['ceo_date', 'TEXT'], ['accelerator', 'INTEGER'], ['refs', 'TEXT']] as const) {
         if (!assignmentColumns.some((column) => column.name === name)) db.exec(`ALTER TABLE assignments ADD COLUMN ${name} ${sql}`);
       }
       const scheduleColumns = db.query('PRAGMA table_info(release_schedules)').all() as Array<{ name: string }>;
@@ -155,21 +159,21 @@ function readTransaction<T>(db: Database, work: () => T): T {
   catch (error) { db.exec('ROLLBACK'); throw error; }
 }
 
-type EventRow = { seq: number; at: string; by: string; feature_id: string; version: string; field: string; from: string; to: string; released: string; dev: string; reason: string | null };
+type EventRow = { seq: number; at: string; by: string; feature_id: string; version: string; field: string; from: string; to: string; released: string; dev: string; reason: string | null; generation: number | null };
 function decode(value: string | null): unknown { return value === null ? null : JSON.parse(value); }
 function historyRow(row: EventRow): ChecklistHistory {
   return { at: row.at, by: row.by, id: row.feature_id, field: row.field, from: decode(row.from), to: decode(row.to), released: row.released, dev: row.dev,
-    ...(row.reason !== null ? { reason: row.reason } : {}) };
+    ...(row.reason !== null ? { reason: row.reason } : {}), ...(row.generation !== null ? { generation: row.generation } : {}) };
 }
 function record(db: Database, version: string, entry: ChecklistHistory): void {
-  db.query('INSERT INTO events (at, by, feature_id, version, field, "from", "to", released, dev, reason) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
-    .run(entry.at, entry.by, entry.id, version, entry.field, JSON.stringify(entry.from ?? null), JSON.stringify(entry.to ?? null), entry.released, entry.dev, entry.reason ?? null);
+  db.query('INSERT INTO events (at, by, feature_id, version, field, "from", "to", released, dev, reason, generation) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+    .run(entry.at, entry.by, entry.id, version, entry.field, JSON.stringify(entry.from ?? null), JSON.stringify(entry.to ?? null), entry.released, entry.dev, entry.reason ?? null, entry.generation ?? null);
 }
 function evidenceRefs(db: Database, version: string, id: string): string[] {
   return (db.query('SELECT ref FROM evidence WHERE feature_id = ? AND version = ? ORDER BY rowid').all(id, version) as Array<{ ref: string }>).map((row) => row.ref);
 }
 function items(db: Database, version: string): ChecklistItem[] {
-  const rows = db.query(`SELECT f.id, COALESCE(a.title_override, f.title) AS title, a.owner, a.kind, a.priority, a.predecessors, a.deadline_version, a.ceo_minutes, a.ceo_date, a.accelerator, a.status, a.disposition, a.evidence, a.updated_at, a.updated_by
+  const rows = db.query(`SELECT f.id, COALESCE(a.title_override, f.title) AS title, a.owner, a.kind, a.priority, a.predecessors, a.deadline_version, a.ceo_minutes, a.ceo_date, a.accelerator, a.refs, a.status, a.disposition, a.evidence, a.updated_at, a.updated_by
     FROM assignments a JOIN features f ON f.id = a.feature_id WHERE a.version = ? ORDER BY a.rowid`).all(version) as Array<Record<string, string | number | null>>;
   return rows.map((r) => {
     const evidence = [r.evidence, ...evidenceRefs(db, version, r.id as string)].filter((value) => value !== null).join('\n');
@@ -179,6 +183,7 @@ function items(db: Database, version: string): ChecklistItem[] {
       ...(r.deadline_version !== null ? { deadlineVersion: r.deadline_version as string } : {}),
       ...(r.ceo_minutes !== null ? { ceoMinutes: r.ceo_minutes as number } : {}), ...(r.ceo_date !== null ? { ceoDate: r.ceo_date as string } : {}),
       ...(r.accelerator === 1 ? { accelerator: true as const } : {}),
+      ...(r.refs !== null && r.refs !== undefined ? { refs: JSON.parse(r.refs as string) as string[] } : {}),
       ...(r.evidence !== null || evidence ? { evidence } : {}), ...(r.disposition !== null ? { disposition: r.disposition as ChecklistItem['disposition'] } : {}),
       updatedAt: r.updated_at as string, updatedBy: r.updated_by as string };
   });
@@ -192,9 +197,9 @@ function putItem(db: Database, version: string, item: ChecklistItem): void {
   if (!feature) db.query('INSERT INTO features (id, title, owner, kind, created_at) VALUES (?, ?, ?, ?, ?)').run(item.id, item.title, item.owner ?? null, item.kind ?? null, item.updatedAt);
   // features.owner/kind follow the latest assignment so details() and the checklist never disagree after a set.
   else if (item.owner !== undefined || item.kind !== undefined) db.query('UPDATE features SET owner = COALESCE(?, owner), kind = COALESCE(?, kind) WHERE id = ?').run(item.owner ?? null, item.kind ?? null, item.id);
-  db.query(`INSERT INTO assignments (feature_id, version, status, disposition, evidence, title_override, owner, kind, priority, predecessors, deadline_version, ceo_minutes, ceo_date, accelerator, updated_at, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    ON CONFLICT(feature_id, version) DO UPDATE SET status=excluded.status, disposition=excluded.disposition, evidence=excluded.evidence, owner=excluded.owner, kind=excluded.kind, priority=excluded.priority, predecessors=excluded.predecessors, deadline_version=excluded.deadline_version, ceo_minutes=excluded.ceo_minutes, ceo_date=excluded.ceo_date, accelerator=excluded.accelerator, updated_at=excluded.updated_at, updated_by=excluded.updated_by`)
-    .run(item.id, version, item.status, item.disposition ?? null, item.evidence ?? null, feature && feature.title !== item.title ? item.title : null, item.owner ?? null, item.kind ?? null, item.priority ?? null, item.predecessors ? JSON.stringify(item.predecessors) : null, item.deadlineVersion ?? null, item.ceoMinutes ?? null, item.ceoDate ?? null, item.accelerator === true ? 1 : null, item.updatedAt, item.updatedBy);
+  db.query(`INSERT INTO assignments (feature_id, version, status, disposition, evidence, title_override, owner, kind, priority, predecessors, deadline_version, ceo_minutes, ceo_date, accelerator, refs, updated_at, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(feature_id, version) DO UPDATE SET status=excluded.status, disposition=excluded.disposition, evidence=excluded.evidence, owner=excluded.owner, kind=excluded.kind, priority=excluded.priority, predecessors=excluded.predecessors, deadline_version=excluded.deadline_version, ceo_minutes=excluded.ceo_minutes, ceo_date=excluded.ceo_date, accelerator=excluded.accelerator, refs=excluded.refs, updated_at=excluded.updated_at, updated_by=excluded.updated_by`)
+    .run(item.id, version, item.status, item.disposition ?? null, item.evidence ?? null, feature && feature.title !== item.title ? item.title : null, item.owner ?? null, item.kind ?? null, item.priority ?? null, item.predecessors ? JSON.stringify(item.predecessors) : null, item.deadlineVersion ?? null, item.ceoMinutes ?? null, item.ceoDate ?? null, item.accelerator === true ? 1 : null, item.refs?.length ? JSON.stringify(item.refs) : null, item.updatedAt, item.updatedBy);
 }
 function jsonHash(contents: string | Buffer): string { return createHash('sha256').update(contents).digest('hex'); }
 
@@ -235,8 +240,8 @@ function importOnDb(db: Database, version: string): boolean {
       // Keep a legacy per-version title until an explicit retitle unifies the feature identity.
       if (!existing) putItem(db, version, item);
       else {
-        db.query('INSERT OR IGNORE INTO assignments (feature_id, version, status, disposition, evidence, title_override, owner, kind, priority, predecessors, deadline_version, ceo_minutes, ceo_date, accelerator, updated_at, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
-          .run(item.id, version, item.status, item.disposition ?? null, item.evidence ?? null, item.title === existing.title ? null : item.title, item.owner ?? null, item.kind ?? null, item.priority ?? null, item.predecessors ? JSON.stringify(item.predecessors) : null, item.deadlineVersion ?? null, item.ceoMinutes ?? null, item.ceoDate ?? null, item.accelerator === true ? 1 : null, item.updatedAt, item.updatedBy);
+        db.query('INSERT OR IGNORE INTO assignments (feature_id, version, status, disposition, evidence, title_override, owner, kind, priority, predecessors, deadline_version, ceo_minutes, ceo_date, accelerator, refs, updated_at, updated_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+          .run(item.id, version, item.status, item.disposition ?? null, item.evidence ?? null, item.title === existing.title ? null : item.title, item.owner ?? null, item.kind ?? null, item.priority ?? null, item.predecessors ? JSON.stringify(item.predecessors) : null, item.deadlineVersion ?? null, item.ceoMinutes ?? null, item.ceoDate ?? null, item.accelerator === true ? 1 : null, item.refs?.length ? JSON.stringify(item.refs) : null, item.updatedAt, item.updatedBy);
       }
     }
     for (const entry of data.history) record(db, version, entry);
@@ -263,7 +268,7 @@ function importOnDb(db: Database, version: string): boolean {
       record(db, version, { at: new Date().toISOString(), by: item.updatedBy, id: item.id, field: 'reimport', from: null, to: item, released: data.released, dev: data.dev });
       continue;
     }
-    const fields = ['title', 'status', 'evidence', 'owner', 'disposition', 'kind', 'priority', 'predecessors', 'deadlineVersion', 'ceoMinutes', 'ceoDate', 'accelerator'] as const;
+    const fields = ['title', 'status', 'evidence', 'owner', 'disposition', 'kind', 'priority', 'predecessors', 'deadlineVersion', 'ceoMinutes', 'ceoDate', 'accelerator', 'refs'] as const;
     const baseEvidence = (db.query('SELECT evidence FROM assignments WHERE feature_id = ? AND version = ?').get(item.id, version) as { evidence: string | null }).evidence ?? undefined;
     const preserveRefs = item.evidence === baseEvidence || item.evidence === current.evidence;
     const differs = fields.some((field) => field === 'evidence'
@@ -333,6 +338,30 @@ export interface ChecklistCollision { version: string; owner?: string; title: st
 
 export function mutate(version: string, released: string, dev: string, apply: (data: Checklist, otherItems: (id: string) => ChecklistCollision[]) => boolean): Checklist {
   validateVersion(version);
+  // COORD-HA ①(RFC-loop-agent-map §A8b): a write carries the generation this process saw; a stale one is refused only
+  // under hq.boardFencing 'enforce' (default shadow = write and log). The lease is read ONCE, before the write transaction —
+  // with an ssh arbiter a lease read inside the transaction would hold the ledger write lock across the network.
+  // Only 'enforce' (opt-in) re-reads once inside the transaction just before writing, so a lease taken over meanwhile
+  // still rolls the write back; shadow never touches the lease under the lock.
+  const hq = getUserConfig().hq;
+  const writerGeneration = hq ? readSeenGeneration(hqSeenGenerationPath(hq)) : null;
+  let recordedGeneration: number | null = null;
+  let firstMeasured = false;
+  if (hq) {
+    let lease: ReturnType<typeof readHqLease>['record'] | undefined;
+    try { lease = readHqLease({ config: hq }).record; }
+    catch (error) { debug.log('hq.fence', 'board-lease-unmeasured', { writer: writerGeneration, version, reason: String(error).slice(0, 200) }); }
+    // A missing lease (null) and a broken one (parseLease throws → caught above with its reason) are both «unmeasured».
+    if (lease === null) debug.log('hq.fence', 'board-lease-unmeasured', { writer: writerGeneration, version, reason: 'no-lease' });
+    if (lease) {
+      firstMeasured = true;
+      recordedGeneration = writerGeneration;
+      if (writerGeneration !== null && writerGeneration < lease.generation) {
+        debug.log('hq.fence', 'board-stale-write', { writer: writerGeneration, lease: lease.generation, version });
+        if (hq.boardFencing === 'enforce') throw new CliUserError(`낡은 세대 ${writerGeneration} < ${lease.generation} — 쓰기 거부`);
+      }
+    }
+  }
   const db = open();
   try {
     let imported = false;
@@ -351,6 +380,22 @@ export function mutate(version: string, released: string, dev: string, apply: (d
             return { version: item.version, ...(item.owner !== null ? { owner: item.owner } : {}), title: item.title };
           });
       })) {
+        if (hq?.boardFencing === 'enforce') {
+          let late: ReturnType<typeof readHqLease>['record'] = null;
+          let lateReason = 'no-lease';
+          try { late = readHqLease({ config: hq }).record; }
+          catch (error) { late = null; lateReason = String(error).slice(0, 200); }
+          if (!late) {
+            // Unmeasured right before the write: the write still goes through, but carries no generation it cannot vouch for.
+            // (Logged only when the first read had measured — an unmeasured first read was already logged once.)
+            if (firstMeasured) debug.log('hq.fence', 'board-lease-unmeasured', { writer: writerGeneration, version, reason: lateReason, phase: 'before-write' });
+            recordedGeneration = null;
+          }
+          if (late && writerGeneration !== null && writerGeneration < late.generation) {
+            debug.log('hq.fence', 'board-stale-write', { writer: writerGeneration, lease: late.generation, version });
+            throw new CliUserError(`낡은 세대 ${writerGeneration} < ${late.generation} — 쓰기 거부`);
+          }
+        }
         for (const item of data.items) if (before.get(item.id) !== JSON.stringify(item)) {
           const previous = before.get(item.id);
           const evidenceChanged = previous && (JSON.parse(previous) as ChecklistItem).evidence !== item.evidence;
@@ -364,7 +409,10 @@ export function mutate(version: string, released: string, dev: string, apply: (d
           db.query('DELETE FROM evidence WHERE feature_id = ? AND version = ?').run(id, version);
           db.query('DELETE FROM assignments WHERE feature_id = ? AND version = ?').run(id, version);
         }
-        for (const entry of data.history.slice(count)) record(db, version, entry);
+        for (const entry of data.history.slice(count)) {
+          if (recordedGeneration !== null) entry.generation = recordedGeneration;
+          record(db, version, entry);
+        }
       }
       return data;
     });

package/src/release-loop/landing-freeze.ts

@@ -8,6 +8,7 @@ export interface LandingFreeze {
   startedAt: string;
   until: string | null;
   by: string;
+  holdLaunches?: boolean;
 }
 
 export function landingFreezePath(root = effectiveInstanceRoot()): string {
@@ -25,21 +26,22 @@ export function readLandingFreeze(root = effectiveInstanceRoot(), now = new Date
   const freeze = record as Partial<LandingFreeze>;
   if (typeof freeze.reason !== 'string' || typeof freeze.by !== 'string' ||
       typeof freeze.startedAt !== 'string' || !Number.isFinite(Date.parse(freeze.startedAt)) ||
-      !(freeze.until === null || (typeof freeze.until === 'string' && Number.isFinite(Date.parse(freeze.until))))) {
+      !(freeze.until === null || (typeof freeze.until === 'string' && Number.isFinite(Date.parse(freeze.until)))) ||
+      (freeze.holdLaunches !== undefined && typeof freeze.holdLaunches !== 'boolean')) {
     throw new Error(`invalid landing freeze: ${path}`);
   }
   // An expired freeze reads as «off». The file is left alone: deleting it here could race a concurrent `freeze on`
   // that just wrote a new one (only `freeze off` removes it; the next `freeze on` overwrites it).
   if (freeze.until && Date.parse(freeze.until) <= now.getTime()) return null;
-  return freeze as LandingFreeze;
+  return { ...freeze, holdLaunches: freeze.holdLaunches ?? false } as LandingFreeze;
 }
 
-export function enableLandingFreeze(opts: { reason?: string; until?: string; by?: string }, root = effectiveInstanceRoot(), now = new Date()): LandingFreeze {
+export function enableLandingFreeze(opts: { reason?: string; until?: string; by?: string; holdLaunches?: boolean }, root = effectiveInstanceRoot(), now = new Date()): LandingFreeze {
   const until = opts.until === undefined ? null : opts.until;
   if (until !== null && (!/^\d{4}-\d\d-\d\dT\d\d:\d\d(?::\d\d(?:\.\d+)?)?(?:Z|[+-]\d\d:\d\d)$/.test(until) || !Number.isFinite(Date.parse(until)) || Date.parse(until) <= now.getTime())) {
     throw new Error('--until must be a future ISO timestamp with timezone');
   }
-  const freeze: LandingFreeze = { reason: opts.reason?.trim() || 'operator freeze', startedAt: now.toISOString(), until: until === null ? null : new Date(until).toISOString(), by: opts.by?.trim() || process.env.ELANOUS_TRACK || process.env.USER || 'cli' };
+  const freeze: LandingFreeze = { reason: opts.reason?.trim() || 'operator freeze', startedAt: now.toISOString(), until: until === null ? null : new Date(until).toISOString(), by: opts.by?.trim() || process.env.ELANOUS_TRACK || process.env.USER || 'cli', holdLaunches: opts.holdLaunches ?? false };
   const path = landingFreezePath(root);
   mkdirSync(root, { recursive: true });
   const tmp = `${path}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;

package/src/release-loop/light-rc.ts

@@ -0,0 +1,173 @@
+/** LIGHT-RC (0.2.19) — a light release-candidate check between cuts: the changed-file self gate over everything that
+ *  landed since the previous release's cut, plus an always-run test list (release/light-rc-always.txt), on the remote
+ *  gate host (GATE-REMOTE). Read-only for the release ledger: it reads the previous published version and never writes.
+ *  It does not touch the landing freeze or launch Pods. */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug } from '../debug/log.js';
+import { runSelfGateCli, type SelfGateCliOptions, type SelfGateCliResult } from '../self-implement/gate-cli.js';
+import { dispatchHeavyCheck, isValidGateHost, type DispatchDeps, type DispatchOptions } from '../self-implement/gate-remote.js';
+import { latestPublishedPreviousVersion } from '../../scripts/release-loop/unattended-release.js';
+import { baseVersion, isReleaseVersion } from '../../scripts/release-loop/release-version.js';
+
+export const LIGHT_RC_ALWAYS_FILE = 'release/light-rc-always.txt';
+export const LIGHT_RC_DEFAULT_SHARDS = 4;
+export const LIGHT_RC_NO_PREVIOUS_CUT = '직전 판 컷을 못 찾았다 — --base 로 준다';
+
+export interface LightRcOptions {
+  base?: string;
+  /** Gate host; absent = config gateRemote.host (the dispatch's own default). */
+  remote?: string;
+  /** Run on this machine (the remote child is re-invoked with it). */
+  local?: boolean;
+  shards?: number;
+  /** Release ledger root for the previous-version lookup (release run's deps.ledgerRoot). */
+  ledgerRoot?: string;
+  log?: (line: string) => void;
+}
+
+export interface LightRcResult {
+  version: string;
+  base: string;
+  /** New failures vs. the base; null = the gate produced no measurement (never read as green). */
+  introduced: number | null;
+  preexisting: number | null;
+  /** Failures the baseline could not classify (unknown + precondition-unmet); null = unmeasured. Non-zero is not green. */
+  unclassified: number | null;
+  alwaysInclude: number;
+  alwaysIncludeMissing: string[];
+  shards: number;
+  /** Host the gate ran on; null = this machine. */
+  remote: string | null;
+  gateExitCode: number;
+  ok: boolean;
+}
+
+export interface LightRcDeps {
+  cwd?: string;
+  git?: (args: string[], cwd: string) => { rc: number | null; stdout: string };
+  previousVersion?: (version: string, ledgerRoot?: string) => string;
+  readFile?: (path: string) => string | undefined;
+  runGate?: (cwd: string, options: SelfGateCliOptions) => SelfGateCliResult;
+  dispatch?: (opts: DispatchOptions, deps?: DispatchDeps) => Promise<number>;
+  /** Extra dispatch deps (runner · settings) — tests drive the real dispatch with a fake host. */
+  dispatchDeps?: Omit<DispatchDeps, 'write'>;
+}
+
+/** Shown when the gate ran remotely but the host name did not come back. */
+export const LIGHT_RC_UNKNOWN_HOST = '(remote · host unknown)';
+
+const defaultGit = (args: string[], cwd: string) => {
+  const run = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  return { rc: run.error ? null : run.status, stdout: run.stdout ?? '' };
+};
+
+/** One repository-relative path per line; `#` starts a comment; blank lines are skipped. */
+export function parseAlwaysIncludeList(text: string): string[] {
+  return [...new Set(text.split('\n').map((line) => line.replace(/#.*/, '').trim()).filter(Boolean))];
+}
+
+/** The previous release's cut: merge-base of origin/main and origin/release/<previous published version>. */
+export function previousCutBase(version: string, deps: LightRcDeps & { cwd: string; ledgerRoot?: string }): string {
+  let previous: string;
+  try {
+    previous = (deps.previousVersion ?? latestPublishedPreviousVersion)(baseVersion(version), deps.ledgerRoot);
+  } catch (error) {
+    throw new Error(`${LIGHT_RC_NO_PREVIOUS_CUT} (${error instanceof Error ? error.message : String(error)})`);
+  }
+  const mergeBase = (deps.git ?? defaultGit)(['merge-base', 'origin/main', `origin/release/${previous}`], deps.cwd);
+  const sha = mergeBase.stdout.trim();
+  if (mergeBase.rc !== 0 || !sha) throw new Error(`${LIGHT_RC_NO_PREVIOUS_CUT} (git merge-base origin/main origin/release/${previous} rc=${mergeBase.rc})`);
+  return sha;
+}
+
+function repoRoot(deps: LightRcDeps): string {
+  if (deps.cwd) return deps.cwd;
+  const top = defaultGit(['rev-parse', '--show-toplevel'], process.cwd());
+  if (top.rc !== 0 || !top.stdout.trim()) throw new Error('release light-rc: not inside a git repository');
+  return top.stdout.trim();
+}
+
+function parseRemoteResult(stdout: string): Partial<LightRcResult> | undefined {
+  const line = stdout.split('\n').map((l) => l.trim()).reverse().find((l) => l.startsWith('{'));
+  if (!line) return undefined;
+  try {
+    const parsed = JSON.parse(line) as Partial<LightRcResult> & { host?: unknown };
+    return parsed && typeof parsed === 'object' ? parsed : undefined;
+  } catch { return undefined; }
+}
+
+export async function runLightRc(version: string, opts: LightRcOptions = {}, deps: LightRcDeps = {}): Promise<LightRcResult> {
+  if (!isReleaseVersion(version)) throw new Error(`release version must be x.y.z: ${version}`);
+  const shards = opts.shards ?? LIGHT_RC_DEFAULT_SHARDS;
+  if (!Number.isSafeInteger(shards) || shards < 1) throw new Error(`invalid --shards count: ${opts.shards}`);
+  if (opts.remote !== undefined && !isValidGateHost(opts.remote)) throw new Error(`invalid --remote host: ${opts.remote}`);
+  const log = opts.log ?? ((line: string) => process.stderr.write(`${line}\n`));
+  const cwd = repoRoot(deps);
+  const base = opts.base ?? previousCutBase(version, { ...deps, cwd, ledgerRoot: opts.ledgerRoot });
+  const listPath = join(cwd, LIGHT_RC_ALWAYS_FILE);
+  const listText = (deps.readFile ?? ((path: string) => existsSync(path) ? readFileSync(path, 'utf8') : undefined))(listPath);
+  if (listText === undefined) throw new Error(`release light-rc: ${LIGHT_RC_ALWAYS_FILE} not found`);
+  const alwaysInclude = parseAlwaysIncludeList(listText);
+
+  let local: SelfGateCliResult | undefined;
+  const runLocal = () => {
+    local = (deps.runGate ?? runSelfGateCli)(cwd, { base, shards, alwaysInclude });
+    for (const line of local.lines) log(line);
+    return local.exitCode;
+  };
+  const captured: Buffer[] = [];
+  const rc = await (deps.dispatch ?? dispatchHeavyCheck)({
+    tool: 'self-gate', repo: cwd, installPwa: true, refs: [base], json: true,
+    // The host re-runs this command with --local (and ELANOUS_GATE_REMOTE_CHILD=1), so it never recurses.
+    remoteArgv: (sha) => ['bun', 'bin/elanous.mjs', 'release', 'light-rc', '--version', version, '--base', sha(base), '--shards', String(shards), '--local', '--json'],
+    flags: { remote: opts.local ? undefined : opts.remote ?? true, local: !!opts.local },
+    runLocal,
+  }, {
+    ...deps.dispatchDeps,
+    write: {
+      out: (data) => { captured.push(Buffer.from(data)); },
+      err: (data) => { process.stderr.write(data); },
+    },
+  });
+
+  let result: LightRcResult;
+  if (local) {
+    result = {
+      version, base,
+      introduced: local.baseline?.introduced ?? null,
+      preexisting: local.baseline?.preexisting ?? null,
+      unclassified: local.baseline ? local.baseline.unknown + local.baseline.preconditionUnmet : null,
+      alwaysInclude: alwaysInclude.length,
+      alwaysIncludeMissing: [...local.alwaysIncludeMissing],
+      shards, remote: null, gateExitCode: local.exitCode, ok: false,
+    };
+  } else {
+    const remote = parseRemoteResult(Buffer.concat(captured).toString('utf8'));
+    if (!remote) throw new Error(`release light-rc: remote gate returned no result (rc=${rc})`);
+    const host = (remote as { host?: unknown }).host;
+    result = {
+      version, base,
+      introduced: typeof remote.introduced === 'number' ? remote.introduced : null,
+      preexisting: typeof remote.preexisting === 'number' ? remote.preexisting : null,
+      unclassified: typeof remote.unclassified === 'number' ? remote.unclassified : null,
+      alwaysInclude: alwaysInclude.length,
+      alwaysIncludeMissing: Array.isArray(remote.alwaysIncludeMissing) ? remote.alwaysIncludeMissing.map(String) : [],
+      shards, remote: typeof host === 'string' && host ? host : opts.remote ?? LIGHT_RC_UNKNOWN_HOST,
+      gateExitCode: typeof remote.gateExitCode === 'number' ? remote.gateExitCode : rc, ok: false,
+    };
+  }
+  // Unmeasured (null) or unclassified failures are never green; policy-gate findings in the gate output are reported
+  // (gate rc), not a regression.
+  result.ok = result.introduced === 0 && result.unclassified === 0;
+  debug.log('release.light-rc', 'done', { version, base, introduced: result.introduced, preexisting: result.preexisting, unclassified: result.unclassified, shards, remote: result.remote });
+  return result;
+}
+
+export function formatLightRc(result: LightRcResult): string[] {
+  return [
+    `${result.ok ? '✅' : '⛔'} light-rc ${result.version} · base ${result.base.slice(0, 12)} · ${result.remote ? `host ${result.remote}` : 'local'} · shards ${result.shards}`,
+    `  introduced ${result.introduced ?? '못 쟀다'} · preexisting ${result.preexisting ?? '못 쟀다'} · unclassified ${result.unclassified ?? '못 쟀다'} · always-include ${result.alwaysInclude}${result.alwaysIncludeMissing.length ? ` (missing: ${result.alwaysIncludeMissing.join(', ')})` : ''} · gate rc ${result.gateExitCode}`,
+  ];
+}

package/src/release-loop/placement.ts

@@ -2,12 +2,14 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { CliUserError } from '../cli/cli-user-error.js';
+import { resolveRepositoryName } from '../harness/repository-name.js';
 import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { userConfigPath } from '../user-config.js';
 import { addItem, listChecklist, ownerMatches, parseOwner, setItem, validateCeoLoad, type ChecklistItem } from './checklist.js';
 import { move, releasedVersion } from './feature-store.js';
 import { listSchedules, type ReleaseSchedule } from './release-schedule.js';
+import { parseRubric, rubricScore } from './rubric.js';
 
 export type PlacementPriority = 'P0' | 'P1' | 'P2';
 export interface PlacementCell { id: string; title: string; owner: string; priority: PlacementPriority; predecessors: string[]; deadlineVersion?: string; ceoMinutes?: number; ceoDate?: string; accelerator?: boolean }
@@ -39,10 +41,41 @@ function versionOrder(a: string, b: string): number {
   return 0;
 }
 
+/** Where each cell id lives. An id may repeat when one copy is in an already released version — history kept two
+ *  different cells under one id (IA1 · EV10a … in 0.2.6~0.2.15) and later cells reused old ids (INSIDE1 0.2.11 ⊕
+ *  0.2.19). A released copy is history: an open copy wins over it, and between released copies the latest wins. Only
+ *  two open copies are a real conflict (ORCH-LIVE-1008 rehearsal 1: every placement failed on «여러 판의 같은 칸»). */
+function cellLocations(snapshots: Iterable<[string, readonly { id: string }[]]>, released: string | null | undefined, skip: readonly string[] = []): { locations: Map<string, string>; conflict: string | null } {
+  const locations = new Map<string, string>();
+  const shipped = (version: string) => !!released && versionOrder(version, released) <= 0;
+  for (const [version, items] of snapshots) {
+    if (skip.includes(version)) continue;
+    for (const item of items) {
+      const previous = locations.get(item.id);
+      if (previous !== undefined) {
+        if (!shipped(previous) && !shipped(version)) return { locations, conflict: item.id };
+        // Keep the open copy; between two released copies keep the later one.
+        const keepPrevious = shipped(version) && (!shipped(previous) || versionOrder(version, previous) < 0);
+        if (keepPrevious) continue;
+      }
+      locations.set(item.id, version);
+    }
+  }
+  return { locations, conflict: null };
+}
+
 /** The merged PR list is a first-class GitHub query, not a count inferred from checklist status. */
+// ORCH-LIVE-1008: the orchestrator tick runs from the installed package (not a git checkout), where a bare `gh pr list`
+// fails «not a git repository» and placement silently left every cell unplaced — so the repository is named explicitly
+// (--repo > harness.repo > GH_REPO > the checkout's remote · `resolveRepositoryName`).
 export function mergedPrsLast24h(now = new Date()): number {
   const since = new Date(now.getTime() - 86_400_000).toISOString();
-  const r = spawnSync('gh', ['pr', 'list', '--state', 'merged', '--search', `merged:>=${since.slice(0, 10)}`, '--limit', '1000', '--json', 'number,mergedAt'], { encoding: 'utf8' });
+  let repo: string;
+  try { repo = resolveRepositoryName(); }
+  catch (error) {
+    throw new CliUserError(`병합 PR 속도 조회 실패: 저장소를 못 정했다 — ${(error instanceof Error ? error.message : String(error)).split('\n')[0]}`, 'harness.repo 설정(owner/name) 또는 GH_REPO');
+  }
+  const r = spawnSync('gh', ['pr', 'list', '--repo', repo, '--state', 'merged', '--search', `merged:>=${since.slice(0, 10)}`, '--limit', '1000', '--json', 'number,mergedAt'], { encoding: 'utf8' });
   if (r.status !== 0) throw new CliUserError(`병합 PR 속도 조회 실패: ${(r.stderr || r.error || '').toString().trim()}`);
   let rows: Array<{ number: number; mergedAt: string }>;
   try { rows = JSON.parse(r.stdout) as typeof rows; }
@@ -91,10 +124,16 @@ function dependencyViolation(
   locations: Map<string, string>,
   overrides: Map<string, string>,
   input: PlacementCell,
+  released?: string | null,
 ): string | null {
   for (const [version, snapshot] of snapshots) for (const item of snapshot.items) {
-    const dependentVersion = overrides.get(item.id) ?? version;
+    // A released version is history — its cells (and what they once depended on) never constrain a new placement.
+    if (released && versionOrder(version, released) <= 0) continue;
     const predecessors = item.id === input.id ? input.predecessors : item.predecessors ?? [];
+    // Only the cells this placement moves, and cells that depend on them, can be made wrong by it — a pre-existing
+    // violation elsewhere on the board must not make every placement infeasible (ORCH-LIVE-1008 rehearsal 1).
+    if (!overrides.has(item.id) && !predecessors.some((predecessor) => overrides.has(predecessor))) continue;
+    const dependentVersion = overrides.get(item.id) ?? version;
     for (const predecessor of predecessors) {
       const predecessorVersion = overrides.get(predecessor) ?? locations.get(predecessor);
       if (!predecessorVersion || versionOrder(dependentVersion, predecessorVersion) <= 0)
@@ -130,12 +169,8 @@ export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): Place
   const open = schedules.filter((row) => (!released || versionOrder(row.version, released) > 0) && row.landBy && available(row, now, backlog));
   const sources = [...new Set([...schedules.map((row) => row.version), ...backlog])];
   const snapshots = new Map(sources.map((version) => [version, (deps.checklist ?? listChecklist)(version)]));
-  const locations = new Map<string, string>();
-  for (const [version, snapshot] of snapshots) for (const item of snapshot.items) {
-    if (backlog.includes(version)) continue;
-    if (locations.has(item.id)) throw new CliUserError(`여러 판의 같은 칸: ${item.id}`);
-    locations.set(item.id, version);
-  }
+  const { locations, conflict } = cellLocations([...snapshots].map(([version, snapshot]) => [version, snapshot.items] as [string, readonly { id: string }[]]), released, backlog);
+  if (conflict) throw new CliUserError(`여러 판의 같은 칸: ${conflict}`);
   // A backlog copy never outranks a scheduled cell with the same id.
   for (const version of backlog) for (const item of snapshots.get(version)?.items ?? []) if (!locations.has(item.id)) locations.set(item.id, version);
   const from = locations.get(input.id) ?? null;
@@ -171,7 +206,7 @@ export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): Place
   const displaced: PlacementDecision['displaced'] = [];
   let chosen: ReleaseSchedule | undefined;
   let loadIssue: string | null = null;
-  const feasible = candidates.filter((row) => !dependencyViolation(snapshots, locations, new Map([[input.id, row.version]]), input));
+  const feasible = candidates.filter((row) => !dependencyViolation(snapshots, locations, new Map([[input.id, row.version]]), input, released));
   // 판은 «마감 안 가장 이른 판»부터 본다(기존 불변식). 가속 등급은 그 판이 찼을 때 같은 우선순위 비가속 칸을 밀 수 있게만 한다.
   for (const row of feasible) {
     const placement = new Map([[input.id, row.version]]);
@@ -191,7 +226,7 @@ export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): Place
       || (accelerator && priority === input.priority);
     const p2 = [...items].reverse().find((item) => {
       if (item.accelerator === true) return false;
-      if (!victimOk(item.priority) || dependencyViolation(snapshots, locations, new Map([...placement, [item.id, next.version]]), input)) return false;
+      if (!victimOk(item.priority) || dependencyViolation(snapshots, locations, new Map([...placement, [item.id, next.version]]), input, released)) return false;
       if (item.deadlineVersion && versionOrder(next.version, item.deadlineVersion) > 0) return false;
       if (items.length < capacity(row) && !(seatItems.length >= seatLimit && ownerMatches(item.owner, seat))) return false;
       if (!item.owner) return false;
@@ -234,6 +269,7 @@ export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): Place
 function moveConstraint(
   item: ChecklistItem, to: ReleaseSchedule, backlog: readonly string[],
   snapshots: Map<string, ChecklistItem[]>, now: number, rate: number, caps: Record<string, number>, rows: ReleaseSchedule[], ceoCap: number,
+  released: string | null | undefined,
 ): string | null {
   if (!to.landBy || !available(to, now, backlog)) return '착지 마감이 지났거나 백로그 판이라 이동 불가';
   if (item.deadlineVersion && versionOrder(to.version, item.deadlineVersion) > 0) return '마감 판 뒤로 이월 불가';
@@ -245,16 +281,15 @@ function moveConstraint(
   const loadIssue = ceoOverload(item, to, new Map([...snapshots].map(([version, items]) => [version, { items }])),
     rows, ceoCap);
   if (loadIssue) return loadIssue;
-  const locations = new Map<string, string>();
-  for (const [version, items] of snapshots) for (const cell of items) {
-    if (locations.has(cell.id)) return `여러 판의 같은 칸: ${cell.id}`;
-    locations.set(cell.id, version);
-  }
+  const { locations, conflict } = cellLocations(snapshots, released);
+  if (conflict) return `여러 판의 같은 칸: ${conflict}`;
   for (const predecessor of item.predecessors ?? []) {
     const location = locations.get(predecessor);
     if (!location || versionOrder(to.version, location) <= 0) return `선행 칸 ${predecessor} 이후 판으로만 이동 가능`;
   }
   for (const [version, items] of snapshots) for (const dependent of items) {
+    // A released version is history — its cells never pin a move (same rule as placement).
+    if (released && versionOrder(version, released) <= 0) continue;
     if (dependent.id !== item.id && dependent.predecessors?.includes(item.id) && versionOrder(version, to.version) <= 0)
       return `의존 칸 ${dependent.id} 이전 판으로만 이동 가능`;
   }
@@ -271,20 +306,29 @@ export function rebalance(version: string, deps: PlacementDeps = {}): RebalanceR
   const backlog = deps.backlog ?? BACKLOG_VERSIONS;
   const next = rows.find((row) => versionOrder(row.version, version) > 0 && !backlog.includes(row.version));
   const snapshots = new Map(rows.map((row) => [row.version, [...(deps.checklist ?? listChecklist)(row.version).items]]));
-  const unstarted = snapshots.get(version)!.filter((item) => item.status === 'yellow' && !item.evidence);
+  const unstarted = snapshots.get(version)!.filter((item) => item.status === 'yellow' && !item.evidence)
+    .map((item, index) => {
+      const rubric = parseRubric(`${item.title}\n${item.evidence ?? ''}`);
+      return { item, index, score: rubric ? rubricScore(rubric) : null };
+    })
+    .sort((a, b) => {
+      if (a.score === null) return b.score === null ? a.index - b.index : 1;
+      if (b.score === null) return -1;
+      return a.score - b.score || a.index - b.index;
+    });
   if (unstarted.length && !next) throw new CliUserError(`${version} 다음 판이 없다`);
   if (!unstarted.length) return { decisions: [], blocked: [] };
   const rate = deps.merged24h ?? mergedPrsLast24h(new Date(now));
   const caps = deps.seatCap ?? placementSeatCap();
   const ceoCap = validCeoCap(deps.ceoDailyCap ?? placementCeoDailyCap());
   const result: RebalanceResult = { decisions: [], blocked: [] };
-  for (const item of unstarted) {
-    const violation = moveConstraint(item, next!, backlog, snapshots, now, rate, caps, rows, ceoCap);
+  for (const { item, score } of unstarted) {
+    const violation = moveConstraint(item, next!, backlog, snapshots, now, rate, caps, rows, ceoCap, deps.released ?? releasedVersion());
     if (violation) {
       result.blocked.push({ id: item.id, from: version, to: next!.version, reason: violation });
       continue;
     }
-    const reason = `${version} 착지 마감 2시간 전 미시작 칸 이월`;
+    const reason = `${version} 착지 마감 2시간 전 미시작 칸 이월${score === null ? '' : ` · 루브릭 ${score}`}`;
     result.decisions.push({ id: item.id, from: version, version: next!.version, reason, displaced: [] });
     snapshots.set(version, snapshots.get(version)!.filter((cell) => cell.id !== item.id));
     snapshots.get(next!.version)!.push(item);
@@ -305,7 +349,7 @@ export function seatMove(id: string, from: string, to: string, by: string, reaso
   if (!ownerMatches(item.owner, parseOwner(by).seat) || next?.version !== to) throw new CliUserError('남의 칸 당기기 거부 — COO 에 요청');
   const now = (deps.now ?? new Date()).getTime();
   const rate = deps.merged24h ?? mergedPrsLast24h(new Date(now));
-  const violation = moveConstraint(item, next, backlog, snapshots, now, rate, deps.seatCap ?? placementSeatCap(), rows, validCeoCap(deps.ceoDailyCap ?? placementCeoDailyCap()));
+  const violation = moveConstraint(item, next, backlog, snapshots, now, rate, deps.seatCap ?? placementSeatCap(), rows, validCeoCap(deps.ceoDailyCap ?? placementCeoDailyCap()), deps.released ?? releasedVersion());
   if (violation) throw new CliUserError(`${id}: ${violation}`);
   if (!deps.dryRun) move(id, from, to, by, undefined, undefined, reason);
 }