elanous 0.2.18 → 0.2.19

package/src/release-loop/feature-store.ts

@@ -5,6 +5,8 @@ import { Database } from 'bun:sqlite';
 import { releaseLedgerRoot } from '../instance/resolve.js';
 import { CliUserError } from '../cli/cli-user-error.js';
 import { debug } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
+import { hqSeenGenerationPath, readHqLease, readSeenGeneration } from '../hq/hq.js';
 import { devVersion, type Checklist, type ChecklistHistory, type ChecklistItem } from './checklist.js';
 
 export function validateVersion(version: string): void {
@@ -32,7 +34,7 @@ export function releasedVersion(ledgerRoot = releaseLedgerRoot()): string {
 const walWait = new Int32Array(new SharedArrayBuffer(4));
 const SCHEMA_COLUMNS: Record<string, readonly string[]> = {
   imported_versions: ['json_hash', 'imported_at'],
-  events: ['reason'],
+  events: ['reason', 'generation'],
   assignments: ['priority', 'predecessors', 'deadline_version', 'ceo_minutes', 'ceo_date', 'accelerator', 'refs'],
   release_schedules: ['freeze_from', 'freeze_until'],
 };
@@ -72,7 +74,9 @@ function open(root = releaseLedgerRoot()): Database {
       const columns = db.query('PRAGMA table_info(imported_versions)').all() as Array<{ name: string }>;
       if (!columns.some((column) => column.name === 'json_hash')) db.exec('ALTER TABLE imported_versions ADD COLUMN json_hash TEXT');
       if (!columns.some((column) => column.name === 'imported_at')) db.exec('ALTER TABLE imported_versions ADD COLUMN imported_at TEXT');
-      if (!(db.query('PRAGMA table_info(events)').all() as Array<{ name: string }>).some((column) => column.name === 'reason')) db.exec('ALTER TABLE events ADD COLUMN reason TEXT');
+      const eventColumns = db.query('PRAGMA table_info(events)').all() as Array<{ name: string }>;
+      if (!eventColumns.some((column) => column.name === 'reason')) db.exec('ALTER TABLE events ADD COLUMN reason TEXT');
+      if (!eventColumns.some((column) => column.name === 'generation')) db.exec('ALTER TABLE events ADD COLUMN generation INTEGER');
       db.exec('CREATE TABLE IF NOT EXISTS release_schedules (version TEXT PRIMARY KEY, cut_at TEXT NOT NULL, land_by TEXT, updated_at TEXT NOT NULL, updated_by TEXT NOT NULL)');
       const assignmentColumns = db.query('PRAGMA table_info(assignments)').all() as Array<{ name: string }>;
       for (const [name, sql] of [['priority', 'TEXT'], ['predecessors', 'TEXT'], ['deadline_version', 'TEXT'], ['ceo_minutes', 'INTEGER'], ['ceo_date', 'TEXT'], ['accelerator', 'INTEGER'], ['refs', 'TEXT']] as const) {
@@ -155,15 +159,15 @@ function readTransaction<T>(db: Database, work: () => T): T {
   catch (error) { db.exec('ROLLBACK'); throw error; }
 }
 
-type EventRow = { seq: number; at: string; by: string; feature_id: string; version: string; field: string; from: string; to: string; released: string; dev: string; reason: string | null };
+type EventRow = { seq: number; at: string; by: string; feature_id: string; version: string; field: string; from: string; to: string; released: string; dev: string; reason: string | null; generation: number | null };
 function decode(value: string | null): unknown { return value === null ? null : JSON.parse(value); }
 function historyRow(row: EventRow): ChecklistHistory {
   return { at: row.at, by: row.by, id: row.feature_id, field: row.field, from: decode(row.from), to: decode(row.to), released: row.released, dev: row.dev,
-    ...(row.reason !== null ? { reason: row.reason } : {}) };
+    ...(row.reason !== null ? { reason: row.reason } : {}), ...(row.generation !== null ? { generation: row.generation } : {}) };
 }
 function record(db: Database, version: string, entry: ChecklistHistory): void {
-  db.query('INSERT INTO events (at, by, feature_id, version, field, "from", "to", released, dev, reason) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
-    .run(entry.at, entry.by, entry.id, version, entry.field, JSON.stringify(entry.from ?? null), JSON.stringify(entry.to ?? null), entry.released, entry.dev, entry.reason ?? null);
+  db.query('INSERT INTO events (at, by, feature_id, version, field, "from", "to", released, dev, reason, generation) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+    .run(entry.at, entry.by, entry.id, version, entry.field, JSON.stringify(entry.from ?? null), JSON.stringify(entry.to ?? null), entry.released, entry.dev, entry.reason ?? null, entry.generation ?? null);
 }
 function evidenceRefs(db: Database, version: string, id: string): string[] {
   return (db.query('SELECT ref FROM evidence WHERE feature_id = ? AND version = ? ORDER BY rowid').all(id, version) as Array<{ ref: string }>).map((row) => row.ref);
@@ -334,6 +338,30 @@ export interface ChecklistCollision { version: string; owner?: string; title: st
 
 export function mutate(version: string, released: string, dev: string, apply: (data: Checklist, otherItems: (id: string) => ChecklistCollision[]) => boolean): Checklist {
   validateVersion(version);
+  // COORD-HA ①(RFC-loop-agent-map §A8b): a write carries the generation this process saw; a stale one is refused only
+  // under hq.boardFencing 'enforce' (default shadow = write and log). The lease is read ONCE, before the write transaction —
+  // with an ssh arbiter a lease read inside the transaction would hold the ledger write lock across the network.
+  // Only 'enforce' (opt-in) re-reads once inside the transaction just before writing, so a lease taken over meanwhile
+  // still rolls the write back; shadow never touches the lease under the lock.
+  const hq = getUserConfig().hq;
+  const writerGeneration = hq ? readSeenGeneration(hqSeenGenerationPath(hq)) : null;
+  let recordedGeneration: number | null = null;
+  let firstMeasured = false;
+  if (hq) {
+    let lease: ReturnType<typeof readHqLease>['record'] | undefined;
+    try { lease = readHqLease({ config: hq }).record; }
+    catch (error) { debug.log('hq.fence', 'board-lease-unmeasured', { writer: writerGeneration, version, reason: String(error).slice(0, 200) }); }
+    // A missing lease (null) and a broken one (parseLease throws → caught above with its reason) are both «unmeasured».
+    if (lease === null) debug.log('hq.fence', 'board-lease-unmeasured', { writer: writerGeneration, version, reason: 'no-lease' });
+    if (lease) {
+      firstMeasured = true;
+      recordedGeneration = writerGeneration;
+      if (writerGeneration !== null && writerGeneration < lease.generation) {
+        debug.log('hq.fence', 'board-stale-write', { writer: writerGeneration, lease: lease.generation, version });
+        if (hq.boardFencing === 'enforce') throw new CliUserError(`낡은 세대 ${writerGeneration} < ${lease.generation} — 쓰기 거부`);
+      }
+    }
+  }
   const db = open();
   try {
     let imported = false;
@@ -352,6 +380,22 @@ export function mutate(version: string, released: string, dev: string, apply: (d
             return { version: item.version, ...(item.owner !== null ? { owner: item.owner } : {}), title: item.title };
           });
       })) {
+        if (hq?.boardFencing === 'enforce') {
+          let late: ReturnType<typeof readHqLease>['record'] = null;
+          let lateReason = 'no-lease';
+          try { late = readHqLease({ config: hq }).record; }
+          catch (error) { late = null; lateReason = String(error).slice(0, 200); }
+          if (!late) {
+            // Unmeasured right before the write: the write still goes through, but carries no generation it cannot vouch for.
+            // (Logged only when the first read had measured — an unmeasured first read was already logged once.)
+            if (firstMeasured) debug.log('hq.fence', 'board-lease-unmeasured', { writer: writerGeneration, version, reason: lateReason, phase: 'before-write' });
+            recordedGeneration = null;
+          }
+          if (late && writerGeneration !== null && writerGeneration < late.generation) {
+            debug.log('hq.fence', 'board-stale-write', { writer: writerGeneration, lease: late.generation, version });
+            throw new CliUserError(`낡은 세대 ${writerGeneration} < ${late.generation} — 쓰기 거부`);
+          }
+        }
         for (const item of data.items) if (before.get(item.id) !== JSON.stringify(item)) {
           const previous = before.get(item.id);
           const evidenceChanged = previous && (JSON.parse(previous) as ChecklistItem).evidence !== item.evidence;
@@ -365,7 +409,10 @@ export function mutate(version: string, released: string, dev: string, apply: (d
           db.query('DELETE FROM evidence WHERE feature_id = ? AND version = ?').run(id, version);
           db.query('DELETE FROM assignments WHERE feature_id = ? AND version = ?').run(id, version);
         }
-        for (const entry of data.history.slice(count)) record(db, version, entry);
+        for (const entry of data.history.slice(count)) {
+          if (recordedGeneration !== null) entry.generation = recordedGeneration;
+          record(db, version, entry);
+        }
       }
       return data;
     });

package/src/release-loop/light-rc.ts

@@ -0,0 +1,173 @@
+/** LIGHT-RC (0.2.19) — a light release-candidate check between cuts: the changed-file self gate over everything that
+ *  landed since the previous release's cut, plus an always-run test list (release/light-rc-always.txt), on the remote
+ *  gate host (GATE-REMOTE). Read-only for the release ledger: it reads the previous published version and never writes.
+ *  It does not touch the landing freeze or launch Pods. */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug } from '../debug/log.js';
+import { runSelfGateCli, type SelfGateCliOptions, type SelfGateCliResult } from '../self-implement/gate-cli.js';
+import { dispatchHeavyCheck, isValidGateHost, type DispatchDeps, type DispatchOptions } from '../self-implement/gate-remote.js';
+import { latestPublishedPreviousVersion } from '../../scripts/release-loop/unattended-release.js';
+import { baseVersion, isReleaseVersion } from '../../scripts/release-loop/release-version.js';
+
+export const LIGHT_RC_ALWAYS_FILE = 'release/light-rc-always.txt';
+export const LIGHT_RC_DEFAULT_SHARDS = 4;
+export const LIGHT_RC_NO_PREVIOUS_CUT = '직전 판 컷을 못 찾았다 — --base 로 준다';
+
+export interface LightRcOptions {
+  base?: string;
+  /** Gate host; absent = config gateRemote.host (the dispatch's own default). */
+  remote?: string;
+  /** Run on this machine (the remote child is re-invoked with it). */
+  local?: boolean;
+  shards?: number;
+  /** Release ledger root for the previous-version lookup (release run's deps.ledgerRoot). */
+  ledgerRoot?: string;
+  log?: (line: string) => void;
+}
+
+export interface LightRcResult {
+  version: string;
+  base: string;
+  /** New failures vs. the base; null = the gate produced no measurement (never read as green). */
+  introduced: number | null;
+  preexisting: number | null;
+  /** Failures the baseline could not classify (unknown + precondition-unmet); null = unmeasured. Non-zero is not green. */
+  unclassified: number | null;
+  alwaysInclude: number;
+  alwaysIncludeMissing: string[];
+  shards: number;
+  /** Host the gate ran on; null = this machine. */
+  remote: string | null;
+  gateExitCode: number;
+  ok: boolean;
+}
+
+export interface LightRcDeps {
+  cwd?: string;
+  git?: (args: string[], cwd: string) => { rc: number | null; stdout: string };
+  previousVersion?: (version: string, ledgerRoot?: string) => string;
+  readFile?: (path: string) => string | undefined;
+  runGate?: (cwd: string, options: SelfGateCliOptions) => SelfGateCliResult;
+  dispatch?: (opts: DispatchOptions, deps?: DispatchDeps) => Promise<number>;
+  /** Extra dispatch deps (runner · settings) — tests drive the real dispatch with a fake host. */
+  dispatchDeps?: Omit<DispatchDeps, 'write'>;
+}
+
+/** Shown when the gate ran remotely but the host name did not come back. */
+export const LIGHT_RC_UNKNOWN_HOST = '(remote · host unknown)';
+
+const defaultGit = (args: string[], cwd: string) => {
+  const run = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  return { rc: run.error ? null : run.status, stdout: run.stdout ?? '' };
+};
+
+/** One repository-relative path per line; `#` starts a comment; blank lines are skipped. */
+export function parseAlwaysIncludeList(text: string): string[] {
+  return [...new Set(text.split('\n').map((line) => line.replace(/#.*/, '').trim()).filter(Boolean))];
+}
+
+/** The previous release's cut: merge-base of origin/main and origin/release/<previous published version>. */
+export function previousCutBase(version: string, deps: LightRcDeps & { cwd: string; ledgerRoot?: string }): string {
+  let previous: string;
+  try {
+    previous = (deps.previousVersion ?? latestPublishedPreviousVersion)(baseVersion(version), deps.ledgerRoot);
+  } catch (error) {
+    throw new Error(`${LIGHT_RC_NO_PREVIOUS_CUT} (${error instanceof Error ? error.message : String(error)})`);
+  }
+  const mergeBase = (deps.git ?? defaultGit)(['merge-base', 'origin/main', `origin/release/${previous}`], deps.cwd);
+  const sha = mergeBase.stdout.trim();
+  if (mergeBase.rc !== 0 || !sha) throw new Error(`${LIGHT_RC_NO_PREVIOUS_CUT} (git merge-base origin/main origin/release/${previous} rc=${mergeBase.rc})`);
+  return sha;
+}
+
+function repoRoot(deps: LightRcDeps): string {
+  if (deps.cwd) return deps.cwd;
+  const top = defaultGit(['rev-parse', '--show-toplevel'], process.cwd());
+  if (top.rc !== 0 || !top.stdout.trim()) throw new Error('release light-rc: not inside a git repository');
+  return top.stdout.trim();
+}
+
+function parseRemoteResult(stdout: string): Partial<LightRcResult> | undefined {
+  const line = stdout.split('\n').map((l) => l.trim()).reverse().find((l) => l.startsWith('{'));
+  if (!line) return undefined;
+  try {
+    const parsed = JSON.parse(line) as Partial<LightRcResult> & { host?: unknown };
+    return parsed && typeof parsed === 'object' ? parsed : undefined;
+  } catch { return undefined; }
+}
+
+export async function runLightRc(version: string, opts: LightRcOptions = {}, deps: LightRcDeps = {}): Promise<LightRcResult> {
+  if (!isReleaseVersion(version)) throw new Error(`release version must be x.y.z: ${version}`);
+  const shards = opts.shards ?? LIGHT_RC_DEFAULT_SHARDS;
+  if (!Number.isSafeInteger(shards) || shards < 1) throw new Error(`invalid --shards count: ${opts.shards}`);
+  if (opts.remote !== undefined && !isValidGateHost(opts.remote)) throw new Error(`invalid --remote host: ${opts.remote}`);
+  const log = opts.log ?? ((line: string) => process.stderr.write(`${line}\n`));
+  const cwd = repoRoot(deps);
+  const base = opts.base ?? previousCutBase(version, { ...deps, cwd, ledgerRoot: opts.ledgerRoot });
+  const listPath = join(cwd, LIGHT_RC_ALWAYS_FILE);
+  const listText = (deps.readFile ?? ((path: string) => existsSync(path) ? readFileSync(path, 'utf8') : undefined))(listPath);
+  if (listText === undefined) throw new Error(`release light-rc: ${LIGHT_RC_ALWAYS_FILE} not found`);
+  const alwaysInclude = parseAlwaysIncludeList(listText);
+
+  let local: SelfGateCliResult | undefined;
+  const runLocal = () => {
+    local = (deps.runGate ?? runSelfGateCli)(cwd, { base, shards, alwaysInclude });
+    for (const line of local.lines) log(line);
+    return local.exitCode;
+  };
+  const captured: Buffer[] = [];
+  const rc = await (deps.dispatch ?? dispatchHeavyCheck)({
+    tool: 'self-gate', repo: cwd, installPwa: true, refs: [base], json: true,
+    // The host re-runs this command with --local (and ELANOUS_GATE_REMOTE_CHILD=1), so it never recurses.
+    remoteArgv: (sha) => ['bun', 'bin/elanous.mjs', 'release', 'light-rc', '--version', version, '--base', sha(base), '--shards', String(shards), '--local', '--json'],
+    flags: { remote: opts.local ? undefined : opts.remote ?? true, local: !!opts.local },
+    runLocal,
+  }, {
+    ...deps.dispatchDeps,
+    write: {
+      out: (data) => { captured.push(Buffer.from(data)); },
+      err: (data) => { process.stderr.write(data); },
+    },
+  });
+
+  let result: LightRcResult;
+  if (local) {
+    result = {
+      version, base,
+      introduced: local.baseline?.introduced ?? null,
+      preexisting: local.baseline?.preexisting ?? null,
+      unclassified: local.baseline ? local.baseline.unknown + local.baseline.preconditionUnmet : null,
+      alwaysInclude: alwaysInclude.length,
+      alwaysIncludeMissing: [...local.alwaysIncludeMissing],
+      shards, remote: null, gateExitCode: local.exitCode, ok: false,
+    };
+  } else {
+    const remote = parseRemoteResult(Buffer.concat(captured).toString('utf8'));
+    if (!remote) throw new Error(`release light-rc: remote gate returned no result (rc=${rc})`);
+    const host = (remote as { host?: unknown }).host;
+    result = {
+      version, base,
+      introduced: typeof remote.introduced === 'number' ? remote.introduced : null,
+      preexisting: typeof remote.preexisting === 'number' ? remote.preexisting : null,
+      unclassified: typeof remote.unclassified === 'number' ? remote.unclassified : null,
+      alwaysInclude: alwaysInclude.length,
+      alwaysIncludeMissing: Array.isArray(remote.alwaysIncludeMissing) ? remote.alwaysIncludeMissing.map(String) : [],
+      shards, remote: typeof host === 'string' && host ? host : opts.remote ?? LIGHT_RC_UNKNOWN_HOST,
+      gateExitCode: typeof remote.gateExitCode === 'number' ? remote.gateExitCode : rc, ok: false,
+    };
+  }
+  // Unmeasured (null) or unclassified failures are never green; policy-gate findings in the gate output are reported
+  // (gate rc), not a regression.
+  result.ok = result.introduced === 0 && result.unclassified === 0;
+  debug.log('release.light-rc', 'done', { version, base, introduced: result.introduced, preexisting: result.preexisting, unclassified: result.unclassified, shards, remote: result.remote });
+  return result;
+}
+
+export function formatLightRc(result: LightRcResult): string[] {
+  return [
+    `${result.ok ? '✅' : '⛔'} light-rc ${result.version} · base ${result.base.slice(0, 12)} · ${result.remote ? `host ${result.remote}` : 'local'} · shards ${result.shards}`,
+    `  introduced ${result.introduced ?? '못 쟀다'} · preexisting ${result.preexisting ?? '못 쟀다'} · unclassified ${result.unclassified ?? '못 쟀다'} · always-include ${result.alwaysInclude}${result.alwaysIncludeMissing.length ? ` (missing: ${result.alwaysIncludeMissing.join(', ')})` : ''} · gate rc ${result.gateExitCode}`,
+  ];
+}

package/src/release-loop/placement.ts

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { CliUserError } from '../cli/cli-user-error.js';
+import { resolveRepositoryName } from '../harness/repository-name.js';
 import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { userConfigPath } from '../user-config.js';
@@ -40,10 +41,41 @@ function versionOrder(a: string, b: string): number {
   return 0;
 }
 
+/** Where each cell id lives. An id may repeat when one copy is in an already released version — history kept two
+ *  different cells under one id (IA1 · EV10a … in 0.2.6~0.2.15) and later cells reused old ids (INSIDE1 0.2.11 ⊕
+ *  0.2.19). A released copy is history: an open copy wins over it, and between released copies the latest wins. Only
+ *  two open copies are a real conflict (ORCH-LIVE-1008 rehearsal 1: every placement failed on «여러 판의 같은 칸»). */
+function cellLocations(snapshots: Iterable<[string, readonly { id: string }[]]>, released: string | null | undefined, skip: readonly string[] = []): { locations: Map<string, string>; conflict: string | null } {
+  const locations = new Map<string, string>();
+  const shipped = (version: string) => !!released && versionOrder(version, released) <= 0;
+  for (const [version, items] of snapshots) {
+    if (skip.includes(version)) continue;
+    for (const item of items) {
+      const previous = locations.get(item.id);
+      if (previous !== undefined) {
+        if (!shipped(previous) && !shipped(version)) return { locations, conflict: item.id };
+        // Keep the open copy; between two released copies keep the later one.
+        const keepPrevious = shipped(version) && (!shipped(previous) || versionOrder(version, previous) < 0);
+        if (keepPrevious) continue;
+      }
+      locations.set(item.id, version);
+    }
+  }
+  return { locations, conflict: null };
+}
+
 /** The merged PR list is a first-class GitHub query, not a count inferred from checklist status. */
+// ORCH-LIVE-1008: the orchestrator tick runs from the installed package (not a git checkout), where a bare `gh pr list`
+// fails «not a git repository» and placement silently left every cell unplaced — so the repository is named explicitly
+// (--repo > harness.repo > GH_REPO > the checkout's remote · `resolveRepositoryName`).
 export function mergedPrsLast24h(now = new Date()): number {
   const since = new Date(now.getTime() - 86_400_000).toISOString();
-  const r = spawnSync('gh', ['pr', 'list', '--state', 'merged', '--search', `merged:>=${since.slice(0, 10)}`, '--limit', '1000', '--json', 'number,mergedAt'], { encoding: 'utf8' });
+  let repo: string;
+  try { repo = resolveRepositoryName(); }
+  catch (error) {
+    throw new CliUserError(`병합 PR 속도 조회 실패: 저장소를 못 정했다 — ${(error instanceof Error ? error.message : String(error)).split('\n')[0]}`, 'harness.repo 설정(owner/name) 또는 GH_REPO');
+  }
+  const r = spawnSync('gh', ['pr', 'list', '--repo', repo, '--state', 'merged', '--search', `merged:>=${since.slice(0, 10)}`, '--limit', '1000', '--json', 'number,mergedAt'], { encoding: 'utf8' });
   if (r.status !== 0) throw new CliUserError(`병합 PR 속도 조회 실패: ${(r.stderr || r.error || '').toString().trim()}`);
   let rows: Array<{ number: number; mergedAt: string }>;
   try { rows = JSON.parse(r.stdout) as typeof rows; }
@@ -92,10 +124,16 @@ function dependencyViolation(
   locations: Map<string, string>,
   overrides: Map<string, string>,
   input: PlacementCell,
+  released?: string | null,
 ): string | null {
   for (const [version, snapshot] of snapshots) for (const item of snapshot.items) {
-    const dependentVersion = overrides.get(item.id) ?? version;
+    // A released version is history — its cells (and what they once depended on) never constrain a new placement.
+    if (released && versionOrder(version, released) <= 0) continue;
     const predecessors = item.id === input.id ? input.predecessors : item.predecessors ?? [];
+    // Only the cells this placement moves, and cells that depend on them, can be made wrong by it — a pre-existing
+    // violation elsewhere on the board must not make every placement infeasible (ORCH-LIVE-1008 rehearsal 1).
+    if (!overrides.has(item.id) && !predecessors.some((predecessor) => overrides.has(predecessor))) continue;
+    const dependentVersion = overrides.get(item.id) ?? version;
     for (const predecessor of predecessors) {
       const predecessorVersion = overrides.get(predecessor) ?? locations.get(predecessor);
       if (!predecessorVersion || versionOrder(dependentVersion, predecessorVersion) <= 0)
@@ -131,12 +169,8 @@ export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): Place
   const open = schedules.filter((row) => (!released || versionOrder(row.version, released) > 0) && row.landBy && available(row, now, backlog));
   const sources = [...new Set([...schedules.map((row) => row.version), ...backlog])];
   const snapshots = new Map(sources.map((version) => [version, (deps.checklist ?? listChecklist)(version)]));
-  const locations = new Map<string, string>();
-  for (const [version, snapshot] of snapshots) for (const item of snapshot.items) {
-    if (backlog.includes(version)) continue;
-    if (locations.has(item.id)) throw new CliUserError(`여러 판의 같은 칸: ${item.id}`);
-    locations.set(item.id, version);
-  }
+  const { locations, conflict } = cellLocations([...snapshots].map(([version, snapshot]) => [version, snapshot.items] as [string, readonly { id: string }[]]), released, backlog);
+  if (conflict) throw new CliUserError(`여러 판의 같은 칸: ${conflict}`);
   // A backlog copy never outranks a scheduled cell with the same id.
   for (const version of backlog) for (const item of snapshots.get(version)?.items ?? []) if (!locations.has(item.id)) locations.set(item.id, version);
   const from = locations.get(input.id) ?? null;
@@ -172,7 +206,7 @@ export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): Place
   const displaced: PlacementDecision['displaced'] = [];
   let chosen: ReleaseSchedule | undefined;
   let loadIssue: string | null = null;
-  const feasible = candidates.filter((row) => !dependencyViolation(snapshots, locations, new Map([[input.id, row.version]]), input));
+  const feasible = candidates.filter((row) => !dependencyViolation(snapshots, locations, new Map([[input.id, row.version]]), input, released));
   // 판은 «마감 안 가장 이른 판»부터 본다(기존 불변식). 가속 등급은 그 판이 찼을 때 같은 우선순위 비가속 칸을 밀 수 있게만 한다.
   for (const row of feasible) {
     const placement = new Map([[input.id, row.version]]);
@@ -192,7 +226,7 @@ export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): Place
       || (accelerator && priority === input.priority);
     const p2 = [...items].reverse().find((item) => {
       if (item.accelerator === true) return false;
-      if (!victimOk(item.priority) || dependencyViolation(snapshots, locations, new Map([...placement, [item.id, next.version]]), input)) return false;
+      if (!victimOk(item.priority) || dependencyViolation(snapshots, locations, new Map([...placement, [item.id, next.version]]), input, released)) return false;
       if (item.deadlineVersion && versionOrder(next.version, item.deadlineVersion) > 0) return false;
       if (items.length < capacity(row) && !(seatItems.length >= seatLimit && ownerMatches(item.owner, seat))) return false;
       if (!item.owner) return false;
@@ -235,6 +269,7 @@ export function placeCell(input: PlacementCell, deps: PlacementDeps = {}): Place
 function moveConstraint(
   item: ChecklistItem, to: ReleaseSchedule, backlog: readonly string[],
   snapshots: Map<string, ChecklistItem[]>, now: number, rate: number, caps: Record<string, number>, rows: ReleaseSchedule[], ceoCap: number,
+  released: string | null | undefined,
 ): string | null {
   if (!to.landBy || !available(to, now, backlog)) return '착지 마감이 지났거나 백로그 판이라 이동 불가';
   if (item.deadlineVersion && versionOrder(to.version, item.deadlineVersion) > 0) return '마감 판 뒤로 이월 불가';
@@ -246,16 +281,15 @@ function moveConstraint(
   const loadIssue = ceoOverload(item, to, new Map([...snapshots].map(([version, items]) => [version, { items }])),
     rows, ceoCap);
   if (loadIssue) return loadIssue;
-  const locations = new Map<string, string>();
-  for (const [version, items] of snapshots) for (const cell of items) {
-    if (locations.has(cell.id)) return `여러 판의 같은 칸: ${cell.id}`;
-    locations.set(cell.id, version);
-  }
+  const { locations, conflict } = cellLocations(snapshots, released);
+  if (conflict) return `여러 판의 같은 칸: ${conflict}`;
   for (const predecessor of item.predecessors ?? []) {
     const location = locations.get(predecessor);
     if (!location || versionOrder(to.version, location) <= 0) return `선행 칸 ${predecessor} 이후 판으로만 이동 가능`;
   }
   for (const [version, items] of snapshots) for (const dependent of items) {
+    // A released version is history — its cells never pin a move (same rule as placement).
+    if (released && versionOrder(version, released) <= 0) continue;
     if (dependent.id !== item.id && dependent.predecessors?.includes(item.id) && versionOrder(version, to.version) <= 0)
       return `의존 칸 ${dependent.id} 이전 판으로만 이동 가능`;
   }
@@ -289,7 +323,7 @@ export function rebalance(version: string, deps: PlacementDeps = {}): RebalanceR
   const ceoCap = validCeoCap(deps.ceoDailyCap ?? placementCeoDailyCap());
   const result: RebalanceResult = { decisions: [], blocked: [] };
   for (const { item, score } of unstarted) {
-    const violation = moveConstraint(item, next!, backlog, snapshots, now, rate, caps, rows, ceoCap);
+    const violation = moveConstraint(item, next!, backlog, snapshots, now, rate, caps, rows, ceoCap, deps.released ?? releasedVersion());
     if (violation) {
       result.blocked.push({ id: item.id, from: version, to: next!.version, reason: violation });
       continue;
@@ -315,7 +349,7 @@ export function seatMove(id: string, from: string, to: string, by: string, reaso
   if (!ownerMatches(item.owner, parseOwner(by).seat) || next?.version !== to) throw new CliUserError('남의 칸 당기기 거부 — COO 에 요청');
   const now = (deps.now ?? new Date()).getTime();
   const rate = deps.merged24h ?? mergedPrsLast24h(new Date(now));
-  const violation = moveConstraint(item, next, backlog, snapshots, now, rate, deps.seatCap ?? placementSeatCap(), rows, validCeoCap(deps.ceoDailyCap ?? placementCeoDailyCap()));
+  const violation = moveConstraint(item, next, backlog, snapshots, now, rate, deps.seatCap ?? placementSeatCap(), rows, validCeoCap(deps.ceoDailyCap ?? placementCeoDailyCap()), deps.released ?? releasedVersion());
   if (violation) throw new CliUserError(`${id}: ${violation}`);
   if (!deps.dryRun) move(id, from, to, by, undefined, undefined, reason);
 }

package/src/release-loop/rubric.ts

@@ -2,6 +2,56 @@ import { Database } from 'bun:sqlite';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import type { ChecklistItem } from './checklist.js';
+import { debug } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
+
+export type RubricAxis = { key: string; weight: number };
+
+export const DEFAULT_PROJECT_AXES: readonly RubricAxis[] = [
+  { key: 'V', weight: 2 }, { key: 'U', weight: 2 },
+  { key: 'R', weight: 2 }, { key: 'S', weight: -0.5 },
+];
+
+const INTERNAL_AXES: readonly RubricAxis[] = [
+  { key: 'A', weight: 2 }, { key: 'E', weight: 2 },
+  { key: 'R', weight: 2 }, { key: 'D', weight: 1.5 },
+  { key: 'M', weight: 1 }, { key: 'B', weight: 1 },
+  { key: 'S', weight: -0.5 }, { key: 'X', weight: -0.5 },
+];
+
+export function rubricScoreWith(axes: readonly RubricAxis[], values: Readonly<{ [key: string]: number } | Rubric>): number {
+  const scores: Readonly<Record<string, number>> = values as Readonly<Record<string, number>>;
+  return axes.reduce((score, { key, weight }) => {
+    const value = Object.hasOwn(scores, key) ? scores[key] : undefined;
+    if (typeof value !== 'number' || !Number.isFinite(value)) throw new Error(`루브릭 축 ${key} 값이 없다`);
+    if (typeof weight !== 'number' || !Number.isFinite(weight)) throw new Error(`루브릭 축 ${key} 가중이 유한수가 아니다`);
+    return score + weight * value;
+  }, 0);
+}
+
+/**
+ * RFC §A4b⑤ — unconfigured projects (and the internal pack `elanous`) keep the internal eight axes;
+ * a project with `projects.<id>.rubric.axes` starts from V/U/R/S and replaces matching keys or appends new ones.
+ * An invalid axes entry raises its config error text here (loading the config itself stays non-fatal).
+ */
+export function resolveRubricAxes(projectId?: string): RubricAxis[] {
+  const projects = projectId && projectId !== 'elanous' ? getUserConfig().projects : undefined;
+  const rubric = projects && Object.hasOwn(projects, projectId!) ? projects[projectId!]?.rubric : undefined;
+  if (rubric?.error) {
+    debug.log('release.rubric', 'axes-invalid', { project: projectId, error: rubric.error });
+    throw new Error(rubric.error);
+  }
+  const configured = rubric?.axes;
+  const axes = (configured ? DEFAULT_PROJECT_AXES : INTERNAL_AXES).map((axis) => ({ ...axis }));
+  for (const axis of configured ?? []) {
+    const index = axes.findIndex((current) => current.key === axis.key);
+    if (index < 0) axes.push({ ...axis });
+    else axes[index] = { ...axis };
+  }
+  // An omitted project id is logged as null (unspecified) — not as `elanous` — even though it resolves to the internal axes.
+  debug.log('release.rubric', 'axes', { project: projectId ?? null, keys: axes.map(({ key }) => key) });
+  return axes;
+}
 
 export interface Rubric {
   A: number;
@@ -33,7 +83,7 @@ export function parseRubric(text: string): Rubric | null {
 }
 
 export function rubricScore(r: Rubric): number {
-  return 2 * r.A + 2 * r.E + 2 * r.R + 1.5 * r.D + r.M + r.B - 0.5 * r.S - 0.5 * r.X;
+  return rubricScoreWith(INTERNAL_AXES, r);
 }
 
 export function rubricGrade(score: number): 'P1' | 'P2' | 'P3' | 'P4' {
@@ -43,6 +93,12 @@ export function rubricGrade(score: number): 'P1' | 'P2' | 'P3' | 'P4' {
   return 'P4';
 }
 
+/** The rule-only split uses the same numeric rubric as the release checklist. */
+export function rubricPriority(text: string): ReturnType<typeof rubricGrade> {
+  const rubric = parseRubric(text);
+  return rubric ? rubricGrade(rubricScore(rubric)) : 'P2';
+}
+
 /** Inspect an existing checklist without initializing, importing, or migrating its ledger. */
 export function readRubricItems(version: string, ledgerRoot: string): Pick<ChecklistItem, 'id' | 'title' | 'evidence' | 'priority'>[] {
   const dbPath = join(ledgerRoot, 'release', 'features.sqlite');

package/src/self-dev/dev-cli.ts

@@ -77,6 +77,42 @@ export function shouldSuppressDevJsonWrapper(opts: Pick<DevCliOpts, 'elanous' |
   return opts.elanous === true && opts.hold === true && opts.json === true;
 }
 
+/** 격리 TUI 기동의 작업 디렉토리 갈래(TUI-ONE-WORD-LAUNCH · 대표 *"cwd 를 넣어야 한다는 것 자체가 프릭션"*).
+ *
+ * - `explicit-cwd` — 사람이 `--cwd` 를 줬다. ⭐ 명시가 이긴다(그대로 쓴다).
+ * - `requested`    — `--worktree` 를 줬다(종전 경로).
+ * - `auto`         — 명시 격리 우주 ⊕ `--elanous` ⊕ 둘 다 없음 ⇒ 시스템이 `prepareDevWorktree` 로 스스로 만든다.
+ *                    ⚠️ `hold` 여부와 무관하다 — `--elanous --goal` 도 같은 우주에서 같은 거부를 받았기 때문이다.
+ * - `none`         — 격리가 아닌 우주(운영·트리 파생) 또는 elanous 가 아닌 경로 — 종전 동작 그대로.
+ *
+ * ⛔ `explicitlyIsolated` 는 `isExplicitlyIsolated`(src/cli/pty-drive-cli.ts) 한 벌에서 온다. */
+export type AutoWorktreeDecision = 'explicit-cwd' | 'requested' | 'auto' | 'none';
+
+export function decideAutoWorktree(input: {
+  readonly explicitlyIsolated: boolean;
+  readonly elanous?: boolean;
+  readonly hold?: boolean;
+  readonly cwd?: string;
+  readonly worktree?: boolean;
+}): AutoWorktreeDecision {
+  if (input.cwd?.trim()) return 'explicit-cwd';
+  if (input.worktree === true) return 'requested';
+  if (input.explicitlyIsolated && input.elanous === true) return 'auto';
+  return 'none';
+}
+
+/** git 저장소 밖 등으로 자동 워크트리를 못 만들었을 때의 사람 문면(스택 없이 한 줄). */
+export function formatAutoWorktreeFailure(cause: unknown): string {
+  const raw = cause instanceof Error ? cause.message : String(cause);
+  const reason = /requires a Git repository/i.test(raw) ? '지금 디렉토리가 git 저장소가 아니다' : raw.split('\n')[0]!.trim();
+  return `작업 디렉토리를 스스로 정하지 못했다 — git 저장소 안에서 치거나 --cwd <경로> 를 주십시오 (${reason})`;
+}
+
+/** 자동 워크트리를 만들었을 때 사람에게 알리는 한 줄. */
+export function formatAutoWorktreeNotice(path: string): string {
+  return `작업 디렉토리: ${path} (격리 우주라 자동으로 만들었다 · 직접 정하려면 --cwd)`;
+}
+
 export interface DevCliOpts {
   base?: string;
   enhance?: boolean;

package/src/self-dev/orchestrate.ts

@@ -1494,6 +1494,7 @@ export function orchestrateSelfDev(opts: OrchestrateSelfDevOptions): Promise<Sel
           ...(disp?.branch ? { branch: disp.branch } : {}),
           ...(disp?.harvestable === true && disp.branch ? { harvestable: true } : {}),
           ...(disp?.worktreePath ? { worktreePath: disp.worktreePath } : {}),
+          ...(disp?.ok !== undefined ? { ok: disp.ok } : {}),
           ...(disp?.prUrl ? { prUrl: disp.prUrl } : {}),
           ...(disp?.prNumber !== undefined ? { prNumber: disp.prNumber } : {}),
           ...(disp?.merged !== undefined ? { merged: disp.merged } : {}),