elanous 0.2.18 → 0.2.20

package/scripts/release-loop/gate-partial.ts

@@ -0,0 +1,106 @@
+// GATE-PARTIAL (0.2.19 · 10-07): a re-gate after `release cut-branch --append` runs only the test files that can have
+// changed — not the whole 24-shard sweep again (0.2.18: two timeout fixes on top of an 84-minute gate meant another full
+// gate). The plan is opt-in (`release resume --from gate --partial`) and fail-closed: any non-test source change, a prior
+// gate record for another commit, or a missing record means «full gate», never a guess.
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+
+export interface PartialPlan {
+  version: string;
+  /** Commit the previous (full) gate measured — its recorded failures are carried for every file not re-run. */
+  priorCommit: string;
+  /** The commit this plan is for — a gate on any other commit ignores it. */
+  forCommit: string;
+  /** Test files re-run: changed test files ⊕ files of the prior failures. */
+  files: string[];
+  priorFailures: string[];
+  priorErrors: string[];
+}
+
+export const partialPlanPath = (root: string, version: string) => join(root, 'release', version, 'gate-partial.json');
+/** The same test-file set the gate sweep runs (`git ls-files` filtered by this suffix). */
+const TEST_FILE = /^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/;
+/** Changes that cannot alter a test result on their own: Markdown that is not test input. A fixture (any file under a
+ *  test/, fixtures, __fixtures__ or __snapshots__ path), JSON or script is not inert — the gate runs in full. */
+const INERT_MD = /\.md$/;
+const TEST_INPUT = /(?:^|\/)(?:test|tests|fixtures|__fixtures__|__snapshots__|__mocks__)\//;
+const isInert = (file: string) => INERT_MD.test(file) && !TEST_INPUT.test(file);
+
+/** The test file of a failure id (`<file> > <case>`). One rule for the gate and the partial plan: ids come only from the
+ *  gate's output parsers, which accept `dir/….test.ts(x)` — anything else (a root file, `..`, no case) is unsafe. */
+export function testFileOfId(id: string): string {
+  const file = id.split(' > ', 1)[0]!;
+  if (!id.includes(' > ') || !/^(?:[\w.-]+\/)+[\w.-]+\.test\.tsx?$/.test(file) || file.split('/').includes('..')) throw new Error(`unsafe test path: ${file}`);
+  return file;
+}
+
+/** Decide whether a partial re-gate is safe for `changedFiles` (prior → for). Never guesses: any doubt is a full gate. */
+export function planPartialRegate(input: { version: string; priorCommit: string; forCommit: string; changedFiles: readonly string[];
+  priorFailures: readonly string[]; priorErrors: readonly string[] }):
+  { ok: true; plan: PartialPlan } | { ok: false; reason: string } {
+  if (!/^[0-9a-f]{40}$/i.test(input.priorCommit) || !/^[0-9a-f]{40}$/i.test(input.forCommit)) return { ok: false, reason: 'commit is not a full sha' };
+  if (input.priorCommit === input.forCommit) return { ok: false, reason: 'no new commit since the prior gate' };
+  const source = input.changedFiles.filter((file) => !TEST_FILE.test(file) && !isInert(file));
+  if (source.length) return { ok: false, reason: `non-test change → full gate: ${source.slice(0, 5).join(', ')}${source.length > 5 ? ` (+${source.length - 5})` : ''}` };
+  let failureFiles: string[];
+  try { failureFiles = [...input.priorFailures, ...input.priorErrors].map(testFileOfId); }
+  catch (error) { return { ok: false, reason: String(error instanceof Error ? error.message : error) }; }
+  const files = [...new Set([...input.changedFiles.filter((file) => TEST_FILE.test(file)), ...failureFiles])].sort();
+  if (!files.length) return { ok: false, reason: 'nothing to re-run' };
+  return { ok: true, plan: { version: input.version, priorCommit: input.priorCommit, forCommit: input.forCommit, files,
+    priorFailures: [...input.priorFailures], priorErrors: [...input.priorErrors] } };
+}
+
+export function writePartialPlan(root: string, plan: PartialPlan): string {
+  const path = partialPlanPath(root, plan.version);
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = `${path}.${process.pid}.tmp`;
+  writeFileSync(temp, `${JSON.stringify(plan, null, 2)}\n`, { mode: 0o600 });
+  renameSync(temp, path);
+  return path;
+}
+
+export function clearPartialPlan(root: string, version: string): void {
+  const path = partialPlanPath(root, version);
+  if (existsSync(path)) rmSync(path);
+}
+
+/** The plan for exactly this commit, or null. A malformed plan is an error (never silently a full or partial gate). */
+export function readPartialPlan(roots: readonly string[], version: string, commit: string): PartialPlan | null {
+  for (const root of roots) {
+    const path = partialPlanPath(root, version);
+    if (!existsSync(path)) continue;
+    const raw = JSON.parse(readFileSync(path, 'utf8')) as Partial<PartialPlan>;
+    if (raw.version !== version || typeof raw.priorCommit !== 'string' || !/^[0-9a-f]{40}$/i.test(raw.priorCommit)
+      || typeof raw.forCommit !== 'string' || !/^[0-9a-f]{40}$/i.test(raw.forCommit) || raw.priorCommit === raw.forCommit
+      || !Array.isArray(raw.files) || raw.files.length === 0 || !raw.files.every((file) => typeof file === 'string' && TEST_FILE.test(file) && !file.split('/').includes('..'))
+      || !Array.isArray(raw.priorFailures) || !Array.isArray(raw.priorErrors)) throw new Error(`invalid gate partial plan: ${path}`);
+    // Every prior failure's file is re-run (planPartialRegate guarantees it) — a plan that would carry a failure it did
+    // not re-run is malformed, not «partial».
+    const rerun = new Set(raw.files);
+    let failureFiles: string[];
+    try { failureFiles = [...raw.priorFailures, ...raw.priorErrors].map((id) => testFileOfId(String(id))); }
+    catch { throw new Error(`invalid gate partial plan: ${path}`); }
+    if (failureFiles.some((file) => !rerun.has(file))) throw new Error(`invalid gate partial plan (prior failure not re-run): ${path}`);
+    if (raw.forCommit !== commit) continue;
+    return raw as PartialPlan;
+  }
+  return null;
+}
+
+/** Cut failures after a partial re-run: prior results for files not re-run ⊕ this run's results for the re-run files. */
+export function mergePartialFailures(plan: PartialPlan, measured: { failures: string[]; errors: string[] }): { failures: string[]; errors: string[] } {
+  const rerun = new Set(plan.files);
+  const keep = (ids: readonly string[]) => ids.filter((id) => !rerun.has(testFileOfId(id)));
+  return { failures: [...keep(plan.priorFailures), ...measured.failures], errors: [...keep(plan.priorErrors), ...measured.errors] };
+}
+
+/** Files changed between two commits — both sides of a rename (`--no-renames`), so moving a source file into a test or
+ *  Markdown name still shows the source path that disappeared. */
+export function changedFilesBetween(repo: string, from: string, to: string): string[] {
+  // git-spawn-allow: read-only diff of two release commits.
+  const result = spawnSync('git', ['diff', '--name-only', '--no-renames', `${from}..${to}`], { cwd: repo, encoding: 'utf8' });
+  if (result.status !== 0 || result.error) throw new Error(`git diff failed: ${(result.stderr || result.error || 'no output').toString().trim()}`);
+  return result.stdout.split(/\r?\n/).filter(Boolean);
+}

package/scripts/release-loop/gate-timing.ts

@@ -0,0 +1,229 @@
+// F5 GATE-TIMING-REPORT — 게이트 한 판의 «시간 비용»을 보이게 한다(GATE-SPEED 의 자).
+// 입력 = 게이트 로그 디렉토리(`<ledger>/release/<version>/gate-logs/cut`)의 `pod-*.json`.
+//   첫 판 샤드 = `pod-<n>.json` · 재시도 = 그 밖의 모든 `pod-*.json`(`-c<k>`·`-c<k>-file-<m>`·`-retry` …).
+// ⛔ 측정이 없으면 `measured:false` 로 표시한다 — 0 을 «잰 값»처럼 내지 않는다.
+// ⭐ 기본 = 전 우주(LOGS-DEFAULT-ALL · 0.2.20) — 게이트는 실행 트리의 시험 우주(예: ⟨test:wt-release⟩
+//   `<tree>/.elanous-test/release/<v>/gate-logs/cut`)에 쌓인다. 운영 원장만 보면 0.2.19 판처럼
+//   «측정 없음»으로 오판한다. 그래서 버전 인자는 운영 원장 ⊕ 등록된 모든 우주(시험·파생 시험 포함)를
+//   본다 — 우주 열거는 `eln logs --all --include-test` 와 같은 레지스트리(`readLogInstanceScope`)다.
+//   좁히기는 opt-in `--prod-only`(종전 동작: `releaseLedgerRoot()` 하나).
+import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { releaseLedgerRoot } from '../../src/instance/resolve.js';
+import { readLogInstanceScope } from '../../src/mss/logging/instance-registry.js';
+
+export interface ShardTiming { name: string; min: number; files: number; plannedMin: number | null }
+
+export interface GateTimingReport {
+  dir: string;
+  /** 읽은 pod-*.json 중 durationMs 를 가진 것이 하나라도 있었나. false 면 아래 수는 «측정 없음». */
+  measured: boolean;
+  /** JSON 파싱 실패·durationMs 부재로 건너뛴 파일 이름. */
+  unreadable: string[];
+  firstPass: { shards: number; sumMin: number; medianMin: number; maxMin: number; failedShards: string[] };
+  retries: { runs: number; sumMin: number; medianMin: number };
+  /** 재시도 합 / (첫 판 합 + 재시도 합). 측정이 없으면 null. */
+  retryShare: number | null;
+  slowestShards: ShardTiming[];
+}
+
+const FIRST_PASS = /^pod-\d+\.json$/;
+const POD_JSON = /^pod-.+\.json$/;
+
+const round1 = (n: number) => Math.round(n * 10) / 10;
+
+function median(xs: number[]): number {
+  if (xs.length === 0) return 0;
+  const s = [...xs].sort((a, b) => a - b);
+  const m = s.length >> 1;
+  return s.length % 2 ? s[m]! : (s[m - 1]! + s[m]!) / 2;
+}
+
+interface PodRecord { durationMs?: unknown; rc?: unknown; files?: unknown; plannedSeconds?: unknown; jobFailed?: unknown }
+
+export function gateTiming(dir: string): GateTimingReport {
+  const names = existsSync(dir) && statSync(dir).isDirectory()
+    ? readdirSync(dir).filter((n) => POD_JSON.test(n)).sort((a, b) => a.localeCompare(b, 'en', { numeric: true }))
+    : [];
+  const first: Array<ShardTiming & { failed: boolean }> = [];
+  const retryMin: number[] = [];
+  const unreadable: string[] = [];
+  for (const name of names) {
+    let rec: PodRecord;
+    try { rec = JSON.parse(readFileSync(join(dir, name), 'utf8')) as PodRecord; } catch { unreadable.push(name); continue; }
+    if (!rec || typeof rec !== 'object' || typeof rec.durationMs !== 'number' || !Number.isFinite(rec.durationMs)) { unreadable.push(name); continue; }
+    const min = rec.durationMs / 60_000;
+    if (FIRST_PASS.test(name)) {
+      first.push({
+        name: name.replace(/\.json$/, ''),
+        min,
+        files: Array.isArray(rec.files) ? rec.files.length : 0,
+        plannedMin: typeof rec.plannedSeconds === 'number' ? rec.plannedSeconds / 60 : null,
+        failed: rec.jobFailed === true || (typeof rec.rc === 'number' && rec.rc !== 0),
+      });
+    } else {
+      retryMin.push(min);
+    }
+  }
+  const firstMins = first.map((s) => s.min);
+  const firstSum = firstMins.reduce((a, b) => a + b, 0);
+  const retrySum = retryMin.reduce((a, b) => a + b, 0);
+  const total = firstSum + retrySum;
+  const measured = first.length + retryMin.length > 0;
+  return {
+    dir,
+    measured,
+    unreadable,
+    firstPass: {
+      shards: first.length,
+      sumMin: round1(firstSum),
+      medianMin: round1(median(firstMins)),
+      maxMin: round1(firstMins.length ? Math.max(...firstMins) : 0),
+      failedShards: first.filter((s) => s.failed).map((s) => s.name),
+    },
+    retries: { runs: retryMin.length, sumMin: round1(retrySum), medianMin: round1(median(retryMin)) },
+    retryShare: measured && total > 0 ? Math.round((retrySum / total) * 1000) / 1000 : null,
+    slowestShards: [...first].sort((a, b) => b.min - a.min).slice(0, 5)
+      .map(({ name, min, files, plannedMin }) => ({ name, min: round1(min), files, plannedMin: plannedMin === null ? null : round1(plannedMin) })),
+  };
+}
+
+/** 인자가 버전이 아니라 디렉토리인가 — 경로처럼 보이거나 실제로 있으면. */
+export function isGateLogDirArg(arg: string): boolean {
+  return arg.includes('/') || arg.startsWith('.') || existsSync(arg);
+}
+
+/** `<version>` 이면 원장 루트(`releaseLedgerRoot()`)의 `release/<version>/gate-logs/cut`, 경로처럼 보이면 그대로. */
+export function resolveGateLogDir(arg: string, ledgerRoot: string = releaseLedgerRoot()): string {
+  if (isGateLogDirArg(arg)) return arg;
+  return join(ledgerRoot, 'release', arg, 'gate-logs', 'cut');
+}
+
+export interface GateLogCandidate { universe: string; dir: string }
+
+export interface GateLogScope {
+  /** 본 후보 원장 루트 수(물리 경로 dedup 뒤). */
+  roots: number;
+  /** 우주 레지스트리 — `read` 읽음 · `unreadable` 못 읽음(«등록 우주 0»이 아니라 «못 셈» — 운영 원장만 봤다)
+   *  · `skipped` `--prod-only` 라 안 읽음. */
+  registry: 'read' | 'unreadable' | 'skipped';
+  /** `--prod-only` 로 좁혔나. */
+  prodOnly: boolean;
+}
+
+export interface GateLogScopeDeps {
+  ledgerRoot?: string;
+  readInstances?: () => { instances: ReadonlyArray<{ name: string; stateDir: string }>; queryStatus: { registeredStores: boolean } };
+}
+
+function physical(path: string): string {
+  try { return realpathSync(path); } catch { return path; }
+}
+
+/** 버전의 게이트 로그 후보 — 운영 원장 루트(`releaseLedgerRoot()`) ⊕ 등록된 모든 우주.
+ *  물리 경로로 dedup 한다(`~/.monad` → `~/.elanous` 심링크가 같은 판을 두 번 세지 않게). */
+export function gateLogCandidates(
+  version: string,
+  opts: { prodOnly?: boolean } = {},
+  deps: GateLogScopeDeps = {},
+): { candidates: GateLogCandidate[]; scope: GateLogScope } {
+  const primary = deps.ledgerRoot ?? releaseLedgerRoot();
+  const roots: Array<{ universe: string; root: string }> = [{ universe: 'prod', root: primary }];
+  let registry: GateLogScope['registry'] = 'skipped';
+  if (!opts.prodOnly) {
+    const scope = (deps.readInstances ?? readLogInstanceScope)();
+    registry = scope.queryStatus.registeredStores ? 'read' : 'unreadable';
+    // 못 읽은 판의 부분 목록은 쓰지 않는다 — «운영만 봤다»는 표시와 실제 본 범위를 일치시킨다.
+    if (registry === 'read') for (const instance of scope.instances) roots.push({ universe: instance.name, root: instance.stateDir });
+  }
+  const seen = new Set<string>();
+  const candidates: GateLogCandidate[] = [];
+  for (const { universe, root } of roots) {
+    const key = physical(root);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    candidates.push({ universe, dir: resolveGateLogDir(version, root) });
+  }
+  return { candidates, scope: { roots: candidates.length, registry, prodOnly: opts.prodOnly === true } };
+}
+
+export interface GateTimingScan {
+  version: string;
+  scope: GateLogScope & { found: number };
+  /** pod-*.json 디렉토리가 «있는» 우주만 — 판마다 따로 낸다(서로 다른 판의 샤드를 섞지 않는다). */
+  reports: Array<GateTimingReport & { universe: string }>;
+}
+
+/** 버전 인자의 기본 동선 — 후보 우주 전부에서 게이트 로그 디렉토리가 있는 것만 보고한다. */
+export function scanGateTiming(version: string, opts: { prodOnly?: boolean } = {}, deps: GateLogScopeDeps = {}): GateTimingScan {
+  const { candidates, scope } = gateLogCandidates(version, opts, deps);
+  const reports = candidates
+    .filter(({ dir }) => existsSync(dir) && statSync(dir).isDirectory())
+    .map(({ universe, dir }) => ({ universe, ...gateTiming(dir) }));
+  return { version, scope: { ...scope, found: reports.length }, reports };
+}
+
+export function formatGateTimingScan(scan: GateTimingScan): string {
+  const s = scan.scope;
+  const head = `게이트 로그 ${scan.version} — ${s.prodOnly ? '운영 원장만(--prod-only)' : '전 우주'} · 본 원장 루트 ${s.roots}개 · 로그 있는 우주 ${s.found}개`
+    + (s.registry === 'unreadable' ? ' · ⚠ 우주 레지스트리를 못 읽었다(운영만 봤다 — «없다»가 아니라 «못 셈»)' : '');
+  if (scan.reports.length === 0) {
+    const where = s.registry === 'read' ? '본 우주 어디에도' : '운영 원장에';
+    const unknown = s.registry === 'unreadable' ? ' · 시험 우주는 못 셌다(있을 수 있다)' : '';
+    return [head, `  게이트 시간 — 측정 없음 · ${where} release/${scan.version}/gate-logs/cut 가 없다${unknown}`,
+      ...(s.prodOnly ? ['  (--prod-only 를 빼면 시험 우주까지 본다)'] : [])].join('\n');
+  }
+  return [head, ...scan.reports.map((r) => `⟨${r.universe}⟩ ${formatGateTiming(r)}`)].join('\n');
+}
+
+export function formatGateTiming(r: GateTimingReport): string {
+  if (!r.measured) {
+    return [`게이트 시간 — 측정 없음 (${r.dir})`, '  pod-*.json 에 durationMs 가 하나도 없다 · 0 은 «잰 값»이 아니다',
+      ...(r.unreadable.length ? [`  읽지 못한 파일 ${r.unreadable.length}개`] : [])].join('\n');
+  }
+  const f = r.firstPass;
+  const lines = [
+    `게이트 시간 (${r.dir})`,
+    `  첫 판   샤드 ${f.shards}개 · 합 ${f.sumMin}분 · 중앙 ${f.medianMin}분 · 최대 ${f.maxMin}분 · 실패 샤드 ${f.failedShards.length}개${f.failedShards.length ? ` (${f.failedShards.join(', ')})` : ''}`,
+    `  재시도  ${r.retries.runs}회 · 합 ${r.retries.sumMin}분 · 중앙 ${r.retries.medianMin}분`,
+    `  재시도 비중 ${r.retryShare === null ? '측정 없음' : `${round1(r.retryShare * 100)}%`} (재시도 합 / 전체 합)`,
+    '  느린 샤드 상위 5:',
+    ...r.slowestShards.map((s) => `    ${s.name}  ${s.min}분 · 파일 ${s.files}개 · 계획 ${s.plannedMin === null ? '—' : `${s.plannedMin}분`}`),
+  ];
+  if (r.unreadable.length) lines.push(`  ⚠ 읽지 못한 파일 ${r.unreadable.length}개: ${r.unreadable.slice(0, 5).join(', ')}${r.unreadable.length > 5 ? ' …' : ''}`);
+  return lines.join('\n');
+}
+
+export const GATE_TIMING_USAGE = [
+  '기본 = 전 우주 — 운영 원장 ⊕ 시험 우주(⟨test:wt-release⟩ 등)의 게이트 로그를 옵션 없이 함께 읽는다',
+  '사용법: bun scripts/release-loop/gate-timing.ts <version|dir> [--json] [--prod-only]',
+  '  <version>    등록된 모든 우주의 release/<version>/gate-logs/cut 를 우주마다 따로 보고한다(⟨우주⟩ 태그)',
+  '  <dir>        그 디렉토리 하나만 (종전과 같은 단일 보고)',
+  '  --prod-only  운영 원장 루트(releaseLedgerRoot)만 본다 — 종전 기본',
+  '  --json       구조화 출력 (<version> 이면 { version, scope, reports[] })',
+].join('\n');
+
+const KNOWN_FLAGS = new Set(['--json', '--prod-only', '--help', '-h']);
+
+if (import.meta.main) {
+  const args = process.argv.slice(2);
+  if (args.includes('--help') || args.includes('-h')) { console.log(GATE_TIMING_USAGE); process.exit(0); }
+  const unknown = args.filter((a) => a.startsWith('-') && !KNOWN_FLAGS.has(a));
+  if (unknown.length) { console.error(`알 수 없는 옵션: ${unknown.join(' ')}\n${GATE_TIMING_USAGE}`); process.exit(2); }
+  const json = args.includes('--json');
+  const prodOnly = args.includes('--prod-only');
+  const target = args.find((a) => !a.startsWith('-'));
+  if (!target) {
+    console.error(GATE_TIMING_USAGE);
+    process.exit(2);
+  }
+  if (isGateLogDirArg(target)) {
+    const report = gateTiming(target);
+    console.log(json ? JSON.stringify(report, null, 2) : formatGateTiming(report));
+    if (!report.measured) process.exit(1);
+  } else {
+    const scan = scanGateTiming(target, { prodOnly });
+    console.log(json ? JSON.stringify(scan, null, 2) : formatGateTimingScan(scan));
+    if (!scan.reports.some((r) => r.measured)) process.exit(1);
+  }
+}

package/scripts/release-loop/preflight.ts

@@ -27,7 +27,7 @@ export interface PreflightResult {
   blockers: number;
   warnings: number;
   findings: PreflightFinding[];
-  schedule: { cutAt: string; landBy: string | null; publishAt: string | null; publishAtSource: 'option' | 'cadence' | null } | null;
+  schedule: { cutAt: string; landBy: string | null; publishAt: string | null; publishAtSource: 'option' | 'schedule' | 'cadence' | null } | null;
   /** The immediately previous release (by version order) whose gate is compared. */
   previousVersion: string | null;
   gateMeasure: GateMeasure | null;
@@ -206,15 +206,17 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
     findings.push({ level: 'warn', check: 'schedule', message: `판 일정 없음 — elanous release schedule set --version ${version} --cut-at <iso> --land-by <iso>` });
   } else {
     const cut = Date.parse(schedule.cutAt);
-    const publishAt = deps.publishAt ? new Date(deps.publishAt).toISOString() : cadencePublishAt(schedule.cutAt);
-    scheduleOut = { cutAt: schedule.cutAt, landBy: schedule.landBy, publishAt, publishAtSource: deps.publishAt ? 'option' : 'cadence' };
+    // --publish-at > the stored schedule publish time (`release schedule set --publish-at`) > the October cadence.
+    const publishAtSource = deps.publishAt ? 'option' : schedule.publishAt ? 'schedule' : 'cadence';
+    const publishAt = deps.publishAt ? new Date(deps.publishAt).toISOString() : schedule.publishAt ?? cadencePublishAt(schedule.cutAt);
+    scheduleOut = { cutAt: schedule.cutAt, landBy: schedule.landBy, publishAt, publishAtSource };
     if (!schedule.landBy) findings.push({ level: 'warn', check: 'schedule', message: `착지 마감 없음 — 컷 ${formatKst(schedule.cutAt)} · 규칙은 컷 − 30분` });
     else if (cut - Date.parse(schedule.landBy) < 30 * 60_000) findings.push({ level: 'warn', check: 'schedule', message: `착지 마감 ${formatKst(schedule.landBy)} 이 컷 − 30분보다 늦다(컷 ${formatKst(schedule.cutAt)})` });
     else findings.push({ level: 'ok', check: 'schedule', message: `일정 — 착지 마감 ${formatKst(schedule.landBy)} · 컷 ${formatKst(schedule.cutAt)}` });
     gateMeasure = previousVersion ? releaseGateMeasure({ version: previousVersion }, deps.graphRunsRoot) : null;
     if (!gateMeasure) fallbackGateMeasure = releaseGateMeasure({ below: version }, deps.graphRunsRoot);
     const windowSeconds = Math.round((Date.parse(publishAt) - cut) / 1000);
-    const publishLabel = `발행 ${formatKst(publishAt)}${deps.publishAt ? '' : '(기본: 판 주기 07·18시 · --publish-at 로 바꾼다)'}`;
+    const publishLabel = `발행 ${formatKst(publishAt)}${publishAtSource === 'cadence' ? '(기본: 판 주기 07·18시 · --publish-at 로 바꾼다)' : publishAtSource === 'schedule' ? '(판 일정)' : ''}`;
     if (!gateMeasure) {
       const fallback = fallbackGateMeasure ? ` · 참고: 가장 최근 실측은 ${fallbackGateMeasure.version} 게이트 ${minutes(fallbackGateMeasure.gateSeconds)}(직전 판 아님)` : ' · 게이트 실측 없음';
       findings.push({ level: 'warn', check: 'schedule', message: `직전 판${previousVersion ? `(${previousVersion})` : ''} 실측 없음 — 컷→${publishLabel} 창 ${minutes(windowSeconds)}${fallback}` });

package/scripts/release-loop/publish-window.ts

@@ -0,0 +1,141 @@
+// PUBLISH-TIME-FROM-GATE (0.2.20 P1) — 발행 시각을 사람이 고르지 않고 «실측»에서 제안한다.
+//
+// 🩸 계기: 판 일정이 «컷 18:45 → 발행 20:00(75분)»처럼 잡혔는데 게이트 하나가 60분+ · 게이트 뒤 노드가 ~40분이다.
+// ⭐ 자 = 최근 N(기본 3)개 완료된(`status: done` · 안정 버전) release-loop 런마다 «런 시작(≈ 컷) → 발행 노드 끝»을 재고 중앙값을 쓴다.
+//    창은 «최근 N개 완료 런»으로 고정한다 — 못 잰 런 대신 더 옛 런을 끌어오지 않는다(옛 판이 지금 실측인 척 섞이지 않게).
+//    런 시작 = 컷이다(예약 시작이 컷에 런을 띄운다) — preflight 의 «런 시작→발행 노드»와 같은 기점.
+// ⛔ 못 잰 런은 0 으로 세지 않는다 — 건너뛰고 `skipped` 에 이유와 함께 남긴다. 표본이 0 이면 제안도 경고도 «없음»이다.
+//
+// 시각 출처(우선순위):
+//   ① `nodes[]` 의 `startedAt`·`endedAt`(0.2.19~ 원장이 노드 시각을 적는다)
+//   ② 옛 원장 — `<runId>.json.contexts/<n>.json` 의 mtime(노드 n 이 «시작할 때» 쓰인다) ⇒ 발행 노드 끝 ≈ 다음 노드 시작.
+//      (preflight `releaseGateMeasure` 와 같은 근사 · 그 파일의 nodeId 가 path 와 맞을 때만 쓴다)
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { releaseLedgerRoot } from '../../src/instance/resolve.js';
+
+export const DEFAULT_PUBLISH_SAMPLE = 3;
+/** 중앙값 위에 얹는 여유(분). 제안은 그 뒤 5분 단위로 올린다. */
+export const DEFAULT_PUBLISH_MARGIN_MIN = 10;
+
+const STABLE = /^\d+\.\d+\.\d+$/;
+
+export interface PublishDurationSample {
+  version: string;
+  runId: string;
+  startedAt: string;
+  /** 런 시작 → 발행 노드 끝(초). */
+  seconds: number;
+  source: 'nodes' | 'contexts';
+}
+
+export interface PublishWindowMeasure {
+  root: string;
+  /** 중앙값에 쓴 표본(최신 먼저 · 최근 sample 개 완료 런 중 잰 것). */
+  samples: PublishDurationSample[];
+  /** 창 안의 완료 런이었지만 못 잰 것 — «0»이 아니라 «못 셈». */
+  skipped: Array<{ runId: string; version: string; why: string }>;
+  /** 표본이 없으면 null(측정 없음). */
+  medianSeconds: number | null;
+}
+
+interface RunState {
+  runId?: string;
+  status?: string;
+  startedAt?: string;
+  path?: unknown;
+  input?: { version?: string };
+  nodes?: Array<{ nodeId?: string; startedAt?: string; endedAt?: string }>;
+}
+
+export function defaultReleaseGraphRunsRoot(ledgerRoot: string = releaseLedgerRoot()): string {
+  return join(ledgerRoot, 'graph-runs', 'release-loop');
+}
+
+function median(xs: number[]): number {
+  const s = [...xs].sort((a, b) => a - b);
+  const m = s.length >> 1;
+  return s.length % 2 ? s[m]! : (s[m - 1]! + s[m]!) / 2;
+}
+
+function publishEndMs(root: string, file: string, state: RunState, path: string[]): { ms: number; source: PublishDurationSample['source'] } | null {
+  const node = Array.isArray(state.nodes) ? state.nodes.find((n) => n?.nodeId === 'publish') : undefined;
+  const ended = node?.endedAt ? Date.parse(node.endedAt) : NaN;
+  if (Number.isFinite(ended)) return { ms: ended, source: 'nodes' };
+  const index = path.indexOf('publish');
+  const contexts = join(root, `${file}.contexts`);
+  if (index < 0 || index + 1 >= path.length || !existsSync(contexts)) return null;
+  const ctxPath = join(contexts, `${index + 2}.json`); // contexts/<n>.json 은 1부터 — 발행 다음 노드의 시작
+  try {
+    const ctx = JSON.parse(readFileSync(ctxPath, 'utf8')) as { nodeId?: string };
+    return ctx.nodeId === path[index + 1] ? { ms: statSync(ctxPath).mtimeMs, source: 'contexts' } : null;
+  } catch { return null; }
+}
+
+/** 최근 `sample` 개 완료 release-loop 런의 «런 시작 → 발행 노드 끝» 중앙값. */
+export function measurePublishWindow(opts: { root?: string; sample?: number } = {}): PublishWindowMeasure {
+  const root = opts.root ?? defaultReleaseGraphRunsRoot();
+  const sample = Math.max(1, opts.sample ?? DEFAULT_PUBLISH_SAMPLE);
+  const runs: Array<{ file: string; state: RunState; version: string; startedAt: string; startMs: number; path: string[] | null }> = [];
+  if (existsSync(root)) {
+    for (const file of readdirSync(root)) {
+      if (!file.endsWith('.json') || file.includes('.decision')) continue;
+      try {
+        const state = JSON.parse(readFileSync(join(root, file), 'utf8')) as RunState;
+        const v = state.input?.version;
+        if (state.status !== 'done' || typeof v !== 'string' || !STABLE.test(v)) continue;
+        // A completed stable run with a broken start or path is still «a run in the window» — it lands in `skipped`, not nowhere.
+        const startedAt = typeof state.startedAt === 'string' ? state.startedAt : '';
+        runs.push({ file, state, version: v, startedAt, startMs: Date.parse(startedAt), path: Array.isArray(state.path) ? state.path.filter((p): p is string => typeof p === 'string') : null });
+      } catch { /* 못 읽은 원장은 표본이 아니다 */ }
+    }
+  }
+  // Newest first; a run without a readable start sorts by its file mtime so it still takes its place in the window.
+  const order = (run: (typeof runs)[number]) => (Number.isFinite(run.startMs) ? run.startMs : statSync(join(root, run.file)).mtimeMs);
+  runs.sort((a, b) => order(b) - order(a));
+  const samples: PublishDurationSample[] = [];
+  const skipped: PublishWindowMeasure['skipped'] = [];
+  for (const run of runs.slice(0, sample)) {
+    const runId = run.state.runId ?? run.file.slice(0, -5);
+    if (!Number.isFinite(run.startMs)) { skipped.push({ runId, version: run.version, why: 'startedAt 없음·무효' }); continue; }
+    if (!run.path) { skipped.push({ runId, version: run.version, why: 'path 가 배열이 아님' }); continue; }
+    if (!run.path.includes('publish')) { skipped.push({ runId, version: run.version, why: 'path 에 publish 노드 없음' }); continue; }
+    const end = publishEndMs(root, run.file, run.state, run.path);
+    const start = run.startMs;
+    if (!end || end.ms < start) { skipped.push({ runId, version: run.version, why: '발행 노드 끝 시각을 못 읽음' }); continue; }
+    samples.push({ version: run.version, runId, startedAt: run.startedAt, seconds: Math.round((end.ms - start) / 1000), source: end.source });
+  }
+  return { root, samples, skipped, medianSeconds: samples.length ? Math.round(median(samples.map((s) => s.seconds))) : null };
+}
+
+/** 제안 발행 시각 = 컷 + 중앙값 + 여유, 5분 단위로 올림. 측정이 없으면 null. */
+export function proposePublishAt(cutAt: string, measure: PublishWindowMeasure, marginMin = DEFAULT_PUBLISH_MARGIN_MIN): string | null {
+  if (measure.medianSeconds === null) return null;
+  const raw = Date.parse(cutAt) + measure.medianSeconds * 1000 + marginMin * 60_000;
+  const step = 5 * 60_000;
+  return new Date(Math.ceil(raw / step) * step).toISOString();
+}
+
+export function kstHourMinute(iso: string): string {
+  return new Intl.DateTimeFormat('en-GB', { timeZone: 'Asia/Seoul', hour: '2-digit', minute: '2-digit', hourCycle: 'h23' }).format(new Date(iso));
+}
+
+const mins = (seconds: number) => Math.round(seconds / 60);
+
+/** 발행 시각이 실측 중앙값보다 짧으면 한 줄 경고, 아니면 null(측정 없음도 null — 경고할 자가 없다). */
+export function publishWindowWarning(cutAt: string, publishAt: string, measure: PublishWindowMeasure, marginMin = DEFAULT_PUBLISH_MARGIN_MIN): string | null {
+  if (measure.medianSeconds === null) return null;
+  const windowSeconds = (Date.parse(publishAt) - Date.parse(cutAt)) / 1000;
+  if (windowSeconds >= measure.medianSeconds) return null;
+  const proposed = proposePublishAt(cutAt, measure, marginMin)!;
+  return `⚠️ 발행 시각이 실측 중앙값(${mins(measure.medianSeconds)}분)보다 짧다 — 컷→발행 ${mins(windowSeconds)}분 · 제안: ${kstHourMinute(proposed)} KST (최근 ${measure.samples.length}판 ${measure.samples.map((s) => s.version).join('·')} · +여유 ${marginMin}분)`;
+}
+
+/** `release schedule show` 의 한 줄 — 제안 발행 시각 또는 «측정 없음». */
+export function formatPublishProposal(cutAt: string, measure: PublishWindowMeasure, marginMin = DEFAULT_PUBLISH_MARGIN_MIN): string {
+  const proposed = proposePublishAt(cutAt, measure, marginMin);
+  if (!proposed || measure.medianSeconds === null) {
+    return `발행 제안 — 실측 없음(완료된 release-loop 런에서 발행 노드 시각을 못 읽었다 · 본 곳 ${measure.root}${measure.skipped.length ? ` · 못 잰 런 ${measure.skipped.length}` : ''})`;
+  }
+  return `발행 제안 ${kstHourMinute(proposed)} KST — 컷 + 실측 중앙값 ${mins(measure.medianSeconds)}분(최근 ${measure.samples.length}판 ${measure.samples.map((s) => `${s.version} ${mins(s.seconds)}분`).join(' · ')}) + 여유 ${marginMin}분`;
+}

package/scripts/release-loop/release-docs.ts

@@ -114,10 +114,7 @@ export function recordDocsFollow(root: string, manifest: ReleaseManifest, items:
   const journal = join(root, 'seat-requests', 'requests.jsonl');
   withSeatRequestLedgerLock(journal, () => {
     const known = new Set(listSeatRequests(root).map((row) => row.key));
-    const missing = [
-      ...report.pending.map((item) => ({ id: item.id, text: `문서 반영 대기 목록 v${manifest.version} · ${item.id}: ${item.missing.join(', ')} — 착지 ${item.sha}; docs·홈 실측 뒤 닫기` })),
-      ...report.unassessed.map((id) => ({ id, text: `문서 반영 대기 목록 v${manifest.version} · ${id}: 착지·green·EXPOSE-RUBRIC 근거 미판정 — 확인 전 공개 문면 금지` })),
-    ];
+    const missing = report.pending.map((item) => ({ id: item.id, text: `문서 반영 대기 목록 v${manifest.version} · ${item.id}: ${item.missing.join(', ')} — 착지 ${item.sha}; docs·홈 실측 뒤 닫기` }));
     const rows = missing.filter((item) => !known.has(`docs-follow:${manifest.version}:${item.id}`)).map((item) => ({
       key: `docs-follow:${manifest.version}:${item.id}`, seat: 'MK', status: 'queued' as const,
       text: item.text, queuedAt: now.toISOString(), ref: `release:${manifest.version}:docs-follow`,

package/scripts/release-loop/release-universe.ts

@@ -0,0 +1,38 @@
+// RELEASE-LEDGER-UNIVERSE (0.2.20 P0): the release run decides its universe ONCE at the entry and every node
+// subprocess is pinned to it (graph runner `pinChildUniverse` stamps ELANOUS_STATE_DIR = this root). Without it a node
+// launched as `bun scripts/release-loop/*-node.ts` from a non-leader tree (wt-release) re-resolved the tree-derived test
+// universe and wrote manifest·story·gate logs to ⟨test:wt-release⟩ while the run ledger was prod (10-07).
+import { getElanousConfigDirOverride } from '../../src/elanous-config-dir.js';
+import { debug } from '../../src/debug/log.js';
+import { effectiveInstanceRoot, normRoot, prodInstanceRoot } from '../../src/instance/resolve.js';
+
+export interface ReleaseUniverseDeps {
+  /** An injected ledger root (tests, or a caller that already decided) is used as is. */
+  root?: string;
+  override?: () => string | undefined;
+  prodRoot?: () => string;
+  effectiveRoot?: () => string;
+}
+
+/**
+ * The single universe of a release run. An explicit `--config-dir` selects its own universe; otherwise the release
+ * ledger is the machine-wide prod root, and a process that itself resolved elsewhere (a source tree without a stamp)
+ * is refused before any node starts — its own logs would land in a different universe from its nodes.
+ */
+export function releaseRunUniverse(deps: ReleaseUniverseDeps = {}): string {
+  if (deps.root) return deps.root;
+  const override = (deps.override ?? getElanousConfigDirOverride)();
+  if (override) {
+    const root = (deps.effectiveRoot ?? effectiveInstanceRoot)();
+    debug.log('release.run', 'universe', { root, layer: 'explicit-flag' });
+    return root;
+  }
+  const prod = normRoot((deps.prodRoot ?? prodInstanceRoot)());
+  const parent = normRoot((deps.effectiveRoot ?? effectiveInstanceRoot)());
+  if (parent !== prod) {
+    debug.log('release.run', 'universe-refused', { parent, prod });
+    throw new Error(`release run refused: this process resolves to ${parent}, not the release ledger universe ${prod} — its nodes would split ledgers and logs across universes. Run the installed \`elanous\` or pass \`--config-dir ${prod}\``);
+  }
+  debug.log('release.run', 'universe', { root: prod, layer: 'prod' });
+  return prod;
+}