elanous 0.2.22 → 0.2.23

package/src/cli/pr-cli.ts

@@ -57,6 +57,7 @@ import { branchLineageSlug, findSiblingPrs } from './pr-lineage.js';
 import { parseReleaseNoteSection } from '../release-loop/release-note.js';
 import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
 import { admitLandingMerge } from '../self-implement/frozen-merges.js';
+import { verifyOverlapEvidence } from './pr-land-overlap-evidence.js';
 import { enqueueL8ShadowQueue, runL8ShadowQueue, shadowPrNumber, statusL8ShadowQueue, type L8ShadowQueueDeps } from '../self-implement/l8-merge-queue.js';
 
 export { branchLineageSlug, findSiblingPrs };
@@ -83,6 +84,8 @@ export interface PrLandOpts {
   forceFreeze?: string;
   /** Land even though changed files would leak into the public export (the reason goes in --land-reason). */
   allowPublicLeak?: boolean;
+  /** Pinned landing only: JSON evidence (rebased · re-gated · reviewed head) that replaces the unavailable non-interactive overlap approval. */
+  overlapEvidence?: string;
 }
 
 export interface PrGranularityOpts {
@@ -998,6 +1001,7 @@ function emitLandingOverlapAdvisory(
   base: string,
   currentFiles: readonly string[],
   out: { log: (message: string) => void },
+  overlappingLandings: string[] = [],
 ): boolean {
   if (currentFiles.length === 0) {
     record('overlap', true, { outcome: 'no-changed-files' });
@@ -1009,6 +1013,8 @@ function emitLandingOverlapAdvisory(
     return false;
   }
   const overlaps = overlapWithCurrentChanges(commits, currentFiles);
+  const current = new Set(currentFiles);
+  overlappingLandings.push(...commits.filter((commit) => commit.files.some((file) => current.has(file))).map((commit) => commit.hash));
   const line = formatOverlapAdvisory(overlaps);
   if (line) {
     record('overlap', true, {
@@ -1184,6 +1190,10 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   const cwd = opts.cwd ?? process.cwd();
   const run = deps.run ?? defaultCmdRunner;
   const pinned = opts.pr !== undefined || opts.expectedHead !== undefined;
+  if (opts.overlapEvidence !== undefined && (!pinned || !opts.overlapEvidence.trim())) {
+    out.error('✗ overlap-evidence: --overlap-evidence <file> 는 --pr ⊕ --expected-head 머리 고정 착지에서만 쓴다.');
+    return 1;
+  }
   let pinnedBranch: string | undefined;
   let pinnedUrl: string | undefined;
   if (pinned) {
@@ -1562,7 +1572,8 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     return 1;
   }
 
-  const overlapFound = emitLandingOverlapAdvisory(run, cwd, base, changedPaths, out);
+  const overlappingLandings: string[] = [];
+  const overlapFound = emitLandingOverlapAdvisory(run, cwd, base, changedPaths, out, overlappingLandings);
   const siblingFound = emitSiblingPrAdvisory(
     branch,
     deps.listOpenPrs ?? (() => lookupOpenPrs(run, cwd)),
@@ -1593,7 +1604,23 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     });
   }
   const hold = !!opts.hold || overlapDecision?.outcome === 'user-hold';
-  if (pinned && overlapDecision && overlapDecision.outcome !== 'user-merge') {
+  // TA-LAND-OVERLAP — 비대화형 «승인 불가»만 증거로 대신한다(사람의 hold 는 증거로 뒤집지 않는다) · 증거가 없거나 어긋나면 종전 거부 그대로.
+  let overlapEvidenceAccepted = false;
+  if (pinned && overlapDecision?.outcome === 'unavailable' && opts.overlapEvidence !== undefined) {
+    const ref = resolveRemoteBranchRef(run, cwd, base);
+    const verdict = verifyOverlapEvidence({
+      evidencePath: opts.overlapEvidence, pr: Number(opts.pr), expectedHead: opts.expectedHead!,
+      remote: ref.remote, branch: ref.branch, cwd, run, readFile, overlappingLandings,
+    });
+    overlapEvidenceAccepted = verdict.ok;
+    if (verdict.ok) {
+      out.log(verdict.mode === 'already-ancestor'
+        ? `✓ overlap-evidence: already-ancestor — 겹친 최근 착지 ${overlappingLandings.length}개가 전부 head ${opts.expectedHead!.slice(0, 12)} 의 조상 · review pass must-fix 0 (${verdict.reviewResult})`
+        : `✓ overlap-evidence: ${ref.remote}/${ref.branch} ${verdict.baseTip.slice(0, 12)} ⊂ head ${opts.expectedHead!.slice(0, 12)} · gate passed on that base · review pass must-fix 0 (${verdict.reviewResult})`);
+    }
+    else out.error(`✗ overlap-evidence: ${verdict.reason}`);
+  }
+  if (pinned && overlapDecision && overlapDecision.outcome !== 'user-merge' && !overlapEvidenceAccepted) {
     out.error('✗ expected-head: overlap merge approval unavailable for the reviewed head');
     return 1;
   }
@@ -1852,6 +1879,7 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}, queu
     .option('--land-reason <text>', '권고를 보고도 지금 내는 이유(예: 남이 기다리는 차단 해제)')
     .option('--force-freeze <reason>', '동결을 넘겨 병합할 명시적 이유(필수)')
     .option('--allow-public-leak', '바뀐 파일이 공개본에 사적 흔적을 실어도 착지(이유는 --land-reason)')
+    .option('--overlap-evidence <file>', '머리 고정 착지 전용: 비대화형 겹침 승인을 대신할 증거 JSON {pr, head, gate:{head,baseCommit,passed}, reviewResult} — 재기반·재게이트·리뷰를 CLI 가 다시 잰다(겹친 착지가 전부 머리의 조상이면 리뷰만 · gate 생략 가능)')
     .action(async (opts: PrLandOpts) => {
       // ⛔⭐⭐⭐ **관측 sink 를 먼저 건다** — 라이브 도그푸드가 잡은 결함(2026-08-03).
       //   단위 테스트는 `debug.log` 가 **불렸다**를 단언하지만, standalone CLI 는 sink 를 등록하지

package/src/cli/pr-land-overlap-evidence.ts

@@ -0,0 +1,131 @@
+/**
+ * TA-LAND-OVERLAP — 머리 고정 착지(`pr land --pr --expected-head`)가 «1일 겹침» 관문에서 비대화형으로 영영 멎던 것을
+ * «증거가 붙은 경우에만» 통과시킨다.
+ *
+ * - 왜: 겹침 승인은 터미널 확인뿐이라 비대화형(TA)에서는 늘 `unavailable` → 머리 고정 착지는 «항상» 거부됐다.
+ *   (10-10 #25845 · 10-11 #25974 가 같은 관문에 걸려 머리 고정을 풀고 착지했다.)
+ * - 무엇을: `--overlap-evidence <file>` 의 JSON 을 «믿지 않고» 잰다.
+ *   ① 재기반 — 원격 base 의 «지금» 끝(`git ls-remote`)이 고정 머리의 조상인가(`git merge-base --is-ancestor`).
+ *   ② 재게이트 — 증거의 게이트 기록이 «그 머리»를 «그 base 끝» 위에서 통과했다고 말하는가(머리·base 끝이 ① 과 맞물린다).
+ *   ③ 리뷰 — 증거가 가리키는 `review-results/<card>-<pr>-<head12>.json`(TA 가 받는 `self review --json` stdout)이
+ *      같은 PR·같은 머리에 대해 `reviewed:true` · `verdict:pass` · must-fix 0 인가.
+ *   ⓐ 이미 조상(TC #26019 실측) — 겹친 최근 착지 커밋이 «전부» 고정 머리의 조상이면 그 겹침은 이미 그 머리의 게이트·리뷰에
+ *      반영됐다 ⇒ ①② 없이 ③ 만으로 통과(관측 reason `already-ancestor`). 하나라도 조상이 아니면 ①②③ 전부.
+ *   하나라도 못 재거나 어긋나면 거부 — 호출부는 종전 거부를 그대로 낸다(fail-closed).
+ * - 관측: `pr.land` · `overlap-evidence` (decision · reason · 잰 값).
+ */
+import { basename, dirname } from 'node:path';
+import { debug } from '../debug/log.js';
+import type { CmdRunner } from '../autopilot/pr-manager.js';
+import { parseReviewResultOutput } from '../task-agent/review-result-capture.js';
+
+const SHA40 = /^[0-9a-f]{40}$/i;
+
+interface OverlapEvidenceFile {
+  pr: number;
+  head: string;
+  /** ①② 경로에서만 필수 — 겹친 착지가 전부 조상(already-ancestor)이면 생략해도 된다. */
+  gate?: { head: string; baseCommit: string; passed: boolean };
+  /** `self review --json` stdout 을 받은 파일(TA: `<state>/review-results/<card>-<pr>-<head12>.json`). */
+  reviewResult: string;
+}
+
+export type OverlapEvidenceVerdict =
+  | { ok: true; mode: 'already-ancestor'; reviewResult: string }
+  | { ok: true; mode: 'rebased'; baseTip: string; reviewResult: string }
+  | { ok: false; reason: string };
+
+export interface VerifyOverlapEvidenceInput {
+  evidencePath: string;
+  pr: number;
+  expectedHead: string;
+  remote: string;
+  branch: string;
+  cwd: string;
+  run: CmdRunner;
+  readFile: (path: string) => string;
+  /** 겹침 관문이 찾은 «겹친» 최근 착지 커밋들 — 전부 머리의 조상이면 already-ancestor. */
+  overlappingLandings?: readonly string[];
+}
+
+type Checked = { ok: false; reason: string; baseTip?: string } | (OverlapEvidenceVerdict & { ok: true; baseTip?: string });
+
+function checkReview(input: VerifyOverlapEvidenceInput, e: Partial<OverlapEvidenceFile>, head: string, baseTip?: string): { ok: false; reason: string; baseTip?: string } | { ok: true; reviewResult: string } {
+  if (typeof e.reviewResult !== 'string' || !e.reviewResult) return { ok: false, reason: 'review-missing', baseTip };
+  // TA 가 받는 자리(`<state>/review-results/<card>-<pr>-<head12>.json` · reviewResultPath)만 — 아무 디렉터리의 같은 이름은 안 받는다.
+  if (basename(dirname(e.reviewResult)) !== 'review-results'
+    || !new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]*-${input.pr}-${head.slice(0, 12)}\\.json$`, 'i').test(basename(e.reviewResult))) {
+    return { ok: false, reason: 'review-path-not-for-this-pr-head', baseTip };
+  }
+  let text: string;
+  try { text = input.readFile(e.reviewResult); } catch { return { ok: false, reason: 'review-unreadable', baseTip }; }
+  const review = parseReviewResultOutput(text);
+  if (!review) return { ok: false, reason: 'review-no-result', baseTip };
+  if (review.pr !== input.pr) return { ok: false, reason: 'review-pr-mismatch', baseTip };
+  if (!review.head || review.head.toLowerCase() !== head) return { ok: false, reason: 'review-head-mismatch', baseTip };
+  if (review.error) return { ok: false, reason: 'review-error', baseTip };
+  if (review.reviewed !== true) return { ok: false, reason: 'review-not-reviewed', baseTip };
+  if (review.verdict !== 'pass') return { ok: false, reason: `review-verdict-${review.verdict ?? 'null'}`, baseTip };
+  if (review.mustFix !== 0) return { ok: false, reason: review.mustFix === null ? 'review-must-fix-unknown' : `review-must-fix-${review.mustFix}`, baseTip };
+  return { ok: true, reviewResult: e.reviewResult };
+}
+
+function check(input: VerifyOverlapEvidenceInput): Checked {
+  const head = input.expectedHead.toLowerCase();
+  let raw: unknown;
+  try { raw = JSON.parse(input.readFile(input.evidencePath)); } catch (error) {
+    return { ok: false, reason: `evidence-unreadable: ${String((error as { message?: string })?.message ?? error).slice(0, 200)}` };
+  }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, reason: 'evidence-not-object' };
+  const e = raw as Partial<OverlapEvidenceFile>;
+  if (e.pr !== input.pr) return { ok: false, reason: `evidence-pr-mismatch: ${String(e.pr)} ≠ ${input.pr}` };
+  if (typeof e.head !== 'string' || e.head.toLowerCase() !== head) return { ok: false, reason: 'evidence-head-mismatch' };
+
+  // ⓐ 이미 조상 — 겹친 착지가 전부 머리 안에 있으면 그 머리의 게이트·리뷰가 이미 그것을 보고 쟀다.
+  const landings = input.overlappingLandings ?? [];
+  if (landings.length > 0 && landings.every((sha) => /^[0-9a-f]{7,40}$/i.test(sha)
+    && input.run('git', ['merge-base', '--is-ancestor', sha, head], { cwd: input.cwd }).ok)) {
+    const review = checkReview(input, e, head);
+    return review.ok ? { ok: true, mode: 'already-ancestor', reviewResult: review.reviewResult } : review;
+  }
+
+  // ① 재기반 — 원격의 «지금» 끝을 읽기 전용으로 받는다(로컬 ref 를 안 바꾼다).
+  const remote = input.run('git', ['ls-remote', input.remote, `refs/heads/${input.branch}`], { cwd: input.cwd });
+  const baseTip = remote.ok ? remote.out.trim().split(/\s+/)[0] ?? '' : '';
+  if (!SHA40.test(baseTip)) return { ok: false, reason: `rebase-unmeasured: ls-remote ${input.remote} ${input.branch} failed` };
+  const ancestor = input.run('git', ['merge-base', '--is-ancestor', baseTip, head], { cwd: input.cwd });
+  if (!ancestor.ok) return { ok: false, reason: `not-rebased: ${input.remote}/${input.branch} ${baseTip.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}`, baseTip };
+
+  // ② 재게이트 — 그 머리를, ① 의 그 base 끝 위에서.
+  const gate = e.gate;
+  if (!gate || typeof gate !== 'object') return { ok: false, reason: 'gate-missing', baseTip };
+  if (gate.passed !== true) return { ok: false, reason: 'gate-not-passed', baseTip };
+  if (typeof gate.head !== 'string' || gate.head.toLowerCase() !== head) return { ok: false, reason: 'gate-head-mismatch', baseTip };
+  if (typeof gate.baseCommit !== 'string' || gate.baseCommit.toLowerCase() !== baseTip.toLowerCase()) {
+    return { ok: false, reason: `gate-base-stale: gate ${String(gate.baseCommit).slice(0, 12)} ≠ ${input.remote}/${input.branch} ${baseTip.slice(0, 12)}`, baseTip };
+  }
+
+  // ③ 리뷰 — 그 PR · 그 머리의 pass ⊕ must-fix 0.
+  const review = checkReview(input, e, head, baseTip);
+  return review.ok ? { ok: true, mode: 'rebased', baseTip, reviewResult: review.reviewResult } : review;
+}
+
+/** 던지지 않는다 — 어떤 실패도 거부(fail-closed)이고 관측 한 줄을 남긴다. */
+export function verifyOverlapEvidence(input: VerifyOverlapEvidenceInput): OverlapEvidenceVerdict {
+  let verdict: Checked;
+  try { verdict = check(input); } catch (error) { verdict = { ok: false, reason: `verify-threw: ${String(error).slice(0, 200)}` }; }
+  debug.log('pr.land', 'overlap-evidence', {
+    decision: verdict.ok ? 'accepted' : 'rejected',
+    reason: verdict.ok ? (verdict.mode === 'already-ancestor' ? 'already-ancestor' : 'rebased+gated+reviewed') : verdict.reason,
+    overlappingLandings: input.overlappingLandings ?? [],
+    pr: input.pr,
+    head: input.expectedHead,
+    base: `${input.remote}/${input.branch}`,
+    baseTip: verdict.baseTip ?? null,
+    evidencePath: input.evidencePath,
+  });
+  if (!verdict.ok) return { ok: false, reason: verdict.reason };
+  return verdict.mode === 'already-ancestor'
+    ? { ok: true, mode: 'already-ancestor', reviewResult: verdict.reviewResult }
+    : { ok: true, mode: 'rebased', baseTip: verdict.baseTip!, reviewResult: verdict.reviewResult };
+}

package/src/cli/release-cli.ts

@@ -5,9 +5,10 @@
 //   elanous release tag --version <x.y.z> --source <commit> [--yes]
 //   elanous release verify  [--version <x.y.z>]
 //   elanous release notes   --from <ref> [--to <ref>]
-//   elanous release run     --version <x.y.z> [--prerelease rc] [--main-cut | --cut-commit <sha>] [--dry-run] [--json] [--if-ready]
-//   elanous release resume  --run <runId> --from <node> [--json]   (release/<v> 수리 뒤 새 끝으로 이어 달리기)
+//   elanous release run     --version <x.y.z> [--prerelease rc] [--main-cut | --cut-commit <sha>] [--publish-at <iso>] [--dry-run] [--json] [--if-ready]
+//   elanous release resume  --run <runId> --from <node> [--waive <node> --reason <text>] [--accepted-regressions <json>] [--json]
 //   elanous release auto-start [--window-minutes <n>] [--apply] [--json]
+//   elanous release rehearsal tick [--apply] [--checkout <dir>] [--json]
 //   elanous release preflight --version <x.y.z> [--publish-at <iso>] [--json]   (컷 30분 전 사전 점검 · 읽기 전용 · ⛔ 있으면 exit 1)
 //   elanous release cut-branch --version <x.y.z> --base <sha> --pick <sha>... [--dry-run]
 //
@@ -39,14 +40,17 @@ import { hqCliWriteAllowed, type HqDeps } from '../hq/hq.js';
 import { fileLeaseStore } from '../hq/lease.js';
 import { isIsolatedLedgerWriteRoot } from '../hq/ledger-write-target.js';
 import { runUnattendedRelease, type UnattendedReleaseDeps } from '../../scripts/release-loop/unattended-release.js';
+import { publishAtError } from '../../scripts/release-loop/publish-at.js';
 import { cutReleaseBranch } from '../../scripts/release-loop/cut-branch.js';
 import { resumeReleaseRun } from '../../scripts/release-loop/resume-release.js';
+import type { AcceptedRegression } from '../../scripts/release-loop/resume.js';
 import type { PrereleaseKind } from '../../scripts/release-loop/release-version.js';
 import { releaseReadiness } from '../../scripts/release-loop/release-readiness.js';
 import { runReleaseIfReady } from './release-run-if-ready.js';
 import { formatPreflight, releasePreflight } from '../../scripts/release-loop/preflight.js';
 import { defaultReleaseGraphRunsRoot, formatPublishProposal, measurePublishWindow, proposePublishAt, publishWindowWarning } from '../../scripts/release-loop/publish-window.js';
 import { autoStartScheduledRelease, type AutoStartDeferral } from '../release-loop/auto-start.js';
+import { runRehearsalTick, type RehearsalDeps } from '../release-loop/rehearsal.js';
 import { landingFreezeMessage, LandingFrozenError, readLandingFreeze } from '../release-loop/landing-freeze.js';
 import { formatLightRc, runLightRc, type LightRcDeps } from '../release-loop/light-rc.js';
 
@@ -596,7 +600,7 @@ function compareReleaseVersions(a: string, b: string): number {
   return 0;
 }
 
-export function registerReleaseCommands(program: Command, releaseRunDeps: UnattendedReleaseDeps = {}, landedDeps: LandedButYellowDeps = {}, hqDeps: HqDeps = {}, lightRcDeps: LightRcDeps = {}): void {
+export function registerReleaseCommands(program: Command, releaseRunDeps: UnattendedReleaseDeps = {}, landedDeps: LandedButYellowDeps = {}, hqDeps: HqDeps = {}, lightRcDeps: LightRcDeps = {}, rehearsalDeps: RehearsalDeps = {}): void {
   const release = program.command('release').description('공개 배포 한 판 — prepare(로컬) → publish(--yes) → verify (docs/manual/MANUAL-versioning-and-release-2026-09-25.md)');
   const schedule = release.command('schedule').description('판별 컷·착지 마감 조회·갱신');
   const scheduleLedgerRoot = () => releaseRunDeps.ledgerRoot ?? releaseLedgerRoot();
@@ -811,7 +815,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         process.exitCode = 1;
       }
     });
-  withContext(checklist.command('add <id> <title>').description('칸 추가')).option('--owner <owner>', '담당').option('--kind <kind>', 'screen = 다섯 화면 짝 칸 · 근거에 짝: PWA … · 데스크톱 … · 폴드 … · 아이폰 … · 아이패드 … 한 줄')
+  withContext(checklist.command('add <id> <title>').description('칸 추가')).option('--owner <owner>', '담당').option('--kind <kind>', 'screen = 다섯 화면 짝 칸 · 근거에 짝: PWA … · 데스크톱 … · 폴드 … · 아이폰 … · 아이패드 … 한 줄 · postpub = 발행 뒤 실측 칸 — 판 관문이 발행 전 판정에서 빼고 따로 센다')
     .option('--priority <priority>', 'P0|P1|P2').option('--deadline-version <v>', '마감 판').option('--predecessor <id...>', '선행 칸 id')
     .option('--ceo-minutes <minutes>', '대표 손 분량(분)').option('--ceo-date <date>', '대표 손 날짜 YYYY-MM-DD (없으면 판 착지일 KST)')
     .option('--accelerator', '가속 등급 — 다른 칸의 처리량을 올리는 칸(자율성·효율성·동시성). 생략하면 등급 없음')
@@ -825,7 +829,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
   });
   withContext(checklist.command('set <id>').description('칸 상태·근거·담당·처분 갱신'))
     .option('--status <status>', 'green|yellow|red|done').option('--evidence <evidence>', '근거').option('--owner <owner>', '담당')
-    .option('--disposition <disposition>', 'move|known-issue|block').option('--kind <kind>', 'screen = 다섯 화면 짝 칸 · 근거에 짝: PWA … · 데스크톱 … · 폴드 … · 아이폰 … · 아이패드 … 한 줄')
+    .option('--disposition <disposition>', 'move|known-issue|block').option('--kind <kind>', 'screen = 다섯 화면 짝 칸 · 근거에 짝: PWA … · 데스크톱 … · 폴드 … · 아이폰 … · 아이패드 … 한 줄 · postpub = 발행 뒤 실측 칸 — 판 관문이 발행 전 판정에서 빼고 따로 센다')
     .option('--priority <priority>', 'P0|P1|P2').option('--deadline-version <v>', '마감 판').option('--predecessor <id...>', '선행 칸 id').option('--no-predecessor', '선행 칸 비우기(진짜 의존이 아니면 · CHECKLIST-PRED-CLEAR)')
     .option('--ceo-minutes <minutes>', '대표 손 분량(분)').option('--ceo-date <date>', '대표 손 날짜 YYYY-MM-DD')
     .option('--accelerator', '가속 등급 부여').option('--no-accelerator', '가속 등급 해제(기본은 없음)')
@@ -985,7 +989,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .action(async (o: { version: string; base: string; pick: string[]; append?: boolean; dryRun?: boolean; json?: boolean }) => {
       await jsonAction(o.json, async (log) => cutReleaseBranch({ ...o, log }), () => true);
     });
-  const runAction = async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; forceFreeze?: boolean; json?: boolean }, logRun = console.log): Promise<boolean | AutoStartDeferral | undefined> => {
+  const runAction = async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; json?: boolean }, logRun = console.log): Promise<boolean | AutoStartDeferral | undefined> => {
       // Only the rc rehearsal channel is operated for now (alpha/beta stay valid version shapes, not run options).
       if (o.prerelease !== undefined && o.prerelease !== 'rc') {
         const message = `--prerelease supports rc only: ${o.prerelease}`;
@@ -994,6 +998,14 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         process.exitCode = 1;
         return false;
       }
+      // A malformed --publish-at is refused before readiness, so --if-ready cannot defer it as a success.
+      const publishAtInvalid = o.publishAt === undefined ? null : publishAtError(o.publishAt);
+      if (publishAtInvalid) {
+        if (o.json) await writeStdoutJson(`${JSON.stringify({ ok: false, error: publishAtInvalid })}\n`);
+        else console.error(`⛔ ${publishAtInvalid}`);
+        process.exitCode = 1;
+        return false;
+      }
       const prerelease = o.prerelease as PrereleaseKind | undefined;
       if (!o.dryRun) {
         try {
@@ -1026,7 +1038,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
           const outcome = await runReleaseIfReady(o.version, {
             ledgerRoot: releaseRunDeps.ledgerRoot,
             readiness: (version, options) => releaseReadiness(version, { ledgerRoot: releaseRunDeps.ledgerRoot, checklist: releaseRunDeps.checklist, ...options }),
-            run: () => runUnattendedRelease({ version: o.version, cutCommit: o.cutCommit, mainCut: o.mainCut, prerelease, forceFreeze: o.forceFreeze }, releaseRunDeps),
+            run: () => runUnattendedRelease({ version: o.version, cutCommit: o.cutCommit, mainCut: o.mainCut, prerelease, forceFreeze: o.forceFreeze, publishAt: o.publishAt }, releaseRunDeps),
           });
           if (outcome.skipped) {
             if (o.json) await writeStdoutJson(`${JSON.stringify(outcome)}\n`);
@@ -1054,7 +1066,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         }
       }
       await jsonAction(o.json, async (log) => {
-        const result = await runUnattendedRelease({ version: o.version, dryRun: o.dryRun, cutCommit: o.cutCommit, mainCut: o.mainCut, prerelease, forceFreeze: o.forceFreeze }, releaseRunDeps);
+        const result = await runUnattendedRelease({ version: o.version, dryRun: o.dryRun, cutCommit: o.cutCommit, mainCut: o.mainCut, prerelease, forceFreeze: o.forceFreeze, publishAt: o.publishAt }, releaseRunDeps);
         log(`${result.dryRun ? '· 드라이런' : '▶ 릴리스 루프'} ${result.input.version} · 입력 ${JSON.stringify(result.input)}`);
         return result;
       }, (r) => r.dryRun || r.state?.status === 'done' || r.state?.status === 'awaiting-approval');
@@ -1067,9 +1079,10 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--prerelease <kind>', '미리보기 판(rc) — <v>-rc.<다음 빈 번호> · npm next · GitHub pre-release · docs-land/ops-upgrade/dev-bump 건너뜀')
     .option('--dry-run', '체크리스트·그래프 실행 없이 전체 입력 보기')
     .option('--if-ready', '준비되지 않았으면 사유를 출력하고 성공으로 건너뛴다')
+    .option('--publish-at <iso>', '승인·선행 노드 통과 뒤 지정 시각까지 발행 대기(오프셋 포함 ISO 시각)')
     .option('--force-freeze', '동결 중 게이트·발행 강행(관측 기록) — 가지 컷은 동결이 필요 없다 · 동결은 비상 스위치로 남는다')
     .option('--json', '결과 한 줄 JSON(stdout) · 사람 줄은 stderr')
-    .action(async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; forceFreeze?: boolean; json?: boolean }) => { await runAction(o); });
+    .action(async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; json?: boolean }) => { await runAction(o); });
   release.command('preflight')
     .description('컷 30분 전 사전 점검(읽기 전용) — 체크리스트 게이트 모의 · 발행 뒤 칸 · run --dry-run 입력 · 동결 · 일정/게이트 실측. ⛔ 있으면 exit 1')
     .requiredOption('--version <v>', '점검할 판(x.y.z)')
@@ -1112,10 +1125,25 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .requiredOption('--run <runId>', '실패한 release-loop 런 ID')
     .requiredOption('--from <node>', '다시 시작할 노드(예: gate)')
     .option('--partial', 'GATE-PARTIAL — --from gate 에서 앞 게이트 뒤 바뀐 시험 파일 ⊕ 앞 실패 파일만 다시 돈다(시험·문서만 바뀐 경우 · 아니면 전체 게이트로)')
+    .option('--waive <node>', '저장된 실패 노드 한 개를 면제(--from 은 그 노드 그대로)')
+    .option('--reason <text>', '면제 사유 — 공개 알려진 문제에 들어갈 사용자 영향 설명')
+    .option('--accepted-regressions <json>', '알려진 문제 추가 입력 JSON 배열 [{"id":"…","note":"…"}]')
     .option('--json', '결과 한 줄 JSON(stdout)')
-    .action(async (o: { run: string; from: string; partial?: boolean; json?: boolean }) => {
+    .action(async (o: { run: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: string; json?: boolean }) => {
       await jsonAction(o.json, async (log) => {
-        const result = await resumeReleaseRun({ runId: o.run, from: o.from, partial: o.partial });
+        let acceptedRegressions: AcceptedRegression[] | undefined;
+        if (o.acceptedRegressions !== undefined) {
+          try { acceptedRegressions = JSON.parse(o.acceptedRegressions) as AcceptedRegression[]; }
+          catch { throw new Error('--accepted-regressions must be a JSON array of {id, note}'); }
+          if (!Array.isArray(acceptedRegressions) || acceptedRegressions.some((issue) => !issue ||
+            typeof issue.id !== 'string' || !issue.id.trim() || typeof issue.note !== 'string' || !issue.note.trim())) {
+            throw new Error('acceptedRegressions must be an array of {id, note}');
+          }
+        }
+        const result = await resumeReleaseRun({ runId: o.run, from: o.from, partial: o.partial,
+          ...(o.waive === undefined ? {} : { waive: o.waive }),
+          ...(o.reason === undefined ? {} : { reason: o.reason }),
+          ...(o.acceptedRegressions === undefined ? {} : { acceptedRegressions }) });
         if (result.partial.requested) log(result.partial.applied
           ? `◐ 부분 재검: ${result.partial.files}파일 · 나머지는 앞 게이트(${result.partial.priorCommit.slice(0, 12)}) 결과를 잇는다`
           : `● 전체 게이트로: ${result.partial.reason}`);
@@ -1123,6 +1151,20 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         return { tip: result.tip, partial: result.partial, status: result.state.status, runId: result.state.runId };
       }, (r) => r.status === 'done' || r.status === 'awaiting-approval');
     });
+  release.command('rehearsal').description('판 일정에서 컷 전 가벼운 RC 두 단계').command('tick')
+    .description('15분 틱: 다음 판 컷 −7h · −150m RC 계획(기본 보기만)')
+    .option('--apply', '도장 선점 후 해당 단계 실행')
+    .option('--checkout <dir>', '깨끗한 git 체크아웃(기본 ELANOUS_REHEARSAL_GIT_CWD)')
+    .option('--json', '결과 한 줄 JSON(stdout)')
+    .action(async (o: { apply?: boolean; checkout?: string; json?: boolean }) => {
+      await jsonAction(o.json, async (log) => {
+        const ledgerRoot = scheduleLedgerRoot();
+        if (o.apply && !mayWriteLedger('release rehearsal tick', false, ledgerRoot)) throw new Error('release rehearsal tick: ledger write denied');
+        const result = await runRehearsalTick({ apply: o.apply, checkout: o.checkout, ledgerRoot }, rehearsalDeps);
+        log(`· 리허설 ${result.status}${'version' in result ? ` ${result.version}` : ''}${result.status === 'due' ? ` · 실행 ${result.run ?? '-'} · 건너뜀 ${result.supersede.join(', ') || '-'}` : ''}`);
+        return result;
+      }, (result) => !result.notificationFailures && !result.stamps?.some((stamp) => !['ok', 'superseded'].includes(stamp.outcome)));
+    });
   release.command('auto-start')
     .description('판 일정의 컷 창에서 릴리스 시작을 미리 본다 · --apply 로 release run --if-ready 실행')
     .option('--window-minutes <n>', '컷 뒤 선택 창(분)', '15')

package/src/cli/self-update.ts

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, realpathSync, readlinkSync, readdirSync, statSync, rmSync, symlinkSync, renameSync, writeFileSync, lstatSync } from 'node:fs';
-import { resolve, join, basename, dirname } from 'node:path';
+import { resolve, join, basename, dirname, sep } from 'node:path';
 import { homedir, platform, userInfo } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { decideRestartNeeded, type RestartNeededResult } from './nexus-restart-needed.js';
@@ -455,14 +455,172 @@ export function planVersionPrune(
   return { removed: all.filter((n) => !kept.includes(n)), kept };
 }
 
-function defaultPruneVersions(plan: { current: string; daemonSha: string; keep: number }): VersionPruneOutcome {
-  const dir = join(homedir(), '.local/share/elanous/versions');
+function isInsideVersion(path: string, version: string): boolean {
+  const normalized = path.replace(/ \(deleted\)$/, '');
+  let actual = normalized;
+  try { actual = realpathSync(normalized); } catch { /* A process can exit between observation and resolution. */ }
+  return actual === version || actual.startsWith(`${version}${sep}`)
+    || normalized === version || normalized.startsWith(`${version}${sep}`);
+}
+
+/** Whether a command line names a path inside the version folder (as a whole path token, not a sibling prefix). */
+function argvReferencesVersion(argv: string, version: string): boolean {
+  const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(?:^|[\\s=:'"])${escaped}(?=$|[\\/\\s:'"])`).test(argv);
+}
+
+/** Linux /proc/<pid>/stat: a zombie has released its cwd/exe, and a kernel thread (PF_KTHREAD) never had them. */
+export function procStatHoldsNothing(stat: string): boolean {
+  // After the comm field: state ppid pgrp session tty_nr tpgid flags …
+  const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+  return fields[0] === 'Z' || (Number(fields[6]) & 0x00200000) !== 0;
+}
+
+type ProcessListing = () => { status: number | null; stdout: string; stderr: string; error?: Error };
+type ProcessScan = (pid: string) => { status: number | null; stdout: string; stderr: string; error?: Error };
+
+/** Inspect live cwd and executable references before deleting any candidate; an unavailable scan must not authorize deletion. */
+function pruneUnusedVersions(dir: string, outcome: VersionPruneOutcome, listProcesses: ProcessListing = () => spawnSync('ps', ['-axww', '-o', 'pid=,uid=,args='], { encoding: 'utf8', maxBuffer: SPAWN_MAX_BUFFER }), scanProcess?: ProcessScan): VersionPruneOutcome {
+  if (!outcome.removed.length) return outcome;
+  const probe = scanProcess ?? ((pid: string) => spawnSync('lsof', ['-nP', '-F', 'pfn', '-p', pid], { encoding: 'utf8', maxBuffer: SPAWN_MAX_BUFFER }));
+  const candidates = outcome.removed.map((name) => ({ name, path: realpathSync(join(dir, name)) }));
+  const references: Array<{ path: string; kind: string; pid: string }> = [
+    { path: process.cwd(), kind: 'cwd', pid: String(process.pid) },
+    { path: process.execPath, kind: 'exe', pid: String(process.pid) },
+  ];
+  let scanError = '';
+  // Other-UID processes: unreadable without privilege (root alone is ~200 on a Mac),
+  // so requiring them would disable pruning entirely. Counted and observed instead.
+  // Their argv is still readable (ps on macOS, /proc/<pid>/cmdline on Linux): an argv naming
+  // a candidate folder holds it. Only processes whose argv is unreadable too are count-only.
+  const uninspected = new Set<string>();
+  const otherArgv: Array<{ pid: string; argv: string }> = [];
+  const otherUid = (pid: string, argv: string | undefined): void => {
+    if (argv === undefined || !argv.trim() || /^\(.*\)$/.test(argv.trim())) uninspected.add(pid);
+    else otherArgv.push({ pid, argv });
+  };
+  if (platform() === 'linux') {
+    const argvRead = new Set<string>();
+    try {
+      for (const pid of readdirSync('/proc').filter((entry) => /^\d+$/.test(entry))) {
+        for (const [link, kind] of [['cwd', 'cwd'], ['exe', 'exe']] as const) {
+          try { references.push({ path: readlinkSync(join('/proc', pid, link)), kind, pid }); }
+          catch (error) {
+            const code = (error as NodeJS.ErrnoException).code;
+            // Only a vanished /proc/<pid> proves exit: a live process whose main thread
+            // ended can also report ENOENT for cwd/exe while worker threads still run.
+            let owner: number | undefined;
+            // Only ENOENT/ESRCH proves the process exited; any other failure leaves the scan incomplete.
+            const exited = (failure: unknown): boolean => ['ENOENT', 'ESRCH'].includes(String((failure as NodeJS.ErrnoException).code));
+            let stat: string;
+            try { owner = statSync(join('/proc', pid)).uid; stat = readFileSync(join('/proc', pid, 'stat'), 'utf8'); }
+            catch (failure) { if (exited(failure) && !existsSync(join('/proc', pid))) continue; throw failure; }
+            if (procStatHoldsNothing(stat)) continue;
+            // Our own links must be readable. Another UID's link failure (denied, or ENOENT from a live process) falls back to its argv.
+            if ((code === 'EACCES' || code === 'EPERM' || code === 'ENOENT') && owner !== process.getuid?.()) {
+              if (!argvRead.has(pid)) {
+                argvRead.add(pid);
+                let argv: string | undefined;
+                try { argv = readFileSync(join('/proc', pid, 'cmdline'), 'utf8').split('\0').join(' '); } catch { argv = undefined; }
+                otherUid(pid, argv);
+              }
+              continue;
+            }
+            throw error;
+          }
+        }
+      }
+    } catch (error) { scanError = String(error); }
+  } else if (platform() === 'darwin') {
+    // Bulk lsof may omit individual files. Only a complete scan of every
+    // still-live process of our own UID permits deletion; other UIDs count
+    // via positive bulk sightings only (lsof cannot inspect them unprivileged).
+    try {
+      const listing = listProcesses();
+      const rows = listing.stdout.trim().split('\n').filter(Boolean);
+      const parsed = rows.map((row) => /^\s*(\d+)\s+(-?\d+)(?:\s+(.*?))?\s*$/.exec(row));
+      if (listing.error || listing.status !== 0 || !rows.length || parsed.some((match) => !match)) {
+        scanError = `lsof scope incomplete (ps unavailable: ${listing.error?.message || listing.stderr.trim() || listing.status})`;
+      } else {
+        const sections = new Map<string, string>();
+        if (!scanProcess) {
+          const bulk = spawnSync('lsof', ['-nP', '-F', 'pfn'], { encoding: 'utf8', maxBuffer: SPAWN_MAX_BUFFER });
+          if (bulk.error || bulk.status !== 0) scanError = `lsof scope incomplete: ${bulk.error?.message || bulk.stderr?.trim() || bulk.status}`;
+          else {
+            let id = '';
+            for (const line of bulk.stdout.split('\n')) {
+              if (/^p\d+$/.test(line)) { id = line.slice(1); sections.set(id, ''); }
+              else if (id) sections.set(id, `${sections.get(id)}${line}\n`);
+            }
+          }
+        }
+        const complete = (lines: string): boolean => /(?:^|\n)fcwd\nn[^\n]+\n/.test(lines) && /(?:^|\n)ftxt\nn[^\n]+\n/.test(lines);
+        const readReferences = (id: string, lines: string): void => {
+          let kind = '';
+          for (const line of lines.split('\n')) {
+            if (line.startsWith('f')) kind = line.slice(1);
+            else if (line.startsWith('n') && (kind === 'cwd' || kind === 'txt')) references.push({ path: line.slice(1), kind: kind === 'txt' ? 'exe' : 'cwd', pid: id });
+          }
+        };
+        // Positive bulk sightings matter even if another UID cannot be inspected.
+        for (const [id, lines] of sections) readReferences(id, lines);
+        for (const match of parsed) {
+          const id = match![1]!;
+          // Compare against the complete ps list; lsof may omit even our own UID.
+          if (Number(match![2]) !== process.getuid?.()) { otherUid(id, match![3]); continue; }
+          if (complete(sections.get(id) ?? '')) continue;
+          const state = spawnSync('ps', ['-p', id, '-o', 'stat='], { encoding: 'utf8', maxBuffer: SPAWN_MAX_BUFFER });
+          if (state.error || (state.status !== 0 && state.status !== 1) || (state.status === 0 && !state.stdout.trim())) {
+            scanError = `lsof scope incomplete (pid=${id} state unavailable: ${state.error?.message || state.stderr?.trim() || state.status})`;
+            break;
+          }
+          if (state.status === 1) {
+            // ps can fail to show another UID as well as a process that exited.
+            // Only ESRCH proves the latter; EPERM/unknown must hold candidates.
+            try { process.kill(Number(id), 0); }
+            catch (error) {
+              if ((error as NodeJS.ErrnoException).code === 'ESRCH') continue;
+              scanError = `lsof scope incomplete (pid=${id} existence unavailable: ${String(error)})`;
+              break;
+            }
+            scanError = `lsof scope incomplete (pid=${id} still alive but ps unavailable)`;
+            break;
+          }
+          if (state.stdout.trim().startsWith('Z')) continue;
+          const scan = probe(id);
+          if (scan.error || scan.status !== 0 || !scan.stdout.startsWith(`p${id}\n`) || !complete(scan.stdout)) {
+            scanError = `lsof scope incomplete (pid=${id} cwd/executable unavailable: ${scan.error?.message || scan.stderr?.trim() || scan.status})`;
+            break;
+          }
+          readReferences(id, scan.stdout.slice(`p${id}\n`.length));
+        }
+      }
+    } catch (error) { scanError = `lsof scope incomplete: ${String(error)}`; }
+  } else scanError = `unsupported platform: ${platform()}`;
+  const removed: string[] = [];
+  const kept = [...outcome.kept];
+  for (const candidate of candidates) {
+    const literal = join(dir, candidate.name);
+    const ref = references.find((entry) => isInsideVersion(entry.path, candidate.path))
+      ?? otherArgv.filter((entry) => argvReferencesVersion(entry.argv, candidate.path) || argvReferencesVersion(entry.argv, literal))
+        .map((entry) => ({ path: entry.argv, kind: 'argv', pid: entry.pid }))[0];
+    if (scanError || ref) {
+      kept.push(candidate.name);
+      console.error(`self-update: prune kept ${candidate.name} — ${ref ? `live pid=${ref.pid} ${ref.kind}` : `process scan unavailable: ${scanError}`}`);
+    } else {
+      rmSync(join(dir, candidate.name), { recursive: true, force: true });
+      removed.push(candidate.name);
+    }
+  }
+  if (uninspected.size) console.error(`self-update: prune removed ${removed.join(', ') || 'none'} — ${uninspected.size} other-UID process(es) not inspectable without privilege (argv unreadable too)`);
+  return { ...outcome, removed, kept };
+}
+
+export function defaultPruneVersions(plan: { current: string; daemonSha: string; keep: number }, dir: string = VERSIONS_DIR(), listProcesses?: ProcessListing, scanProcess?: ProcessScan): VersionPruneOutcome {
   const entries = readdirSync(dir, { withFileTypes: true })
     .filter((d) => d.isDirectory())
     .map((d) => ({ name: d.name, mtimeMs: statSync(join(dir, d.name)).mtimeMs }));
-  const outcome = planVersionPrune(entries, plan.current, plan.daemonSha, plan.keep);
-  for (const name of outcome.removed) rmSync(join(dir, name), { recursive: true, force: true });
-  return outcome;
+  return pruneUnusedVersions(dir, planVersionPrune(entries, plan.current, plan.daemonSha, plan.keep), listProcesses, scanProcess);
 }
 
 /**
@@ -502,11 +660,15 @@ export interface ReleaseUpdateDeps {
   out?: { log: (text: string) => void; error: (text: string) => void };
   alert?: (text: string) => void;
   pruneVersions?: (plan: { current: string; previous: string; keep: number; prefix: string }) => VersionPruneOutcome;
+  /** Process scope probe for pruning; when absent the host's process list is used. */
+  listPruneProcesses?: ProcessListing;
+  /** Per-process cwd/executable probe; when absent the host's lsof is used. */
+  scanPruneProcess?: ProcessScan;
   /** 릴리스 기준 URL 주입 — 환경변수와 설치 출처보다 우선한다. */
   releaseBase?: string;
 }
 
-function pruneReleaseVersions(plan: { current: string; previous: string; keep: number; prefix: string }): VersionPruneOutcome {
+function pruneReleaseVersions(plan: { current: string; previous: string; keep: number; prefix: string }, listProcesses?: ProcessListing, scanProcess?: ProcessScan): VersionPruneOutcome {
   const dir = join(plan.prefix, 'versions');
   const entries = readdirSync(dir, { withFileTypes: true })
     .filter((entry) => entry.isDirectory())
@@ -519,8 +681,7 @@ function pruneReleaseVersions(plan: { current: string; previous: string; keep: n
   const newest = [...entries].sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, plan.keep).map((entry) => entry.name);
   const kept = all.filter((name) => name === plan.current || name === plan.previous || newest.includes(name));
   const removed = all.filter((name) => !kept.includes(name));
-  for (const name of removed) rmSync(join(dir, name), { recursive: true, force: true });
-  return { removed, kept };
+  return pruneUnusedVersions(dir, { removed, kept }, listProcesses, scanProcess);
 }
 
 /** The build identity of an install.json — version, version folder and commit; empty when it cannot be read. */
@@ -617,7 +778,8 @@ export async function runReleaseUpdate(options: ReleaseUpdateOptions = {}, deps:
     try {
       const current = typeof metadata === 'object' && metadata !== null && 'versionDir' in metadata && typeof metadata.versionDir === 'string'
         && /^versions\/[a-zA-Z0-9._-]+$/.test(metadata.versionDir) && !metadata.versionDir.includes('..') ? basename(metadata.versionDir) : '';
-      prune = (deps.pruneVersions ?? pruneReleaseVersions)({ current, previous, keep: options.keep ?? 3, prefix });
+      // runReleaseUpdate → pruneReleaseVersions → pruneUnusedVersions (all-UID cwd/executable guard).
+      prune = (deps.pruneVersions ?? ((plan) => pruneReleaseVersions(plan, deps.listPruneProcesses, deps.scanPruneProcess)))({ current, previous, keep: options.keep ?? 3, prefix });
     } catch (error) {
       prune = { removed: [], kept: [], skipped: `정리 실패: ${String(error)}` };
     }
@@ -999,6 +1161,7 @@ export async function runSelfUpdate(options: SelfUpdateOptions = {}, deps: SelfU
     }
     let prune: VersionPruneOutcome;
     try {
+      // runSelfUpdate → defaultPruneVersions → pruneUnusedVersions (all-UID cwd/executable guard).
       prune = (deps.pruneVersions ?? defaultPruneVersions)({ current: installedVersion, daemonSha: decision.from ?? '', keep: options.keep ?? 3 });
     } catch (error) {
       prune = { removed: [], kept: [], skipped: `정리 실패: ${String(error)}` };