elanous 0.2.23 → 0.2.24

package/src/cli/pr-land-overlap-evidence.ts

@@ -7,14 +7,21 @@
  * - 무엇을: `--overlap-evidence <file>` 의 JSON 을 «믿지 않고» 잰다.
  *   ① 재기반 — 원격 base 의 «지금» 끝(`git ls-remote`)이 고정 머리의 조상인가(`git merge-base --is-ancestor`).
  *   ② 재게이트 — 증거의 게이트 기록이 «그 머리»를 «그 base 끝» 위에서 통과했다고 말하는가(머리·base 끝이 ① 과 맞물린다).
+ *   ②' 재게이트 뒤 base 가 앞섰다(OVERLAP-EVIDENCE-BASE-WINDOW) — `gate.baseCommit ≠ 지금 끝`이면 «창»을 잰다:
+ *      ⓐ `gate.baseCommit` 이 고정 머리의 조상 ⊕ 지금 끝의 조상이고 ⓑ 창 `gate.baseCommit..지금 끝`의 커밋이 «하나도»
+ *      PR 의 바뀐 파일(머리 vs merge-base)을 안 건드리면 통과(관측 reason `base-advanced-disjoint`).
+ *      겹치면 `base-stale-overlap`(REJUDGE 가 재게이트를 청한다) · 못 재면 `base-window-unmeasured` · ⓐ 가 아니면 종전 사유.
  *   ③ 리뷰 — 증거가 가리키는 `review-results/<card>-<pr>-<head12>.json`(TA 가 받는 `self review --json` stdout)이
- *      같은 PR·같은 머리에 대해 `reviewed:true` · `verdict:pass` · must-fix 0 인가.
+ *      같은 PR·같은 머리에 대해 `reviewed:true` · `verdict ∈ {pass, warn}` · must-fix 가 «잰 수» 0 인가
+ *      (자동 병합 canAuto · TA-LAND-WARN-MUSTFIX0 과 같은 규칙 — must-fix 를 못 셌으면 거부).
  *   ⓐ 이미 조상(TC #26019 실측) — 겹친 최근 착지 커밋이 «전부» 고정 머리의 조상이면 그 겹침은 이미 그 머리의 게이트·리뷰에
  *      반영됐다 ⇒ ①② 없이 ③ 만으로 통과(관측 reason `already-ancestor`). 하나라도 조상이 아니면 ①②③ 전부.
+ *   ⓐ' 증거 파일이 없을 때(`verifyAncestorAutoPass`) — 같은 ⓐ 를 표준 자리 `review-results/*-<pr>-<head12>.json` 만으로 잰다
+ *      (관측 reason `already-ancestor-auto`). 조상이 아닌 착지가 하나라도 있거나 리뷰 결과가 없으면 거부.
  *   하나라도 못 재거나 어긋나면 거부 — 호출부는 종전 거부를 그대로 낸다(fail-closed).
  * - 관측: `pr.land` · `overlap-evidence` (decision · reason · 잰 값).
  */
-import { basename, dirname } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
 import type { CmdRunner } from '../autopilot/pr-manager.js';
 import { parseReviewResultOutput } from '../task-agent/review-result-capture.js';
@@ -33,6 +40,7 @@ interface OverlapEvidenceFile {
 export type OverlapEvidenceVerdict =
   | { ok: true; mode: 'already-ancestor'; reviewResult: string }
   | { ok: true; mode: 'rebased'; baseTip: string; reviewResult: string }
+  | { ok: true; mode: 'base-advanced-disjoint'; baseTip: string; gateBase: string; windowCommits: number; reviewResult: string }
   | { ok: false; reason: string };
 
 export interface VerifyOverlapEvidenceInput {
@@ -48,9 +56,14 @@ export interface VerifyOverlapEvidenceInput {
   overlappingLandings?: readonly string[];
 }
 
-type Checked = { ok: false; reason: string; baseTip?: string } | (OverlapEvidenceVerdict & { ok: true; baseTip?: string });
+type Checked = { ok: false; reason: string; baseTip?: string; gateBase?: string; windowCommits?: number }
+  | (OverlapEvidenceVerdict & { ok: true; baseTip?: string });
 
-function checkReview(input: VerifyOverlapEvidenceInput, e: Partial<OverlapEvidenceFile>, head: string, baseTip?: string): { ok: false; reason: string; baseTip?: string } | { ok: true; reviewResult: string } {
+/** 리뷰가 받는 판정 — 자동 병합(canAuto)·TA 착지(TA-LAND-WARN-MUSTFIX0)와 같은 집합. */
+const ACCEPTED_REVIEW_VERDICTS: ReadonlySet<string> = new Set(['pass', 'warn']);
+const COMMIT_MARK = '\u0001';
+
+function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>, e: Partial<OverlapEvidenceFile>, head: string, baseTip?: string): { ok: false; reason: string; baseTip?: string } | { ok: true; reviewResult: string } {
   if (typeof e.reviewResult !== 'string' || !e.reviewResult) return { ok: false, reason: 'review-missing', baseTip };
   // TA 가 받는 자리(`<state>/review-results/<card>-<pr>-<head12>.json` · reviewResultPath)만 — 아무 디렉터리의 같은 이름은 안 받는다.
   if (basename(dirname(e.reviewResult)) !== 'review-results'
@@ -65,11 +78,67 @@ function checkReview(input: VerifyOverlapEvidenceInput, e: Partial<OverlapEviden
   if (!review.head || review.head.toLowerCase() !== head) return { ok: false, reason: 'review-head-mismatch', baseTip };
   if (review.error) return { ok: false, reason: 'review-error', baseTip };
   if (review.reviewed !== true) return { ok: false, reason: 'review-not-reviewed', baseTip };
-  if (review.verdict !== 'pass') return { ok: false, reason: `review-verdict-${review.verdict ?? 'null'}`, baseTip };
+  if (review.verdict === null || !ACCEPTED_REVIEW_VERDICTS.has(review.verdict)) return { ok: false, reason: `review-verdict-${review.verdict ?? 'null'}`, baseTip };
   if (review.mustFix !== 0) return { ok: false, reason: review.mustFix === null ? 'review-must-fix-unknown' : `review-must-fix-${review.mustFix}`, baseTip };
   return { ok: true, reviewResult: e.reviewResult };
 }
 
+type WindowResult = { ok: true; windowCommits: number } | { ok: false; reason: string; windowCommits?: number };
+
+/**
+ * ②' — 재게이트 뒤 앞선 base 의 창 `gateBase..baseTip` 이 PR 의 바뀐 파일과 «서로소»인가. 읽기 전용 git 만 쓴다
+ * (끝 커밋이 로컬에 없을 때만 ref 를 안 쓰는 fetch). `staleReason` 은 ⓐ(조상 아님)일 때 그대로 내는 종전 사유다.
+ */
+function checkBaseWindow(input: VerifyOverlapEvidenceInput, head: string, baseTip: string, gateBase: string, staleReason: string): WindowResult {
+  const git = (args: string[]) => input.run('git', args, { cwd: input.cwd });
+  const short = (sha: string) => sha.slice(0, 12);
+  if (!git(['merge-base', '--is-ancestor', gateBase, head]).ok) {
+    return { ok: false, reason: `${staleReason} (gate base is not an ancestor of head)` };
+  }
+  if (!git(['cat-file', '-e', `${baseTip}^{commit}`]).ok) {
+    // ref 를 안 바꾸는 fetch — FETCH_HEAD 도 원격 추적 ref 도 안 쓴다.
+    git(['fetch', '--quiet', '--no-write-fetch-head', '--refmap=', input.remote, `refs/heads/${input.branch}`]);
+    if (!git(['cat-file', '-e', `${baseTip}^{commit}`]).ok) {
+      return { ok: false, reason: `base-window-unmeasured: ${input.remote}/${input.branch} ${short(baseTip)} not available locally · ${staleReason}` };
+    }
+  }
+  if (!git(['merge-base', '--is-ancestor', gateBase, baseTip]).ok) {
+    return { ok: false, reason: `${staleReason} (gate base is not an ancestor of ${input.remote}/${input.branch})` };
+  }
+  const mergeBase = git(['merge-base', baseTip, head]);
+  const forkPoint = mergeBase.ok ? mergeBase.out.trim() : '';
+  if (!SHA40.test(forkPoint)) return { ok: false, reason: `base-window-unmeasured: merge-base ${short(baseTip)} ${short(head)} failed · ${staleReason}` };
+  const diff = git(['diff', '--name-only', '--no-renames', forkPoint, head]);
+  if (!diff.ok) return { ok: false, reason: `base-window-unmeasured: diff --name-only ${short(forkPoint)} ${short(head)} failed · ${staleReason}` };
+  const prFiles = new Set(diff.out.split('\n').map((line) => line.trim()).filter(Boolean));
+  if (prFiles.size === 0) return { ok: false, reason: `base-window-unmeasured: PR changed files are empty · ${staleReason}` };
+  // 병합 커밋은 첫 부모 대비 diff(-m --first-parent) — base 에 «들어온» 변경만, 빠짐없이.
+  const log = git(['log', '--first-parent', '-m', '--no-renames', '--name-only', `--format=${COMMIT_MARK}%H`, `${gateBase}..${baseTip}`]);
+  if (!log.ok) return { ok: false, reason: `base-window-unmeasured: log ${short(gateBase)}..${short(baseTip)} failed · ${staleReason}` };
+  const touched = new Map<string, string[]>();
+  let current = '';
+  for (const raw of log.out.split('\n')) {
+    const line = raw.trim();
+    if (!line) continue;
+    if (line.startsWith(COMMIT_MARK)) { current = line.slice(COMMIT_MARK.length); if (!touched.has(current)) touched.set(current, []); continue; }
+    if (current && prFiles.has(line)) touched.get(current)!.push(line);
+  }
+  const windowCommits = touched.size;
+  if (windowCommits === 0 || [...touched.keys()].some((sha) => !SHA40.test(sha))) {
+    return { ok: false, reason: `base-window-unmeasured: window ${short(gateBase)}..${short(baseTip)} listed no commits · ${staleReason}` };
+  }
+  const overlapping = [...touched.entries()].filter(([, files]) => files.length > 0);
+  if (overlapping.length > 0) {
+    const files = [...new Set(overlapping.flatMap(([, f]) => f))];
+    return {
+      ok: false,
+      windowCommits,
+      reason: `base-stale-overlap: gate ${short(gateBase)} ≠ ${input.remote}/${input.branch} ${short(baseTip)} · ${overlapping.length}/${windowCommits} window commits touch PR files (${overlapping.map(([sha]) => short(sha)).slice(0, 5).join(', ')}): ${files.slice(0, 10).join(', ')}`,
+    };
+  }
+  return { ok: true, windowCommits };
+}
+
 function check(input: VerifyOverlapEvidenceInput): Checked {
   const head = input.expectedHead.toLowerCase();
   let raw: unknown;
@@ -94,15 +163,32 @@ function check(input: VerifyOverlapEvidenceInput): Checked {
   const baseTip = remote.ok ? remote.out.trim().split(/\s+/)[0] ?? '' : '';
   if (!SHA40.test(baseTip)) return { ok: false, reason: `rebase-unmeasured: ls-remote ${input.remote} ${input.branch} failed` };
   const ancestor = input.run('git', ['merge-base', '--is-ancestor', baseTip, head], { cwd: input.cwd });
-  if (!ancestor.ok) return { ok: false, reason: `not-rebased: ${input.remote}/${input.branch} ${baseTip.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}`, baseTip };
+  const gate = e.gate;
+  // ②' 의 입구 — 게이트 기록이 «그 머리»를 통과했고 base 만 지금 끝과 다르다.
+  const gateBase = gate && typeof gate === 'object' && gate.passed === true
+    && typeof gate.head === 'string' && gate.head.toLowerCase() === head
+    && typeof gate.baseCommit === 'string' && SHA40.test(gate.baseCommit) && gate.baseCommit.toLowerCase() !== baseTip.toLowerCase()
+    ? gate.baseCommit.toLowerCase() : undefined;
+  const advanced = (staleReason: string): Checked => {
+    const window = checkBaseWindow(input, head, baseTip, gateBase!, staleReason);
+    if (!window.ok) return { ok: false, reason: window.reason, baseTip, gateBase, windowCommits: window.windowCommits };
+    const review = checkReview(input, e, head, baseTip);
+    return review.ok
+      ? { ok: true, mode: 'base-advanced-disjoint', baseTip, gateBase: gateBase!, windowCommits: window.windowCommits, reviewResult: review.reviewResult }
+      : { ...review, gateBase, windowCommits: window.windowCommits };
+  };
+  if (!ancestor.ok) {
+    const notRebased = `not-rebased: ${input.remote}/${input.branch} ${baseTip.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}`;
+    return gateBase ? advanced(notRebased) : { ok: false, reason: notRebased, baseTip };
+  }
 
   // ② 재게이트 — 그 머리를, ① 의 그 base 끝 위에서.
-  const gate = e.gate;
   if (!gate || typeof gate !== 'object') return { ok: false, reason: 'gate-missing', baseTip };
   if (gate.passed !== true) return { ok: false, reason: 'gate-not-passed', baseTip };
   if (typeof gate.head !== 'string' || gate.head.toLowerCase() !== head) return { ok: false, reason: 'gate-head-mismatch', baseTip };
   if (typeof gate.baseCommit !== 'string' || gate.baseCommit.toLowerCase() !== baseTip.toLowerCase()) {
-    return { ok: false, reason: `gate-base-stale: gate ${String(gate.baseCommit).slice(0, 12)} ≠ ${input.remote}/${input.branch} ${baseTip.slice(0, 12)}`, baseTip };
+    const stale = `gate-base-stale: gate ${String(gate.baseCommit).slice(0, 12)} ≠ ${input.remote}/${input.branch} ${baseTip.slice(0, 12)}`;
+    return gateBase ? advanced(stale) : { ok: false, reason: stale, baseTip };
   }
 
   // ③ 리뷰 — 그 PR · 그 머리의 pass ⊕ must-fix 0.
@@ -110,22 +196,84 @@ function check(input: VerifyOverlapEvidenceInput): Checked {
   return review.ok ? { ok: true, mode: 'rebased', baseTip, reviewResult: review.reviewResult } : review;
 }
 
+export type AncestorAutoVerdict =
+  | { ok: true; mode: 'already-ancestor-auto'; reviewResult: string }
+  | { ok: false; reason: string };
+
+export interface VerifyAncestorAutoInput {
+  pr: number;
+  expectedHead: string;
+  cwd: string;
+  run: CmdRunner;
+  readFile: (path: string) => string;
+  /** 표준 자리 `<state>/review-results` — 이 안의 `*-<pr>-<head12>.json` 만 본다. */
+  reviewResultsDir: string;
+  listDir: (dir: string) => readonly string[];
+  /** 겹침 관문이 찾은 «겹친» 최근 착지 커밋들. */
+  overlappingLandings: readonly string[];
+}
+
+function checkAncestorAuto(input: VerifyAncestorAutoInput): AncestorAutoVerdict {
+  const head = input.expectedHead.toLowerCase();
+  const landings = input.overlappingLandings;
+  if (landings.length === 0) return { ok: false, reason: 'ancestor-auto-no-overlapping-landings' };
+  const notAncestor = landings.find((sha) => !(/^[0-9a-f]{7,40}$/i.test(sha)
+    && input.run('git', ['merge-base', '--is-ancestor', sha, head], { cwd: input.cwd }).ok));
+  if (notAncestor !== undefined) return { ok: false, reason: `ancestor-auto-not-ancestor: ${notAncestor.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}` };
+  let names: readonly string[];
+  try { names = input.listDir(input.reviewResultsDir); } catch { return { ok: false, reason: 'review-missing' }; }
+  const suffix = new RegExp(`-${input.pr}-${head.slice(0, 12)}\\.json$`, 'i');
+  // 같은 <pr>-<head12> 리뷰가 여럿이면 «전부» 통과해야 한다 — 하나라도 거부면 거부(fail-closed · 처음 통과한 하나로 승인하지 않는다).
+  let accepted: string | undefined;
+  for (const name of [...names].filter((n) => suffix.test(n)).sort()) {
+    const review = checkReview(input, { reviewResult: join(input.reviewResultsDir, name) }, head);
+    if (!review.ok) return { ok: false, reason: review.reason };
+    accepted = review.reviewResult;
+  }
+  return accepted === undefined ? { ok: false, reason: 'review-missing' } : { ok: true, mode: 'already-ancestor-auto', reviewResult: accepted };
+}
+
+/**
+ * 증거 파일이 없을 때의 already-ancestor 자동 판정 — 겹친 착지가 «전부» 고정 머리의 조상이고 표준 자리의 리뷰 결과가
+ * pass|warn ⊕ must-fix 0 이면 통과. 던지지 않는다 — 어떤 실패도 거부(fail-closed)이고 관측 한 줄을 남긴다.
+ */
+export function verifyAncestorAutoPass(input: VerifyAncestorAutoInput): AncestorAutoVerdict {
+  let verdict: AncestorAutoVerdict;
+  try { verdict = checkAncestorAuto(input); } catch (error) { verdict = { ok: false, reason: `verify-threw: ${String(error).slice(0, 200)}` }; }
+  debug.log('pr.land', 'overlap-evidence', {
+    decision: verdict.ok ? 'accepted' : 'rejected',
+    reason: verdict.ok ? 'already-ancestor-auto' : verdict.reason,
+    overlappingLandings: input.overlappingLandings,
+    pr: input.pr,
+    head: input.expectedHead,
+    evidencePath: null,
+    reviewResultsDir: input.reviewResultsDir,
+  });
+  return verdict;
+}
+
 /** 던지지 않는다 — 어떤 실패도 거부(fail-closed)이고 관측 한 줄을 남긴다. */
 export function verifyOverlapEvidence(input: VerifyOverlapEvidenceInput): OverlapEvidenceVerdict {
   let verdict: Checked;
   try { verdict = check(input); } catch (error) { verdict = { ok: false, reason: `verify-threw: ${String(error).slice(0, 200)}` }; }
   debug.log('pr.land', 'overlap-evidence', {
     decision: verdict.ok ? 'accepted' : 'rejected',
-    reason: verdict.ok ? (verdict.mode === 'already-ancestor' ? 'already-ancestor' : 'rebased+gated+reviewed') : verdict.reason,
+    reason: verdict.ok
+      ? (verdict.mode === 'already-ancestor' ? 'already-ancestor' : verdict.mode === 'base-advanced-disjoint' ? 'base-advanced-disjoint' : 'rebased+gated+reviewed')
+      : verdict.reason,
     overlappingLandings: input.overlappingLandings ?? [],
     pr: input.pr,
     head: input.expectedHead,
     base: `${input.remote}/${input.branch}`,
     baseTip: verdict.baseTip ?? null,
     evidencePath: input.evidencePath,
+    gateBase: (verdict.ok ? (verdict.mode === 'base-advanced-disjoint' ? verdict.gateBase : undefined) : verdict.gateBase) ?? null,
+    windowCommits: (verdict.ok ? (verdict.mode === 'base-advanced-disjoint' ? verdict.windowCommits : undefined) : verdict.windowCommits) ?? null,
   });
   if (!verdict.ok) return { ok: false, reason: verdict.reason };
-  return verdict.mode === 'already-ancestor'
-    ? { ok: true, mode: 'already-ancestor', reviewResult: verdict.reviewResult }
-    : { ok: true, mode: 'rebased', baseTip: verdict.baseTip!, reviewResult: verdict.reviewResult };
+  if (verdict.mode === 'already-ancestor') return { ok: true, mode: 'already-ancestor', reviewResult: verdict.reviewResult };
+  if (verdict.mode === 'base-advanced-disjoint') {
+    return { ok: true, mode: 'base-advanced-disjoint', baseTip: verdict.baseTip!, gateBase: verdict.gateBase, windowCommits: verdict.windowCommits, reviewResult: verdict.reviewResult };
+  }
+  return { ok: true, mode: 'rebased', baseTip: verdict.baseTip!, reviewResult: verdict.reviewResult };
 }

package/src/cli/release-cli.ts

@@ -5,8 +5,8 @@
 //   elanous release tag --version <x.y.z> --source <commit> [--yes]
 //   elanous release verify  [--version <x.y.z>]
 //   elanous release notes   --from <ref> [--to <ref>]
-//   elanous release run     --version <x.y.z> [--prerelease rc] [--main-cut | --cut-commit <sha>] [--publish-at <iso>] [--dry-run] [--json] [--if-ready]
-//   elanous release resume  --run <runId> --from <node> [--waive <node> --reason <text>] [--accepted-regressions <json>] [--json]
+//   elanous release run     --version <x.y.z> [--prerelease rc] [--main-cut | --cut-commit <sha>] [--publish-at <iso>] [--gate-executor <pod|host> [--gate-host <ssh-host>]] [--dry-run] [--json] [--if-ready]
+//   elanous release resume  --run <runId> --from <node> [--waive <node> --reason <text>] [--accepted-regressions <json>] [--gate-executor <pod|host> [--gate-host <ssh-host>]] [--json]
 //   elanous release auto-start [--window-minutes <n>] [--apply] [--json]
 //   elanous release rehearsal tick [--apply] [--checkout <dir>] [--json]
 //   elanous release preflight --version <x.y.z> [--publish-at <iso>] [--json]   (컷 30분 전 사전 점검 · 읽기 전용 · ⛔ 있으면 exit 1)
@@ -989,7 +989,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .action(async (o: { version: string; base: string; pick: string[]; append?: boolean; dryRun?: boolean; json?: boolean }) => {
       await jsonAction(o.json, async (log) => cutReleaseBranch({ ...o, log }), () => true);
     });
-  const runAction = async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; json?: boolean }, logRun = console.log): Promise<boolean | AutoStartDeferral | undefined> => {
+  const runAction = async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; gateExecutor?: string; gateHost?: string; json?: boolean }, logRun = console.log): Promise<boolean | AutoStartDeferral | undefined> => {
       // Only the rc rehearsal channel is operated for now (alpha/beta stay valid version shapes, not run options).
       if (o.prerelease !== undefined && o.prerelease !== 'rc') {
         const message = `--prerelease supports rc only: ${o.prerelease}`;
@@ -1038,7 +1038,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
           const outcome = await runReleaseIfReady(o.version, {
             ledgerRoot: releaseRunDeps.ledgerRoot,
             readiness: (version, options) => releaseReadiness(version, { ledgerRoot: releaseRunDeps.ledgerRoot, checklist: releaseRunDeps.checklist, ...options }),
-            run: () => runUnattendedRelease({ version: o.version, cutCommit: o.cutCommit, mainCut: o.mainCut, prerelease, forceFreeze: o.forceFreeze, publishAt: o.publishAt }, releaseRunDeps),
+            run: () => runUnattendedRelease({ version: o.version, cutCommit: o.cutCommit, mainCut: o.mainCut, prerelease, forceFreeze: o.forceFreeze, publishAt: o.publishAt, gateExecutor: o.gateExecutor, gateHost: o.gateHost }, releaseRunDeps),
           });
           if (outcome.skipped) {
             if (o.json) await writeStdoutJson(`${JSON.stringify(outcome)}\n`);
@@ -1066,7 +1066,7 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         }
       }
       await jsonAction(o.json, async (log) => {
-        const result = await runUnattendedRelease({ version: o.version, dryRun: o.dryRun, cutCommit: o.cutCommit, mainCut: o.mainCut, prerelease, forceFreeze: o.forceFreeze, publishAt: o.publishAt }, releaseRunDeps);
+        const result = await runUnattendedRelease({ version: o.version, dryRun: o.dryRun, cutCommit: o.cutCommit, mainCut: o.mainCut, prerelease, forceFreeze: o.forceFreeze, publishAt: o.publishAt, gateExecutor: o.gateExecutor, gateHost: o.gateHost }, releaseRunDeps);
         log(`${result.dryRun ? '· 드라이런' : '▶ 릴리스 루프'} ${result.input.version} · 입력 ${JSON.stringify(result.input)}`);
         return result;
       }, (r) => r.dryRun || r.state?.status === 'done' || r.state?.status === 'awaiting-approval');
@@ -1081,8 +1081,10 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--if-ready', '준비되지 않았으면 사유를 출력하고 성공으로 건너뛴다')
     .option('--publish-at <iso>', '승인·선행 노드 통과 뒤 지정 시각까지 발행 대기(오프셋 포함 ISO 시각)')
     .option('--force-freeze', '동결 중 게이트·발행 강행(관측 기록) — 가지 컷은 동결이 필요 없다 · 동결은 비상 스위치로 남는다')
+    .option('--gate-executor <pod|host>', 'gate 노드 실행기(기본 pod) — host 는 Pod 대신 SSH 호스트의 깨끗한 클론에서 같은 판정(면제 아님)')
+    .option('--gate-host <ssh-host>', '--gate-executor host 의 SSH 호스트(기본 release.loop.gateRemote)')
     .option('--json', '결과 한 줄 JSON(stdout) · 사람 줄은 stderr')
-    .action(async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; json?: boolean }) => { await runAction(o); });
+    .action(async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; gateExecutor?: string; gateHost?: string; json?: boolean }) => { await runAction(o); });
   release.command('preflight')
     .description('컷 30분 전 사전 점검(읽기 전용) — 체크리스트 게이트 모의 · 발행 뒤 칸 · run --dry-run 입력 · 동결 · 일정/게이트 실측. ⛔ 있으면 exit 1')
     .requiredOption('--version <v>', '점검할 판(x.y.z)')
@@ -1128,8 +1130,10 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--waive <node>', '저장된 실패 노드 한 개를 면제(--from 은 그 노드 그대로)')
     .option('--reason <text>', '면제 사유 — 공개 알려진 문제에 들어갈 사용자 영향 설명')
     .option('--accepted-regressions <json>', '알려진 문제 추가 입력 JSON 배열 [{"id":"…","note":"…"}]')
+    .option('--gate-executor <pod|host>', '다시 도는 gate 의 실행기 전환(--from gate 이전만) — 런 입력에 기록 · 면제 아님')
+    .option('--gate-host <ssh-host>', '--gate-executor host 의 SSH 호스트(기본 저장된 런 입력 gateRemote)')
     .option('--json', '결과 한 줄 JSON(stdout)')
-    .action(async (o: { run: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: string; json?: boolean }) => {
+    .action(async (o: { run: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: string; gateExecutor?: string; gateHost?: string; json?: boolean }) => {
       await jsonAction(o.json, async (log) => {
         let acceptedRegressions: AcceptedRegression[] | undefined;
         if (o.acceptedRegressions !== undefined) {
@@ -1143,12 +1147,17 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         const result = await resumeReleaseRun({ runId: o.run, from: o.from, partial: o.partial,
           ...(o.waive === undefined ? {} : { waive: o.waive }),
           ...(o.reason === undefined ? {} : { reason: o.reason }),
-          ...(o.acceptedRegressions === undefined ? {} : { acceptedRegressions }) });
+          ...(o.acceptedRegressions === undefined ? {} : { acceptedRegressions }),
+          ...(o.gateExecutor === undefined ? {} : { gateExecutor: o.gateExecutor }),
+          ...(o.gateHost === undefined ? {} : { gateHost: o.gateHost }) });
+        const override = result.state.inputOverrides?.at(-1);
+        if (o.gateExecutor !== undefined && override) log(`⇄ gate 실행기 ${override.set.gateExecutor}${override.set.gateRemote ? ` @ ${override.set.gateRemote}` : ''} (런 입력에 기록 · 면제 아님)`);
         if (result.partial.requested) log(result.partial.applied
           ? `◐ 부분 재검: ${result.partial.files}파일 · 나머지는 앞 게이트(${result.partial.priorCommit.slice(0, 12)}) 결과를 잇는다`
           : `● 전체 게이트로: ${result.partial.reason}`);
         log(`${result.tip.changed ? `↻ ${result.tip.branch} ${result.tip.from.slice(0, 12)} → ${result.tip.to.slice(0, 12)} (백업 ${result.tip.backup})` : `· ${result.tip.branch} 끝 그대로 ${result.tip.to.slice(0, 12)}`} · ${o.from} 부터 → ${result.state.status}`);
-        return { tip: result.tip, partial: result.partial, status: result.state.status, runId: result.state.runId };
+        return { tip: result.tip, partial: result.partial, status: result.state.status, runId: result.state.runId,
+          ...(o.gateExecutor !== undefined && result.state.inputOverrides?.length ? { gateExecutor: result.state.inputOverrides.at(-1) } : {}) };
       }, (r) => r.status === 'done' || r.status === 'awaiting-approval');
     });
   release.command('rehearsal').description('판 일정에서 컷 전 가벼운 RC 두 단계').command('tick')

package/src/cli/rfc-status.ts

@@ -1,6 +1,6 @@
 import type { Command } from 'commander';
 import { readdirSync, readFileSync } from 'node:fs';
-import { join, relative, resolve } from 'node:path';
+import { dirname, join, relative, resolve } from 'node:path';
 import YAML from 'yaml';
 
 export const RFC_STATUSES = ['unknown', 'proposed', 'adopted', 'completed', 'superseded', 'rejected'] as const;
@@ -69,6 +69,49 @@ export function adoptedWithoutCard(rows: readonly RfcRow[]): RfcRow[] {
   return rows.filter((row) => row.status === 'adopted' && row.card === null);
 }
 
+const RFC_HUB_FILE = 'INDEX-loop-agents-and-harness-rfcs.md';
+
+function markdownLinks(markdown: string): string[] {
+  return [...markdown.matchAll(/\]\(([^)\s]+\.md)(?:#[^)]*)?\)/g)].map((match) => match[1]!);
+}
+
+function hasHubConnectionReference(text: string, documentPath: string, root: string): boolean {
+  const firstSection = text.search(/^##\s/m);
+  const header = firstSection < 0 ? text : text.slice(0, firstSection);
+  const hubPath = resolve(root, 'docs', RFC_HUB_FILE);
+  return header.split(/\r?\n/).some((line) => {
+    if (!line.includes('🔗') || !line.includes('연결 참조')) return false;
+    return markdownLinks(line).some((target) =>
+      resolve(dirname(resolve(root, documentPath)), target) === hubPath);
+  });
+}
+
+/** 허브를 못 읽으면 null — «0» 과 «못 셌음» 은 다른 값이다. */
+function hubConnectionCounts(root: string, rows: readonly RfcRow[]): { unconnected: number; unlisted: number } | null {
+  const hubPath = resolve(root, 'docs', RFC_HUB_FILE);
+  let hub: string;
+  try { hub = readFileSync(hubPath, 'utf8'); }
+  catch { return null; }
+
+  const hubDirectory = dirname(hubPath);
+  const listedPaths = new Set(markdownLinks(hub)
+    .filter((target) => /^RFC-.*\.md$/.test(target.split(/[?#]/, 1)[0]!))
+    .map((target) => relative(root, resolve(hubDirectory, target)).replaceAll('\\', '/')));
+  const rowsByPath = new Map(rows.map((row) => [row.path, row]));
+  const unconnected = [...listedPaths].filter((path) => {
+    const row = rowsByPath.get(path);
+    if (!row) return false;
+    return !hasHubConnectionReference(readFileSync(resolve(root, row.path), 'utf8'), row.path, root);
+  }).length;
+  const unlisted = rows.filter((row) => {
+    if (listedPaths.has(row.path)) return false;
+    const text = readFileSync(resolve(root, row.path), 'utf8');
+    const title = /^#\s+(.+)$/m.exec(text)?.[1] ?? '';
+    return /루프|하니스|그래프/.test(title);
+  }).length;
+  return { unconnected, unlisted };
+}
+
 export function runRfcStatus(options: { json?: boolean; missingCards?: boolean }, root = process.cwd(),
   write: (text: string) => void = (text) => process.stdout.write(text)): void {
   const all = scanRfcs(root);
@@ -77,9 +120,13 @@ export function runRfcStatus(options: { json?: boolean; missingCards?: boolean }
     write(`${JSON.stringify({ total: all.length, adoptedWithoutCard: adoptedWithoutCard(all).length, rows }, null, 2)}\n`);
     return;
   }
+  const hubCounts = hubConnectionCounts(root, all);
   write(`RFC ${all.length} · 채택·칸 없음 ${adoptedWithoutCard(all).length} · 표시 ${rows.length}\n`);
   write('상태\t담당\t칸\t대체 문서\t핸드북\t옛 상태\t옛 담당\t경로\t메타 오류\n');
   for (const row of rows) write(`${row.status}\t${row.owner ?? '모름'}\t${row.card ?? '모름'}\t${row.supersededBy ?? '모름'}\t${row.handbook ?? '모름'}\t${row.legacyStatus ?? '-'}\t${row.legacyOwner ?? '-'}\t${row.path}\t${row.issue ?? '-'}\n`);
+  write(hubCounts
+    ? `허브 연결: 되돌림 없음 ${hubCounts.unconnected} · 미등재 ${hubCounts.unlisted}\n`
+    : `허브 연결: 못 셈 — docs/${RFC_HUB_FILE} 를 못 읽었다\n`);
 }
 
 export function registerRfcStatusCommand(docs: Command): void {
@@ -87,5 +134,8 @@ export function registerRfcStatusCommand(docs: Command): void {
     .description('전체 RFC 생애주기 표 (RFC frontmatter만 읽음)')
     .option('--json', '기계가 읽을 JSON')
     .option('--missing-cards', '채택됐으나 칸이 기록되지 않은 RFC만')
-    .action((options: { json?: boolean; missingCards?: boolean }) => runRfcStatus(options));
+    .action((options: { json?: boolean; missingCards?: boolean }): void => {
+      // registerDocsCommands in docs-cli.ts calls registerRfcStatusCommand; this action calls runRfcStatus and its hub check.
+      runRfcStatus(options);
+    });
 }

package/src/cli/self-update.ts

@@ -428,6 +428,80 @@ export interface VersionPruneOutcome {
   skipped?: string;
 }
 
+export interface RailSafeProcessListing {
+  status: number | null;
+  stdout: string;
+  stderr: string;
+  error?: Error;
+}
+
+export interface AssessRailSafeInput {
+  entries: ReadonlyArray<{ name: string; mtimeMs: number }>;
+  current: string;
+  daemonSha: string;
+  keep: number;
+  versionsDir: string;
+  listProcesses?: (pattern: string) => RailSafeProcessListing;
+  readProcessCommand?: (pid: string) => string | null;
+  isReleaseRunActive?: () => boolean;
+}
+
+/** Shadow probes must never stall the install: a hung pgrep/ps reads as «no process» (status null). */
+const RAIL_SAFE_PROBE_TIMEOUT_MS = 5_000;
+
+function pgrepProcesses(pattern: string): RailSafeProcessListing {
+  const result = spawnSync('pgrep', ['-f', pattern], { encoding: 'utf8', maxBuffer: SPAWN_MAX_BUFFER, timeout: RAIL_SAFE_PROBE_TIMEOUT_MS });
+  return { status: result.status, stdout: result.stdout ?? '', stderr: result.error?.message ?? result.stderr ?? '', ...(result.error ? { error: result.error } : {}) };
+}
+
+function processCommand(pid: string): string | null {
+  const result = spawnSync('ps', ['-p', pid, '-o', 'command='], { encoding: 'utf8', maxBuffer: SPAWN_MAX_BUFFER, timeout: RAIL_SAFE_PROBE_TIMEOUT_MS });
+  return result.status === 0 ? (result.stdout ?? '').trim() || null : null;
+}
+
+function listedProcessCommands(listing: RailSafeProcessListing, readCommand: (pid: string) => string | null): string[] {
+  if (listing.status !== 0) return [];
+  return listing.stdout.split(/\r?\n/).flatMap((line) => {
+    const entry = line.trim();
+    if (!entry) return [];
+    if (!/^\d+$/.test(entry)) return [entry];
+    const command = readCommand(entry);
+    return command ? [command] : [];
+  });
+}
+
+function pgrepPathPattern(path: string): string {
+  return path.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/** Shadow-only observation: determine whether a prune plan targets an argv-held version or a release run is active. */
+export function assessRailSafe(input: AssessRailSafeInput): {
+  wouldBlock: boolean;
+  reasons: Array<'held-version' | 'release-run-active'>;
+  heldVersions: string[];
+  releaseRunActive: boolean;
+} {
+  const plan = planVersionPrune(input.entries, input.current, input.daemonSha, input.keep);
+  const listProcesses = input.listProcesses ?? pgrepProcesses;
+  const readCommand = input.readProcessCommand ?? processCommand;
+  const heldVersions = plan.removed.filter((name) => {
+    const path = join(input.versionsDir, name);
+    try {
+      return listedProcessCommands(listProcesses(pgrepPathPattern(path)), readCommand).some((argv) => argv.includes(path));
+    } catch { return false; }
+  });
+  let releaseRunActive = false;
+  try {
+    releaseRunActive = input.isReleaseRunActive?.() ?? listedProcessCommands(
+      listProcesses('release[[:space:]]+(run|resume)'), readCommand,
+    ).some((argv) => /release\s+(?:run|resume)/.test(argv));
+  } catch { releaseRunActive = false; }
+  const reasons: Array<'held-version' | 'release-run-active'> = [];
+  if (heldVersions.length) reasons.push('held-version');
+  if (releaseRunActive) reasons.push('release-run-active');
+  return { wouldBlock: reasons.length > 0, reasons, heldVersions, releaseRunActive };
+}
+
 /**
  * 야간 자동 설치는 하룻밤에 한 판(약 641MB · 2026-09-24 실측)을 쌓는다. 설치기는 옛 판을 안 지운다.
  * 남기는 것: `current` 가 가리키는 판 · 지금 데몬이 도는 판(판정의 `from` sha) · 최근 `keep` 판(롤백용).
@@ -664,6 +738,12 @@ export interface ReleaseUpdateDeps {
   listPruneProcesses?: ProcessListing;
   /** Per-process cwd/executable probe; when absent the host's lsof is used. */
   scanPruneProcess?: ProcessScan;
+  /** Shadow-only rail-safe process listing override. */
+  listRailSafeProcesses?: (pattern: string) => RailSafeProcessListing;
+  /** Resolves pgrep's PID-only output to a command line; defaults to `ps -p <pid> -o command=`. */
+  readRailSafeProcessCommand?: (pid: string) => string | null;
+  /** Shadow-only release-run detector override. */
+  isReleaseRunActive?: () => boolean;
   /** 릴리스 기준 URL 주입 — 환경변수와 설치 출처보다 우선한다. */
   releaseBase?: string;
 }
@@ -740,10 +820,14 @@ export async function runReleaseUpdate(options: ReleaseUpdateOptions = {}, deps:
   }
   let previous = '';
   let previousBuild = '';
+  let previousCommit = '';
   let replacedDev: { from: string; to: string } | null = null;
   try {
     const metadata: unknown = JSON.parse(readFileSync(join(prefix, 'install.json'), 'utf8'));
     previousBuild = installedBuild(metadata);
+    if (typeof metadata === 'object' && metadata !== null && typeof (metadata as { commit?: unknown }).commit === 'string') {
+      previousCommit = (metadata as { commit: string }).commit;
+    }
     if (typeof metadata === 'object' && metadata !== null && (metadata as { channel?: unknown }).channel === 'dev') {
       const fromDir = typeof (metadata as { versionDir?: unknown }).versionDir === 'string' ? (metadata as { versionDir: string }).versionDir : '';
       replacedDev = { from: fromDir, to: '' };
@@ -757,6 +841,26 @@ export async function runReleaseUpdate(options: ReleaseUpdateOptions = {}, deps:
     const result = spawnSync(command, args, { cwd, encoding: 'utf8', input, maxBuffer: SPAWN_MAX_BUFFER, env: { ...process.env, ...env, PATH: childPath() } });
     return { status: result.status, stderr: result.error?.message ?? result.stderr ?? '' };
   });
+  let railSafeEntries: Array<{ name: string; mtimeMs: number }> = [];
+  try {
+    railSafeEntries = readdirSync(join(prefix, 'versions'), { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => ({ name: entry.name, mtimeMs: statSync(join(prefix, 'versions', entry.name)).mtimeMs }));
+  } catch { /* shadow observation cannot change the install decision */ }
+  let railSafe: ReturnType<typeof assessRailSafe> = { wouldBlock: false, reasons: [], heldVersions: [], releaseRunActive: false };
+  try {
+    railSafe = assessRailSafe({
+      entries: railSafeEntries,
+      current: previous,
+      daemonSha: previousCommit,
+      keep: options.keep ?? 3,
+      versionsDir: join(prefix, 'versions'),
+      ...(deps.listRailSafeProcesses ? { listProcesses: deps.listRailSafeProcesses } : {}),
+      ...(deps.readRailSafeProcessCommand ? { readProcessCommand: deps.readRailSafeProcessCommand } : {}),
+      ...(deps.isReleaseRunActive ? { isReleaseRunActive: deps.isReleaseRunActive } : {}),
+    });
+  } catch { /* shadow observation cannot change the install decision */ }
+  try { debug.log('self-update.rail-safe', 'shadow', railSafe); } catch { /* shadow observation never changes update decisions */ }
   try {
     const install = run('bash', ['-s', '--', '--no-modify-path', '--prefix', prefix], prefix, installer, envLiteral({ ELANOUS_VERSION: version ?? '', ELANOUS_INSTALL_SOURCE: '', ELANOUS_RELEASE_BASE: base }));
     if (install.status !== 0) return fail(1, `설치 실패: ${install.stderr.trim() || install.status}`);