elanous 0.2.25 → 0.2.28

package/src/domains/morning-report.ts

@@ -22,6 +22,8 @@ export interface MorningReportOpts {
   heatmapImageUrl?: string;
   /** S3 상세 리포트 업로드 여부(기본 true). 테스트는 false 로 부작용 차단. */
   upload?: boolean;
+  /** 시장서사 LLM model 명시(A/B). 미지정이면 지금과 같은 기본 provider 경로(providerFor(cfg)). */
+  model?: string;
 }
 
 /** 밤사이 소스를 종합한 아침 에센셜(텔레그램) 조립. 상세는 S3 링크로. */
@@ -38,7 +40,7 @@ export async function composeMorningReport(now: Date = new Date(), opts: Morning
     catch { uploaded = null; }
   }
 
-  const narrative = opts.narrate ? await synthesizeEssentialBrief(md) : '';
+  const narrative = opts.narrate ? await synthesizeEssentialBrief(md, { model: opts.model }) : '';
 
   // 결론-우선 상단 블록(매력도 Δ · 섹터순환 · 캡스톤) — PWA 대시보드 데이터 재사용. fail-soft.
   let heatmap = null, capstone = null;

package/src/domains/release-tool.ts

@@ -21,12 +21,15 @@ export const RELEASE_STATUS_SPEC: LLMToolSpec = {
     + 'topic=cell: id 칸 하나의 상태·근거와 살핀 판.\n'
     + 'topic=schedule: 발행 이후 판의 컷·착지·발행·동결 일정.\n'
     + 'topic=ops: 도는 런·발행·늦은 스케줄·자리·열린 결정의 출처 있는 개관.\n'
-    + 'topic 과 action 을 동시에 쓰지 않는다 — 둘 중 하나만: topic 은 읽을 대상, action 은 짧은 요약.\n'
+    + 'topic 과 action 을 동시에 쓰면 topic 을 우선하고 action 은 무시한다. topic 은 읽을 대상, action 은 단독 조회의 짧은 요약.\n'
+    + 'topic=features 에서는 owner·status 로 칸을 필터링할 수 있다.\n'
     + '발행·버전·피처·체크리스트·칸·컷·일정·운영 상태 질문은 Grep·ListDir·파일 검색보다 이 도구를 먼저 부른다 — 그 답은 파일이 아니라 원장에 있다.',
   parameters: { type: 'object', properties: {
     version: { type: 'string', description: '조회할 판. 생략하면 개발 판과 다음 판.' },
     topic: { type: 'string', enum: ['status', 'features', 'cell', 'schedule', 'ops'], description: '읽을 대상(기본 status).' },
     action: { type: 'string', enum: ['schedule', 'blocked', 'landed'], description: '짧은 읽기 요약: 다음 컷 일정·막힌 칸·최근 24시간 병합 PR.' },
+    owner: { type: 'string', description: 'topic=features 때 담당 읽기 필터.' },
+    status: { type: 'string', description: 'topic=features 때 상태 읽기 필터.' },
     id: { type: 'string', description: 'topic=cell 때 찾을 칸 id(필수).' },
   }, required: [] },
 };
@@ -122,10 +125,23 @@ function cellView(item: ChecklistItem) {
 export function dispatchReleaseStatus(args: Record<string, unknown>, deps: ReleaseToolDeps = {}): { text: string; structured: Record<string, unknown> } {
   const topic = args.topic === undefined ? 'status' : args.topic;
   if (typeof topic !== 'string' || !['status', 'features', 'cell', 'schedule', 'ops'].includes(topic)) throw new Error('topic 은 status, features, cell, schedule, ops 중 하나');
-  if (args.topic !== undefined && args.action !== undefined) {
-    throw new Error(`topic 과 action 을 동시에 보낼 수 없습니다 — 둘 중 하나만: topic=${topic} 는 읽을 대상, action 은 짧은 요약(schedule·blocked·landed)`);
-  }
+  const ignoredAction = args.topic !== undefined && args.action !== undefined ? args.action : undefined;
+  const withIgnoredAction = (result: { text: string; structured: Record<string, unknown> }) => ignoredAction === undefined
+    ? result
+    : { ...result, text: `action=${String(ignoredAction)} 은 무시됨 — topic 과 같이 못 쓴다\n${result.text}` };
   const requested = args.version;
+  if (topic === 'features') {
+    for (const key of ['owner', 'status'] as const) {
+      if (args[key] !== undefined && (typeof args[key] !== 'string' || !args[key].trim())) throw new Error(`${key} 값이 필요합니다`);
+    }
+  }
+  const filters = topic === 'features' ? {
+    ...(typeof args.owner === 'string' ? { owner: args.owner } : {}),
+    ...(typeof args.status === 'string' ? { status: args.status } : {}),
+  } : {};
+  const hasFeatureFilters = Object.keys(filters).length > 0;
+  const featureItemMatches = (item: ChecklistItem) =>
+    (!('owner' in filters) || item.owner === filters.owner) && (!('status' in filters) || item.status === filters.status);
   if (requested !== undefined && (typeof requested !== 'string' || !requested.trim())) throw new Error('판 이름이 필요합니다');
   const checklist = deps.checklist ?? listChecklist;
   if (topic === 'ops') {
@@ -133,10 +149,10 @@ export function dispatchReleaseStatus(args: Record<string, unknown>, deps: Relea
     const kinds: ContextFact['kind'][] = ['run', 'release', 'schedule-late', 'seat', 'decision'];
     const facts = answer.facts.filter(fact => kinds.includes(fact.kind));
     debug.log('release.tool', 'status', { action: 'status', topic, version: requested ?? null });
-    return { text: facts.length ? facts.map(fact => JSON.stringify(fact)).join('\n') : '운영 개관: 관측된 사실 없음', structured: { facts } };
+    return withIgnoredAction({ text: facts.length ? facts.map(fact => JSON.stringify(fact)).join('\n') : '운영 개관: 관측된 사실 없음', structured: { facts } });
   }
   const dev = checklistDevVersion(deps.devVersion?.() ?? devVersion());
-  if (args.action !== undefined) {
+  if (ignoredAction === undefined && args.action !== undefined) {
     const action = args.action;
     if (typeof action !== 'string' || !['schedule', 'blocked', 'landed'].includes(action)) {
       throw new Error('action 은 schedule, blocked, landed 중 하나여야 합니다');
@@ -178,12 +194,13 @@ export function dispatchReleaseStatus(args: Record<string, unknown>, deps: Relea
       const target = (requested as string | undefined) ?? dev;
       validateVersion(target);
       const data = checklist(target);
-      const counts = summarizeChecklist(data);
-      const items = data.items.slice(0, 60).map(({ id, title, status, owner, priority }) =>
+      const matchingItems = data.items.filter(featureItemMatches);
+      const counts = hasFeatureFilters ? summarizeChecklist({ ...data, items: matchingItems }) : summarizeChecklist(data);
+      const items = matchingItems.slice(0, 60).map(({ id, title, status, owner, priority }) =>
         ({ id, title: firstLine(title), status, owner: owner ?? null, priority: priority ?? null }));
-      const total = data.items.length;
+      const total = matchingItems.length;
       result = { text: `${target} 판 피처 ${total}칸 · 초록 ${counts.green} · 노랑 ${counts.yellow} · 빨강 ${counts.red} · 끝 ${counts.done}\n${items.map(item => `${item.id} ${item.title} · ${item.status} · ${item.owner ?? '미배정'}`).join('\n')}${total > 60 ? `\n앞 60칸만 표시(전체 ${total}칸)` : ''}`,
-        structured: { version: target, items, counts: { green: counts.green, yellow: counts.yellow, red: counts.red, done: counts.done }, total, truncated: total > 60 } };
+        structured: { version: target, items, counts: { green: counts.green, yellow: counts.yellow, red: counts.red, done: counts.done }, total, truncated: total > 60, ...(hasFeatureFilters ? { filters } : {}) } };
     } else if (topic === 'cell') {
       const id = requiredString(args, 'id');
       const searched = requested ? [requested as string] : [...new Set([dev, nextVersion(dev), checklist(dev).released].filter(Boolean))];
@@ -208,7 +225,7 @@ export function dispatchReleaseStatus(args: Record<string, unknown>, deps: Relea
           publishAt: row.publishAt ?? null, freezeFrom: row.freezeFrom ?? null, freezeUntil: row.freezeUntil ?? null })) } };
     }
     debug.log('release.tool', 'status', { action: 'status', topic, version: requested ?? dev });
-    return result;
+    return withIgnoredAction(result);
   }
   const version = requested ? null : dev;
   const versions = requested ? [requested as string] : [version!, nextVersion(version!)];
@@ -253,7 +270,7 @@ export function dispatchReleaseStatus(args: Record<string, unknown>, deps: Relea
     : published.state === 'unreadable' ? `발행 판 ${published.version} · 발행 기록 못 읽음` : '발행 판 모름';
   const structured = { releases: entries, latestRun: latest, published };
   debug.log('release.tool', 'status', { action: 'status', topic, version: versions.join(',') });
-  return { text: `${lines.join('\n\n')}\n${cards.map(formatElanousCard).join('\n')}\n${publishedLine}`, structured };
+  return withIgnoredAction({ text: `${lines.join('\n\n')}\n${cards.map(formatElanousCard).join('\n')}\n${publishedLine}`, structured });
 }
 
 function requiredString(args: Record<string, unknown>, key: string): string {

package/src/domains/surface-events.ts

@@ -169,6 +169,22 @@ export function recordInboundTurn(
   finally { if (ownDb) db.close(); }
 }
 
+export interface SurfaceUtteranceQuery {
+  from: string;
+  to: string;
+  surface?: string;
+}
+
+/** Read every event in a half-open UTC interval without touching recall state. */
+export function querySurfaceUtterances(db: Database, opts: SurfaceUtteranceQuery): SurfaceEventRow[] {
+  const where = ["julianday(e.ts) >= julianday(?)", "julianday(e.ts) < julianday(?)", "e.direction = 'inbound'", "e.kind IN ('utterance', 'qna')"];
+  const params: string[] = [opts.from, opts.to];
+  if (opts.surface) { where.push('e.surface = ?'); params.push(opts.surface); }
+  return db.prepare(
+    `SELECT e.* FROM events e WHERE ${where.join(' AND ')} ORDER BY julianday(e.ts) ASC, e.id ASC`,
+  ).all(...params) as SurfaceEventRow[];
+}
+
 export interface QueryEventsOpts {
   query?: string;             // FTS MATCH (없으면 최근순 전체)
   surface?: string;

package/src/elanous-config-dir.ts

@@ -15,8 +15,8 @@
 // Resolution order:
 //   1. Programmatic override set via `setElanousConfigDir(dir)` (incl.
 //      from the `--config-dir` CLI flag).
-//   2. State-dir via `effectiveInstanceRoot()` (including isolated source trees).
-//   3. `~/.elanous` for the installed daily-driver root.
+//   2. State-dir via `effectiveInstanceRoot()` (explicit --test or parent stamp).
+//   3. `~/.elanous` for both installed and source CLIs without an explicit test root.
 
 import { homedir } from 'node:os';
 import { resolve } from 'node:path';

package/src/fleet/host-doctor.ts

@@ -1,5 +1,7 @@
 import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
+import type { ResourceView } from '../control-plane/ledger.js';
+import type { MachineLedger, MachineFleetIntent } from '../machines/machine-ledger.js';
 
 /**
  * 호스트 닥터 — 첫 조각(FLEET-DOCTOR-1 · 읽기 전용).
@@ -295,6 +297,66 @@ export interface HostDoctorOptions {
   remote?: HostDoctorRemote;
   expected?: HostDoctorExpected;
   now?: () => Date;
+  /** HQ observations: null means the source could not be read; [] means a successful empty reading. */
+  membership?: {
+    intent: MachineLedger | null;
+    machines: readonly ResourceView[] | null;
+    parentHosts: readonly { host?: string; podPool?: string; approvalCapacity?: number }[] | null;
+    intentError?: string;
+    machinesError?: string;
+    parentHostsError?: string;
+  };
+}
+
+function membershipCheck(id: string, status: HostDoctorCheckStatus, observed: string, expected: string): HostDoctorCheckResult {
+  return { id, status, observed, expected, fixKind: 'human', fix: 'compare Nexus machine registration, machines.yaml intent, and taskAgent.parentHost' };
+}
+
+/** Pure HQ comparison. A failed query is null (unmeasured); a successful empty result is a real missing host. */
+export function checkHostMembership(host: string, platform: HostDoctorPlatform | null, membership: NonNullable<HostDoctorOptions['membership']>): HostDoctorCheckResult[] {
+  const intent: MachineFleetIntent | undefined = membership.intent?.machines.find((row) => row.fleet?.sshName === host)?.fleet;
+  const registryExpected = intent ? `live machine ${host} · role ${intent.role}` : `machines.yaml fleet intent for ${host}`;
+  let registry: HostDoctorCheckResult;
+  if (membership.intent === null || membership.machines === null) {
+    registry = membershipCheck('registry.member', 'unmeasured', membership.intent === null
+      ? `intent ledger unavailable (repository checkout required)${membership.intentError ? `: ${membership.intentError}` : ''}`
+      : `Nexus machine query unavailable${membership.machinesError ? `: ${membership.machinesError}` : ''}`, registryExpected);
+  } else if (!intent) {
+    registry = membershipCheck('registry.member', 'fail', 'host absent from fleet intent', registryExpected);
+  } else {
+    // `machine` is the Nexus identity; `name` is a display label. A missing/expired record
+    // is a measured failure even when the remote platform probe did not run.
+    const rows = membership.machines.filter((row) => row.kind === 'machine' && row.machine === host && !row.expired);
+    const row = rows[0];
+    const role = row?.attrs.role;
+    if (!row) registry = membershipCheck('registry.member', 'fail', 'no live Nexus machine record', registryExpected);
+    else if (rows.length !== 1) registry = membershipCheck('registry.member', 'fail', `${rows.length} live machine records`, registryExpected);
+    else if (typeof role !== 'string') registry = membershipCheck('registry.member', 'unmeasured', 'machine attrs.role unavailable', registryExpected);
+    else if (role !== intent.role) registry = membershipCheck('registry.member', 'fail', `machine role ${role}`, registryExpected);
+    // Existence and role have been measured above; a pass still needs the platform probe.
+    else if (platform === null) registry = membershipCheck('registry.member', 'unmeasured', 'host platform unavailable', `intent platform ${intent.platform}`);
+    else if (platform !== intent.platform) registry = membershipCheck('registry.member', 'fail', `host platform ${platform}`, `intent platform ${intent.platform}`);
+    else registry = membershipCheck('registry.member', 'pass', `live machine ${host} · role ${role}`, registryExpected);
+  }
+
+  const parentExpected = intent ? `taskAgent.parentHost ${host} · ${intent.podPool} · cap ${intent.cap}` : `machines.yaml fleet intent for ${host}`;
+  let parent: HostDoctorCheckResult;
+  if (membership.intent === null || membership.parentHosts === null) {
+    parent = membershipCheck('parentHost.member', 'unmeasured', membership.intent === null
+      ? `intent ledger unavailable (repository checkout required)${membership.intentError ? `: ${membership.intentError}` : ''}`
+      : `taskAgent.parentHost unavailable${membership.parentHostsError ? `: ${membership.parentHostsError}` : ''}`, parentExpected);
+  } else if (!intent) {
+    parent = membershipCheck('parentHost.member', 'fail', 'host absent from fleet intent', parentExpected);
+  } else {
+    const rows = membership.parentHosts.filter((row) => row.host === host);
+    const row = rows[0];
+    if (intent.cap === 0) parent = membershipCheck('parentHost.member', rows.length === 0 ? 'pass' : 'fail', rows.length === 0 ? 'disabled in both intent and parent config' : 'disabled host still in parent config', 'host absent from taskAgent.parentHost (cap 0)');
+    else if (!row) parent = membershipCheck('parentHost.member', 'fail', 'host absent from taskAgent.parentHost', parentExpected);
+    else if (rows.length !== 1 || row.podPool !== intent.podPool || row.approvalCapacity !== intent.cap) {
+      parent = membershipCheck('parentHost.member', 'fail', `host entries ${rows.length} · pool ${row.podPool ?? '(missing)'} · cap ${row.approvalCapacity ?? '(missing)'}`, parentExpected);
+    } else parent = membershipCheck('parentHost.member', 'pass', `host ${host} · pool ${row.podPool} · cap ${row.approvalCapacity}`, parentExpected);
+  }
+  return [registry, parent];
 }
 
 /** 원격 `uname -s` ⊕ `/proc/version` 의 microsoft 로 darwin|linux|wsl. 못 재면 null. */
@@ -344,9 +406,14 @@ export function runHostDoctor(options: HostDoctorOptions): HostDoctorReport {
   const platform = reached ? detectHostDoctorPlatform(remote, host) : null;
   const arch = reached ? detectHostDoctorArch(remote, host) : null;
   const specs = HOST_DOCTOR_CHECKS.filter((spec) => spec.roles.includes(role));
-  const checks = reached
+  const remoteChecks = reached
     ? specs.map((spec) => runCheck(spec, { host, remote, role, platform, arch, expected }))
     : specs.map((spec) => unmeasuredBecauseUnreached(spec, { platform, arch, expected }));
+  const checks = [...remoteChecks, ...(role === 'worker' && options.membership ? checkHostMembership(host, platform, options.membership) : [])];
+  const mismatch = checks.filter((check) => (check.id === 'registry.member' || check.id === 'parentHost.member') && check.status === 'fail');
+  if (mismatch.length) debug.log('fleet.doctor', 'membership-mismatch', { host, checks: mismatch.map((check) => ({ id: check.id, observed: check.observed, expected: check.expected })) });
+  const membershipUnmeasured = checks.filter((check) => (check.id === 'registry.member' || check.id === 'parentHost.member') && check.status === 'unmeasured');
+  if (membershipUnmeasured.length) debug.log('fleet.doctor', 'membership-unmeasured', { host, checks: membershipUnmeasured.map((check) => ({ id: check.id, observed: check.observed })) });
   const fail = checks.filter((check) => check.status === 'fail').map((check) => check.id);
   const unmeasured = checks.filter((check) => check.status === 'unmeasured').map((check) => check.id);
   const measuredAt = (options.now ?? (() => new Date()))().toISOString();
@@ -365,9 +432,13 @@ export function runHostDoctor(options: HostDoctorOptions): HostDoctorReport {
   };
 }
 
-/** 사람 출력 한 줄씩 — «✓|✗|→ <id> <한 줄>» 문법(node-setup.sh --check 와 같다). */
+/** 사람 출력 한 줄씩 — 기본은 «✓|✗|→ <id> <한 줄>»(node-setup.sh --check),
+ *  membership 미측정은 눈에 보이는 «⚠ <id> unmeasured: <원인>»을 쓴다. */
 export function formatHostDoctorLines(report: HostDoctorReport): string[] {
   return report.checks.map((check) => {
+    if ((check.id === 'registry.member' || check.id === 'parentHost.member') && check.status === 'unmeasured') {
+      return `⚠ ${check.id} unmeasured: ${check.observed}`;
+    }
     const mark = check.status === 'pass' ? '✓' : check.status === 'fail' ? '✗' : '→';
     const detail = check.status === 'fail' ? `${check.observed} (expected: ${check.expected})` : check.observed;
     return `${mark} ${check.id} ${detail}`;

package/src/github/pr-labels.ts

@@ -3,6 +3,12 @@ export const IDEA_APPROVAL_LIMIT = 10;
 export const IDEA_STALE_DAYS = 7;
 export const STALLED_DRAFT_HOURS = 24;
 export const CLAIM_IDLE_HOURS = 6;
+export const PR_LABEL_NAMES = {
+  running: 'elanous:running',
+  stalled: 'elanous:stalled',
+  superseded: 'elanous:superseded',
+  needsRebase: 'elanous:needs-rebase',
+} as const;
 
 export type PrLabelAxis = 'state' | 'addon' | 'origin' | 'risk';
 export type PrLabelApplier = 'harness' | 'launcher' | 'sweeper' | 'session' | 'human';
@@ -24,14 +30,14 @@ export interface PrLabelDefinition {
 }
 
 export const PR_LABELS = [
-  { name: 'elanous:running', axis: 'state', color: '1D76DB', description: 'Harness run or session is actively handling a draft PR', appliedBy: ['harness', 'session'], sweep: { action: 'mark-stalled', when: 'run-ended' } },
-  { name: 'elanous:stalled', axis: 'state', color: 'D93F0B', description: 'Incomplete draft requiring human attention', appliedBy: ['harness', 'sweeper'], sweep: { action: 'close', afterHours: STALLED_DRAFT_HOURS } },
+  { name: PR_LABEL_NAMES.running, axis: 'state', color: '1D76DB', description: 'Harness run or session is actively handling a draft PR', appliedBy: ['harness', 'session'], sweep: { action: 'mark-stalled', when: 'run-ended' } },
+  { name: PR_LABEL_NAMES.stalled, axis: 'state', color: 'D93F0B', description: 'Incomplete draft requiring human attention', appliedBy: ['harness', 'sweeper'], sweep: { action: 'close', afterHours: STALLED_DRAFT_HOURS } },
   { name: 'elanous:idea-approval', axis: 'state', color: '0E8A16', description: 'Completed, ready PR awaiting human approval', appliedBy: ['launcher'], sweep: { action: 'none' } },
-  { name: 'elanous:superseded', axis: 'state', color: '6A737D', description: 'Another PR has already merged the same work', appliedBy: ['sweeper', 'session'], sweep: { action: 'close' } },
+  { name: PR_LABEL_NAMES.superseded, axis: 'state', color: '6A737D', description: 'Another PR has already merged the same work', appliedBy: ['sweeper', 'session'], sweep: { action: 'close' } },
   { name: 'elanous:keep', axis: 'addon', color: 'BFDADC', description: 'Human requested that the PR be kept open', appliedBy: ['human'], sweep: { action: 'exclude' } },
   { name: 'elanous:release-hold', axis: 'addon', color: 'D4C5F9', description: 'Exclude from release notes until verified in production', appliedBy: ['launcher', 'session', 'human'], sweep: { action: 'none' } },
   { name: 'elanous:idea-stale', axis: 'addon', color: 'FBCA04', description: 'Approval pending beyond the notification threshold', appliedBy: ['sweeper'], sweep: { action: 'notify', afterDays: IDEA_STALE_DAYS } },
-  { name: 'elanous:needs-rebase', axis: 'addon', color: 'E99695', description: 'Approval blocked by conflicts or failing checks', appliedBy: ['sweeper'], sweep: { action: 'block-approval' } },
+  { name: PR_LABEL_NAMES.needsRebase, axis: 'addon', color: 'E99695', description: 'Approval blocked by conflicts or failing checks', appliedBy: ['sweeper', 'session'], sweep: { action: 'block-approval' } },
   { name: 'elanous:bench', axis: 'addon', color: 'C5DEF5', description: 'Bench arm output: never landed or swept; the owner harvests the winner onto main', appliedBy: ['harness'], sweep: { action: 'none' } },
   { name: 'elanous:harvestable', axis: 'addon', color: 'FBCA04', description: 'Pod terminal marked this PR for harvest', appliedBy: ['harness'], sweep: { action: 'close', afterHours: STALLED_DRAFT_HOURS } },
   { name: 'elanous:from-harness', axis: 'origin', color: 'C5DEF5', description: 'Launched from a harness goal', appliedBy: ['harness'], sweep: { action: 'none' } },

package/src/graph-runner/runner.ts

@@ -26,6 +26,44 @@ import type { BashNode, NodeExecContext, WorkflowDeps } from '../workflow-runtim
 import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeWaiver, type AcceptedRegression, type GateExecutorOverride } from '../../scripts/release-loop/resume.js';
 
 type BashRun = WorkflowDeps['runBash'];
+const DEFAULT_BASH_TIMEOUT_MS = 5 * 60 * 1_000;
+// Independent of graph YAML and recipe snapshots: an already-wrong saved binding must fail closed.
+const RELEASE_NODE_COMMANDS: Readonly<Record<string, { recipe: string; command?: string }>> = {
+  'version-release': { recipe: 'cmd:version-release', command: 'bun scripts/release-loop/version-node.ts release --json' },
+  cutoff: { recipe: 'cmd:cutoff', command: 'bun scripts/release-loop/node-verdict.ts cutoff' },
+  'checklist-gate': { recipe: 'cmd:checklist-gate', command: 'bun scripts/release-loop/checklist-gate-node.ts' },
+  prefetch: { recipe: 'cmd:docs', command: 'bun scripts/release-loop/docs-node.ts --json' },
+  gate: { recipe: 'cmd:gate', command: 'bun scripts/release-loop/gate-node.ts --json' },
+  'mac-smoke': { recipe: 'cmd:mac-smoke', command: 'bun scripts/release-loop/mac-smoke-node.ts' },
+  'export-check': { recipe: 'cmd:export-check', command: 'bun scripts/release-loop/export-check-node.ts' },
+  pwa: { recipe: 'cmd:pwa', command: 'bun scripts/release-loop/node-verdict.ts pwa' },
+  prepare: { recipe: 'cmd:prepare', command: 'bun scripts/release-loop/prepare-node.ts' },
+  upgrade: { recipe: 'cmd:upgrade', command: 'bun scripts/release-loop/upgrade-node.ts' },
+  tui: { recipe: 'cmd:docs', command: 'bun scripts/release-loop/docs-node.ts --json' },
+  docs: { recipe: 'cmd:docs', command: 'bun scripts/release-loop/docs-node.ts --json' },
+  'known-issues': { recipe: 'cmd:known-issues', command: 'bun scripts/release-loop/known-issues-node.ts' },
+  'notes-check': { recipe: 'cmd:notes-check', command: 'bun scripts/announce-loop/check-node.ts --json' },
+  'auto-approve': { recipe: 'cmd:auto-approve', command: 'bun scripts/release-loop/auto-approve-node.ts' },
+  'approve-publish': { recipe: 'approval:publish' },
+  publish: { recipe: 'cmd:publish-command', command: 'bun scripts/release-loop/publish-node.ts' },
+  'npm-publish': { recipe: 'cmd:npm-publish', command: 'bun scripts/release-loop/npm-publish-node.ts' },
+  'docs-land': { recipe: 'cmd:docs-land', command: 'bun scripts/release-loop/docs-land-node.ts' },
+  verify: { recipe: 'cmd:verify', command: 'bun scripts/release-loop/verify-node.ts' },
+  'vault-note': { recipe: 'cmd:vault-note', command: 'bun scripts/release-loop/vault-note-node.ts' },
+  'release-story': { recipe: 'cmd:release-story', command: 'bun scripts/release-story/draft.ts --graph' },
+  'ops-upgrade': { recipe: 'cmd:ops-upgrade', command: 'bun scripts/release-loop/ops-upgrade-node.ts' },
+  'version-dev-bump': { recipe: 'cmd:version-dev-bump', command: 'bun scripts/release-loop/version-node.ts dev-bump --json' },
+  done: { recipe: 'none' },
+  failed: { recipe: 'none' },
+};
+
+function assertReleaseCommandBinding(node: GraphNodeSpec, command: string | undefined, terminal: boolean): void {
+  const expected = RELEASE_NODE_COMMANDS[node.nodeId];
+  if (!expected || node.recipe !== expected.recipe || command !== expected.command ||
+    terminal !== (node.nodeId === 'done' || node.nodeId === 'failed')) {
+    throw new Error(`release node dispatch mismatch before execution: ${node.nodeId}`);
+  }
+}
 
 export interface GraphRunState {
   graphId: string;
@@ -53,7 +91,9 @@ export interface GraphRunState {
   graphPath?: string;
   variant?: { overlayId: string; goal: string; plan: GraphVariantPlan };
   parentRunId?: string;
-  unitCalls?: Array<{ node: string; unit: string; version: number; hash: string; childRunId: string; exit: string; steps: number }>;
+  /** The entry chosen by a parent call; absent for existing single-entry runs. */
+  entryNodeId?: string;
+  unitCalls?: Array<{ node: string; unit: string; version: number; hash: string; childRunId: string; exit: string; steps: number; entry?: string }>;
   growth?: GraphGrowth[];
   growthRejections?: Array<{ from: string; outcome: string; reason: string }>;
   growthPark?: { from: string; outcome: string; reason: string; decisionId: string; decisionRef: string; growth: GraphGrowth; command?: GrowthCommand; approval?: string };
@@ -83,7 +123,7 @@ export interface GraphRunOptions {
   releaseGateExecutor?: { executor: string; host?: string };
   useCurrentGraph?: boolean;
   /** Internal unit invocation context, propagated only by runGraph. */
-  unitContext?: { parentRunId: string; ancestors: readonly string[]; remainingSteps: number };
+  unitContext?: { parentRunId: string; ancestors: readonly string[]; remainingSteps: number; entryNodeId?: string };
   /**
    * RELEASE-LEDGER-UNIVERSE — stamp every cmd: child with this run's ledger root (`ELANOUS_STATE_DIR`).
    * Without it a child launched from a non-leader tree (`bun scripts/...` with cwd = that tree) re-resolves
@@ -403,7 +443,14 @@ function nextNode(edges: readonly GraphEdgeSpec[], nodeId: string, exitOutcome:
 
 type ResolvedUnit = { path: string; template: GraphTemplateSpec; hash: string };
 
-function resolveUnit(call: string, callerPath: string): ResolvedUnit {
+export class UnitNotFoundError extends Error {
+  constructor(call: string) {
+    super(`unit not found: ${call}`);
+    this.name = 'UnitNotFoundError';
+  }
+}
+
+export function resolveUnit(call: string, callerPath: string): ResolvedUnit {
   const [id, requested] = call.split('@');
   const repo = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
   const directories = [join(dirname(callerPath), 'units'), dirname(callerPath), join(repo, 'graphs', 'units'), join(getElanousConfigDir(), 'graphs', 'units')];
@@ -423,16 +470,24 @@ function resolveUnit(call: string, callerPath: string): ResolvedUnit {
     if (matches.length > 1) throw new Error(`ambiguous unit: ${call}`);
     if (matches.length) return matches[0]!;
   }
-  throw new Error(`unit not found: ${call}`);
+  throw new UnitNotFoundError(call);
 }
 
-function validateUnitCalls(graph: GraphTemplateSpec, path: string, ancestors: readonly string[] = []): Map<string, ResolvedUnit> {
+export function validateUnitCalls(graph: GraphTemplateSpec, path: string, ancestors: readonly string[] = [], onMissing?: (call: string) => void): Map<string, ResolvedUnit> {
   if (ancestors.includes(graph.graphId)) throw new Error(`unit cycle: ${[...ancestors, graph.graphId].join(' -> ')}`);
   if (ancestors.length > 3) throw new Error('unit nesting exceeds depth 3');
   const result = new Map<string, ResolvedUnit>();
   for (const node of graph.nodes) {
     if (node.kind !== 'subgraph' || node.call === undefined) continue;
-    const unit = resolveUnit(node.call!, path);
+    let unit: ResolvedUnit;
+    try { unit = resolveUnit(node.call!, path); } catch (error) {
+      if (error instanceof UnitNotFoundError && onMissing) { onMissing(node.call!); continue; }
+      throw error;
+    }
+    const selectedEntry = node.callEntry ?? unit.template.entryNode;
+    if (!(unit.template.unit?.entries ?? [unit.template.entryNode]).includes(selectedEntry)) {
+      throw new Error(`unit entry mismatch: ${node.nodeId} -> ${selectedEntry}`);
+    }
     const contract = node.contract!;
     const edge = graph.edges.find(e => e.from === node.nodeId);
     if (!unit.template.unit || contract.inputs.length !== unit.template.unit.inputs.length ||
@@ -444,7 +499,7 @@ function validateUnitCalls(graph: GraphTemplateSpec, path: string, ancestors: re
       debug.log('graph.unit', 'contract-mismatch', { graphId: graph.graphId, nodeId: node.nodeId, call: node.call });
       throw new Error(`unit contract mismatch: ${node.nodeId} -> ${node.call}`);
     }
-    validateUnitCalls(unit.template, unit.path, [...ancestors, graph.graphId]);
+    validateUnitCalls(unit.template, unit.path, [...ancestors, graph.graphId], onMissing);
     result.set(node.nodeId, unit);
   }
   return result;
@@ -491,6 +546,13 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
   if (variant && !variant.ok) throw new Error(`graph variant rejected: ${JSON.stringify(variant.rejections)}`);
   if (variant?.ok) graph = variant.template;
   const units = validateUnitCalls(graph, path, options.unitContext?.ancestors);
+  const unitEntryNode = options.unitContext?.entryNodeId ?? saved?.entryNodeId ?? graph.entryNode;
+  if (saved?.entryNodeId !== undefined && options.unitContext?.entryNodeId !== undefined && saved.entryNodeId !== options.unitContext.entryNodeId) {
+    throw new Error('unit entry changed on resume');
+  }
+  if ((options.unitContext || saved?.entryNodeId !== undefined) && !(graph.unit?.entries ?? [graph.entryNode]).includes(unitEntryNode)) {
+    throw new Error(`unit entry mismatch: ${unitEntryNode}`);
+  }
   const variantSource = variant?.ok ? stringifyYaml({ ...document,
     nodes: graph.nodes.map((node, index) => ({
       ...((document.nodes as Record<string, unknown>[])[index] ?? {}), node_id: node.nodeId, kind: node.kind,
@@ -536,6 +598,14 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     if (!resolved.command && !resolved.prompt && !resolved.approval) throw new Error(`unknown command recipe for ${node.nodeId}: ${node.recipe}`);
   }
   const graphId = safeSegment(graph.graphId);
+  const isReleaseLoop = graphId === 'release-loop';
+  // A copied or saved release graph is still a release graph. Its path cannot grant or revoke
+  // permission to dispatch a command; only the graph identity and this independent table can.
+  const enforceReleaseCommandBindings = isReleaseLoop;
+  if (enforceReleaseCommandBindings) {
+    for (const node of graph.nodes) assertReleaseCommandBinding(node,
+      resolveNodeRecipe(node, recipes, catalogRoles).command?.command, graph.terminalNodes.includes(node.nodeId));
+  }
   if (saved && graphId !== saved.graphId) {
     if (options.fromNodeId && graphMode === 'current') throw new Error('graph or recipes changed since failed run');
     throw new Error(`run identity mismatch: ${saved.graphId}/${saved.runId}`);
@@ -561,7 +631,9 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     : { graphId, runId, startedAt: new Date().toISOString(), ...runnerOwner, status: 'running', path: [], nodes: [], sourceHash: approvalSourceHash,
       graphSnapshot: { graphSha: createHash('sha256').update(variantSource).digest('hex'), recipesSha: createHash('sha256').update(recipeSource).digest('hex') },
       graphPath: resolve(path), ...(variant?.ok ? { variant: { overlayId: variant.overlay.overlayId, ...options.variant! } } : {}),
-      ...(options.input === undefined ? {} : { input: options.input }), executed: 0, dryRun: options.dryRun === true, statePath };
+      ...(options.input === undefined ? {} : { input: options.input }),
+      ...(options.unitContext?.entryNodeId === undefined ? {} : { entryNodeId: options.unitContext.entryNodeId }),
+      executed: 0, dryRun: options.dryRun === true, statePath };
   if (options.resumeRunId && graphMode === 'snapshot' && state.sourceHash && state.sourceHash !== approvalSourceHash) {
     throw new Error('graph snapshot changed since run started');
   }
@@ -593,7 +665,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
         const reported = lastJsonObject(prior.output)?.outcome;
         const next = nextNode(graph.edges, prior.nodeId, prior.ok ? 'ok' : 'fail', typeof reported === 'string' ? reported : undefined);
         if (next !== recorded.nodeId) throw new Error('saved run path does not follow graph edges');
-      } else if (recorded.nodeId !== graph.entryNode) throw new Error('saved run path does not start at entry node');
+      } else if (recorded.nodeId !== unitEntryNode) throw new Error('saved run path does not start at entry node');
       if (i < from && !recorded.ok) throw new Error('cannot preserve a failed predecessor when resuming');
       const approved = resolveNodeRecipe(spec, recipes, catalogRoles).approval;
       if (approved && i >= from) throw new Error('cannot restart across an approval decision');
@@ -735,7 +807,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
   if (options.resumeRunId && !options.fromNodeId) {
     const previousStatus = state.status;
     Object.assign(state, runnerOwner);
-    state.resume = { from: state.pending?.nodeId ?? state.path.at(-1) ?? graph.entryNode, at: new Date().toISOString(), previousStatus, graph: graphMode };
+    state.resume = { from: state.pending?.nodeId ?? state.path.at(-1) ?? unitEntryNode, at: new Date().toISOString(), previousStatus, graph: graphMode };
     persistOwnedRun(state, saved!);
   }
   if (options.resumeRunId) debug.log('graph.runs', 'resume', { graphId, runId, from: state.resume?.from, graph: graphMode });
@@ -750,7 +822,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     : baseLog;
   const visits = new Map<string, number>();
   for (const nodeId of state.path) visits.set(nodeId, (visits.get(nodeId) ?? 0) + 1);
-  let current: string | undefined = options.fromNodeId ?? state.pending?.nodeId ?? state.path.at(-1) ?? graph.entryNode;
+  let current: string | undefined = options.fromNodeId ?? state.pending?.nodeId ?? state.path.at(-1) ?? unitEntryNode;
   if (!options.resumeRunId) {
     mkdirSync(dirname(statePath), { recursive: true });
     if (readdirSync(dirname(statePath)).some((file) => file.startsWith(`${runId}.json.`) && file.endsWith('.decision.json'))) {
@@ -787,6 +859,7 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
     }
     const resolved = resolveNodeRecipe(node, recipes, catalogRoles);
     const command = resolved.command;
+    if (enforceReleaseCommandBindings) assertReleaseCommandBinding(node, command?.command, graph.terminalNodes.includes(current));
     const prompt = resolved.prompt;
     const approval = resolved.approval ? { approval: approvalMessage(resolved.approval.approval, state.input) } : undefined;
     if (resumingPending && (!approval || approval.approval !== state.pending?.message)) {
@@ -836,7 +909,13 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       const redactCredentials = (text: string) => Object.values(credentials).filter(value => value.length > 0)
         .reduce((safe, value) => safe.replaceAll(value, '[REDACTED]'), text);
       const runBash: BashRun = async (body, opts) => {
+        // Hash the actual /bin/bash argv after interpolation. Keep the command text (which may contain
+        // credentials) out of logs, but leave enough to distinguish a replayed publish from npm/docs.
+        const argvSha256 = createHash('sha256').update(JSON.stringify(['/bin/bash', '-c', body])).digest('hex');
+        const fingerprint = { graphId, runId, nodeId: current!, recipe: node.recipe, argvSha256 };
+        debug.log('graph.run', 'command-dispatch', { ...fingerprint, pid: null });
         const execute = options.deps?.runBash ?? realRunBash((pid) => {
+          debug.log('graph.run', 'command-spawn', { ...fingerprint, pid });
           // Publish the child before its start time is known, so a concurrent stop refuses instead of failing
           // the ledger while an untracked node keeps working (REL8b review round 3).
           state.activeNode = { nodeId: current!, pid, pidStartedAt: UNVERIFIED_NODE_START };
@@ -878,7 +957,8 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       env.ELANOUS_GRAPH_DRY_RUN = state.dryRun ? '1' : '0';
       env.ELANOUS_GRAPH_DIR = dirname(resolve(path));
       const ctx = { arguments: '', artifactsDir: dirname(statePath), outputs: {}, resolvedProvider: undefined, resolvedModel: undefined, toolPolicy: {}, env } as NodeExecContext;
-      const result = await executeBashNode({ id: current, type: 'bash', bash: state.dryRun ? command.dry_run_command! : command.command, ...(command.timeout_ms ? { idle_timeout: command.timeout_ms } : {}) } as BashNode, ctx, { runBash } as WorkflowDeps);
+      const result = await executeBashNode({ id: current, type: 'bash', bash: state.dryRun ? command.dry_run_command! : command.command,
+        idle_timeout: command.timeout_ms ?? DEFAULT_BASH_TIMEOUT_MS } as BashNode, ctx, { runBash } as WorkflowDeps);
       output = result.output;
       ok = result.ok;
       exit = code;
@@ -904,7 +984,10 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
       const alreadySpent = state.path.length + (state.unitCalls ?? []).reduce((sum, call) => sum + call.steps, 0);
       const remaining = options.unitContext ? options.unitContext.remainingSteps - alreadySpent : Infinity;
       const childRunId = randomUUID();
-      const info = { graphId, runId, nodeId: current, unit: unit.template.graphId, childRunId, parentRunId: runId };
+      const selectedEntry = node.callEntry ?? unit.template.entryNode;
+      const recordEntry = node.callEntry !== undefined || unit.template.unit?.entries !== undefined;
+      const info = { graphId, runId, nodeId: current, unit: unit.template.graphId, childRunId, parentRunId: runId,
+        ...(recordEntry ? { entry: selectedEntry } : {}) };
       let entered = false;
       try {
         for (const key of contract.inputs) if (!Object.hasOwn(inputs, key)) throw new Error(`unit input missing: ${current}.${key}`);
@@ -916,7 +999,8 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
         const child = await runGraph(unit.path, { runId: childRunId, input: inputs, dryRun: false,
           pinChildUniverse: options.pinChildUniverse,
           unitContext: { parentRunId: runId, ancestors: [...(options.unitContext?.ancestors ?? []), graphId],
-            remainingSteps: Math.min(node.budget!.innerSteps, remaining) }, deps: options.deps });
+            remainingSteps: Math.min(node.budget!.innerSteps, remaining),
+            ...(recordEntry ? { entryNodeId: selectedEntry } : {}) }, deps: options.deps });
         const steps = child.path.length + (child.unitCalls ?? []).reduce((sum, call) => sum + call.steps, 0);
         const childExit = child.status === 'done' || child.status === 'failed' ? child.path.at(-1) : undefined;
         // The last successful record carrying every contracted output is the source;
@@ -930,7 +1014,8 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
         }, undefined) ?? {};
         state.unitCalls ??= [];
         state.unitCalls.push({ node: current, unit: unit.template.graphId, version: unit.template.version,
-          hash: unit.hash, childRunId, exit: childExit ?? child.status, steps });
+          hash: unit.hash, childRunId, exit: childExit ?? child.status, steps,
+          ...(recordEntry ? { entry: selectedEntry } : {}) });
         if (child.status === 'awaiting-approval') throw new Error(`unit cannot pause for approval: ${current}`);
         if (child.status === 'budget-exceeded' || steps > node.budget!.innerSteps || steps > remaining) {
           debug.log('graph.unit', 'budget-exhausted', { ...info, steps, innerSteps: node.budget!.innerSteps });
@@ -1003,6 +1088,10 @@ export async function runGraph(path: string, options: GraphRunOptions = {}): Pro
         ...(approval && state.pending ? { ...(state.pending.decidedBy === undefined ? {} : { decidedBy: state.pending.decidedBy }), decidedAt: state.pending.decidedAt } : {}),
         startedAt: nodeStartedAt, endedAt: nodeEndedAt, seconds });
     }
+    if (isReleaseLoop && graph.terminalNodes.includes(current) && node.recipe === 'none' &&
+      (exit !== null || output !== undefined || error !== undefined || state.nodes.at(-1)?.executed)) {
+      throw new Error(`release terminal received command output: ${current}`);
+    }
     if (approval) {
       delete state.pending;
       delete state.approvalSourceHash;

package/src/harness/harness-clean.ts

@@ -201,6 +201,8 @@ export function planHarnessClean(input: {
   readWorktreeProvenance?: WorktreeProvenanceReader;
   /** provenance reader가 쓰는 git runner. planner 단독 테스트에서는 반드시 명시한다. */
   run?: GitRunner;
+  /** Allow reclaiming unowned worktrees only for merged-clean branches; default remains preservation. */
+  includeUnownedMergedClean?: boolean;
   /** 조회별 소요 시간(밀리초). 키는 `queryStatus` 조회 칸과 같다. 못 잰 칸은 생략한다. */
   queryTimings?: HarnessCleanQueryTimings;
 }): HarnessCleanPlan {
@@ -353,7 +355,15 @@ export function planHarnessClean(input: {
       continue;
     }
     const ladderReason = `assessment=${assessment.disposition}:${assessment.reason}`;
-    if (assessment.disposition !== 'reclaim-safe' || !ownership.recorded) {
+    const includeUnownedMergedClean = input.includeUnownedMergedClean === true
+      && mode === 'merged'
+      && mergedPr.has(branch)
+      && !openPr.has(branch)
+      && assessment.disposition === 'reclaim-safe'
+      && assessment.reason === 'merged-clean'
+      && !ownership.recorded
+      && ownership.status.startsWith('not-recorded:');
+    if (assessment.disposition !== 'reclaim-safe' || (!ownership.recorded && !includeUnownedMergedClean)) {
       preserve.push({ ...base, reason: `${ladderReason}; ownership=${ownership.status}` });
       continue;
     }
@@ -992,6 +1002,7 @@ export function execHarnessClean(opts: {
   mode: HarnessCleanMode;
   dryRun?: boolean;
   force?: boolean;
+  includeUnownedMergedClean?: boolean;
   branchPrefix?: string;
   repo?: string;
   window?: { offset: number; size: number };
@@ -1087,6 +1098,7 @@ export function execHarnessClean(opts: {
     readWorktreeProvenance: opts.readWorktreeProvenance,
     run,
     mode: opts.mode,
+    ...(opts.includeUnownedMergedClean ? { includeUnownedMergedClean: true } : {}),
     queryStatus,
     queryTimings: {
       worktrees: worktreesTimed.ms,
@@ -1286,10 +1298,16 @@ export function renderHarnessCleanReport(
     item.reason.includes('reclaim-safe:merged-no-worktree'),
   ).length;
   const branchOnlyReclaimedCount = res.plan.remove.filter((item) => item.reason.includes('branch-only')).length;
+  const isUnownedMergedClean = (item: CleanPlanItem): boolean =>
+    item.reason.includes('assessment=reclaim-safe:merged-clean') && item.reason.includes('ownership=not-recorded:');
+  const plannedUnownedMergedCleanCount = res.plan.remove.filter(isUnownedMergedClean).length;
+  const unownedMergedCleanCount = (res.dryRun ? res.plan.remove : res.removed).filter(isUnownedMergedClean).length;
+  const unownedMergedCleanSummary = plannedUnownedMergedCleanCount > 0
+    ? ` · 미소유 merged-clean ${res.dryRun ? '제거 예정' : '회수'} ${unownedMergedCleanCount}` : '';
   L.push(
     omittedPreserve > 0
-      ? `규모 매칭 ${matchedTotal} · 제거 계획 ${res.plan.remove.length} · 보존 ${res.plan.preserve.length} · 화면 ${displayedCount} (보존 ${omittedPreserve}개는 생략) · 브랜치만 회수 ${branchOnlyReclaimedCount} · 워크트리 없이 안전 ${mergedNoWorktreeCount}`
-      : `규모 매칭 ${matchedTotal} · 제거 계획 ${res.plan.remove.length} · 보존 ${res.plan.preserve.length} · 화면 ${displayedCount} · 브랜치만 회수 ${branchOnlyReclaimedCount} · 워크트리 없이 안전 ${mergedNoWorktreeCount}`,
+      ? `규모 매칭 ${matchedTotal} · 제거 계획 ${res.plan.remove.length} · 보존 ${res.plan.preserve.length} · 화면 ${displayedCount} (보존 ${omittedPreserve}개는 생략) · 브랜치만 회수 ${branchOnlyReclaimedCount} · 워크트리 없이 안전 ${mergedNoWorktreeCount}${unownedMergedCleanSummary}`
+      : `규모 매칭 ${matchedTotal} · 제거 계획 ${res.plan.remove.length} · 보존 ${res.plan.preserve.length} · 화면 ${displayedCount} · 브랜치만 회수 ${branchOnlyReclaimedCount} · 워크트리 없이 안전 ${mergedNoWorktreeCount}${unownedMergedCleanSummary}`,
   );
   if (res.plan.remove.length === 0) L.push('정리 대상 없음.');
   else {