elanous 0.2.27 → 0.2.29

package/scripts/release-loop/gate-triage-node.ts

@@ -0,0 +1,190 @@
+#!/usr/bin/env bun
+import { readFileSync } from 'node:fs';
+import { debug } from '../../src/debug/log.js';
+import { registerStandaloneLogSink } from '../../src/domains/standalone-log-sink.js';
+import type { GateResult } from './gate-node.js';
+import { emitNodeResult, readGraphContext, type GraphContext } from './node-verdict.js';
+
+/** A shadow recommendation. No value here is a release waiver or a graph edge. */
+export type GateTriageClass = 'unmeasured' | 'load' | 'env' | 'regression' | 'clean' | 'exhausted';
+
+export interface GateTriageEvidence {
+  /** Observed from the Pod/host during this gate; a timeout alone is not proof of load. */
+  highLoad?: boolean;
+  /** Count of the suspected failure IDs reproduced in an isolated run. */
+  isolatedReproductions?: number;
+  /** Exact introduced IDs that actually received an isolated recheck. */
+  isolatedCheckedFailureIds?: string[];
+  /** Timeout shard files that completed an isolated recheck. */
+  isolatedPassedFiles?: string[];
+  /** Exact test IDs independently attributed to the Pod environment. */
+  environmentFailureIds?: string[];
+  /** The last two actual decisions, including their measured identities. */
+  priorDecisions?: Array<{ classification: GateTriageClass; commit: string; failureIds: string[] }>;
+}
+
+export interface GateTriageShadow {
+  classification: GateTriageClass;
+  reason: string;
+  commit: string;
+  introduced: string[];
+  stalledFiles: string[];
+  failureIds: string[];
+  evidence: {
+    highLoad: boolean | null;
+    isolatedReproductions: number | null;
+    isolatedCheckedFailureIds: string[] | null;
+    isolatedPassedFiles: string[] | null;
+    environmentFailureIds: string[] | null;
+    loadFlaky: string[] | null;
+    stalledEnv: Array<{ file: string; local: string }>;
+  };
+  /** Shadow always goes to the existing failure exit. */
+  outcome: 'fail';
+}
+
+function timeoutShape(gate: GateResult): boolean {
+  return gate.stalledShards?.some((shard) => shard.reason === 'timeout' || shard.reason === 'no-output') === true
+    || (gate.loadFlaky?.length ?? 0) > 0;
+}
+
+export function classifyGateShadow(gate: GateResult, evidence: GateTriageEvidence = {}): GateTriageShadow {
+  const stalledFiles = [...new Set((gate.stalledShards ?? []).flatMap((shard) => shard.files))].sort();
+  const failureIds = [...new Set([...gate.introduced, ...stalledFiles, ...gate.stalledEnv.map((item) => item.file)])].sort();
+  let classification: GateTriageClass;
+  let reason: string;
+
+  const unmeasured = gate.stalledShards?.some((shard) => shard.reason !== 'timeout' && shard.reason !== 'no-output') === true;
+  const loadExplainsIntroduced = gate.introduced.every((id) => gate.loadFlaky?.includes(id) === true
+    && evidence.isolatedCheckedFailureIds?.includes(id) === true);
+  const loadExplainsStalled = stalledFiles.every((file) => evidence.isolatedPassedFiles?.includes(file) === true);
+  const noUnexplainedEnvironmentFailure = gate.stalledEnv.length === 0;
+  const envFiles = new Set(gate.stalledEnv.filter((item) => item.local === 'passed').map((item) => item.file));
+  const envExplainsIntroduced = gate.introduced.every((id) => envFiles.has(id.split(' > ', 1)[0]!)
+    && evidence.environmentFailureIds?.includes(id) === true);
+  const envExplainsStalled = stalledFiles.every((file) => envFiles.has(file));
+  const allEnvironmentChecksPassed = gate.stalledEnv.length > 0 && gate.stalledEnv.every((item) => item.local === 'passed');
+  if (unmeasured) {
+    classification = 'unmeasured';
+    reason = 'gate has unfinished or unattributed shard files';
+  } else if ((gate.introduced.length > 0 || stalledFiles.length > 0)
+    && timeoutShape(gate) && loadExplainsIntroduced && loadExplainsStalled && noUnexplainedEnvironmentFailure
+    && evidence.highLoad === true && evidence.isolatedReproductions === 0) {
+    classification = 'load';
+    reason = 'timeout shape under observed load did not reproduce in isolation';
+  } else if (gate.outcome !== 'ok' && allEnvironmentChecksPassed && envExplainsIntroduced && envExplainsStalled) {
+    classification = 'env';
+    reason = 'Pod environment failure passed outside the Pod';
+  } else if (stalledFiles.length || (gate.outcome === 'error' && gate.introduced.length === 0)) {
+    classification = 'unmeasured';
+    reason = stalledFiles.length ? 'timeout-shaped files remain unmeasured' : 'gate errored without a measured regression';
+  } else if (gate.introduced.length > 0 || gate.outcome === 'regression') {
+    classification = 'regression';
+    reason = 'gate measured an introduced regression';
+  } else if (gate.outcome === 'ok') {
+    classification = 'clean';
+    reason = 'gate passed';
+  } else {
+    classification = 'unmeasured';
+    reason = 'gate failure has no measured regression identity';
+  }
+
+  const repeated = failureIds.length > 0 && evidence.priorDecisions?.slice(-2).length === 2
+    && evidence.priorDecisions.slice(-2).every((prior) => prior.classification === classification
+      && prior.commit === gate.commit
+      && JSON.stringify([...prior.failureIds].sort()) === JSON.stringify(failureIds));
+  if (classification !== 'clean' && repeated) {
+    classification = 'exhausted';
+    reason = 'the same class and failure identities already recurred twice';
+  }
+  return { classification, reason, commit: gate.commit, introduced: [...gate.introduced], stalledFiles, failureIds,
+    evidence: { highLoad: evidence.highLoad ?? null, isolatedReproductions: evidence.isolatedReproductions ?? null,
+      isolatedCheckedFailureIds: evidence.isolatedCheckedFailureIds ? [...evidence.isolatedCheckedFailureIds] : null,
+      isolatedPassedFiles: evidence.isolatedPassedFiles ? [...evidence.isolatedPassedFiles] : null,
+      environmentFailureIds: evidence.environmentFailureIds ? [...evidence.environmentFailureIds] : null,
+      loadFlaky: gate.loadFlaky ? [...gate.loadFlaky] : null,
+      stalledEnv: gate.stalledEnv.map((item) => ({ file: item.file, local: item.local })) },
+    outcome: 'fail' };
+}
+
+/** Read only the completed gate output. The graph wiring is a separate change after M3. */
+export function gateTriageShadowFromContext(context: GraphContext, evidence?: GateTriageEvidence): GateTriageShadow {
+  const value = context.outputs.gate;
+  if (!value || typeof value.commit !== 'string' || !Array.isArray(value.introduced)
+    || !value.introduced.every((item) => typeof item === 'string')
+    || !Array.isArray(value.stalledEnv)
+    || !value.stalledEnv.every((item) => item && typeof item === 'object' && typeof item.file === 'string'
+      && ['passed', 'failed', 'timeout'].includes(String(item.local)))
+    || (value.stalledShards !== undefined && (!Array.isArray(value.stalledShards)
+      || !value.stalledShards.every((item) => item && typeof item === 'object' && Array.isArray(item.files)
+        && item.files.every((file: unknown) => typeof file === 'string') && typeof item.reason === 'string')))
+    || (value.loadFlaky !== undefined && (!Array.isArray(value.loadFlaky)
+      || !value.loadFlaky.every((item) => typeof item === 'string')))
+    || !['ok', 'regression', 'error'].includes(String(value.outcome))) {
+    throw new Error('gate output is missing or malformed');
+  }
+  const input = context.input.gateTriageEvidence;
+  const supplied = input && typeof input === 'object' && !Array.isArray(input) ? input as Record<string, unknown> : {};
+  const observed: GateTriageEvidence = evidence ?? {
+    ...(supplied.highLoad === true ? { highLoad: true } : {}),
+    ...(Number.isSafeInteger(supplied.isolatedReproductions) && Number(supplied.isolatedReproductions) >= 0
+      ? { isolatedReproductions: Number(supplied.isolatedReproductions) } : {}),
+    ...(Array.isArray(supplied.isolatedCheckedFailureIds) && supplied.isolatedCheckedFailureIds.every((id) => typeof id === 'string')
+      ? { isolatedCheckedFailureIds: supplied.isolatedCheckedFailureIds as string[] } : {}),
+    ...(Array.isArray(supplied.isolatedPassedFiles) && supplied.isolatedPassedFiles.every((file) => typeof file === 'string')
+      ? { isolatedPassedFiles: supplied.isolatedPassedFiles as string[] } : {}),
+    ...(Array.isArray(supplied.environmentFailureIds) && supplied.environmentFailureIds.every((id) => typeof id === 'string')
+      ? { environmentFailureIds: supplied.environmentFailureIds as string[] } : {}),
+    ...(Array.isArray(supplied.priorDecisions) && supplied.priorDecisions.every((item) => item && typeof item === 'object'
+      && typeof item.classification === 'string' && typeof item.commit === 'string' && Array.isArray(item.failureIds)
+      && item.failureIds.every((id: unknown) => typeof id === 'string'))
+      ? { priorDecisions: supplied.priorDecisions as GateTriageEvidence['priorDecisions'] } : {}),
+  };
+  return classifyGateShadow(value as unknown as GateResult, observed);
+}
+
+export function logGateTriageShadow(result: GateTriageShadow, version: string): void {
+  debug.log('graph.ground', 'gate-triage-shadow', { version, ...result });
+}
+
+/** A saved verdict has fewer fields than the live gate output. Keep the absent evidence absent. */
+export function gateTriageShadowFromSavedVerdict(value: unknown): { version: string; result: GateTriageShadow } {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('invalid saved gate verdict');
+  const saved = value as Record<string, unknown>;
+  if (typeof saved.version !== 'string' || typeof saved.commit !== 'string'
+    || !['ok', 'regression', 'error'].includes(String(saved.outcome))
+    || !Array.isArray(saved.introduced) || !saved.introduced.every((id) => typeof id === 'string')
+    || (saved.loadFlaky !== undefined && (!Array.isArray(saved.loadFlaky)
+      || !saved.loadFlaky.every((id) => typeof id === 'string')))) throw new Error('invalid saved gate verdict');
+  const gate: GateResult = { outcome: saved.outcome as GateResult['outcome'], commit: saved.commit,
+    introduced: saved.introduced, preexisting: 0, fixed: null, knownEnv: 0, knownEnvCleared: [],
+    stalledEnv: (saved.stalledEnv ?? []) as GateResult['stalledEnv'], rcNonzeroNoFailures: [], durationMs: 0,
+    ...(saved.stalledShards !== undefined ? { stalledShards: saved.stalledShards as GateResult['stalledShards'] } : {}),
+    ...(saved.loadFlaky !== undefined ? { loadFlaky: saved.loadFlaky as string[] } : {}) };
+  const context: GraphContext = { input: { version: saved.version, previousVersion: '0.0.0' },
+    outputs: { gate: gate as unknown as Record<string, unknown> } };
+  return { version: saved.version, result: gateTriageShadowFromContext(context) };
+}
+
+if (import.meta.main) {
+  await registerStandaloneLogSink('release-loop');
+  try {
+    const savedPath = process.argv[2] === '--gate-verdict' ? process.argv[3] : undefined;
+    if (process.argv[2] && !savedPath) throw new Error('usage: gate-triage-node.ts [--gate-verdict <path>]');
+    const { version, result } = savedPath
+      ? gateTriageShadowFromSavedVerdict(JSON.parse(readFileSync(savedPath, 'utf8')))
+      : (() => { const context = readGraphContext(); return { version: context.input.version,
+        result: gateTriageShadowFromContext(context) }; })();
+    logGateTriageShadow(result, version);
+    emitNodeResult({ ...result, verdict: 'fail', summary: `gate-triage shadow: ${result.classification} — ${result.reason}` });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    const result: GateTriageShadow = { outcome: 'fail', classification: 'unmeasured', reason,
+      commit: 'unknown', introduced: [], stalledFiles: [], failureIds: [],
+      evidence: { highLoad: null, isolatedReproductions: null, isolatedCheckedFailureIds: null,
+        isolatedPassedFiles: null, environmentFailureIds: null, loadFlaky: null, stalledEnv: [] } };
+    logGateTriageShadow(result, 'unknown');
+    emitNodeResult({ ...result, verdict: 'fail', summary: `gate-triage shadow: ${reason}` });
+  }
+  process.exitCode = 1;
+}

package/scripts/release-loop/node-verdict.ts

@@ -7,6 +7,7 @@ import { debug } from '../../src/debug/log.js';
 export type NodeOutcome = 'ok' | 'fail' | 'error';
 export type NodeVerdict = 'pass' | 'flaky' | 'fail';
 export interface GraphContext {
+  nodeId?: string;
   input: { version: string; previousVersion: string; [key: string]: unknown };
   outputs: Record<string, Record<string, unknown>>;
 }
@@ -20,7 +21,8 @@ export function readGraphContext(env: NodeJS.ProcessEnv = process.env): GraphCon
   const input = context.input as Record<string, unknown> | undefined;
   if (!input || typeof input.version !== 'string' || !isReleaseVersion(input.version)
     || typeof input.previousVersion !== 'string' || !/^\d+\.\d+\.\d+$/.test(input.previousVersion)) throw new Error('version and previousVersion required');
-  return { input: input as GraphContext['input'], outputs: context.outputs && typeof context.outputs === 'object' ? context.outputs as GraphContext['outputs'] : {} };
+  return { ...(typeof context.nodeId === 'string' ? { nodeId: context.nodeId } : {}),
+    input: input as GraphContext['input'], outputs: context.outputs && typeof context.outputs === 'object' ? context.outputs as GraphContext['outputs'] : {} };
 }
 
 export function nodeOutput(context: GraphContext, node: string, key: string): string {

package/scripts/release-loop/publish-node.ts

@@ -48,6 +48,9 @@ export function waitForAssets(run: CommandRunner, repo: string, tag: string, nam
 export function runPublish(run: CommandRunner = runCommand, prodFreezeRoot?: string,
   clock: { now: () => number; sleep: (ms: number) => void } = { now: Date.now, sleep: Bun.sleepSync }) {
   const context = readGraphContext();
+  // A resumed graph once invoked this irreversible node at npm-publish, docs-land, and failed.
+  // The runner's context is the authority: only the publish visit may publish.
+  if (context.nodeId !== 'publish') throw new Error(`publish node context mismatch: expected publish, got ${context.nodeId ?? 'missing'}`);
   const version = context.input.version;
   // A measured automatic decision or the existing human approval must authorize publication.
   const auto = context.outputs['auto-approve'];

package/scripts/release-loop/spawn-lane.ts

@@ -0,0 +1,68 @@
+import { planShards } from './shard-plan';
+
+/**
+ * Gate tests that exercise a real process or PTY. Keep them in their own Pod
+ * shards so an external CLI/terminal stall cannot consume an ordinary shard's
+ * deadline. These are file paths at the cut commit, not test title patterns.
+ *
+ * 0.2.29 (2026-10-15): these files from the failed gate attempts launch a
+ * real child. Add a file only after checking its test body, not merely because
+ * its name mentions a process.
+ */
+export const GATE_SPAWN_LANE_FILES = [
+  'scripts/lib/tui-runshell-group-e2e.test.ts',
+  'scripts/lib/tui-streaming-e2e.test.ts',
+  'src/agent-mission/doc-guided-install.test.ts',
+  'src/dashboard/first-screen-band-wiring.test.ts',
+  'src/git-fs/spawn-discipline.test.ts',
+  'src/self-implement/run-ledger.test.ts',
+  'src/video-pipeline/recipes/reframe.test.ts',
+  'test/ch5730-watch-delivery.test.ts',
+  'test/cli-dev-command.test.ts',
+  'test/preview-terminal.test.ts',
+] as const;
+
+const SPAWN_FILES = new Set<string>(GATE_SPAWN_LANE_FILES);
+
+export const GATE_SPAWN_LANE_SHARDS = 3;
+
+export function isGateSpawnLaneFile(file: string): boolean {
+  return SPAWN_FILES.has(file);
+}
+
+/** Every assigned test file is returned exactly once, including a partial gate. */
+export function partitionGateSpawnLane(files: readonly string[]): { regular: string[]; spawn: string[] } {
+  const regular: string[] = [];
+  const spawn: string[] = [];
+  const seen = new Set<string>();
+  for (const file of files) {
+    if (seen.has(file)) throw new Error(`duplicate gate test file: ${file}`);
+    seen.add(file);
+    (isGateSpawnLaneFile(file) ? spawn : regular).push(file);
+  }
+  return { regular, spawn };
+}
+
+/** Reserve at most three of the configured shards for real process tests.
+ * Keeping those files out of ordinary shards preserves coverage and leaves
+ * the total shard count unchanged when enough regular files exist. */
+export function planGateSpawnSeparatedShards(files: readonly string[], durations: Map<string, number>, shardCount: number): {
+  shards: Array<{ files: string[]; plannedSeconds: number }>;
+  spawnFiles: string[];
+  spawnShardCount: number;
+} {
+  const { regular, spawn } = partitionGateSpawnLane(files);
+  if (regular.length && spawn.length && shardCount < 2) {
+    throw new Error('gate spawn lane needs at least two shards when regular and spawn tests coexist');
+  }
+  const spawnShardCount = Math.min(GATE_SPAWN_LANE_SHARDS, spawn.length, shardCount - (regular.length ? 1 : 0));
+  const regularCount = regular.length ? shardCount - spawnShardCount : 0;
+  return {
+    shards: [
+      ...(regular.length ? planShards(regular, durations, regularCount) : []),
+      ...(spawn.length ? planShards(spawn, durations, spawnShardCount) : []),
+    ],
+    spawnFiles: spawn,
+    spawnShardCount,
+  };
+}

package/scripts/release-loop/tui-node-checks.ts

@@ -11,6 +11,9 @@ export interface TuiScreens {
 export interface TuiCheck { id: string; pass: boolean; detail: string }
 
 const ERROR_TEXT = /\b(TypeError|ReferenceError|SyntaxError|Unhandled|panic|Segmentation fault)\b|Error: /;
+// The startup band can say "Commands — /help lists every command" (#26954).
+// Only the modal's title proves that the help overlay itself remains on screen.
+const HELP_MODAL_TITLE = 'Dashboard help';
 
 export function tuiChecks(s: TuiScreens, readyLimitMs = 60_000): TuiCheck[] {
   const all = [s.first, s.help, s.afterEsc].join('\n');
@@ -18,12 +21,35 @@ export function tuiChecks(s: TuiScreens, readyLimitMs = 60_000): TuiCheck[] {
     { id: 'boot', pass: s.readyMs !== null && s.readyMs <= readyLimitMs, detail: s.readyMs === null ? 'never ready' : `ready in ${s.readyMs}ms` },
     { id: 'prompt', pass: s.first.includes('❯'), detail: 'input line (❯) on the first screen' },
     { id: 'status-bar', pass: /│.*ctx \d+/.test(s.first), detail: 'status bar with model and ctx' },
-    { id: 'help-opens', pass: s.help.includes('help') && s.help.includes('Commands') && s.help.includes('/help'), detail: '/help shows the help overlay' },
-    { id: 'help-closes', pass: !s.afterEsc.includes('Commands') && s.afterEsc.includes('❯'), detail: 'Esc closes the overlay' },
+    { id: 'help-opens', pass: s.help.includes(HELP_MODAL_TITLE) && s.help.includes('Commands') && s.help.includes('/help'), detail: '/help shows the help overlay' },
+    { id: 'help-closes', pass: !s.afterEsc.includes(HELP_MODAL_TITLE) && s.afterEsc.includes('❯'), detail: 'Esc closes the overlay' },
     { id: 'no-error-text', pass: !ERROR_TEXT.test(all), detail: 'no error text on any screen' },
   ];
 }
 
+export interface ExecutedTuiCheck { outcome: 'ok' | 'fail' | 'unmeasured'; detail: string }
+
+/** Run the screen-based TUI node, not `--help`: the subprocess boots a PTY, captures first/help/Esc screens and judges them. */
+export async function executeTuiNodeCheck(commit: string, repo: string,
+  command: (cmd: string, args: string[], cwd: string, limitMs?: number) => Promise<{ rc: number; output: string }>): Promise<ExecutedTuiCheck> {
+  const run = await command('bun', ['scripts/release-loop/tui-sim-node.ts', '--commit', commit, '--json'], repo, 300_000);
+  const line = run.output.split(/\r?\n/).find((text) => text.trim().startsWith('{'));
+  let value: Record<string, unknown>;
+  try { value = JSON.parse(line ?? '') as Record<string, unknown>; }
+  catch { return { outcome: 'unmeasured', detail: `TUI screen result missing (rc=${run.rc})` }; }
+  if (run.rc === 0 && reusableTui(withTuiOutcome(run.rc, value), commit))
+    return { outcome: 'ok', detail: `TUI screens: ${value.verdict} · 6 checks` };
+  const ids = ['boot', 'prompt', 'status-bar', 'help-opens', 'help-closes', 'no-error-text'];
+  const measuredFailure = run.rc === 1 && value.commit === commit && value.verdict === 'fail' && value.attempts === 2
+    && Array.isArray(value.checks) && value.checks.length === ids.length
+    && value.checks.every((check: unknown, i: number) => !!check && typeof check === 'object'
+      && (check as TuiCheck).id === ids[i] && typeof (check as TuiCheck).pass === 'boolean'
+      && typeof (check as TuiCheck).detail === 'string')
+    && value.checks.some((check: TuiCheck) => !check.pass);
+  const failed = measuredFailure ? (value.checks as TuiCheck[]).filter((check) => !check.pass).map((check) => check.id) : [];
+  return { outcome: measuredFailure ? 'fail' : 'unmeasured', detail: `TUI screens: ${failed.join(', ') || String(value.verdict)} (rc=${run.rc})` };
+}
+
 export function tuiVerdict(checks: readonly TuiCheck[]): 'pass' | 'fail' {
   return checks.every((c) => c.pass) ? 'pass' : 'fail';
 }

package/scripts/release-loop/version-node.ts

@@ -20,6 +20,41 @@ export function nextDevVersion(version: string): string {
   return `${match[1]}.${match[2]}.${BigInt(match[3]!) + 1n}-dev.0`;
 }
 
+/** Is main carrying the published release immediately before this cut (patch, minor, or major boundary)? */
+function previousPublishedLine(version: string, current: string): string | null {
+  const target = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(baseVersion(version));
+  const carried = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-dev\.(0|[1-9]\d*))?$/.exec(current);
+  if (!target || !carried) return null;
+  const [major, minor, patch] = [BigInt(target[1]!), BigInt(target[2]!), BigInt(target[3]!)];
+  const [priorMajor, priorMinor, priorPatch] = [BigInt(carried[1]!), BigInt(carried[2]!), BigInt(carried[3]!)];
+  const nextPatch = priorMajor === major && priorMinor === minor && priorPatch + 1n === patch;
+  const nextMinor = priorMajor === major && priorMinor + 1n === minor && patch === 0n;
+  const nextMajor = priorMajor + 1n === major && minor === 0n && patch === 0n;
+  return nextPatch || nextMinor || nextMajor ? `${priorMajor}.${priorMinor}.${priorPatch}` : null;
+}
+
+function compareVersionParts(left: readonly bigint[], right: readonly bigint[]): number {
+  for (let index = 0; index < 3; index++) {
+    if (left[index] !== right[index]) return left[index]! < right[index]! ? -1 : 1;
+  }
+  return 0;
+}
+
+/** At a minor/major boundary, the carried line must be the latest published stable tag before the cut. */
+function latestPublishedStableBefore(repo: string, version: string): string | null {
+  const target = baseVersion(version).split('.').map(BigInt);
+  let latest: { version: string; parts: bigint[] } | null = null;
+  const tags = git(repo, 'ls-remote', '--tags', '--refs', 'origin', 'refs/tags/v*');
+  for (const line of tags.split('\n')) {
+    const match = /\brefs\/tags\/v((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))$/.exec(line);
+    if (!match) continue;
+    const parts = match[1]!.split('.').map(BigInt);
+    if (compareVersionParts(parts, target) >= 0) continue;
+    if (!latest || compareVersionParts(parts, latest.parts) > 0) latest = { version: match[1]!, parts };
+  }
+  return latest?.version ?? null;
+}
+
 function run(command: string, args: string[], cwd: string): string {
   const result = spawnSync(command, args, { cwd, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
   if (result.status !== 0 || result.error) {
@@ -120,13 +155,32 @@ function currentFreeze(): LandingFreeze | null {
   return readLandingFreeze(prod) ?? (root === prod ? null : readLandingFreeze(root));
 }
 
+/**
+ * RELEASE-DEVBUMP-ALWAYS (대표 10-14 07:0x): main still carries the previous line (<previous> or <previous>-dev.N)
+ * while that release is already published (tag v<previous> advertised) — its post-publish dev bump was
+ * stranded by an earlier failed run. Land the stranded dev bump (to <version>-dev.0) so this release cuts
+ * from its own -dev line. Returns false without touching anything when the carried version is not the
+ * immediately previous line or that line is not published yet.
+ */
+function strandedDevBumpHealed(repo: string, version: string, current: string, deps: BranchCutDeps): boolean {
+  const previous = previousPublishedLine(version, current);
+  if (previous === null) return false;
+  const tag = git(repo, 'ls-remote', '--tags', 'origin', `refs/tags/v${previous}`);
+  if (!tag.trim()) return false;
+  const devBump = `${baseVersion(version)}-dev.0`;
+  if (devBump !== nextDevVersion(previous) && latestPublishedStableBefore(repo, version) !== previous) return false;
+  landing(repo, 'dev-bump', previous, undefined, undefined, deps.forceFreeze === true, true, devBump);
+  debug.log('release-loop.version-dev-bump', 'self-healed', { version, mainVersion: current, devBump, published: previous });
+  return true;
+}
+
 /**
  * RELEASE-BRANCH (대표 10-06 20:0x «0.2.18부터 브랜치 방식»): the release commit lives on `release/<v>`, never on main.
  * An existing branch is reused as is (a resumed run, or a branch a repair appended to) — its tip is the release commit.
  * Otherwise the branch is cut from origin/main and the version bump is committed on it; main keeps its -dev.N version
  * until the post-publish dev bump.
  */
-export function cutReleaseBranchForRun(repo: string, version: string, deps: BranchCutDeps = {}): Output {
+export function cutReleaseBranchForRun(repo: string, version: string, deps: BranchCutDeps = {}, selfHealed = false): Output {
   if (!isReleaseVersion(version)) throw new Error(`invalid release version: ${version}`);
   // The run does not need a freeze, but one that is on is the emergency stop: neither a new nor a reused cut passes it.
   const frozen = (deps.freeze ?? currentFreeze)();
@@ -160,7 +214,11 @@ export function cutReleaseBranchForRun(repo: string, version: string, deps: Bran
   const current = versionAt(repo, base);
   const stable = baseVersion(version);
   const devOfStable = new RegExp(`^${stable.replaceAll('.', '\\.')}-dev\\.(0|[1-9][0-9]*)$`);
-  if (current !== version && !devOfStable.test(current)) throw new Error(`origin/main version ${current} is not ${stable}-dev.N (release ${version})`);
+  if (current !== version && !devOfStable.test(current)) {
+    // RELEASE-DEVBUMP-ALWAYS: self-heal once — a stranded previous dev bump never strands this release's cut too.
+    if (!selfHealed && strandedDevBumpHealed(repo, version, current, deps)) return cutReleaseBranchForRun(repo, version, deps, true);
+    throw new Error(`origin/main version ${current} is not ${stable}-dev.N (release ${version})`);
+  }
   const temp = mkdtempSync(join(tmpdir(), 'release-branch-cut-'));
   const worktree = join(temp, 'tree');
   let added = false;
@@ -189,14 +247,14 @@ export function cutReleaseBranchForRun(repo: string, version: string, deps: Bran
   }
 }
 
-function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string, cutCommit?: string, forceFreeze = false, branchCut = false): Output {
+function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string, cutCommit?: string, forceFreeze = false, branchCut = false, devTarget?: string): Output {
   if (kind === 'release' && branchCut && cutCommit === undefined) return cutReleaseBranchForRun(repo, releaseVersion, { forceFreeze });
   if (kind === 'dev-bump' && prereleaseKind(releaseVersion) !== null) {
     // A prerelease (rehearsal) never moves main: the next stable release still owns this -dev line.
     debug.log('release-loop.version-dev-bump', 'skipped', { version: releaseVersion, reason: 'prerelease' });
     return { outcome: 'ok', kind, version: releaseVersion, commit: null, pr: null, skipped: 'prerelease' };
   }
-  const target = kind === 'release' ? releaseVersion : nextDevVersion(releaseVersion);
+  const target = kind === 'release' ? releaseVersion : devTarget ?? nextDevVersion(releaseVersion);
   // With the release on its branch, main still carries <v>-dev.N when the dev bump runs.
   const source = kind === 'release' ? `${releaseVersion}-dev.N` : branchCut ? `${releaseVersion}-dev.N` : releaseVersion;
   fetchMain(repo);

package/scripts/skills/public-check.ts

@@ -17,7 +17,9 @@ export interface PublicCheckReport {
   readonly ok: boolean;
 }
 
-const PERSONAL_OR_INTERNAL = /\/Users\/|~\/source(?:\/|\b)|\b(?:INTERNAL_ONLY|ELANOUS_INTERNAL|PRIVATE_INTERNAL|internal-only)\b|@internal\b|내부\s*전용/iu;
+// 개인 경로(`/Users/`·`~/source`)는 대소문자를 가리고, 내부 표지는 기존처럼 `iu`.
+const PERSONAL_PATH = /\/Users\/|~\/source(?:\/|\b)/u;
+const INTERNAL_MARKER = /\b(?:INTERNAL_ONLY|ELANOUS_INTERNAL|PRIVATE_INTERNAL|internal-only)\b|@internal\b|내부\s*전용/iu;
 const EXECUTABLE = /\.(?:ts|tsx|js|mjs|cjs|py|sh|bash)$/iu;
 const ENTRY_DIR = /^(?:scripts|src|bin)\//u;
 const NON_ENTRY = /(?:\.d\.ts|\.(?:test|spec)\.[^.]+)$/iu;
@@ -165,7 +167,8 @@ export function checkPublicSkills(root: string, boundary: SkillBoundaryReport =
       const bytes = readFileSync(file);
       if (bytes.includes(0)) continue;
       try {
-        if (PERSONAL_OR_INTERNAL.test(new TextDecoder('utf-8', { fatal: true }).decode(bytes))) matches.push(relative(root, file));
+        const decoded = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        if (PERSONAL_PATH.test(decoded) || INTERNAL_MARKER.test(decoded)) matches.push(relative(root, file));
       } catch {
         // Binary assets are not text; extensionless and dotfiles are checked when decodable.
       }