elanous 0.2.29 → 0.2.31

package/src/cli/pr-land-overlap-evidence.ts

@@ -29,7 +29,7 @@ import { parseReviewResultOutput } from '../task-agent/review-result-capture.js'
 const SHA40 = /^[0-9a-f]{40}$/i;
 
 interface OverlapEvidenceFile {
-  pr: number;
+  pr: number | string;
   head: string;
   /** ①② 경로에서만 필수 — 겹친 착지가 전부 조상(already-ancestor)이면 생략해도 된다. */
   gate?: { head: string; baseCommit: string; passed: boolean };
@@ -174,6 +174,47 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>,
   if (!review) return { ok: false, reason: 'review-no-result', baseTip };
   if (review.pr !== input.pr) return { ok: false, reason: 'review-pr-mismatch', baseTip };
   if (!review.head || review.head.toLowerCase() !== head) return { ok: false, reason: 'review-head-mismatch', baseTip };
+  // The capture parser projects away model provenance; inspect the same last result-shaped line here.
+  let raw: Record<string, unknown> | undefined;
+  for (const line of text.split('\n').reverse()) {
+    if (!line.trim().startsWith('{')) continue;
+    let value: unknown;
+    try { value = JSON.parse(line); } catch { continue; }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) continue;
+    const result = value as Record<string, unknown>;
+    if (result.pr === undefined || !(('verdict' in result && Array.isArray(result.mustFix)) || typeof result.error === 'string')) continue;
+    raw = result;
+    break;
+  }
+  if (raw) {
+    const actualBackend = typeof raw.actualBackend === 'string' ? raw.actualBackend.trim().toLowerCase() : '';
+    const model = typeof raw.model === 'string' ? raw.model.trim().toLowerCase() : '';
+    const route = typeof raw.reviewRoute === 'string' ? raw.reviewRoute.trim().toLowerCase() : '';
+    const respondedProvider = typeof raw.respondedProvider === 'string' ? raw.respondedProvider.trim().toLowerCase() : '';
+    const respondedModel = typeof raw.respondedModel === 'string' ? raw.respondedModel.trim().toLowerCase() : '';
+    if (actualBackend === 'acp:claude' || actualBackend.startsWith('acp:claude/')
+      || model === 'acp:claude' || model.startsWith('acp:claude/')
+      || ((route === 'acp' || route === 'acp-fallback') && typeof raw.fallbackBackend === 'string' && raw.fallbackBackend.trim().toLowerCase() === 'claude')) {
+      return { ok: false, reason: 'review-forbidden-acp-claude', baseTip };
+    }
+    const requested = typeof raw.requestedModel === 'string' ? raw.requestedModel.trim().toLowerCase() : '';
+    if (requested) {
+      const requestedAcpBackend = requested.startsWith('acp:') ? requested.split('/')[0] : '';
+      // Only explicit provider-qualified forms identify a provider here. Bare model IDs
+      // (for example claude-sonnet-4 or gpt-6-sol) cannot be compared to a provider name.
+      const apiProvider = requested.startsWith('openrouter/') ? 'openrouter'
+        : requested.startsWith('local:') ? 'local' : '';
+      const expectedResponseModel = requested.startsWith('openrouter/') ? requested.slice('openrouter/'.length) : requested;
+      const mismatch = (model !== '' && model !== requested)
+        || (actualBackend !== '' && (requestedAcpBackend ? actualBackend !== requestedAcpBackend : actualBackend !== 'api'
+          && (apiProvider === '' || actualBackend !== apiProvider)))
+        || (route !== '' && route !== (requestedAcpBackend ? 'acp' : 'api'))
+        || (!requestedAcpBackend && apiProvider !== '' && respondedProvider !== '' && respondedProvider !== apiProvider)
+        || (!requestedAcpBackend && respondedModel !== '' && respondedModel !== expectedResponseModel
+          && respondedModel !== requested);
+      if (mismatch) console.warn(`⚠ overlap-evidence: review provider mismatch — requestedModel=${requested} actualBackend=${actualBackend || 'unmeasured'} model=${model || 'unmeasured'} reviewRoute=${route || 'unmeasured'} respondedProvider=${respondedProvider || 'unmeasured'} respondedModel=${respondedModel || 'unmeasured'} (${e.reviewResult})`);
+    }
+  }
   if (review.error) return { ok: false, reason: 'review-error', baseTip };
   if (review.reviewed !== true) return { ok: false, reason: 'review-not-reviewed', baseTip };
   if (review.verdict === null || !ACCEPTED_REVIEW_VERDICTS.has(review.verdict)) return { ok: false, reason: `review-verdict-${review.verdict ?? 'null'}`, baseTip };
@@ -245,7 +286,11 @@ function check(input: VerifyOverlapEvidenceInput): Checked {
   }
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return { ok: false, reason: 'evidence-not-object' };
   const e = raw as Partial<OverlapEvidenceFile>;
-  if (e.pr !== input.pr) return { ok: false, reason: `evidence-pr-mismatch: ${String(e.pr)} ≠ ${input.pr}` };
+  const evidencePr = typeof e.pr === 'number' ? e.pr
+    : typeof e.pr === 'string' && /^[0-9]+$/.test(e.pr) ? Number(e.pr) : NaN;
+  const prMatches = Number.isSafeInteger(input.pr) && input.pr > 0
+    && Number.isSafeInteger(evidencePr) && evidencePr === input.pr;
+  if (!prMatches) return { ok: false, reason: `evidence-pr-mismatch: ${String(e.pr)} ≠ ${input.pr}` };
   if (typeof e.head !== 'string' || e.head.toLowerCase() !== head) return { ok: false, reason: 'evidence-head-mismatch' };
 
   // ⓐ 이미 조상 — 겹친 착지가 전부 머리 안에 있으면 그 머리의 게이트·리뷰가 이미 그것을 보고 쟀다.
@@ -317,13 +362,10 @@ export interface VerifyAncestorAutoInput {
   overlappingLandings: readonly string[];
 }
 
-function checkAncestorAuto(input: VerifyAncestorAutoInput): AncestorAutoVerdict {
+/** Standard same-head reviews must all pass; a later passing review cannot hide a failed attempt. */
+export function verifyAllSameHeadReviews(input: Pick<VerifyAncestorAutoInput, 'pr' | 'expectedHead' | 'readFile' | 'reviewResultsDir' | 'listDir'>):
+  { ok: true; reviewResult: string } | { ok: false; reason: string } {
   const head = input.expectedHead.toLowerCase();
-  const landings = input.overlappingLandings;
-  if (landings.length === 0) return { ok: false, reason: 'ancestor-auto-no-overlapping-landings' };
-  const notAncestor = landings.find((sha) => !(/^[0-9a-f]{7,40}$/i.test(sha)
-    && input.run('git', ['merge-base', '--is-ancestor', sha, head], { cwd: input.cwd }).ok));
-  if (notAncestor !== undefined) return { ok: false, reason: `ancestor-auto-not-ancestor: ${notAncestor.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}` };
   let names: readonly string[];
   try { names = input.listDir(input.reviewResultsDir); } catch { return { ok: false, reason: 'review-missing' }; }
   const filename = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]*-${input.pr}-([a-f0-9]{10,40})\\.json$`, 'i');
@@ -333,11 +375,23 @@ function checkAncestorAuto(input: VerifyAncestorAutoInput): AncestorAutoVerdict
     const match = filename.exec(n);
     return Boolean(match && match[1]!.length >= 10 && head.startsWith(match[1]!.toLowerCase()));
   }).sort()) {
+    // The auto-ancestor landing path uses the same provider/forbidden-backend check as explicit evidence.
     const review = checkReview(input, { reviewResult: join(input.reviewResultsDir, name) }, head);
     if (!review.ok) return { ok: false, reason: review.reason };
     accepted = review.reviewResult;
   }
-  return accepted === undefined ? { ok: false, reason: 'review-missing' } : { ok: true, mode: 'already-ancestor-auto', reviewResult: accepted };
+  return accepted === undefined ? { ok: false, reason: 'review-missing' } : { ok: true, reviewResult: accepted };
+}
+
+function checkAncestorAuto(input: VerifyAncestorAutoInput): AncestorAutoVerdict {
+  const head = input.expectedHead.toLowerCase();
+  const landings = input.overlappingLandings;
+  if (landings.length === 0) return { ok: false, reason: 'ancestor-auto-no-overlapping-landings' };
+  const notAncestor = landings.find((sha) => !(/^[0-9a-f]{7,40}$/i.test(sha)
+    && input.run('git', ['merge-base', '--is-ancestor', sha, head], { cwd: input.cwd }).ok));
+  if (notAncestor !== undefined) return { ok: false, reason: `ancestor-auto-not-ancestor: ${notAncestor.slice(0, 12)} is not an ancestor of ${head.slice(0, 12)}` };
+  const reviews = verifyAllSameHeadReviews(input);
+  return reviews.ok ? { ok: true, mode: 'already-ancestor-auto', reviewResult: reviews.reviewResult } : reviews;
 }
 
 /**

package/src/cli/pr-land-pod-shadow-job.ts

@@ -0,0 +1,83 @@
+/** Opt-in shadow of the pinned landing typecheck and changed-file gate on a Pod Job. */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { runPodCommand, type RunPodCommandOptions, type PodCommandResult } from '../task-orchestrator/surfaces/pod-command-job.js';
+import { redactSecretText } from '../debug/log.js';
+import type { RootPlanSummary } from './pr-land-heavy-remote.js';
+
+const SHA = /^[0-9a-f]{40}$/i;
+const MARKER = 'ELANOUS_PRLAND_SHADOW';
+
+export interface LandingPodShadowInput { head: string; main: string }
+export interface LandingPodShadowVerdict {
+  measured: boolean;
+  ok: boolean;
+  rootPlan: RootPlanSummary | null;
+  tscRc?: number;
+  gateRc?: number;
+  reason?: string;
+  job?: string;
+}
+
+export function landingPodShadowScript(head: string, main: string): string {
+  if (!SHA.test(head) || !SHA.test(main)) throw new Error('pod shadow: invalid head/main');
+  return [
+    'set -u',
+    `test "$(git rev-parse HEAD)" = '${head}' || { echo '${MARKER} unmeasured source-head'; exit 2; }`,
+    `git fetch origin '${main}' >/dev/null 2>&1 || { echo '${MARKER} unmeasured main-fetch'; exit 2; }`,
+    `git cat-file -e '${main}^{commit}' || { echo '${MARKER} unmeasured main-missing'; exit 2; }`,
+    `if [ "$(git rev-parse --is-shallow-repository)" = true ]; then git fetch --unshallow origin '${head}' >/tmp/prland-shadow-unshallow.log 2>&1 || { tail -n 12 /tmp/prland-shadow-unshallow.log; echo '${MARKER} unmeasured unshallow'; exit 2; }; fi`,
+    'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit ' + `'${main}'` + ` >/tmp/prland-shadow-merge.log 2>&1 || { tail -n 12 /tmp/prland-shadow-merge.log; echo '${MARKER} unmeasured merge'; exit 2; }`,
+    `bun install --frozen-lockfile >/tmp/prland-shadow-install.log 2>&1 || { echo '${MARKER} unmeasured root-install'; exit 2; }`,
+    `if [ -f apps/pwa/package.json ]; then (cd apps/pwa && bun install --frozen-lockfile) >/tmp/prland-shadow-pwa-install.log 2>&1 || { echo '${MARKER} unmeasured pwa-install'; exit 2; }; fi`,
+    `TSC_BASE_REF='${main}' bun scripts/ci-typecheck-changed.ts --local >/tmp/prland-shadow-tsc.log 2>&1; tsc_rc=$?`,
+    `bun bin/elanous.mjs self gate --changed --base '${main}' --local --shards 4 >/tmp/prland-shadow-gate.log 2>&1; gate_rc=$?`,
+    `printf '${MARKER}_TSC_PLAN %s\\n' "$(grep '^\\[tsc-gate\\] root-plan ' /tmp/prland-shadow-tsc.log | tail -n 1 | sed 's/^\\[tsc-gate\\] root-plan //')"`,
+    "tail -n 8 /tmp/prland-shadow-tsc.log; tail -n 8 /tmp/prland-shadow-gate.log",
+    `printf '${MARKER} head=%s main=%s tsc=%s gate=%s\\n' '${head}' '${main}' "$tsc_rc" "$gate_rc"`,
+    'exit 0',
+  ].join('\n');
+}
+
+export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps: {
+  runPod?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
+  readLog?: (path: string) => string;
+} = {}): Promise<LandingPodShadowVerdict> {
+  const script = landingPodShadowScript(input.head, input.main);
+  const job = await (deps.runPod ?? runPodCommand)({
+    command: ['bash', '-lc', script], clone: true, source: { kind: 'commit', sha: input.head },
+    returnLogs: true, deadlineSeconds: 45 * 60,
+  });
+  let log: string;
+  try { log = (deps.readLog ?? ((path: string) => readFileSync(path, 'utf8')))(join(job.artifactsDir, 'child.log')); }
+  catch (error) {
+    const detail = redactSecretText(error instanceof Error ? error.message : String(error)).slice(0, 180);
+    return { measured: false, ok: false, rootPlan: null, reason: `child-log-unreadable:${detail}`, job: job.job };
+  }
+  const expected = `${MARKER} head=${input.head} main=${input.main} `;
+  const lines = log.split(/\r?\n/);
+  let markerIndex = -1;
+  for (let index = lines.length - 1; index >= 0; index--) {
+    if (lines[index]!.startsWith(MARKER)) { markerIndex = index; break; }
+  }
+  const line = markerIndex >= 0 ? lines[markerIndex] : undefined;
+  if (job.exitCode !== 0 || !line?.startsWith(expected)) {
+    const detail = markerIndex > 0 ? redactSecretText(lines[markerIndex - 1] ?? '').trim().slice(0, 180) : '';
+    return { measured: false, ok: false, rootPlan: null, reason: `${line ?? `pod-exit-${job.exitCode}`}${detail ? ` · ${detail}` : ''}`, job: job.job };
+  }
+  const match = /^tsc=(\d+) gate=(\d+)$/.exec(line.slice(expected.length));
+  if (!match) return { measured: false, ok: false, rootPlan: null, reason: 'marker-unreadable', job: job.job };
+  const planLine = log.split(/\r?\n/).reverse().find((part) => part.startsWith(`${MARKER}_TSC_PLAN `));
+  let rootPlan: RootPlanSummary | null = null;
+  if (planLine) {
+    try {
+      const candidate = JSON.parse(planLine.slice(`${MARKER}_TSC_PLAN `.length)) as RootPlanSummary;
+      if ((candidate.mode === 'affected' || candidate.mode === 'full') && (candidate.roots === null || Number.isSafeInteger(candidate.roots))
+        && typeof candidate.promoted === 'boolean' && (candidate.reason === null || typeof candidate.reason === 'string')) rootPlan = candidate;
+    } catch { /* an unreadable plan stays unmeasured */ }
+  }
+  if (!rootPlan) return { measured: false, ok: false, rootPlan: null, reason: 'root-plan-missing', job: job.job };
+  const tscRc = Number(match[1]);
+  const gateRc = Number(match[2]);
+  return { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job };
+}

package/src/cli/pr-land-pod-shadow.ts

@@ -1,10 +1,10 @@
 /**
  * PRLAND-HEAVY-ON-POD-1 — `pr land` 무거운 판정을 Pod 에서 그림자 리허설한다.
  *
- * 착지 경로에 아직 잇지 않는다. `--heavy-on-pod-shadow` 플래그·실제 Pod 러너 바인딩은
- * 다음 조각(pr-cli.ts · pod-command-job.ts 무접촉). 이번 단위는 주입형 순수 함수만:
+ * `pr-cli.ts`의 `--heavy-remote --heavy-on-pod-shadow` 선택 경로가 호출한다.
+ * 비교기는 주입형 함수이며 Pod Job 바인딩은 `pr-land-pod-shadow-job.ts`에 둔다.
  * 켜지면 가짜/실 Pod 러너를 한 번 부르고 `pr.land`/`heavy-on-pod-shadow` 관측 한 줄을 남긴 뒤
- * 로컬 판정을 그대로 반환한다. 끄면 러너 0회. 러너가 던져도 경고 한 줄만 내고 로컬을 지킨다.
+ * 로컬 판정을 그대로 반환한다. 끄면 러너 0회. 러너가 던지면 미측정 관측과 경고를 남기고 로컬을 지킨다.
  */
 
 export interface HeavyOnPodShadowInput<T> {
@@ -18,6 +18,13 @@ export interface HeavyOnPodShadowInput<T> {
 }
 
 function agree(local: unknown, pod: unknown): boolean {
+  if (local && pod && typeof local === 'object' && typeof pod === 'object'
+    && 'measured' in local && 'measured' in pod) {
+    const a = local as { measured: unknown; ok?: unknown; rootPlan?: unknown };
+    const b = pod as { measured: unknown; ok?: unknown; rootPlan?: unknown };
+    return a.measured === true && b.measured === true && a.ok === b.ok
+      && JSON.stringify(a.rootPlan ?? null) === JSON.stringify(b.rootPlan ?? null);
+  }
   if (Object.is(local, pod)) return true;
   try {
     return JSON.stringify(local) === JSON.stringify(pod);
@@ -49,6 +56,12 @@ export async function runHeavyOnPodShadow<T>(input: HeavyOnPodShadowInput<T>): P
     });
   } catch (error) {
     warn(error instanceof Error ? error.message : String(error));
+    log('pr.land', 'heavy-on-pod-shadow', {
+      pr, head, local,
+      pod: { measured: false, ok: false, reason: `pod-exception:${error instanceof Error ? error.name : 'unknown'}` },
+      agree: false,
+      podMs: elapsedMs(started), localMs,
+    });
   }
   return local;
 }

package/src/cli/pr-land-virtual-rebase.ts

@@ -0,0 +1,108 @@
+/**
+ * Read-only virtual rebase proof for a reviewed PR head. The merge tree is written
+ * into a disposable object directory, never into the repository object store.
+ */
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { delimiter, resolve, join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const SHA40 = /^[a-f0-9]{40}$/iu;
+type Verdict = { ok: true; oldBase: string; patchId: string }
+  | { ok: false; reason: string };
+
+type MergeTreeInput = { cwd: string; baseTip: string; head: string };
+
+/** The callback may read the tree while its temporary objects exist. */
+function withDisposableMergeTree<T>(input: MergeTreeInput, consume: (mergedTree: string, env: NodeJS.ProcessEnv) => T):
+  { ok: true; value: T } | { ok: false; reason: string } {
+  const { cwd, baseTip, head } = input;
+  const gitObjects = spawnSync('git', ['rev-parse', '--git-path', 'objects'], { cwd, encoding: 'utf8' });
+  if (gitObjects.status !== 0 || !gitObjects.stdout.trim()) return { ok: false, reason: 'object-directory-unmeasured' };
+  const alternate = resolve(cwd, gitObjects.stdout.trim());
+  let temporary: string;
+  try { temporary = mkdtempSync(join(tmpdir(), 'elanous-virtual-rebase-')); }
+  catch { return { ok: false, reason: 'temporary-object-directory-unmeasured' }; }
+  const env = {
+    ...process.env,
+    GIT_OBJECT_DIRECTORY: temporary,
+    GIT_ALTERNATE_OBJECT_DIRECTORIES: [alternate, process.env.GIT_ALTERNATE_OBJECT_DIRECTORIES].filter(Boolean).join(delimiter),
+  };
+  try {
+    const result = spawnSync('git', ['merge-tree', '--write-tree', baseTip, head], {
+      cwd, env, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024,
+    });
+    const mergedTree = result.status === 0 && !result.error ? result.stdout.trim() : '';
+    if (!SHA40.test(mergedTree)) return { ok: false, reason: 'merge-tree-conflict-or-unmeasured' };
+    return { ok: true, value: consume(mergedTree, env) };
+  } catch {
+    return { ok: false, reason: 'virtual-rebase-unmeasured' };
+  } finally {
+    rmSync(temporary, { recursive: true, force: true });
+  }
+}
+
+export function verifyVirtualRebasePatch(input: MergeTreeInput): Verdict {
+  const { cwd, baseTip, head } = input;
+  if (!SHA40.test(baseTip) || !SHA40.test(head)) return { ok: false, reason: 'invalid-sha' };
+  const git = (args: string[], env?: NodeJS.ProcessEnv, stdin?: string) => spawnSync('git', args, {
+    cwd, env, input: stdin, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024,
+  });
+  const checked = (args: string[], env?: NodeJS.ProcessEnv) => {
+    const result = git(args, env);
+    return result.status === 0 && !result.error ? result.stdout.trim() : undefined;
+  };
+  const oldBase = checked(['merge-base', baseTip, head]);
+  if (!oldBase || !SHA40.test(oldBase)) return { ok: false, reason: 'merge-base-unmeasured' };
+  if (oldBase === head) return { ok: false, reason: 'head-has-no-patch' };
+  const merged = withDisposableMergeTree(input, (mergedTree, env): Verdict => {
+    const binaryBlob = (sha: string, inEnv?: NodeJS.ProcessEnv): 'binary' | 'text' | 'unmeasured' => {
+      if (/^0+$/u.test(sha)) return 'text';
+      const size = checked(['cat-file', '-s', sha], inEnv);
+      if (!size || !/^\d+$/u.test(size) || Number(size) > 32 * 1024 * 1024) return 'unmeasured';
+      const result = spawnSync('git', ['cat-file', 'blob', sha], {
+        cwd, env: inEnv, maxBuffer: 32 * 1024 * 1024,
+      });
+      if (result.status !== 0 || result.error || !Buffer.isBuffer(result.stdout)) return 'unmeasured';
+      const blob = result.stdout;
+      if (blob.includes(0) || blob.some((byte) => byte < 32 && byte !== 9 && byte !== 10 && byte !== 13)) return 'binary';
+      try { new TextDecoder('utf-8', { fatal: true }).decode(blob); }
+      catch { return 'binary'; }
+      return 'text';
+    };
+    const changed = (from: string, to: string, inEnv?: NodeJS.ProcessEnv) => {
+      const names = checked(['diff', '--name-status', '-M', '-C', '--find-copies-harder', from, to], inEnv);
+      const numstat = checked(['diff', '--numstat', from, to], inEnv);
+      if (names === undefined || numstat === undefined) return { ok: false as const, reason: 'diff-unmeasured' };
+      if (!names) return { ok: false as const, reason: 'empty-patch' };
+      if (names.split('\n').some((line) => /^[RC][0-9]*\t/u.test(line))) return { ok: false as const, reason: 'rename-or-copy' };
+      if (numstat.split('\n').some((line) => /^-\t-\t/u.test(line))) return { ok: false as const, reason: 'binary-patch' };
+      const raw = checked(['diff', '--raw', '--no-abbrev', '-z', from, to], inEnv);
+      if (raw === undefined) return { ok: false as const, reason: 'diff-unmeasured' };
+      const fields = raw.split('\0').filter(Boolean);
+      if (fields.length === 0 || fields.length % 2 !== 0) return { ok: false as const, reason: 'diff-blob-unmeasured' };
+      for (let i = 0; i < fields.length; i += 2) {
+        const entry = /^:[0-7]{6} [0-7]{6} ([a-f0-9]{40,64}) ([a-f0-9]{40,64}) [A-Z][0-9]*$/iu.exec(fields[i]!);
+        if (!entry) return { ok: false as const, reason: 'diff-blob-unmeasured' };
+        for (const sha of [entry[1]!, entry[2]!]) {
+          const kind = binaryBlob(sha, inEnv);
+          if (kind !== 'text') return { ok: false as const, reason: kind === 'binary' ? 'binary-patch' : 'diff-blob-unmeasured' };
+        }
+      }
+      const diff = checked(['diff', '--no-ext-diff', '--no-renames', '--binary', from, to], inEnv);
+      if (!diff) return { ok: false as const, reason: 'diff-unmeasured' };
+      const patched = git(['patch-id', '--stable'], inEnv, `${diff}\n`);
+      const patchId = patched.status === 0 && !patched.error ? patched.stdout.trim().split(/\s+/u)[0] : undefined;
+      return patchId && SHA40.test(patchId)
+        ? { ok: true as const, patchId }
+        : { ok: false as const, reason: 'patch-id-unmeasured' };
+    };
+    const original = changed(oldBase, head);
+    if (!original.ok) return original;
+    const virtual = changed(baseTip, mergedTree, env);
+    if (!virtual.ok) return virtual;
+    if (original.patchId !== virtual.patchId) return { ok: false, reason: 'patch-id-different' };
+    return { ok: true, oldBase, patchId: original.patchId };
+  });
+  return merged.ok ? merged.value : merged;
+}

package/src/cli/release-cli.ts

@@ -8,7 +8,7 @@
 //   elanous release run     --version <x.y.z> [--prerelease rc] [--main-cut | --cut-commit <sha>] [--publish-at <iso>] [--gate-executor <pod|host> [--gate-host <ssh-host>]] [--dry-run] [--json] [--if-ready]
 //   elanous release resume  --run <runId> --from <node> [--waive <node> --reason <text>] [--accepted-regressions <json>] [--gate-executor <pod|host> [--gate-host <ssh-host>]] [--json]
 //   elanous release auto-start [--window-minutes <n>] [--apply] [--json]
-//   elanous release rehearsal tick [--apply] [--checkout <dir>] [--json]
+//   elanous release rehearsal tick [--apply] [--checkout <dir>] [--shards <n>] [--remote <host>] [--json]
 //   elanous release preflight --version <x.y.z> [--publish-at <iso>] [--json]   (컷 30분 전 사전 점검 · 읽기 전용 · ⛔ 있으면 exit 1)
 //   elanous release cut-branch --version <x.y.z> --base <sha> --pick <sha>... [--dry-run]
 //
@@ -21,7 +21,7 @@ import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import type { Command } from 'commander';
 import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../instance/resolve.js';
@@ -32,7 +32,8 @@ import { addItem, cellsReferencingDoc, claimItem, decodeClaimHistoryEntry, devVe
 import * as features from '../release-loop/feature-store.js';
 import { evidencePlan, landedButYellow, type MergedChecklistPr } from '../release-loop/landed-but-yellow.js';
 import { formatSchedule, getSchedule, listSchedules, setSchedule } from '../release-loop/release-schedule.js';
-import { placeCell, rebalance, seatMove, type PlacementPriority } from '../release-loop/placement.js';
+import { mergedPrsLast24h, placeCell, planPullForward, pullForwardPlacementConfig, rebalance, seatMove, type PlacementPriority } from '../release-loop/placement.js';
+import { readTrafficSignal } from '../seat-loop/traffic-signal.js';
 import { parseRubric, readRubricItems, rubricGrade, rubricScore } from '../release-loop/rubric.js';
 import { writeStdoutJson } from './stdout-json.js';
 import { CliUserError } from './cli-user-error.js';
@@ -700,6 +701,63 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
       for (const row of blocked) console.log(`⛔ ${row.id} ${row.from} → ${row.to} 이월 거부 · ${row.reason}`);
       if (!decisions.length && !blocked.length) console.log('이월할 미시작 칸 없음');
     });
+  release.command('budget').description('판의 P0/P1 루브릭 S(0~3) 분포·합계·미기입 칸 조회(읽기 전용)')
+    .requiredOption('--version <v>', '조회할 판 또는 별칭')
+    .option('--json', '결과 JSON')
+    .action(async (opts: { version: string; json?: boolean }) => {
+      const version = checklistVersion(opts.version, checklistCodenames());
+      const byPriority = {
+        P0: { s: { 0: 0, 1: 0, 2: 0, 3: 0 }, total: 0, missing: 0 },
+        P1: { s: { 0: 0, 1: 0, 2: 0, 3: 0 }, total: 0, missing: 0 },
+      };
+      for (const item of readRubricItems(version, releaseLedgerRoot())) {
+        if (item.priority !== 'P0' && item.priority !== 'P1') continue;
+        const group = byPriority[item.priority];
+        const rubric = parseRubric(`${item.title}\n${item.evidence ?? ''}`);
+        if (rubric === null) group.missing++;
+        else { group.s[rubric.S as 0 | 1 | 2 | 3]++; group.total += rubric.S; }
+      }
+      const result = { version, byPriority, total: byPriority.P0.total + byPriority.P1.total, missing: byPriority.P0.missing + byPriority.P1.missing };
+      if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+      else {
+        for (const [priority, group] of Object.entries(byPriority)) console.log(`${priority} · S 0:${group.s[0]} 1:${group.s[1]} 2:${group.s[2]} 3:${group.s[3]} · 합계 ${group.total} · S 미기입 ${group.missing}`);
+        console.log(`합계 ${result.total} · S 미기입 ${result.missing}`);
+      }
+    });
+  release.command('pull-forward').description('다음 판 P0/P1 칸을 지금 판으로 당길 계획만 조회')
+    .option('--dry-run', '원장 이동 없이 계획만 보기').option('--traffic <path>', 'OP traffic.json 경로')
+    .option('--checkout <dir>', '대상 저장소 체크아웃(기본 harness.defaultRepo 또는 현재 디렉터리)')
+    .option('--json', '구조화 계획 출력')
+    .action((opts: { dryRun?: boolean; traffic?: string; checkout?: string; json?: boolean }) => {
+      if (!opts.dryRun) throw new CliUserError('pull-forward는 --dry-run 계획만 지원한다');
+      const signal = readTrafficSignal(opts.traffic);
+      if (!signal || 'unreadable' in signal) throw new CliUserError('traffic.json을 읽지 못해 hold·신호 순서를 확인할 수 없다');
+      const checkout = resolve(opts.checkout ?? getUserConfig().harness?.defaultRepo ?? process.cwd());
+      if (!existsSync(checkout) || !statSync(checkout).isDirectory()) throw new CliUserError(`대상 저장소 체크아웃이 없다: ${checkout}`);
+      const root = spawnSync('git', ['-C', checkout, 'rev-parse', '--show-toplevel'], { encoding: 'utf8', timeout: 5_000 });
+      if (root.status !== 0 || !root.stdout?.trim() || realpathSync(root.stdout.trim()) !== realpathSync(checkout))
+        throw new CliUserError(`대상 저장소의 Git 체크아웃 루트가 아니다: ${checkout}`);
+      const checkoutReal = realpathSync(checkout);
+      const now = new Date();
+      const schedules = listSchedules(scheduleLedgerRoot());
+      const versions = [...new Set([...schedules.map((row) => row.version), ...features.assignedVersions()])];
+      const checklists = new Map(versions.map((version) => [version, listChecklist(version).items] as const));
+      const placement = pullForwardPlacementConfig();
+      const result = planPullForward({ now, schedules, checklists, released: features.releasedVersion(),
+        merged24h: mergedPrsLast24h(now), ...placement, signal,
+        targetPathExists: (path) => {
+          try {
+            const targetReal = realpathSync(join(checkout, path));
+            const inside = relative(checkoutReal, targetReal);
+            return inside !== '..' && !inside.startsWith(`..${sep}`)
+              && !isAbsolute(inside) && statSync(targetReal).isFile();
+          } catch { return false; }
+        } });
+      if (opts.json) return writeStdoutJson(`${JSON.stringify(result)}\n`);
+      for (const row of result.decisions) console.log(`· 드라이런 ${row.id} ${row.from} → ${row.version} · ${row.reason}`);
+      for (const row of result.blocked) console.log(`⛔ ${row.id} ${row.from} → ${row.to} 당김 보류 · ${row.reason}`);
+      if (!result.decisions.length && !result.blocked.length) console.log('당겨올 칸 없음');
+    });
   const ceoMinutes = (value: string): number => {
     if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value))) throw new CliUserError('대표 손 분량은 0 이상의 정수 분이어야 한다');
     return Number(value);
@@ -783,13 +841,16 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         if (opts.open && (local.version !== undefined || inherited?.version !== undefined)) throw new CliUserError('--open 과 --version 을 함께 쓸 수 없다');
         const json = local.json ?? inherited?.json;
         if (opts.owner !== undefined) parseOwner(opts.owner);
-        const released = opts.open ? (landedDeps.released ?? features.releasedVersion)() : '';
-        const openSnapshots = opts.open
-          ? (landedDeps.schedules ?? features.readSchedules)()
-            .filter(({ version }) => isReleaseVersion(version) && (!released || compareReleaseVersions(version, released) > 0))
-            .sort((a, b) => compareReleaseVersions(a.version, b.version))
-            .map(({ version }) => (landedDeps.checklist ?? listChecklist)(version)).filter((snapshot) => snapshot.items.length > 0)
+        const includeOpenHistory = opts.open || local.version !== undefined || inherited?.version !== undefined;
+        const released = includeOpenHistory ? (landedDeps.released ?? features.releasedVersion)() : '';
+        // readSchedules() initializes SQLite when the ledger does not exist. This query is read-only.
+        const schedules = includeOpenHistory
+          ? landedDeps.schedules?.() ?? (existsSync(join(releaseLedgerRoot(), 'release', 'features.sqlite')) ? features.readSchedules() : [])
           : [];
+        const openSnapshots = schedules
+          .filter(({ version }) => isReleaseVersion(version) && (!released || compareReleaseVersions(version, released) > 0))
+          .sort((a, b) => compareReleaseVersions(a.version, b.version))
+          .map(({ version }) => (landedDeps.checklist ?? listChecklist)(version)).filter((snapshot) => snapshot.items.length > 0);
         if (opts.open && !openSnapshots.length) {
           if (json) await writeStdoutJson('[]\n'); else console.log('열린 판 없음');
           return;
@@ -797,7 +858,9 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         if (opts.applyEvidence && !opts.dryRun && !mayWrite(cmd)) return;
         const snapshots = opts.open ? openSnapshots : [(landedDeps.checklist ?? listChecklist)(context(cmd).version)];
         const now = (landedDeps.now ?? (() => new Date()))();
-        const updated = snapshots.flatMap(({ items }) => items
+        // --version 도 --open 과 같은 판 전체 최좌 수정일로 병합 PR 을 찾는다 — 선택 판 칸의 updatedAt 에 묶이면 그보다 오래 전에 병합된 PR 을 놓친다(LBY-VERSION-OPEN-MISMATCH · OPT #4059).
+        const sinceSnapshots = opts.open ? snapshots : [...openSnapshots, ...snapshots];
+        const updated = sinceSnapshots.flatMap(({ items }) => items
           .filter((item) => (item.status === 'yellow' || item.status === 'red') && (opts.owner === undefined || ownerMatches(item.owner, opts.owner)))
           .map((item) => Date.parse(item.updatedAt)).filter((at) => Number.isFinite(at)));
         const since = updated.length ? new Date(updated.reduce((earliest, at) => Math.min(earliest, at))).toISOString().slice(0, 10)
@@ -1141,15 +1204,16 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--remote <host>', '게이트 호스트(기본 config gateRemote.host)')
     .option('--local', '원격 대신 이 기계에서 돌린다(원격 자식이 이것으로 다시 불린다)')
     .option('--shards <n>', '시험 분할 수', '4')
+    .option('--fixed-shard-distribution', 'self gate 에 그대로 전달 — RSS 사전 측정 없이 --shards N 조각에 정렬 라운드로빈 고정 배정(opt-in · 원격 자식 전달)')
     .option('--rehearsal-tui', '리허설 전용 TUI 화면 점검(원격 자식 전달)')
     .option('--json', '결과 한 줄 JSON(stdout) · 사람 줄은 stderr')
-    .action(async (o: { version: string; base?: string; head?: string; remote?: string; local?: boolean; shards: string; rehearsalTui?: boolean; json?: boolean }) => {
+    .action(async (o: { version: string; base?: string; head?: string; remote?: string; local?: boolean; shards: string; fixedShardDistribution?: boolean; rehearsalTui?: boolean; json?: boolean }) => {
       // The root strips `--local` from argv (remote-bookmark attach) before Commander sees it — same read as `self gate`.
       const local = !!o.local || process.argv.slice(2).includes('--local');
       await jsonAction(o.json, async (log) => {
         if (o.remote !== undefined && local) throw new Error('release light-rc: --remote and --local cannot be combined');
         const shards = Number(o.shards);
-        const result = await runLightRc(o.version, { base: o.base, head: o.head, remote: o.remote, local, shards, rehearsalTui: o.rehearsalTui, ledgerRoot: releaseRunDeps.ledgerRoot, log: (l) => console.error(l) }, lightRcDeps);
+        const result = await runLightRc(o.version, { base: o.base, head: o.head, remote: o.remote, local, shards, ...(o.fixedShardDistribution ? { fixedShardDistribution: true } : {}), rehearsalTui: o.rehearsalTui, ledgerRoot: releaseRunDeps.ledgerRoot, log: (l) => console.error(l) }, lightRcDeps);
         for (const line of formatLightRc(result)) log(line);
         return result;
       }, (r) => r.ok);
@@ -1237,12 +1301,14 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .description('15분 틱: 다음 판 컷 −7h · −150m RC 계획(기본 보기만)')
     .option('--apply', '도장 선점 후 해당 단계 실행')
     .option('--checkout <dir>', '깨끗한 git 체크아웃(기본 ELANOUS_REHEARSAL_GIT_CWD)')
+    .option('--shards <n>', '시험 분할 수')
+    .option('--remote <host>', '게이트 호스트')
     .option('--json', '결과 한 줄 JSON(stdout)')
-    .action(async (o: { apply?: boolean; checkout?: string; json?: boolean }) => {
+    .action(async (o: { apply?: boolean; checkout?: string; shards?: string; remote?: string; json?: boolean }) => {
       await jsonAction(o.json, async (log) => {
         const ledgerRoot = scheduleLedgerRoot();
         if (o.apply && !mayWriteLedger('release rehearsal tick', false, ledgerRoot)) throw new Error('release rehearsal tick: ledger write denied');
-        const result = await runRehearsalTick({ apply: o.apply, checkout: o.checkout, ledgerRoot }, rehearsalDeps);
+        const result = await runRehearsalTick({ apply: o.apply, checkout: o.checkout, shards: o.shards === undefined ? undefined : Number(o.shards), remote: o.remote, ledgerRoot }, rehearsalDeps);
         log(`· 리허설 ${result.status}${'version' in result ? ` ${result.version}` : ''}${result.status === 'due' ? ` · 실행 ${result.run ?? '-'} · 건너뜀 ${result.supersede.join(', ') || '-'}` : ''}`);
         return result;
       }, (result) => !result.notificationFailures && !result.stamps?.some((stamp) => !['ok', 'superseded'].includes(stamp.outcome)));