elanous 0.2.31 → 0.2.34

package/scripts/release-loop/resume-release.ts

@@ -6,13 +6,14 @@ import { constants, copyFileSync, existsSync, readFileSync, renameSync, writeFil
 import { join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
-import { lastJsonObject, runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { lastJsonObject, runGraph, verifyReleaseCommandRoot, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
 import { changedFilesBetween, clearPartialPlan, planPartialRegate, writePartialPlan } from './gate-partial.js';
-import { gitClosureTree, testsReachingChanged, type ClosureTree } from './gate-closure.js';
-import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { gitClosureTree, testsReachingChanged, TRACEABLE_RELEASE_JSON, type ClosureTree } from './gate-closure.js';
+import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { reserveReleaseResumeAttempt } from './resume-cap.js';
 
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
@@ -33,6 +34,20 @@ export interface ResumeReleaseDeps {
   ledgerRoot?: string;
   /** GATE-REUSE-BY-DIFF: the tip tree for the import closure — default read from git objects of the tip commit. */
   closureTree?: (commit: string) => ClosureTree;
+  /** Source observation before the first resumed node. */
+  onSource?: (line: string) => void;
+}
+
+export interface ResumeReleaseOptions {
+  runId: string; from: string; partial?: boolean; waive?: string; reason?: string;
+  acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string; gatePodPool?: string;
+  commandRoot?: string;
+}
+
+export interface ResumeReleasePlan {
+  runId: string; version: string; fromNode: string; commandRoot: string; tip: TipRefresh;
+  partial: PartialOutcome; gatePlan: { mode: 'not-run' | 'partial' | 'full'; reason?: string };
+  nextAttempt: number; attemptLimit: 2; preflight: 'passed';
 }
 
 /** CLI entry files: a production file that only names one (help text, a goal's command line) does not run it. */
@@ -66,6 +81,10 @@ function safeRunId(runId: string): string {
 
 /** Point the saved version-release output at the current release/<v> tip (fast-forward of the recorded commit only). */
 export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps = {}, from?: string, waiverCommit?: string): TipRefresh {
+  return refreshReleaseBranchTipInternal(runId, deps, from, waiverCommit, false);
+}
+
+function refreshReleaseBranchTipInternal(runId: string, deps: ResumeReleaseDeps, from: string | undefined, waiverCommit: string | undefined, dryRun: boolean): TipRefresh {
   const root = deps.root ?? effectiveInstanceRoot();
   const statePath = join(root, 'graph-runs', 'release-loop', `${safeRunId(runId)}.json`);
   const state = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
@@ -89,8 +108,14 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   const git = deps.git ?? gitRunner(deps.repo ?? process.cwd());
   const advertised = git(['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]).split(/\s+/)[0] ?? '';
   if (!/^[0-9a-f]{40}$/i.test(advertised)) throw new Error(`${branch} is not on origin — this run was not cut as a release branch`);
-  git(['fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
-  const to = git(['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
+  let to: string;
+  if (dryRun) {
+    // Use the advertised object id directly: a preflight must not create/update local remote-tracking refs.
+    to = advertised;
+  } else {
+    git(['fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
+    to = git(['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
+  }
   if (waiverCommit && (recorded.toLowerCase() !== waiverCommit.toLowerCase() || to.toLowerCase() !== waiverCommit.toLowerCase() || advertised.toLowerCase() !== waiverCommit.toLowerCase())) {
     throw new Error('release branch moved — re-gate the new tip before waiving a node');
   }
@@ -114,6 +139,7 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   }
   const stamp = (deps.now?.() ?? new Date()).toISOString().replace(/[:.]/g, '-');
   const backup = `${statePath}.before-tip-${stamp}-${process.pid}-${to.slice(0, 12)}.bak`;
+  if (dryRun) return { version, branch, from: recorded, to, changed: true, statePath };
   // Exclusive: a retry never overwrites an earlier backup.
   copyFileSync(statePath, backup, constants.COPYFILE_EXCL);
   const refreshed = { ...output, commit: to, refreshedFrom: recorded };
@@ -134,10 +160,10 @@ export type PartialOutcome = { requested: false }
 
 /** Build (or clear) the partial re-gate plan for the new tip. Fail-closed: any doubt leaves a full gate.
  *  GATE-REUSE-BY-DIFF: `--from gate` on a moved tip plans by default (`partial: undefined`); `partial: false` opts out. */
-function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean }, deps: ResumeReleaseDeps): PartialOutcome {
+function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean }, deps: ResumeReleaseDeps, dryRun = false): PartialOutcome {
   const root = deps.root ?? effectiveInstanceRoot();
   // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
-  clearPartialPlan(root, tip.version);
+  if (!dryRun) clearPartialPlan(root, tip.version);
   const auto = opts.partial === undefined;
   // The current graph checks public export before gate. A moved tip must resume there, so its gate still needs
   // the diff plan; in older saved graphs export-check followed gate and cannot consume one.
@@ -182,6 +208,18 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   catch (error) { return fallback(`tip tree unreadable: ${String(error instanceof Error ? error.message : error).slice(0, 200)}`); }
   const tracked = new Set(tree.files);
   const tests = tree.files.filter((file) => GATE_TEST.test(file));
+  if (changed.includes(TRACEABLE_RELEASE_JSON)) {
+    // The one JSON exception is safe only while both the production reader and a test name this exact file at the tip.
+    // A renamed, computed or unreadable reader returns to the full gate instead of trusting a stale dependency map.
+    const reader = tree.read('scripts/release-loop/known-issues-node.ts');
+    if (!reader || !/readFileSync\(join\(import\.meta\.dir,\s*['"]known-issues-0\.2\.33-approved\.json['"]\)/.test(reader)) {
+      return fallback('known-issues JSON reader not statically verified — full gate');
+    }
+    const readerClosure = testsReachingChanged(tree, ['scripts/release-loop/known-issues-node.ts'], tests, { cliEntries: CLI_ENTRIES });
+    if (!readerClosure.ok || readerClosure.reached === 0) return fallback('known-issues JSON production reader reaches no verified test — full gate');
+    const jsonClosure = testsReachingChanged(tree, [TRACEABLE_RELEASE_JSON], tests, { cliEntries: CLI_ENTRIES });
+    if (!jsonClosure.ok || jsonClosure.reached === 0) return fallback('known-issues JSON reaches no verified test — full gate');
+  }
   const planned = planPartialRegate({ version: tip.version, priorCommit: tip.from, forCommit: tip.to, changedFiles: changed,
     priorFailures: prior.failures as string[], priorErrors: (prior.errors ?? []) as string[],
     existsAtTip: (file) => tracked.has(file),
@@ -201,9 +239,9 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     }
     if (!clean) return fallback(`no clean gate verdict for ${tip.from.slice(0, 12)} — full gate`);
   }
-  const path = writePartialPlan(root, planned.plan);
+  const path = dryRun ? undefined : writePartialPlan(root, planned.plan);
   debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
-    tests: tests.length, auto, path, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
+    tests: tests.length, auto, ...(path ? { path } : {}), dryRun, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
   return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.from,
     ...(auto ? { auto: true as const } : {}), ...(planned.closure ? { closure: planned.closure } : {}) };
 }
@@ -217,34 +255,87 @@ function savedGraphPath(statePath: string): string | undefined {
 }
 
 /** Refresh the branch tip, then restart the failed run at `from` with the saved graph snapshot. */
-export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+export async function resumeReleaseRun(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.root` must not
   // move this run onto a separate lock inode from the steward resync and the unattended release.
   return withOpSeatFlock(() => resumeReleaseRunLocked(opts, deps));
 }
 
-async function resumeReleaseRunLocked(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+/** Validate a resume without changing the saved run, attempt ledger, or partial-gate plan. */
+export async function planResumeReleaseRun(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps = {}): Promise<ResumeReleasePlan> {
+  return withOpSeatFlock(() => planResumeReleaseRunLocked(opts, deps));
+}
+
+async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps): Promise<ResumeReleasePlan> {
+  if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
+  deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
+  const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
+  const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+  if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
+  if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
+  const hasOverrides = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined
+    || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined;
+  const original = hasOverrides ? savedRun : undefined;
+  if (original && opts.gateExecutor !== undefined) releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost });
+  if (original && opts.gatePodPool !== undefined) releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool });
+  const waiver = original && (opts.waive !== undefined || opts.reason !== undefined) ? releaseResumeWaiver(original, opts) : undefined;
+  if (original && opts.acceptedRegressions !== undefined && !waiver)
+    releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from);
+  const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true, noDecision: true });
+  let waiverCommit: string | undefined;
+  if (waiver) {
+    const output = lastJsonObject(savedRun.nodes.find((node) => node.nodeId === 'version-release')?.output);
+    const version = output?.version, recorded = output?.commit;
+    if (typeof version !== 'string' || typeof recorded !== 'string' || !isReleaseVersion(version) || !/^[0-9a-f]{40}$/i.test(recorded)) throw new Error('release waiver requires a recorded release commit');
+    const git = deps.git ?? gitRunner(deps.repo ?? process.cwd());
+    const branch = `release/${version}`;
+    const advertised = git(['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]).split(/\s+/)[0];
+    if (advertised?.toLowerCase() !== recorded.toLowerCase()) throw new Error('release branch moved — re-gate the new tip before waiving a node');
+    waiverCommit = recorded;
+  }
+  const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
+  const partial = preparePartial(tip, opts, deps, true);
+  const fromIndex = savedRun.path.indexOf(opts.from);
+  const gateIndex = savedRun.path.indexOf('gate');
+  const gateWillRun = fromIndex >= 0 && gateIndex >= fromIndex;
+  const gatePlan = !gateWillRun ? { mode: 'not-run' as const }
+    : partial.requested && partial.applied ? { mode: 'partial' as const }
+      : { mode: 'full' as const, reason: partial.requested ? partial.reason : opts.partial === false ? 'partial recheck disabled' : 'no partial plan applies' };
+  return { runId: opts.runId, version: tip.version, fromNode: opts.from, commandRoot, tip, partial,
+    gatePlan, nextAttempt: attempt.attempt, attemptLimit: 2, preflight: 'passed' };
+}
+
+async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
   // RELEASE-LEDGER-UNIVERSE: decide the universe once; the run lookup and every resumed node use it.
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
   const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
+  const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
   let waiverCommit: string | undefined;
   if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
-  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined
-    ? JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState : undefined;
+  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined
+    ? savedRun : undefined;
   // GATE-HOST-EXECUTOR: checked before the tip refresh writes anything; the runner checks it again under the resume lock.
   const gateExecutor = original && opts.gateExecutor !== undefined
     ? releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost }) : undefined;
+  const gatePodPool = original && opts.gatePodPool !== undefined
+    ? releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool }) : undefined;
   if (gateExecutor) debug.log('release-loop.resume', 'gate-executor', { runId: opts.runId, from: opts.from, executor: gateExecutor.set.gateExecutor, host: gateExecutor.set.gateRemote ?? null, previous: gateExecutor.previous });
+  if (gatePodPool) debug.log('release-loop.resume', 'gate-pod-pool', {
+    runId: opts.runId, from: opts.from, pool: gatePodPool.set.gatePodPool, previous: gatePodPool.previous,
+  });
   const waiver = original && (opts.waive !== undefined || opts.reason !== undefined)
     ? releaseResumeWaiver(original, opts) : undefined;
   if (waiver) debug.log('release-loop.resume', 'waiver', { runId: opts.runId, node: waiver.nodeId, reason: waiver.reason, unmeasured: waiver.unmeasured ?? null });
   const acceptedRegressions = original && opts.acceptedRegressions !== undefined && !waiver
     ? releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from) : undefined;
+  if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
+  // Validate request arguments before the cap, then block the third attempt before tip refresh.
+  reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true });
   // A waived verdict may reuse its original commit. A moved tip still requires a full re-gate.
   if (waiver) {
-    const saved = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
-    const versionRecord = saved.nodes.find((node) => node.nodeId === 'version-release');
+    const versionRecord = savedRun.nodes.find((node) => node.nodeId === 'version-release');
     const output = lastJsonObject(versionRecord?.output);
     const version = output?.version;
     const recorded = output?.commit;
@@ -257,13 +348,21 @@ async function resumeReleaseRunLocked(opts: { runId: string; from: string; parti
   }
   // Check the refreshed tip before refresh writes a new version-release record or backup.
   const tip = refreshReleaseBranchTip(opts.runId, deps, opts.from, waiverCommit);
+  const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
   const partial = preparePartial(tip, opts, deps);
+  // A failed preflight does not consume one of the two release resume attempts.
+  const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now });
+  debug.log('release-loop.resume', 'attempt', { runId: opts.runId, attempt: attempt.attempt, limit: 2, ledger: attempt.path });
   // Resume the graph at the path it was started from (its snapshot is used); only tests inject another path.
   const graphPath = deps.graphPath ?? savedGraphPath(tip.statePath) ?? GRAPH;
+  const savedSource = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;
+  deps.onSource?.(`레시피 출처: graph=${graphPath} · graph sha=${savedSource.graphSnapshot?.graphSha?.slice(0, 12) ?? 'legacy'} · recipes sha=${savedSource.graphSnapshot?.recipesSha?.slice(0, 12) ?? 'legacy'} · command-root=${commandRoot} · 컷 tip=${tip.to.slice(0, 12)}`);
   const state = await (deps.graph ?? runGraph)(graphPath, { resumeRunId: opts.runId, fromNodeId: opts.from, pinChildUniverse: true,
+    releaseCommandSource: { root: commandRoot, cutTip: tip.to, ...(deps.git ? { git: deps.git } : {}) },
     ...(waiver ? { releaseWaiver: { ...waiver, requestedRegressions: opts.acceptedRegressions ?? [] } } : {}),
     ...(acceptedRegressions ? { releaseAcceptedRegressions: { requested: opts.acceptedRegressions!, acceptedRegressions } } : {}),
     ...(gateExecutor ? { releaseGateExecutor: { executor: gateExecutor.set.gateExecutor, ...(opts.gateHost !== undefined ? { host: opts.gateHost } : {}) } } : {}),
+    ...(gatePodPool ? { releaseGatePodPool: gatePodPool.set.gatePodPool } : {}),
     deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
   return { tip, partial, state };
 }

package/scripts/release-loop/resume.ts

@@ -137,6 +137,28 @@ export interface GateExecutorOverride {
   previous: { gateExecutor: unknown; gateRemote: unknown };
 }
 
+/** RESUME-GATE-POOL-OVERRIDE — replace the saved pool for a gate that will be re-run. */
+export interface GatePodPoolOverride {
+  kind: 'gate-pod-pool';
+  at: string;
+  from: string;
+  set: { gatePodPool: string };
+  previous: { gatePodPool: unknown };
+}
+
+export function releaseResumeGatePodPool(state: GraphRunState, opts: { from: string; pool: unknown; at?: string }): GatePodPoolOverride {
+  const input = state.input;
+  if (!input || typeof input !== 'object' || Array.isArray(input) || typeof (input as { version?: unknown }).version !== 'string') throw new Error('release run has no input');
+  if (typeof opts.pool !== 'string' || !opts.pool.trim()) throw new Error('--gate-pod-pool must not be empty');
+  const start = state.path.indexOf(opts.from);
+  if (start < 0) throw new Error(`--from ${opts.from} is not a node on the saved path`);
+  const gate = state.path.indexOf('gate');
+  if (gate >= 0 && start > gate) throw new Error('--gate-pod-pool needs a resume that re-runs gate (--from gate or earlier)');
+  const saved = input as { gatePodPool?: unknown };
+  return { kind: 'gate-pod-pool', at: opts.at ?? new Date().toISOString(), from: opts.from,
+    set: { gatePodPool: opts.pool.trim() }, previous: { gatePodPool: saved.gatePodPool ?? null } };
+}
+
 /**
  * Switch the gate executor of a resumed release run. Not a waiver: the gate node runs again (the restart must be at or
  * before gate) and produces a normal verdict; only where its sweep runs changes.
@@ -156,7 +178,8 @@ export function releaseResumeGateExecutor(state: GraphRunState, opts: { from: st
   // A restart after gate keeps the recorded verdict — switching its executor there would record a choice nothing used.
   if (gate >= 0 && start > gate) throw new Error('--gate-executor needs a resume that re-runs gate (--from gate or earlier)');
   // Back to pod: restore the gateRemote the run started with (an earlier host override replaced it).
-  const firstHost = choice.executor === 'pod' ? state.inputOverrides?.find((item) => item.kind === 'gate-executor' && item.set.gateRemote !== undefined) : undefined;
+  const firstHost = choice.executor === 'pod' ? state.inputOverrides?.find((item): item is GateExecutorOverride =>
+    item.kind === 'gate-executor' && item.set.gateRemote !== undefined) : undefined;
   const restored = firstHost ? firstHost.previous.gateRemote : undefined;
   return {
     kind: 'gate-executor', at: opts.at ?? new Date().toISOString(), from: opts.from,

package/scripts/release-loop/tui-sim-node.ts

@@ -16,7 +16,7 @@ import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 import { copyFileSync, existsSync, mkdtempSync, openSync, symlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
-import { parseTuiRegress, regressWarning, tuiChecks, tuiVerdict, type TuiCheck, type TuiRegress } from './tui-node-checks';
+import { parseTuiRegress, regressWarning, tuiChecks, tuiVerdict, validatedTuiRegress, type TuiCheck, type TuiRegress } from './tui-node-checks';
 
 const log = (msg: string) => process.stderr.write(`[tui-node] ${msg}\n`);
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
@@ -83,7 +83,13 @@ export function measureTuiRegress(worktree: string, runner: typeof spawnSync = s
 export function tuiNodeOutput(commit: string, attempts: Array<{ checks: TuiCheck[]; png?: string }>, regress: TuiRegress, failure?: string) {
   const last = attempts.at(-1);
   const verdict = !last ? 'error' : tuiVerdict(last.checks) === 'fail' ? 'fail' : attempts.length > 1 ? 'flaky' : 'pass';
-  return { verdict, commit, attempts: attempts.length, checks: last?.checks ?? [], png: last?.png, regress, ...(failure ? { error: failure } : {}) };
+  const measured = validatedTuiRegress(regress);
+  const regressSummary = 'unmeasured' in measured
+    ? `regress unmeasured: ${measured.unmeasured}`
+    : `regress ${measured.pass} pass / ${measured.fail} fail${measured.fail ? ` (${measured.results.filter((r) => !r.ok).map((r) => r.id).join(',')})` : ''}`;
+  const checks = last?.checks ?? [];
+  const summary = `TUI ${verdict}: basic ${checks.filter((check) => check.pass).length}/${checks.length} · ${regressSummary}`;
+  return { verdict, summary, commit, attempts: attempts.length, checks, png: last?.png, regress: measured, ...(failure ? { error: failure } : {}) };
 }
 
 async function main(): Promise<number> {

package/scripts/release-loop/unattended-release.ts

@@ -10,6 +10,7 @@ import { isLandingFreezeRefusal, readLandingFreeze, LandingFrozenError } from '.
 import { debug } from '../../src/debug/log.js';
 import { runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
+import { ReleaseRunClaimConflict, findActiveReleaseRun } from '../../src/cli/release-single-flight.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { baseVersion, isStableVersion, nextPrereleaseVersion, type PrereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
@@ -19,6 +20,8 @@ const VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
 export interface ReleaseLoopConfig {
+  /** Mid-cycle full-gate rehearsal, hours before cut (default 12; 0 disables). */
+  rehearsalHardIntervalHours?: number;
   gatePodPool?: string;
   gatePodBunCache?: string;
   gatePodShards?: number;
@@ -138,7 +141,7 @@ export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDep
 
 /** Fail closed at the entry boundary, before any graph node can change a release. */
 export async function runUnattendedRelease(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps = {},
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // A dry run only builds the input and mutates nothing, so it neither creates nor waits on the OP-seat lock.
@@ -149,7 +152,7 @@ export async function runUnattendedRelease(
 }
 
 async function runUnattendedReleaseLocked(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps,
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
@@ -188,6 +191,9 @@ async function runUnattendedReleaseLocked(
   if (beforeGraph && !opts.forceFreeze) throw new LandingFrozenError(beforeGraph);
   // RELEASE-LEDGER-UNIVERSE: one universe for the run ledger, the release ledger and every node subprocess.
   const root = releaseRunUniverse({ root: deps.ledgerRoot });
+  // Resume and fresh runs share the OP-seat flock. Recheck under that flock so a
+  // resume that began after CLI preflight cannot slip between the ledger scan and graph start.
+  if (!opts.forceNew && findActiveReleaseRun(version, root)) throw new ReleaseRunClaimConflict();
   const state = await (deps.graph ?? runGraph)(GRAPH, { input, pinChildUniverse: true, deps: { root } });
   // A freeze switched on while the graph ran stops gate or publish inside it. Only a failed gate/publish node whose own
   // record is the freeze refusal is reported as the freeze; any other failure keeps its own reason.

package/src/acp/core-turn-bridge.ts

@@ -54,6 +54,7 @@ import { readOriginSessionMeta } from './origin-session-meta.js';
 import { isFactQuestion } from './fact-question.js';
 import { classifyTuiChatIntent, formatTuiRouteLine, isSeatOpsDirective, type TuiChatRoute } from '../core-turn/short-question.js';
 import { HARNESS_ROLE_ENV } from '../harness/harness-space.js';
+import { createReasoningThoughtBuffer } from './reasoning-thought-buffer.js';
 
 const FACT_QUESTION_INSTRUCTION = '사실·최신 정보 질문이다. WebSearch 를 1~2회 쓰고 검색 결과(제목·스니펫·URL)로 답하라. 출처 링크를 붙여라. 셸·브라우저·파일 도구는 검색 결과로 부족할 때만. 도구 예산에 닿으면 지금까지 근거로 답하고 끝에 «더 찾아볼까요?»를 붙여라.';
 
@@ -67,8 +68,9 @@ const QUICK_TOOLS: Record<QuickTuiRoute, readonly string[]> = {
   '조회': ['decisions_pending', 'ops_seats', 'ops_status', 'release_status', 'logs_query', 'context_now', 'memory_recall', 'Read'],
   '설정 변경': ['DashboardConfigGet', 'DashboardConfigSet', 'LlmListAvailableModels', 'prompt_getRuntimeConfig', 'prompt_setRuntimeConfig', 'view_getConfig', 'view_applyRuntimeConfig', 'view_saveConfig', 'memory_recall'],
   // MsgList is a read-only ledger listing (never acks); MsgPost · MsgAck · RunShell · Bash stay out (TUI-QUICK-ROUTE-EXPLICIT-CMD).
-  '조사': ['WebSearch', 'OmniSearch', 'Grep', 'Glob', 'Read', 'fact_check', 'memory_recall', 'MsgList'],
-  '상시 일': ['schedule_manage', 'schedule_list', 'schedule_create', 'schedule_update', 'session_manage', 'ops_status', 'memory_recall'],
+  '조사': ['WebSearch', 'OmniSearch', 'Grep', 'Glob', 'Read', 'fact_check', 'memory_recall', 'MsgList', 'Agent'],
+  // ScheduleWakeup (H5) wakes this TUI in-process; schedule_manage is OS cron — both belong to «상시 일».
+  '상시 일': ['schedule_manage', 'schedule_list', 'schedule_create', 'schedule_update', 'ScheduleWakeup', 'session_manage', 'ops_status', 'memory_recall'],
 };
 
 export function toolsForTuiRoute(tools: readonly LLMToolSpec[], route: QuickTuiRoute): LLMToolSpec[] {
@@ -248,7 +250,7 @@ export function bridgeCoreTurnToAcp(
           })
         : { route: '코딩·구현' as const, reason: harness ? 'harness' : 'legacy', goalLoop: true };
       const tools = !route.goalLoop && route.route !== '코딩·구현' && route.route !== '읽기·분석'
-        ? toolsForTuiRoute(availableTools, route.route)
+        ? toolsForTuiRoute(availableTools, route.route) // bridgeCoreTurnToAcp applies route allowlists here.
         : availableTools;
       if (deps.tuiRouting) {
         debug.log('chat.route', 'decided', { route: route.route, reason: route.reason, goalLoop: route.goalLoop, seat, seatKnown });
@@ -317,6 +319,7 @@ export function bridgeCoreTurnToAcp(
       let finalSupplement: { answer: string; supplement: string; finalText: string } | null = null;
       // turnFamily 는 관측용으로만 유지(goal loop 아밍 판정은 위 사실 질문 판정 앞에서 한다).
       const turnModel = modelOverride ?? getUserConfig().llm.model;
+      let resolvedRoute: { provider: string; model: string } | null = null;
       const turnFamily = getModelFamily(turnModel);
       if (armGoalLoop) {
         // 관측 — 어느 family/모델에서 across-turn goal-loop 가 아밍됐나(전-family 개방 검증).
@@ -380,6 +383,16 @@ export function bridgeCoreTurnToAcp(
             return approvedDispatch(name, args, dispatchCtx);
           }
         : approvedDispatch;
+      // TUI-TURN-NARRATION 조각 2 — 추론 요약을 «문단» 단위로 모아 ACP `agent_thought_chunk`
+      //   (`_meta.reasoning: true`)로 보낸다. 대시보드가 흐린 💭 한 줄로 그린다(`acp-chat.ts`).
+      //   ⛔ 전에는 debug.log 로만 남아 화면엔 «무엇을 하는지»가 0줄이었다(결함 #87).
+      const reasoningThoughts = createReasoningThoughtBuffer((text) => {
+        debug.log('llm.reasoning', 'thought-emitted', { sessionId: turnCtx.sessionId, chars: text.length });
+        void turnCtx.pushSessionUpdate(
+          { sessionUpdate: 'agent_thought_chunk', content: { type: 'text', text } },
+          { reasoning: true },
+        );
+      });
       const dispatchResult = await runTurnDispatch({
         sessionId: turnCtx.sessionId,
         ...(originSessionId ? { originSessionId } : {}),
@@ -401,6 +414,7 @@ export function bridgeCoreTurnToAcp(
             // contract is synchronous onText. Chunks are delivered in
             // order because `sessionUpdate` is serialized per-
             // connection on the ACP SDK side.
+            if (delta.length > 0) reasoningThoughts.flush();
             streamedTextSum += delta;
             void turnCtx.push(delta);
           },
@@ -418,20 +432,31 @@ export function bridgeCoreTurnToAcp(
               toolKinds.add(call.name);
               observeToolBudget();
             }
+            reasoningThoughts.flush();
             void turnCtx.pushToolCall(call);
           },
           onToolResult: (call) => { void turnCtx.pushToolResult(call); },
+          // 실제로 응답한 공급자·모델을 기억한다 — 폴백 체인이 넘기면(예 codex → grok) 턴 모델(turnModel)과 달라진다.
+          //   streamLLMWithTools 가 스트림을 (다시) 열 때마다 부른다 → 사용량 직전 값 = 그 사용량을 낸 쪽.
+          onResolvedProvider: (provider, model) => { resolvedRoute = { provider, model }; },
           // 턴 모델(라우팅 결과)을 실어 보낸다 — 대시보드 턴 지표가 설정 모델로 ctx·단가를 잡지 않게.
-          onUsage: (usage) => { void turnCtx.pushUsage({ ...usage, model: usage.model ?? turnModel }); },
-          // Codex Responses API reasoning summary stream. Currently
-          // surfaced via forensic only (debug.log) — acts as the
-          // "did the model actually emit reasoning?" verification
-          // signal before we wire the dashboard UI in a fast-follow.
+          //   ⭐ 폴백이면 «넘어간» 모델·공급자를 싣는다(TUI-MODEL-BADGE-ACTUAL · 완료 배지가 읽는다 · 상태줄·/model 은 후속 TUI-MODEL-BADGE-SOURCE).
+          onUsage: (usage) => {
+            void turnCtx.pushUsage({
+              ...usage,
+              model: usage.model ?? resolvedRoute?.model ?? turnModel,
+              ...(resolvedRoute ? { routeProvider: resolvedRoute.provider } : {}),
+            });
+          },
+          // Codex Responses API reasoning summary stream. Surfaced to the
+          // dashboard as `agent_thought_chunk` via `reasoningThoughts`
+          // (TUI-TURN-NARRATION 조각 2) ⊕ the forensic debug.log below.
           // The forensic line carries the streamed delta and the
           // running summary index so a single grep gives the
           // reasoning trace in order. summary_part_added marks the
           // paragraph boundary; summary_delta is the text within.
           onReasoning: (event) => {
+            reasoningThoughts.onEvent(event);
             if (debug.enabled) {
               if (event.kind === 'summary_delta') {
                 debug.log('llm.reasoning', 'codex.summary.delta', {
@@ -447,6 +472,7 @@ export function bridgeCoreTurnToAcp(
             }
           },
           onTurnComplete: async (newMessages) => {
+            reasoningThoughts.flush();
             // Surface runtime-injected synthesis to ACP. emitTurnComplete
             // pushes the final assistant text (which may be the W5-E/F/G
             // force-synthesis output) into history. Compare to what was
@@ -580,7 +606,8 @@ export function bridgeCoreTurnToAcp(
             }
           },
         },
-      });
+      // 오류·취소로 끝나 onTurnComplete 가 안 불려도 마지막 추론 문단을 내보낸다(#28964 리뷰 FU-1 · 빈 버퍼면 무동작).
+      }).finally(() => reasoningThoughts.flush());
       // ⭐ 인증 거절은 코어 턴이 «던지지 않고» 돌려준다 — 여기서 안 읽으면 서버는 end_turn 을 내고
       //   TUI 엔 «✔ 완료»만 남는다(TUI 결함 #22). 던져서 실패 경로(prompt-failed · 오류 줄)로 보낸다.
       const stopReason = (dispatchResult as { stopReason?: unknown } | null | undefined)?.stopReason;

package/src/acp/elanous-extensions.ts

@@ -81,6 +81,9 @@ export interface ElanousUiUsagePayload {
   provider?: 'anthropic' | 'openai';
   /** 그 턴이 실제로 요청한 모델(라우팅 결과 — 설정 모델과 다를 수 있다). */
   model?: string;
+  /** 이 사용량을 낸 «실제» 공급자(폴백 체인이 넘겼으면 넘어간 쪽 · 예 `grok`). `provider` 는 과금 계열 축이라 따로 둔다
+   *  (TUI-MODEL-BADGE-ACTUAL · 10-16). */
+  routeProvider?: string;
   inputTokens?: number;
   outputTokens?: number;
   cacheReadInputTokens?: number;

package/src/acp/reasoning-thought-buffer.ts

@@ -0,0 +1,45 @@
+// TUI-TURN-NARRATION 조각 2 — 추론 요약(reasoning summary)을 화면 한 줄로 낸다.
+//
+// 🩸 왜 있나 (결함 #87 · 2026-10-18): gpt-6 계열 TUI 턴은 도구 사이에 글을 0자 낸다
+//   (`llm.stream consume-end` `textChars=0`). 그런데 추론 요약은 라운드마다 24~37자씩 «온다»
+//   (`reasoningChars`). `core-turn-bridge` 의 `onReasoning` 이 debug.log 로만 남기고
+//   화면으로 안 보내서, 사용자는 «무엇을 하는지» 한 줄도 못 봤다.
+//   대시보드는 이미 `agent_thought_chunk` ⊕ `_meta.reasoning` 을 흐린 💭 줄로 그린다
+//   (`dashboard/chat/acp-chat.ts`) — 빠진 것은 «주는 자리» 하나였다.
+//
+// ⭐ 델타를 그대로 흘리지 않고 «문단» 단위로 모은다 — 델타마다 보내면 한 생각이 여러 줄로 찢긴다.
+//   문단 경계 = 다음 `summary_part_added` · 도구 호출 · 답 글 시작 · 턴 끝.
+
+export type ReasoningEvent =
+  | { kind: 'summary_part_added'; summaryIndex?: number }
+  | { kind: 'summary_delta'; delta: string; summaryIndex?: number };
+
+export interface ReasoningThoughtBuffer {
+  onEvent(event: ReasoningEvent): void;
+  /** 모은 문단을 내보낸다(비었으면 아무것도 안 한다). */
+  flush(): void;
+}
+
+/** 요약 문단은 짧다(실측 24~37자). 폭주 방어로만 자른다. */
+const MAX_THOUGHT_CHARS = 400;
+
+export function createReasoningThoughtBuffer(emit: (text: string) => void): ReasoningThoughtBuffer {
+  let buf = '';
+  const flush = (): void => {
+    const text = buf.trim();
+    buf = '';
+    if (text.length === 0) return;
+    emit(text.length > MAX_THOUGHT_CHARS ? `${text.slice(0, MAX_THOUGHT_CHARS)}…` : text);
+  };
+  return {
+    onEvent(event) {
+      if (event.kind === 'summary_part_added') {
+        flush();
+        return;
+      }
+      // 모으는 단계에서도 상한을 지킨다 — 문단 경계 없이 긴 스트림이 와도 버퍼가 무한히 크지 않게.
+      if (buf.length <= MAX_THOUGHT_CHARS) buf += event.delta.slice(0, MAX_THOUGHT_CHARS + 1 - buf.length);
+    },
+    flush,
+  };
+}

package/src/acp/server.ts

@@ -838,6 +838,8 @@ export interface AcpTurnContext {
   pushUsage: (usage: {
     provider?: 'anthropic' | 'openai';
     model?: string;
+    /** 실제로 응답한 공급자(폴백이면 넘어간 쪽). */
+    routeProvider?: string;
     inputTokens?: number;
     outputTokens?: number;
     cacheReadInputTokens?: number;
@@ -1839,6 +1841,7 @@ function wireAcpConnection(
           id: `turn:${Date.now()}`,
           ...(usage.provider !== undefined ? { provider: usage.provider } : {}),
           ...(usage.model !== undefined ? { model: usage.model } : {}),
+          ...(usage.routeProvider !== undefined ? { routeProvider: usage.routeProvider } : {}),
           ...(usage.inputTokens !== undefined ? { inputTokens: usage.inputTokens } : {}),
           ...(usage.outputTokens !== undefined ? { outputTokens: usage.outputTokens } : {}),
           ...(usage.cacheReadInputTokens !== undefined