elanous 0.2.32 → 0.2.34

package/scripts/release-loop/resume-release.ts

@@ -6,13 +6,14 @@ import { constants, copyFileSync, existsSync, readFileSync, renameSync, writeFil
 import { join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
-import { lastJsonObject, runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { lastJsonObject, runGraph, verifyReleaseCommandRoot, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
 import { changedFilesBetween, clearPartialPlan, planPartialRegate, writePartialPlan } from './gate-partial.js';
-import { gitClosureTree, testsReachingChanged, type ClosureTree } from './gate-closure.js';
-import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { gitClosureTree, testsReachingChanged, TRACEABLE_RELEASE_JSON, type ClosureTree } from './gate-closure.js';
+import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { reserveReleaseResumeAttempt } from './resume-cap.js';
 
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
@@ -33,6 +34,20 @@ export interface ResumeReleaseDeps {
   ledgerRoot?: string;
   /** GATE-REUSE-BY-DIFF: the tip tree for the import closure — default read from git objects of the tip commit. */
   closureTree?: (commit: string) => ClosureTree;
+  /** Source observation before the first resumed node. */
+  onSource?: (line: string) => void;
+}
+
+export interface ResumeReleaseOptions {
+  runId: string; from: string; partial?: boolean; waive?: string; reason?: string;
+  acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string; gatePodPool?: string;
+  commandRoot?: string;
+}
+
+export interface ResumeReleasePlan {
+  runId: string; version: string; fromNode: string; commandRoot: string; tip: TipRefresh;
+  partial: PartialOutcome; gatePlan: { mode: 'not-run' | 'partial' | 'full'; reason?: string };
+  nextAttempt: number; attemptLimit: 2; preflight: 'passed';
 }
 
 /** CLI entry files: a production file that only names one (help text, a goal's command line) does not run it. */
@@ -66,6 +81,10 @@ function safeRunId(runId: string): string {
 
 /** Point the saved version-release output at the current release/<v> tip (fast-forward of the recorded commit only). */
 export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps = {}, from?: string, waiverCommit?: string): TipRefresh {
+  return refreshReleaseBranchTipInternal(runId, deps, from, waiverCommit, false);
+}
+
+function refreshReleaseBranchTipInternal(runId: string, deps: ResumeReleaseDeps, from: string | undefined, waiverCommit: string | undefined, dryRun: boolean): TipRefresh {
   const root = deps.root ?? effectiveInstanceRoot();
   const statePath = join(root, 'graph-runs', 'release-loop', `${safeRunId(runId)}.json`);
   const state = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
@@ -89,8 +108,14 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   const git = deps.git ?? gitRunner(deps.repo ?? process.cwd());
   const advertised = git(['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]).split(/\s+/)[0] ?? '';
   if (!/^[0-9a-f]{40}$/i.test(advertised)) throw new Error(`${branch} is not on origin — this run was not cut as a release branch`);
-  git(['fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
-  const to = git(['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
+  let to: string;
+  if (dryRun) {
+    // Use the advertised object id directly: a preflight must not create/update local remote-tracking refs.
+    to = advertised;
+  } else {
+    git(['fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`]);
+    to = git(['rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`]);
+  }
   if (waiverCommit && (recorded.toLowerCase() !== waiverCommit.toLowerCase() || to.toLowerCase() !== waiverCommit.toLowerCase() || advertised.toLowerCase() !== waiverCommit.toLowerCase())) {
     throw new Error('release branch moved — re-gate the new tip before waiving a node');
   }
@@ -114,6 +139,7 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   }
   const stamp = (deps.now?.() ?? new Date()).toISOString().replace(/[:.]/g, '-');
   const backup = `${statePath}.before-tip-${stamp}-${process.pid}-${to.slice(0, 12)}.bak`;
+  if (dryRun) return { version, branch, from: recorded, to, changed: true, statePath };
   // Exclusive: a retry never overwrites an earlier backup.
   copyFileSync(statePath, backup, constants.COPYFILE_EXCL);
   const refreshed = { ...output, commit: to, refreshedFrom: recorded };
@@ -134,10 +160,10 @@ export type PartialOutcome = { requested: false }
 
 /** Build (or clear) the partial re-gate plan for the new tip. Fail-closed: any doubt leaves a full gate.
  *  GATE-REUSE-BY-DIFF: `--from gate` on a moved tip plans by default (`partial: undefined`); `partial: false` opts out. */
-function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean }, deps: ResumeReleaseDeps): PartialOutcome {
+function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean }, deps: ResumeReleaseDeps, dryRun = false): PartialOutcome {
   const root = deps.root ?? effectiveInstanceRoot();
   // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
-  clearPartialPlan(root, tip.version);
+  if (!dryRun) clearPartialPlan(root, tip.version);
   const auto = opts.partial === undefined;
   // The current graph checks public export before gate. A moved tip must resume there, so its gate still needs
   // the diff plan; in older saved graphs export-check followed gate and cannot consume one.
@@ -182,6 +208,18 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   catch (error) { return fallback(`tip tree unreadable: ${String(error instanceof Error ? error.message : error).slice(0, 200)}`); }
   const tracked = new Set(tree.files);
   const tests = tree.files.filter((file) => GATE_TEST.test(file));
+  if (changed.includes(TRACEABLE_RELEASE_JSON)) {
+    // The one JSON exception is safe only while both the production reader and a test name this exact file at the tip.
+    // A renamed, computed or unreadable reader returns to the full gate instead of trusting a stale dependency map.
+    const reader = tree.read('scripts/release-loop/known-issues-node.ts');
+    if (!reader || !/readFileSync\(join\(import\.meta\.dir,\s*['"]known-issues-0\.2\.33-approved\.json['"]\)/.test(reader)) {
+      return fallback('known-issues JSON reader not statically verified — full gate');
+    }
+    const readerClosure = testsReachingChanged(tree, ['scripts/release-loop/known-issues-node.ts'], tests, { cliEntries: CLI_ENTRIES });
+    if (!readerClosure.ok || readerClosure.reached === 0) return fallback('known-issues JSON production reader reaches no verified test — full gate');
+    const jsonClosure = testsReachingChanged(tree, [TRACEABLE_RELEASE_JSON], tests, { cliEntries: CLI_ENTRIES });
+    if (!jsonClosure.ok || jsonClosure.reached === 0) return fallback('known-issues JSON reaches no verified test — full gate');
+  }
   const planned = planPartialRegate({ version: tip.version, priorCommit: tip.from, forCommit: tip.to, changedFiles: changed,
     priorFailures: prior.failures as string[], priorErrors: (prior.errors ?? []) as string[],
     existsAtTip: (file) => tracked.has(file),
@@ -201,9 +239,9 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     }
     if (!clean) return fallback(`no clean gate verdict for ${tip.from.slice(0, 12)} — full gate`);
   }
-  const path = writePartialPlan(root, planned.plan);
+  const path = dryRun ? undefined : writePartialPlan(root, planned.plan);
   debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
-    tests: tests.length, auto, path, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
+    tests: tests.length, auto, ...(path ? { path } : {}), dryRun, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
   return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.from,
     ...(auto ? { auto: true as const } : {}), ...(planned.closure ? { closure: planned.closure } : {}) };
 }
@@ -217,34 +255,87 @@ function savedGraphPath(statePath: string): string | undefined {
 }
 
 /** Refresh the branch tip, then restart the failed run at `from` with the saved graph snapshot. */
-export async function resumeReleaseRun(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+export async function resumeReleaseRun(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps = {}): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   // The lock root is the OP seat's (opSeatLockRoot), never the injected ledger root: a different `deps.root` must not
   // move this run onto a separate lock inode from the steward resync and the unattended release.
   return withOpSeatFlock(() => resumeReleaseRunLocked(opts, deps));
 }
 
-async function resumeReleaseRunLocked(opts: { runId: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string }, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
+/** Validate a resume without changing the saved run, attempt ledger, or partial-gate plan. */
+export async function planResumeReleaseRun(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps = {}): Promise<ResumeReleasePlan> {
+  return withOpSeatFlock(() => planResumeReleaseRunLocked(opts, deps));
+}
+
+async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps): Promise<ResumeReleasePlan> {
+  if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
+  deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
+  const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
+  const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+  if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
+  if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
+  const hasOverrides = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined
+    || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined;
+  const original = hasOverrides ? savedRun : undefined;
+  if (original && opts.gateExecutor !== undefined) releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost });
+  if (original && opts.gatePodPool !== undefined) releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool });
+  const waiver = original && (opts.waive !== undefined || opts.reason !== undefined) ? releaseResumeWaiver(original, opts) : undefined;
+  if (original && opts.acceptedRegressions !== undefined && !waiver)
+    releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from);
+  const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true, noDecision: true });
+  let waiverCommit: string | undefined;
+  if (waiver) {
+    const output = lastJsonObject(savedRun.nodes.find((node) => node.nodeId === 'version-release')?.output);
+    const version = output?.version, recorded = output?.commit;
+    if (typeof version !== 'string' || typeof recorded !== 'string' || !isReleaseVersion(version) || !/^[0-9a-f]{40}$/i.test(recorded)) throw new Error('release waiver requires a recorded release commit');
+    const git = deps.git ?? gitRunner(deps.repo ?? process.cwd());
+    const branch = `release/${version}`;
+    const advertised = git(['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]).split(/\s+/)[0];
+    if (advertised?.toLowerCase() !== recorded.toLowerCase()) throw new Error('release branch moved — re-gate the new tip before waiving a node');
+    waiverCommit = recorded;
+  }
+  const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
+  const partial = preparePartial(tip, opts, deps, true);
+  const fromIndex = savedRun.path.indexOf(opts.from);
+  const gateIndex = savedRun.path.indexOf('gate');
+  const gateWillRun = fromIndex >= 0 && gateIndex >= fromIndex;
+  const gatePlan = !gateWillRun ? { mode: 'not-run' as const }
+    : partial.requested && partial.applied ? { mode: 'partial' as const }
+      : { mode: 'full' as const, reason: partial.requested ? partial.reason : opts.partial === false ? 'partial recheck disabled' : 'no partial plan applies' };
+  return { runId: opts.runId, version: tip.version, fromNode: opts.from, commandRoot, tip, partial,
+    gatePlan, nextAttempt: attempt.attempt, attemptLimit: 2, preflight: 'passed' };
+}
+
+async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
   if (opts.from === 'version-release') throw new Error('--from version-release would cut again — resume at a later node');
   // RELEASE-LEDGER-UNIVERSE: decide the universe once; the run lookup and every resumed node use it.
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
   const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
+  const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
   let waiverCommit: string | undefined;
   if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
-  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined
-    ? JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState : undefined;
+  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined
+    ? savedRun : undefined;
   // GATE-HOST-EXECUTOR: checked before the tip refresh writes anything; the runner checks it again under the resume lock.
   const gateExecutor = original && opts.gateExecutor !== undefined
     ? releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost }) : undefined;
+  const gatePodPool = original && opts.gatePodPool !== undefined
+    ? releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool }) : undefined;
   if (gateExecutor) debug.log('release-loop.resume', 'gate-executor', { runId: opts.runId, from: opts.from, executor: gateExecutor.set.gateExecutor, host: gateExecutor.set.gateRemote ?? null, previous: gateExecutor.previous });
+  if (gatePodPool) debug.log('release-loop.resume', 'gate-pod-pool', {
+    runId: opts.runId, from: opts.from, pool: gatePodPool.set.gatePodPool, previous: gatePodPool.previous,
+  });
   const waiver = original && (opts.waive !== undefined || opts.reason !== undefined)
     ? releaseResumeWaiver(original, opts) : undefined;
   if (waiver) debug.log('release-loop.resume', 'waiver', { runId: opts.runId, node: waiver.nodeId, reason: waiver.reason, unmeasured: waiver.unmeasured ?? null });
   const acceptedRegressions = original && opts.acceptedRegressions !== undefined && !waiver
     ? releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from) : undefined;
+  if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
+  // Validate request arguments before the cap, then block the third attempt before tip refresh.
+  reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true });
   // A waived verdict may reuse its original commit. A moved tip still requires a full re-gate.
   if (waiver) {
-    const saved = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
-    const versionRecord = saved.nodes.find((node) => node.nodeId === 'version-release');
+    const versionRecord = savedRun.nodes.find((node) => node.nodeId === 'version-release');
     const output = lastJsonObject(versionRecord?.output);
     const version = output?.version;
     const recorded = output?.commit;
@@ -257,13 +348,21 @@ async function resumeReleaseRunLocked(opts: { runId: string; from: string; parti
   }
   // Check the refreshed tip before refresh writes a new version-release record or backup.
   const tip = refreshReleaseBranchTip(opts.runId, deps, opts.from, waiverCommit);
+  const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
   const partial = preparePartial(tip, opts, deps);
+  // A failed preflight does not consume one of the two release resume attempts.
+  const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now });
+  debug.log('release-loop.resume', 'attempt', { runId: opts.runId, attempt: attempt.attempt, limit: 2, ledger: attempt.path });
   // Resume the graph at the path it was started from (its snapshot is used); only tests inject another path.
   const graphPath = deps.graphPath ?? savedGraphPath(tip.statePath) ?? GRAPH;
+  const savedSource = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;
+  deps.onSource?.(`레시피 출처: graph=${graphPath} · graph sha=${savedSource.graphSnapshot?.graphSha?.slice(0, 12) ?? 'legacy'} · recipes sha=${savedSource.graphSnapshot?.recipesSha?.slice(0, 12) ?? 'legacy'} · command-root=${commandRoot} · 컷 tip=${tip.to.slice(0, 12)}`);
   const state = await (deps.graph ?? runGraph)(graphPath, { resumeRunId: opts.runId, fromNodeId: opts.from, pinChildUniverse: true,
+    releaseCommandSource: { root: commandRoot, cutTip: tip.to, ...(deps.git ? { git: deps.git } : {}) },
     ...(waiver ? { releaseWaiver: { ...waiver, requestedRegressions: opts.acceptedRegressions ?? [] } } : {}),
     ...(acceptedRegressions ? { releaseAcceptedRegressions: { requested: opts.acceptedRegressions!, acceptedRegressions } } : {}),
     ...(gateExecutor ? { releaseGateExecutor: { executor: gateExecutor.set.gateExecutor, ...(opts.gateHost !== undefined ? { host: opts.gateHost } : {}) } } : {}),
+    ...(gatePodPool ? { releaseGatePodPool: gatePodPool.set.gatePodPool } : {}),
     deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
   return { tip, partial, state };
 }

package/scripts/release-loop/resume.ts

@@ -137,6 +137,28 @@ export interface GateExecutorOverride {
   previous: { gateExecutor: unknown; gateRemote: unknown };
 }
 
+/** RESUME-GATE-POOL-OVERRIDE — replace the saved pool for a gate that will be re-run. */
+export interface GatePodPoolOverride {
+  kind: 'gate-pod-pool';
+  at: string;
+  from: string;
+  set: { gatePodPool: string };
+  previous: { gatePodPool: unknown };
+}
+
+export function releaseResumeGatePodPool(state: GraphRunState, opts: { from: string; pool: unknown; at?: string }): GatePodPoolOverride {
+  const input = state.input;
+  if (!input || typeof input !== 'object' || Array.isArray(input) || typeof (input as { version?: unknown }).version !== 'string') throw new Error('release run has no input');
+  if (typeof opts.pool !== 'string' || !opts.pool.trim()) throw new Error('--gate-pod-pool must not be empty');
+  const start = state.path.indexOf(opts.from);
+  if (start < 0) throw new Error(`--from ${opts.from} is not a node on the saved path`);
+  const gate = state.path.indexOf('gate');
+  if (gate >= 0 && start > gate) throw new Error('--gate-pod-pool needs a resume that re-runs gate (--from gate or earlier)');
+  const saved = input as { gatePodPool?: unknown };
+  return { kind: 'gate-pod-pool', at: opts.at ?? new Date().toISOString(), from: opts.from,
+    set: { gatePodPool: opts.pool.trim() }, previous: { gatePodPool: saved.gatePodPool ?? null } };
+}
+
 /**
  * Switch the gate executor of a resumed release run. Not a waiver: the gate node runs again (the restart must be at or
  * before gate) and produces a normal verdict; only where its sweep runs changes.
@@ -156,7 +178,8 @@ export function releaseResumeGateExecutor(state: GraphRunState, opts: { from: st
   // A restart after gate keeps the recorded verdict — switching its executor there would record a choice nothing used.
   if (gate >= 0 && start > gate) throw new Error('--gate-executor needs a resume that re-runs gate (--from gate or earlier)');
   // Back to pod: restore the gateRemote the run started with (an earlier host override replaced it).
-  const firstHost = choice.executor === 'pod' ? state.inputOverrides?.find((item) => item.kind === 'gate-executor' && item.set.gateRemote !== undefined) : undefined;
+  const firstHost = choice.executor === 'pod' ? state.inputOverrides?.find((item): item is GateExecutorOverride =>
+    item.kind === 'gate-executor' && item.set.gateRemote !== undefined) : undefined;
   const restored = firstHost ? firstHost.previous.gateRemote : undefined;
   return {
     kind: 'gate-executor', at: opts.at ?? new Date().toISOString(), from: opts.from,

package/scripts/release-loop/tui-sim-node.ts

@@ -16,7 +16,7 @@ import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
 import { copyFileSync, existsSync, mkdtempSync, openSync, symlinkSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
-import { parseTuiRegress, regressWarning, tuiChecks, tuiVerdict, type TuiCheck, type TuiRegress } from './tui-node-checks';
+import { parseTuiRegress, regressWarning, tuiChecks, tuiVerdict, validatedTuiRegress, type TuiCheck, type TuiRegress } from './tui-node-checks';
 
 const log = (msg: string) => process.stderr.write(`[tui-node] ${msg}\n`);
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
@@ -83,7 +83,13 @@ export function measureTuiRegress(worktree: string, runner: typeof spawnSync = s
 export function tuiNodeOutput(commit: string, attempts: Array<{ checks: TuiCheck[]; png?: string }>, regress: TuiRegress, failure?: string) {
   const last = attempts.at(-1);
   const verdict = !last ? 'error' : tuiVerdict(last.checks) === 'fail' ? 'fail' : attempts.length > 1 ? 'flaky' : 'pass';
-  return { verdict, commit, attempts: attempts.length, checks: last?.checks ?? [], png: last?.png, regress, ...(failure ? { error: failure } : {}) };
+  const measured = validatedTuiRegress(regress);
+  const regressSummary = 'unmeasured' in measured
+    ? `regress unmeasured: ${measured.unmeasured}`
+    : `regress ${measured.pass} pass / ${measured.fail} fail${measured.fail ? ` (${measured.results.filter((r) => !r.ok).map((r) => r.id).join(',')})` : ''}`;
+  const checks = last?.checks ?? [];
+  const summary = `TUI ${verdict}: basic ${checks.filter((check) => check.pass).length}/${checks.length} · ${regressSummary}`;
+  return { verdict, summary, commit, attempts: attempts.length, checks, png: last?.png, regress: measured, ...(failure ? { error: failure } : {}) };
 }
 
 async function main(): Promise<number> {

package/scripts/release-loop/unattended-release.ts

@@ -10,6 +10,7 @@ import { isLandingFreezeRefusal, readLandingFreeze, LandingFrozenError } from '.
 import { debug } from '../../src/debug/log.js';
 import { runGraph, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
+import { ReleaseRunClaimConflict, findActiveReleaseRun } from '../../src/cli/release-single-flight.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { baseVersion, isStableVersion, nextPrereleaseVersion, type PrereleaseKind } from './release-version.js';
 import { publishAtError } from './publish-at.js';
@@ -19,6 +20,8 @@ const VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 const GRAPH = join(import.meta.dir, '../../graphs/release/release-loop.yaml');
 
 export interface ReleaseLoopConfig {
+  /** Mid-cycle full-gate rehearsal, hours before cut (default 12; 0 disables). */
+  rehearsalHardIntervalHours?: number;
   gatePodPool?: string;
   gatePodBunCache?: string;
   gatePodShards?: number;
@@ -138,7 +141,7 @@ export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDep
 
 /** Fail closed at the entry boundary, before any graph node can change a release. */
 export async function runUnattendedRelease(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps = {},
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // A dry run only builds the input and mutates nothing, so it neither creates nor waits on the OP-seat lock.
@@ -149,7 +152,7 @@ export async function runUnattendedRelease(
 }
 
 async function runUnattendedReleaseLocked(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
   deps: UnattendedReleaseDeps,
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
@@ -188,6 +191,9 @@ async function runUnattendedReleaseLocked(
   if (beforeGraph && !opts.forceFreeze) throw new LandingFrozenError(beforeGraph);
   // RELEASE-LEDGER-UNIVERSE: one universe for the run ledger, the release ledger and every node subprocess.
   const root = releaseRunUniverse({ root: deps.ledgerRoot });
+  // Resume and fresh runs share the OP-seat flock. Recheck under that flock so a
+  // resume that began after CLI preflight cannot slip between the ledger scan and graph start.
+  if (!opts.forceNew && findActiveReleaseRun(version, root)) throw new ReleaseRunClaimConflict();
   const state = await (deps.graph ?? runGraph)(GRAPH, { input, pinChildUniverse: true, deps: { root } });
   // A freeze switched on while the graph ran stops gate or publish inside it. Only a failed gate/publish node whose own
   // record is the freeze refusal is reported as the freeze; any other failure keeps its own reason.

package/src/acp/core-turn-bridge.ts

@@ -54,6 +54,7 @@ import { readOriginSessionMeta } from './origin-session-meta.js';
 import { isFactQuestion } from './fact-question.js';
 import { classifyTuiChatIntent, formatTuiRouteLine, isSeatOpsDirective, type TuiChatRoute } from '../core-turn/short-question.js';
 import { HARNESS_ROLE_ENV } from '../harness/harness-space.js';
+import { createReasoningThoughtBuffer } from './reasoning-thought-buffer.js';
 
 const FACT_QUESTION_INSTRUCTION = '사실·최신 정보 질문이다. WebSearch 를 1~2회 쓰고 검색 결과(제목·스니펫·URL)로 답하라. 출처 링크를 붙여라. 셸·브라우저·파일 도구는 검색 결과로 부족할 때만. 도구 예산에 닿으면 지금까지 근거로 답하고 끝에 «더 찾아볼까요?»를 붙여라.';
 
@@ -382,6 +383,16 @@ export function bridgeCoreTurnToAcp(
             return approvedDispatch(name, args, dispatchCtx);
           }
         : approvedDispatch;
+      // TUI-TURN-NARRATION 조각 2 — 추론 요약을 «문단» 단위로 모아 ACP `agent_thought_chunk`
+      //   (`_meta.reasoning: true`)로 보낸다. 대시보드가 흐린 💭 한 줄로 그린다(`acp-chat.ts`).
+      //   ⛔ 전에는 debug.log 로만 남아 화면엔 «무엇을 하는지»가 0줄이었다(결함 #87).
+      const reasoningThoughts = createReasoningThoughtBuffer((text) => {
+        debug.log('llm.reasoning', 'thought-emitted', { sessionId: turnCtx.sessionId, chars: text.length });
+        void turnCtx.pushSessionUpdate(
+          { sessionUpdate: 'agent_thought_chunk', content: { type: 'text', text } },
+          { reasoning: true },
+        );
+      });
       const dispatchResult = await runTurnDispatch({
         sessionId: turnCtx.sessionId,
         ...(originSessionId ? { originSessionId } : {}),
@@ -403,6 +414,7 @@ export function bridgeCoreTurnToAcp(
             // contract is synchronous onText. Chunks are delivered in
             // order because `sessionUpdate` is serialized per-
             // connection on the ACP SDK side.
+            if (delta.length > 0) reasoningThoughts.flush();
             streamedTextSum += delta;
             void turnCtx.push(delta);
           },
@@ -420,6 +432,7 @@ export function bridgeCoreTurnToAcp(
               toolKinds.add(call.name);
               observeToolBudget();
             }
+            reasoningThoughts.flush();
             void turnCtx.pushToolCall(call);
           },
           onToolResult: (call) => { void turnCtx.pushToolResult(call); },
@@ -435,15 +448,15 @@ export function bridgeCoreTurnToAcp(
               ...(resolvedRoute ? { routeProvider: resolvedRoute.provider } : {}),
             });
           },
-          // Codex Responses API reasoning summary stream. Currently
-          // surfaced via forensic only (debug.log) — acts as the
-          // "did the model actually emit reasoning?" verification
-          // signal before we wire the dashboard UI in a fast-follow.
+          // Codex Responses API reasoning summary stream. Surfaced to the
+          // dashboard as `agent_thought_chunk` via `reasoningThoughts`
+          // (TUI-TURN-NARRATION 조각 2) ⊕ the forensic debug.log below.
           // The forensic line carries the streamed delta and the
           // running summary index so a single grep gives the
           // reasoning trace in order. summary_part_added marks the
           // paragraph boundary; summary_delta is the text within.
           onReasoning: (event) => {
+            reasoningThoughts.onEvent(event);
             if (debug.enabled) {
               if (event.kind === 'summary_delta') {
                 debug.log('llm.reasoning', 'codex.summary.delta', {
@@ -459,6 +472,7 @@ export function bridgeCoreTurnToAcp(
             }
           },
           onTurnComplete: async (newMessages) => {
+            reasoningThoughts.flush();
             // Surface runtime-injected synthesis to ACP. emitTurnComplete
             // pushes the final assistant text (which may be the W5-E/F/G
             // force-synthesis output) into history. Compare to what was
@@ -592,7 +606,8 @@ export function bridgeCoreTurnToAcp(
             }
           },
         },
-      });
+      // 오류·취소로 끝나 onTurnComplete 가 안 불려도 마지막 추론 문단을 내보낸다(#28964 리뷰 FU-1 · 빈 버퍼면 무동작).
+      }).finally(() => reasoningThoughts.flush());
       // ⭐ 인증 거절은 코어 턴이 «던지지 않고» 돌려준다 — 여기서 안 읽으면 서버는 end_turn 을 내고
       //   TUI 엔 «✔ 완료»만 남는다(TUI 결함 #22). 던져서 실패 경로(prompt-failed · 오류 줄)로 보낸다.
       const stopReason = (dispatchResult as { stopReason?: unknown } | null | undefined)?.stopReason;

package/src/acp/reasoning-thought-buffer.ts

@@ -0,0 +1,45 @@
+// TUI-TURN-NARRATION 조각 2 — 추론 요약(reasoning summary)을 화면 한 줄로 낸다.
+//
+// 🩸 왜 있나 (결함 #87 · 2026-10-18): gpt-6 계열 TUI 턴은 도구 사이에 글을 0자 낸다
+//   (`llm.stream consume-end` `textChars=0`). 그런데 추론 요약은 라운드마다 24~37자씩 «온다»
+//   (`reasoningChars`). `core-turn-bridge` 의 `onReasoning` 이 debug.log 로만 남기고
+//   화면으로 안 보내서, 사용자는 «무엇을 하는지» 한 줄도 못 봤다.
+//   대시보드는 이미 `agent_thought_chunk` ⊕ `_meta.reasoning` 을 흐린 💭 줄로 그린다
+//   (`dashboard/chat/acp-chat.ts`) — 빠진 것은 «주는 자리» 하나였다.
+//
+// ⭐ 델타를 그대로 흘리지 않고 «문단» 단위로 모은다 — 델타마다 보내면 한 생각이 여러 줄로 찢긴다.
+//   문단 경계 = 다음 `summary_part_added` · 도구 호출 · 답 글 시작 · 턴 끝.
+
+export type ReasoningEvent =
+  | { kind: 'summary_part_added'; summaryIndex?: number }
+  | { kind: 'summary_delta'; delta: string; summaryIndex?: number };
+
+export interface ReasoningThoughtBuffer {
+  onEvent(event: ReasoningEvent): void;
+  /** 모은 문단을 내보낸다(비었으면 아무것도 안 한다). */
+  flush(): void;
+}
+
+/** 요약 문단은 짧다(실측 24~37자). 폭주 방어로만 자른다. */
+const MAX_THOUGHT_CHARS = 400;
+
+export function createReasoningThoughtBuffer(emit: (text: string) => void): ReasoningThoughtBuffer {
+  let buf = '';
+  const flush = (): void => {
+    const text = buf.trim();
+    buf = '';
+    if (text.length === 0) return;
+    emit(text.length > MAX_THOUGHT_CHARS ? `${text.slice(0, MAX_THOUGHT_CHARS)}…` : text);
+  };
+  return {
+    onEvent(event) {
+      if (event.kind === 'summary_part_added') {
+        flush();
+        return;
+      }
+      // 모으는 단계에서도 상한을 지킨다 — 문단 경계 없이 긴 스트림이 와도 버퍼가 무한히 크지 않게.
+      if (buf.length <= MAX_THOUGHT_CHARS) buf += event.delta.slice(0, MAX_THOUGHT_CHARS + 1 - buf.length);
+    },
+    flush,
+  };
+}

package/src/agent-substrate/acp-reviewer.ts

@@ -55,6 +55,9 @@ export interface AcpReviewerOpts {
  */
 export const DEFAULT_REVIEW_BACKEND = 'codex';
 
+/** Stable failureReason prefix carried through reviewPullRequest's fail-soft result. */
+export const GROK_ACP_REVIEW_TIMEOUT = 'ACP_REVIEW_TIMEOUT:grok:';
+
 // ACP ToolKind(zToolKind) 중 read-only(부작용 없음) — 리뷰어에게 허가할 계열.
 const READONLY_TOOL_KINDS = new Set(['read', 'search', 'fetch', 'think', 'switch_mode']);
 // 명시적 변경/실행 계열 — 리뷰(read-only)에선 절대 불허.
@@ -84,7 +87,7 @@ const TOOL_REVIEW_PREAMBLE = [
  *  - model 지정 시 selectSessionModel 로 tier 고정(picked 관측).
  *  - ⭐auto-allow permission approver — 리뷰어의 read-only 툴콜을 무조건 허가(대표 지시)해 Read 반복거부
  *    정체를 원천제거. 각 허가는 debug.log 로 각인(제1원칙 관측 관문 — 자동승인은 관측되는 결정).
- *  - timeout: 초과 시 cancel→throw. 오류/타임아웃은 각인 후 rethrow → reviewPullRequest 가 fail-soft
+ *  - timeout: 초과 시 실패를 확정하고 cancel·stop. 오류/타임아웃은 각인 후 rethrow → reviewPullRequest 가 fail-soft
  *    (reviewed=false)로 흡수, CLI 가 reviewed=false 를 "리뷰 실패"로 표면화(부분결과 오판 pass 방지). */
 export function makeAcpReviewLLM(opts: AcpReviewerOpts): (prompt: string, images?: readonly ReviewImage[]) => Promise<string> {
   return async (prompt: string, images?: readonly ReviewImage[]): Promise<string> => {
@@ -117,8 +120,13 @@ export function makeAcpReviewLLM(opts: AcpReviewerOpts): (prompt: string, images
       model: opts.model ?? '(default)',
       promptChars: prompt.length,
     });
+    const startedAt = Date.now();
+    let phase = 'spawn';
+    let phaseStartedAt = startedAt;
+    const enterPhase = (next: string): void => { phase = next; phaseStartedAt = Date.now(); };
     let allowed = 0;
     let denied = 0;
+    const observedToolCalls = new Set<string>();
     let capabilitiesObserved = false;
     const agentOpts: Omit<AcpAgentOpts, 'backendId'> = {
       cwd: opts.cwd,
@@ -149,10 +157,12 @@ export function makeAcpReviewLLM(opts: AcpReviewerOpts): (prompt: string, images
     };
     // A review owns its manager and subprocess: the global manager caches
     // chat agents, whose callbacks and lifecycle must not be mutated here.
-    const reviewManager = injected || opts.backendSpec ? undefined : new AcpAgentManager();
+    // Grok's start can hang before the manager registers the subprocess;
+    // own it directly so the handshake timeout can stop that child.
+    const directAgent = injected || Boolean(opts.backendSpec) || backend === 'grok';
+    const reviewManager = directAgent ? undefined : new AcpAgentManager();
     let agent: AcpAgent | undefined;
     let text = '';
-    let timedOut = false;
     let timer: ReturnType<typeof setTimeout> | undefined;
     const handshakeTimeoutMs = opts.handshakeTimeoutMs ?? Math.min(timeoutMs, 60_000);
     const handshakeDeadline = Date.now() + handshakeTimeoutMs;
@@ -165,9 +175,16 @@ export function makeAcpReviewLLM(opts: AcpReviewerOpts): (prompt: string, images
     })]).finally(() => { if (handshakeTimer) clearTimeout(handshakeTimer); });
     try {
       if (opts.createAgent) agent = opts.createAgent({ backendId: requestedBackend, ...agentOpts });
-      else if (opts.backendSpec) agent = new AcpAgent({ backendId: requestedBackend, ...agentOpts });
-      else agent = await withinHandshake(reviewManager!.getAgent(requestedBackend, agentOpts));
-      if (injected || opts.backendSpec) await withinHandshake(agent.start());
+      else if (directAgent) agent = new AcpAgent({ backendId: requestedBackend, ...agentOpts });
+      else {
+        // getAgent owns both spawn and initialize; neither step is independently observable here.
+        enterPhase('spawn-initialize');
+        agent = await withinHandshake(reviewManager!.getAgent(requestedBackend, agentOpts));
+      }
+      if (directAgent) {
+        enterPhase(injected ? 'initialize' : 'spawn-initialize');
+        await withinHandshake(agent.start());
+      }
       if (!capabilitiesObserved) {
         try {
           debug.log('acp-review', 'capabilities', {
@@ -181,12 +198,14 @@ export function makeAcpReviewLLM(opts: AcpReviewerOpts): (prompt: string, images
           // Observability must not interrupt a review.
         }
       }
+      enterPhase('session-new');
       const sid = await withinHandshake(agent.newSession());
       if (opts.model) {
+        enterPhase('model-select');
         const picked = await withinHandshake(agent.selectSessionModel(sid, opts.model));
         debug.log('acp-review', 'model', { requested: opts.model, picked: picked?.name ?? null, backend });
       }
-      timer = setTimeout(() => { timedOut = true; agent!.cancel(sid).catch(() => { /* noop */ }); }, timeoutMs);
+      enterPhase('prompt');
       // ⭐⭐ `P4b` 멀티미디어 — 이미지를 «별도 ContentBlock» 으로 싣는다.
       //   ⛔ 광고를 «먼저 본다** — 백엔드가 image 를 안 받는다고 말하면 안 보낸다. 보내 봐야
       //      거절이 이 층보다 훨씬 읽기 어려운 자리에서 나고, 그 거절은 리뷰 실패로 보인다.
@@ -211,23 +230,44 @@ export function makeAcpReviewLLM(opts: AcpReviewerOpts): (prompt: string, images
           // Observation must not prevent the review from running.
         }
       }
-      await agent.prompt(sid, [{ type: 'text', text: TOOL_REVIEW_PREAMBLE + prompt }, ...imageBlocks], (u) => {
+      const promptAttempt = agent.prompt(sid, [{ type: 'text', text: TOOL_REVIEW_PREAMBLE + prompt }, ...imageBlocks], (u) => {
+        if (u.sessionUpdate === 'tool_call' || u.sessionUpdate === 'tool_call_update') {
+          observedToolCalls.add(u.toolCallId);
+        }
         if (u.sessionUpdate === 'agent_message_chunk') {
           const c = u.content;
           if (c.type === 'text' && c.text) text += c.text;
         }
       });
-      if (timedOut) throw new Error(`ACP 리뷰 타임아웃(${timeoutMs}ms·툴콜 ${allowed})`);
+      // Do not rely on cancel causing prompt() to settle: a stalled ACP child may never answer it.
+      await Promise.race([promptAttempt, new Promise<never>((_, reject) => {
+        timer = setTimeout(() => {
+          // Commit the timeout before cancel can settle prompt with a partial response.
+          reject(new Error(backend === 'grok'
+            ? `${GROK_ACP_REVIEW_TIMEOUT} ${timeoutMs}ms·툴콜 ${observedToolCalls.size}`
+            : `ACP 리뷰 타임아웃(${timeoutMs}ms·툴콜 ${allowed})`));
+          void agent!.cancel(sid).catch(() => { /* noop */ });
+        }, timeoutMs);
+      })]);
     } catch (e) {
-      debug.log('acp-review', 'error', { backend, model: opts.model ?? '(default)', message: (e as Error).message }, { level: 'error' });
-      throw e;
+      const message = (e as Error).message;
+      const handshakeTimeout = message.startsWith('ACP handshake timeout (');
+      const failure = backend === 'grok' && handshakeTimeout
+        ? new Error(`${GROK_ACP_REVIEW_TIMEOUT} ${message}`) : e;
+      const timeout = message.startsWith(GROK_ACP_REVIEW_TIMEOUT) || message.startsWith('ACP 리뷰 타임아웃(') || handshakeTimeout;
+      debug.log('acp-review', 'error', {
+        backend, provider: backend, model: opts.model ?? '(default)', message: (failure as Error).message,
+        phase, elapsedMs: Date.now() - startedAt, phaseElapsedMs: Date.now() - phaseStartedAt,
+        toolCalls: observedToolCalls.size, allowed, denied, ...(timeout ? { classification: phase === 'prompt' && observedToolCalls.size === 0 ? 'pre-tool-timeout' : 'acp-timeout' } : {}),
+      }, { level: 'error' });
+      throw failure;
     } finally {
       if (timer) clearTimeout(timer);
       // Both paths are review-owned: injected agents retain their direct
       // cleanup seam, while the per-review manager releases its agents and
       // process hooks. An injected agent is external to the manager.
       try {
-        if (injected || opts.backendSpec) await agent?.stop();
+        if (directAgent) await agent?.stop();
         else await reviewManager!.dispose();
       } catch (e) {
         debug.log('acp-review', 'stop-fail', { backend, message: (e as Error).message }, { level: 'error' });