elanous 0.2.35 → 0.2.36

package/scripts/release-loop/node-verdict.ts

@@ -9,6 +9,7 @@ export type NodeVerdict = 'pass' | 'flaky' | 'fail';
 export interface GraphContext {
   nodeId?: string;
   runId?: string;
+  startedAt?: string;
   input: { version: string; previousVersion: string; [key: string]: unknown };
   outputs: Record<string, Record<string, unknown>>;
 }
@@ -24,6 +25,7 @@ export function readGraphContext(env: NodeJS.ProcessEnv = process.env): GraphCon
     || typeof input.previousVersion !== 'string' || !/^\d+\.\d+\.\d+$/.test(input.previousVersion)) throw new Error('version and previousVersion required');
   return { ...(typeof context.nodeId === 'string' ? { nodeId: context.nodeId } : {}),
     ...(typeof context.runId === 'string' ? { runId: context.runId } : {}),
+    ...(typeof context.startedAt === 'string' ? { startedAt: context.startedAt } : {}),
     input: input as GraphContext['input'], outputs: context.outputs && typeof context.outputs === 'object' ? context.outputs as GraphContext['outputs'] : {} };
 }
 

package/scripts/release-loop/resume-cap.ts

@@ -1,56 +1,36 @@
 import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { DecisionLedger } from '../../src/decisions/decision-ledger.js';
 import type { GraphRunState } from '../../src/graph-runner/runner.js';
 import { isReleaseVersion } from './release-version.js';
 
-export const RELEASE_RESUME_LIMIT = 2;
-
 /** Called under the OP seat flock, before any branch-tip or graph-run mutation. */
 export function reserveReleaseResumeAttempt(state: GraphRunState, root: string, options: {
   now?: () => Date;
-  openCard?: (version: string, runId: string, reason: string) => string;
-  /** Under the OP flock, check capacity before tip preflight without consuming an attempt. */
+  /** Under the OP flock, preview the next observed count before tip preflight. */
   checkOnly?: boolean;
-  /** A dry-run reports the cap without creating an OP decision card. */
-  noDecision?: boolean;
-} = {}): { attempt: number; path: string } {
+} = {}): { attempt: number; path: string; priorCountKnown: boolean } {
   const version = (state.input as { version?: unknown } | undefined)?.version;
   if (typeof version !== 'string' || !isReleaseVersion(version) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(state.runId))
-    throw new Error('release resume cap requires a valid saved version and run id');
+    throw new Error('release resume count requires a valid saved version and run id');
   const path = join(root, 'release', version, 'resume-attempts', `${state.runId}.json`);
-  const card = options.openCard ?? ((v: string, id: string, reason: string) => {
-    const ref = `release-resume-cap:${v}:${id}`;
-    return new DecisionLedger({ stateDir: root, now: options.now }).raiseOnce({
-      title: `${v} release resume limit: ${id}`, category: 'scope',
-      scqa: { s: `Release ${v} run ${id} has reached its two-resume limit.`, c: reason,
-        q: 'Should this release be deferred or moved to the next version?' },
-      options: [{ key: 'a', label: 'Defer this release', consequence: 'Stop this run and reschedule the release.' },
-        { key: 'b', label: 'Move to next version', consequence: 'Stop this run and carry the work to a new release.' }],
-      recommendation: { skipped: true, reason: 'OP must choose the release disposition.' },
-      raisedBy: { agent: 'release-resume-cap', track: 'TC' }, refs: [ref],
-    }, ref).id;
-  });
-  const blocked = (reason: string): never => {
-    if (options.noDecision) throw new Error(`release resume limit reached: ${reason}`);
-    throw new Error(`release resume limit reached — decision ${card(version, state.runId, reason)}: ${reason}`);
-  };
-  if (options.noDecision && !options.checkOnly) throw new Error('noDecision requires checkOnly');
-  if (!existsSync(path) && state.resume) blocked('saved run was resumed before attempt counting; prior count is unknown');
-  const prior = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) as unknown : { version, runId: state.runId, attempts: [] };
+  const hadLedger = existsSync(path);
+  const prior = hadLedger ? JSON.parse(readFileSync(path, 'utf8')) as unknown : { version, runId: state.runId, attempts: [] };
   if (!prior || typeof prior !== 'object' || Array.isArray(prior)) throw new Error('release resume attempts ledger invalid');
-  const saved = prior as { version?: unknown; runId?: unknown; attempts?: unknown };
+  const saved = prior as { version?: unknown; runId?: unknown; attempts?: unknown; priorCountKnown?: unknown };
   if (saved.version !== version || saved.runId !== state.runId || !Array.isArray(saved.attempts)
-    || saved.attempts.some(value => typeof value !== 'string' || !Number.isFinite(Date.parse(value))))
+    || saved.attempts.some(value => typeof value !== 'string' || !Number.isFinite(Date.parse(value)))
+    || (saved.priorCountKnown !== undefined && typeof saved.priorCountKnown !== 'boolean'))
     throw new Error('release resume attempts ledger invalid');
-  if (saved.attempts.length >= RELEASE_RESUME_LIMIT) blocked(`${saved.attempts.length} resumes already recorded`);
-  if (options.checkOnly) return { attempt: saved.attempts.length + 1, path };
+  // Existing ledgers predate this field and began before the first resume.
+  // A legacy resumed run with no ledger must carry its unknown history forward.
+  const priorCountKnown = hadLedger ? saved.priorCountKnown !== false : !state.resume;
+  if (options.checkOnly) return { attempt: saved.attempts.length + 1, path, priorCountKnown };
   const at = (options.now ?? (() => new Date()))().toISOString();
-  const next = { version, runId: state.runId, attempts: [...saved.attempts, at] };
+  const next = { version, runId: state.runId, priorCountKnown, attempts: [...saved.attempts, at] };
   mkdirSync(dirname(path), { recursive: true });
   const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
   try { writeFileSync(temp, `${JSON.stringify(next)}\n`, { mode: 0o600 }); renameSync(temp, path); }
   finally { try { unlinkSync(temp); } catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; } }
-  return { attempt: next.attempts.length, path };
+  return { attempt: next.attempts.length, path, priorCountKnown };
 }

package/scripts/release-loop/resume-release.ts

@@ -2,11 +2,12 @@
 // The saved version-release output is re-pointed at the new branch tip (fast-forward only, state backed up first), so
 // every later node reads the repaired commit without anyone hand-editing the run state.
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { constants, copyFileSync, existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
-import { lastJsonObject, runGraph, verifyReleaseCommandRoot, type GraphRunState } from '../../src/graph-runner/runner.js';
+import { lastJsonObject, runGraph, verifyReleaseCommandRoot, verifyReleaseRecipeSnapshot, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
@@ -47,7 +48,7 @@ export interface ResumeReleaseOptions {
 export interface ResumeReleasePlan {
   runId: string; version: string; fromNode: string; commandRoot: string; tip: TipRefresh;
   partial: PartialOutcome; gatePlan: { mode: 'not-run' | 'partial' | 'full'; reason?: string };
-  nextAttempt: number; attemptLimit: 2; preflight: 'passed';
+  nextAttempt: number; priorCountKnown: boolean; preflight: 'passed';
 }
 
 /** CLI entry files: a production file that only names one (help text, a goal's command line) does not run it. */
@@ -84,7 +85,7 @@ export function refreshReleaseBranchTip(runId: string, deps: ResumeReleaseDeps =
   return refreshReleaseBranchTipInternal(runId, deps, from, waiverCommit, false);
 }
 
-function refreshReleaseBranchTipInternal(runId: string, deps: ResumeReleaseDeps, from: string | undefined, waiverCommit: string | undefined, dryRun: boolean): TipRefresh {
+function refreshReleaseBranchTipInternal(runId: string, deps: ResumeReleaseDeps, from: string | undefined, waiverCommit: string | undefined, dryRun: boolean, expectedTip?: string): TipRefresh {
   const root = deps.root ?? effectiveInstanceRoot();
   const statePath = join(root, 'graph-runs', 'release-loop', `${safeRunId(runId)}.json`);
   const state = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
@@ -108,6 +109,7 @@ function refreshReleaseBranchTipInternal(runId: string, deps: ResumeReleaseDeps,
   const git = deps.git ?? gitRunner(deps.repo ?? process.cwd());
   const advertised = git(['ls-remote', '--heads', 'origin', `refs/heads/${branch}`]).split(/\s+/)[0] ?? '';
   if (!/^[0-9a-f]{40}$/i.test(advertised)) throw new Error(`${branch} is not on origin — this run was not cut as a release branch`);
+  if (expectedTip && advertised.toLowerCase() !== expectedTip.toLowerCase()) throw new Error(`${branch} moved during pin preflight (${expectedTip} → ${advertised}) — retry resume`);
   let to: string;
   if (dryRun) {
     // Use the advertised object id directly: a preflight must not create/update local remote-tracking refs.
@@ -152,6 +154,26 @@ function refreshReleaseBranchTipInternal(runId: string, deps: ResumeReleaseDeps,
   return { version, branch, from: recorded, to, changed: true, statePath, backup };
 }
 
+/** Check the saved graph and recipes before fetch, backup, or run-ledger writes. */
+function verifyResumeRecipePin(commandRoot: string, snapshot: GraphRunState['graphSnapshot'], version: string): void {
+  try { verifyReleaseRecipeSnapshot(commandRoot, snapshot); }
+  catch (error) {
+    if (!snapshot) throw error;
+    const mismatches: string[] = [];
+    for (const [name, savedSha] of [
+      ['release-loop.yaml', snapshot.graphSha], ['recipes.yaml', snapshot.recipesSha],
+    ] as const) {
+      const file = join(commandRoot, 'graphs', 'release', name);
+      let currentSha: string;
+      try { currentSha = createHash('sha256').update(readFileSync(file)).digest('hex'); }
+      catch { continue; }
+      if (currentSha !== savedSha) mismatches.push(`${file} saved=${savedSha} current=${currentSha}`);
+    }
+    if (!mismatches.length) throw error;
+    throw new Error(`release recipe source differs from saved pin: ${mismatches.join('; ')}\nremedy: start a new pinned run with eln release run --version ${version}`, { cause: error });
+  }
+}
+
 /** GATE-PARTIAL outcome of a resume — applied (plan written) or the reason it fell back to a full gate. `auto` marks the
  *  default plan of `--from gate` (GATE-REUSE-BY-DIFF); `closure` is set when code changes were followed. */
 export type PartialOutcome = { requested: false }
@@ -318,7 +340,7 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
   const waiver = original && (opts.waive !== undefined || opts.reason !== undefined) ? releaseResumeWaiver(original, opts) : undefined;
   if (original && opts.acceptedRegressions !== undefined && !waiver)
     releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from);
-  const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true, noDecision: true });
+  const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true });
   let waiverCommit: string | undefined;
   if (waiver) {
     const output = lastJsonObject(savedRun.nodes.find((node) => node.nodeId === 'version-release')?.output);
@@ -331,6 +353,7 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
     waiverCommit = recorded;
   }
   const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  verifyResumeRecipePin(opts.commandRoot ?? process.cwd(), savedRun.graphSnapshot, tip.version);
   const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
   const partial = preparePartial(tip, opts, deps, true);
   const fromIndex = savedRun.path.indexOf(opts.from);
@@ -340,7 +363,7 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
     : partial.requested && partial.applied ? { mode: 'partial' as const }
       : { mode: 'full' as const, reason: partial.requested ? partial.reason : opts.partial === false ? 'partial recheck disabled' : 'no partial plan applies' };
   return { runId: opts.runId, version: tip.version, fromNode: opts.from, commandRoot, tip, partial,
-    gatePlan, nextAttempt: attempt.attempt, attemptLimit: 2, preflight: 'passed' };
+    gatePlan, nextAttempt: attempt.attempt, priorCountKnown: attempt.priorCountKnown, preflight: 'passed' };
 }
 
 async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeReleaseDeps): Promise<{ tip: TipRefresh; partial: PartialOutcome; state: GraphRunState }> {
@@ -368,7 +391,7 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
   const acceptedRegressions = original && opts.acceptedRegressions !== undefined && !waiver
     ? releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from) : undefined;
   if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
-  // Validate request arguments before the cap, then block the third attempt before tip refresh.
+  // Validate request arguments before the tip refresh; the count is observational.
   reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now, checkOnly: true });
   // A waived verdict may reuse its original commit. A moved tip still requires a full re-gate.
   if (waiver) {
@@ -383,13 +406,16 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
     if (advertised?.toLowerCase() !== recorded.toLowerCase()) throw new Error('release branch moved — re-gate the new tip before waiving a node');
     waiverCommit = recorded;
   }
-  // Check the refreshed tip before refresh writes a new version-release record or backup.
-  const tip = refreshReleaseBranchTip(opts.runId, deps, opts.from, waiverCommit);
-  const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
+  // The read-only tip and recipe pin preflight must pass before fetch or a saved-run rewrite.
+  const previewTip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  verifyResumeRecipePin(opts.commandRoot ?? process.cwd(), savedRun.graphSnapshot, previewTip.version);
+  const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), previewTip.to, deps.git);
+  const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, false, previewTip.to);
   const partial = preparePartial(tip, opts, deps);
-  // A failed preflight does not consume one of the two release resume attempts.
+  // A failed preflight does not consume an observed release resume attempt.
   const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now });
-  debug.log('release-loop.resume', 'attempt', { runId: opts.runId, attempt: attempt.attempt, limit: 2, ledger: attempt.path });
+  debug.log('release-loop.resume', 'attempt', { runId: opts.runId, attempt: attempt.attempt,
+    priorCountKnown: attempt.priorCountKnown, ledger: attempt.path });
   // Resume the graph at the path it was started from (its snapshot is used); only tests inject another path.
   const graphPath = deps.graphPath ?? savedGraphPath(tip.statePath) ?? GRAPH;
   const savedSource = JSON.parse(readFileSync(tip.statePath, 'utf8')) as GraphRunState;

package/scripts/release-loop/traffic-node.ts

@@ -0,0 +1,59 @@
+#!/usr/bin/env bun
+import { spawnSync } from 'node:child_process';
+import { debug } from '../../src/debug/log.js';
+import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
+import { releaseLoopConfig } from './unattended-release.js';
+import { errorResult, finishNode, readGraphContext } from './node-verdict.js';
+import { applyReleaseTrafficEvent, trafficOptionsFromConfig, type ReleaseTrafficEvent, type TrafficTransitionOptions } from './traffic-transition.js';
+
+const EVENTS: Record<string, ReleaseTrafficEvent> = {
+  'traffic-gate-passed': 'gate-passed',
+  'traffic-verify-complete': 'verify-complete',
+};
+
+export interface TrafficNodeDeps {
+  options?: TrafficTransitionOptions;
+  report?: (body: string) => void;
+}
+
+function reportFailure(body: string): void {
+  const result = spawnSync('eln', ['msg', 'post', '--from', 'MK', '--to', 'OP', '--kind', 'report', '--body', body], { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  if (result.status !== 0 || result.error) process.stderr.write(`traffic OP mail failed: ${result.stderr || result.error || result.status}\n`);
+}
+
+/** Traffic transitions are warning-only for the release graph, but their node result remains truthful. */
+export async function runTrafficNode(node = process.argv[2], env: NodeJS.ProcessEnv = process.env, deps: TrafficNodeDeps = {}): Promise<number> {
+  let version = '';
+  let runId = '';
+  try {
+    const context = readGraphContext(env);
+    version = context.input.version;
+    runId = context.runId ?? '';
+    const event = EVENTS[node ?? ''];
+    if (!event || context.nodeId !== node) throw new Error(`traffic node context mismatch: ${node ?? 'missing'}`);
+    const options = deps.options ?? trafficOptionsFromConfig(env, releaseLoopConfig());
+    if (!options.trafficFile) {
+      const summary = `traffic-file-unset: ${event} skipped because trafficFile is not configured`;
+      debug.log('release-loop.traffic', 'traffic-file-unset', { runId, version, event, node, reason: summary });
+      (deps.report ?? reportFailure)(`RELEASE-POSTPUB-TRAFFIC ${version} ${runId || 'unknown'} ${node} ${summary}. Release traffic was not changed.`);
+      return finishNode(node!, version, { outcome: 'fail', verdict: 'fail', summary });
+    }
+    const result = await applyReleaseTrafficEvent(context, event, options);
+    if (!result.applied) {
+      const consequence = event === 'verify-complete'
+        ? '릴리스 검증은 성공했으나 트래픽 복귀가 적용되지 않았습니다.'
+        : 'gate는 성공했으나 트래픽 감속이 적용되지 않았습니다.';
+      (deps.report ?? reportFailure)(`RELEASE-POSTPUB-TRAFFIC ${version} ${runId || 'unknown'} ${node} 무시 — ${result.reason ?? 'traffic state unchanged'}. ${consequence}`);
+    }
+    return finishNode(node!, version, { outcome: 'ok', verdict: 'pass', summary: `${event} ${result.applied ? 'applied' : result.reason ?? 'ignored'}` });
+  } catch (error) {
+    const detail = errorResult(error).summary;
+    const isLockTimeout = detail.startsWith('traffic lock timeout:');
+    const failure = isLockTimeout ? `traffic-lock-timeout · stale 의심 경로 ${detail.slice('traffic lock timeout:'.length).trim()}` : detail;
+    debug.log('release-loop.traffic', 'non-blocking-failure', { node: node ?? 'missing', version, reason: detail });
+    (deps.report ?? reportFailure)(`RELEASE-POSTPUB-TRAFFIC ${version || 'unknown'} ${runId || 'unknown'} ${node ?? 'unknown'} 실패 — ${failure}. 릴리스 판정은 계속 진행한다.`);
+    return finishNode(node ?? 'traffic', version, { outcome: 'fail', verdict: 'fail', summary: `traffic transition failed; release graph continues with warning: ${failure}` });
+  }
+}
+
+if (import.meta.main) process.exitCode = await runTrafficNode();

package/scripts/release-loop/traffic-transition.ts

@@ -0,0 +1,159 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import type { GraphContext } from './node-verdict.js';
+import type { ReleaseLoopConfig } from './unattended-release.js';
+
+export type ReleaseTrafficEvent = 'gate-passed' | 'verify-complete';
+
+export interface TrafficFile {
+  global?: string;
+  seats: Record<string, Record<string, unknown>>;
+  releaseLifecycle?: { runId: string; version: string; stage: 1 | 2; event: ReleaseTrafficEvent; startedAt?: string; updatedAt: string };
+  [key: string]: unknown;
+}
+
+type ReleaseTrafficConfig = ReleaseLoopConfig & {
+  trafficFile?: string;
+};
+
+const SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+const STAGE: Record<ReleaseTrafficEvent, 1 | 2> = { 'gate-passed': 1, 'verify-complete': 2 };
+const TRAFFIC_PER_CYCLE = { half: 3, full: 6 } as const;
+
+export interface TrafficTransitionOptions {
+  trafficFile?: string;
+  lockTimeoutMs?: number;
+  now?: () => Date;
+  log?: (event: string, fields: Record<string, unknown>) => void;
+}
+
+function waitSync(ms: number): void {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function acquireTrafficLock(path: string, timeoutMs = 10_000): () => void {
+  const lock = `${path}.lock.d`;
+  const deadline = Date.now() + timeoutMs;
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      mkdirSync(lock);
+      try { writeFileSync(`${lock}/pid`, `${process.pid}\n`, { flag: 'wx', mode: 0o600 }); }
+      catch (error) { rmSync(lock, { recursive: true, force: true }); throw error; }
+      return () => rmSync(lock, { recursive: true, force: true });
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      try {
+        // A directory cannot be conditionally renamed by identity. Reclaiming after
+        // checking its PID can therefore move a replacement owner's live lock.
+        // Fail closed; OP can inspect and remove a stale lock after the warning mail.
+        readFileSync(`${lock}/pid`, 'utf8');
+        statSync(lock);
+      } catch { /* Unknown or concurrently changing locks are left intact. */ }
+      if (Date.now() >= deadline) throw new Error(`traffic lock timeout: ${lock}`);
+      waitSync(100);
+    }
+  }
+}
+
+function readTrafficFile(path: string): TrafficFile {
+  const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('traffic file must contain a JSON object');
+  const file = parsed as TrafficFile;
+  if (!file.seats || typeof file.seats !== 'object' || Array.isArray(file.seats)
+    || !SEATS.every((seat) => file.seats[seat] && typeof file.seats[seat] === 'object' && !Array.isArray(file.seats[seat]))) {
+    throw new Error('traffic seats object missing');
+  }
+  return file;
+}
+
+function atomicWriteTrafficFile(path: string, file: TrafficFile): void {
+  const temp = `${path}.tmp.${process.pid}.${Date.now()}`;
+  const mode = statSync(path).mode & 0o777;
+  try {
+    writeFileSync(temp, `${JSON.stringify(file, null, 2)}\n`, { flag: 'wx', mode });
+    renameSync(temp, path);
+  } catch (error) {
+    rmSync(temp, { force: true });
+    throw error;
+  }
+}
+
+function compareReleaseVersions(left: string, right: string): number {
+  const parse = (value: string) => /^(\d+)\.(\d+)\.(\d+)(?:-(alpha|beta|rc)\.(\d+))?$/.exec(value);
+  const a = parse(left), b = parse(right);
+  if (!a || !b) return left.localeCompare(right);
+  for (const index of [1, 2, 3]) {
+    const delta = Number(a[index]) - Number(b[index]);
+    if (delta) return Math.sign(delta);
+  }
+  if (!a[4] || !b[4]) return a[4] ? -1 : b[4] ? 1 : 0;
+  const rank = { alpha: 0, beta: 1, rc: 2 } as const;
+  const kind = rank[a[4] as keyof typeof rank] - rank[b[4] as keyof typeof rank];
+  return kind || Math.sign(Number(a[5]) - Number(b[5]));
+}
+
+function isLaterRun(current: string | undefined, previous: string | undefined): boolean {
+  return Boolean(current && previous && current > previous);
+}
+
+/** Apply one monotonic release graph event while preserving unrelated traffic policy fields. */
+export async function applyReleaseTrafficEvent(
+  context: GraphContext,
+  event: ReleaseTrafficEvent,
+  options: TrafficTransitionOptions,
+): Promise<{ applied: boolean; stage: number; reason?: string }> {
+  if (!context.runId) throw new Error('release traffic event requires graph runId');
+  if (!options.trafficFile) throw new Error('traffic file path is not configured');
+  const runId = context.runId;
+  const version = context.input.version;
+  const path = resolve(options.trafficFile);
+  if (!existsSync(path)) throw new Error(`traffic file does not exist: ${path}`);
+  const log = options.log ?? ((name, fields) => debug.log('release-loop.traffic', name, fields));
+  const stage = STAGE[event];
+  const stamp = (options.now ?? (() => new Date()))().toISOString();
+  const rate = event === 'gate-passed' ? TRAFFIC_PER_CYCLE.half : TRAFFIC_PER_CYCLE.full;
+  const releaseLifecycle = { runId, version, stage, event, ...(context.startedAt ? { startedAt: context.startedAt } : {}), updatedAt: stamp };
+  const release = () => {
+    const unlock = acquireTrafficLock(path, options.lockTimeoutMs);
+    try {
+      const before = readTrafficFile(path);
+      const prior = before.releaseLifecycle;
+      const sameRun = prior?.runId === runId;
+      const newerVersion = !prior?.runId || compareReleaseVersions(version, prior.version) > 0;
+      const sameVersionLaterRun = prior?.version === version && isLaterRun(context.startedAt, prior.startedAt);
+      if (sameRun && prior.stage >= stage) return { file: before, applied: true, idempotent: true };
+      const permitted = sameRun
+        ? prior.stage === stage - 1
+        : newerVersion || (event === 'gate-passed' && prior?.version === version && (prior.stage ?? 0) < 2 && sameVersionLaterRun)
+          || (event === 'verify-complete' && prior?.version === version && sameVersionLaterRun);
+      if (!permitted) {
+        return { file: before, applied: false, idempotent: false, reason: prior?.runId && prior.runId !== runId ? 'different-run-is-current' : 'event-out-of-order' };
+      }
+      const after: TrafficFile = {
+        ...before,
+        ...(event === 'verify-complete' ? { global: 'green' } : {}),
+        seats: Object.fromEntries(Object.entries(before.seats).map(([seat, value]) => [
+          seat, SEATS.includes(seat as typeof SEATS[number]) ? { ...value, perCycle: rate } : value,
+        ])),
+        releaseLifecycle,
+      };
+      atomicWriteTrafficFile(path, after);
+      return { file: after, applied: true, idempotent: false };
+    } finally { unlock(); }
+  };
+  const result = release();
+  const reason = result.applied && result.idempotent ? 'already-applied' : result.reason;
+  log(result.idempotent ? 'already-applied' : result.applied ? 'applied' : 'ignored', {
+    runId, version, event, stage, reason, perCycle: rate, ...(event === 'verify-complete' ? { global: 'green' } : {}),
+  });
+  return { applied: result.applied, stage: result.file.releaseLifecycle?.stage ?? 0, ...(reason ? { reason } : {}) };
+}
+
+export function trafficOptionsFromConfig(env: NodeJS.ProcessEnv = process.env, rawConfig: ReleaseLoopConfig = {}): TrafficTransitionOptions {
+  const config = rawConfig as ReleaseTrafficConfig;
+  const envTrafficFile = env.ELANOUS_RELEASE_TRAFFIC_FILE?.trim();
+  const configTrafficFile = typeof config.trafficFile === 'string' ? config.trafficFile.trim() : undefined;
+  const trafficFile = envTrafficFile || configTrafficFile;
+  return trafficFile ? { trafficFile } : {};
+}

package/scripts/rhythm/daily.ts

@@ -15,7 +15,10 @@ import { loopEvent } from '../../src/loops/observe.js';
 import { kindRouteTarget, mainHomeTarget } from '../../src/domains/telegram-kind-route.js';
 import { recordOutbound } from '../../src/domains/outbound-alert.js';
 import { listSelfDevRuns, runSummaryLine, selfDevRunsDir } from '../../src/self-dev/run-store.js';
-import { runDraftSweep } from '../../src/self-dev/draft-sweep.js';
+import { runDraftSweep, sweptReasonLabel } from '../../src/self-dev/draft-sweep.js';
+import { LogStore } from '../../src/mss/logging/log-store.js';
+import { BriefItemsLedger } from '../../src/briefing/brief-items.js';
+import { debug } from '../../src/debug/log.js';
 import { retroBriefingLines } from '../../src/retro/daily.js';
 import { dispatchCooAdmin } from '../../src/domains/coo-admin-tool.js';
 
@@ -76,6 +79,133 @@ export function collectRunSummaries(now: Date, root = effectiveInstanceRoot(), l
       prNumbers }));
 }
 
+/**
+ * DRAFT-SWEEP-DAILY-SUMMARY — 닫힌 draft 사유를 «하루 한 번 브리핑 원장 1건» 으로 적는다.
+ * 사유의 정본은 DRAFT-SWEEP-QUIET 이 닫을 때 남기는 `closed` 로그(PR 댓글 0 계약은 그쪽이 지킨다)이고,
+ * 이 경로는 로그 원장 «읽기» ⊕ 브리핑 원장 «쓰기» 만 한다 — GitHub 에 아무것도 쓰지 않는다.
+ */
+export const DRAFT_CLOSE_BRIEF_SOURCE = 'rhythm.daily.draft-close';
+/** DRAFT-SWEEP-QUIET 가 닫힌 draft마다 남기는 로그 — 사유의 정본 좌표. */
+const SWEPT_DRAFT_LOG = { category: 'self-dev.draft-sweep', event: 'closed' } as const;
+const SWEPT_LABEL_PREFIX = 'elanous:swept:';
+
+export type ClosedDraftReason = { reason: string; count: number };
+export type ClosedDraftCount = { closed: number; reasons: ClosedDraftReason[]; unreadable: number };
+export type DraftCloseSummary = {
+  /** 요약이 다루는 날짜(어제, KST). */
+  day: string;
+  closed: number;
+  reasons: ClosedDraftReason[];
+  /** 브리핑 원장에 실린 한 줄 — 표본이 없으면 null. */
+  text: string | null;
+  state: 'recorded' | 'already-recorded' | 'unmeasured' | 'unreadable';
+  /** 미측정·실패 사유(한 줄). */
+  detail?: string;
+  itemId?: number;
+};
+
+/** `closed` 로그 한 줄의 `{ reason }` — Pod 전달 래퍼(`originalData`)도 벗긴다. 못 읽으면 null. */
+function closedLogReason(data: string | null): string | null {
+  if (typeof data !== 'string' || !data.trim()) return null;
+  let payload: unknown;
+  try { payload = JSON.parse(data); } catch { return null; }
+  let body = record(payload);
+  const forwarded = body.originalData;
+  if (forwarded !== undefined) {
+    if (typeof forwarded !== 'string') body = record(forwarded);
+    else { try { body = record(JSON.parse(forwarded)); } catch { return null; } }
+  }
+  const reason = string(body.reason).trim();
+  return reason ? shortReason(reason) : null;
+}
+
+/** 사유를 DRAFT-SWEEP-QUIET 의 사유 종류로 접는다(`superseded-by #24123` → `superseded-by`). */
+export function sweptReasonKind(reason: string): string {
+  const label = sweptReasonLabel(reason);
+  return label.startsWith(SWEPT_LABEL_PREFIX) ? label.slice(SWEPT_LABEL_PREFIX.length) : label;
+}
+
+/**
+ * 어제(KST 00:00–24:00) 닫힌 draft 사유를 로그 원장에서 센다.
+ * ⛔ 원장이 없거나 못 읽으면 null — «0건»이 아니라 «미측정»이다.
+ */
+export function collectClosedDrafts(root: string, now: Date): ClosedDraftCount | null {
+  const path = join(root, 'logs', 'logs.db');
+  if (!existsSync(path)) return null;
+  const from = new Date(`${kstDay(new Date(now.getTime() - 86_400_000))}T00:00:00+09:00`);
+  const store = LogStore.openReadOnly(path);
+  try {
+    const rows = store.queryAll({ exactCategories: [SWEPT_DRAFT_LOG.category], events: [SWEPT_DRAFT_LOG.event],
+      sinceMs: from.getTime(), untilMs: from.getTime() + 86_400_000 - 1 });
+    const counts = new Map<string, number>();
+    let unreadable = 0;
+    for (const row of rows) {
+      const reason = closedLogReason(row.data);
+      if (reason === null) { unreadable += 1; continue; }
+      const kind = sweptReasonKind(reason);
+      counts.set(kind, (counts.get(kind) ?? 0) + 1);
+    }
+    return { closed: [...counts.values()].reduce((sum, count) => sum + count, 0),
+      reasons: [...counts].map(([reason, count]) => ({ reason, count }))
+        .sort((a, b) => b.count - a.count || sortNames(a.reason, b.reason)),
+      unreadable };
+  } finally { store.close(); }
+}
+
+/** 브리핑 한 줄 — 사유 종류별 건수, 상위 5종만 적고 나머지는 «외 N종» 으로 접는다. */
+export function composeDraftCloseSummaryText(reasons: readonly ClosedDraftReason[]): string {
+  const total = reasons.reduce((sum, item) => sum + item.count, 0);
+  const shown = reasons.slice(0, 5).map(item => `${item.reason} ${item.count}`).join(' · ');
+  const omitted = Math.max(0, reasons.length - 5);
+  return `어제 닫힌 draft ${total}건${shown ? ` — ${shown}` : ''}${omitted > 0 ? ` · 외 ${omitted}종` : ''}`;
+}
+
+/**
+ * 어제 닫힌 draft 사유를 브리핑 원장(`<state>/briefing/items.sqlite`, `eln brief`)에 **하루 1건** 으로 적는다.
+ * 표본이 없거나 원장을 못 읽으면 아무것도 쓰지 않고 `unmeasured`/`unreadable` 로 남긴다(«0건»으로 적지 않는다).
+ * 관측은 `deps.log`(루프 tick 전용)가 아니라 로그에 직접 남긴다 — 데일리 tick 의 의미를 바꾸지 않는다.
+ */
+export function recordDraftCloseSummary(root: string, now: Date,
+  log: (category: string, event: string, data?: unknown) => void = (category, event, data) => debug.log(category, event, data),
+): DraftCloseSummary {
+  const observe = (summary: DraftCloseSummary): DraftCloseSummary => {
+    try {
+      log('rhythm.daily', 'draft-close-summary', { day: summary.day, closed: summary.closed, state: summary.state,
+        reasons: summary.reasons.map(item => `${item.reason} ${item.count}`).join(' · '),
+        ...(summary.detail ? { detail: summary.detail } : {}), ...(summary.itemId === undefined ? {} : { itemId: summary.itemId }) });
+    } catch { /* 관측 실패가 브리핑을 막지 않는다 */ }
+    return summary;
+  };
+  const day = kstDay(new Date(now.getTime() - 86_400_000));
+  let counted: ClosedDraftCount | null;
+  try { counted = collectClosedDrafts(root, now); }
+  catch (error) { return observe({ day, closed: 0, reasons: [], text: null, state: 'unreadable',
+    detail: shortReason(`로그 원장 못 읽음 · ${reasonOf(error)}`) }); }
+  if (counted === null) return observe({ day, closed: 0, reasons: [], text: null, state: 'unmeasured', detail: '로그 원장 없음' });
+  if (counted.closed === 0) return observe({ day, closed: 0, reasons: [], text: null, state: 'unmeasured',
+    detail: counted.unreadable > 0 ? `사유 못 읽은 closed 로그 ${counted.unreadable}건` : '닫힌 draft 없음' });
+  // 사유를 못 읽은 closed 로그가 섞이면 읽힌 건수만으로 닫힘 총수를 단정할 수 없다 — 원장에 확정 기록하지 않고 부분 미측정으로 남긴다.
+  if (counted.unreadable > 0) return observe({ day, closed: counted.closed, reasons: counted.reasons, text: null,
+    state: 'unmeasured',
+    detail: `사유 못 읽은 closed 로그 ${counted.unreadable}건 — 읽힌 ${counted.closed}건만 셈(부분 미측정)` });
+  const text = composeDraftCloseSummaryText(counted.reasons);
+  try {
+    const ledger = new BriefItemsLedger({ stateDir: root, now: () => now, log });
+    const today = kstDay(now);
+    const recorded = ledger.list().find(item => item.source === DRAFT_CLOSE_BRIEF_SOURCE
+      && kstDay(new Date(item.created_at)) === today);
+    if (recorded) return observe({ day, closed: counted.closed, reasons: counted.reasons, text,
+      state: 'already-recorded', itemId: recorded.id });
+    const item = ledger.add({ text, domain: '운영', priority: 'P2', source: DRAFT_CLOSE_BRIEF_SOURCE,
+      evidence: `elanous logs --category ${SWEPT_DRAFT_LOG.category} --event ${SWEPT_DRAFT_LOG.event} --since 24h`,
+      createdAt: now.toISOString(), dedupeKey: `${DRAFT_CLOSE_BRIEF_SOURCE}:${today}`, dedupeWithinMs: 86_400_000 });
+    return observe({ day, closed: counted.closed, reasons: counted.reasons, text, state: 'recorded', itemId: item.id });
+  } catch (error) {
+    return observe({ day, closed: counted.closed, reasons: counted.reasons, text, state: 'unreadable',
+      detail: shortReason(`브리핑 원장 못 씀 · ${reasonOf(error)}`) });
+  }
+}
+
 /** 기본은 어제 KST 00:00–24:00, 창을 주면 그 안에 실제 병합된 PR만 센다. */
 export async function collectLandings(now: Date, window?: { from: Date; to: Date }, source?: { repoRoot?: string; repoName?: string; stateRoot?: string }): Promise<Landing[]> {
   const configuredTree = source?.repoRoot ?? getUserConfig().ops?.cronRepoRoot;
@@ -495,7 +625,8 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
         else loopEvent('rhythm-daily', 'tick', tick);
       }
     }
-    return { file, markdown, header, risks, sections, sent, ...vault, sendError, recordError, status, deliveryState, deliveryLine };
+    return { file, markdown, header, risks, sections, sent, ...vault, sendError, recordError, status, deliveryState, deliveryLine,
+      draftCloseSummary: undefined };
   }
   const safe = async <T>(fetch: () => Promise<T>): Promise<Section<T>> => {
     try { return { status: 'ok', value: await fetch() }; } catch (e) { return unreadable(reasonOf(e)); }
@@ -589,6 +720,9 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
     writeFileSync(file, review.markdown);
   }
   const { vaultError, vaultFatal } = options.dryRun ? { vaultError: null, vaultFatal: false } : copyToVault(review.markdown, now, deps);
+  // DRAFT-SWEEP-DAILY-SUMMARY — 어제 닫힌 draft 사유를 오늘 브리핑 원장 1건으로 적는다(PR별 댓글 0 유지).
+  // --dry-run 은 원장에 쓰지 않는다(다른 산출물과 같은 규칙).
+  const draftCloseSummary = options.dryRun ? undefined : recordDraftCloseSummary(root, now);
   let enabled = deps.sendEnabled === true;
   let sendError: string | null = null;
   let deliveryState = options.stage === 'collect' ? 'pending' : options.dryRun ? 'dry-run' : 'send-disabled';
@@ -628,7 +762,7 @@ export async function runDaily(options: { dryRun?: boolean; noNews?: boolean; st
       else loopEvent('rhythm-daily', 'tick', tick);
     }
   }
-  return { file, ...review, sent, vaultError, vaultFatal, sendError, recordError, status, deliveryState, deliveryLine };
+  return { file, ...review, sent, vaultError, vaultFatal, sendError, recordError, status, deliveryState, deliveryLine, draftCloseSummary };
 }
 
 export async function main(args: string[] = process.argv.slice(2), deps: DailyDeps = {}): Promise<Awaited<ReturnType<typeof runDaily>>> {