elanous 0.2.36 → 0.2.38

package/scripts/release-loop/traffic-transition.ts

@@ -4,12 +4,17 @@ import { debug } from '../../src/debug/log.js';
 import type { GraphContext } from './node-verdict.js';
 import type { ReleaseLoopConfig } from './unattended-release.js';
 
-export type ReleaseTrafficEvent = 'gate-passed' | 'verify-complete';
+export type ReleaseTrafficEvent = 'cut-start' | 'gate-passed' | 'npm-published' | 'verify-complete' | 'failed';
+
+export interface TrafficBeforeCut {
+  global?: string;
+  perCycle: Record<string, unknown>;
+}
 
 export interface TrafficFile {
   global?: string;
   seats: Record<string, Record<string, unknown>>;
-  releaseLifecycle?: { runId: string; version: string; stage: 1 | 2; event: ReleaseTrafficEvent; startedAt?: string; updatedAt: string };
+  releaseLifecycle?: { runId: string; version: string; stage: 0 | 1 | 2 | 3; event: ReleaseTrafficEvent; startedAt?: string; updatedAt: string; beforeCut?: TrafficBeforeCut };
   [key: string]: unknown;
 }
 
@@ -18,7 +23,7 @@ type ReleaseTrafficConfig = ReleaseLoopConfig & {
 };
 
 const SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
-const STAGE: Record<ReleaseTrafficEvent, 1 | 2> = { 'gate-passed': 1, 'verify-complete': 2 };
+const STAGE: Record<ReleaseTrafficEvent, 0 | 1 | 2 | 3> = { 'cut-start': 0, 'gate-passed': 1, 'npm-published': 2, 'verify-complete': 2, failed: 3 };
 const TRAFFIC_PER_CYCLE = { half: 3, full: 6 } as const;
 
 export interface TrafficTransitionOptions {
@@ -112,32 +117,65 @@ export async function applyReleaseTrafficEvent(
   const log = options.log ?? ((name, fields) => debug.log('release-loop.traffic', name, fields));
   const stage = STAGE[event];
   const stamp = (options.now ?? (() => new Date()))().toISOString();
-  const rate = event === 'gate-passed' ? TRAFFIC_PER_CYCLE.half : TRAFFIC_PER_CYCLE.full;
-  const releaseLifecycle = { runId, version, stage, event, ...(context.startedAt ? { startedAt: context.startedAt } : {}), updatedAt: stamp };
+  const rate = event === 'gate-passed' ? TRAFFIC_PER_CYCLE.half
+    : event === 'npm-published' || event === 'verify-complete' ? TRAFFIC_PER_CYCLE.full : undefined;
   const release = () => {
     const unlock = acquireTrafficLock(path, options.lockTimeoutMs);
     try {
       const before = readTrafficFile(path);
       const prior = before.releaseLifecycle;
+      if ((event === 'npm-published' || event === 'verify-complete') && context.outputs['npm-publish']?.outcome !== 'ok') {
+        return { file: before, applied: false, idempotent: false, reason: 'npm-publish-unconfirmed' };
+      }
       const sameRun = prior?.runId === runId;
       const newerVersion = !prior?.runId || compareReleaseVersions(version, prior.version) > 0;
       const sameVersionLaterRun = prior?.version === version && isLaterRun(context.startedAt, prior.startedAt);
-      if (sameRun && prior.stage >= stage) return { file: before, applied: true, idempotent: true };
-      const permitted = sameRun
-        ? prior.stage === stage - 1
-        : newerVersion || (event === 'gate-passed' && prior?.version === version && (prior.stage ?? 0) < 2 && sameVersionLaterRun)
-          || (event === 'verify-complete' && prior?.version === version && sameVersionLaterRun);
+      const resumedTrafficNode = sameRun && prior.stage === 3
+        && (event === 'cut-start' && context.nodeId === 'traffic-cut-start'
+          || event === 'gate-passed' && context.nodeId === 'traffic-gate-passed'
+          || event === 'npm-published' && context.nodeId === 'traffic-npm-published'
+          || event === 'verify-complete' && context.nodeId === 'traffic-verify-complete' && context.outputs['npm-publish']?.outcome === 'ok');
+      if (sameRun && prior.stage === 3 && event !== 'failed' && !resumedTrafficNode) {
+        return { file: before, applied: false, idempotent: false, reason: 'run-already-failed' };
+      }
+      if (sameRun && prior.stage >= stage && event !== 'failed' && !resumedTrafficNode) return { file: before, applied: true, idempotent: true };
+      if (event === 'failed' && (!sameRun || prior?.stage === 2 || prior?.stage === 3 || !prior?.beforeCut)) {
+        return { file: before, applied: false, idempotent: false,
+          reason: !sameRun ? prior?.runId ? 'different-run-is-current' : 'before-cut-unmeasured'
+            : prior?.stage === 2 ? 'published-keeps-full' : prior?.stage === 3 ? 'already-restored' : 'before-cut-unmeasured' };
+      }
+      const permitted = event === 'failed' ? sameRun
+        : sameRun ? resumedTrafficNode || (stage === 0 ? prior.stage === 0 : stage > prior.stage)
+        : newerVersion || (prior?.version === version && sameVersionLaterRun && (prior.stage < 2 || prior.stage === 3 || event === 'verify-complete'));
       if (!permitted) {
         return { file: before, applied: false, idempotent: false, reason: prior?.runId && prior.runId !== runId ? 'different-run-is-current' : 'event-out-of-order' };
       }
+      if (event === 'cut-start' && prior && prior.stage < 2 && !prior.beforeCut) {
+        return { file: before, applied: false, idempotent: false, reason: 'before-cut-unmeasured' };
+      }
+      const beforeCut = event === 'cut-start' ? {
+        ...(prior?.stage !== undefined && prior.stage < 2 && prior.beforeCut
+          ? prior.beforeCut
+          : { ...(before.global === undefined ? {} : { global: before.global }),
+            perCycle: Object.fromEntries(SEATS.map((seat) => [seat, before.seats[seat]?.perCycle])) }),
+      } : prior?.beforeCut;
+      const releaseLifecycle = { runId, version, stage, event, ...(context.startedAt ? { startedAt: context.startedAt } : {}),
+        updatedAt: stamp, ...(beforeCut ? { beforeCut } : {}) };
       const after: TrafficFile = {
         ...before,
-        ...(event === 'verify-complete' ? { global: 'green' } : {}),
+        ...(event === 'cut-start' ? { global: 'gate' }
+          : event === 'gate-passed' ? { global: 'yellow' }
+          : event === 'npm-published' || event === 'verify-complete' ? { global: 'green' }
+          : beforeCut?.global === undefined ? {} : { global: beforeCut.global }),
         seats: Object.fromEntries(Object.entries(before.seats).map(([seat, value]) => [
-          seat, SEATS.includes(seat as typeof SEATS[number]) ? { ...value, perCycle: rate } : value,
+          seat, SEATS.includes(seat as typeof SEATS[number])
+            ? { ...value, ...(event === 'failed' ? { perCycle: beforeCut?.perCycle[seat] } : rate === undefined ? {} : { perCycle: rate }) }
+            : value,
         ])),
         releaseLifecycle,
       };
+      if (event === 'failed' && beforeCut?.global === undefined) delete after.global;
+      if (event === 'failed') for (const seat of SEATS) if (beforeCut?.perCycle[seat] === undefined) delete after.seats[seat]?.perCycle;
       atomicWriteTrafficFile(path, after);
       return { file: after, applied: true, idempotent: false };
     } finally { unlock(); }
@@ -145,7 +183,9 @@ export async function applyReleaseTrafficEvent(
   const result = release();
   const reason = result.applied && result.idempotent ? 'already-applied' : result.reason;
   log(result.idempotent ? 'already-applied' : result.applied ? 'applied' : 'ignored', {
-    runId, version, event, stage, reason, perCycle: rate, ...(event === 'verify-complete' ? { global: 'green' } : {}),
+    runId, version, event, stage, reason, ...(rate === undefined ? {} : { perCycle: rate }),
+    ...(event === 'cut-start' ? { global: 'gate' } : event === 'gate-passed' ? { global: 'yellow' }
+      : event === 'npm-published' || event === 'verify-complete' ? { global: 'green' } : {}),
   });
   return { applied: result.applied, stage: result.file.releaseLifecycle?.stage ?? 0, ...(reason ? { reason } : {}) };
 }

package/scripts/release-loop/version-node.ts

@@ -8,11 +8,13 @@ import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, prodInstanceRoot } from '../../src/instance/resolve.js';
 import { landingFreezeMessage, readLandingFreeze, type LandingFreeze } from '../../src/release-loop/landing-freeze.js';
 import { baseVersion, isReleaseVersion, isStableVersion, prereleaseKind } from './release-version.js';
+import { cutReleaseBranch } from './cut-branch.js';
 
 type Kind = 'release' | 'dev-bump';
 type Output = { outcome: 'ok' | 'error'; kind: Kind | null; version: string | null; commit: string | null; pr: number | null; files?: string[]; worktree?: string; error?: string;
   /** RELEASE-BRANCH: the release branch the cut lives on and the main commit it was cut from. */
-  branch?: string; base?: string; existing?: boolean; skipped?: string };
+  branch?: string; base?: string; existing?: boolean; skipped?: string;
+  artifactOwner?: { runId: string; attempt: number } };
 
 export function nextDevVersion(version: string): string {
   const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(isReleaseVersion(version) ? baseVersion(version) : version);
@@ -147,6 +149,57 @@ export interface BranchCutDeps {
   freeze?: () => LandingFreeze | null;
   /** `--force-freeze`: cut while a freeze is on (recorded). */
   forceFreeze?: boolean;
+  /** Identity of the graph run cutting this branch. A direct legacy call may omit it. */
+  runId?: string;
+  /** Release run ledger universe; defaults to the active instance root. */
+  root?: string;
+}
+
+function releaseOwner(version: string, deps: BranchCutDeps): { runId: string; attempt: number } | undefined {
+  if (!deps.runId) return undefined;
+  const runId = deps.runId;
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(runId) || runId === '.' || runId === '..') throw new Error(`invalid release run id: ${runId}`);
+  const path = join(deps.root ?? effectiveInstanceRoot(), 'release', version, 'resume-attempts', `${runId}.json`);
+  if (!existsSync(path)) return { runId, attempt: 0 };
+  const saved = JSON.parse(readFileSync(path, 'utf8')) as { version?: unknown; runId?: unknown; attempts?: unknown };
+  if (saved.version !== version || saved.runId !== runId || !Array.isArray(saved.attempts)
+    || saved.attempts.some((value) => typeof value !== 'string' || !Number.isFinite(Date.parse(value))))
+    throw new Error(`invalid resume attempts: ${path}`);
+  return { runId, attempt: saved.attempts.length };
+}
+
+function recordedBranchOwner(repo: string, tip: string): { runId: string; attempt: number } | undefined {
+  // An owner's trailer inherited from main is not evidence that this release branch belongs to that run.
+  const fork = git(repo, 'merge-base', 'origin/main', tip);
+  const messages = git(repo, 'log', '--first-parent', '--format=%B', '-n', '100', `${fork}..${tip}`);
+  const match = /^Elanous-Release-Run: ([A-Za-z0-9][A-Za-z0-9._-]*)\nElanous-Release-Attempt: (0|[1-9][0-9]*)$/m.exec(messages);
+  return match ? { runId: match[1]!, attempt: Number(match[2]) } : undefined;
+}
+
+function priorRunOwnsTip(version: string, tip: string, owner: { runId: string; attempt: number }, root: string): boolean {
+  const path = join(root, 'graph-runs', 'release-loop', `${owner.runId}.json`);
+  if (!existsSync(path)) return false;
+  const state = JSON.parse(readFileSync(path, 'utf8')) as { graphId?: unknown; runId?: unknown; input?: { version?: unknown; branchCut?: unknown };
+    nodes?: Array<{ nodeId?: unknown; ok?: unknown; output?: unknown }> };
+  if (state.graphId !== 'release-loop' || state.runId !== owner.runId || state.input?.version !== version || state.input?.branchCut !== true) return false;
+  return state.nodes?.some((node) => {
+    if (node.nodeId !== 'version-release' || node.ok !== true || typeof node.output !== 'string') return false;
+    try {
+      const result = JSON.parse(node.output.trim().split('\n').at(-1)!) as { commit?: unknown; branch?: unknown };
+      return result.commit === tip && result.branch === `release/${version}`;
+    } catch { return false; }
+  }) ?? false;
+}
+
+function preserveForeignBranch(repo: string, version: string, tip: string): string {
+  const backupBranch = `release-backup/${version}/${tip}`;
+  const ref = `refs/heads/${backupBranch}`;
+  const existing = git(repo, 'ls-remote', '--heads', 'origin', ref).split(/\s+/)[0] ?? '';
+  if (existing && existing !== tip) throw new Error(`${backupBranch} points to another commit — refusing to replace release branch`);
+  if (!existing) git(repo, 'push', '--porcelain', `--force-with-lease=${ref}:`, 'origin', `${tip}:${ref}`);
+  const preserved = git(repo, 'ls-remote', '--heads', 'origin', ref).split(/\s+/)[0] ?? '';
+  if (preserved !== tip) throw new Error(`${backupBranch} backup verification failed — refusing to replace release branch`);
+  return backupBranch;
 }
 
 function currentFreeze(): LandingFreeze | null {
@@ -189,15 +242,23 @@ export function cutReleaseBranchForRun(repo: string, version: string, deps: Bran
     if (!deps.forceFreeze) throw new Error(landingFreezeMessage(frozen));
   }
   fetchMain(repo);
+  const owner = releaseOwner(version, deps);
   const branch = `release/${version}`;
   const advertised = git(repo, 'ls-remote', '--heads', 'origin', `refs/heads/${branch}`).split(/\s+/)[0] ?? '';
   if (advertised) {
-    // A prerelease number is used once: an existing rc branch is another run's cut, never this run's.
-    if (prereleaseKind(version) !== null) throw new Error(`${branch} already exists — ${version} was cut by another run; run again for the next free number`);
     if (!/^[0-9a-f]{40}$/i.test(advertised)) throw new Error(`${branch} remote tip is not a commit SHA`);
     git(repo, 'fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`);
     const tip = git(repo, 'rev-parse', '--verify', `refs/remotes/origin/${branch}^{commit}`);
     if (tip !== advertised) throw new Error(`${branch} moved while it was read (${advertised} → ${tip})`);
+    const recordedOwner = owner ? recordedBranchOwner(repo, tip) : undefined;
+    const ledgerOwned = owner && !recordedOwner
+      ? priorRunOwnsTip(version, tip, owner, deps.root ?? effectiveInstanceRoot()) : false;
+    if (owner && recordedOwner?.runId !== owner.runId && !ledgerOwned) {
+      const backupBranch = preserveForeignBranch(repo, version, tip);
+      throw new Error(`${branch} belongs to ${recordedOwner?.runId ?? 'an unknown run'}; preserved ${tip} at ${backupBranch}; refusing to replace a foreign release branch`);
+    }
+    // Direct legacy calls retain the old prerelease number rule. A graph run may reuse only its own rc branch.
+    if (!owner && prereleaseKind(version) !== null) throw new Error(`${branch} already exists — ${version} was cut by another run; run again for the next free number`);
     const current = versionAt(repo, tip);
     if (current !== version) throw new Error(`${branch} tip ${tip} package.json version ${current} is not ${version}`);
     // The branch must be a cut of this release line: its fork point on main still carries <base>-dev.N (or <v>).
@@ -207,8 +268,10 @@ export function cutReleaseBranchForRun(repo: string, version: string, deps: Bran
     if (forkVersion !== version && !new RegExp(`^${stableLine.replaceAll('.', '\\.')}-dev\\.(0|[1-9][0-9]*)$`).test(forkVersion)) {
       throw new Error(`${branch} forks from main at ${fork} (version ${forkVersion}) — not a cut of ${stableLine}-dev.N`);
     }
-    debug.log('release-loop.cut', 'chosen', { version, source: 'release-branch', commit: tip, branch, existing: true });
-    return { outcome: 'ok', kind: 'release', version, commit: tip, pr: null, branch, existing: true };
+    // A legacy saved version-release node was the initial cut; later resume counts do not change its owner attempt.
+    const artifactOwner = recordedOwner ?? (ledgerOwned && owner ? { runId: owner.runId, attempt: 0 } : undefined);
+    debug.log('release-loop.cut', 'chosen', { version, source: 'release-branch', commit: tip, branch, existing: true, artifactOwner });
+    return { outcome: 'ok', kind: 'release', version, commit: tip, pr: null, branch, existing: true, ...(artifactOwner ? { artifactOwner } : {}) };
   }
   const base = git(repo, 'rev-parse', 'origin/main');
   const current = versionAt(repo, base);
@@ -229,8 +292,10 @@ export function cutReleaseBranchForRun(repo: string, version: string, deps: Bran
     if (files.length) {
       (deps.install ?? ((tree: string) => { run('bun', ['install', '--frozen-lockfile'], tree); }))(worktree);
       git(worktree, 'add', '-A');
-      git(worktree, 'commit', '-m', `release: ${version}`, '-m', `Cut from main ${base}.`);
     }
+    // Even a no-op version bump needs a commit that records who owns this cut.
+    if (files.length || owner) git(worktree, 'commit', ...(files.length ? [] : ['--allow-empty']), '-m', `release: ${version}`,
+      '-m', `Cut from main ${base}.${owner ? `\n\nElanous-Release-Run: ${owner.runId}\nElanous-Release-Attempt: ${owner.attempt}` : ''}`);
     const commit = git(worktree, 'rev-parse', 'HEAD');
     // Create-only: an empty lease refuses to overwrite a branch someone else made meanwhile.
     const push = git(repo, 'push', '--porcelain', `--force-with-lease=refs/heads/${branch}:`, 'origin', `${commit}:refs/heads/${branch}`);
@@ -239,16 +304,16 @@ export function cutReleaseBranchForRun(repo: string, version: string, deps: Bran
       return flag === '*' && !!ref?.endsWith(`:refs/heads/${branch}`) && summary === '[new branch]';
     });
     if (!created) throw new Error(`${branch} was not created (push: ${push.replace(/\s+/g, ' ').trim() || 'no output'})`);
-    debug.log('release-loop.cut', 'chosen', { version, source: 'release-branch', commit, branch, base, existing: false });
-    return { outcome: 'ok', kind: 'release', version, commit, pr: null, branch, base, files };
+    debug.log('release-loop.cut', 'chosen', { version, source: 'release-branch', commit, branch, base, existing: false, artifactOwner: owner });
+    return { outcome: 'ok', kind: 'release', version, commit, pr: null, branch, base, files, ...(owner ? { artifactOwner: owner } : {}) };
   } finally {
     try { if (added) git(repo, 'worktree', 'remove', '--force', worktree); }
     finally { rmSync(temp, { recursive: true, force: true }); }
   }
 }
 
-function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string, cutCommit?: string, forceFreeze = false, branchCut = false, devTarget?: string): Output {
-  if (kind === 'release' && branchCut && cutCommit === undefined) return cutReleaseBranchForRun(repo, releaseVersion, { forceFreeze });
+function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string, cutCommit?: string, forceFreeze = false, branchCut = false, devTarget?: string, runId?: string): Output {
+  if (kind === 'release' && branchCut && cutCommit === undefined) return cutReleaseBranchForRun(repo, releaseVersion, { forceFreeze, runId });
   if (kind === 'dev-bump' && prereleaseKind(releaseVersion) !== null) {
     // A prerelease (rehearsal) never moves main: the next stable release still owns this -dev line.
     debug.log('release-loop.version-dev-bump', 'skipped', { version: releaseVersion, reason: 'prerelease' });
@@ -375,20 +440,36 @@ export function main(args: string[] = process.argv.slice(2), repo = process.cwd(
   let cutCommit: string | undefined;
   let forceFreeze = false;
   let branchCut = false;
+  let runId: string | undefined;
   try {
-    if (args[0] !== 'release' && args[0] !== 'dev-bump') throw new Error('usage: version-node.ts <release|dev-bump> [--version <v>] [--cut <sha>] [--cut-commit <sha>] --json');
-    kind = args[0];
+    if (args[0] !== 'release' && args[0] !== 'dev-bump' && args[0] !== 'cut-branch')
+      throw new Error('usage: version-node.ts <release|dev-bump|cut-branch> [--version <v>] [--cut <sha>] [--cut-commit <sha>] [--pick <sha>] [--base <sha>] [--append] [--dry-run] --json');
+    kind = args[0] === 'cut-branch' ? 'release' : args[0];
+    const picks: string[] = [];
+    let base: string | undefined;
+    let append = false;
+    let dryRun = false;
+    let versionRelease: { commit?: unknown; base?: unknown; branch?: unknown } | undefined;
     for (let i = 1; i < args.length; i++) {
       if (args[i] === '--json') continue;
       if (args[i] === '--version' && args[i + 1]) { version = args[++i]!; continue; }
       if (args[i] === '--cut' && args[i + 1]) { cut = args[++i]!; continue; }
       if (args[i] === '--cut-commit' && args[i + 1]) { cutCommit = args[++i]!; continue; }
+      if (args[i] === '--pick' && args[i + 1]) { picks.push(args[++i]!); continue; }
+      if (args[i] === '--base' && args[i + 1]) { base = args[++i]!; continue; }
+      if (args[i] === '--append') { append = true; continue; }
+      if (args[i] === '--dry-run') { dryRun = true; continue; }
       throw new Error(`unknown or incomplete argument: ${args[i]}`);
     }
     if (process.env.ELANOUS_GRAPH_CONTEXT) {
       const location = process.env.ELANOUS_GRAPH_CONTEXT;
       const context = JSON.parse(location.trimStart().startsWith('{') ? location : readFileSync(location, 'utf8')) as {
-        input?: { version?: unknown; cutCommit?: unknown; forceFreeze?: unknown; branchCut?: unknown }; outputs?: Record<string, { commit?: unknown } | undefined> };
+        runId?: unknown; input?: { version?: unknown; cutCommit?: unknown; forceFreeze?: unknown; branchCut?: unknown };
+        outputs?: Record<string, { commit?: unknown; base?: unknown; branch?: unknown } | undefined> };
+      if (context.runId !== undefined) {
+        if (typeof context.runId !== 'string') throw new Error('runId must be a string');
+        runId = context.runId;
+      }
       if (!version && typeof context.input?.version === 'string') version = context.input.version;
       forceFreeze = context.input?.forceFreeze === true;
       branchCut = context.input?.branchCut === true;
@@ -397,13 +478,26 @@ export function main(args: string[] = process.argv.slice(2), repo = process.cwd(
         cutCommit = context.input.cutCommit;
       }
       // The cut = the commit version-release landed (what cutoff and the gate measured).
+      // RELEASE-APPEND-BASE-AUTO: cut-branch consumes that same record as its ledger seam
+      // (ledger: () => versionRelease), so it must not also see it injected as --cut.
       const releasedCommit = context.outputs?.['version-release']?.commit;
-      if (!cut && typeof releasedCommit === 'string' && releasedCommit) cut = releasedCommit;
+      if (args[0] !== 'cut-branch' && !cut && typeof releasedCommit === 'string' && releasedCommit) cut = releasedCommit;
+      // RELEASE-APPEND-BASE-AUTO: the version-release node's record is the ledger seam cut-branch consults.
+      versionRelease = context.outputs?.['version-release'];
     }
     if (!version) throw new Error('version required (--version or ELANOUS_GRAPH_CONTEXT.input.version)');
     nextDevVersion(version);
+    if (args[0] === 'cut-branch') {
+      if (cut !== undefined || cutCommit !== undefined) throw new Error('--cut/--cut-commit are not valid for cut-branch');
+      if (!picks.length) throw new Error('at least one --pick commit is required');
+      const result = cutReleaseBranch({
+        version, pick: picks, ...(base !== undefined ? { base } : {}), append, dryRun,
+        repoRoot: resolve(repo), ledger: () => versionRelease,
+      });
+      return { outcome: 'ok', kind: 'release', version, commit: result.commit, pr: null, branch: result.branch, ...(dryRun ? { skipped: 'dry-run' } : {}) };
+    }
     if (kind === 'dev-bump' && cutCommit !== undefined) throw new Error('--cut-commit is only valid for release');
-    return landing(resolve(repo), kind, version, cut, cutCommit, forceFreeze, branchCut);
+    return landing(resolve(repo), kind, version, cut, cutCommit, forceFreeze, branchCut, undefined, runId);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     const worktree = /\[worktree: ([^\]]+)\]$/.exec(message)?.[1];

package/scripts/train/green-leg.ts

@@ -0,0 +1,176 @@
+import { execFile as nodeExecFile, spawn } from 'node:child_process';
+import { rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import { execFileSync } from 'node:child_process';
+import { validateGoalDoneEvidenceCommand } from '../../src/self-implement/goal-author.js';
+import { listChecklist, setItemIfSnapshot } from '../../src/release-loop/checklist.js';
+
+const execFile = promisify(nodeExecFile);
+const OUTPUT_TAIL_CHARS = 8_000;
+export interface CommandResult { command: string; rc: number | null; timedOut: boolean; outputTail: string; startedAt: string; endedAt: string }
+export interface GreenLegInput { version: string; cellId: string; mergeSha: string; tree: string; timeoutMs?: number }
+export interface GreenLegDeps {
+  run: (command: string, cwd: string, timeoutMs: number) => Promise<CommandResult>;
+  record: (input: GreenLegInput, evidence: string) => Promise<void>;
+  propose: (body: string) => Promise<void>;
+  now: () => string;
+  resolveLandedMerge?: (tree: string, mergeSha: string) => string;
+  getCell?: (version: string, cellId: string) => { title: string; status: string } | undefined;
+}
+
+/** Parse the train lane's required proof command and optional isolated E4 command. */
+export function completionBoundaryCommands(title: string): { evidence?: string; real?: string; errors: string[] } {
+  const errors: string[] = [];
+  const read = (label: string, optional: boolean): string | undefined => {
+    const prefix = `- 완료 경계 ${label}:`;
+    const lines = title.split(/\r?\n/u).filter((line) => line.startsWith(prefix));
+    if (lines.length > 1) { errors.push(`${label}: 중복 선언`); return; }
+    const value = lines[0]?.slice(prefix.length).trim();
+    if (!value) {
+      if (!optional) errors.push(`${label}: 선언 없음`);
+      return;
+    }
+    const parsed = validateGoalDoneEvidenceCommand(value);
+    if (!parsed.command) { errors.push(`${label}: ${parsed.error ?? '잘못된 명령'}`); return; }
+    return parsed.command;
+  };
+  return { evidence: read('증거 명령', false), real: read('실물 명령', true), errors };
+}
+
+function tokenize(command: string): string[] | null {
+  const args: string[] = [];
+  let current = '', quote: '"' | "'" | undefined, escaped = false, active = false;
+  for (const char of command) {
+    if (escaped) { current += char; escaped = false; active = true; continue; }
+    if (char === '\\' && quote !== "'") { escaped = true; active = true; continue; }
+    if (quote) { if (char === quote) quote = undefined; else current += char; active = true; continue; }
+    if (char === '"' || char === "'") { quote = char; active = true; continue; }
+    if (/\s/u.test(char)) { if (active) args.push(current); current = ''; active = false; continue; }
+    current += char; active = true;
+  }
+  if (escaped || quote) return null;
+  if (active) args.push(current);
+  return args;
+}
+
+export function validateIsolatedTestCommand(command: string): { args?: string[]; error?: string } {
+  const args = tokenize(command);
+  if (!args) return { error: '인용부호가 닫히지 않은 명령' };
+  if (args[0] !== 'bun' || args[1] !== 'test' || args.length < 3) return { error: '격리 레인에서는 bun test <시험 경로>만 실행 가능' };
+  if (args.slice(2).some((arg) => arg.startsWith('-'))) return { error: '시험 경로 외 추가 옵션은 허용하지 않음' };
+  if (args.slice(2).some((arg) => arg.split('/').includes('..') || arg.startsWith('/') || arg.includes('\\'))) return { error: '시험 경로는 트리 내부 상대 경로여야 함' };
+  return { args };
+}
+
+export function runIsolatedTestCommand(command: string, cwd: string, timeoutMs: number): Promise<CommandResult> {
+  const parsed = validateIsolatedTestCommand(command);
+  const startedAt = new Date().toISOString();
+  if (!parsed.args) return Promise.resolve({ command, rc: null, timedOut: false, outputTail: `REJECTED: ${parsed.error}`, startedAt, endedAt: new Date().toISOString() });
+  return new Promise((resolveResult) => {
+    const dir = join(tmpdir(), `eln-green-leg-${process.pid}-${Date.now()}`);
+    const child = spawn(parsed.args![0]!, parsed.args!.slice(1), {
+      cwd, shell: false, detached: true, env: { ...process.env, ELANOUS_STATE_DIR: dir },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let output = '', timedOut = false, done = false;
+    let forceTimer: ReturnType<typeof setTimeout> | undefined;
+    const append = (chunk: Buffer): void => { output = (output + chunk.toString('utf8')).slice(-OUTPUT_TAIL_CHARS); };
+    child.stdout.on('data', append); child.stderr.on('data', append);
+    const killGroup = (signal: NodeJS.Signals): void => {
+      if (child.pid) { try { process.kill(-child.pid, signal); } catch { /* already exited */ } }
+      else child.kill(signal);
+    };
+    const timer = setTimeout(() => { timedOut = true; killGroup('SIGTERM'); forceTimer = setTimeout(() => killGroup('SIGKILL'), 2_000); forceTimer.unref(); }, timeoutMs);
+    const finish = (rc: number | null): void => {
+      if (done) return; done = true; clearTimeout(timer); if (forceTimer) clearTimeout(forceTimer);
+      void rm(dir, { recursive: true, force: true }).finally(() => resolveResult({ command, rc, timedOut, outputTail: output, startedAt, endedAt: new Date().toISOString() }));
+    };
+    child.on('error', (error) => { append(Buffer.from(`\nSPAWN ERROR: ${error.message}`)); finish(null); });
+    child.on('close', (code) => finish(code));
+  });
+}
+
+export async function runGreenLeg(input: GreenLegInput, deps: GreenLegDeps): Promise<{ passed: boolean; results: CommandResult[]; evidence: string }> {
+  const tree = resolve(input.tree);
+  let mergeSha: string;
+  try {
+    mergeSha = deps.resolveLandedMerge?.(tree, input.mergeSha) ?? resolveLandedMerge(tree, input.mergeSha);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    const now = deps.now();
+    const evidence = [
+      `TRAIN-GREEN-LEG ${now}`,
+      `우주 표기(test:${tree})`,
+      `착지 merge SHA 검증 실패: ${input.mergeSha}`,
+      `검증 오류: ${reason}`,
+      '결과=미측정 · green 금지',
+    ].join('\n');
+    await deps.record(input, evidence);
+    await deps.propose(`evidence-only: ${input.version}/${input.cellId}; 착지 merge SHA 사전 검증 실패로 시험 미실행; 우주 test:${tree}; 입력 SHA ${input.mergeSha}; 체크리스트 상태는 변경하지 않았습니다.`);
+    return { passed: false, results: [], evidence };
+  }
+  const snapshot = deps.getCell?.(input.version, input.cellId) ?? listChecklist(input.version).items.find((item) => item.id === input.cellId);
+  if (!snapshot) throw new Error(`체크리스트 칸 없음: ${input.cellId}`);
+  if (snapshot.status !== 'yellow') throw new Error(`yellow가 아닌 칸에는 TRAIN-GREEN-LEG 실행 불가: ${snapshot.status}`);
+  const declarations = completionBoundaryCommands(snapshot.title);
+  const commands = [declarations.evidence, declarations.real].filter((value): value is string => Boolean(value));
+  const results: CommandResult[] = declarations.errors.length
+    ? [{ command: '', rc: null, timedOut: false, outputTail: `REJECTED: ${declarations.errors.join('; ')}`, startedAt: deps.now(), endedAt: deps.now() }]
+    : await runInOrder(commands, (command) => deps.run(command, tree, input.timeoutMs ?? 120_000));
+  const passed = declarations.errors.length === 0 && results.length > 0 && results.every((result) => result.rc === 0 && !result.timedOut);
+  const proposalReady = passed && Boolean(declarations.real);
+  const evidence = [
+    `TRAIN-GREEN-LEG ${deps.now()}`,
+    `우주 표기(test:${tree})`,
+    `착지 merge SHA ${mergeSha}`,
+    ...results.map((result) => `${result.command || '(선언 검증)'} | rc=${result.rc ?? 'spawn-error'} | timeout=${result.timedOut} | ${result.startedAt}..${result.endedAt}\n${result.outputTail}`),
+    `결과=${proposalReady ? '격리 E4 통과 · OP/OPT 판정 대기' : passed ? '증거 시험 통과 · 실물 E4 미선언 · human-collected 대기' : '미통과 또는 미측정 · green 금지'}`,
+  ].join('\n');
+  await deps.record(input, evidence);
+  await deps.propose(`${proposalReady ? 'propose-green' : 'evidence-only'}: ${input.version}/${input.cellId}; ${proposalReady ? '격리 E4 시험 명령 통과' : passed ? '증거 시험만 통과, 실물 E4는 human-collected 대기' : '명령 실패·시간초과·선언 거부 기록'}; 우주 test:${tree}; 착지 merge SHA ${mergeSha}. 체크리스트 상태는 변경하지 않았습니다.`);
+  return { passed, results, evidence };
+}
+
+function resolveLandedMerge(tree: string, sha: string): string {
+  if (!/^[0-9a-f]{40}$/iu.test(sha)) throw new Error('착지 merge SHA는 전체 40자리여야 합니다');
+  const full = execFileSync('git', ['-C', tree, 'rev-parse', '--verify', `${sha}^{commit}`], { encoding: 'utf8' }).trim();
+  execFileSync('git', ['-C', tree, 'merge-base', '--is-ancestor', full, 'HEAD']);
+  return full;
+}
+
+async function runInOrder<T>(items: readonly T[], run: (item: T) => Promise<CommandResult>): Promise<CommandResult[]> {
+  const results: CommandResult[] = [];
+  for (const item of items) results.push(await run(item));
+  return results;
+}
+
+export const defaultGreenLegDeps: GreenLegDeps = {
+  run: runIsolatedTestCommand,
+  now: () => new Date().toISOString(),
+  async record(input, evidence) {
+    const current = listChecklist(input.version).items.find((item) => item.id === input.cellId);
+    if (!current) throw new Error(`체크리스트 칸 없음: ${input.cellId}`);
+    if (current.status !== 'yellow') throw new Error(`yellow가 아닌 칸에는 TRAIN-GREEN-LEG 기록 불가: ${current.status}`);
+    setItemIfSnapshot(input.version, input.cellId, { evidence: [current.evidence, evidence].filter(Boolean).join('\n\n') }, 'MK', current);
+  },
+  async propose(body) { await execFile('eln', ['msg', 'post', '--from', 'MK', '--to', 'OPT', '--kind', 'report', '--body', body]); },
+};
+
+if (import.meta.main) {
+  const [version, cellId, mergeSha, tree] = process.argv.slice(2);
+  if (!version || !cellId || !mergeSha || !tree) {
+    console.error('usage: bun scripts/train/green-leg.ts <version> <cell-id> <landed-merge-sha> <test-tree>');
+    process.exitCode = 2;
+  } else {
+    try {
+      const result = await runGreenLeg({ version, cellId, mergeSha, tree }, defaultGreenLegDeps);
+      console.log(JSON.stringify({ passed: result.passed, results: result.results }, null, 2));
+      if (!result.passed) process.exitCode = 1;
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exitCode = 1;
+    }
+  }
+}

package/scripts/tui-continue-real-evidence.ts

@@ -0,0 +1,47 @@
+// 실물 증거: 생산 모듈(src/index.ts)이 쓰는 실제 세션 저장소에서 --continue 해석을 잰다.
+// 픽스처 없음 — createProject/createSession 으로 진짜 스토어에 두 프로젝트·세션을 만든 뒤,
+// 프로덕션 함수 latestSessionIdForContinue 를 호출해 "cwd 최근 세션" 이 이기는지 본다.
+//
+//   bun scripts/tui-continue-real-evidence.ts
+import { mkdirSync, mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const root = mkdtempSync(join(tmpdir(), 'eln-continue-evidence-'));
+process.env.ELANOUS_STATE_DIR = join(root, 'state');
+process.env.ELANOUS_CONFIG_DIR = join(root, 'config');
+
+const cwdA = join(root, 'projA');
+const cwdB = join(root, 'projB');
+mkdirSync(join(cwdA, 'nested'), { recursive: true });
+mkdirSync(cwdB, { recursive: true });
+
+const { createProject } = await import('../src/project/project-store');
+const { createSession } = await import('../src/session/index');
+const { latestSessionIdForContinue } = await import('../src/index');
+
+const projectA = createProject({ name: 'evidence-A', primaryFolder: cwdA });
+const projectB = createProject({ name: 'evidence-B', primaryFolder: cwdB });
+
+const sessionA = createSession({ projectId: projectA.id, source: 'cli', title: 'A turn' });
+await new Promise((resolve) => setTimeout(resolve, 20));
+const sessionB = createSession({ projectId: projectB.id, source: 'cli', title: 'B turn' });
+
+const fromNested = latestSessionIdForContinue(join(cwdA, 'nested'));
+const fromNoProject = latestSessionIdForContinue(join(root, 'unassigned'));
+
+console.log(JSON.stringify({
+  store: root,
+  globalNewest: sessionB.id,
+  pickedFromCwdA: fromNested,
+  pickedIsSessionA: fromNested === sessionA.id,
+  pickedIsGlobalNewest: fromNested === sessionB.id,
+  pickedFromUnassignedCwd: fromNoProject,
+  unassignedFallsBackToGlobal: fromNoProject === sessionB.id,
+}, null, 2));
+
+if (fromNested !== sessionA.id || fromNoProject !== sessionB.id) {
+  console.error('FAIL: --continue resolution did not follow cwd project');
+  process.exit(1);
+}
+console.log('PASS: --continue picks the cwd project session, falls back to global newest elsewhere');

package/scripts/ux-sim.ts

@@ -69,7 +69,7 @@ if (argv[0] === 'emit') {
 }
 
 // ── N03 키 순서열 (TUI-NEXT E4) — 진짜 PTY 에 next TUI 를 fake LLM 으로 띄워 단계별 화면 ⊕ 격리 우주 logs ──
-//   bun scripts/ux-sim.ts seat-seq <next-new-session|next-compact|next-queue|next-wakeup|next-paste|next-goal-continue|next-goal-interim|next-proactive-continue|classic-400-heal|classic-400-exhausted|classic-seat-boot|classic-typing-lag|classic-wakeup|classic-paste|classic-goal-continue|classic-goal-interim|classic-orphan-autostop> --root <빈 폴더> [--installed | --executable <bun> --entry <elanous.mjs>] [--expect-sha <sha256>] [--json]
+//   bun scripts/ux-sim.ts seat-seq <next-new-session|next-compact|next-resume|next-queue|next-wakeup|next-paste|next-at-picker|next-subagent-e4|next-goal-continue|next-goal-interim|next-proactive-continue|classic-400-heal|classic-400-exhausted|classic-seat-boot|classic-typing-lag|classic-wakeup|classic-paste|classic-goal-continue|classic-goal-interim|classic-orphan-autostop> --root <빈 폴더> [--installed | --executable <bun> --entry <elanous.mjs>] [--expect-sha <sha256>] [--json]
 //   기본 실행 = 이 트리 bin/elanous.mjs ⊕ 이 bun. --installed = ~/.local/share/elanous/current 의 elanous.mjs.
 //   rc: 0 = 모든 checks 참 · 1 = 거짓이 있다 · 2 = 인자 오류
 if (argv[0] === 'seat-seq') {

package/scripts/video-pipeline.ts

@@ -723,8 +723,8 @@ function strictVerdict(rows: { graphId: string; parsed: boolean; unbound: string
 const REMOTE_RAM = new Map<string, number | null>();
 /**
  * ⛔⭐⭐ ***어느 기계의 여유 메모리인가*** — 2026-09-23.
- * 🩸 초판은 «이 노트북»의 여유(70GB)를 ssh 구현(`node-b` 에서 도는 것)과 견줬다. ***틀린 기계다.***
- *   node-b 은 여유 435GB 다 — 여기서 「안 된다」가 나오면 그것은 «거짓»이다.
+ * 🩸 초판은 «이 노트북»의 여유를 ssh 구현(원격 노드에서 도는 것)과 견줬다. ***틀린 기계다.***
+ *   원격 노드의 여유가 더 클 수 있다 — 여기서 「안 된다」가 나오면 그것은 «거짓»이다.
  * ⇒ 구현의 `probe.kind` 가 `ssh` 면 ***그 호스트에게 묻는다***. 호스트당 한 번만.
  */
 function freeRamGbOf(impl: Impl): number | null {

package/src/acp/client.ts

@@ -43,6 +43,7 @@ import { grokApiKeyEnvName } from './grok-auth-probe.js';
 import { grokAuthHint, isGrokAuthError } from './grok-auth.js';
 import { providerEnvKey } from '../llm/provider-credentials.js';
 import { getUserConfig } from '../user-config.js';
+import { createAcpStderrSummarizer } from './stderr-summary.js';
 import {
   AcpForkSessionUnsupportedError,
   AcpListSessionsUnsupportedError,
@@ -548,16 +549,41 @@ export class AcpAgent {
     });
     await spawned;
 
-    // Stderr from the agent is opaque text — log it so the operator
-    // sees errors from the subprocess (auth, network, etc.) without
-    // having to attach a debugger.
+    // Keep raw diagnostics in the debug log and coalesce the UI warning.
+    const stderrSummary = createAcpStderrSummarizer(({ kind, count }) => {
+      this.log(`stderr: ${kind} (${count}건)`);
+    });
+    const maxPendingStderrChars = 8 * 1024;
+    let pendingStderr = '';
+    const recordStderrLine = (line: string): void => {
+      const clean = line.trim();
+      if (!clean) return;
+      const redacted = redactSecretText(clean);
+      debug.log('acp.stderr', 'line', { backendId: this.spec.id, line: redacted });
+      stderrSummary.push(redacted);
+    };
     child.stderr.setEncoding('utf-8');
     child.stderr.on('data', (chunk: string) => {
-      for (const line of chunk.split('\n')) {
-        if (line.trim()) this.log(`stderr: ${line}`);
+      const lines = `${pendingStderr}${chunk}`.split('\n');
+      pendingStderr = lines.pop() ?? '';
+      for (const line of lines) recordStderrLine(line);
+      while (pendingStderr.length > maxPendingStderrChars) {
+        recordStderrLine(`${pendingStderr.slice(0, maxPendingStderrChars)} [continued]`);
+        pendingStderr = pendingStderr.slice(maxPendingStderrChars);
       }
     });
+    child.stderr.once('end', () => {
+      recordStderrLine(pendingStderr);
+      pendingStderr = '';
+      stderrSummary.flush();
+    });
+    child.stderr.once('error', () => {
+      recordStderrLine(pendingStderr);
+      pendingStderr = '';
+      stderrSummary.flush();
+    });
     child.on('exit', (code, signal) => {
+      stderrSummary.flush();
       this.log(`subprocess exited (code=${code}, signal=${signal})`);
       this.proc = null;
       this.connection = null;