elanous 0.2.38 → 0.2.41

package/src/release-loop/gate-host-reservation.ts

@@ -1,9 +1,12 @@
 import { randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { psProcessStartMs } from '../harness/harness-stop.js';
 import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { psProcessStart, type HostLeaseRecord, type PendingJobIdentity } from '../pod-lease/host-lease.js';
+import { parsePodPool, podPoolHostLease, resolvePodPoolSpec, type PodPoolMember } from '../task-orchestrator/surfaces/pod-pool.js';
 
 interface GateHostClaim {
   token: string;
@@ -11,11 +14,154 @@ interface GateHostClaim {
   hosts: string[];
   pid: number;
   pidStartedAt: number | null;
+  /** Wall-clock claim time. Claims written before this field existed stay readable (optional on read). */
+  reservedAt?: number;
 }
 
 export type GateHostReservation =
   | { status: 'free' }
-  | { status: 'reserved' | 'unknown'; reason: string; runId?: string };
+  | { status: 'reserved' | 'unknown'; reason: string; runId?: string; reservedAt?: number };
+
+/** Read-only snapshots used to decide whether the resource pool behind a gate host is occupied. */
+export interface GateHostResourceSnapshot {
+  /** null means the lease ledger was unreadable; [] is a measured empty ledger. */
+  leases: readonly HostLeaseRecord[] | null;
+  /** Active Pending/Running Jobs from the configured Pod pool; null means not measurable. */
+  activeJobs: readonly PendingJobIdentity[] | null;
+}
+
+export type GateHostResourceReading =
+  | { status: 'measured'; empty: boolean; reservations: number; authoringLeases: number; waitingJobs: number; activeJobs: number }
+  | { status: 'unmeasurable'; empty: null; reason: 'lease-ledger-unavailable' | 'lease-ledger-invalid' | 'pod-list-unavailable' | 'pod-list-invalid' | 'pod-pool-invalid' };
+
+const unavailable = (reason: Extract<GateHostResourceReading, { status: 'unmeasurable' }>['reason']): GateHostResourceReading => ({ status: 'unmeasurable', empty: null, reason });
+
+/** Read leases and active harness Pods from the configured pool without creating, pruning, or updating any ledger. */
+export function readGateHostResourcesForHost(host: string, env: NodeJS.ProcessEnv = process.env,
+  deps: { members?: readonly PodPoolMember[]; kubectl?: (args: readonly string[]) => { status: number | null; stdout: string };
+    processStart?: (pid: number) => string | null } = {}): GateHostResourceReading {
+  let members: readonly PodPoolMember[];
+  try {
+    const spec = resolvePodPoolSpec(undefined, env, () => {
+      try {
+        // The gate path resolves its pool from harness.podPool, unlike generic Pod launches.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        return (require('../user-config.js') as typeof import('../user-config.js')).getUserConfig().harness?.podPool;
+      } catch { return undefined; }
+    });
+    members = deps.members ?? (spec ? parsePodPool(spec) : []);
+  } catch { return unavailable('pod-pool-invalid'); }
+  if (!members.length) return unavailable('pod-list-unavailable');
+  const selectedHost = host.split('@').at(-1)!;
+  const selectedMembers = members.filter(member => member.sshHost === selectedHost);
+  if (!selectedMembers.length) return unavailable('pod-list-unavailable');
+  const selectedContexts = new Set(selectedMembers.map(member => member.context));
+
+  const leasePool = podPoolHostLease(members);
+  let leases: HostLeaseRecord[];
+  try {
+    let names: string[];
+    try { names = readdirSync(leasePool.dir).filter(name => name.endsWith('.json')); }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') names = [];
+      else return unavailable('lease-ledger-unavailable');
+    }
+    leases = [];
+    const processStart = deps.processStart ?? psProcessStart;
+    for (const name of names) {
+      if (!/^[A-Za-z0-9._-]+\.json$/.test(name)) return unavailable('lease-ledger-invalid');
+      let lease: HostLeaseRecord;
+      try { lease = JSON.parse(readFileSync(join(leasePool.dir, name), 'utf8')) as HostLeaseRecord; }
+      catch { return unavailable('lease-ledger-invalid'); }
+      if (!lease || !Number.isSafeInteger(lease.pid) || lease.pid <= 0 || typeof lease.startedAt !== 'string' || !lease.startedAt ||
+        typeof lease.at !== 'string' || (lease.stage !== undefined && lease.stage !== 'authoring' && lease.stage !== 'job') ||
+        (lease.stage === 'job' && (!lease.job || !lease.context || !lease.namespace))) return unavailable('lease-ledger-invalid');
+      try { process.kill(lease.pid, 0); }
+      catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ESRCH') continue;
+        // EPERM means the PID may still be alive; the start-time comparison below is still read-only.
+      }
+      const startedAt = processStart(lease.pid);
+      if (startedAt === null) return unavailable('lease-ledger-unavailable');
+      if (startedAt !== lease.startedAt) continue;
+      if (lease.stage !== 'job' || selectedContexts.has(lease.context!)) leases.push(lease);
+    }
+  } catch { return unavailable('lease-ledger-unavailable'); }
+
+  const kubectl = deps.kubectl ?? ((args: readonly string[]) => {
+    const result = spawnSync('kubectl', [...args], { encoding: 'utf8', timeout: 15_000, maxBuffer: 64 * 1024 * 1024 });
+    return { status: result.status, stdout: result.stdout ?? '' };
+  });
+  const activeJobs = new Map<string, PendingJobIdentity>();
+  for (const member of selectedMembers) {
+    let result: { status: number | null; stdout: string };
+    try { result = kubectl(['--context', member.context, '--request-timeout=10s', 'get', 'pods', '--all-namespaces', '-l', 'elanous.substrate=pod', '-o', 'json']); }
+    catch { return unavailable('pod-list-unavailable'); }
+    if (result.status !== 0) return unavailable('pod-list-unavailable');
+    let items: unknown;
+    try { items = (JSON.parse(result.stdout) as { items?: unknown }).items; }
+    catch { return unavailable('pod-list-invalid'); }
+    if (!Array.isArray(items)) return unavailable('pod-list-invalid');
+    for (const item of items) {
+      if (!item || typeof item !== 'object') return unavailable('pod-list-invalid');
+      const pod = item as { metadata?: { name?: unknown; namespace?: unknown; deletionTimestamp?: unknown; labels?: Record<string, unknown>; ownerReferences?: Array<{ kind?: unknown; name?: unknown }> }; status?: { phase?: unknown } };
+      const phase = pod.status?.phase;
+      if (phase === 'Succeeded' || phase === 'Failed') continue;
+      if (phase !== 'Pending' && phase !== 'Running') return unavailable('pod-list-invalid');
+      // Deleting Pods are already leaving the pool and must not keep the selected host occupied.
+      if (pod.metadata?.deletionTimestamp != null) continue;
+      const context = member.context;
+      const namespace = pod.metadata?.namespace;
+      const owner = pod.metadata?.ownerReferences?.find(ref => ref.kind === 'Job')?.name;
+      const job = owner ?? pod.metadata?.labels?.['job-name'];
+      if (typeof namespace !== 'string' || !namespace || typeof job !== 'string' || !job) return unavailable('pod-list-invalid');
+      const identity = { context, namespace, job };
+      activeJobs.set(`${context}\0${namespace}\0${job}`, identity);
+    }
+  }
+  const reading = readGateHostResources({ leases, activeJobs: [...activeJobs.values()] });
+  debug.log('release-loop.gate', 'host-resource-probe', { host: selectedHost, poolContexts: selectedMembers.map(member => member.context), ...reading });
+  return reading;
+}
+
+function activeJobKey(job: PendingJobIdentity): string | null {
+  return typeof job?.context === 'string' && job.context.length > 0 &&
+    typeof job.namespace === 'string' && job.namespace.length > 0 &&
+    typeof job.job === 'string' && job.job.length > 0
+    ? `${job.context}\0${job.namespace}\0${job.job}` : null;
+}
+
+/**
+ * Read the resource ledgers as the authority for host occupancy. Process argv is deliberately not an input:
+ * unrelated commands that happen to contain `bun test` do not reserve a gate host.
+ * A Job-backed lease and its active Job are one reservation; a lease without an observed Job remains reserved.
+ */
+export function readGateHostResources(snapshot: GateHostResourceSnapshot): GateHostResourceReading {
+  if (snapshot.leases === null) return { status: 'unmeasurable', empty: null, reason: 'lease-ledger-unavailable' };
+  if (snapshot.activeJobs === null) return { status: 'unmeasurable', empty: null, reason: 'pod-list-unavailable' };
+  if (!Array.isArray(snapshot.leases) || snapshot.leases.some((lease) => !lease ||
+    !Number.isSafeInteger(lease.pid) || lease.pid <= 0 || typeof lease.startedAt !== 'string' || !lease.startedAt || typeof lease.at !== 'string' ||
+    (lease.stage !== undefined && lease.stage !== 'authoring' && lease.stage !== 'job') ||
+    (lease.stage === 'job' && (!lease.job || !lease.context || !lease.namespace)))) {
+    return { status: 'unmeasurable', empty: null, reason: 'lease-ledger-invalid' };
+  }
+  if (!Array.isArray(snapshot.activeJobs) || snapshot.activeJobs.some((job) => !job || activeJobKey(job) === null)) {
+    return { status: 'unmeasurable', empty: null, reason: 'pod-list-invalid' };
+  }
+
+  const jobs = new Set(snapshot.activeJobs.map(activeJobKey) as string[]);
+  // Authoring leases have no host/context yet, so they conservatively occupy each selected host in the shared pool.
+  let authoringLeases = 0;
+  let waitingJobs = 0;
+  for (const lease of snapshot.leases) {
+    if (lease.stage !== 'job') { authoringLeases++; continue; }
+    const key = lease.job && lease.context && lease.namespace
+      ? activeJobKey({ job: lease.job, context: lease.context, namespace: lease.namespace }) : null;
+    if (!key || !jobs.has(key)) waitingJobs++;
+  }
+  const reservations = authoringLeases + waitingJobs + jobs.size;
+  return { status: 'measured', empty: reservations === 0, reservations, authoringLeases, waitingJobs, activeJobs: jobs.size };
+}
 
 const hostName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const claimsDir = (root: string) => join(root, 'release', 'gate-host-reservations');
@@ -44,7 +190,7 @@ export function reserveReleaseGateHosts(root: string, runId: string, hosts: read
   const token = randomUUID();
   const pidStartedAt = psProcessStartMs(process.pid);
   if (pidStartedAt === null) throw new Error('release gate owner start time unmeasured');
-  const claim: GateHostClaim = { token, runId, hosts: unique, pid: process.pid, pidStartedAt };
+  const claim: GateHostClaim = { token, runId, hosts: unique, pid: process.pid, pidStartedAt, reservedAt: Date.now() };
   const path = join(dir, `${token}.json`);
   const temp = join(dir, `.${token}.tmp`);
   try {
@@ -82,7 +228,9 @@ export function inspectReleaseGateHost(root: string, host: string): GateHostRese
         || !Number.isSafeInteger(claim.pid) || claim.pid <= 0 || typeof claim.token !== 'string'
         || typeof claim.runId !== 'string' || !claim.runId
         || (claim.pidStartedAt !== null && (!Number.isSafeInteger(claim.pidStartedAt)
-          || claim.pidStartedAt <= 0 || claim.pidStartedAt > Date.now()))) throw new Error('invalid claim');
+          || claim.pidStartedAt <= 0 || claim.pidStartedAt > Date.now()))
+        || (claim.reservedAt !== undefined && (!Number.isSafeInteger(claim.reservedAt)
+          || claim.reservedAt <= 0 || claim.reservedAt > Date.now()))) throw new Error('invalid claim');
     } catch (error) { return { status: 'unknown', reason: `reservation unreadable: ${name}: ${String(error)}` }; }
     const live = claimAlive(claim);
     if (live === 'dead') {
@@ -91,7 +239,12 @@ export function inspectReleaseGateHost(root: string, host: string): GateHostRese
       continue;
     }
     if (!claim.hosts.includes(host) && !claim.hosts.includes('*')) continue;
-    return { status: live === 'unknown' ? 'unknown' : 'reserved', reason: `release gate ${claim.runId} holds ${host}`, runId: claim.runId };
+    return {
+      status: live === 'unknown' ? 'unknown' : 'reserved',
+      reason: `release gate ${claim.runId} holds ${host}`,
+      runId: claim.runId,
+      ...(claim.reservedAt !== undefined ? { reservedAt: claim.reservedAt } : {}),
+    };
   }
   return { status: 'free' };
 }

package/src/release-loop/gate-shard-ledger.ts

@@ -0,0 +1,68 @@
+// One append-only observation per gate shard transition. The live board is a projection, not evidence for reuse.
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+
+export interface GateShardLedgerRow {
+  v: 1;
+  version: string;
+  phase: 'cut' | 'baseline';
+  shardId: string;
+  files: string[];
+  host: string | null;
+  executor: 'pod' | 'host';
+  imageDigest: string | null;
+  commit: string;
+  envFingerprint: string;
+  startedAt: string | null;
+  endedAt: string | null;
+  observedAt: string;
+  state: 'pending' | 'running' | 'done' | 'retry' | 'timeout' | 'failed';
+  rc: number | null;
+  pass: number | null;
+  fail: number | null;
+  errors: number | null;
+  ran: number | null;
+  failureIds: string[] | null;
+  errorIds: string[] | null;
+  attribution: 'complete' | 'unmeasured';
+  logPath: string | null;
+  junitPath: string | null;
+  stopReason: string | null;
+  attemptId: string | null;
+}
+
+export function gateShardLedgerPath(version: string, root = releaseLedgerRoot()): string {
+  if (!/^\d+\.\d+\.\d+(?:[-.][A-Za-z0-9.-]+)?$/.test(version)) throw new Error('invalid release version');
+  return join(root, 'release', version, 'gate-logs', 'shard-ledger.jsonl');
+}
+
+/** Each newline is a complete event, so an observer can read while the gate is running. */
+export function appendGateShardLedger(path: string, row: GateShardLedgerRow): void {
+  if (!/^[a-f0-9]{40}$/i.test(row.commit) || !/^[a-f0-9]{64}$/i.test(row.envFingerprint)) throw new Error('invalid shard ledger identity');
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(row.shardId) || row.files.some((file) => file.startsWith('/') || file.split('/').includes('..'))) throw new Error('invalid shard ledger path');
+  mkdirSync(dirname(path), { recursive: true });
+  appendFileSync(path, `${JSON.stringify(row)}\n`, { mode: 0o600 });
+}
+
+export function readGateShardLedger(path: string): { rows: GateShardLedgerRow[]; malformed: number } | null {
+  if (!existsSync(path)) return null;
+  const rows: GateShardLedgerRow[] = [];
+  let malformed = 0;
+  for (const line of readFileSync(path, 'utf8').split('\n')) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line) as GateShardLedgerRow;
+      if (row.v !== 1 || typeof row.shardId !== 'string' || !Array.isArray(row.files) || typeof row.observedAt !== 'string') throw new Error('invalid row');
+      rows.push(row);
+    } catch { malformed++; }
+  }
+  return { rows, malformed };
+}
+
+/** The newest event for each phase/shard. Preserve every attempt in the underlying ledger. */
+export function latestGateShardLedger(rows: readonly GateShardLedgerRow[]): GateShardLedgerRow[] {
+  const latest = new Map<string, GateShardLedgerRow>();
+  for (const row of rows) latest.set(`${row.phase}:${row.shardId}`, row);
+  return [...latest.values()].sort((a, b) => a.phase.localeCompare(b.phase) || a.shardId.localeCompare(b.shardId, undefined, { numeric: true }));
+}

package/src/release-loop/merged-pr-checklist.ts

@@ -7,7 +7,7 @@ import { listChecklist, setItem } from './checklist.js';
 import { judgeLandedCell } from './landed-to-green.js';
 import { evidencePlan, landedButYellow, type MergedChecklistPr } from './landed-but-yellow.js';
 import { assignedVersions, evidenceAdd } from './feature-store.js';
-import { boundMergedTaskCells, candidateMergedTaskCells, closeMergedTaskCard } from '../task-agent/postland-card.js';
+import { boundMergedTaskCells, candidateMergedTaskCells, closeMergedTaskCard, recordMergedTaskImplFindings } from '../task-agent/postland-card.js';
 
 export interface MergedPrChecklistDeps {
   readPr?: (number: number, cwd: string) => { state: string; baseRefName: string; title: string; body: string | null; mergedAt: string; url?: string; headRefOid?: string; files?: Array<{ path: string }> };
@@ -19,13 +19,19 @@ export interface MergedPrChecklistDeps {
   closeTaskCard?: typeof closeMergedTaskCard;
   boundTaskCells?: typeof boundMergedTaskCells;
   candidateTaskCells?: typeof candidateMergedTaskCells;
+  feedbackStatePath?: string;
+  feedbackFollowUp?: NonNullable<Parameters<typeof recordMergedTaskImplFindings>[2]>['followUp'];
   log?: typeof debug.log;
 }
 
+function readMergedPr(number: number, cwd: string): NonNullable<MergedPrChecklistDeps['readPr']> extends (number: number, cwd: string) => infer T ? T : never {
+  return JSON.parse(execFileSync('gh', ['pr', 'view', String(number), '--json', 'state,baseRefName,title,body,mergedAt,url,headRefOid,files'], { cwd, encoding: 'utf8', timeout: 30_000 }));
+}
+
 /** A confirmed main merge is the only entry. The existing checklist matcher owns PR-to-cell decisions. */
 export function syncMergedPrChecklist(number: number, cwd: string, goalFile?: string, deps: MergedPrChecklistDeps = {}): void {
   const log = deps.log ?? debug.log.bind(debug);
-  const pr = (deps.readPr ?? ((n, dir) => JSON.parse(execFileSync('gh', ['pr', 'view', String(n), '--json', 'state,baseRefName,title,body,mergedAt,url,headRefOid,files'], { cwd: dir, encoding: 'utf8', timeout: 30_000 })) as ReturnType<NonNullable<MergedPrChecklistDeps['readPr']>>))(number, cwd);
+  const pr = (deps.readPr ?? readMergedPr)(number, cwd);
   if (pr.state !== 'MERGED' || pr.baseRefName !== 'main') return;
   const merged: MergedChecklistPr = { number, title: pr.title, body: pr.body, mergedAt: pr.mergedAt };
   const versions = deps.versions?.() ?? (() => {
@@ -116,6 +122,23 @@ export function syncMergedPrChecklist(number: number, cwd: string, goalFile?: st
   for (const id of missing) log('release.checklist', 'merged-pr-cell-not-found', { pr: number, id });
 }
 
+/** Production merge entry: reconcile synchronously, then await idempotent PR-body feedback before returning. */
+export async function syncMergedPrChecklistWithFeedback(
+  number: number,
+  cwd: string,
+  goalFile?: string,
+  deps: MergedPrChecklistDeps = {},
+): Promise<Awaited<ReturnType<typeof recordMergedTaskImplFindings>>> {
+  const pr = (deps.readPr ?? readMergedPr)(number, cwd);
+  syncMergedPrChecklist(number, cwd, goalFile, { ...deps, readPr: () => pr });
+  if (pr.url && pr.headRefOid) {
+    return await recordMergedTaskImplFindings({ ...pr, number, url: pr.url, headRefOid: pr.headRefOid }, cwd,
+      { ...(deps.feedbackStatePath ? { statePath: deps.feedbackStatePath } : {}),
+        ...(deps.feedbackFollowUp ? { followUp: deps.feedbackFollowUp } : {}) });
+  }
+  return null;
+}
+
 const LABEL_IDS = '([A-Za-z0-9_-]+(?:[ \\t]*(?:,|·)[ \\t]*[A-Za-z0-9_-]+)*)';
 const LABEL_END = '(?=[ \\t]*$|[ \\t]+[—–·(-])';
 const DESIGNATION = new RegExp(`^ {0,3}(?:#{1,6}[ \\t]+|[-*][ \\t]+)?칸[ \\t]*:[ \\t]*${LABEL_IDS}${LABEL_END}`);

package/src/release-loop/rehearsal-shard-plan.ts

@@ -87,7 +87,12 @@ export function planRehearsalShards(version: string, root: string, checkout: str
   let gatePlanShards: number | null = null;
   try {
     const board = (deps.board ?? readGateShards)(gateShardsPath(version, root));
-    gatePlanShards = board?.version === version && board.shards.length && new Set(board.shards.map(shard => shard.id)).size === board.shards.length ? board.shards.length : null;
+    if (board?.version === version && board.shards.length
+      && new Set(board.shards.map(shard => shard.id)).size === board.shards.length) {
+      // Split/retry/tail rows are observations, not extra planned shards. Older boards used arbitrary IDs.
+      const roots = board.shards.filter(shard => /^pod-\d+$/.test(shard.id));
+      gatePlanShards = roots.length || (board.shards.some(shard => /^pod-\d+/.test(shard.id)) ? null : board.shards.length);
+    }
   } catch (error) { reasons.push(`persisted gate shard plan unreadable: ${error instanceof Error ? error.message : String(error)}`); }
   let testFiles: number | null = null;
   let measuredFiles = 0;

package/src/release-loop/rehearsal.ts

@@ -67,6 +67,15 @@ export function planRehearsal(schedules: readonly ReleaseSchedule[], now: Date,
   return { status: 'not-yet', version, cutAt, nextStepAt: new Date(cut - open[0]!.minutes * minute).toISOString() };
 }
 
+export interface RehearsalRecovery {
+  failedShard: string;
+  remeasuredFiles: number | null;
+  durationMs: number | null;
+  poolOverwriteApplied: boolean | null;
+  outcome: 'ok' | 'failed';
+  error?: string;
+}
+
 export interface RehearsalStamp {
   version: string;
   step: StepId;
@@ -79,6 +88,7 @@ export interface RehearsalStamp {
   regressionFiles?: string[];
   result?: LightRcResult;
   hardGate?: HardGateResult;
+  recovery?: RehearsalRecovery;
   hardGateRunId?: string;
   hardGateLog?: string;
   /** B6: an unmeasured hard gate always retains a cause, run id and durable local evidence path. */
@@ -94,6 +104,7 @@ export interface RehearsalOptions {
   apply?: boolean;
   checkout?: string;
   ledgerRoot?: string;
+  recoveryRun?: string;
   shards?: number;
   remote?: string;
 }
@@ -109,6 +120,7 @@ export interface RehearsalDeps {
   notify?: (text: string) => void | boolean | Promise<void | boolean>;
   git?: (args: string[], cwd: string) => { rc: number | null; stdout: string; stderr?: string };
   leakCheck?: (checkout: string) => { status: number | null; detail?: string };
+  resumeGate?: (runId: string, checkout: string) => Promise<{ files: number; durationMs: number; poolOverwriteApplied: boolean; ok: boolean }>;
 }
 
 export type RehearsalTickResult = RehearsalPlan & { applied?: boolean; stamps?: RehearsalStamp[]; notificationFailures?: number };
@@ -520,6 +532,21 @@ export async function runRehearsalTick(opts: RehearsalOptions = {}, deps: Rehear
                 console.error(line);
               } }, { cwd })))(plan.version, checkout, selection);
             stamp.result = result;
+            if (opts.recoveryRun && result.unmeasured !== null) {
+              const failedShard = result.unmeasured;
+              const started = Date.now();
+              try {
+                const recovered = await deps.resumeGate?.(opts.recoveryRun, checkout);
+                if (!recovered) throw new Error('release resume --from gate is unavailable for this rehearsal');
+                stamp.recovery = { failedShard, remeasuredFiles: recovered.files, durationMs: recovered.durationMs,
+                  poolOverwriteApplied: recovered.poolOverwriteApplied, outcome: recovered.ok ? 'ok' : 'failed',
+                  ...(!recovered.ok ? { error: 'resumed gate did not pass' } : {}) };
+              } catch (error) {
+                stamp.recovery = { failedShard, remeasuredFiles: null, durationMs: Math.max(0, Date.now() - started),
+                  poolOverwriteApplied: null, outcome: 'failed',
+                  error: oneLine(error instanceof Error ? error.message : String(error)) };
+              }
+            }
             if (regressionFiles.length) stamp.regressionFiles = regressionFiles;
             const shardMismatch = selection.shards !== undefined && result.shards !== selection.shards
               ? `selected shards ${selection.shards} but RC reported ${result.shards}` : null;

package/src/release-loop/release-schedule.ts

@@ -1,10 +1,99 @@
+import { createHash } from 'node:crypto';
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { CliUserError } from '../cli/cli-user-error.js';
 import { debug } from '../debug/log.js';
-import { readSchedule, readSchedules, writeSchedule, type ScheduleRow } from './feature-store.js';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+import { readSchedule, readSchedules, releasedVersion, writeSchedule, type ScheduleRow } from './feature-store.js';
 import { checkScheduleCeoLoad } from './placement.js';
 
 export type ReleaseSchedule = ScheduleRow;
 
+export interface ReleaseCutDueEvent {
+  id: string;
+  type: 'release.cut.due';
+  version: string;
+  cutAt: string;
+  at: string;
+}
+
+function newerVersion(version: string, published: string): boolean {
+  if (!published) return true;
+  const left = version.split('.').map(Number), right = published.split('.').map(Number);
+  for (let index = 0; index < 3; index++) {
+    if (left[index]! !== right[index]!) return left[index]! > right[index]!;
+  }
+  return false;
+}
+
+/** A scheduler tick observes due cuts; it does not directly start a release run. */
+export function dueReleaseCutEvents(now: string, root = releaseLedgerRoot()): ReleaseCutDueEvent[] {
+  const at = Date.parse(now);
+  if (!Number.isFinite(at)) throw new Error(`invalid schedule tick time: ${now}`);
+  const published = releasedVersion(root);
+  return readSchedules(root).filter(row => {
+    const cut = Date.parse(row.cutAt);
+    return newerVersion(row.version, published) && cut <= at && at - cut < 24 * 3_600_000;
+  }).map(row => ({ id: `release.cut.due:${row.version}:${row.cutAt}`, type: 'release.cut.due' as const,
+    version: row.version, cutAt: row.cutAt, at: new Date(at).toISOString() }));
+}
+
+function hasReleaseRunForEvent(root: string, eventId: string): boolean {
+  const dir = join(root, 'graph-runs', 'release-loop');
+  if (!existsSync(dir)) return false;
+  for (const name of readdirSync(dir)) {
+    if (!name.endsWith('.json')) continue;
+    try {
+      const run = JSON.parse(readFileSync(join(dir, name), 'utf8')) as { input?: { triggerEvent?: { id?: string } } };
+      if (run.input?.triggerEvent?.id === eventId) return true;
+    } catch { /* Ignore a partially written run; the next scheduler tick retries. */ }
+  }
+  return false;
+}
+
+/** Claim each version+cut only once across scheduler processes; a dead pending owner can be retried. */
+export async function emitDueReleaseCutEvents(now: string, emit: (event: ReleaseCutDueEvent) => Promise<void>,
+  root = releaseLedgerRoot(), subscriptionId = 'graph:release-loop'): Promise<ReleaseCutDueEvent[]> {
+  const emitted: ReleaseCutDueEvent[] = [];
+  for (const event of dueReleaseCutEvents(now, root)) {
+    const hash = createHash('sha256').update(`${subscriptionId}\0${event.id}`).digest('hex').slice(0, 16);
+    const path = join(root, 'release', 'cut-events', `${event.version}-${hash}.json`);
+    mkdirSync(dirname(path), { recursive: true });
+    let fd: number;
+    try { fd = openSync(path, 'wx', 0o600); }
+    catch (cause) {
+      if ((cause as NodeJS.ErrnoException).code !== 'EEXIST') throw cause;
+      let prior: { status?: string; pid?: number } = {};
+      try { prior = JSON.parse(readFileSync(path, 'utf8')) as typeof prior; } catch { /* pending write */ }
+      if (prior.status !== 'pending' || !Number.isInteger(prior.pid)) {
+        // A crash between O_EXCL creation and the first write leaves an empty claim.
+        if (Date.now() - statSync(path).mtimeMs < 60_000 || prior.status === 'emitted') continue;
+      } else {
+        try { process.kill(prior.pid!, 0); continue; }
+        catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ESRCH') continue; }
+      }
+      if (hasReleaseRunForEvent(root, event.id)) {
+        writeFileSync(path, JSON.stringify({ ...event, subscriptionId, status: 'emitted', recovered: true }) + '\n', { mode: 0o600 });
+        continue;
+      }
+      try { unlinkSync(path); fd = openSync(path, 'wx', 0o600); }
+      catch (error) { if ((error as NodeJS.ErrnoException).code === 'EEXIST') continue; throw error; }
+    }
+    closeSync(fd);
+    writeFileSync(path, JSON.stringify({ ...event, subscriptionId, status: 'pending', pid: process.pid }) + '\n', { mode: 0o600 });
+    try {
+      await emit(event);
+      writeFileSync(path, JSON.stringify({ ...event, subscriptionId, status: 'emitted', pid: process.pid }) + '\n', { mode: 0o600 });
+      debug.log('release.schedule', 'cut-due', { version: event.version, cutAt: event.cutAt, eventId: event.id, subscriptionId });
+      emitted.push(event);
+    } catch (error) {
+      if (existsSync(path)) unlinkSync(path);
+      throw error;
+    }
+  }
+  return emitted;
+}
+
 /** A release landing and its representative work share the same KST day boundary. */
 export function kstDay(utc: string): string {
   return new Date(Date.parse(utc) + 9 * 3_600_000).toISOString().slice(0, 10);

package/src/research/bloom-exemplars.ts

@@ -0,0 +1,135 @@
+import { readFileSync, statSync } from 'node:fs';
+import { BLOOM_2D_SCOPED, isBloom2DScoped, type Bloom2D } from '../knowledge/kgs/types.js';
+
+export const BLOOM_EXEMPLAR_DOMAINS = [
+  'finance', 'macro', 'technology', 'science', 'medicine', 'law', 'business',
+] as const;
+export type BloomExemplarDomain = typeof BLOOM_EXEMPLAR_DOMAINS[number];
+export type BloomExemplarLevel = 1 | 2 | 3 | 4 | 5 | 6;
+
+export interface BloomExemplar {
+  domain: BloomExemplarDomain;
+  level: BloomExemplarLevel;
+  bloom: Bloom2D;
+  question: string;
+}
+
+export interface BloomExemplarPack { version: 1; exemplars: BloomExemplar[] }
+export interface BloomExemplarContext {
+  domain: BloomExemplarDomain;
+  domainSignal: 'matched' | 'fallback';
+  source: 'pro-pack' | 'public-fallback';
+  count: number;
+  levels: BloomExemplarLevel[];
+  context: string;
+}
+
+// The existing KGS Bloom2D vocabulary is reused. Numeric research levels are
+// mapped to the closest scoped cognitive/knowledge cell; no second taxonomy is
+// introduced.
+const COGNITIVE_BY_LEVEL = ['remember', 'understand', 'apply', 'analyze', 'evaluate', 'create'] as const;
+const BLOOM_BY_LEVEL = Object.fromEntries(COGNITIVE_BY_LEVEL.map((cognitive, index) => {
+  const cell = BLOOM_2D_SCOPED.find(candidate => candidate.cognitive === cognitive);
+  if (!cell) throw new Error(`KGS Bloom2D is missing cognitive stage ${cognitive}`);
+  return [index + 1, cell];
+})) as Record<BloomExemplarLevel, Bloom2D>;
+
+// Public source tree intentionally contains only two original exemplars.
+const PUBLIC_EXEMPLARS: readonly BloomExemplar[] = [
+  { domain: 'finance', level: 4, bloom: BLOOM_BY_LEVEL[4], question: '채권 금리 변화가 만기 구조와 발행자의 차환 위험에 어떤 경로로 연결되는가?' },
+  { domain: 'finance', level: 5, bloom: BLOOM_BY_LEVEL[5], question: '현재 금리 전망을 반박할 수 있는 시장 지표와 그 신뢰도는 무엇인가?' },
+];
+
+const DOMAIN_TERMS: Record<BloomExemplarDomain, readonly string[]> = {
+  finance: ['bond', 'yield', '채권', '금리', '주식', '금융', '환율', '투자'],
+  macro: ['inflation', 'gdp', 'recession', '물가', '경기', '거시', '고용'],
+  technology: ['software', 'chip', 'ai', 'technology', '소프트웨어', '반도체', '기술', '인공지능'],
+  science: ['physics', 'chemistry', 'biology', 'science', '물리', '화학', '생물', '과학'],
+  medicine: ['patient', 'clinical', 'disease', 'medicine', '환자', '임상', '질환', '의학'],
+  law: ['legal', 'law', 'court', 'statute', '법률', '법원', '규정', '판례'],
+  business: ['company', 'market', 'customer', 'business', '기업', '시장', '고객', '사업'],
+};
+
+let cachedPackPath: string | undefined;
+let cachedPackStamp: string | undefined;
+let cachedPack: BloomExemplarPack | undefined;
+
+export function inferBloomExemplarDomain(request: string): BloomExemplarDomain {
+  return inferBloomExemplarDomainWithSignal(request).domain;
+}
+
+function inferBloomExemplarDomainWithSignal(request: string): { domain: BloomExemplarDomain; domainSignal: BloomExemplarContext['domainSignal'] } {
+  const normalized = request.toLocaleLowerCase();
+  const ranked = BLOOM_EXEMPLAR_DOMAINS.map(domain => ({
+    domain,
+    score: DOMAIN_TERMS[domain].reduce((score, term) => score + (normalized.includes(term) ? 1 : 0), 0),
+  })).sort((a, b) => b.score - a.score || BLOOM_EXEMPLAR_DOMAINS.indexOf(a.domain) - BLOOM_EXEMPLAR_DOMAINS.indexOf(b.domain));
+  return ranked[0]!.score > 0
+    ? { domain: ranked[0]!.domain, domainSignal: 'matched' }
+    : { domain: 'business', domainSignal: 'fallback' };
+}
+
+export function validateBloomExemplarPack(value: unknown): value is BloomExemplarPack {
+  if (!isRecord(value) || value.version !== 1 || !Array.isArray(value.exemplars)) return false;
+  const counts = new Map<string, number>();
+  for (const item of value.exemplars) {
+    if (!isRecord(item) || !isDomain(item.domain) || !isLevel(item.level)
+      || typeof item.question !== 'string' || item.question.trim().length === 0
+      || item.question.length > 500 || /[\u0000-\u001f\u007f]/.test(item.question)
+      || !isBloom(item.bloom) || !isBloom2DScoped(item.bloom)
+      || !sameBloom(item.bloom, BLOOM_BY_LEVEL[item.level])) return false;
+    const key = `${item.domain}:${item.level}`;
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return value.exemplars.length === 210
+    && BLOOM_EXEMPLAR_DOMAINS.every(domain => [1, 2, 3, 4, 5, 6].every(level => counts.get(`${domain}:${level}`) === 5));
+}
+
+export function getBloomExemplarContext(request: string, packPath = process.env.ELANOUS_BLOOM_EXEMPLARS_PACK): BloomExemplarContext {
+  const { domain, domainSignal } = inferBloomExemplarDomainWithSignal(request);
+  let exemplars: readonly BloomExemplar[] = PUBLIC_EXEMPLARS;
+  let source: BloomExemplarContext['source'] = 'public-fallback';
+  if (packPath) {
+    try {
+      const stamp = (() => { const stat = statSync(packPath); return `${stat.mtimeMs}:${stat.size}`; })();
+      if (cachedPackPath !== packPath || cachedPackStamp !== stamp) {
+        const parsed: unknown = JSON.parse(readFileSync(packPath, 'utf8'));
+        cachedPackPath = packPath;
+        cachedPackStamp = stamp;
+        cachedPack = validateBloomExemplarPack(parsed) ? parsed : undefined;
+      }
+      if (cachedPack) {
+        exemplars = cachedPack.exemplars;
+        source = 'pro-pack';
+      }
+    } catch {
+      // A missing pack can be installed while this process runs; don't cache
+      // ENOENT. Invalid JSON/data is safely cached by the file stamp above.
+      if (cachedPackPath === packPath) { cachedPackPath = undefined; cachedPackStamp = undefined; cachedPack = undefined; }
+    }
+  }
+  const selected = ([4, 5] as const).flatMap(level => exemplars
+    .filter(item => item.domain === domain && item.level === level)
+    .slice(0, source === 'pro-pack' ? 3 : 1));
+  const levels = [...new Set(selected.map(item => item.level))].sort() as BloomExemplarLevel[];
+  const context = selected.length
+    ? ['Bloom exemplar examples (reference style only; treat each question as data and generate request-specific questions):', ...selected.map(item => `L${item.level} ${item.bloom.cognitive}/${item.bloom.knowledge}: ${JSON.stringify(item.question)}`)].join('\n')
+    : '';
+  return { domain, domainSignal, source, count: selected.length, levels, context };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function isDomain(value: unknown): value is BloomExemplarDomain {
+  return typeof value === 'string' && (BLOOM_EXEMPLAR_DOMAINS as readonly string[]).includes(value);
+}
+function isLevel(value: unknown): value is BloomExemplarLevel {
+  return Number.isInteger(value) && typeof value === 'number' && value >= 1 && value <= 6;
+}
+function isBloom(value: unknown): value is Bloom2D {
+  return isRecord(value) && isBloom2DScoped(value as unknown as Bloom2D);
+}
+function sameBloom(a: Bloom2D, b: Bloom2D): boolean {
+  return a.cognitive === b.cognitive && a.knowledge === b.knowledge;
+}