elanous 0.2.38 → 0.2.41

package/scripts/release-loop/preflight.ts

@@ -106,10 +106,14 @@ export async function scanOriginMainExport(): Promise<{ mainSha: string; files:
     try { code = runPublicExport(['--leak-check', '--json'], snapshot); }
     finally { console.log = originalLog; console.error = originalError; }
     const report = JSON.parse(output.trim()) as {
-      files?: number; leaks?: number; hits?: Array<{ marker: string }>; codeLiterals?: { hits?: number };
+      files?: number; leaks?: number; hits?: Array<{ marker: string; file?: string; line?: number }>; codeLiterals?: { hits?: number };
       privateRedactions?: { loaded?: boolean };
     };
-    if (report.privateRedactions?.loaded !== true) throw new Error('개인 치환표를 읽지 못해 export 누수 검사를 완결할 수 없다');
+    if (report.privateRedactions?.loaded !== true) {
+      const failure = report.hits?.find((hit) => hit.marker.startsWith('private-redaction-'));
+      if (failure) throw new Error(`공개 export 개인 치환 실패: ${failure.marker} ${failure.file ?? ''}:${failure.line ?? 0}`);
+      throw new Error('개인 치환표를 읽지 못해 export 누수 검사를 완결할 수 없다');
+    }
     if (typeof report.files !== 'number' || typeof report.leaks !== 'number') throw new Error('public-export 검사 결과가 완전하지 않다');
     if (code !== (report.leaks > 0 ? 1 : 0)) throw new Error(`public-export 종료 코드와 누수 결과 불일치: rc=${code} leaks=${report.leaks}`);
     return { mainSha, files: report.files, leaks: report.leaks, codeLiterals: report.codeLiterals?.hits ?? 0 };

package/scripts/release-loop/resume-release.ts

@@ -8,13 +8,16 @@ import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
+import { acquireLockAsync } from '../../src/storage/file-lock.js';
 import { lastJsonObject, runGraph, verifyReleaseCommandRoot, verifyReleaseRecipeSnapshot, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
-import { changedFilesBetween, clearPartialPlan, collectExecutedPodShardImages, planPartialRegate, planStalledShardRecheck, writePartialPlan, writeRecheckPlan } from './gate-partial.js';
+import { changedFilesBetween, clearPartialPlan, collectExecutedPodShardImages, planPartialRegate, planSameCommitRecheck, planStalledShardRecheck, testFileOfId, writePartialPlan, writeRecheckPlan } from './gate-partial.js';
+import { gateAssignableTestsAtCommit, gateEnvFingerprint } from './gate-baseline-receipt.js';
+import { readGateShardManifest, readGateShardResult } from './gate-shard-receipts.js';
 import { gitClosureTree, testsReachingChanged, TRACEABLE_RELEASE_JSON, type ClosureTree } from './gate-closure.js';
-import { releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { assertReleaseResumeApprovalBoundary, releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeGateShardReroute, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
 import { reserveReleaseResumeAttempt } from './resume-cap.js';
 import { cutReleaseBranch } from './cut-branch.js';
 import { releaseLoopConfig } from './unattended-release.js';
@@ -46,6 +49,8 @@ export interface ResumeReleaseDeps {
   ledgerRoot?: string;
   /** GATE-REUSE-BY-DIFF: the tip tree for the import closure — default read from git objects of the tip commit. */
   closureTree?: (commit: string) => ClosureTree;
+  /** Test seam for the pinned Pod gate selection; production reads the selected test universe at the cut commit. */
+  gateTestsAtCommit?: (commit: string) => string[] | null;
   /** Source observation before the first resumed node. */
   onSource?: (line: string) => void;
   /** Test seam; production resolves this from ELANOUS_RELEASE_TRAFFIC_FILE / release.loop.trafficFile. */
@@ -55,6 +60,7 @@ export interface ResumeReleaseDeps {
 export interface ResumeReleaseOptions {
   runId: string; from: string; partial?: boolean; waive?: string; reason?: string;
   acceptedRegressions?: AcceptedRegression[]; gateExecutor?: string; gateHost?: string; gatePodPool?: string;
+  rerouteShard?: string; shardHost?: string; shardOs?: 'darwin' | 'linux';
   commandRoot?: string;
 }
 
@@ -292,14 +298,111 @@ function verifyResumePreflight(run: GraphRunState, opts: ResumeReleaseOptions, d
   }
 }
 
-/** GATE-PARTIAL outcome of a resume — applied (plan written) or the reason it fell back to a full gate. `auto` marks the
- *  default plan of `--from gate` (GATE-REUSE-BY-DIFF); `closure` is set when code changes were followed. */
+/** GATE-PARTIAL outcome of a resume — applied (with its exact remeasure selection) or the reason it fell back to a full gate.
+ *  `auto` marks the default plan of `--from gate` (GATE-REUSE-BY-DIFF); `closure` is set when code changes were followed. */
 export type PartialOutcome = { requested: false }
-  | { requested: true; applied: true; files: number; priorCommit: string; auto?: true; closure?: { reached: number; opaque: number } }
+  | { requested: true; applied: true; files: number; plannedFiles: string[]; priorCommit: string; auto?: true; closure?: { reached: number; opaque: number } }
   | { requested: true; applied: false; reason: string; auto?: true };
 
 /** Build (or clear) the partial re-gate plan for the new tip. Fail-closed: any doubt leaves a full gate.
  *  GATE-REUSE-BY-DIFF: `--from gate` on a moved tip plans by default (`partial: undefined`); `partial: false` opts out. */
+type StalledGateEvidence = {
+  stalledShards: Array<{ shard: number; files: string[]; reason: string }>;
+  partialSummary: { pass: number; fail: number; errors: number; ran: number; files: number };
+  partialFailures: { failures: string[]; errors: string[] };
+  preservedShardCount: number;
+};
+
+/** Recover an interrupted Pod sweep from its atomic shard receipts. No receipt or identity doubt authorizes a partial gate. */
+function stalledGateEvidence(input: { version: string; commit: string; repo: string; roots: string[];
+  gateOutput?: Record<string, unknown>; expectedBase40?: string; expectedTests?: (commit: string) => string[] | null }):
+  { ok: true; evidence: StalledGateEvidence } | { ok: false; reason: string } {
+  const fail = (reason: string) => ({ ok: false as const, reason });
+  if (input.gateOutput && (input.gateOutput.outcome !== 'error' || input.gateOutput.commit !== input.commit))
+    return fail('saved gate result is not an error for the recorded cut');
+  if (!/^[a-f0-9]{40}$/i.test(input.expectedBase40 ?? ''))
+    return fail('saved cutoff baseline is absent or invalid');
+  const fingerprint = gateEnvFingerprint(process.env);
+  let receiptDir: string | undefined;
+  for (const root of input.roots) {
+    const candidate = join(root, 'release', input.version, 'gate-logs', 'cut', 'receipts');
+    if (existsSync(candidate)) { receiptDir = candidate; break; }
+  }
+  if (!receiptDir) return fail('stalled gate receipts are absent');
+  const names = readdirSync(receiptDir).filter((name) => /^pod-\d+\.receipt\.json$/.test(name)).sort((a, b) =>
+    Number(/^pod-(\d+)/.exec(a)![1]) - Number(/^pod-(\d+)/.exec(b)![1]));
+  if (!names.length || names.some((name, index) => Number(/^pod-(\d+)/.exec(name)![1]) !== index))
+    return fail('stalled gate receipt shard set is incomplete');
+  const allFiles: string[] = [];
+  const failures: string[] = [];
+  const errors: string[] = [];
+  const stalledShards: StalledGateEvidence['stalledShards'] = [];
+  const imageDigests = new Set<string>();
+  let pass = 0, failCount = 0, errorCount = 0, ran = 0, files = 0, preservedShardCount = 0;
+  let base40: string | undefined;
+  for (const name of names) {
+    const id = name.slice(0, -'.receipt.json'.length);
+    const receipt = readGateShardManifest(receiptDir, id);
+    if (!receipt || receipt.head40 !== input.commit || !/^[a-f0-9]{40}$/i.test(receipt.base40)
+      || !receipt.files.length
+      || receipt.files.some((file) => typeof file !== 'string'
+        || !/^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/.test(file) || file.split('/').includes('..'))
+      || typeof receipt.envKey !== 'string' || typeof receipt.host !== 'string')
+      return fail(`stalled gate receipt identity or file list is invalid: ${id}`);
+    if (receipt.base40 !== input.expectedBase40)
+      return fail(`stalled gate receipt baseline differs from saved cutoff baseline: ${id}`);
+    if (base40 && receipt.base40 !== base40) return fail(`stalled gate receipts disagree on baseline: ${id}`);
+    base40 = receipt.base40;
+    allFiles.push(...receipt.files);
+    if (receipt.status === 'unmeasured') {
+      stalledShards.push({ shard: Number(id.slice(4)), files: [...receipt.files], reason: 'incomplete' });
+      continue;
+    }
+    if (!receipt.envKey.startsWith(`${fingerprint}:`)) return fail(`stalled gate receipt environment mismatch: ${id}`);
+    const imageDigest = receipt.envKey.slice(fingerprint.length + 1);
+    if (!/^sha256:[a-f0-9]{64}$/i.test(imageDigest)) return fail(`stalled gate receipt image identity is missing: ${id}`);
+    imageDigests.add(imageDigest.toLowerCase());
+    const result = readGateShardResult(receiptDir, { shard: { id, files: receipt.files }, head40: input.commit,
+      base40: receipt.base40, envKey: receipt.envKey });
+    if (!result) return fail(`stalled gate receipt payload is incomplete or corrupt: ${id}`);
+    const totals = result.runs.reduce((sum, run) => ({ pass: sum.pass + run.pass, fail: sum.fail + run.fail,
+      errors: sum.errors + run.errors, ran: sum.ran + run.ran, files: sum.files + run.files }),
+    { pass: 0, fail: 0, errors: 0, ran: 0, files: 0 });
+    if (!Object.values(totals).every(Number.isSafeInteger) || receipt.failureIds.length !== totals.fail
+      || receipt.errorIds.length !== totals.errors)
+      return fail(`stalled gate receipt counts do not reconcile: ${id}`);
+    pass += totals.pass; failCount += totals.fail; errorCount += totals.errors; ran += totals.ran; files += totals.files;
+    failures.push(...receipt.failureIds); errors.push(...receipt.errorIds); preservedShardCount++;
+  }
+  if (!stalledShards.length) return fail('no incomplete shard receipt identifies the interrupted work');
+  if (new Set(allFiles).size !== allFiles.length) return fail('stalled gate receipt file assignments overlap');
+  if (imageDigests.size !== 1) return fail('stalled gate completed shards do not share one executed image');
+  const expected = (input.expectedTests ?? ((commit) => gateAssignableTestsAtCommit(input.repo, commit)))(input.commit);
+  if (!expected || JSON.stringify([...expected].sort()) !== JSON.stringify([...allFiles].sort()))
+    return fail('stalled gate receipts do not cover the pinned test selection');
+  const partialSummary = { pass, fail: failCount, errors: errorCount, ran, files };
+  const partialFailures = { failures: [...new Set(failures)].sort(), errors: [...new Set(errors)].sort() };
+  const gate = input.gateOutput;
+  if (gate) {
+    const savedSummary = gate.partialSummary as Partial<StalledGateEvidence['partialSummary']> | undefined;
+    const savedFailures = gate.partialFailures as Partial<StalledGateEvidence['partialFailures']> | undefined;
+    if (savedSummary && JSON.stringify(savedSummary) !== JSON.stringify(partialSummary))
+      return fail('saved gate summary disagrees with shard receipts');
+    if (savedFailures && (JSON.stringify([...((savedFailures.failures as string[] | undefined) ?? [])].sort()) !== JSON.stringify(partialFailures.failures)
+      || JSON.stringify([...((savedFailures.errors as string[] | undefined) ?? [])].sort()) !== JSON.stringify(partialFailures.errors)))
+      return fail('saved gate failures disagree with shard receipts');
+    if (gate.preservedShardCount !== undefined && gate.preservedShardCount !== preservedShardCount)
+      return fail('saved preserved shard count disagrees with shard receipts');
+    if (Array.isArray(gate.stalledShards)) {
+      const savedStalled = gate.stalledShards.flatMap((item) => item && typeof item === 'object'
+        && Array.isArray((item as { files?: unknown }).files) ? (item as { files: string[] }).files : []).sort();
+      if (JSON.stringify(savedStalled) !== JSON.stringify(stalledShards.flatMap((item) => item.files).sort()))
+        return fail('saved stalled shard list disagrees with shard receipts');
+    }
+  }
+  return { ok: true, evidence: { stalledShards, partialSummary, partialFailures, preservedShardCount } };
+}
+
 function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean; gateExecutor?: string }, deps: ResumeReleaseDeps, dryRun = false): PartialOutcome {
   const root = deps.root ?? effectiveInstanceRoot();
   // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
@@ -355,9 +458,11 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     debug.log('release-loop.resume', 'stalled-recheck-planned', { version: tip.version, commit: tip.to,
       planKind: planned.plan.kind, remeasureFileCount: planned.plan.files.length,
       preservedShardCount: planned.plan.preservedShardCount ?? 0, fallbackReason: null, path });
-    return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.to, ...(auto ? { auto: true as const } : {}) };
+    return { requested: true, applied: true, files: planned.plan.files.length, plannedFiles: [...planned.plan.files], priorCommit: tip.to,
+      ...(auto ? { auto: true as const } : {}) };
   }
   let prior: { commit?: unknown; failures?: unknown; errors?: unknown } | undefined;
+  let movedStalledEvidence: StalledGateEvidence | undefined;
   for (const location of [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])]) {
     const path = join(location, 'release', tip.version, 'gate-failures.json');
     if (!existsSync(path)) continue;
@@ -367,7 +472,19 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     if (record?.commit === tip.from) { prior = record; break; }
   }
   if (!prior || !Array.isArray(prior.failures) || !(prior.errors === undefined || Array.isArray(prior.errors))) {
-    return fallback(`no complete gate record for ${tip.from.slice(0, 12)} (a stalled or errored gate keeps none)`);
+    const gateRecord = saved.nodes.find((node) => node.nodeId === 'gate');
+    const gateOutput = gateRecord ? lastJsonObject(gateRecord.output) as Record<string, unknown> | undefined : undefined;
+    const cutoffRecord = saved.nodes.find((node) => node.nodeId === 'cutoff');
+    const cutoffOutput = cutoffRecord ? lastJsonObject(cutoffRecord.output) as Record<string, unknown> | undefined : undefined;
+    const expectedBase40 = (cutoffOutput?.baseline as { sha?: unknown } | undefined)?.sha;
+    const evidence = stalledGateEvidence({ version: tip.version, commit: tip.from, repo: deps.repo ?? process.cwd(),
+      roots: [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])], gateOutput,
+      ...(typeof expectedBase40 === 'string' ? { expectedBase40 } : {}),
+      expectedTests: deps.gateTestsAtCommit });
+    if (!evidence.ok) return fallback(`no complete gate record for ${tip.from.slice(0, 12)}; ${evidence.reason}`);
+    movedStalledEvidence = evidence.evidence;
+    prior = { commit: tip.from, failures: movedStalledEvidence.partialFailures.failures,
+      errors: movedStalledEvidence.partialFailures.errors };
   }
   // Both sides of a rename count (`--no-renames`): a source moved to a test/Markdown name is still a source change.
   let changed: string[];
@@ -403,10 +520,11 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   const savedInput = saved.input as { gateExecutor?: unknown; gatePodPool?: unknown };
   const podGate = (opts.gateExecutor ?? savedInput.gateExecutor ?? (savedInput.gatePodPool ? 'pod' : undefined)) === 'pod';
   const priorShards = priorCutLogs ? collectExecutedPodShardImages(priorCutLogs, tip.from) : undefined;
-  const planned = planPartialRegate({ version: tip.version, priorCommit: tip.from, forCommit: tip.to, changedFiles: changed,
+  const stalledFiles = movedStalledEvidence?.stalledShards.flatMap((shard) => shard.files) ?? [];
+  const planned = planPartialRegate({ version: tip.version, priorCommit: tip.from, forCommit: tip.to, changedFiles: [...changed, ...stalledFiles],
     priorFailures: prior.failures as string[], priorErrors: (prior.errors ?? []) as string[],
     existsAtTip: (file) => tracked.has(file),
-    ...(podGate ? { priorShards: priorShards ?? [] } : {}),
+    ...((podGate || movedStalledEvidence) ? { priorShards: priorShards ?? [] } : {}),
     closure: (changedCode) => testsReachingChanged(tree, changedCode, tests, { cliEntries: CLI_ENTRIES }) });
   if (!planned.ok) return fallback(planned.reason);
   if (planned.plan.files.length >= tests.length) return fallback(`every test is re-run (${tests.length}) — full gate`);
@@ -426,7 +544,7 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   const path = dryRun ? undefined : writePartialPlan(root, planned.plan);
   debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
     tests: tests.length, auto, ...(path ? { path } : {}), dryRun, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
-  return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.from,
+  return { requested: true, applied: true, files: planned.plan.files.length, plannedFiles: [...planned.plan.files], priorCommit: tip.from,
     ...(auto ? { auto: true as const } : {}), ...(planned.closure ? { closure: planned.closure } : {}) };
 }
 
@@ -456,12 +574,16 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
   const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
   const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
   if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
+  assertReleaseResumeApprovalBoundary({ ...savedRun, statePath }, opts.from);
   if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
+  if ((opts.shardHost !== undefined || opts.shardOs !== undefined) && opts.rerouteShard === undefined)
+    throw new Error('--shard-host/--shard-os require --reroute-shard');
   const hasOverrides = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined
-    || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined;
+    || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined || opts.rerouteShard !== undefined;
   const original = hasOverrides ? savedRun : undefined;
   if (original && opts.gateExecutor !== undefined) releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost });
   if (original && opts.gatePodPool !== undefined) releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool });
+  if (original && opts.rerouteShard !== undefined) releaseResumeGateShardReroute(original, { from: opts.from, shard: opts.rerouteShard, host: opts.shardHost, os: opts.shardOs });
   const waiver = original && (opts.waive !== undefined || opts.reason !== undefined) ? releaseResumeWaiver(original, opts) : undefined;
   if (original && opts.acceptedRegressions !== undefined && !waiver)
     releaseResumeAcceptedRegressions(original, opts.acceptedRegressions, opts.from);
@@ -478,10 +600,11 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
     waiverCommit = recorded;
   }
   const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  if (opts.rerouteShard !== undefined && tip.changed) throw new Error('shard reroute requires the original cut head; moved tip needs a full re-gate');
   verifyResumeRecipePin(opts.commandRoot ?? process.cwd(), savedRun.graphSnapshot, tip.version);
   const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), tip.to, deps.git);
   verifyResumePreflight(savedRun, opts, deps, tip.version, tip.from, tip.to, commandRoot);
-  const partial = preparePartial(tip, opts, deps, true);
+  const partial = preparePartial(tip, opts.rerouteShard !== undefined ? { ...opts, partial: false } : opts, deps, true);
   const fromIndex = savedRun.path.indexOf(opts.from);
   const gateIndex = savedRun.path.indexOf('gate');
   const gateWillRun = fromIndex >= 0 && gateIndex >= fromIndex;
@@ -498,15 +621,20 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
   deps = { ...deps, root: releaseRunUniverse({ root: deps.root }) };
   const statePath = join(deps.root!, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
   const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+  assertReleaseResumeApprovalBoundary({ ...savedRun, statePath }, opts.from);
   let waiverCommit: string | undefined;
   if (opts.gateHost !== undefined && opts.gateExecutor === undefined) throw new Error('--gate-host requires --gate-executor host');
-  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined
+  if ((opts.shardHost !== undefined || opts.shardOs !== undefined) && opts.rerouteShard === undefined)
+    throw new Error('--shard-host/--shard-os require --reroute-shard');
+  const original = opts.waive !== undefined || opts.reason !== undefined || opts.acceptedRegressions !== undefined || opts.gateExecutor !== undefined || opts.gatePodPool !== undefined || opts.rerouteShard !== undefined
     ? savedRun : undefined;
   // GATE-HOST-EXECUTOR: checked before the tip refresh writes anything; the runner checks it again under the resume lock.
   const gateExecutor = original && opts.gateExecutor !== undefined
     ? releaseResumeGateExecutor(original, { from: opts.from, executor: opts.gateExecutor, host: opts.gateHost }) : undefined;
   const gatePodPool = original && opts.gatePodPool !== undefined
     ? releaseResumeGatePodPool(original, { from: opts.from, pool: opts.gatePodPool }) : undefined;
+  const shardReroute = original && opts.rerouteShard !== undefined
+    ? releaseResumeGateShardReroute(original, { from: opts.from, shard: opts.rerouteShard, host: opts.shardHost, os: opts.shardOs }) : undefined;
   if (gateExecutor) debug.log('release-loop.resume', 'gate-executor', { runId: opts.runId, from: opts.from, executor: gateExecutor.set.gateExecutor, host: gateExecutor.set.gateRemote ?? null, previous: gateExecutor.previous });
   if (gatePodPool) debug.log('release-loop.resume', 'gate-pod-pool', {
     runId: opts.runId, from: opts.from, pool: gatePodPool.set.gatePodPool, previous: gatePodPool.previous,
@@ -534,11 +662,12 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
   }
   // The read-only tip and recipe pin preflight must pass before fetch or a saved-run rewrite.
   const previewTip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
+  if (shardReroute && previewTip.changed) throw new Error('shard reroute requires the original cut head; moved tip needs a full re-gate');
   verifyResumeRecipePin(opts.commandRoot ?? process.cwd(), savedRun.graphSnapshot, previewTip.version);
   const commandRoot = verifyReleaseCommandRoot(opts.commandRoot ?? process.cwd(), previewTip.to, deps.git);
   verifyResumePreflight(savedRun, opts, deps, previewTip.version, previewTip.from, previewTip.to, commandRoot);
   const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, false, previewTip.to);
-  const partial = preparePartial(tip, opts, deps);
+  const partial = preparePartial(tip, shardReroute ? { ...opts, partial: false } : opts, deps);
   // A failed preflight does not consume an observed release resume attempt.
   const attempt = reserveReleaseResumeAttempt(savedRun, deps.root!, { now: deps.now });
   debug.log('release-loop.resume', 'attempt', { runId: opts.runId, attempt: attempt.attempt,
@@ -553,6 +682,9 @@ async function resumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: ResumeRe
     ...(acceptedRegressions ? { releaseAcceptedRegressions: { requested: opts.acceptedRegressions!, acceptedRegressions } } : {}),
     ...(gateExecutor ? { releaseGateExecutor: { executor: gateExecutor.set.gateExecutor, ...(opts.gateHost !== undefined ? { host: opts.gateHost } : {}) } } : {}),
     ...(gatePodPool ? { releaseGatePodPool: gatePodPool.set.gatePodPool } : {}),
+    ...(shardReroute ? { releaseGateShardReroute: { shard: shardReroute.set.gateRerouteShard,
+      ...(shardReroute.set.gateShardHost ? { host: shardReroute.set.gateShardHost } : {}),
+      ...(opts.shardOs ? { os: opts.shardOs } : {}) } } : {}),
     deps: { root: deps.root, ...(deps.runBash ? { runBash: deps.runBash } : {}) } });
   return { tip, partial, state };
 }
@@ -589,6 +721,23 @@ export interface RecoverReleaseResult {
   resume?: { status: string; tip: TipRefresh; partial: PartialOutcome };
 }
 
+export interface RecoverReleaseLandingOptions {
+  runId: string;
+  /** The landed repair commit on main; this is the idempotency key for a landing notification. */
+  mergeSha: string;
+  from?: string;
+  commandRoot?: string;
+  partial?: boolean;
+  repoRoot?: string;
+}
+
+export type RecoverReleaseLandingResult = RecoverReleaseResult & { duplicate: boolean };
+
+/** Commander represents `--no-partial` as false and its default (flag omitted) as true. */
+export function recoverLandingPartialOption(optionValue?: boolean): boolean | undefined {
+  return optionValue === false ? false : undefined;
+}
+
 export interface RecoverReleaseDeps extends ResumeReleaseDeps {
   /** `release cut-branch --append` — tests record the plan instead of pushing the branch. */
   cutBranch?: typeof cutReleaseBranch;
@@ -604,11 +753,19 @@ export class ReleaseRecoverStopped extends Error {
   }
 }
 
+function readRecoverJson(path: string, label: string): unknown {
+  try { return JSON.parse(readFileSync(path, 'utf8')) as unknown; }
+  catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`release ${label} JSON을 읽을 수 없다: ${path} (${detail}) — 파일을 보존하고 원장을 올바른 JSON으로 복구한 뒤 재시도하라.`);
+  }
+}
+
 /** Append one stage result to the resume-attempts ledger. `attempts[]` keeps its shape — the stage results are added. */
 function recordRecoverStage(entry: { root: string; runId: string; version: string; priorCountKnown: boolean; stage: RecoverStageRecord }): void {
   const path = join(entry.root, 'release', entry.version, 'resume-attempts', `${entry.runId}.json`);
   const saved = existsSync(path)
-    ? JSON.parse(readFileSync(path, 'utf8')) as { attempts?: unknown; recoveries?: unknown; priorCountKnown?: unknown }
+    ? readRecoverJson(path, 'resume attempts 원장') as { attempts?: unknown; recoveries?: unknown; priorCountKnown?: unknown }
     : undefined;
   if (saved !== undefined && (!saved || typeof saved !== 'object' || Array.isArray(saved) || !Array.isArray(saved.attempts)
     || (saved.recoveries !== undefined && !Array.isArray(saved.recoveries)))) throw new Error('release resume attempts ledger invalid');
@@ -622,16 +779,39 @@ function recordRecoverStage(entry: { root: string; runId: string; version: strin
   renameSync(temporary, path);
 }
 
+async function acquireReleaseRecoveryLock(root: string, runId: string) {
+  const lockDir = join(root, 'release', 'recovery-locks');
+  mkdirSync(lockDir, { recursive: true });
+  // A full-gate subprocess can block this process's event loop, delaying the async lock heartbeat.
+  // The observed release gate reached 2h20m; leave a finite four-hour stale/wait window for one recovery.
+  const lock = await acquireLockAsync(join(lockDir, `${runId}.lock`), {
+    staleMs: 4 * 60 * 60_000, retryBusyMs: 1_000, maxTries: 14_400,
+  });
+  if (!lock.stillHeld()) {
+    lock.release();
+    throw new Error(`release recovery lock was lost for ${runId} — retry after inspecting the recovery ledger`);
+  }
+  return lock;
+}
+
 /**
  * Repair a failed release run in one command: append dry-run (plan only) → append (fast-forward release/<v> onto the
  * picked repairs) → resume --from export-check (preflight plan, then the graph). A failing stage stops the command:
  * the later stages never run, and the stage results are already in the ledger for the human to read.
  */
 export async function recoverReleaseRun(opts: RecoverReleaseOptions, deps: RecoverReleaseDeps = {}): Promise<RecoverReleaseResult> {
-  if (!Array.isArray(opts.pick) || !opts.pick.length) throw new Error('release recover requires at least one --pick commit');
   const root = releaseRunUniverse({ root: deps.root });
+  const runId = safeRunId(opts.runId);
+  const lock = await acquireReleaseRecoveryLock(root, runId);
+  try {
+    return await recoverReleaseRunLocked(opts, deps, root);
+  } finally { lock.release(); }
+}
+
+async function recoverReleaseRunLocked(opts: RecoverReleaseOptions, deps: RecoverReleaseDeps, root: string): Promise<RecoverReleaseResult> {
+  if (!Array.isArray(opts.pick) || !opts.pick.length) throw new Error('release recover requires at least one --pick commit');
   const statePath = join(root, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
-  const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+  const savedRun = readRecoverJson(statePath, 'release run 상태') as GraphRunState;
   if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
   // The saved version-release record names what to repair: the release branch and the commit the run cut.
   const versionRecord = savedRun.nodes.find((node) => node.nodeId === 'version-release');
@@ -692,8 +872,9 @@ export async function recoverReleaseRun(opts: RecoverReleaseOptions, deps: Recov
   const now = (): string => (deps.now?.() ?? new Date()).toISOString();
   const stages: RecoverStageRecord[] = [];
   const record = (stage: RecoverStageRecord): void => {
-    stages.push(stage);
-    recordRecoverStage({ root, runId: opts.runId, version, priorCountKnown: !savedRun.resume, stage });
+    const withPick = { ...stage, pick: stage.pick ?? [...opts.pick] };
+    stages.push(withPick);
+    recordRecoverStage({ root, runId: opts.runId, version, priorCountKnown: !savedRun.resume, stage: withPick });
   };
   const stop = (stage: RecoverStageName, error: unknown): never => {
     throw new ReleaseRecoverStopped(stage, stages, RECOVER_STAGES.slice(RECOVER_STAGES.indexOf(stage) + 1),
@@ -718,7 +899,7 @@ export async function recoverReleaseRun(opts: RecoverReleaseOptions, deps: Recov
   };
   const ledgerPath = join(root, 'release', version, 'resume-attempts', `${opts.runId}.json`);
   const recoveries: RecoverStageRecord[] = existsSync(ledgerPath)
-    ? ((JSON.parse(readFileSync(ledgerPath, 'utf8')) as { recoveries?: unknown[] }).recoveries ?? []) as RecoverStageRecord[]
+    ? ((readRecoverJson(ledgerPath, 'resume attempts 원장') as { recoveries?: unknown[] }).recoveries ?? []) as RecoverStageRecord[]
     : [];
   let appendedCommit: string | undefined;
   for (let index = recoveries.length - 1; index >= 0; index -= 1) {
@@ -828,3 +1009,69 @@ export async function recoverReleaseRun(opts: RecoverReleaseOptions, deps: Recov
     }
   }
 }
+
+/**
+ * Manual landing-event entrypoint. The event's merge SHA is the dedupe key; once that repair has completed its
+ * resume stage, a redelivered event returns the recorded result without appending or running the graph again.
+ * The event producer can call this after its own hook lands; this function does not subscribe to PR-land events.
+ */
+export async function recoverReleaseRunFromLanding(opts: RecoverReleaseLandingOptions,
+  deps: RecoverReleaseDeps = {}): Promise<RecoverReleaseLandingResult> {
+  if (!/^[0-9a-f]{40}$/i.test(opts.mergeSha)) throw new Error('release recover-landing requires a full 40-hex merge SHA');
+  const root = releaseRunUniverse({ root: deps.root });
+  const runId = safeRunId(opts.runId);
+  // Share one run-scoped lock with manual `release recover`: the dedupe read, append, and resume must not race.
+  const landingLock = await acquireReleaseRecoveryLock(root, runId);
+  try {
+    return await recoverReleaseRunFromLandingLocked(opts, deps, root, runId);
+  } finally { landingLock.release(); }
+}
+
+async function recoverReleaseRunFromLandingLocked(opts: RecoverReleaseLandingOptions, deps: RecoverReleaseDeps,
+  root: string, runId: string): Promise<RecoverReleaseLandingResult> {
+  const pick = [opts.mergeSha.toLowerCase()];
+  const statePath = join(root, 'graph-runs', 'release-loop', `${runId}.json`);
+  if (existsSync(statePath)) {
+    const savedRun = readRecoverJson(statePath, 'release run 상태') as GraphRunState;
+    const versionNode = savedRun.nodes.find((node) => node.nodeId === 'version-release');
+    const recorded = lastJsonObject(versionNode?.output);
+    const version = typeof recorded?.version === 'string' ? recorded.version : '';
+    if (savedRun.graphId === 'release-loop' && savedRun.runId === runId && isReleaseVersion(version)) {
+      const ledgerPath = join(root, 'release', version, 'resume-attempts', `${runId}.json`);
+      if (existsSync(ledgerPath)) {
+        const ledger = readRecoverJson(ledgerPath, 'resume attempts 원장') as { recoveries?: unknown };
+        if (ledger.recoveries !== undefined && !Array.isArray(ledger.recoveries)) throw new Error(`release resume attempts ledger invalid: ${ledgerPath}`);
+        const records = (ledger.recoveries ?? []) as RecoverStageRecord[];
+        const matchesPick = (entry: RecoverStageRecord): boolean => Array.isArray(entry.pick)
+          && entry.pick.some((sha) => typeof sha === 'string' && sha.toLowerCase() === pick[0]);
+        let completedIndex = -1;
+        for (let index = records.length - 1; index >= 0; index -= 1) {
+          const entry = records[index]!;
+          if (matchesPick(entry) && entry.stage === 'resume' && entry.outcome === 'ok') {
+            completedIndex = index;
+            break;
+          }
+        }
+        if (completedIndex >= 0) {
+          let cycleStart = completedIndex;
+          for (let index = completedIndex; index >= 0; index -= 1) {
+            const entry = records[index]!;
+            if (matchesPick(entry) && entry.stage === 'append-dry-run') {
+              cycleStart = index;
+              break;
+            }
+          }
+          const completed = records[completedIndex]!;
+          return { runId, version, branch: `release/${version}`, fromNode: completed.from ?? opts.from ?? RECOVER_FIRST_NODE,
+            stages: records.slice(cycleStart, completedIndex + 1).filter(matchesPick), duplicate: true };
+        }
+      }
+    }
+  }
+  const result = await recoverReleaseRunLocked({ runId, pick,
+    ...(opts.from === undefined ? {} : { from: opts.from }),
+    ...(opts.commandRoot === undefined ? {} : { commandRoot: opts.commandRoot }),
+    ...(opts.partial === undefined ? {} : { partial: opts.partial }),
+    ...(opts.repoRoot === undefined ? {} : { repoRoot: opts.repoRoot }) }, deps, root);
+  return { ...result, duplicate: false };
+}

package/scripts/release-loop/resume.ts

@@ -1,9 +1,31 @@
+import { readFileSync } from 'node:fs';
 import { lastJsonObject, STOPPED_NODE_ERROR, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { publicWaiverReason } from './known-issues-node.js';
 import { checkGateExecutorChoice, type GateExecutor } from './gate-executor.js';
 
 export interface AcceptedRegression { id: string; note: string }
 
+/** Match the graph runner's approval boundary before release resume performs tip refresh or writes an attempt. */
+export function assertReleaseResumeApprovalBoundary(state: GraphRunState, from: string): void {
+  if (!Array.isArray(state.path)) return;
+  const start = state.path.indexOf(from);
+  if (start < 0 || state.path.lastIndexOf(from) !== start) {
+    return;
+  }
+  for (let index = 0; index < state.nodes.length; index++) {
+    const record = state.nodes[index]!;
+    if (typeof record.decidedAt !== 'string') continue;
+    if (index >= start) throw new Error('cannot restart across an approval decision — start a new release run with the full gate');
+    if (!record.ok) throw new Error('cannot preserve a failed predecessor when resuming');
+    let decision: { nodeId?: unknown; decision?: unknown; decidedAt?: unknown };
+    try { decision = JSON.parse(readFileSync(`${state.statePath}.${index + 1}.decision.json`, 'utf8')); }
+    catch { throw new Error(`missing approval decision for ${record.nodeId}`); }
+    if (decision.nodeId !== record.nodeId || decision.decision !== 'approved' || decision.decidedAt !== record.decidedAt) {
+      throw new Error(`invalid approval decision for ${record.nodeId}`);
+    }
+  }
+}
+
 /** Merge explicit public issues with the saved release input without changing the ledger shape. */
 export function releaseResumeAcceptedRegressions(state: GraphRunState, additions: AcceptedRegression[], from?: string): AcceptedRegression[] {
   if (!Array.isArray(additions) || additions.some((issue) => !issue || typeof issue.id !== 'string' || !issue.id.trim() || typeof issue.note !== 'string' || !issue.note.trim())) {
@@ -154,6 +176,32 @@ export interface GatePodPoolOverride {
   previous: { gatePodPool: unknown };
 }
 
+/** One shard keeps its component identity while the run-time scheduler chooses a compatible member. */
+export interface GateShardRerouteOverride {
+  kind: 'gate-shard-reroute'; at: string; from: string;
+  set: { gateRerouteShard: string; gateShardHost?: string; gateShardCapabilities?: Record<string, { os: 'darwin' | 'linux' }> };
+  previous: { gateRerouteShard: unknown; gateShardHost: unknown; gateShardCapabilities: unknown };
+}
+
+export function releaseResumeGateShardReroute(state: GraphRunState, opts: {
+  from: string; shard: unknown; host?: unknown; os?: unknown; at?: string;
+}): GateShardRerouteOverride {
+  const input = state.input as Record<string, unknown> | undefined;
+  if (!input || typeof input.gatePodPool !== 'string' || !input.gatePodPool.trim())
+    throw new Error('shard reroute requires the saved Pod gate pool');
+  if (opts.from !== 'gate' || !state.path.includes('gate')) throw new Error('shard reroute requires --from gate');
+  if (typeof opts.shard !== 'string' || !/^(?:auto|pod-\d+)$/.test(opts.shard))
+    throw new Error('--reroute-shard requires auto or pod-N');
+  if (opts.host !== undefined && (typeof opts.host !== 'string' || !opts.host.trim())) throw new Error('--shard-host requires a pool context');
+  if (opts.os !== undefined && (opts.shard === 'auto' || opts.os !== 'darwin' && opts.os !== 'linux'))
+    throw new Error('--shard-os requires pod-N and darwin or linux');
+  return { kind: 'gate-shard-reroute', at: opts.at ?? new Date().toISOString(), from: opts.from,
+    set: { gateRerouteShard: opts.shard, ...(opts.host ? { gateShardHost: opts.host.trim() } : {}),
+      ...(opts.os ? { gateShardCapabilities: { [opts.shard]: { os: opts.os } } } : {}) },
+    previous: { gateRerouteShard: input.gateRerouteShard ?? null, gateShardHost: input.gateShardHost ?? null,
+      gateShardCapabilities: input.gateShardCapabilities ?? null } };
+}
+
 export function releaseResumeGatePodPool(state: GraphRunState, opts: { from: string; pool: unknown; at?: string }): GatePodPoolOverride {
   const input = state.input;
   if (!input || typeof input !== 'object' || Array.isArray(input) || typeof (input as { version?: unknown }).version !== 'string') throw new Error('release run has no input');

package/scripts/release-loop/traffic-node.ts

@@ -42,7 +42,10 @@ export async function runTrafficNode(node = process.argv[2], env: NodeJS.Process
       return finishNode(node!, version, { outcome: 'fail', verdict: 'fail', summary });
     }
     const result = await applyReleaseTrafficEvent(context, event, options);
-    if (!result.applied) {
+    // Replaying the terminal restore after this run already restored its pre-cut traffic is a successful no-op.
+    const alreadyRestored = event === 'failed' && result.reason === 'already-restored';
+    const applied = result.applied || alreadyRestored;
+    if (!applied) {
       const consequence = event === 'failed' && result.reason === 'published-keeps-full'
         ? 'npm 발행은 완료됐으므로 전체 트래픽을 유지합니다. 후속 발행 단계 실패를 확인하세요.'
         : event === 'verify-complete' || event === 'npm-published'
@@ -52,8 +55,8 @@ export async function runTrafficNode(node = process.argv[2], env: NodeJS.Process
               : 'gate는 성공했으나 트래픽 감속이 적용되지 않았습니다.';
       (deps.report ?? reportFailure)(`RELEASE-POSTPUB-TRAFFIC ${version} ${runId || 'unknown'} ${node} 무시 — ${result.reason ?? 'traffic state unchanged'}. ${consequence}`);
     }
-    return finishNode(node!, version, { outcome: result.applied ? 'ok' : 'fail', verdict: result.applied ? 'pass' : 'fail',
-      summary: `${event} ${result.applied ? 'applied' : result.reason ?? 'ignored'}` });
+    return finishNode(node!, version, { outcome: applied ? 'ok' : 'fail', verdict: applied ? 'pass' : 'fail',
+      summary: `${event} ${alreadyRestored ? 'already-restored' : applied ? 'applied' : result.reason ?? 'ignored'}` });
   } catch (error) {
     const detail = errorResult(error).summary;
     const isLockTimeout = detail.startsWith('traffic lock timeout:');

package/scripts/release-loop/unattended-release.ts

@@ -49,6 +49,7 @@ export interface ReleaseLoopConfig {
 export interface ReleaseRunInput extends ReleaseLoopConfig {
   version: string;
   previousVersion: string;
+  triggerEvent?: { id: string; type: 'release.cut.due'; version: string; cutAt: string; at: string };
   cutCommit?: string;
   /** Required for the pod executor (the default); a host-executor run may have none. */
   gatePodPool?: string;
@@ -143,7 +144,7 @@ export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDep
 
 /** Fail closed at the entry boundary, before any graph node can change a release. */
 export async function runUnattendedRelease(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string; triggerEvent?: ReleaseRunInput['triggerEvent'] },
   deps: UnattendedReleaseDeps = {},
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // A dry run only builds the input and mutates nothing, so it neither creates nor waits on the OP-seat lock.
@@ -154,7 +155,7 @@ export async function runUnattendedRelease(
 }
 
 async function runUnattendedReleaseLocked(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string; triggerEvent?: ReleaseRunInput['triggerEvent'] },
   deps: UnattendedReleaseDeps,
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
@@ -171,6 +172,7 @@ async function runUnattendedReleaseLocked(
   }
   const version = resolveRunVersion(opts.version, opts.prerelease, deps);
   const input = buildReleaseRunInput(version, deps, opts.cutCommit, { executor: opts.gateExecutor, host: opts.gateHost });
+  if (opts.triggerEvent) input.triggerEvent = opts.triggerEvent;
   if (opts.publishAt !== undefined) {
     const invalid = publishAtError(opts.publishAt);
     if (invalid) throw new Error(invalid);

package/scripts/release-loop/version-node.ts

@@ -465,14 +465,19 @@ export function main(args: string[] = process.argv.slice(2), repo = process.cwd(
       const location = process.env.ELANOUS_GRAPH_CONTEXT;
       const context = JSON.parse(location.trimStart().startsWith('{') ? location : readFileSync(location, 'utf8')) as {
         runId?: unknown; input?: { version?: unknown; cutCommit?: unknown; forceFreeze?: unknown; branchCut?: unknown };
-        outputs?: Record<string, { commit?: unknown; base?: unknown; branch?: unknown } | undefined> };
+        outputs?: Record<string, { outcome?: unknown; commit?: unknown; base?: unknown; branch?: unknown } | undefined> };
       if (context.runId !== undefined) {
         if (typeof context.runId !== 'string') throw new Error('runId must be a string');
         runId = context.runId;
       }
       if (!version && typeof context.input?.version === 'string') version = context.input.version;
       forceFreeze = context.input?.forceFreeze === true;
-      branchCut = context.input?.branchCut === true;
+      const releasedBranch = context.outputs?.['version-release']?.branch;
+      branchCut = context.input?.branchCut === true
+        || (kind === 'dev-bump'
+          && context.outputs?.['version-release']?.outcome === 'ok'
+          && typeof version === 'string'
+          && releasedBranch === `release/${version}`);
       if (kind === 'release' && cutCommit === undefined && context.input?.cutCommit !== undefined) {
         if (typeof context.input.cutCommit !== 'string') throw new Error('cutCommit must be a commit SHA');
         cutCommit = context.input.cutCommit;