elanous 0.2.38 → 0.2.41

package/src/cli/pr-land-heavy-remote.ts

@@ -8,10 +8,8 @@ import { debug, redactSecretText } from '../debug/log.js';
 import { gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote, type GateRemoteRunner, type RemoteRunOutcome } from '../self-implement/gate-remote.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
-// WSL still lands last: its gate environment was repaired (WSL-GATE-ENV, 2026-10-17 — baselineWorkspaceRoot in
-// scripts/ci-typecheck-changed.ts now picks the host disk /var/tmp instead of WSL's 20GiB tmpfs), so the host is
-// allowlisted as the third slot while node-b/node-c keep discovery order — the recorded host order stays part of the
-// evidence contract.
+// This is the stable fallback order when settings.host is unavailable; an explicitly configured allowlisted host
+// always leads, and the remaining allowlisted hosts retain their relative order.
 export const PR_LAND_HEAVY_HOSTS = ['node-b', 'node-c', 'host-e-wsl'] as const;
 export const PR_LAND_HEAVY_HOST = PR_LAND_HEAVY_HOSTS[0];
 export type PrLandHeavyHost = typeof PR_LAND_HEAVY_HOSTS[number];
@@ -74,14 +72,23 @@ function evidencePath(input: HeavyRemoteInput): string {
   return join(input.evidenceDir ?? join(effectiveInstanceRoot(), 'pr-land-heavy-results'), `${input.pr}.json`);
 }
 
+function validRootPlan(value: unknown): value is RootPlanSummary | null {
+  if (value === null) return true;
+  if (!value || typeof value !== 'object') return false;
+  const plan = value as Partial<RootPlanSummary>;
+  return (plan.mode === 'affected' || plan.mode === 'full')
+    && (plan.roots === null || (Number.isSafeInteger(plan.roots) && plan.roots >= 0))
+    && typeof plan.promoted === 'boolean'
+    && (plan.reason === null || typeof plan.reason === 'string');
+}
+
 function matchingEvidence(path: string, input: HeavyRemoteInput): HeavyRemoteEvidence | null {
   if (!existsSync(path)) return null;
   try {
     const data: HeavyRemoteEvidence = JSON.parse(readFileSync(path, 'utf8'));
     return data.schema === 2 && data.pr === input.pr && data.head === input.head
       && data.main === input.main && allowedHost(data.host) && Number.isFinite(data.elapsedMs)
-      && typeof data.interferenceMeasured === 'boolean'
-      && (data.rootPlan === null || (data.rootPlan?.mode === 'affected' || data.rootPlan?.mode === 'full')) ? data : null;
+      && typeof data.interferenceMeasured === 'boolean' && validRootPlan(data.rootPlan) ? data : null;
   } catch { return null; }
 }
 
@@ -214,9 +221,8 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
   const started = now();
   const deadline = started + settings.slotWaitSeconds * 1000;
   let outcome: RemoteRunOutcome = { kind: 'busy' };
-  const primaryHost: PrLandHeavyHost = settings.host;
-  let selectedHost: PrLandHeavyHost = primaryHost;
-  const hosts = [primaryHost, ...PR_LAND_HEAVY_HOSTS.filter((candidate) => candidate !== primaryHost)];
+  let selectedHost: PrLandHeavyHost = PR_LAND_HEAVY_HOSTS[0];
+  const hosts: readonly PrLandHeavyHost[] = [settings.host, ...PR_LAND_HEAVY_HOSTS.filter((host) => host !== settings.host)];
   wait: for (;;) {
     for (const host of hosts) {
       selectedHost = host;

package/src/cli/pty-takeover-cli.ts

@@ -5,7 +5,7 @@ import { dirname, join, resolve } from 'node:path';
 import { runGitCommand } from '../git-fs/runner.js';
 import { debug } from '../debug/log.js';
 import { getPty, listPty, renamePty, requestPtyTakeover, startPty, type StartOpts } from '../pty-shell/registry.js';
-import { describePtyRunState, describeTurnCell, formatTurnCell, ptyTurnViewOfRow, readCheckoutHead, readCurrentInstallRecord, shortSha, UNKNOWN_TURN_CELL, type InstalledRecord, type PtyRunStateView, type PtyTurnCell } from '../pty-shell/tui-run-state.js';
+import { describePtyRunState, describeTurnCell, formatTurnCell, judgeTurnProgress, ptyTurnViewOfRow, readCheckoutHead, readCurrentInstallRecord, shortSha, UNKNOWN_TURN_CELL, type InstalledRecord, type PtyRunStateView, type PtyTurnCell, type TurnProgressJudgment } from '../pty-shell/tui-run-state.js';
 import { getPtyManifest, isProcessAlive, listPtyManifest, listPtyManifestRows, listPtyManifestRowsAt, ptyManifestDbPath, readPtyManifestFrame, reapDeadPtyManifest, reapDeadPtyManifestAt, reapStalePtyManifest, removePtyManifest, PTY_MANIFEST_CLOSED_TTL_MS, PTY_MANIFEST_STALE_MS, type PtyManifestExternalReapResult, type PtyManifestRow } from '../pty-shell/pty-manifest.js';
 import { readPtyEventsAfter, readPtyEventsAfterAt, type PtyEventLogReadResult, type PtyEventRow } from '../pty-shell/pty-event-log.js';
 import { resolvePtyRef, type PtyRefItem } from '../pty-shell/pty-ref.js';
@@ -13,7 +13,7 @@ import { parsePtyWriteActor, resolveRemoteControlActor, resolveTakeover, type Pt
 import { registerPtyAttachDriveCommand } from './pty-drive-cli.js';
 import { resolveNexusPwa, type NexusPwaResolution } from './nexus-show.js';
 import { formatPtyWebAddress, ptyWebAddress, type PtyWebAddress } from './pty-web-address.js';
-import { getHarnessRunId, normalizeRunIdSource, type RunIdSource } from '../harness/harness-space.js';
+import { ensureRunId, getHarnessRunId, normalizeRunIdSource, type RunIdSource } from '../harness/harness-space.js';
 import { inspectControlInbox, type ControlInboxSnapshot } from '../harness/control-inbox.js';
 import { requestRemotePtyControl, type PtyControlAction, type PtyControlPayload, type PtyControlRequestOptions, type PtyControlResult } from '../pty-shell/pty-control-ipc.js';
 import { resolvePtySpecialKey, type PtyKeyEncoding } from '../pty-shell/pty-special-keys.js';
@@ -1467,6 +1467,10 @@ interface PtyListJsonRow extends PtyWebAddress {
   readonly ageMs?: number;
   /** ⭐ H10 — TUI 가 스스로 적은 턴(화면 추정 아님) ⊕ 그 상태 경과 초. 턴 기록 없는 행·원격 행은 `state:'unknown'`. */
   readonly turn: PtyTurnCell;
+  /** ⭐ SURVIVAL-PROGRESS-CLOCK — 마지막 진전 시각(epoch ms). 기록 없는 행·옛 판은 칸을 비운다. */
+  readonly progressAt?: number;
+  /** ⭐ SURVIVAL-PROGRESS-CLOCK — 진전 판정(progressing·slow·stalled·abort-ignored·unknown). */
+  readonly progress: TurnProgressJudgment;
   /** ⭐ H10 — 기동 판(실행판 sha) ⊕ 낡음. 판 기록 없는 행·판독 실패는 null. */
   readonly build: { readonly version: string; readonly sha: string; readonly source: string; readonly stale: boolean | null; readonly staleReason: string } | null;
 }
@@ -1534,10 +1538,15 @@ function ptyListJsonRow(row: PtyManifestRow, instance: string, sourceRoot: PtyMa
 
 /** `pty list --json` 의 턴·판 칸 — ⛔ 키는 «언제나» 싣는다(값으로만 갈린다 · 모르면 unknown/null).
  *  ⭐ 턴은 행의 자기보고 값만 읽는다 — 판 판독(설치본·git)이 실패해도 기록된 턴은 버리지 않는다. */
-function ptyListRunFields(row: PtyManifestRow, deps: PtyTakeoverCommandDeps, observedAt: number, installed: () => InstalledRecord): Pick<PtyListJsonRow, 'turn' | 'build'> {
+function ptyListRunFields(row: PtyManifestRow, deps: PtyTakeoverCommandDeps, observedAt: number, installed: () => InstalledRecord): Pick<PtyListJsonRow, 'turn' | 'progressAt' | 'progress' | 'build'> {
   const turn = describeTurnCell(ptyTurnViewOfRow(row), observedAt);
+  // SURVIVAL-PROGRESS-CLOCK — 진전 판정을 같은 관측 시각으로 잡고 전환을 관측한다.
+  const progress = judgeTurnProgress({
+    turn: turn.state, turnAt: turn.at ?? undefined, progressAt: row.progressAt, abortRequestedAt: row.abortRequestedAt, now: observedAt,
+  });
+  noteTurnProgressSurvival(row.id, progress, { turnAt: turn.at ?? undefined, progressAt: row.progressAt, now: observedAt });
   try {
-    if (!row.build) return { turn, build: null };
+    if (!row.build) return { turn, ...(row.progressAt !== undefined ? { progressAt: row.progressAt } : {}), progress, build: null };
     // 판독 예외 계약: 판 sha 는 기록값이라 그대로 두고 낡음만 «모른다»(stale=null · unknown) ⊕ `list-build-read-failed` 관측.
     //   그 밖의 뜻밖 예외는 판을 null 로(아래 catch) — 어느 쪽이든 기록된 턴은 버리지 않는다.
     const run = describePtyRunState(row, {
@@ -1549,10 +1558,11 @@ function ptyListRunFields(row: PtyManifestRow, deps: PtyTakeoverCommandDeps, obs
         }
       },
     });
-    return { turn, build: run.build ? { version: run.build.version, sha: run.build.sha, source: run.build.source, stale: run.stale, staleReason: run.staleReason } : null };
+    const progressFields = { ...(row.progressAt !== undefined ? { progressAt: row.progressAt } : {}), progress };
+    return { turn, ...progressFields, build: run.build ? { version: run.build.version, sha: run.build.sha, source: run.build.source, stale: run.stale, staleReason: run.staleReason } : null };
   } catch (error) {
     deps.log('list-build-read-failed', { ptyId: row.id, source: 'describe', error: error instanceof Error ? error.message : String(error) });
-    return { turn, build: null };
+    return { turn, ...(row.progressAt !== undefined ? { progressAt: row.progressAt } : {}), progress, build: null };
   }
 }
 
@@ -1848,8 +1858,9 @@ function remotePtyListJsonRow(row: RemoteTerminalListItem): PtyListJsonRow {
     runTerminationSource: 'unknown',
     runStoreIo: 'not-checked',
     ownerRunUsage: 'unknown',
-    // 원격 응답은 턴·판을 안 싣는다 — «모른다»로(로컬과 같은 키).
+    // 원격 응답은 턴·판·진전을 안 싣는다 — «모른다»로(로컬과 같은 키).
     turn: UNKNOWN_TURN_CELL,
+    progress: 'unknown',
     build: null,
   };
 }
@@ -2167,12 +2178,16 @@ export async function runPtyState(ref: string, deps: PtyTakeoverCommandDeps = li
 function formatPtyStateResult(id: string, screen: { state: FrameState; label?: string | null }, run: PtyRunStateView, at: number, json: boolean, deps: PtyTakeoverCommandDeps, screenUnavailable?: string): PtyTakeoverCommandResult {
   const reconciled = reconcileFrameStateWithTurn(screen.state, run.turn);
   if (reconciled.overridden) deps.log('state-reconciled', { ptyId: id, turn: run.turn, screenState: reconciled.screenState, label: screen.label ?? null, state: reconciled.state });
+  // SURVIVAL-PROGRESS-CLOCK — 진전·정체·Esc 무시 판정을 turnAt 옆에 싣고 전환을 관측한다.
+  const progress = judgeTurnProgress({ turn: run.turn, turnAt: run.turnAt, progressAt: run.progressAt, abortRequestedAt: run.abortRequestedAt, now: at });
+  noteTurnProgressSurvival(id, progress, { turnAt: run.turnAt, progressAt: run.progressAt, now: at });
   const guess = reconciled.screenState !== reconciled.state && !screenUnavailable ? ` guess=${reconciled.screenState}` : '';
   return { exitCode: 0, message: json
     ? JSON.stringify({
       id, state: reconciled.state, stateSource: reconciled.source, screenState: reconciled.screenState, label: screen.label, at,
       ...(screenUnavailable ? { screenUnavailable } : {}),
       turn: run.turn, ...(run.turnAt !== undefined ? { turnAt: run.turnAt } : {}),
+      ...(run.progressAt !== undefined ? { progressAt: run.progressAt } : {}), progress,
       build: run.build ? { version: run.build.version, sha: run.build.sha, source: run.build.source } : null,
       installed: run.installed, stale: run.stale, staleReason: run.staleReason,
     })
@@ -2193,6 +2208,29 @@ function formatRunBuild(run: PtyRunStateView): string {
   return run.build ? `${run.build.version}@${shortSha(run.build.sha)}(${run.build.source})` : 'unknown';
 }
 
+// ── SURVIVAL-PROGRESS-CLOCK — «마지막 진전 시각» 판정을 state/list 에 싣고 전환을 한 번만 관측한다 ──
+const SURVIVAL_EVENT_OF: Record<'stalled' | 'abort-ignored' | 'slow', 'stall-detected' | 'abort-ignored' | 'slow-turn'> = {
+  stalled: 'stall-detected',
+  'abort-ignored': 'abort-ignored',
+  slow: 'slow-turn',
+};
+const lastSurvivalJudgmentByPtyId = new Map<string, TurnProgressJudgment>();
+
+/** 판정이 stalled·abort-ignored·slow 로 «바뀔 때» `tui.survival` 관측을 전환마다 한 번만 남긴다(같은 값이면 조용히). */
+function noteTurnProgressSurvival(ptyId: string, judgment: TurnProgressJudgment, fields: { turnAt?: number; progressAt?: number; now: number }): void {
+  if (lastSurvivalJudgmentByPtyId.get(ptyId) === judgment) return;
+  lastSurvivalJudgmentByPtyId.set(ptyId, judgment);
+  const event = SURVIVAL_EVENT_OF[judgment as keyof typeof SURVIVAL_EVENT_OF];
+  if (!event) return;
+  const since = fields.progressAt ?? fields.turnAt;
+  debug.log('tui.survival', event, {
+    ptyId,
+    turnAt: fields.turnAt ?? null,
+    progressAt: fields.progressAt ?? null,
+    elapsedMs: since !== undefined ? Math.max(0, fields.now - since) : null,
+  });
+}
+
 /** `pty list` 한 칸 — 판을 적는 행(TUI)만. `run=<sha>` · 낡았으면 `,stale` · 옛 행 추정은 `run=?,stale`. */
 function formatListRunColumn(row: PtyManifestRow | undefined, deps: PtyTakeoverCommandDeps, installed: () => InstalledRecord): string {
   // 설치본 판독기가 없는 구성(시험 deps)은 이 칸을 안 낸다 — 기계마다 다른 값이 목록에 새지 않게.
@@ -2294,6 +2332,20 @@ export async function runPtyRename(ref: string, name: string, deps: PtyTakeoverC
   const renamed = (deps.renameLocal ?? renamePty)(id, nickname);
   return mapResult('rename', id, renamed ? { status: 'success' } : { status: 'unknown-pty' }, deps, observed);
 }
+/** `pty stop-turn` cancels the TUI's active turn through its owner; it never terminates the PTY process. */
+export async function runPtyStopTurn(ref: string, actor: PtyWriteActor, actorIdentity: string, reason: string, deps: PtyTakeoverCommandDeps = liveDeps): Promise<PtyTakeoverCommandResult> {
+  const identity = actorIdentity.trim();
+  const why = reason.trim();
+  if (!identity) return { exitCode: 2, message: 'pty stop-turn: --actor-id must not be empty' };
+  if (!why) return { exitCode: 2, message: 'pty stop-turn: --reason must not be empty' };
+  const refResult = resolveId(ref, 'stop-turn', deps); if (typeof refResult !== 'string') return refResult;
+  const id = refResult;
+  // A standalone CLI may not inherit a TUI run id. Mint one for this caller; inherited identity is retained so the
+  // owner still rejects a request from the same run as the target turn.
+  ensureRunId();
+  const request = { force: true as const, actorIdentity: identity, reason: why };
+  return mapResult('stop-turn', id, await deps.requestRemote(id, 'stop-turn', request, { actor }), deps, { ...request, actor });
+}
 export function registerPtyTakeoverCommands(program: Command, deps: PtyTakeoverCommandDeps = liveDeps, toolInstallDeps: ToolInstallDeps = {}): void {
   const pty = program.command('pty').description(
     // ⭐ `<ref>` = id · nickname · unique prefix — **ref 를 받는 하위명령**이 resolvePtyRef 로 해석한다(`list` 는 인자 없음).
@@ -2369,6 +2421,14 @@ export function registerPtyTakeoverCommands(program: Command, deps: PtyTakeoverC
   pty.command('takeover <ref>').description('Request human write ownership through the PTY arbiter').action((id: string) => run(() => runPtyTakeover(id, deps)));
   registerPtyAttachDriveCommand(pty, run);
   pty.command('release <ref>').description('Return human-owned PTY control to its prior mode').action((id: string) => run(() => runPtyRelease(id, deps)));
+  pty.command('stop-turn <ref>').requiredOption('--force', 'cancel the active turn and its child work without terminating the PTY')
+    .requiredOption('--actor <who>', 'actor type: human or agent').requiredOption('--actor-id <identity>', 'named requesting actor, such as OP or CEO')
+    .requiredOption('--reason <reason>', 'why this turn must be force-stopped').description('Force-stop an active TUI turn').action((id: string, opts: { actor: string; actorId: string; reason: string }) => {
+      const actor = parsePtyWriteActor(opts.actor);
+      return run(() => actor
+        ? runPtyStopTurn(id, actor, opts.actorId, opts.reason, deps)
+        : Promise.resolve({ exitCode: 2, message: `pty stop-turn: --actor must be 'human' or 'agent' (got ${opts.actor})` }));
+    });
   pty.command('state <ref>').option('--json', 'emit the classified frame state as JSON')
     .description('Classify the current PTY screen state').action((id: string, opts: { json?: boolean }) => run(() => runPtyState(id, deps, opts.json === true)));
   pty.command('wait <ref>').requiredOption('--until <state>', 'wait until idle, working, blocked, waiting, or done')

package/src/cli/release-cli.ts

@@ -9,6 +9,7 @@
 //   elanous release resume  --run <runId> --from <node> [--waive <node> --reason <text>] [--accepted-regressions <json>] [--gate-executor <pod|host> [--gate-host <ssh-host>]] [--gate-pod-pool <pool>] [--json]
 //   elanous release auto-start [--window-minutes <n>] [--apply] [--json]
 //   elanous release recover --run <runId> --pick <sha...> [--from export-check] [--command-root <path>] [--repo-root <path>] [--no-partial] [--json]
+//   elanous release recover-landing --run <runId> --merge <full-sha> [--from export-check] [--repo-root <path>] [--no-partial] [--json]
 //   elanous release rehearsal tick [--apply] [--checkout <dir>] [--shards <n>] [--remote <host>] [--recovery-run <id>] [--json]
 //   elanous release preflight --version <x.y.z> [--publish-at <iso>] [--json]   (컷 − 60분 main export 포함 사전 점검 · 읽기 전용 · ⛔ 있으면 exit 1)
 //   elanous release cut-branch --version <x.y.z> [--base <sha>] --pick <sha>... [--append] [--dry-run]
@@ -45,7 +46,7 @@ import { isIsolatedLedgerWriteRoot } from '../hq/ledger-write-target.js';
 import { runUnattendedRelease, type UnattendedReleaseDeps } from '../../scripts/release-loop/unattended-release.js';
 import { publishAtError } from '../../scripts/release-loop/publish-at.js';
 import { cutReleaseBranch } from '../../scripts/release-loop/cut-branch.js';
-import { planResumeReleaseRun, recoverReleaseRun, resumeReleaseRun, ReleaseRecoverStopped, type RecoverReleaseDeps } from '../../scripts/release-loop/resume-release.js';
+import { planResumeReleaseRun, recoverLandingPartialOption, recoverReleaseRun, recoverReleaseRunFromLanding, resumeReleaseRun, ReleaseRecoverStopped, type RecoverReleaseDeps } from '../../scripts/release-loop/resume-release.js';
 import type { AcceptedRegression } from '../../scripts/release-loop/resume.js';
 import type { PrereleaseKind } from '../../scripts/release-loop/release-version.js';
 import { releaseReadiness } from '../../scripts/release-loop/release-readiness.js';
@@ -56,6 +57,7 @@ import { defaultReleaseGraphRunsRoot, formatPublishProposal, measurePublishWindo
 import { autoStartScheduledRelease, type AutoStartDeferral } from '../release-loop/auto-start.js';
 import { runRehearsalTick, type RehearsalDeps } from '../release-loop/rehearsal.js';
 import { landingFreezeMessage, LandingFrozenError, readLandingFreeze } from '../release-loop/landing-freeze.js';
+import { gateShardLedgerPath, latestGateShardLedger, readGateShardLedger } from '../release-loop/gate-shard-ledger.js';
 import { formatLightRc, runLightRc, type LightRcDeps } from '../release-loop/light-rc.js';
 import { applyWatchList, formatGateHistory, gateHistory, ghMergedPrs } from '../../scripts/release-loop/gate-history.js';
 import { registerRfcCommands } from './rfc-cli.js';
@@ -609,6 +611,19 @@ function compareReleaseVersions(a: string, b: string): number {
 export function registerReleaseCommands(program: Command, releaseRunDeps: UnattendedReleaseDeps = {}, landedDeps: LandedButYellowDeps = {}, hqDeps: HqDeps = {}, lightRcDeps: LightRcDeps = {}, rehearsalDeps: RehearsalDeps = {}, resumeDeps: RecoverReleaseDeps = {}, checklistEvidenceReader?: ChecklistEvidenceReader): void {
   registerRfcCommands(program);
   const release = program.command('release').description('공개 배포 한 판 — prepare(로컬) → publish(--yes) → verify (docs/manual/MANUAL-versioning-and-release-2026-09-25.md)');
+  release.command('gate-shards').description('실행 중에도 읽는 게이트 조각 원장(시도·귀속·증거)')
+    .requiredOption('--version <v>', '조회할 판').option('--all', '과거 전이와 재시도까지 조회').option('--json', '결과 JSON')
+    .action((o: { version: string; all?: boolean; json?: boolean }) => {
+      const path = gateShardLedgerPath(o.version, releaseRunDeps.ledgerRoot ?? releaseLedgerRoot());
+      const ledger = readGateShardLedger(path);
+      if (!ledger) throw new CliUserError(`게이트 조각 원장 없음: ${o.version}`, '게이트가 시작되면 다시 조회하세요.');
+      const rows = o.all ? ledger.rows : latestGateShardLedger(ledger.rows);
+      if (o.json) console.log(JSON.stringify({ version: o.version, path, malformed: ledger.malformed, rows }));
+      else {
+        console.log(`${o.version} 조각 ${rows.length} · 읽지 못한 행 ${ledger.malformed} · ${path}`);
+        for (const row of rows) console.log(`${row.phase}/${row.shardId} ${row.state} ${row.host ?? '?'} rc=${row.rc ?? '?'} ${row.ran ?? '?'}시험 · 실패 ${row.failureIds?.length ?? '?'} · 귀속 ${row.attribution} · ${row.files.length}파일${row.stopReason ? ` · ${row.stopReason}` : ''}`);
+      }
+    });
   const schedule = release.command('schedule').description('판별 컷·착지 마감 조회·갱신');
   const scheduleLedgerRoot = () => releaseRunDeps.ledgerRoot ?? releaseLedgerRoot();
   const ledgerFenceDeps = (): HqDeps => getElanousConfigDirOverride() && !hqDeps.store && !getUserConfig().hq?.arbiter
@@ -1298,10 +1313,13 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--gate-executor <pod|host>', '다시 도는 gate 의 실행기 전환(--from gate 이전만) — 런 입력에 기록 · 면제 아님')
     .option('--gate-host <ssh-host>', '--gate-executor host 의 SSH 호스트(기본 저장된 런 입력 gateRemote)')
     .option('--gate-pod-pool <pool>', '다시 도는 gate 의 Pod 풀을 전환(--from gate 이전만) — 런 입력에 기록')
+    .option('--reroute-shard <pod-N|auto>', '같은 컷의 조각 한 개를 새로 측정하고 나머지 완전 영수증은 승계(--from gate)')
+    .option('--shard-host <pool-context>', '재지정 조각의 호스트 수동 지정(생략 시 가용 능력 기반 배치)')
+    .option('--shard-os <darwin|linux>', '재지정 pod-N 조각에 필요한 OS 능력')
     .option('--command-root <path>', '노드 명령을 실행할 컷 tip checkout(생략 시 현재 폴더)')
     .option('--dry-run', '재개 preflight만 수행하고 런·상태 원장·시도 횟수는 변경하지 않는다')
     .option('--json', '결과 한 줄 JSON(stdout)')
-    .action(async (o: { run: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: string; gateExecutor?: string; gateHost?: string; gatePodPool?: string; commandRoot?: string; dryRun?: boolean; json?: boolean }) => {
+    .action(async (o: { run: string; from: string; partial?: boolean; waive?: string; reason?: string; acceptedRegressions?: string; gateExecutor?: string; gateHost?: string; gatePodPool?: string; rerouteShard?: string; shardHost?: string; shardOs?: string; commandRoot?: string; dryRun?: boolean; json?: boolean }) => {
       await jsonAction(o.json, async (log) => {
         let acceptedRegressions: AcceptedRegression[] | undefined;
         if (o.acceptedRegressions !== undefined) {
@@ -1312,13 +1330,18 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
             throw new Error('acceptedRegressions must be an array of {id, note}');
           }
         }
+        if (o.shardOs !== undefined && o.shardOs !== 'darwin' && o.shardOs !== 'linux') throw new Error('--shard-os must be darwin or linux');
+        const shardOs = o.shardOs as 'darwin' | 'linux' | undefined;
         const resumeOptions = { runId: o.run, from: o.from, partial: o.partial, commandRoot: o.commandRoot,
           ...(o.waive === undefined ? {} : { waive: o.waive }),
           ...(o.reason === undefined ? {} : { reason: o.reason }),
           ...(o.acceptedRegressions === undefined ? {} : { acceptedRegressions }),
           ...(o.gateExecutor === undefined ? {} : { gateExecutor: o.gateExecutor }),
           ...(o.gateHost === undefined ? {} : { gateHost: o.gateHost }),
-          ...(o.gatePodPool === undefined ? {} : { gatePodPool: o.gatePodPool }) };
+          ...(o.gatePodPool === undefined ? {} : { gatePodPool: o.gatePodPool }),
+          ...(o.rerouteShard === undefined ? {} : { rerouteShard: o.rerouteShard }),
+          ...(o.shardHost === undefined ? {} : { shardHost: o.shardHost }),
+          ...(shardOs === undefined ? {} : { shardOs }) };
         if (o.dryRun) {
           const plan = await planResumeReleaseRun(resumeOptions, { onSource: log });
           const gate = plan.gatePlan.mode === 'not-run' ? 'gate 실행 없음'
@@ -1366,6 +1389,31 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
         }
       }, (r) => r.stages.every((stage) => stage.outcome === 'ok'));
     });
+  release.command('recover-landing')
+    .description('착지 알림 수동 재생 입구 — merge SHA로 중복을 억제하고 append → tip 고정 → export-check 재개를 수행한다. release-loop event hook 착지 전에는 사람이 직접 호출한다')
+    .requiredOption('--run <runId>', '실패한 release-loop 런 ID')
+    .requiredOption('--merge <sha>', 'main에 착지한 수리 커밋의 전체 40자리 SHA')
+    .option('--from <node>', '재개 시작 노드 — 기본 export-check')
+    .option('--command-root <path>', '재개 명령을 실행할 checkout — 생략 시 append tip 임시 checkout')
+    .option('--repo-root <path>', 'append를 실행할 checkout — origin remote 필요')
+    .option('--no-partial', 'Pod image digest 등이 맞지 않으면 전체 gate를 실행하며 부분 재검을 사용하지 않음')
+    .option('--json', '결과 한 줄 JSON(stdout) · 사람 줄은 stderr')
+    .action(async (o: { run: string; merge: string; from?: string; commandRoot?: string; repoRoot?: string; partial?: boolean; json?: boolean }) => {
+      await jsonAction(o.json, async (log) => {
+        try {
+          const partial = recoverLandingPartialOption(o.partial);
+          return await recoverReleaseRunFromLanding({ runId: o.run, mergeSha: o.merge,
+            ...(o.from === undefined ? {} : { from: o.from }),
+            ...(o.commandRoot === undefined ? {} : { commandRoot: o.commandRoot }),
+            ...(o.repoRoot === undefined ? {} : { repoRoot: o.repoRoot }),
+            ...(partial === undefined ? {} : { partial }) },
+          { ...resumeDeps, onSource: log });
+        } catch (caught) {
+          if (!(caught instanceof ReleaseRecoverStopped)) throw caught;
+          return { ok: false as const, error: caught.message, stages: [...caught.stages], notRun: [...caught.notRun], duplicate: false };
+        }
+      }, (r) => r.duplicate || r.stages.every((stage) => stage.outcome === 'ok'));
+    });
   release.command('gate-history')
     .description('GATE-FAIL-HISTORY (0.2.29) — 판을 넘는 게이트 실패 표 — 모든 release-loop·light-rc 런 원장 ⊕ gate-verdict 에서 시험 파일별 introduced·preexisting·env·flaky 횟수 · 마지막 실패 판 · 원인 PR(수리 PR 본문 «원인 #N»)')
     .option('--since <판|일>', '이 판(x.y.z)부터 · 또는 그 날(YYYY-MM-DD) 이후 시작된 런부터')
@@ -1427,12 +1475,36 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
             return { recovery: 'planned', ...plan };
           }
           if (!mayWriteLedger('release rehearsal recovery', false, ledgerRoot)) throw new Error('release rehearsal recovery: ledger write denied');
-          const result = await resumeReleaseRun(resumeOptions, resumeDeps);
-          log(`· 리허설 복구 완료 · run ${o.recoveryRun} · ${result.state.status} · gate에서 재개`);
-          return { recovery: 'resumed', runId: o.recoveryRun, status: result.state.status, ...result };
+          const schedules = listSchedules(ledgerRoot);
+          if (schedules.length === 0) {
+            const resumed = await resumeReleaseRun(resumeOptions, resumeDeps);
+            log(`· 리허설 복구 완료 · run ${o.recoveryRun} · ${resumed.state.status} · gate에서 재개`);
+            return { recovery: 'resumed', runId: o.recoveryRun, status: resumed.state.status, ...resumed };
+          }
         }
         if (o.apply && !mayWriteLedger('release rehearsal tick', false, ledgerRoot)) throw new Error('release rehearsal tick: ledger write denied');
-        const result = await runRehearsalTick({ apply: o.apply, checkout: o.checkout, shards: o.shards === undefined ? undefined : Number(o.shards), remote: o.remote, ledgerRoot }, rehearsalDeps);
+        const result = await runRehearsalTick({ apply: o.apply, checkout: o.checkout, shards: o.shards === undefined ? undefined : Number(o.shards), remote: o.remote, recoveryRun: o.recoveryRun, ledgerRoot }, {
+          ...rehearsalDeps,
+          resumeGate: rehearsalDeps.resumeGate ?? (async (runId, checkout) => {
+            const resumed = await resumeReleaseRun({ runId, from: 'gate', commandRoot: checkout }, resumeDeps);
+            const gate = resumed.state.nodes.find((node) => node.nodeId === 'gate');
+            if (typeof gate?.output !== 'string') throw new Error('release resume --from gate produced no gate output');
+            const outputLine = gate.output.split(/\r?\n/).filter((line) => line.trim().startsWith('{')).at(-1);
+            if (!outputLine) throw new Error('release resume --from gate produced no JSON output');
+            let parsed: Record<string, unknown>;
+            try { parsed = JSON.parse(outputLine) as Record<string, unknown>; }
+            catch { throw new Error('release resume --from gate produced invalid gate JSON'); }
+            const startedAt = Date.parse(gate?.startedAt ?? '');
+            const endedAt = Date.parse(gate?.endedAt ?? '');
+            const summary = parsed.partialSummary as { files?: unknown } | undefined;
+            if (!Number.isSafeInteger(summary?.files) || Number(summary!.files) < 0) throw new Error('release resume --from gate omitted measured partialSummary.files');
+            if (!Number.isFinite(startedAt) || !Number.isFinite(endedAt) || endedAt < startedAt) throw new Error('release resume --from gate omitted valid gate timestamps');
+            return { files: Number(summary!.files),
+              durationMs: endedAt - startedAt,
+              poolOverwriteApplied: (resumed.state.inputOverrides ?? []).some((item) => item.kind === 'gate-pod-pool'),
+              ok: resumed.state.status === 'done' && parsed.outcome === 'ok' };
+          }),
+        });
         log(`· 리허설 ${result.status}${'version' in result ? ` ${result.version}` : ''}${result.status === 'due' ? ` · 실행 ${result.run ?? '-'} · 건너뜀 ${result.supersede.join(', ') || '-'}` : ''}`);
         for (const stamp of result.stamps ?? []) {
           if (stamp.outcome === 'unmeasured' && !stamp.result && stamp.shardPlan && (stamp.shardPlan.testFiles === 0 || stamp.shardPlan.gatePlanShards === null))

package/src/cli/repo-cli.ts

@@ -6,6 +6,7 @@ import type { Command } from 'commander';
 
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { debug } from '../debug/log.js';
+import { spawnWithOwnedStderr } from '../surface/child-process.js';
 import { applyDesignDirection } from '../design/apply-direction.js';
 import { createCustomSystemFromPalette, createCustomSystemFromUrl, unreadTokenCount } from '../design/custom-system-create.js';
 import { libraryDir } from '../design/design-library.js';
@@ -731,7 +732,7 @@ export function registerRepoCommands(program: Command, overrides: RepoCliDeps =
         // ⭐ stderr 는 «흘려 보낸다» — 채점기가 쪽마다 진행을 거기 적는다.
         //   🩸 2026-09-14 7판 terra: 전 쪽 채점이 5분 넘게 «말없이» 돌자 감독자가 「진행 없음」으로 판정해 재작업을 걸었다.
         //   ⛔ 게다가 'pipe' 로 받고 «안 읽으면» 버퍼가 차는 순간 자식이 멈춘다.
-        const proc = Bun.spawn(['bun', join(scripts, script), ...args], { stdout: 'pipe', stderr: 'inherit' });
+        const proc = spawnWithOwnedStderr(['bun', join(scripts, script), ...args], { stdout: 'pipe' });
         const out = await new Response(proc.stdout).text();
         await proc.exited;
         return { code: proc.exitCode ?? 1, out };

package/src/cli/sim-cli.ts

@@ -1,4 +1,6 @@
 import type { Command } from 'commander';
+import { getTestStateRoot } from '../nexus/paths.js';
+import { runReleaseSimRigIfFile } from '../ux-sim/release-sim-rig.js';
 import { runScenarioFile } from '../ux-sim/scenario.js';
 
 export function registerSimCommands(program: Command): void {
@@ -7,7 +9,11 @@ export function registerSimCommands(program: Command): void {
     .description('등록된 UX simulation 시나리오를 test 우주에서 실행한다')
     .action(async (scenarioFile: string) => {
       try {
-        const result = await runScenarioFile(scenarioFile);
+        // Enforce isolation before either runner inspects the supplied path. Otherwise
+        // release-graph dispatch can leak a path-validation error outside test mode.
+        if (!getTestStateRoot()) throw new Error('scenario runner requires --test isolated mode');
+        const releaseResult = await runReleaseSimRigIfFile(scenarioFile);
+        const result = releaseResult ?? await runScenarioFile(scenarioFile);
         console.log(JSON.stringify(result));
         if (!result.pass) process.exitCode = 1;
       } catch (error) {

package/src/cli/tasks-cli.ts

@@ -473,14 +473,15 @@ async function tryRemoteParent(args: string[], cwd: string | undefined, context:
   return null;
 }
 
-/** stderr 파일의 첫 비어 있지 않은 줄(최대 4KB 만 읽는다 — 원 로그 꼬리를 싣지 않는다). */
-function firstStderrLine(path: string): string {
+/** Advisory lines may precede the actual fatal error. Keep the full stderr as evidence. */
+function actionableStderrLine(path: string): string {
   try {
     const fd = openSync(path, 'r');
     try {
       const buf = Buffer.alloc(4096);
       const n = readSync(fd, buf, 0, buf.length, 0);
-      return buf.subarray(0, n).toString('utf8').split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0) ?? '';
+      const lines = buf.subarray(0, n).toString('utf8').split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+      return lines.find((line) => /^(?:❌|error:|fatal:)/i.test(line)) ?? lines[0] ?? '';
     } finally { closeSync(fd); }
   } catch { return ''; }
 }
@@ -529,7 +530,7 @@ export async function defaultTaskLauncher(args: string[], cwd?: string, context?
     : undefined;
   if (timer) clearTimeout(timer);
   if (early && early.code !== 0) {
-    const first = firstStderrLine(stderrPath);
+    const first = actionableStderrLine(stderrPath);
     const cause = `child rc=${early.code ?? early.signal ?? 'unknown'}${first ? `: ${first}` : ''}`;
     const { boundRunStopCause, recordRunStop, runStopRecorded, RUN_STOP_EVENT } = await import('../self-implement/run-stop.js');
     const hasStop = deps.hasStop ?? ((id: string) => {
@@ -843,7 +844,7 @@ export function coverCardsInWindow(cards: readonly CoverCardRow[] | null, window
 }
 
 /** Read the card ledger itself. A missing file or malformed row makes the aggregate unknown. */
-function readImplementCardBindings(statePath: string): ImplementCardRunBinding[] {
+function readImplementCardBindings(statePath: string): { bindings: ImplementCardRunBinding[]; cleanup: Array<{ cardId: string; outcome: 'complete' | 'partial'; at: string }> | null } {
   if (!existsSync(statePath)) throw new Error('TASK-AGENT card ledger is missing');
   const state = readTaskAgentState<{ tasks?: Record<string, TaskCard> }>(statePath);
   if (state.tasks !== undefined && (!state.tasks || typeof state.tasks !== 'object' || Array.isArray(state.tasks))) {
@@ -851,14 +852,38 @@ function readImplementCardBindings(statePath: string): ImplementCardRunBinding[]
   }
   const cards = Object.entries(state.tasks ?? {});
   if (cards.length >= COVER_QUERY_LIMIT) throw new Error('TASK-AGENT card ledger reached query bound');
-  return cards.map(([key, card]) => {
+  const bindings: ImplementCardRunBinding[] = [];
+  const cleanup: Array<{ cardId: string; outcome: 'complete' | 'partial'; at: string }> = [];
+  let cleanupUnreadable = false;
+  for (const [key, card] of cards) {
     if (!card || typeof card !== 'object' || Array.isArray(card) || typeof card.id !== 'string' || !card.id
       || card.id !== key || (card.runId != null && typeof card.runId !== 'string')
       || (card.runChildId != null && typeof card.runChildId !== 'string')) {
       throw new Error('TASK-AGENT card binding is malformed');
     }
-    return { cardId: card.id, runId: card.runId, runChildId: card.runChildId };
-  });
+    bindings.push({ cardId: card.id, runId: card.runId, runChildId: card.runChildId });
+    if (card.postLand === undefined) continue;
+    const post = card.postLand;
+    if (!post || (post.outcome !== 'complete' && post.outcome !== 'partial')
+      || !Number.isSafeInteger(post.pr) || typeof post.head !== 'string' || !post.head
+      || typeof post.at !== 'string' || !Number.isFinite(Date.parse(post.at))
+      || !Array.isArray(card.history)) { cleanupUnreadable = true; continue; }
+    if (card.history.some((event) => !event || typeof event !== 'object')) { cleanupUnreadable = true; continue; }
+    if (card.status !== 'done' || card.prTerminal?.state !== 'MERGED'
+      || card.prTerminal.pr !== post.pr || typeof card.prTerminal.head !== 'string'
+      || card.prTerminal.head.toLowerCase() !== post.head.toLowerCase()) continue;
+    // A same-outcome reconciliation refreshes postLand.at without appending another history event.
+    const sourceEvents = card.history.filter((event) => event.event === 'postland-card' && event.pr === post.pr
+      && typeof event.head === 'string' && event.head.toLowerCase() === post.head.toLowerCase());
+    if (sourceEvents.length === 0) continue;
+    if (sourceEvents.some((event) => typeof event.at !== 'string' || !Number.isFinite(Date.parse(event.at)))) {
+      cleanupUnreadable = true;
+      continue;
+    }
+    const sourceAt = sourceEvents[sourceEvents.length - 1]!.at;
+    cleanup.push({ cardId: card.id, outcome: post.outcome, at: sourceAt });
+  }
+  return { bindings, cleanup: cleanupUnreadable ? null : cleanup };
 }
 
 function implementLedgerDirectories(statePath: string, includeTest: boolean): string[] {
@@ -987,10 +1012,13 @@ export function readTaskAgentCover(
   };
   // A supplied reader overrides only its own source. The ordinary CLI always reads both physical ledgers.
   try {
-    input.implementCardRuns = goalReaders.coverImplementCardRuns
-      ? goalReaders.coverImplementCardRuns()
-      : readImplementCardBindings(goalReaders.taskStatePath ?? taskStatePathDefault());
-  } catch { input.implementCardRuns = null; }
+    if (goalReaders.coverImplementCardRuns) input.implementCardRuns = goalReaders.coverImplementCardRuns();
+    else {
+      const { bindings, cleanup } = readImplementCardBindings(goalReaders.taskStatePath ?? taskStatePathDefault());
+      input.implementCardRuns = bindings;
+      input.cleanupCards = cleanup?.filter((card) => inWindow(card.at)) ?? null;
+    }
+  } catch { input.implementCardRuns = null; input.cleanupCards = null; input.implementReadFailure = 'card-ledger-unreadable'; }
   try {
     input.implementRunMerges = goalReaders.coverImplementRunMerges
       ? goalReaders.coverImplementRunMerges()
@@ -1001,7 +1029,7 @@ export function readTaskAgentCover(
           implementLedgerDirectories(goalReaders.taskStatePath ?? taskStatePathDefault(), goalReaders.coverIncludeTest === true),
           window,
         );
-  } catch { input.implementRunMerges = null; }
+  } catch { input.implementRunMerges = null; input.implementReadFailure ??= 'run-ledger-unreadable'; }
   const orders = orderRead && !orderRead.limitReached ? coverEvents(orderRead.rows, 'task-agent.land-order', 'appended', (data) =>
     Number.isSafeInteger(data.pr) ? { pr: data.pr as number } : null) : null;
   const landSignals: CoverLandSignals = {

package/src/codex/models.ts

@@ -1,8 +1,7 @@
 // ── OpenAI Codex model catalog ──
 //
-// Curated subset of the full OpenAI Codex CLI model roster — the six
-// options that cover the most common use cases without overwhelming
-// the onboarding picker. Source: omni-crawl sweep on 2026-04-14 across
+// Curated subset of the full OpenAI Codex CLI model roster, covering
+// common use cases without overwhelming the onboarding picker. Source: omni-crawl sweep on 2026-04-14 across
 //   - developers.openai.com/api/docs/models/{all,codex-mini-latest,gpt-5-codex}
 //   - developers.openai.com/codex/models
 //   - platform.openai.com/docs/models
@@ -20,10 +19,9 @@
 // 2026-09-09 refresh (live 1차 대조 — developers.openai.com/api/내부 문서 `gpt-6-astra`
 // ⊕ openai.com/api/pricing/ ⊕ `codex exec --model gpt-6-astra` 실호출):
 //   + gpt-6-astra  (2026-09-03 출시 · 현 최상단)
-//   + gpt-5.6-terra (elanous 가 «실제로» 기본으로 쓰는 모델 — llm.model 이 이 값이다)
-// ⛔ recommended 를 gpt-5.5 → gpt-5.6-terra 로 옮겼다. 이 표의 recommended 는 「가장 센 것」이
-//   아니라 「기본으로 골라도 되는 것」이고, 그 자리에 두 세대 전 모델이 앉아 있었다.
-//   astra 는 recommended 가 «아니다» — terra 대비 input 4배·output 3.3배라 기본값이 될 수 없다.
+//   + gpt-5.6-terra (at the time, the configured `llm.model` default)
+// GPT-6.1 refresh (2026-10-28): recommended is GPT-6.1 Terra; Sol is available for higher-cost deep work.
+// `recommended` means a safe default, not the strongest model; Astra remains opt-in due to its higher cost.
 
 export type CodexModelTier = 'flagship' | 'balanced' | 'cheap' | 'specialist' | 'legacy';
 
@@ -44,11 +42,21 @@ export interface CodexModel {
   recommended?: boolean;
 }
 
-/** Six curated models for the 1-point setup picker. Ordering
- *  reflects the UI: recommended first, then by descending tier. */
+/** Curated models for the 1-point setup picker. Ordering reflects the UI:
+ *  recommended first, then by descending tier. */
 export const CODEX_MODELS: CodexModel[] = [
   {
-    // 📏 2026-09-25 캐시 읽기 단가 = 입력의 10%(OpenRouter 목록 gpt-6-astra 1.0 · sol 0.2 · luna 0.01) — 없으면 캐시분이 입력 단가로 10배 매겨졌다.
+    id: 'gpt-6.1-terra',
+    label: 'GPT-6.1 Terra',
+    tier: 'balanced',
+    description: 'Recommended everyday Codex model. 500K context; $1/$5 per million tokens, cached input $0.05.',
+    contextWindow: 500_000,
+    pricingUsd: { inputPerM: 1.0, outputPerM: 5.0, cacheReadPerM: 0.05 },
+    recommended: true,
+  },
+  {
+    // Cache-read rates: Astra $1.00/M, GPT-6.1 Sol $0.10/M, Terra $0.05/M, Luna $0.01/M.
+    // Per OP 2026-10-28 price direction, legacy GPT-6 Sol also uses $0.10/M for cost estimates.
     id: 'gpt-6-astra',
     label: 'GPT-6 Astra (frontier)',
     tier: 'flagship',
@@ -56,14 +64,21 @@ export const CODEX_MODELS: CodexModel[] = [
     contextWindow: 1_050_000,
     pricingUsd: { inputPerM: 10.0, outputPerM: 50.0, cacheReadPerM: 1.0 },
   },
+  {
+    id: 'gpt-6.1-sol',
+    label: 'GPT-6.1 Sol',
+    tier: 'flagship',
+    description: 'Higher-capability reasoning and coding model. 500K context; $2/$10 per million tokens, cached input $0.10.',
+    contextWindow: 500_000,
+    pricingUsd: { inputPerM: 2.0, outputPerM: 10.0, cacheReadPerM: 0.1 },
+  },
   {
     id: 'gpt-6-sol',
-    label: 'GPT-6 Sol',   // «recommended» 표시는 목록이 `recommended: true` 로 붙인다 — 라벨에도 쓰면 두 번 뜬다(UX 8)
-    tier: 'balanced',
-    description: 'elanous 운영 기본(대표 2026-09-23). 복합 코딩·agentic 워크플로. Reasoning «Highest» 인데 가격은 5.6 Terra 와 같은 입력·더 싼 출력. 1.05M ctx, effort none..max(기본 medium).',
+    label: 'GPT-6 Sol',
+    tier: 'legacy',
+    description: 'Legacy GPT-6 Sol retained for compatibility; GPT-6.1 Sol is its higher-performing successor at the same price, while Terra is a lower-cost default.',
     contextWindow: 1_050_000,
-    pricingUsd: { inputPerM: 2.0, outputPerM: 10.0, cacheReadPerM: 0.2 },
-    recommended: true,
+    pricingUsd: { inputPerM: 2.0, outputPerM: 10.0, cacheReadPerM: 0.1 },
   },
   {
     id: 'gpt-6-luna',