elanous 0.2.40 → 0.2.41

package/scripts/release-loop/resume-release.ts

@@ -8,11 +8,14 @@ import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { debug } from '../../src/debug/log.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../../src/instance/resolve.js';
+import { acquireLockAsync } from '../../src/storage/file-lock.js';
 import { lastJsonObject, runGraph, verifyReleaseCommandRoot, verifyReleaseRecipeSnapshot, type GraphRunState } from '../../src/graph-runner/runner.js';
 import { withOpSeatFlock } from '../../src/steward/resync-tick.js';
 import { releaseRunUniverse } from './release-universe.js';
 import { isReleaseVersion } from './release-version.js';
-import { changedFilesBetween, clearPartialPlan, collectExecutedPodShardImages, planPartialRegate, planStalledShardRecheck, writePartialPlan, writeRecheckPlan } from './gate-partial.js';
+import { changedFilesBetween, clearPartialPlan, collectExecutedPodShardImages, planPartialRegate, planSameCommitRecheck, planStalledShardRecheck, testFileOfId, writePartialPlan, writeRecheckPlan } from './gate-partial.js';
+import { gateAssignableTestsAtCommit, gateEnvFingerprint } from './gate-baseline-receipt.js';
+import { readGateShardManifest, readGateShardResult } from './gate-shard-receipts.js';
 import { gitClosureTree, testsReachingChanged, TRACEABLE_RELEASE_JSON, type ClosureTree } from './gate-closure.js';
 import { assertReleaseResumeApprovalBoundary, releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeGateShardReroute, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
 import { reserveReleaseResumeAttempt } from './resume-cap.js';
@@ -46,6 +49,8 @@ export interface ResumeReleaseDeps {
   ledgerRoot?: string;
   /** GATE-REUSE-BY-DIFF: the tip tree for the import closure — default read from git objects of the tip commit. */
   closureTree?: (commit: string) => ClosureTree;
+  /** Test seam for the pinned Pod gate selection; production reads the selected test universe at the cut commit. */
+  gateTestsAtCommit?: (commit: string) => string[] | null;
   /** Source observation before the first resumed node. */
   onSource?: (line: string) => void;
   /** Test seam; production resolves this from ELANOUS_RELEASE_TRAFFIC_FILE / release.loop.trafficFile. */
@@ -293,14 +298,111 @@ function verifyResumePreflight(run: GraphRunState, opts: ResumeReleaseOptions, d
   }
 }
 
-/** GATE-PARTIAL outcome of a resume — applied (plan written) or the reason it fell back to a full gate. `auto` marks the
- *  default plan of `--from gate` (GATE-REUSE-BY-DIFF); `closure` is set when code changes were followed. */
+/** GATE-PARTIAL outcome of a resume — applied (with its exact remeasure selection) or the reason it fell back to a full gate.
+ *  `auto` marks the default plan of `--from gate` (GATE-REUSE-BY-DIFF); `closure` is set when code changes were followed. */
 export type PartialOutcome = { requested: false }
-  | { requested: true; applied: true; files: number; priorCommit: string; auto?: true; closure?: { reached: number; opaque: number } }
+  | { requested: true; applied: true; files: number; plannedFiles: string[]; priorCommit: string; auto?: true; closure?: { reached: number; opaque: number } }
   | { requested: true; applied: false; reason: string; auto?: true };
 
 /** Build (or clear) the partial re-gate plan for the new tip. Fail-closed: any doubt leaves a full gate.
  *  GATE-REUSE-BY-DIFF: `--from gate` on a moved tip plans by default (`partial: undefined`); `partial: false` opts out. */
+type StalledGateEvidence = {
+  stalledShards: Array<{ shard: number; files: string[]; reason: string }>;
+  partialSummary: { pass: number; fail: number; errors: number; ran: number; files: number };
+  partialFailures: { failures: string[]; errors: string[] };
+  preservedShardCount: number;
+};
+
+/** Recover an interrupted Pod sweep from its atomic shard receipts. No receipt or identity doubt authorizes a partial gate. */
+function stalledGateEvidence(input: { version: string; commit: string; repo: string; roots: string[];
+  gateOutput?: Record<string, unknown>; expectedBase40?: string; expectedTests?: (commit: string) => string[] | null }):
+  { ok: true; evidence: StalledGateEvidence } | { ok: false; reason: string } {
+  const fail = (reason: string) => ({ ok: false as const, reason });
+  if (input.gateOutput && (input.gateOutput.outcome !== 'error' || input.gateOutput.commit !== input.commit))
+    return fail('saved gate result is not an error for the recorded cut');
+  if (!/^[a-f0-9]{40}$/i.test(input.expectedBase40 ?? ''))
+    return fail('saved cutoff baseline is absent or invalid');
+  const fingerprint = gateEnvFingerprint(process.env);
+  let receiptDir: string | undefined;
+  for (const root of input.roots) {
+    const candidate = join(root, 'release', input.version, 'gate-logs', 'cut', 'receipts');
+    if (existsSync(candidate)) { receiptDir = candidate; break; }
+  }
+  if (!receiptDir) return fail('stalled gate receipts are absent');
+  const names = readdirSync(receiptDir).filter((name) => /^pod-\d+\.receipt\.json$/.test(name)).sort((a, b) =>
+    Number(/^pod-(\d+)/.exec(a)![1]) - Number(/^pod-(\d+)/.exec(b)![1]));
+  if (!names.length || names.some((name, index) => Number(/^pod-(\d+)/.exec(name)![1]) !== index))
+    return fail('stalled gate receipt shard set is incomplete');
+  const allFiles: string[] = [];
+  const failures: string[] = [];
+  const errors: string[] = [];
+  const stalledShards: StalledGateEvidence['stalledShards'] = [];
+  const imageDigests = new Set<string>();
+  let pass = 0, failCount = 0, errorCount = 0, ran = 0, files = 0, preservedShardCount = 0;
+  let base40: string | undefined;
+  for (const name of names) {
+    const id = name.slice(0, -'.receipt.json'.length);
+    const receipt = readGateShardManifest(receiptDir, id);
+    if (!receipt || receipt.head40 !== input.commit || !/^[a-f0-9]{40}$/i.test(receipt.base40)
+      || !receipt.files.length
+      || receipt.files.some((file) => typeof file !== 'string'
+        || !/^(?:[\w.-]+\/)*[\w.-]+\.test\.(?:tsx?|jsx?|mts|cts)$/.test(file) || file.split('/').includes('..'))
+      || typeof receipt.envKey !== 'string' || typeof receipt.host !== 'string')
+      return fail(`stalled gate receipt identity or file list is invalid: ${id}`);
+    if (receipt.base40 !== input.expectedBase40)
+      return fail(`stalled gate receipt baseline differs from saved cutoff baseline: ${id}`);
+    if (base40 && receipt.base40 !== base40) return fail(`stalled gate receipts disagree on baseline: ${id}`);
+    base40 = receipt.base40;
+    allFiles.push(...receipt.files);
+    if (receipt.status === 'unmeasured') {
+      stalledShards.push({ shard: Number(id.slice(4)), files: [...receipt.files], reason: 'incomplete' });
+      continue;
+    }
+    if (!receipt.envKey.startsWith(`${fingerprint}:`)) return fail(`stalled gate receipt environment mismatch: ${id}`);
+    const imageDigest = receipt.envKey.slice(fingerprint.length + 1);
+    if (!/^sha256:[a-f0-9]{64}$/i.test(imageDigest)) return fail(`stalled gate receipt image identity is missing: ${id}`);
+    imageDigests.add(imageDigest.toLowerCase());
+    const result = readGateShardResult(receiptDir, { shard: { id, files: receipt.files }, head40: input.commit,
+      base40: receipt.base40, envKey: receipt.envKey });
+    if (!result) return fail(`stalled gate receipt payload is incomplete or corrupt: ${id}`);
+    const totals = result.runs.reduce((sum, run) => ({ pass: sum.pass + run.pass, fail: sum.fail + run.fail,
+      errors: sum.errors + run.errors, ran: sum.ran + run.ran, files: sum.files + run.files }),
+    { pass: 0, fail: 0, errors: 0, ran: 0, files: 0 });
+    if (!Object.values(totals).every(Number.isSafeInteger) || receipt.failureIds.length !== totals.fail
+      || receipt.errorIds.length !== totals.errors)
+      return fail(`stalled gate receipt counts do not reconcile: ${id}`);
+    pass += totals.pass; failCount += totals.fail; errorCount += totals.errors; ran += totals.ran; files += totals.files;
+    failures.push(...receipt.failureIds); errors.push(...receipt.errorIds); preservedShardCount++;
+  }
+  if (!stalledShards.length) return fail('no incomplete shard receipt identifies the interrupted work');
+  if (new Set(allFiles).size !== allFiles.length) return fail('stalled gate receipt file assignments overlap');
+  if (imageDigests.size !== 1) return fail('stalled gate completed shards do not share one executed image');
+  const expected = (input.expectedTests ?? ((commit) => gateAssignableTestsAtCommit(input.repo, commit)))(input.commit);
+  if (!expected || JSON.stringify([...expected].sort()) !== JSON.stringify([...allFiles].sort()))
+    return fail('stalled gate receipts do not cover the pinned test selection');
+  const partialSummary = { pass, fail: failCount, errors: errorCount, ran, files };
+  const partialFailures = { failures: [...new Set(failures)].sort(), errors: [...new Set(errors)].sort() };
+  const gate = input.gateOutput;
+  if (gate) {
+    const savedSummary = gate.partialSummary as Partial<StalledGateEvidence['partialSummary']> | undefined;
+    const savedFailures = gate.partialFailures as Partial<StalledGateEvidence['partialFailures']> | undefined;
+    if (savedSummary && JSON.stringify(savedSummary) !== JSON.stringify(partialSummary))
+      return fail('saved gate summary disagrees with shard receipts');
+    if (savedFailures && (JSON.stringify([...((savedFailures.failures as string[] | undefined) ?? [])].sort()) !== JSON.stringify(partialFailures.failures)
+      || JSON.stringify([...((savedFailures.errors as string[] | undefined) ?? [])].sort()) !== JSON.stringify(partialFailures.errors)))
+      return fail('saved gate failures disagree with shard receipts');
+    if (gate.preservedShardCount !== undefined && gate.preservedShardCount !== preservedShardCount)
+      return fail('saved preserved shard count disagrees with shard receipts');
+    if (Array.isArray(gate.stalledShards)) {
+      const savedStalled = gate.stalledShards.flatMap((item) => item && typeof item === 'object'
+        && Array.isArray((item as { files?: unknown }).files) ? (item as { files: string[] }).files : []).sort();
+      if (JSON.stringify(savedStalled) !== JSON.stringify(stalledShards.flatMap((item) => item.files).sort()))
+        return fail('saved stalled shard list disagrees with shard receipts');
+    }
+  }
+  return { ok: true, evidence: { stalledShards, partialSummary, partialFailures, preservedShardCount } };
+}
+
 function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean; gateExecutor?: string }, deps: ResumeReleaseDeps, dryRun = false): PartialOutcome {
   const root = deps.root ?? effectiveInstanceRoot();
   // Any resume starts from no plan: one without a partial plan (from whatever node) never inherits an older plan.
@@ -356,9 +458,11 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     debug.log('release-loop.resume', 'stalled-recheck-planned', { version: tip.version, commit: tip.to,
       planKind: planned.plan.kind, remeasureFileCount: planned.plan.files.length,
       preservedShardCount: planned.plan.preservedShardCount ?? 0, fallbackReason: null, path });
-    return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.to, ...(auto ? { auto: true as const } : {}) };
+    return { requested: true, applied: true, files: planned.plan.files.length, plannedFiles: [...planned.plan.files], priorCommit: tip.to,
+      ...(auto ? { auto: true as const } : {}) };
   }
   let prior: { commit?: unknown; failures?: unknown; errors?: unknown } | undefined;
+  let movedStalledEvidence: StalledGateEvidence | undefined;
   for (const location of [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])]) {
     const path = join(location, 'release', tip.version, 'gate-failures.json');
     if (!existsSync(path)) continue;
@@ -368,7 +472,19 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
     if (record?.commit === tip.from) { prior = record; break; }
   }
   if (!prior || !Array.isArray(prior.failures) || !(prior.errors === undefined || Array.isArray(prior.errors))) {
-    return fallback(`no complete gate record for ${tip.from.slice(0, 12)} (a stalled or errored gate keeps none)`);
+    const gateRecord = saved.nodes.find((node) => node.nodeId === 'gate');
+    const gateOutput = gateRecord ? lastJsonObject(gateRecord.output) as Record<string, unknown> | undefined : undefined;
+    const cutoffRecord = saved.nodes.find((node) => node.nodeId === 'cutoff');
+    const cutoffOutput = cutoffRecord ? lastJsonObject(cutoffRecord.output) as Record<string, unknown> | undefined : undefined;
+    const expectedBase40 = (cutoffOutput?.baseline as { sha?: unknown } | undefined)?.sha;
+    const evidence = stalledGateEvidence({ version: tip.version, commit: tip.from, repo: deps.repo ?? process.cwd(),
+      roots: [...new Set([deps.ledgerRoot ?? releaseLedgerRoot(), root])], gateOutput,
+      ...(typeof expectedBase40 === 'string' ? { expectedBase40 } : {}),
+      expectedTests: deps.gateTestsAtCommit });
+    if (!evidence.ok) return fallback(`no complete gate record for ${tip.from.slice(0, 12)}; ${evidence.reason}`);
+    movedStalledEvidence = evidence.evidence;
+    prior = { commit: tip.from, failures: movedStalledEvidence.partialFailures.failures,
+      errors: movedStalledEvidence.partialFailures.errors };
   }
   // Both sides of a rename count (`--no-renames`): a source moved to a test/Markdown name is still a source change.
   let changed: string[];
@@ -404,10 +520,11 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   const savedInput = saved.input as { gateExecutor?: unknown; gatePodPool?: unknown };
   const podGate = (opts.gateExecutor ?? savedInput.gateExecutor ?? (savedInput.gatePodPool ? 'pod' : undefined)) === 'pod';
   const priorShards = priorCutLogs ? collectExecutedPodShardImages(priorCutLogs, tip.from) : undefined;
-  const planned = planPartialRegate({ version: tip.version, priorCommit: tip.from, forCommit: tip.to, changedFiles: changed,
+  const stalledFiles = movedStalledEvidence?.stalledShards.flatMap((shard) => shard.files) ?? [];
+  const planned = planPartialRegate({ version: tip.version, priorCommit: tip.from, forCommit: tip.to, changedFiles: [...changed, ...stalledFiles],
     priorFailures: prior.failures as string[], priorErrors: (prior.errors ?? []) as string[],
     existsAtTip: (file) => tracked.has(file),
-    ...(podGate ? { priorShards: priorShards ?? [] } : {}),
+    ...((podGate || movedStalledEvidence) ? { priorShards: priorShards ?? [] } : {}),
     closure: (changedCode) => testsReachingChanged(tree, changedCode, tests, { cliEntries: CLI_ENTRIES }) });
   if (!planned.ok) return fallback(planned.reason);
   if (planned.plan.files.length >= tests.length) return fallback(`every test is re-run (${tests.length}) — full gate`);
@@ -427,7 +544,7 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
   const path = dryRun ? undefined : writePartialPlan(root, planned.plan);
   debug.log('release-loop.resume', 'partial-planned', { version: tip.version, priorCommit: tip.from, commit: tip.to, files: planned.plan.files.length,
     tests: tests.length, auto, ...(path ? { path } : {}), dryRun, ...(planned.closure ? { reached: planned.closure.reached, opaque: planned.closure.opaque } : {}) });
-  return { requested: true, applied: true, files: planned.plan.files.length, priorCommit: tip.from,
+  return { requested: true, applied: true, files: planned.plan.files.length, plannedFiles: [...planned.plan.files], priorCommit: tip.from,
     ...(auto ? { auto: true as const } : {}), ...(planned.closure ? { closure: planned.closure } : {}) };
 }
 
@@ -604,6 +721,23 @@ export interface RecoverReleaseResult {
   resume?: { status: string; tip: TipRefresh; partial: PartialOutcome };
 }
 
+export interface RecoverReleaseLandingOptions {
+  runId: string;
+  /** The landed repair commit on main; this is the idempotency key for a landing notification. */
+  mergeSha: string;
+  from?: string;
+  commandRoot?: string;
+  partial?: boolean;
+  repoRoot?: string;
+}
+
+export type RecoverReleaseLandingResult = RecoverReleaseResult & { duplicate: boolean };
+
+/** Commander represents `--no-partial` as false and its default (flag omitted) as true. */
+export function recoverLandingPartialOption(optionValue?: boolean): boolean | undefined {
+  return optionValue === false ? false : undefined;
+}
+
 export interface RecoverReleaseDeps extends ResumeReleaseDeps {
   /** `release cut-branch --append` — tests record the plan instead of pushing the branch. */
   cutBranch?: typeof cutReleaseBranch;
@@ -619,11 +753,19 @@ export class ReleaseRecoverStopped extends Error {
   }
 }
 
+function readRecoverJson(path: string, label: string): unknown {
+  try { return JSON.parse(readFileSync(path, 'utf8')) as unknown; }
+  catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`release ${label} JSON을 읽을 수 없다: ${path} (${detail}) — 파일을 보존하고 원장을 올바른 JSON으로 복구한 뒤 재시도하라.`);
+  }
+}
+
 /** Append one stage result to the resume-attempts ledger. `attempts[]` keeps its shape — the stage results are added. */
 function recordRecoverStage(entry: { root: string; runId: string; version: string; priorCountKnown: boolean; stage: RecoverStageRecord }): void {
   const path = join(entry.root, 'release', entry.version, 'resume-attempts', `${entry.runId}.json`);
   const saved = existsSync(path)
-    ? JSON.parse(readFileSync(path, 'utf8')) as { attempts?: unknown; recoveries?: unknown; priorCountKnown?: unknown }
+    ? readRecoverJson(path, 'resume attempts 원장') as { attempts?: unknown; recoveries?: unknown; priorCountKnown?: unknown }
     : undefined;
   if (saved !== undefined && (!saved || typeof saved !== 'object' || Array.isArray(saved) || !Array.isArray(saved.attempts)
     || (saved.recoveries !== undefined && !Array.isArray(saved.recoveries)))) throw new Error('release resume attempts ledger invalid');
@@ -637,16 +779,39 @@ function recordRecoverStage(entry: { root: string; runId: string; version: strin
   renameSync(temporary, path);
 }
 
+async function acquireReleaseRecoveryLock(root: string, runId: string) {
+  const lockDir = join(root, 'release', 'recovery-locks');
+  mkdirSync(lockDir, { recursive: true });
+  // A full-gate subprocess can block this process's event loop, delaying the async lock heartbeat.
+  // The observed release gate reached 2h20m; leave a finite four-hour stale/wait window for one recovery.
+  const lock = await acquireLockAsync(join(lockDir, `${runId}.lock`), {
+    staleMs: 4 * 60 * 60_000, retryBusyMs: 1_000, maxTries: 14_400,
+  });
+  if (!lock.stillHeld()) {
+    lock.release();
+    throw new Error(`release recovery lock was lost for ${runId} — retry after inspecting the recovery ledger`);
+  }
+  return lock;
+}
+
 /**
  * Repair a failed release run in one command: append dry-run (plan only) → append (fast-forward release/<v> onto the
  * picked repairs) → resume --from export-check (preflight plan, then the graph). A failing stage stops the command:
  * the later stages never run, and the stage results are already in the ledger for the human to read.
  */
 export async function recoverReleaseRun(opts: RecoverReleaseOptions, deps: RecoverReleaseDeps = {}): Promise<RecoverReleaseResult> {
-  if (!Array.isArray(opts.pick) || !opts.pick.length) throw new Error('release recover requires at least one --pick commit');
   const root = releaseRunUniverse({ root: deps.root });
+  const runId = safeRunId(opts.runId);
+  const lock = await acquireReleaseRecoveryLock(root, runId);
+  try {
+    return await recoverReleaseRunLocked(opts, deps, root);
+  } finally { lock.release(); }
+}
+
+async function recoverReleaseRunLocked(opts: RecoverReleaseOptions, deps: RecoverReleaseDeps, root: string): Promise<RecoverReleaseResult> {
+  if (!Array.isArray(opts.pick) || !opts.pick.length) throw new Error('release recover requires at least one --pick commit');
   const statePath = join(root, 'graph-runs', 'release-loop', `${safeRunId(opts.runId)}.json`);
-  const savedRun = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
+  const savedRun = readRecoverJson(statePath, 'release run 상태') as GraphRunState;
   if (savedRun.graphId !== 'release-loop' || savedRun.runId !== opts.runId) throw new Error(`run identity mismatch: ${statePath}`);
   // The saved version-release record names what to repair: the release branch and the commit the run cut.
   const versionRecord = savedRun.nodes.find((node) => node.nodeId === 'version-release');
@@ -707,8 +872,9 @@ export async function recoverReleaseRun(opts: RecoverReleaseOptions, deps: Recov
   const now = (): string => (deps.now?.() ?? new Date()).toISOString();
   const stages: RecoverStageRecord[] = [];
   const record = (stage: RecoverStageRecord): void => {
-    stages.push(stage);
-    recordRecoverStage({ root, runId: opts.runId, version, priorCountKnown: !savedRun.resume, stage });
+    const withPick = { ...stage, pick: stage.pick ?? [...opts.pick] };
+    stages.push(withPick);
+    recordRecoverStage({ root, runId: opts.runId, version, priorCountKnown: !savedRun.resume, stage: withPick });
   };
   const stop = (stage: RecoverStageName, error: unknown): never => {
     throw new ReleaseRecoverStopped(stage, stages, RECOVER_STAGES.slice(RECOVER_STAGES.indexOf(stage) + 1),
@@ -733,7 +899,7 @@ export async function recoverReleaseRun(opts: RecoverReleaseOptions, deps: Recov
   };
   const ledgerPath = join(root, 'release', version, 'resume-attempts', `${opts.runId}.json`);
   const recoveries: RecoverStageRecord[] = existsSync(ledgerPath)
-    ? ((JSON.parse(readFileSync(ledgerPath, 'utf8')) as { recoveries?: unknown[] }).recoveries ?? []) as RecoverStageRecord[]
+    ? ((readRecoverJson(ledgerPath, 'resume attempts 원장') as { recoveries?: unknown[] }).recoveries ?? []) as RecoverStageRecord[]
     : [];
   let appendedCommit: string | undefined;
   for (let index = recoveries.length - 1; index >= 0; index -= 1) {
@@ -843,3 +1009,69 @@ export async function recoverReleaseRun(opts: RecoverReleaseOptions, deps: Recov
     }
   }
 }
+
+/**
+ * Manual landing-event entrypoint. The event's merge SHA is the dedupe key; once that repair has completed its
+ * resume stage, a redelivered event returns the recorded result without appending or running the graph again.
+ * The event producer can call this after its own hook lands; this function does not subscribe to PR-land events.
+ */
+export async function recoverReleaseRunFromLanding(opts: RecoverReleaseLandingOptions,
+  deps: RecoverReleaseDeps = {}): Promise<RecoverReleaseLandingResult> {
+  if (!/^[0-9a-f]{40}$/i.test(opts.mergeSha)) throw new Error('release recover-landing requires a full 40-hex merge SHA');
+  const root = releaseRunUniverse({ root: deps.root });
+  const runId = safeRunId(opts.runId);
+  // Share one run-scoped lock with manual `release recover`: the dedupe read, append, and resume must not race.
+  const landingLock = await acquireReleaseRecoveryLock(root, runId);
+  try {
+    return await recoverReleaseRunFromLandingLocked(opts, deps, root, runId);
+  } finally { landingLock.release(); }
+}
+
+async function recoverReleaseRunFromLandingLocked(opts: RecoverReleaseLandingOptions, deps: RecoverReleaseDeps,
+  root: string, runId: string): Promise<RecoverReleaseLandingResult> {
+  const pick = [opts.mergeSha.toLowerCase()];
+  const statePath = join(root, 'graph-runs', 'release-loop', `${runId}.json`);
+  if (existsSync(statePath)) {
+    const savedRun = readRecoverJson(statePath, 'release run 상태') as GraphRunState;
+    const versionNode = savedRun.nodes.find((node) => node.nodeId === 'version-release');
+    const recorded = lastJsonObject(versionNode?.output);
+    const version = typeof recorded?.version === 'string' ? recorded.version : '';
+    if (savedRun.graphId === 'release-loop' && savedRun.runId === runId && isReleaseVersion(version)) {
+      const ledgerPath = join(root, 'release', version, 'resume-attempts', `${runId}.json`);
+      if (existsSync(ledgerPath)) {
+        const ledger = readRecoverJson(ledgerPath, 'resume attempts 원장') as { recoveries?: unknown };
+        if (ledger.recoveries !== undefined && !Array.isArray(ledger.recoveries)) throw new Error(`release resume attempts ledger invalid: ${ledgerPath}`);
+        const records = (ledger.recoveries ?? []) as RecoverStageRecord[];
+        const matchesPick = (entry: RecoverStageRecord): boolean => Array.isArray(entry.pick)
+          && entry.pick.some((sha) => typeof sha === 'string' && sha.toLowerCase() === pick[0]);
+        let completedIndex = -1;
+        for (let index = records.length - 1; index >= 0; index -= 1) {
+          const entry = records[index]!;
+          if (matchesPick(entry) && entry.stage === 'resume' && entry.outcome === 'ok') {
+            completedIndex = index;
+            break;
+          }
+        }
+        if (completedIndex >= 0) {
+          let cycleStart = completedIndex;
+          for (let index = completedIndex; index >= 0; index -= 1) {
+            const entry = records[index]!;
+            if (matchesPick(entry) && entry.stage === 'append-dry-run') {
+              cycleStart = index;
+              break;
+            }
+          }
+          const completed = records[completedIndex]!;
+          return { runId, version, branch: `release/${version}`, fromNode: completed.from ?? opts.from ?? RECOVER_FIRST_NODE,
+            stages: records.slice(cycleStart, completedIndex + 1).filter(matchesPick), duplicate: true };
+        }
+      }
+    }
+  }
+  const result = await recoverReleaseRunLocked({ runId, pick,
+    ...(opts.from === undefined ? {} : { from: opts.from }),
+    ...(opts.commandRoot === undefined ? {} : { commandRoot: opts.commandRoot }),
+    ...(opts.partial === undefined ? {} : { partial: opts.partial }),
+    ...(opts.repoRoot === undefined ? {} : { repoRoot: opts.repoRoot }) }, deps, root);
+  return { ...result, duplicate: false };
+}

package/scripts/release-loop/traffic-node.ts

@@ -42,7 +42,10 @@ export async function runTrafficNode(node = process.argv[2], env: NodeJS.Process
       return finishNode(node!, version, { outcome: 'fail', verdict: 'fail', summary });
     }
     const result = await applyReleaseTrafficEvent(context, event, options);
-    if (!result.applied) {
+    // Replaying the terminal restore after this run already restored its pre-cut traffic is a successful no-op.
+    const alreadyRestored = event === 'failed' && result.reason === 'already-restored';
+    const applied = result.applied || alreadyRestored;
+    if (!applied) {
       const consequence = event === 'failed' && result.reason === 'published-keeps-full'
         ? 'npm 발행은 완료됐으므로 전체 트래픽을 유지합니다. 후속 발행 단계 실패를 확인하세요.'
         : event === 'verify-complete' || event === 'npm-published'
@@ -52,8 +55,8 @@ export async function runTrafficNode(node = process.argv[2], env: NodeJS.Process
               : 'gate는 성공했으나 트래픽 감속이 적용되지 않았습니다.';
       (deps.report ?? reportFailure)(`RELEASE-POSTPUB-TRAFFIC ${version} ${runId || 'unknown'} ${node} 무시 — ${result.reason ?? 'traffic state unchanged'}. ${consequence}`);
     }
-    return finishNode(node!, version, { outcome: result.applied ? 'ok' : 'fail', verdict: result.applied ? 'pass' : 'fail',
-      summary: `${event} ${result.applied ? 'applied' : result.reason ?? 'ignored'}` });
+    return finishNode(node!, version, { outcome: applied ? 'ok' : 'fail', verdict: applied ? 'pass' : 'fail',
+      summary: `${event} ${alreadyRestored ? 'already-restored' : applied ? 'applied' : result.reason ?? 'ignored'}` });
   } catch (error) {
     const detail = errorResult(error).summary;
     const isLockTimeout = detail.startsWith('traffic lock timeout:');

package/scripts/release-loop/unattended-release.ts

@@ -49,6 +49,7 @@ export interface ReleaseLoopConfig {
 export interface ReleaseRunInput extends ReleaseLoopConfig {
   version: string;
   previousVersion: string;
+  triggerEvent?: { id: string; type: 'release.cut.due'; version: string; cutAt: string; at: string };
   cutCommit?: string;
   /** Required for the pod executor (the default); a host-executor run may have none. */
   gatePodPool?: string;
@@ -143,7 +144,7 @@ export function buildReleaseRunInput(version: string, deps: UnattendedReleaseDep
 
 /** Fail closed at the entry boundary, before any graph node can change a release. */
 export async function runUnattendedRelease(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string; triggerEvent?: ReleaseRunInput['triggerEvent'] },
   deps: UnattendedReleaseDeps = {},
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // A dry run only builds the input and mutates nothing, so it neither creates nor waits on the OP-seat lock.
@@ -154,7 +155,7 @@ export async function runUnattendedRelease(
 }
 
 async function runUnattendedReleaseLocked(
-  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string },
+  opts: { version: string; dryRun?: boolean; cutCommit?: string; forceFreeze?: boolean; forceNew?: boolean; mainCut?: boolean; prerelease?: PrereleaseKind; publishAt?: string; gateExecutor?: string; gateHost?: string; triggerEvent?: ReleaseRunInput['triggerEvent'] },
   deps: UnattendedReleaseDeps,
 ): Promise<{ input: ReleaseRunInput; dryRun: boolean; state?: GraphRunState }> {
   // RELEASE-BRANCH (10-06): the default cut is a release branch, so main keeps landing and the run no longer needs a
@@ -171,6 +172,7 @@ async function runUnattendedReleaseLocked(
   }
   const version = resolveRunVersion(opts.version, opts.prerelease, deps);
   const input = buildReleaseRunInput(version, deps, opts.cutCommit, { executor: opts.gateExecutor, host: opts.gateHost });
+  if (opts.triggerEvent) input.triggerEvent = opts.triggerEvent;
   if (opts.publishAt !== undefined) {
     const invalid = publishAtError(opts.publishAt);
     if (invalid) throw new Error(invalid);

package/scripts/shadow-authoring-probe.ts

@@ -0,0 +1,20 @@
+/**
+ * SHADOW-MODEL-ARMS(0.2.44 칸) · 저작 단계 그림자 «1팔» probe — 명시 실행 전용 스크립트.
+ *
+ * 저작(goal-author) 단계 그림자 1팔을 `planShadowArms` 일일 상한 안에서 «실제 호출»해
+ * 난이도·모델·예상/실제 비용·결과를 한 줄 원장 형식으로 stdout 에 출력한다.
+ * ⛔ 관측만 한다 — 라이브 LLM(Claude 구독) 호출 0 · 골/PR/착지 파일 쓰기 0.
+ * ⛔ 자동 런 훅과 다른 단계(implement·review·judge) 팔은 후속 조각이다.
+ *
+ * 사용(저장소 루트에서): bun scripts/shadow-authoring-probe.ts
+ */
+import { probeAuthoringShadowArm } from '../src/self-implement/goal-author.js';
+
+/** 명시 실행 probe — 생산 저작 probe 경로(probeAuthoringShadowArm ⊕ probeShadowArm ⊕ planShadowArms)를 그대로 지나 한 줄을 낸다. */
+export function runShadowAuthoringProbe(authorRunId = `shadow-authoring-probe-${new Date().toISOString().slice(0, 10)}`): string {
+  return probeAuthoringShadowArm(authorRunId).line;
+}
+
+if (import.meta.main) {
+  console.log(runShadowAuthoringProbe());
+}

package/scripts/ux-sim.ts

@@ -15,6 +15,7 @@
 //   bun scripts/ux-sim.ts --list-trajectories # 저장한 궤적과 출처 목록
 //   bun scripts/ux-sim.ts --fault cred-expiry # 결함 주입: grok 구독 만료 임박 × 갱신 결과 → 디스패처·발사 판정
 //   bun scripts/ux-sim.ts --fault pod-death   # 결함 주입: PARTIAL 줄을 남긴 Pod 가 SIGTERM 으로 지워짐 → 호스트 재방출 판정
+//   bun scripts/ux-sim.ts --fault pod-child-result # 결함 주입: Completed Pod 안의 report-deficit child 결과 보존
 //   bun scripts/ux-sim.ts --fault pool-cap    # 결함 주입: --pod-pool 에 :N 이 빠진 풀 → 승인 판정(limitedBy)
 //   bun scripts/ux-sim.ts --fault sqlite-busy # 결함 주입: 실제 SQLite 잠금 → 로그 배치 버퍼·복구
 //   bun scripts/ux-sim.ts emit child-error-long --json # 사건 주입(L0): 격리 우주 원장에 주입 줄 → 소비자 목록
@@ -128,7 +129,7 @@ if (argv[0] === 'seat-seq') {
 //     ***영영 모른다*** — 오늘 이 저장소가 같은 함정을 다른 도구에서 이미 한 번 고쳤다.
 //  ⛔ 그래서 「알려진 플래그」를 «한 곳»에 두고, 그 밖의 `--` 인자는 거부한다.
 const KNOWN_FLAGS = new Set([
-  '--list', '--list-trajectories', '--computer-use', '--trajectory', '--from-run',
+  '--list', '--list-trajectories', '--computer-use', '--trajectory', '--from-run', '--seminar-rehearsal',
   '--save-trajectory', '--esc', '--queue', '--width', '--height', '--draft', '--fault',
 ]);
 {
@@ -142,6 +143,17 @@ const KNOWN_FLAGS = new Set([
 }
 if (argv.includes('--list')) { console.log([...PHASES, 'computer-use: normal | capture-stalls | capture-fails | target-missing'].join('\n')); process.exit(0); }
 
+if (argv.includes('--seminar-rehearsal')) {
+  if (argv.length !== 1) {
+    console.error('⛔ --seminar-rehearsal 는 단독 모드다');
+    process.exit(2);
+  }
+  const { renderSeminarRehearsal, seminarRehearsalSweep } = await import('../src/ux-sim/seminar-rehearsal.js');
+  const result = seminarRehearsalSweep();
+  console.log(renderSeminarRehearsal(result).join('\n'));
+  process.exit(result.verdict === 'pass' ? 0 : 1);
+}
+
 {
   // `--fault=<이름>` 꼴도 받는다 — KNOWN_FLAGS 는 등호 꼴을 통과시키므로 여기서 놓치면 조용히 기본 국면으로 빠진다.
   const eq = argv.find((a) => a.startsWith('--fault='));
@@ -159,6 +171,11 @@ if (argv.includes('--fault')) {
     console.log(renderPodDeath(simPodDeath()).join('\n'));
     process.exit(0);
   }
+  if (fault === 'pod-child-result') {
+    const { podChildResultScenario, renderPodChildResult } = await import('../src/ux-sim/fault-pod-child-result.js');
+    console.log(renderPodChildResult(podChildResultScenario()).join('\n'));
+    process.exit(0);
+  }
   if (fault === 'pool-cap') {
     const { poolCapSweep, renderPoolCap } = await import('../src/ux-sim/fault-pool-cap.js');
     console.log(renderPoolCap(poolCapSweep()).join('\n'));
@@ -169,7 +186,7 @@ if (argv.includes('--fault')) {
     console.log(renderSqliteBusy(simSqliteBusy()).join('\n'));
     process.exit(0);
   }
-  console.error(`⛔ 모르는 결함이다: ${fault ?? '(없음)'} — 아는 것: cred-expiry · pod-death · pool-cap · sqlite-busy`);
+  console.error(`⛔ 모르는 결함이다: ${fault ?? '(없음)'} — 아는 것: cred-expiry · pod-death · pod-child-result · pool-cap · sqlite-busy`);
   process.exit(2);
 }
 

package/src/acp/core-turn-bridge.ts

@@ -57,6 +57,13 @@ import { resolveSessionSurfaceProfile } from '../session-runtime/index.js';
 import { classifyTuiChatIntent, formatTuiRouteLine, isSeatOpsDirective, type TuiChatRoute } from '../core-turn/short-question.js';
 import { HARNESS_ROLE_ENV } from '../harness/harness-space.js';
 import { createReasoningThoughtBuffer } from './reasoning-thought-buffer.js';
+import {
+  REQUEST_SIZE_MAX_CHARS,
+  createRequestSizeGuard,
+  estimateRequestChars,
+  formatRequestSizeStatus,
+  type RequestSizeGuard,
+} from '../session/request-size-guard.js';
 
 const FACT_QUESTION_INSTRUCTION = '사실·최신 정보 질문이다. WebSearch 를 1~2회 쓰고 검색 결과(제목·스니펫·URL)로 답하라. 출처 링크를 붙여라. 셸·브라우저·파일 도구는 검색 결과로 부족할 때만. 도구 예산에 닿으면 지금까지 근거로 답하고 끝에 «더 찾아볼까요?»를 붙여라.';
 
@@ -143,6 +150,18 @@ export interface CoreTurnBridgeDeps {
   /** TUI-H1-SEAT-GOALLOOP — the seat this TUI works for (`detectSeatTui`), read per turn. null/absent = a human
    *  conversation TUI (routing unchanged). A seat TUI sends operational directives to the goal loop. */
   resolveSeat?: () => string | null;
+  /** TUI-TOKEN-GUARD-WIRE — host write-back for the #32254 request-size cap.
+   *  Compacts the host's own history store (the one `getMessages` reads) in place
+   *  so the next prompt does not reload the original. The bridge re-reads
+   *  `getMessages` after `fired:true`. Only consulted on `tuiRouting` turns. */
+  compactPersistedHistory?: (ctx: {
+    sessionId: string;
+    userText: string;
+    requestChars: number;
+    maxChars: number;
+  }) => Promise<{ fired: boolean; reason: string }>;
+  /** Override the request-size cap (tests). Defaults to `REQUEST_SIZE_MAX_CHARS`. */
+  requestSizeMaxChars?: number;
 }
 
 /** Default abort-poll cadence. 50ms = 20 Hz: responsive without
@@ -224,7 +243,7 @@ export function bridgeCoreTurnToAcp(
     (poll as unknown as { unref?: () => void }).unref?.();
 
     try {
-      const messages = await Promise.resolve(
+      let messages = await Promise.resolve(
         deps.getMessages({
           sessionId: turnCtx.sessionId,
           userText: turnCtx.userText,
@@ -318,9 +337,71 @@ export function bridgeCoreTurnToAcp(
       }
       const explicitMaxToolTurns = deps.resolveMaxToolTurns?.({ sessionId: turnCtx.sessionId });
       const maxToolTurns = explicitMaxToolTurns ?? (factQuestion ? getUserConfig().chat.factQuestion.maxToolTurns : undefined);
-      const turnMessages: LLMMessage[] = factQuestion
-        ? [{ role: 'system', content: FACT_QUESTION_INSTRUCTION }, ...messages]
-        : messages;
+      const withFactInstruction = (seed: LLMMessage[]): LLMMessage[] => factQuestion
+        ? [{ role: 'system', content: FACT_QUESTION_INSTRUCTION }, ...seed]
+        : seed;
+      let turnMessages: LLMMessage[] = withFactInstruction(messages);
+      // TUI-TOKEN-GUARD-WIRE — exact serialized provider measurement owns
+      // first-request compaction; the seed estimate is telemetry only. This
+      // keeps turn-0 history untouched until compactFirstRequest writes back.
+      let requestSizeGuard: RequestSizeGuard | undefined;
+      if (deps.tuiRouting === true) {
+        const maxChars = deps.requestSizeMaxChars ?? REQUEST_SIZE_MAX_CHARS;
+        let historyCompacted = false;
+        const compactHistory = async (requestChars: number, stage: 'first-request') => {
+          if (!deps.compactPersistedHistory || historyCompacted) return false;
+          let fired = false;
+          let reason = 'no-op';
+          try {
+            const result = await deps.compactPersistedHistory({
+              sessionId: turnCtx.sessionId, userText: turnCtx.userText, requestChars, maxChars,
+            });
+            fired = result.fired;
+            reason = result.reason;
+            historyCompacted = fired;
+          } catch (error) {
+            reason = 'compaction-error';
+            debug.log('llm.request', 'request-size-compact-error', {
+              stage, requestChars, maxChars, message: error instanceof Error ? error.message : String(error),
+            }, { level: 'warn' });
+          }
+          return { fired, reason };
+        };
+        const estimatedSeedChars = estimateRequestChars(turnMessages, tools);
+        debug.log('llm.request', 'request-size-compact', {
+          stage: 'estimate', sessionId: turnCtx.sessionId,
+          beforeChars: estimatedSeedChars, maxChars,
+          compacted: false, reason: 'awaiting-exact-wire-measurement',
+        });
+        requestSizeGuard = createRequestSizeGuard({
+          maxChars,
+          compactOptions: () => {
+            const guardModel = modelOverride ?? getUserConfig().llm?.model;
+            const guardConfig = getUserConfig().chat;
+            const preserveLastN = guardConfig?.autoCompact?.preserveLastN;
+            const archiveEnabled = guardConfig?.compact?.archiveEnabled;
+            return {
+              sessionId: turnCtx.sessionId,
+              ...(guardModel ? { activeModelId: guardModel } : {}),
+              ...(preserveLastN !== undefined ? { preserveLastN } : {}),
+              ...(archiveEnabled !== undefined ? { archiveEnabled } : {}),
+            };
+          },
+          // The preflight estimate missed (wire over cap, seed under): still write the
+          // compaction back so the next prompt starts small, then compact this request live.
+          compactFirstRequest: async (_current, info) => {
+            await compactHistory(info.requestChars, 'first-request');
+            return null;
+          },
+          onMeasured: (measurement) => {
+            if (!measurement.compacted) return;
+            void turnCtx.pushSessionUpdate(
+              { sessionUpdate: 'agent_thought_chunk', content: { type: 'text', text: formatRequestSizeStatus(measurement) } },
+              { status: true },
+            );
+          },
+        });
+      }
       let toolCallCount = 0;
       const toolKinds = new Set<string>();
       const observeToolBudget = () => {
@@ -434,6 +515,7 @@ export function bridgeCoreTurnToAcp(
         ...(modelOverride !== undefined ? { modelOverride } : {}),
         ...(autohealProvider ?? {}),
         ...(maxToolTurns !== undefined ? { maxToolTurns } : {}),
+        ...(requestSizeGuard ? { requestSizeGuard } : {}),
         ...((!factQuestion || explicitMaxToolTurns !== undefined) && deps.budgetGrant !== undefined ? { budgetGrant: deps.budgetGrant } : {}),
         callbacks: {
           onStatus: (line) => {