elanous 0.2.42 → 0.2.44

package/src/cli/pr-land-heavy-remote.ts

@@ -8,6 +8,7 @@ import { debug, redactSecretText } from '../debug/log.js';
 import { gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote, type GateRemoteRunner, type RemoteRunOutcome } from '../self-implement/gate-remote.js';
 import { decideWarmReuse, type WarmReuseEvidenceByConsumer, type WarmReuseSwitchConfig } from '../task-orchestrator/surfaces/pod-warm-switch.js';
 import { buildLandWarmEvidence, type LandShadowSampleWindow } from './pr-land-pod-shadow-job.js';
+import { readWarmReuseEvidence, warmReuseEvidencePath, type WarmReuseEvidenceRow } from '../task-orchestrator/surfaces/warm-reuse-evidence.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
 // This is the stable fallback order when settings.host is unavailable; an explicitly configured allowlisted host
@@ -18,7 +19,7 @@ export type PrLandHeavyHost = typeof PR_LAND_HEAVY_HOSTS[number];
 const allowedHost = (host: string): host is PrLandHeavyHost => PR_LAND_HEAVY_HOSTS.some((candidate) => candidate === host);
 
 export interface HeavyRemoteEvidence {
-  schema: 2;
+  schema: 3;
   pr: number;
   head: string;
   main: string;
@@ -72,6 +73,42 @@ export interface HeavyRemoteDeps {
   warmReuseConfig?: () => WarmReuseSwitchConfig | undefined;
   /** WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과 창 seam(기본 없음 = 증거 없음 = off). */
   landShadowSamples?: () => LandShadowSampleWindow | undefined;
+  /** Durable shadow journal reader seam. */
+  readWarmEvidence?: (identity: { consumer: 'land' | 'gate-recheck'; pr: number; head: string; main: string }) => WarmReuseEvidenceRow[] | undefined;
+  warmEvidencePath?: () => string;
+}
+
+function journalLandShadowSamples(input: HeavyRemoteInput, deps: HeavyRemoteDeps): LandShadowSampleWindow | undefined {
+  const read = deps.readWarmEvidence ?? ((identity) => readWarmReuseEvidence(
+    (deps.warmEvidencePath ?? warmReuseEvidencePath)(), identity));
+  const rows = read({ consumer: 'land', pr: input.pr, head: input.head, main: input.main });
+  if (!rows?.length) return undefined;
+  const samples = rows.map((row) => ({ head: row.head, main: row.main,
+    lock: row.expectedLockHash ?? '', leaseValid: row.leaseValid === true && !!row.leaseId && !!row.workerId
+      && row.generation !== undefined && row.expectedLockHash === row.workerLockHash,
+    canaryPassed: row.canaryPassed === true, agree: row.agree === true }));
+  const latest = rows[rows.length - 1]!;
+  const gateRows = read({ consumer: 'gate-recheck', pr: input.pr, head: input.head, main: input.main });
+  let gateRecheck: LandShadowSampleWindow['gateRecheck'];
+  if (gateRows?.length) {
+    let consecutiveMatchSamples = 0;
+    for (let i = gateRows.length - 1; i >= 0; i--) {
+      const row = gateRows[i]!;
+      if (row.workerId !== latest.workerId || row.expectedLockHash !== latest.expectedLockHash
+        || row.workerLockHash !== row.expectedLockHash || row.leaseValid !== true
+        || !row.leaseId || row.generation === undefined
+        || row.canaryPassed !== true || row.agree !== true) break;
+      consecutiveMatchSamples++;
+    }
+    const latestGate = gateRows[gateRows.length - 1]!;
+    gateRecheck = { consecutiveMatchSamples, recentMismatchCount: gateRows.filter((row) => row.agree === false).length,
+      leaseValid: latestGate.leaseValid === true && !!latestGate.leaseId && !!latestGate.workerId && latestGate.generation !== undefined,
+      canaryPassed: latestGate.canaryPassed === true,
+      expected: { head: input.head, main: input.main, lock: latestGate.expectedLockHash },
+      worker: { head: input.head, main: input.main, lock: latestGate.workerLockHash } };
+  }
+  const lock = latest.expectedLockHash ?? '';
+  return { samples, lock, ...(gateRecheck ? { gateRecheck } : {}) };
 }
 
 function evidencePath(input: HeavyRemoteInput): string {
@@ -83,7 +120,7 @@ function validRootPlan(value: unknown): value is RootPlanSummary | null {
   if (!value || typeof value !== 'object') return false;
   const plan = value as Partial<RootPlanSummary>;
   return (plan.mode === 'affected' || plan.mode === 'full')
-    && (plan.roots === null || (Number.isSafeInteger(plan.roots) && plan.roots >= 0))
+    && (plan.roots === null || (typeof plan.roots === 'number' && Number.isSafeInteger(plan.roots) && plan.roots >= 0))
     && typeof plan.promoted === 'boolean'
     && (plan.reason === null || typeof plan.reason === 'string');
 }
@@ -92,7 +129,7 @@ function matchingEvidence(path: string, input: HeavyRemoteInput): HeavyRemoteEvi
   if (!existsSync(path)) return null;
   try {
     const data: HeavyRemoteEvidence = JSON.parse(readFileSync(path, 'utf8'));
-    return data.schema === 2 && data.pr === input.pr && data.head === input.head
+    return data.schema === 3 && data.pr === input.pr && data.head === input.head
       && data.main === input.main && allowedHost(data.host) && Number.isFinite(data.elapsedMs)
       && typeof data.interferenceMeasured === 'boolean' && validRootPlan(data.rootPlan) ? data : null;
   } catch { return null; }
@@ -232,7 +269,8 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
   }
   try {
     warmStage = 'evidence';
-    warmEvidence = buildLandWarmEvidence(deps.landShadowSamples?.(), { head: input.head, main: input.main });
+    const samples = deps.landShadowSamples ? deps.landShadowSamples() : journalLandShadowSamples(input, deps);
+    warmEvidence = buildLandWarmEvidence(samples, { head: input.head, main: input.main });
   } catch (error) {
     debug.log('pod.warm', 'land-shadow-unavailable', {
       pr: input.pr, stage: warmStage, reason: 'warm-evidence-read-failed',
@@ -266,7 +304,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
           // then run typecheck and self gate (changed tests and PWA reach/build) at that exact pair.
           // The detached integration commit stays on the selected host and never changes the PR branch.
           argv: (sha) => ['sh', '-c',
-          'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit "$1" && TSC_BASE_REF="$1" bun run scripts/ci-typecheck-changed.ts --local && bun bin/elanous.mjs self gate --changed --base "$1" --local --shards 4 && bun scripts/pr-land-extra-remote-gates.ts "$1"',
+          'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit "$1" && bash scripts/ci-typecheck-main-delta.sh "$1" && bun bin/elanous.mjs self gate --changed --base "$1" --local --shards 4 && bun scripts/pr-land-extra-remote-gates.ts "$1"',
           'sh', sha(input.main)],
         }, deps.runner ?? realGateRemoteRunner);
       } catch (error) {
@@ -309,7 +347,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
     return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason, elapsedMs, evidencePath: path, ...(failureLogPath ? { failureLogPath } : {}) };
   }
   const evidence: HeavyRemoteEvidence = {
-    schema: 2, pr: input.pr, head: input.head, main: input.main, host: selectedHost,
+    schema: 3, pr: input.pr, head: input.head, main: input.main, host: selectedHost,
     passedAt: new Date().toISOString(), elapsedMs: outcome.ms, rootPlan: rootPlanFromOutput(outcome.stdout),
     interferenceMeasured: extraGates.interferenceMeasured,
   };

package/src/cli/pr-land-overlap-evidence.ts

@@ -14,6 +14,9 @@
  *   ③ 리뷰 — 증거가 가리키는 `review-results/<card>-<pr>-<head접두 10~40>.json`(TA 가 받는 `self review --json` stdout)이
  *      파일명에서 같은 PR·머리 접두이고 내용에서 전체 PR·머리가 정확히 같으며 `reviewed:true` · `verdict ∈ {pass, warn}` · must-fix 가 «잰 수» 0 인가
  *      (자동 병합 canAuto · TA-LAND-WARN-MUSTFIX0 과 같은 규칙 — must-fix 를 못 셌으면 거부).
+ *   ③' 공급자(PRLAND-ACP-CLAUDE-ALLOW) — 백엔드가 `acp:claude`(또는 `acp:claude/…`, acp-fallback+`claude`)인 리뷰도
+ *      ③ 을 만족하고 «같은 머리의 선택된 리뷰» 이면 착지 증거다. 같은 머리의 실패한 금지 리뷰는 후보에서
+ *      superseded 로 제외되고(supersedes 장부), 유효한 같은-머리 리뷰가 없으면 종전처럼 거부한다(fail-closed).
  *   ⓐ 이미 조상(TC #26019 실측) — 겹친 최근 착지 커밋이 «전부» 고정 머리의 조상이면 그 겹침은 이미 그 머리의 게이트·리뷰에
  *      반영됐다 ⇒ ①② 없이 ③ 만으로 통과(관측 reason `already-ancestor`). 하나라도 조상이 아니면 ①②③ 전부.
  *   ⓐ' 증거 파일이 없을 때(`verifyAncestorAutoPass`) — 같은 ⓐ 를 표준 자리 `review-results/*-<pr>-<head접두 10~40>.json` 만으로 잰다
@@ -453,6 +456,7 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>
   if (!review.head || review.head.toLowerCase() !== reviewHead) return { ok: false, reason: 'review-head-mismatch', baseTip };
   // The capture parser projects away model provenance; inspect the same last result-shaped line here.
   const raw = lastReviewRecord(text);
+  let acpClaudeEvidence: { actualBackend: string; model: string; reviewRoute: string } | undefined;
   if (raw) {
     if (raw.reviewer === 'OP-waiver') {
       const waiver = validOpWaiver(raw, input.pr, head);
@@ -463,10 +467,15 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>
     const route = typeof raw.reviewRoute === 'string' ? raw.reviewRoute.trim().toLowerCase() : '';
     const respondedProvider = typeof raw.respondedProvider === 'string' ? raw.respondedProvider.trim().toLowerCase() : '';
     const respondedModel = typeof raw.respondedModel === 'string' ? raw.respondedModel.trim().toLowerCase() : '';
+    // PRLAND-ACP-CLAUDE-ALLOW — `acp:claude` is no longer refused outright. A review that satisfies
+    // the landing contract below (same PR/head, reviewed, pass|warn, counted must-fix 0) is evidence
+    // whatever backend produced it; a failed acp:claude attempt is excluded by the same-head
+    // supersedes ledger instead of blocking every landing. This note records the provenance only —
+    // the contract below still decides, so an invalid or other-head acp:claude review stays rejected.
     if (actualBackend === 'acp:claude' || actualBackend.startsWith('acp:claude/')
       || model === 'acp:claude' || model.startsWith('acp:claude/')
       || ((route === 'acp' || route === 'acp-fallback') && typeof raw.fallbackBackend === 'string' && raw.fallbackBackend.trim().toLowerCase() === 'claude')) {
-      return { ok: false, reason: 'review-forbidden-acp-claude', baseTip };
+      acpClaudeEvidence = { actualBackend, model, reviewRoute: route };
     }
     const requested = typeof raw.requestedModel === 'string' ? raw.requestedModel.trim().toLowerCase() : '';
     if (requested) {
@@ -490,6 +499,9 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>
   if (review.reviewed !== true) return { ok: false, reason: 'review-not-reviewed', baseTip };
   if (review.verdict === null || !ACCEPTED_REVIEW_VERDICTS.has(review.verdict)) return { ok: false, reason: `review-verdict-${review.verdict ?? 'null'}`, baseTip };
   if (review.mustFix !== 0) return { ok: false, reason: review.mustFix === null ? 'review-must-fix-unknown' : `review-must-fix-${review.mustFix}`, baseTip };
+  if (acpClaudeEvidence) {
+    debug.log('pr.land', 'review-acp-claude-accepted', { pr: input.pr, head, reviewResult: e.reviewResult, ...acpClaudeEvidence });
+  }
   if (carry) {
     if (!input.cwd || !input.remote || !input.branch) return { ok: false, reason: 'carry-repo-unmeasured', baseTip };
     const digest = createHash('sha256').update(text).digest('hex');

package/src/cli/pr-land-pod-shadow-job.ts

@@ -3,8 +3,15 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { runPodCommand, type RunPodCommandOptions, type PodCommandResult } from '../task-orchestrator/surfaces/pod-command-job.js';
 import { redactSecretText } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
 import type { RootPlanSummary } from './pr-land-heavy-remote.js';
-import type { WarmReuseEvidence, WarmReuseEvidenceByConsumer } from '../task-orchestrator/surfaces/pod-warm-switch.js';
+import type { WarmReuseEvidence, WarmReuseEvidenceByConsumer, WarmReuseSwitchConfig } from '../task-orchestrator/surfaces/pod-warm-switch.js';
+import { requestWarmPodReplay, finalizeWarmPodReplay, quarantineWarmPodReplay } from '../task-orchestrator/surfaces/pod-warm-worker-provider.js';
+import { assessWarmWorkerShadow, type WarmWorkerFileResult } from '../task-orchestrator/surfaces/pod-warm-worker-protocol.js';
+import { writeWarmJobManifest, warmReferenceFromJobArtifacts } from '../../scripts/release-loop/gate-warm-artifacts.js';
+import type { ActualWarmLeaseEvidence } from '../task-orchestrator/surfaces/warm-reuse-evidence.js';
+import { randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 
 const SHA = /^[0-9a-f]{40}$/i;
 const MARKER = 'ELANOUS_PRLAND_SHADOW';
@@ -12,7 +19,7 @@ const MARKER = 'ELANOUS_PRLAND_SHADOW';
 export const LANDING_POD_SHADOW_HOST_TIMEOUT_MS = 10 * 60_000;
 export const LANDING_POD_SHADOW_STATUS_UNREADABLE_MS = 60_000;
 
-export interface LandingPodShadowInput { head: string; main: string }
+export interface LandingPodShadowInput { pr?: number; repo?: string; host?: string; head: string; main: string }
 export interface LandingPodShadowVerdict {
   measured: boolean;
   ok: boolean;
@@ -21,9 +28,26 @@ export interface LandingPodShadowVerdict {
   gateRc?: number;
   reason?: string;
   job?: string;
+  /** Warm evidence only exists after a real worker lease and exact per-file comparison. */
+  warmEvidence?: ActualWarmLeaseEvidence;
+  warmReason?: string;
+  warmTestFiles?: string[];
 }
 
-export function landingPodShadowScript(head: string, main: string): string {
+const LAND_TEST_PATH = /^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*\/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*\.test\.tsx?$/;
+export const LAND_WARM_CANARY_TIMEOUT_MS = 5 * 60_000;
+
+/** Changed test files are the bounded canary scope; no test file means no warm evidence. */
+export function changedLandWarmTestFiles(repo: string, head: string, main: string): string[] {
+  if (!SHA.test(head) || !SHA.test(main)) return [];
+  const result = spawnSync('git', ['-C', repo, 'diff', '--name-only', '--diff-filter=ACMR', `${main}...${head}`], {
+    encoding: 'utf8', timeout: 15_000, maxBuffer: 2 * 1024 * 1024,
+  });
+  if (result.status !== 0) return [];
+  return [...new Set(result.stdout.split(/\r?\n/).filter((path) => LAND_TEST_PATH.test(path)))].sort();
+}
+
+export function landingPodShadowScript(head: string, main: string, afterGate = ''): string {
   if (!SHA.test(head) || !SHA.test(main)) throw new Error('pod shadow: invalid head/main');
   return [
     'set -u',
@@ -39,17 +63,117 @@ export function landingPodShadowScript(head: string, main: string): string {
     `printf '${MARKER}_TSC_PLAN %s\\n' "$(grep '^\\[tsc-gate\\] root-plan ' /tmp/prland-shadow-tsc.log | tail -n 1 | sed 's/^\\[tsc-gate\\] root-plan //')"`,
     "tail -n 8 /tmp/prland-shadow-tsc.log; tail -n 8 /tmp/prland-shadow-gate.log",
     `printf '${MARKER} head=%s main=%s tsc=%s gate=%s\\n' '${head}' '${main}' "$tsc_rc" "$gate_rc"`,
+    ...(afterGate ? [afterGate] : []),
     'exit 0',
   ].join('\n');
 }
 
+function landWarmColdTestScript(files: readonly string[], head: string, attemptId: string): string {
+  if (files.some((file) => !LAND_TEST_PATH.test(file)) || !SHA.test(head) || !/^[0-9a-f-]{36}$/i.test(attemptId))
+    throw new Error('pod shadow: invalid warm test scope');
+  return files.map((file, index) => {
+    const prefix = `"$HOME/outbox/pr-land-warm/${index}"`;
+    const quotedFile = `'${file}'`;
+    return [
+      `mkdir -p "$HOME/outbox/pr-land-warm"`,
+      `bun test --reporter=junit --reporter-outfile=${prefix}.junit.xml ${quotedFile} >${prefix}.log 2>&1`,
+      'test_rc=$?',
+      `printf '%s' "$test_rc" >${prefix}.rc`,
+      `printf '{"commit":"${head}","attemptId":"${attemptId}","files":["${file}"],"rc":%s,"jobFailed":false,"jobExitCode":0}\n' "$test_rc" >${prefix}.json`,
+      `printf '[warm-worker] file=%s\\n[warm-worker] cut=%s attempt=%s\\n' '${file}' '${head}' '${attemptId}' >${prefix}.log.stamped`,
+      `cat ${prefix}.log >>${prefix}.log.stamped`,
+      `printf '\\n[warm-worker] junit-sha256=%s\\n' "$(sha256sum ${prefix}.junit.xml 2>/dev/null | cut -d' ' -f1)" >>${prefix}.log.stamped`,
+      `mv ${prefix}.log.stamped ${prefix}.log`,
+    ].join('\n');
+  }).join('\n');
+}
+
+async function runWarmLandCanary(input: {
+  pr: number; head: string; main: string; host: string; repo: string;
+  job: PodCommandResult; files: readonly string[]; attemptId: string; coldGatePassed: boolean;
+  timeoutMs?: number;
+  readReference?: typeof warmReferenceFromJobArtifacts;
+  requestWarm?: typeof requestWarmPodReplay;
+  finalizeWarm?: typeof finalizeWarmPodReplay;
+  quarantineWarm?: typeof quarantineWarmPodReplay;
+  warmConfig?: () => WarmReuseSwitchConfig | undefined;
+}): Promise<{ warmEvidence?: ActualWarmLeaseEvidence; reason: string }> {
+  let config: WarmReuseSwitchConfig | undefined;
+  try { config = input.warmConfig ? input.warmConfig() : getUserConfig().pod?.warmReuse; }
+  catch { return { reason: 'warm-config-unavailable' }; }
+  if (input.host !== 'node-b') return { reason: 'canary-host-mismatch' };
+  if (config?.land !== true) return { reason: 'land-canary-flag-off' };
+  if (!input.files.length) return { reason: 'changed-test-files-unmeasured' };
+  const coldFiles = input.files.map((file, index) => {
+    const prefix = join(input.job.artifactsDir, 'outbox', 'pr-land-warm', String(index));
+    const writeManifest = writeWarmJobManifest(prefix, file, input.head, input.attemptId);
+    return writeManifest ? (input.readReference ?? warmReferenceFromJobArtifacts)(prefix, file,
+      { cutSha: input.head, attemptId: input.attemptId }) : null;
+  });
+  if (coldFiles.some((row) => row === null)) return { reason: 'cold-reference-unmeasured' };
+  const requestWarm = input.requestWarm ?? requestWarmPodReplay;
+  let replay;
+  const timeoutMs = input.timeoutMs ?? LAND_WARM_CANARY_TIMEOUT_MS;
+  const request = requestWarm({ protocol: 1, runId: `land-${input.pr}-${input.head.slice(0, 8)}`,
+      attemptId: input.attemptId, cutSha: input.head, baselineSha: input.main,
+      deadlineAt: Date.now() + timeoutMs, files: [...input.files], envProfile: 'gate-v1' });
+  const timedOut = Symbol('warm-canary-timeout');
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const raced = await Promise.race([request, new Promise<typeof timedOut>((resolve) => {
+      timer = setTimeout(() => resolve(timedOut), timeoutMs);
+    })]);
+    if (raced === timedOut) {
+      // The provider API has no AbortSignal yet. Fence any late lease as soon as it arrives.
+      void request.then(async (late) => {
+        if (late.command) await (input.quarantineWarm ?? quarantineWarmPodReplay)(late.command, 'land-shadow-late-after-timeout');
+      }).catch(() => {});
+      return { reason: 'warm-request-timeout' };
+    }
+    replay = raced;
+  } catch (error) { return { reason: `warm-request-failed:${error instanceof Error ? error.name : 'unknown'}` }; }
+  finally { if (timer) clearTimeout(timer); }
+  const command = replay.command;
+  if (!command) return { reason: replay.transport.reason ?? 'warm-lease-unmeasured' };
+  const decision = assessWarmWorkerShadow(command, coldFiles as WarmWorkerFileResult[], replay.transport.reply);
+  const matched = decision.reason === 'match';
+  let leaseValid = replay.transport.status === 'observed' && replay.transport.reason === 'complete';
+  try {
+    if (matched) await (input.finalizeWarm ?? finalizeWarmPodReplay)(command);
+    else { leaseValid = false; await (input.quarantineWarm ?? quarantineWarmPodReplay)(command, `land-shadow-${decision.reason}`); }
+  } catch { leaseValid = false; }
+  // The reply is the worker-side observation. Falling back to the host's requested key
+  // would turn a missing worker identity into a false positive comparison.
+  const workerLockHash = replay.transport.reply?.key?.lockHash;
+  if (!command.leaseId || !Number.isSafeInteger(command.generation) || command.generation < 1
+    || !command.key.lockHash || !workerLockHash) return { reason: 'warm-lease-identity-unmeasured' };
+  return { reason: decision.reason, warmEvidence: {
+    workerId: command.workerId,
+    leaseId: command.leaseId, generation: command.generation,
+    expectedLockHash: command.key.lockHash, workerLockHash,
+    leaseValid, canaryPassed: matched && leaseValid && input.coldGatePassed, agree: matched,
+  } };
+}
+
 export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps: {
   runPod?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
   readLog?: (path: string) => string;
   /** Deterministic timer seam for the host deadline. */
   armTimeout?: (onTimeout: () => void, ms: number) => () => void;
+  testFiles?: readonly string[];
+  warmReplay?: typeof requestWarmPodReplay;
+  finalizeWarm?: typeof finalizeWarmPodReplay;
+  quarantineWarm?: typeof quarantineWarmPodReplay;
+  readReference?: typeof warmReferenceFromJobArtifacts;
+  warmConfig?: () => WarmReuseSwitchConfig | undefined;
+  warmTimeoutMs?: number;
 } = {}): Promise<LandingPodShadowVerdict> {
-  const script = landingPodShadowScript(input.head, input.main);
+  let warmConfig: WarmReuseSwitchConfig | undefined;
+  try { warmConfig = deps.warmConfig ? deps.warmConfig() : getUserConfig().pod?.warmReuse; } catch { /* no warm launch without readable config */ }
+  const canaryEnabled = input.host === 'node-b' && warmConfig?.land === true;
+  const files = canaryEnabled ? deps.testFiles ?? (input.repo ? changedLandWarmTestFiles(input.repo, input.head, input.main) : []) : [];
+  const attemptId = randomUUID();
+  const script = landingPodShadowScript(input.head, input.main, landWarmColdTestScript(files, input.head, attemptId));
   const controller = new AbortController();
   const armTimeout = deps.armTimeout ?? ((onTimeout: () => void, ms: number) => {
     const timer = setTimeout(onTimeout, ms);
@@ -106,7 +230,21 @@ export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps:
   if (!rootPlan) return { measured: false, ok: false, rootPlan: null, reason: 'root-plan-missing', job: job.job };
   const tscRc = Number(match[1]);
   const gateRc = Number(match[2]);
-  return { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job };
+  const verdict: LandingPodShadowVerdict = { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job,
+    ...(files.length ? { warmTestFiles: [...files] } : {}) };
+  if (input.pr && input.repo && input.host) {
+    const warm = await runWarmLandCanary({ pr: input.pr, head: input.head, main: input.main, host: input.host,
+      repo: input.repo, job, files, attemptId, coldGatePassed: verdict.ok,
+      ...(deps.warmTimeoutMs !== undefined ? { timeoutMs: deps.warmTimeoutMs } : {}),
+      ...(deps.readReference ? { readReference: deps.readReference } : {}),
+      ...(deps.warmReplay ? { requestWarm: deps.warmReplay } : {}),
+      ...(deps.finalizeWarm ? { finalizeWarm: deps.finalizeWarm } : {}),
+      ...(deps.quarantineWarm ? { quarantineWarm: deps.quarantineWarm } : {}),
+      warmConfig: () => warmConfig });
+    verdict.warmReason = warm.reason;
+    if (warm.warmEvidence) verdict.warmEvidence = warm.warmEvidence;
+  }
+  return verdict;
 }
 
 /** WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과 표본(착지쌍·lock·lease·카나리아·그림자 일치). */

package/src/cli/pr-land-pod-shadow.ts

@@ -15,6 +15,8 @@ export interface HeavyOnPodShadowInput<T> {
   runPod: () => T | Promise<T>;
   log: (category: string, event: string, data: Record<string, unknown>) => void;
   warn: (message: string) => void;
+  /** Evidence persistence is best effort; it must never change the cold landing verdict. */
+  onShadow?: (observation: { pod: unknown; agree: boolean }) => void;
 }
 
 function agree(local: unknown, pod: unknown): boolean {
@@ -38,22 +40,25 @@ function elapsedMs(started: number): number {
 }
 
 export async function runHeavyOnPodShadow<T>(input: HeavyOnPodShadowInput<T>): Promise<T> {
-  const { enabled, pr, head, local, runPod, log, warn } = input;
+  const { enabled, pr, head, local, runPod, log, warn, onShadow } = input;
   if (!enabled) return local;
 
   const localMs = 0;
   const started = performance.now();
   try {
     const pod = await runPod();
+    const agrees = agree(local, pod);
     log('pr.land', 'heavy-on-pod-shadow', {
       pr,
       head,
       local,
       pod,
-      agree: agree(local, pod),
+      agree: agrees,
       podMs: elapsedMs(started),
       localMs,
     });
+    try { onShadow?.({ pod, agree: agrees }); }
+    catch (error) { warn(`shadow evidence write failed: ${error instanceof Error ? error.message : String(error)}`); }
   } catch (error) {
     warn(error instanceof Error ? error.message : String(error));
     log('pr.land', 'heavy-on-pod-shadow', {
@@ -62,6 +67,8 @@ export async function runHeavyOnPodShadow<T>(input: HeavyOnPodShadowInput<T>): P
       agree: false,
       podMs: elapsedMs(started), localMs,
     });
+    try { onShadow?.({ pod: { measured: false, ok: false, reason: `pod-exception:${error instanceof Error ? error.name : 'unknown'}` }, agree: false }); }
+    catch (writeError) { warn(`shadow evidence write failed: ${writeError instanceof Error ? writeError.message : String(writeError)}`); }
   }
   return local;
 }

package/src/cli/release-checklist-read-cli.ts

@@ -76,6 +76,26 @@ function evidenceJson(stdout: string): Record<string, unknown> | null {
   return null;
 }
 
+// E4 reads only the exact event near the evidence timestamp; absent timestamps fail closed.
+const E4_LOG_WINDOW_MS = 30 * 60_000;
+const EVIDENCE_ISO_TIMESTAMP = /\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})\b/gu;
+
+function evidenceTimestampNearIdentity(evidence: string, identity: string): number | null {
+  const identityAt = evidence.indexOf(identity);
+  if (identityAt < 0) return null;
+  const lineStart = evidence.lastIndexOf('\n', identityAt) + 1;
+  const lineEnd = evidence.indexOf('\n', identityAt);
+  const identityLine = evidence.slice(lineStart, lineEnd < 0 ? undefined : lineEnd);
+  let nearest: { distance: number; timestamp: number } | null = null;
+  for (const match of identityLine.matchAll(EVIDENCE_ISO_TIMESTAMP)) {
+    const timestamp = Date.parse(match[0]);
+    if (!Number.isFinite(timestamp)) continue;
+    const distance = Math.abs((match.index ?? 0) - (identityAt - lineStart));
+    if (!nearest || distance < nearest.distance) nearest = { distance, timestamp };
+  }
+  return nearest?.timestamp ?? null;
+}
+
 export function collectChecklistEvidenceStages(item: ReturnType<typeof listChecklist>['items'][number], run: ChecklistEvidenceCommandRunner = evidenceCommand): ChecklistEvidenceStage[] {
   const measuredAt = new Date().toISOString();
   const evidence = item.evidence ?? '';
@@ -135,22 +155,30 @@ export function collectChecklistEvidenceStages(item: ReturnType<typeof listCheck
   const verificationCommand = /(?:완료 경계 증거 명령|증거 명령|verification command)\s*[:=]\s*([^\r\n]+)/iu.exec(`${item.title}\n${evidence}`)?.[1]?.trim() ?? null;
   const e4: ChecklistEvidenceStage = { id: 'E4', state: 'missing', source: null, measuredAt, verificationCommand, reason: '근거에 runId·missionId·taskId 중 하나와 event·원문 검증 명령이 모두 필요하다' };
   if (runId && event && verificationCommand) {
-    const logs = run('eln', ['logs', '--grep', runId, '--since', '365d', '--all', '--include-test', '--limit', '1000', '--json'], 30_000);
-    if (logs.status !== 0) { e4.state = 'unmeasurable'; e4.reason = `runId 로그 조회 실패${logs.error ? `: ${logs.error}` : ''}`; }
-    else {
-      const rows = logs.stdout.split(/\r?\n/u).flatMap((line) => { try { return [JSON.parse(line) as Record<string, unknown>]; } catch { return []; } });
-      const truncated = rows.length >= 1000 || rows.some((row) => row._meta && typeof row._meta === 'object' && (row._meta as { limitReached?: unknown }).limitReached === true);
-      const observed = rows.some((row) => {
-        if (row.event !== event || typeof row.data !== 'string') return false;
-        try {
-          const data = JSON.parse(row.data) as { runId?: unknown; missionId?: unknown; taskId?: unknown };
-          return data[identityField] === runId;
-        } catch { return false; }
-      });
-      e4.source = `eln logs --grep ${runId} --since 365d --all --include-test --limit 1000 --json (${identityField}=${runId}, event=${event})`;
-      if (observed) { e4.state = 'observed'; e4.reason = `같은 ${identityField}의 ${event} 실물 이벤트를 찾았다`; }
-      else if (truncated) { e4.state = 'unmeasurable'; e4.reason = '로그 결과가 잘려 사건 부재를 판정할 수 없다'; }
-      else { e4.reason = `같은 ${identityField}의 ${event} 이벤트가 없다`; }
+    const identityAt = evidenceTimestampNearIdentity(evidence, runId);
+    if (identityAt === null) {
+      e4.state = 'unmeasurable';
+      e4.reason = `근거의 ${identityField}=${runId} 주변에 시간대가 명시된 ISO 시각이 없어 로그 조회 창을 만들 수 없다`;
+    } else {
+      const since = new Date(identityAt - E4_LOG_WINDOW_MS).toISOString();
+      const until = new Date(identityAt + E4_LOG_WINDOW_MS).toISOString();
+      const logs = run('eln', ['logs', '--event', event, '--since', since, '--until', until, '--all', '--include-test', '--limit', '1000', '--json'], 30_000);
+      if (logs.status !== 0) { e4.state = 'unmeasurable'; e4.reason = `runId 로그 조회 실패${logs.error ? `: ${logs.error}` : ''}`; }
+      else {
+        const rows = logs.stdout.split(/\r?\n/u).flatMap((line) => { try { return [JSON.parse(line) as Record<string, unknown>]; } catch { return []; } });
+        const truncated = rows.length >= 1000 || rows.some((row) => row._meta && typeof row._meta === 'object' && (row._meta as { limitReached?: unknown }).limitReached === true);
+        const observed = rows.some((row) => {
+          if (row.event !== event || typeof row.data !== 'string') return false;
+          try {
+            const data = JSON.parse(row.data) as { runId?: unknown; missionId?: unknown; taskId?: unknown };
+            return data[identityField] === runId;
+          } catch { return false; }
+        });
+        e4.source = `eln logs --event ${event} --since ${since} --until ${until} --all --include-test --limit 1000 --json (${identityField}=${runId})`;
+        if (observed) { e4.state = 'observed'; e4.reason = `같은 ${identityField}의 ${event} 실물 이벤트를 찾았다`; }
+        else if (truncated) { e4.state = 'unmeasurable'; e4.reason = '로그 결과가 잘려 사건 부재를 판정할 수 없다'; }
+        else { e4.reason = `같은 ${identityField}의 ${event} 이벤트가 없다`; }
+      }
     }
   }
 

package/src/cli/release-cli.ts

@@ -52,7 +52,7 @@ import type { PrereleaseKind } from '../../scripts/release-loop/release-version.
 import { releaseReadiness } from '../../scripts/release-loop/release-readiness.js';
 import { runReleaseIfReady } from './release-run-if-ready.js';
 import { ReleaseRunClaimConflict, findActiveReleaseRun, readActiveForceReleaseRun, isPidAlive, readReleaseRunLock, withDirectReleaseRunLock, withForceReleaseRunMarker } from './release-single-flight.js';
-import { formatPreflight, releasePreflight } from '../../scripts/release-loop/preflight.js';
+import { formatCountdown, formatPreflight, releasePreflight, runReleaseCountdown } from '../../scripts/release-loop/preflight.js';
 import { defaultReleaseGraphRunsRoot, formatPublishProposal, measurePublishWindow, proposePublishAt, publishWindowWarning } from '../../scripts/release-loop/publish-window.js';
 import { autoStartScheduledRelease, type AutoStartDeferral } from '../release-loop/auto-start.js';
 import { runRehearsalTick, type RehearsalDeps } from '../release-loop/rehearsal.js';
@@ -62,6 +62,7 @@ import { formatLightRc, runLightRc, type LightRcDeps } from '../release-loop/lig
 import { applyWatchList, formatGateHistory, gateHistory, ghMergedPrs } from '../../scripts/release-loop/gate-history.js';
 import { registerRfcCommands } from './rfc-cli.js';
 import { checklistCodenames, checklistVersion, isReleaseVersion, readChecklistContext, registerChecklistReadCommands, type ChecklistEvidenceReader } from './release-checklist-read-cli.js';
+import { syncLinearProgress } from '../decisions/linear-progress-sync.js';
 
 export { isReleaseVersion } from './release-checklist-read-cli.js';
 
@@ -814,6 +815,16 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
       console.log(`칸 ${rows.length} · 🟢 ${byStatus.green} · 🟡 ${byStatus.yellow} · 🔴 ${byStatus.red} · ✅ ${byStatus.done}`);
     });
   registerChecklistReadCommands(checklist, checklistEvidenceReader);
+  withContext(checklist.command('progress-sync').description('Linear 일일 진행 요약 계획 · --live 에서만 댓글 발송'))
+    .option('--live', '요약을 Linear 에 댓글로 발송(판별 뒤에만 사용)')
+    .action(async (opts: { live?: boolean }, cmd: Command) => {
+      const { version, json } = context(cmd);
+      if (!version) throw new CliUserError('조회할 판을 지정하라', '--version <v>');
+      const result = await syncLinearProgress({ version, live: opts.live === true });
+      if (json) { await writeStdoutJson(`${JSON.stringify(result)}\n`); return; }
+      console.log(`Linear 진행 요약 ${result.day} · 계획 ${result.planned} · 발송 ${result.posted} · 중복 건너뜀 ${result.skipped} · 실패 ${result.failed}`);
+      for (const row of result.plan) console.log(`· ${row.issue} ${row.action}: ${row.body.split('\n').slice(0, 4).join(' / ')}`);
+    });
   withContext(checklist.command('landed-but-yellow').description('병합 PR 이 있지만 노랑·빨강인 칸(기본 읽기 전용)'))
     .option('--owner <owner>', '자리 또는 하위 자리로 거르기')
     .option('--open', '미발행 일정 판 중 칸이 있는 판 전부')
@@ -1261,12 +1272,21 @@ export function registerReleaseCommands(program: Command, releaseRunDeps: Unatte
     .option('--json', '결과 한 줄 JSON(stdout) · 사람 줄은 stderr')
     .action(async (o: { version: string; cutCommit?: string; mainCut?: boolean; prerelease?: string; dryRun?: boolean; ifReady?: boolean; publishAt?: string; forceFreeze?: boolean; forceNew?: boolean; gateExecutor?: string; gateHost?: string; json?: boolean }) => { await runAction(o); });
   release.command('preflight')
-    .description('컷 전 사전 점검(읽기 전용) — 체크리스트·런 입력·동결·일정 + 컷 − 60분 origin/main export(자동 예약 없음). ⛔ 있으면 exit 1')
+    .description('컷 전 사전 점검(기본 읽기 전용) — --countdown 은 단계 판정 모델만 표시하고 컷을 실행하지 않는다. --allow-side-effects 를 명시해야 실패 우편·원장을 기록한다.')
     .requiredOption('--version <v>', '점검할 판(x.y.z)')
     .option('--publish-at <iso>', '계획 발행 시각(기본: 컷 뒤 첫 07·18시 KST)')
+    .option('--countdown', '발사 카운트다운 — T−120 노트·export·게이트 모의 → T−60 컷 트리 고정⊕node-b 자리 → T−30 gate 모드 → T0 컷 · 기본 dry-run')
+    .option('--allow-side-effects', '카운트다운 실패 때 담당 자리 우편·부적합 보고 원장 기록 허용(명시적 opt-in)')
     .option('--json', '결과 한 줄 JSON(stdout)')
-    .action(async (o: { version: string; publishAt?: string; json?: boolean }) => {
+    .action(async (o: { version: string; publishAt?: string; countdown?: boolean; allowSideEffects?: boolean; json?: boolean }) => {
       try {
+        if (o.countdown) {
+          const countdown = await runReleaseCountdown(o.version, { publishAt: o.publishAt, releaseRunDeps, allowSideEffects: o.allowSideEffects });
+          if (o.json) await writeStdoutJson(`${JSON.stringify(countdown)}\n`);
+          else for (const line of formatCountdown(countdown)) console.log(line);
+          if (countdown.verdict === 'block') process.exitCode = 1;
+          return;
+        }
         const result = await releasePreflight(o.version, { publishAt: o.publishAt, releaseRunDeps });
         if (o.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
         else for (const line of formatPreflight(result)) console.log(line);

package/src/cli/research-cli.ts

@@ -9,6 +9,7 @@ export interface ResearchCliDeps {
   readonly availableEngines?: () => string[];
   readonly maxDetailOn?: (runId?: string) => boolean;
   readonly log?: typeof debug.log;
+  readonly registerLogSink?: (surface: string) => Promise<unknown>;
 }
 
 export function registerResearchCommand(program: Command, deps: ResearchCliDeps = {}): void {
@@ -31,6 +32,14 @@ export function registerResearchCommand(program: Command, deps: ResearchCliDeps
         return;
       }
 
+      // 독립 CLI 프로세스는 데몬의 StoreSink 를 상속하지 않는다. Sink 등록이 없으면
+      // debug.log 이벤트가 파일 trail 에만 남아 `eln logs` 에서 관측되지 않는다.
+      try {
+        const register = deps.registerLogSink
+          ?? (async (surface: string) => (await import('../domains/standalone-log-sink.js')).registerStandaloneLogSink(surface));
+        await register('research');
+      } catch { /* fail-open: logging must not prevent research */ }
+
       const log = deps.log ?? ((category: string, event: string, data?: unknown) => debug.log(category, event, data));
       const maxDetailOn = deps.maxDetailOn ?? isLiveDetailOn;
       const runId = process.env.ELANOUS_RUN_ID?.trim() || undefined;