elanous 0.2.43 → 0.2.44

package/scripts/release-loop/preflight.ts

@@ -16,11 +16,13 @@ import { effectiveInstanceRoot } from '../../src/instance/resolve.js';
 import { debug } from '../../src/debug/log.js';
 import { releaseReadiness } from './release-readiness.js';
 import { latestPublishedPreviousVersion, runUnattendedRelease, type UnattendedReleaseDeps } from './unattended-release.js';
-import { loadExportConfig, run as runPublicExport, selectExportFiles } from '../public-export.js';
+import { gitIgnoredExportFiles, loadExportConfig, run as runPublicExport, selectExportFiles } from '../public-export.js';
 import { SPAWN_SYNC_MAX_BUFFER } from '../../src/util/spawn-sync-output.js';
+import { NODE_REGISTRY, parsePodPool } from '../../src/task-orchestrator/surfaces/pod-pool.js';
 
 export type PreflightLevel = 'ok' | 'warn' | 'block';
-export type PreflightCheck = 'checklist' | 'postpub' | 'run-input' | 'freeze' | 'schedule' | 'export' | 'notes' | 'cut-tree' | 'gate-slot' | 'release-notes';
+export type PreflightCheck = 'checklist' | 'postpub' | 'run-input' | 'freeze' | 'schedule' | 'export' | 'notes' | 'cut-tree' | 'gate-slot' | 'release-notes'
+  | 'cutoff-notes' | 'gitignored-export' | 'pwa-build' | 'gate-image';
 export interface PreflightFinding { level: PreflightLevel; check: PreflightCheck; id?: string; message: string; suggestion?: string }
 export interface GateMeasure { version: string; runId: string; gateSeconds: number; toPublishSeconds?: number }
 const compareStable = (a: string, b: string) => { const x = a.split('.').map(Number), y = b.split('.').map(Number); return x[0]! - y[0]! || x[1]! - y[1]! || x[2]! - y[2]!; };
@@ -33,6 +35,7 @@ export interface PreflightResult {
   findings: PreflightFinding[];
   schedule: { cutAt: string; landBy: string | null; publishAt: string | null; publishAtSource: 'option' | 'schedule' | 'cadence' | null; exportCheckAt: string } | null;
   exportCheck: { mainSha: string; files: number; leaks: number; codeLiterals: number } | null;
+  cutoffExportCheck: { commit: string; gitIgnoredLeaks: number | null; error?: string } | null;
   /** Read-only T−120 evidence. It describes checks only; it never means a release stage ran. */
   countdownReadiness: {
     status: 'green' | 'red' | 'unmeasured';
@@ -128,6 +131,12 @@ export interface PreflightDeps {
   previousVersion?: string;
   /** Injectable for deterministic preflight tests. Production pins origin/main and scans a disposable checkout. */
   exportCheck?: () => Promise<{ mainSha: string; files: number; leaks: number; codeLiterals: number }>;
+  /** Release cut −60: build the pinned candidate PWA from a disposable checkout. */
+  pwaBuildCheck?: (commit: string) => Promise<{ ok: boolean; detail: string; commit?: string }>;
+  /** Release cut −60: count export-gitignored hits against the exact cutoff tree. */
+  gitIgnoredExportCheck?: (commit: string) => Promise<number | null>;
+  /** Release cut −60: prove the candidate's immutable commit tag exists in at least one configured gate pool. */
+  gateImageTagCheck?: (commit: string, poolSpec: string) => { checked: boolean; pools: string[]; detail?: string };
   /** Countdown T−120/T−60/T0: the cut manifest `cutoff.ts` pinned (default `<instance>/release/<v>/manifest.json`). */
   manifest?: (version: string) => CountdownManifest | null;
   /** Countdown T−60: the «node-b» gate-slot record (default `<instance>/release/<v>/gate-slot.json`). */
@@ -148,6 +157,14 @@ function runGit(cwd: string, args: string[]): string {
   return (result.stdout ?? '').trim();
 }
 
+/** Avoid partial-clone promisor remotes turning a missing fixture/cut SHA into an implicit network fetch. */
+function hasLocalCommit(repoRoot: string, commit: string): boolean {
+  const result = spawnSync('git', ['cat-file', '-e', `${commit}^{commit}`], {
+    cwd: repoRoot, env: { ...process.env, GIT_NO_LAZY_FETCH: '1' }, encoding: 'utf8', timeout: 5_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER,
+  });
+  return result.status === 0;
+}
+
 /** Read-only main snapshot: all checkout and cleanup writes are contained in a disposable temp directory. */
 export async function scanOriginMainExport(): Promise<{ mainSha: string; files: number; leaks: number; codeLiterals: number }> {
   const repoRoot = runGit(process.cwd(), ['rev-parse', '--show-toplevel']);
@@ -225,6 +242,100 @@ export async function scanReleaseNotesAddedLines(previousVersion: string | undef
   return added;
 }
 
+/** Count files selected by the cutoff commit's public-export manifest that its own .gitignore would hide. */
+export async function scanGitIgnoredExportAtCommit(commit: string): Promise<number | null> {
+  if (!/^[0-9a-f]{40}$/i.test(commit)) return null;
+  const repoRoot = runGit(process.cwd(), ['rev-parse', '--show-toplevel']);
+  if (!hasLocalCommit(repoRoot, commit)) return null;
+  const temp = mkdtempSync(join(tmpdir(), 'release-preflight-gitignored-'));
+  const snapshot = join(temp, 'checkout');
+  try {
+    runGit(temp, ['clone', '--shared', '--no-checkout', '--quiet', repoRoot, snapshot]);
+    runGit(snapshot, ['read-tree', commit]);
+    runGit(snapshot, ['checkout-index', '--all', '--force']);
+    const tracked = runGit(snapshot, ['ls-files', '-z']).split('\0').filter(Boolean);
+    const config = loadExportConfig(snapshot);
+    return gitIgnoredExportFiles(snapshot, selectExportFiles(tracked, config)).length;
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+/** Build the PWA from an exact candidate commit in a disposable snapshot; never build the caller's dirty tree. */
+export async function scanPwaBuildAtCommit(commit: string): Promise<{ ok: boolean; detail: string; commit: string }> {
+  if (!/^[0-9a-f]{40}$/i.test(commit)) return { ok: false, detail: `candidate commit is not pinned: ${commit || '(missing)'}`, commit };
+  const repoRoot = runGit(process.cwd(), ['rev-parse', '--show-toplevel']);
+  if (!hasLocalCommit(repoRoot, commit)) return { ok: false, detail: `candidate commit is unavailable locally: ${commit}`, commit };
+  const temp = mkdtempSync(join(tmpdir(), 'release-preflight-pwa-'));
+  const snapshot = join(temp, 'checkout');
+  const run = (cmd: string, args: string[], cwd: string, timeout = 60_000) => spawnSync(cmd, args, {
+    cwd, encoding: 'utf8', timeout, maxBuffer: SPAWN_SYNC_MAX_BUFFER,
+  });
+  const failureDetail = (result: ReturnType<typeof run>): string =>
+    (result.stderr || result.stdout || (result.error instanceof Error ? result.error.message : '') || `exit ${result.status}`).trim();
+  try {
+    const clone = run('git', ['clone', '--shared', '--no-checkout', '--quiet', repoRoot, snapshot], temp);
+    if (clone.status !== 0) return { ok: false, detail: `candidate checkout failed: ${failureDetail(clone)}`, commit };
+    const tree = run('git', ['read-tree', commit], snapshot);
+    if (tree.status !== 0) return { ok: false, detail: `candidate tree unavailable: ${failureDetail(tree)}`, commit };
+    const checkout = run('git', ['checkout-index', '--all', '--force'], snapshot);
+    if (checkout.status !== 0) return { ok: false, detail: `candidate files unavailable: ${failureDetail(checkout)}`, commit };
+    const rootInstall = run('bun', ['install', '--frozen-lockfile'], snapshot, 300_000);
+    if (rootInstall.status !== 0) return { ok: false, detail: `candidate dependency install failed: ${failureDetail(rootInstall).slice(-500)}`, commit };
+    const pwaInstall = run('bun', ['install', '--frozen-lockfile'], join(snapshot, 'apps/pwa'), 300_000);
+    if (pwaInstall.status !== 0) return { ok: false, detail: `PWA dependency install failed: ${failureDetail(pwaInstall).slice(-500)}`, commit };
+    const build = run('bun', ['bin/elanous.mjs', 'nexus', 'build'], snapshot, 15 * 60_000);
+    const detail = (build.status === 0 ? build.stdout : failureDetail(build)).trim().slice(-800);
+    // The snapshot was checked out at `commit`; echo that pin so injected evidence still has to match it.
+    return { ok: build.status === 0 && !build.error, detail: detail || `nexus build exit ${build.status}`, commit };
+  } catch (error) {
+    return { ok: false, detail: error instanceof Error ? error.message : String(error), commit };
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
+  }
+}
+
+/** Read pool tags with a bounded SSH timeout; local pools use the image's immutable commit label. */
+export function scanGateImageTag(commit: string, poolSpec: string): { checked: boolean; pools: string[]; detail?: string } {
+  if (!/^[0-9a-f]{40}$/i.test(commit)) return { checked: false, pools: [], detail: 'cutoff commit is not pinned' };
+  try {
+    const members = parsePodPool(poolSpec);
+    if (!members.length) return { checked: false, pools: [], detail: 'gate pool is empty' };
+    const pools: string[] = [];
+    const errors: string[] = [];
+    for (const member of members) {
+      if (!member.sshHost) {
+        const local = spawnSync('docker', ['image', 'inspect', 'elanous-harness:local', '--format', '{{index .Config.Labels "elanous.commit"}}'], { encoding: 'utf8', timeout: 10_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+        if (local.status === 0 && local.stdout.trim() === commit) pools.push(member.context);
+        else if (local.error || local.status === null) errors.push(`${member.context}: ${local.error?.message ?? 'docker inspection unavailable'}`);
+        continue;
+      }
+      const registry = member.registry ?? NODE_REGISTRY;
+      const portMatch = /:(\d+)$/.exec(registry);
+      if (!portMatch) {
+        errors.push(`${member.context}: registry port is missing (${registry})`);
+        continue;
+      }
+      // Remote registry tags use the 12-character prefix per pod-pool.ts; local elanous.commit labels are full SHAs.
+      const port = portMatch[1]!;
+      const image = 'elanous-harness';
+      const remote = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', member.sshHost,
+        `curl -fsS --max-time 5 http://localhost:${port}/v2/${image}/tags/list 2>/dev/null`], { encoding: 'utf8', timeout: 12_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+      if (remote.status !== 0) {
+        errors.push(`${member.context}: registry query failed${remote.error ? ` (${remote.error.message})` : ` (rc=${remote.status})`}`);
+        continue;
+      }
+      try {
+        const tags = (JSON.parse(remote.stdout) as { tags?: string[] }).tags ?? [];
+        if (tags.includes(commit.slice(0, 12))) pools.push(member.context);
+      } catch { errors.push(`${member.context}: registry tag response was not valid JSON`); }
+    }
+    return { checked: errors.length === 0, pools, ...(errors.length ? { detail: errors.join('; ') } : {}) };
+  } catch (error) {
+    return { checked: false, pools: [], detail: error instanceof Error ? error.message : String(error) };
+  }
+}
+
 const POSTPUB_ID = /^POSTPUB-/i;
 // Only a title that «starts» with the marker: a pre-publish cell often mentions «발행 뒤» in its body (a slot, a plan).
 const POSTPUB_TITLE = /^[«"'(]?\s*(발행\s*(뒤|후)|post-?publish)/i;
@@ -343,6 +454,9 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
   // Always the stored cut (before or after it): the preflight simulates «the cut», not the moment it is run.
   const judgeAt = schedule ? new Date(Date.parse(schedule.cutAt)) : now;
   const data = listChecklist(version);
+  const cutoffManifest = deps.countdown
+    ? (deps.manifest ?? ((v: string) => readReleaseJson<CountdownManifest>(v, 'manifest.json')))(version)
+    : null;
   const { autoMoved, ...gate } = cutChecklistGate(version, schedule?.landBy, judgeAt);
   const p0 = data.items.filter((item) => item.status === 'yellow' && item.priority === 'P0').map((item) => item.id);
   const byId = new Map(data.items.map((item) => [item.id, item]));
@@ -387,7 +501,8 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
 
   // 3a. Public export leakage is measured against one pinned origin/main commit, never this possibly dirty branch.
   try {
-    exportCheck = await (deps.exportCheck ?? scanOriginMainExport)();
+    const scanned = await (deps.exportCheck ?? scanOriginMainExport)();
+    exportCheck = scanned;
     findings.push(exportCheck.leaks
       ? { level: 'block', check: 'export', message: `origin/main ${exportCheck.mainSha.slice(0, 12)} 공개 export 누수 ${exportCheck.leaks}건 · ${exportCheck.files} 파일 검사` }
       : { level: 'ok', check: 'export', message: `origin/main ${exportCheck.mainSha.slice(0, 12)} 공개 export 누수 0건 · ${exportCheck.files} 파일 검사` });
@@ -398,25 +513,90 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
 
   // 3. The same input check `release run --dry-run` makes.
   let runPrevious: string | undefined;
+  let gatePodPool: string | undefined;
   try {
     const result = await (deps.runInput ?? ((v: string) => runUnattendedRelease({ version: v, dryRun: true }, deps.releaseRunDeps ?? {})))(version);
     const input = result.input as { previousVersion?: string; gatePodPool?: string };
     runPrevious = input.previousVersion;
+    gatePodPool = input.gatePodPool;
     findings.push({ level: 'ok', check: 'run-input', message: `release run --dry-run 입력 OK — 직전 판 ${input.previousVersion ?? '-'} · 게이트 풀 ${input.gatePodPool ?? '-'}` });
   } catch (error) {
     findings.push({ level: 'block', check: 'run-input', message: `release run --dry-run 입력 오류 — ${error instanceof Error ? error.message : String(error)}` });
   }
 
   let notesAddedLines: number | null = null;
+  let cutoffExportCheck: PreflightResult['cutoffExportCheck'] = null;
+  const manifestNotesEmpty = cutoffManifest?.escalate?.some((item) => item.kind === 'notes-empty') === true;
+  const fragments = cutoffManifest?.fragments;
+  const manifestNoteSummary = fragments
+    && [fragments.byPr, fragments.byNextMd, fragments.unlinked, fragments.unknown].every(Number.isFinite)
+    ? `PR ${fragments.byPr} · next.md ${fragments.byNextMd} · unlinked ${fragments.unlinked} · unknown ${fragments.unknown}`
+    : null;
   if (deps.countdown) {
     try {
       notesAddedLines = await (deps.releaseNotesCheck ?? scanReleaseNotesAddedLines)(runPrevious, exportCheck?.mainSha);
       findings.push(notesAddedLines > 0
-        ? { level: 'ok', check: 'release-notes', message: `직전 발행 ${runPrevious} 이후 고정 main의 release/next.md 추가 ${notesAddedLines}줄` }
+        ? { level: 'ok', check: 'release-notes', message: `직전 발행 ${runPrevious ?? '-'} 이후 고정 main의 release/next.md 추가 ${notesAddedLines}줄` }
         : { level: 'block', check: 'release-notes', message: `직전 발행 ${runPrevious ?? '-'} 이후 고정 main의 release/next.md 추가 줄이 없다` });
     } catch (error) {
-      findings.push({ level: 'warn', check: 'release-notes', message: `release/next.md 변경을 측정하지 못했다 — ${error instanceof Error ? error.message : String(error)}` });
+      const message = error instanceof Error ? error.message : String(error);
+      findings.push({ level: 'warn', check: 'release-notes', message: `release/next.md 변경을 측정하지 못했다 — ${message}` });
+    }
+
+    const candidateCommit = cutoffManifest?.cutoff?.sha ?? '';
+    // cutoff.ts already classifies all public note sources (PR fragments and next.md lines) and emits
+    // notes-empty only when the manifest contains no user-visible feat/fix/security line.
+    const notesEmpty = manifestNotesEmpty;
+    const notesDetail = notesEmpty
+      ? 'notes-empty — 컷 manifest가 공개용 feat/fix/security 노트가 없다고 판정했다'
+      : `컷 manifest 노트 분류: ${manifestNoteSummary ?? '확인 불가'}`;
+    const emptyManifestNotes = fragments !== undefined
+      && fragments.byPr === 0 && fragments.byNextMd === 0 && fragments.unlinked === 0 && fragments.unknown === 0;
+    const cutoffNotesMissing = !candidateCommit || manifestNoteSummary === null || notesEmpty || emptyManifestNotes;
+    findings.push({
+      level: cutoffNotesMissing ? 'block' : 'ok', check: 'cutoff-notes',
+      message: notesDetail,
+      ...(cutoffNotesMissing ? { suggestion: 'cutoff manifest를 만들고 고정 후보 트리의 release/next.md 에 사용자용 feat/fix 줄을 더한 뒤 다시 검사한다' } : {}),
+    });
+
+    let ignoredLeaks: number | null = null;
+    let ignoredLeaksError: string | undefined;
+    try { ignoredLeaks = await (deps.gitIgnoredExportCheck ?? scanGitIgnoredExportAtCommit)(candidateCommit); }
+    catch (error) {
+      ignoredLeaks = null;
+      ignoredLeaksError = error instanceof Error ? error.message : String(error);
+    }
+    cutoffExportCheck = { commit: candidateCommit, gitIgnoredLeaks: ignoredLeaks, ...(ignoredLeaksError ? { error: ignoredLeaksError } : {}) };
+    findings.push(ignoredLeaks === 0
+      ? { level: 'ok', check: 'gitignored-export', message: `컷 후보 ${candidateCommit.slice(0, 12) || '(SHA 없음)'} public-export export-gitignored 0건` }
+      : { level: 'block', check: 'gitignored-export', message: ignoredLeaks === null || ignoredLeaks === undefined
+        ? `컷 후보 ${candidateCommit.slice(0, 12) || '(SHA 없음)'} public-export export-gitignored 결과를 확인하지 못했다${ignoredLeaksError ? ` — ${ignoredLeaksError}` : ''}`
+        : `컷 후보 ${candidateCommit.slice(0, 12) || '(SHA 없음)'} public-export export-gitignored ${ignoredLeaks}건`,
+        suggestion: '공개 export 입력 중 .gitignore 에 걸리는 파일을 제거하거나 공개 정책을 고치고 검사를 다시 실행한다' });
+
+    let pwa: { ok: boolean; detail: string; commit?: string };
+    try {
+      pwa = await (deps.pwaBuildCheck ?? scanPwaBuildAtCommit)(candidateCommit);
+      const pwaOk = pwa.ok && pwa.commit === candidateCommit;
+      findings.push(pwaOk
+        ? { level: 'ok', check: 'pwa-build', message: `PWA 빌드 통과 · ${candidateCommit.slice(0, 12)}` }
+      : { level: 'block', check: 'pwa-build', message: `PWA 빌드 실패 또는 SHA 불일치(${pwa.commit ?? '미기록'} ≠ ${candidateCommit}) · ${pwa.detail}`,
+          suggestion: `고정 후보 ${candidateCommit.slice(0, 12) || '(SHA 없음)'}에서 apps/pwa 빌드를 통과시킨다` });
+    } catch (error) {
+      pwa = { ok: false, detail: error instanceof Error ? error.message : String(error) };
+      findings.push({ level: 'block', check: 'pwa-build', message: `PWA 빌드 증거를 확인하지 못했다 · ${pwa.detail}`,
+        suggestion: `고정 후보 ${candidateCommit.slice(0, 12) || '(SHA 없음)'}에서 apps/pwa 빌드를 통과시킨다` });
     }
+
+    const imageCheck = gatePodPool
+      ? (deps.gateImageTagCheck ?? scanGateImageTag)(candidateCommit, gatePodPool)
+      : { checked: false, pools: [], detail: 'release run 입력에서 gatePodPool을 얻지 못했다' };
+    findings.push(imageCheck.checked && imageCheck.pools.length > 0
+      ? { level: 'ok', check: 'gate-image', message: `컷 후보 gate 이미지 태그 ${candidateCommit.slice(0, 12)} 확인 · 풀 ${imageCheck.pools.join(', ')}` }
+      : { level: 'block', check: 'gate-image', message: imageCheck.checked
+        ? `컷 후보 gate 이미지 태그 ${candidateCommit.slice(0, 12) || '(SHA 없음)'}가 어느 풀에도 없다`
+        : `컷 후보 gate 이미지 태그를 확인하지 못했다 · ${imageCheck.detail ?? '원인 미상'}`,
+        suggestion: `컷 후보 ${candidateCommit.slice(0, 12) || '(SHA 없음)'}의 gate 이미지를 하나 이상의 풀에 빌드·반입한 뒤 preflight 를 다시 실행한다` });
   }
 
   // 4. Landing freeze (emergency switch since RELEASE-BRANCH): when on, `release run` refuses.
@@ -488,7 +668,7 @@ export async function releasePreflight(version: string, deps: PreflightDeps = {}
   const blockers = findings.filter((f) => f.level === 'block').length;
   const warnings = findings.filter((f) => f.level === 'warn').length;
   debug.log('release.preflight', 'checked', { version, blockers, warnings });
-  return { version, next, verdict: blockers ? 'block' : warnings ? 'warn' : 'ok', blockers, warnings, findings, schedule: scheduleOut, exportCheck, countdownReadiness, previousVersion, gateMeasure, fallbackGateMeasure };
+  return { version, next, verdict: blockers ? 'block' : warnings ? 'warn' : 'ok', blockers, warnings, findings, schedule: scheduleOut, exportCheck, cutoffExportCheck, countdownReadiness, previousVersion, gateMeasure, fallbackGateMeasure };
 }
 
 const ICON: Record<PreflightLevel, string> = { ok: '✅', warn: '⚠️', block: '⛔' };
@@ -507,13 +687,13 @@ const COUNTDOWN_OFFSET_MINUTES: Record<CountdownStage, number> = { 'T-120': 120,
 /** Which existing finding group each stage judges — the check vocabulary of `releasePreflight`, not a new rule set. */
 const COUNTDOWN_CHECKS: Record<CountdownStage, PreflightCheck[]> = {
   'T-120': ['checklist', 'postpub', 'notes', 'release-notes', 'export'],
-  'T-60': ['run-input', 'freeze', 'cut-tree', 'gate-slot'],
+  'T-60': ['run-input', 'freeze', 'cut-tree', 'gate-slot', 'cutoff-notes', 'gitignored-export', 'pwa-build', 'gate-image'],
   'T-30': ['schedule'],
   T0: [],
 };
 const COUNTDOWN_LABELS: Record<CountdownStage, string> = {
   'T-120': '노트(next.md 새 줄) · 공개 export 누수 · 체크리스트 게이트 모의',
-  'T-60': 'preflight(컷 트리 고정) ⊕ node-b 게이트 자리(디스패처 정지 · podTarget 감축)',
+  'T-60': '컷 후보 P0 네 항목(노트 · gitignore export · PWA · gate 이미지) ⊕ node-b 게이트 자리',
   'T-30': 'gate window 준비(컷→발행 창 ≥ 직전 실측 게이트)',
   T0: '컷 트리 확인(실제 컷 실행은 별도)',
 };

package/scripts/release-loop/render-warm-control-manifest.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env bun
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { DEFAULT_CONTROL_PORT } from '../../src/control-plane/server.js';
+
+const args = process.argv.slice(2);
+const imageIndex = args.indexOf('--image');
+const namespaceIndex = args.indexOf('--namespace');
+const image = imageIndex >= 0 ? args[imageIndex + 1] : undefined;
+const namespace = namespaceIndex >= 0 ? args[namespaceIndex + 1] : undefined;
+if (args.length !== 4 || imageIndex < 0 || namespaceIndex < 0 || imageIndex === namespaceIndex
+  || !image || !namespace || !/^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$/.test(namespace)
+  || !/^[a-z0-9][a-z0-9.-]*(?::[0-9]+)?\/[a-zA-Z0-9._/-]+@sha256:[a-f0-9]{64}$/.test(image)) {
+  process.stderr.write('usage: bun scripts/release-loop/render-warm-control-manifest.ts --image <repository@sha256:digest> --namespace <namespace>\n');
+  process.exitCode = 2;
+} else {
+  const template = readFileSync(join(import.meta.dir, '../../docker/warm-control/control.yaml.tmpl'), 'utf8');
+  if (!template.includes('{{CONTROL_IMAGE}}') || !template.includes('{{NAMESPACE}}') || !template.includes('{{CONTROL_PORT}}'))
+    throw new Error('warm control manifest placeholder missing');
+  process.stdout.write(template.replaceAll('{{CONTROL_IMAGE}}', image)
+    .replaceAll('{{NAMESPACE}}', namespace).replaceAll('{{CONTROL_PORT}}', String(DEFAULT_CONTROL_PORT)));
+}

package/scripts/release-loop/resume-release.ts

@@ -17,7 +17,7 @@ import { changedFilesBetween, clearPartialPlan, collectExecutedPodShardImages, p
 import { gateAssignableTestsAtCommit, gateEnvFingerprint } from './gate-baseline-receipt.js';
 import { readGateShardManifest, readGateShardResult } from './gate-shard-receipts.js';
 import { gitClosureTree, testsReachingChanged, TRACEABLE_RELEASE_JSON, type ClosureTree } from './gate-closure.js';
-import { assertReleaseResumeApprovalBoundary, releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeGateShardReroute, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
+import { assertReleaseResumeApprovalBoundary, releaseFanOutForkIndex, releaseResumeAcceptedRegressions, releaseResumeGateExecutor, releaseResumeGatePodPool, releaseResumeGateShardReroute, releaseResumeWaiver, type AcceptedRegression } from './resume.js';
 import { reserveReleaseResumeAttempt } from './resume-cap.js';
 import { cutReleaseBranch } from './cut-branch.js';
 import { releaseLoopConfig } from './unattended-release.js';
@@ -138,8 +138,9 @@ function refreshReleaseBranchTipInternal(runId: string, deps: ResumeReleaseDeps,
   const state = JSON.parse(readFileSync(statePath, 'utf8')) as GraphRunState;
   if (state.graphId !== 'release-loop' || state.runId !== runId) throw new Error(`run identity mismatch: ${statePath}`);
   if (state.status !== 'failed') throw new Error(`release run ${runId} is ${state.status} — only a failed run is resumed`);
-  const restartAt = from === undefined ? -1 : state.path.indexOf(from);
-  if (from !== undefined && (restartAt < 0 || state.path.lastIndexOf(from) !== restartAt)) throw new Error(`--from ${from} is not a node on the saved path of ${runId}`);
+  const branchFork = from === undefined || state.path.includes(from) ? undefined : releaseFanOutForkIndex(state, from);
+  const restartAt = from === undefined ? -1 : state.path.indexOf(from) >= 0 ? state.path.indexOf(from) : branchFork ?? -1;
+  if (from !== undefined && (restartAt < 0 || (branchFork === undefined && state.path.lastIndexOf(from) !== restartAt))) throw new Error(`--from ${from} is not a node on the saved path of ${runId}`);
   const index = state.nodes.findIndex((node) => node.nodeId === 'version-release');
   const record = index >= 0 ? state.nodes[index]! : undefined;
   const output = record ? lastJsonObject(record.output) : undefined;
@@ -490,7 +491,7 @@ function preparePartial(tip: TipRefresh, opts: { from: string; partial?: boolean
       const path = dryRun ? undefined : writeRecheckPlan(root, recheckPlan);
       debug.log('release-loop.resume', 'interference-recheck-planned', { version: tip.version, commit: tip.to,
         remeasureFileCount: recheckPlan.files.length, fallbackReason: null, ...(path ? { path } : {}), dryRun });
-      return { requested: true, applied: true, files: recheckPlan.files.length, priorCommit: tip.to, ...(auto ? { auto: true as const } : {}) };
+      return { requested: true, applied: true, files: recheckPlan.files.length, plannedFiles: recheckPlan.files, priorCommit: tip.to, ...(auto ? { auto: true as const } : {}) };
     }
     const stalled = previousGate?.stalledShards;
     const summary = previousGate?.partialSummary as { pass?: unknown; fail?: unknown; errors?: unknown; ran?: unknown; files?: unknown } | undefined;
@@ -664,7 +665,7 @@ async function planResumeReleaseRunLocked(opts: ResumeReleaseOptions, deps: Resu
     waiverCommit = recorded;
   }
   const tip = refreshReleaseBranchTipInternal(opts.runId, deps, opts.from, waiverCommit, true);
-  const fromIndex = savedRun.path.indexOf(opts.from);
+  const fromIndex = savedRun.path.indexOf(opts.from) >= 0 ? savedRun.path.indexOf(opts.from) : releaseFanOutForkIndex(savedRun, opts.from) ?? -1;
   const gateIndex = savedRun.path.indexOf('gate');
   const gateWillRun = fromIndex >= 0 && gateIndex >= fromIndex;
   if (opts.rerouteShard !== undefined && tip.changed) throw new Error('shard reroute requires the original cut head; moved tip needs a full re-gate');
@@ -929,8 +930,9 @@ async function recoverReleaseRunLocked(opts: RecoverReleaseOptions, deps: Recove
   if (fromNode === 'version-release') {
     throw new Error(`--from version-release would cut again — recover at a later node; ${branch} was not moved`);
   }
-  const restartAt = savedRun.path.indexOf(fromNode);
-  if (restartAt < 0 || savedRun.path.lastIndexOf(fromNode) !== restartAt) {
+  const branchFork = savedRun.path.includes(fromNode) ? undefined : releaseFanOutForkIndex(savedRun, fromNode);
+  const restartAt = savedRun.path.indexOf(fromNode) >= 0 ? savedRun.path.indexOf(fromNode) : branchFork ?? -1;
+  if (restartAt < 0 || (branchFork === undefined && savedRun.path.lastIndexOf(fromNode) !== restartAt)) {
     throw new Error(`--from ${fromNode} is not a node on the saved path of ${opts.runId}; ${branch} was not moved`);
   }
   const consumers = ['export-check', 'gate'].map((node) => savedRun.path.indexOf(node)).filter((index) => index >= 0);

package/scripts/release-loop/resume.ts

@@ -5,13 +5,22 @@ import { checkGateExecutorChoice, type GateExecutor } from './gate-executor.js';
 
 export interface AcceptedRegression { id: string; note: string }
 
+/** Return the saved fork-node index when --from names a failed fan-out branch rather than a parent-path node. */
+export function releaseFanOutForkIndex(state: GraphRunState, branchId: string): number | undefined {
+  const matches = Object.values(state.fanOuts ?? {}).filter((fanout) => fanout.branches[branchId]?.status === 'failed');
+  if (matches.length !== 1) return undefined;
+  const fork = matches[0]!.from;
+  const index = state.path.indexOf(fork);
+  return index >= 0 && state.path.lastIndexOf(fork) === index ? index : undefined;
+}
+
 /** Match the graph runner's approval boundary before release resume performs tip refresh or writes an attempt. */
 export function assertReleaseResumeApprovalBoundary(state: GraphRunState, from: string): void {
   if (!Array.isArray(state.path)) return;
-  const start = state.path.indexOf(from);
-  if (start < 0 || state.path.lastIndexOf(from) !== start) {
-    return;
-  }
+  const pathStart = state.path.indexOf(from);
+  const branchStart = pathStart < 0 ? releaseFanOutForkIndex(state, from) : undefined;
+  const start = pathStart >= 0 ? pathStart : branchStart;
+  if (start === undefined || start < 0 || (pathStart >= 0 && state.path.lastIndexOf(from) !== start)) return;
   for (let index = 0; index < state.nodes.length; index++) {
     const record = state.nodes[index]!;
     if (typeof record.decidedAt !== 'string') continue;

package/scripts/release-loop/warm-control-forward.ts

@@ -0,0 +1,178 @@
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:net';
+import { debug } from '../../src/debug/log.js';
+
+export interface WarmControlForwardOptions {
+  context: string;
+  namespace: string;
+  service: string;
+  remotePort: number;
+  kubectl?: string;
+  startupTimeoutMs?: number;
+}
+
+export interface WarmControlForward {
+  url: string;
+  stop(): Promise<void>;
+}
+
+/** A single-flight startup cache owned by one gate-run lifecycle. A rejected start
+ * is shared by that run's shards, while a later run gets a fresh instance and retries. */
+export function createRunScopedWarmControlForward(start: () => Promise<WarmControlForward>): {
+  ensure(): Promise<WarmControlForward>;
+  stop(): Promise<void>;
+} {
+  let starting: Promise<WarmControlForward> | null = null;
+  return {
+    ensure() {
+      starting ??= start();
+      return starting;
+    },
+    async stop() {
+      const pending = starting;
+      starting = null;
+      const forward = pending ? await pending.catch(() => null) : null;
+      if (forward) await forward.stop();
+    },
+  };
+}
+
+type ForwardExit = { code: number | null; signal: NodeJS.Signals | null };
+
+function exitWithin(exited: Promise<ForwardExit>, timeoutMs: number): Promise<ForwardExit | null> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  return Promise.race([exited, new Promise<null>(resolve => { timer = setTimeout(() => resolve(null), timeoutMs); })])
+    .finally(() => { if (timer) clearTimeout(timer); });
+}
+
+function ephemeralLoopbackPort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address();
+      if (!address || typeof address === 'string') {
+        server.close();
+        reject(new Error('warm control forward could not reserve a loopback port'));
+        return;
+      }
+      server.close(error => error ? reject(error) : resolve(address.port));
+    });
+  });
+}
+
+function cleanKubectlEnv(): NodeJS.ProcessEnv {
+  // Port-forward carries control credentials and task payloads; never route the tunnel through ambient proxies.
+  const env = { ...process.env };
+  for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[key];
+  return env;
+}
+
+/** Start a run-owned, loopback-only tunnel. No remote interface is ever bound. */
+async function startWarmControlPortForwardAt(options: WarmControlForwardOptions, localPort: number): Promise<WarmControlForward> {
+  const child = spawn(options.kubectl ?? 'kubectl', [
+    '--context', options.context, '-n', options.namespace, 'port-forward',
+    '--address', '127.0.0.1', `service/${options.service}`, `${localPort}:${options.remotePort}`,
+  ], { detached: true, stdio: ['ignore', 'pipe', 'pipe'], env: cleanKubectlEnv() });
+  let stdout = '';
+  let stderr = '';
+  let stopRequested = false;
+  let failStartup: ((error: Error) => void) | undefined;
+  const startedAt = Date.now();
+  const stopGroup = (signal: NodeJS.Signals) => {
+    if (child.pid) {
+      try { process.kill(-child.pid, signal); } catch { child.kill(signal); }
+    } else child.kill(signal);
+  };
+  const exited = new Promise<ForwardExit>(resolve => {
+    child.once('close', (code, signal) => resolve({ code, signal }));
+    child.once('error', () => resolve({ code: null, signal: null }));
+  });
+  child.stderr?.on('data', chunk => {
+    stderr = `${stderr}${String(chunk)}`.slice(-8192);
+    if (/address already in use/i.test(stderr)) failStartup?.(new Error('warm control local port was claimed before kubectl bound it'));
+  });
+
+  try {
+    await new Promise<void>((resolve, reject) => {
+      let settled = false;
+      const timer = setTimeout(() => finish(new Error('warm control port-forward startup timed out')), options.startupTimeoutMs ?? 15_000);
+      const ready = (chunk: Buffer | string) => {
+        if (new RegExp(`Forwarding from 127\\.0\\.0\\.1:${localPort} -> ${options.remotePort}`).test(stdout)) finish();
+      };
+      const capture = (chunk: Buffer | string) => { stdout = `${stdout}${String(chunk)}`.slice(-8192); };
+      const finish = (error?: Error) => {
+        if (settled) return;
+        settled = true;
+        failStartup = undefined;
+        clearTimeout(timer);
+        child.stdout?.off('data', ready);
+        if (error) reject(error); else resolve();
+      };
+      failStartup = finish;
+      child.stdout?.on('data', capture);
+      child.stdout?.on('data', ready);
+      void exited.then(({ code, signal }) => finish(new Error(`warm control port-forward exited before ready (code=${code}, signal=${signal})`)));
+      child.once('error', error => finish(error));
+    });
+  } catch (error) {
+    stopRequested = true;
+    if (child.exitCode === null && child.signalCode === null) stopGroup('SIGTERM');
+    let final = await exitWithin(exited, 2_000);
+    if (final === null) {
+      stopGroup('SIGKILL');
+      final = await exitWithin(exited, 2_000);
+    }
+    debug.log('pod.warm.control-forward', 'start-failed', { context: options.context, namespace: options.namespace,
+      service: options.service, localPort, elapsedMs: Date.now() - startedAt,
+      reason: error instanceof Error ? error.message : String(error), stderr: stderr.slice(-1000), orphaned: final === null },
+    { level: final === null ? 'error' : 'warn' });
+    if (final === null) debug.log('pod.warm.control-forward', 'orphan-detected', { context: options.context,
+      namespace: options.namespace, service: options.service, localHost: '127.0.0.1', localPort }, { level: 'error' });
+    throw error;
+  }
+  void exited.then(result => {
+    if (!stopRequested) debug.log('pod.warm.control-forward', 'exited-unexpectedly', {
+      context: options.context, namespace: options.namespace, service: options.service,
+      localHost: '127.0.0.1', localPort, exitCode: result.code, exitSignal: result.signal,
+    }, { level: 'error' });
+  });
+  debug.log('pod.warm.control-forward', 'started', { context: options.context, namespace: options.namespace,
+    service: options.service, localHost: '127.0.0.1', localPort, remotePort: options.remotePort });
+
+  return {
+    url: `http://127.0.0.1:${localPort}/`,
+    async stop() {
+      if (stopRequested) return;
+      stopRequested = true;
+      if (child.exitCode === null && child.signalCode === null) stopGroup('SIGTERM');
+      const result = await exitWithin(exited, 2_000);
+      if (result === null) stopGroup('SIGKILL');
+      const final = result ?? await exitWithin(exited, 2_000);
+      const orphaned = final === null;
+      debug.log('pod.warm.control-forward', orphaned ? 'orphan-detected' : 'stopped', {
+        context: options.context, namespace: options.namespace, service: options.service,
+        localHost: '127.0.0.1', localPort, remotePort: options.remotePort,
+        elapsedMs: Date.now() - startedAt, exitCode: final?.code ?? null, exitSignal: final?.signal ?? null,
+      }, { level: orphaned ? 'error' : 'info' });
+      if (orphaned) throw new Error('warm control port-forward process survived gate cleanup');
+    },
+  };
+}
+
+export async function startWarmControlPortForward(options: WarmControlForwardOptions): Promise<WarmControlForward> {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(options.context)
+    || !/^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$/.test(options.namespace)
+    || !/^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$/.test(options.service)
+    || !Number.isSafeInteger(options.remotePort) || options.remotePort < 1 || options.remotePort > 65535)
+    throw new Error('invalid warm control forward target');
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const localPort = await ephemeralLoopbackPort();
+    try { return await startWarmControlPortForwardAt(options, localPort); }
+    catch (error) {
+      if (attempt === 0 && error instanceof Error && /local port was claimed/i.test(error.message)) continue;
+      throw error;
+    }
+  }
+  throw new Error('warm control port-forward could not claim a loopback port');
+}

package/scripts/retro-cycle.ts

@@ -21,6 +21,11 @@ import { aggregateMissionRetros } from '../src/autopilot/mission-retrospect.js';
 import { recordAutonomousActionSafe } from '../src/domains/autonomy-log.js';
 import { sendOutbound } from '../src/domains/outbound-alert.js';
 import { unknownCronFlag } from '../src/domains/cron-flag-contract.js';
+import { debug } from '../src/debug/log.js';
+import { registerStandaloneLogSink } from '../src/domains/standalone-log-sink.js';
+import { finishRetroCycleRun } from '../src/domains/retro-cycle-observation.js';
+import { readRunExits } from '../src/harness/harness-incidents.js';
+import { doctorVisitIncidentRoot, readDoctorVisits } from '../src/self-implement/doctor-visit.js';
 
 // ⛔⭐ 거부는 «맨 앞»이다 — 이 파일은 모듈 최상위에서 argv 를 읽으므로 그 뒤면 늦다.
 //   ⛔ 그리고 «한 줄»로 낸다 — 최상위 throw 는 스택 트레이스를 흘리고, 크론 로그에서 그것은 잡음이다.
@@ -32,6 +37,10 @@ const pIdx = process.argv.indexOf('--period');
 const period = (pIdx >= 0 ? process.argv[pIdx + 1] : 'weekly') as RetroPeriod;
 if (!['weekly', 'monthly', 'quarterly', 'annual'].includes(period)) { console.error(`잘못된 period: ${period}`); process.exit(1); }
 
+// This scheduled script runs outside the daemon; attach its debug events to
+// this instance's logs.db so the lifecycle observations remain queryable.
+await registerStandaloneLogSink('retro');
+
 const REPORT_DIR = join(homedir(), '.elanous/conatus/reflections');
 const LOG = join(homedir(), '.elanous/conatus/retro_cycle.log');
 const log = (m: string): void => { try { appendFileSync(LOG, `${new Date().toISOString()} ${m}\n`); } catch { /* */ } };
@@ -114,6 +123,14 @@ const report = await runRetroCycle({
   // C3 (2026-07-18) — 미션 회고(C1 안착·C2 피드백) 집계를 주간 리포트에 합류(비파괴 opt-in).
   retro: { backtest: backtestAgg, regime: regimeAgg, surface: surfaceAgg, missions: (from, to) => aggregateMissionRetros(from, to) },
   candidates,
+  featureSignals: () => {
+    const incidents = readRunExits(doctorVisitIncidentRoot())
+      .map((row) => ({ runId: row.runId, symptom: row.reason, at: row.at, source: 'incident' as const }));
+    const visits = readDoctorVisits()
+      .filter((row) => !!row.timestamp)
+      .map((row) => ({ runId: row.runId, symptom: row.symptom, at: row.timestamp!, source: 'doctor-visit' as const }));
+    return [...incidents, ...visits];
+  },
   // LLM 정성 서사(fail-soft) — provider 없으면 정량 base 그대로.
   narrate: narrateRetro,
   writeReport: (filename, md) => {
@@ -127,15 +144,20 @@ const report = await runRetroCycle({
   notify: (t) => { log(`[HITL] ${t.replace(/\n/g, ' ')}`); if (!process.argv.includes('--collect-only')) try { sendOutbound(t, 'ops-alert'); } catch { /* fail-soft */ } },
 }, period);
 
-log(`retro ${period}: report=${report.reportPath} · 제안=${report.hasProposal ? report.proposalId : '없음'}`);
+log(`retro ${period}: report=${report.reportPath} · 리밸런싱=${report.hasProposal ? report.proposalId : '없음'} · 반복 증상 제안=${report.featureProposals.length}`);
 
 // Autopilot P0.2 — 자율행동(회고 루프) 회상 로깅. 리밸런싱 제안은 HITL 승인 대기(자율집행 아님).
-recordAutonomousActionSafe({
-  loop: 'retro',
-  action: `${period} 회고 리포트 발행`,
-  rationale: '기간 성과 집계(백테스트·국면·발송) → 리밸런싱 제안(HITL 승인 대기)',
-  outcome: report.hasProposal ? `리밸런싱 제안 ${report.proposalId}(승인 대기)` : '제안 없음',
-  refs: { reportPath: report.reportPath },
+const runId = finishRetroCycleRun(report, {
+  recordAction: ({ runId: actionRunId, reportPath }) => {
+    recordAutonomousActionSafe({
+      loop: 'retro',
+      action: `${period} 회고 리포트 발행`,
+      rationale: '기간 성과 집계(백테스트·국면·발송) → 리밸런싱 제안(HITL 승인 대기)',
+      outcome: report.hasProposal ? `리밸런싱 제안 ${report.proposalId}(승인 대기)` : '제안 없음',
+      refs: { runId: actionRunId, reportPath },
+    });
+  },
+  log: (category, event, data) => debug.log(category, event, data),
 });
 
-console.log(JSON.stringify(report, null, 2));
+console.log(JSON.stringify({ ...report, runId }, null, 2));