leerness 1.36.160 → 1.36.161

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.36.161 — 2026-08-25
+
+- 전체 E2E가 잡은 ci init의 낡은 v4 기대값을 v7/Node 24 계약으로 갱신했습니다. i18n doctor는 동일 픽스처에서 영문·한국어 각각 139초/exit 0으로 재현 통과해 제품 결함이 아닌 장시간 부하 타임아웃으로 판별했으며, 테스트 상한을 600초로 조정하고 실패 진단을 보강했습니다.
+
+- 외부 Codex 교차 검수에서 확인한 Windows 자식 env npm_execpath 불일치와 ci init 템플릿 v4 잔존을 수정했습니다. release channel/view/pack/publish 성공·실패, CLI 누락 ENOENT, 셸 메타문자 argv 보존을 실제 명령으로 검증하고 CI에 Node 24/26 전용 런타임 매트릭스를 추가했습니다. 이 실제 npm 경로 프로브는 상위 `LEERNESS_OFFLINE=1` 게이트에서도 대소문자가 다른 상속 `NPM_EXECPATH`를 제거하고 로컬 fake CLI를 단일 키로 명시해 네트워크 없이 같은 계약을 검증합니다.
+
+- GitHub Actions의 checkout/setup-node를 Node 24 기반 v7으로 올리고, Windows 릴리스 경로가 npm.cmd 셸 대신 npm-cli.js를 Node로 직접 실행하도록 바꿔 DEP0190과 셸 메타문자 재해석 위험을 제거했습니다. Linux/macOS는 shell:false npm 실행을 유지하며 전용 release-runtime 프로브를 fast/core/full 게이트에 연결했습니다.
+
 ## 1.36.160 — 2026-08-25
 
 - CI 전체 E2E를 Linux/Windows에서 결정화하고, 다중 AI 세션 presence와 상태 쓰기 락을 고유 토큰 owner·heartbeat 가시성·기본 fail-closed로 강화했습니다. fencing 없는 PID/host/mtime 판정으로 기존 owner를 자동 탈취하지 않습니다.

package/README.md

@@ -126,7 +126,7 @@ MIT
 <!-- leerness:project-readme:start -->
 ## Leerness Project Harness
 
-이 프로젝트는 Leerness v1.36.160 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
+이 프로젝트는 Leerness v1.36.161 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
 
 ### 정체성 — AI 에이전트 운영 레이어 (UR-0030)
 
@@ -180,7 +180,7 @@ leerness memory restore decision <date|title>
 
 ### MCP server (외부 AI 통합)
 
-Leerness v1.36.160는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **89개 도구**를 노출:
+Leerness v1.36.161는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **89개 도구**를 노출:
 
 ```jsonc
 // 카테고리별
@@ -201,7 +201,7 @@ Leerness v1.36.160는 stdio JSON-RPC MCP server를 내장합니다 — Claude Co
 `<<autonomous-loop-dynamic>>` 신호만 보내면 AI가:
 1) 다음 라운드 후보 선정 → 2) 코드 변경 → 3) 회귀 테스트 갱신 → 4) 전체 e2e 스위트 통과 → 5) npm publish + git tag → 6) main push → 7) session close → 8) 다음 라운드 예약.
 
-현재 누적: **v1.9.x → 1.36.160 릴리스 태그 이력** (수백 라운드) · _reports/는 비공개 보존.
+현재 누적: **v1.9.x → 1.36.161 릴리스 태그 이력** (수백 라운드) · _reports/는 비공개 보존.
 
 ### 성능 가이드
 
@@ -239,5 +239,5 @@ leerness release pack --close --auto-main-push
 - `.harness/session-handoff.md`: 다음 세션 인수인계 (자동 작성)
 - `.harness/lessons.md` / `decisions.md` / `rules.md`: 영구 메모리 (5 surface)
 
-Last synced by Leerness v1.36.160: 2026-08-25
+Last synced by Leerness v1.36.161: 2026-08-25
 <!-- leerness:project-readme:end -->

package/bin/leerness.js

@@ -5,6 +5,7 @@ const fs = require('fs');
 const path = require('path');
 const cp = require('child_process');
 const { log, ok, warn, fail, failJson, setQuiet, today, now, absRoot, exists, read, readBuf, mkdirp, writeUtf8, append, rel, setDryRunGuard, mkdirpRaw } = require('../lib/io');  // 1.9.382/383 (UR-0025): 출력/시간/파일 프리미티브 공유 모듈 · 1.10.2 (UR-0146): setQuiet
+const { spawnNpmSync } = require('../lib/npm-process');
 const os = require('os');  // 1.9.178: _publishToNpm 에서 os.tmpdir() 사용 (전역 import)
 const readline = require('readline');
 // 1.9.274 (UR-0025 1단계): 순수 유틸 함수 모듈 분리 (require-based, 비파괴). selftest 7종이 동작 검증.
@@ -35,7 +36,7 @@ const { tokenizeForRank: _tokenizeForRank, expandQuery: _expandQuery, scoreHits:
 const { findCorruptedStateJson: _findCorruptedStateJson } = require('../lib/state-integrity');  // 1.36.1 (클린룸 리뷰 FN): .harness/*.json 상태 무결성 (audit/health/check 공유)
 const _cursorHook = require('../lib/cursor-session-hook');
 
-const VERSION = '1.36.160';
+const VERSION = '1.36.161';
 
 // 1.9.290 (UR-0037, Codex gpt-5.5 #4 수렴): CLI 전용 부작용은 require 시 실행하지 않는다.
 //   이전: warning listener 제거 / NODE_OPTIONS 변경 / chcp IIFE 가 top-level 즉시 실행 → require('harness') 시 호스트 프로세스 오염.
@@ -5237,7 +5238,9 @@ function _selfTestCases() {
     { name: 'GPT-5.5 전략리뷰 §6.7 (UR-0152): ci init — PR gate 워크플로 생성 + exit-code 정책 (1.9.444) + 강화(1.33.1 버전핀/권한/concurrency)', run: () => {
       if (typeof ciInitCmd !== 'function') return false;
       const wf = LEERNESS_GATE_WORKFLOW;
-      const contentOk = /name:\s*leerness-gate/.test(wf) && /on:\s*\n\s*pull_request:/.test(wf) && /exit code 정책/.test(wf) && /actions\/checkout@v4/.test(wf);
+      const contentOk = /name:\s*leerness-gate/.test(wf) && /on:\s*\n\s*pull_request:/.test(wf) && /exit code 정책/.test(wf)
+        && /actions\/checkout@v7/.test(wf) && /actions\/setup-node@v7/.test(wf)
+        && /node-version:\s*'24'/.test(wf) && /package-manager-cache:\s*false/.test(wf);
       // 1.33.1 강화: 버전 핀(leerness@x.y.z gate, latest 와 동일) + 최소권한 permissions + concurrency cancel
       const hardened = new RegExp('leerness@' + VERSION.replace(/\./g, '\\.') + ' gate \\.').test(wf)
         && /permissions:\s*\n\s*contents: read/.test(wf)
@@ -22618,7 +22621,7 @@ function releaseChannelCmd(root) {
   const tag = _resolveNpmTag(arg('--npm-tag', null));
   let distTags = null;
   if (!has('--offline') && process.env.LEERNESS_OFFLINE !== '1') {
-    try { const r = cp.spawnSync('npm', ['view', 'leerness', 'dist-tags', '--json'], { encoding: 'utf8', timeout: 10000, shell: true }); if (r.status === 0 && r.stdout) distTags = JSON.parse(r.stdout); } catch {}
+    try { const r = spawnNpmSync(['view', 'leerness', 'dist-tags', '--json'], { encoding: 'utf8', timeout: 10000 }); if (r.status === 0 && r.stdout) distTags = JSON.parse(r.stdout); } catch {}
   }
   if (json) { log(JSON.stringify({ version: v, defaultPublishTag: tag, distTags, policy: { stable: 'latest', experimental: 'next' } }, null, 2)); return; }
   log(`# leerness release channel (1.9.275, UR-0026)`);
@@ -22671,8 +22674,8 @@ function _publishToNpm(root, opts = {}) {
 
   // 1) 이미 publish된 버전인지 확인 (npm view <pkg>@<version> version)
   try {
-    const viewR = cp.spawnSync('npm', ['view', `${pkgName}@${pkgVersion}`, 'version'], {
-      cwd: root, encoding: 'utf8', shell: true, timeout: 15000
+    const viewR = spawnNpmSync(['view', `${pkgName}@${pkgVersion}`, 'version'], {
+      cwd: root, encoding: 'utf8', timeout: 15000
     });
     if (viewR.status === 0 && (viewR.stdout || '').trim() === pkgVersion) {
       log(`   ✓ 이미 npm registry에 publish됨 — skip`);
@@ -22684,7 +22687,7 @@ function _publishToNpm(root, opts = {}) {
   if (!opts.forcePublish) {
     let publishedLatest = null;
     try {
-      const latestR = cp.spawnSync('npm', ['view', pkgName, 'version'], { cwd: root, encoding: 'utf8', shell: true, timeout: 15000 });
+      const latestR = spawnNpmSync(['view', pkgName, 'version'], { cwd: root, encoding: 'utf8', timeout: 15000 });
       if (latestR.status === 0) publishedLatest = (latestR.stdout || '').trim();
     } catch {}
     const gate = _shouldPublishNpm(pkgVersion, publishedLatest, false);
@@ -22710,8 +22713,8 @@ function _publishToNpm(root, opts = {}) {
     if (otp) baseArgs.push(`--otp=${otp}`);
     const args = opts.dryRun ? [...baseArgs, '--dry-run'] : baseArgs;
     log(`   ${opts.dryRun ? '(dry-run) ' : ''}npm publish 시도 중... (dist-tag: ${npmTag})`);
-    const pubR = cp.spawnSync('npm', args, {
-      cwd: root, encoding: 'utf8', shell: true, timeout: 60000,
+    const pubR = spawnNpmSync(args, {
+      cwd: root, encoding: 'utf8', timeout: 60000,
       env: { ...process.env, npm_config_loglevel: 'warn' }
     });
     if (pubR.status === 0) {
@@ -22785,7 +22788,7 @@ async function releasePackCmd(root) {
 
   // 2. npm pack
   if (!dryRun) {
-    const r = cp.spawnSync('npm', ['pack'], { cwd: root, encoding: 'utf8', shell: true });
+    const r = spawnNpmSync(['pack'], { cwd: root, encoding: 'utf8' });
     if (r.status !== 0) { fail('npm pack 실패'); log(r.stderr); process.exitCode = 1; return; }
     const tarMatch = (r.stdout || '').match(/[^\s]+\.tgz/);
     if (tarMatch) ok(`npm pack → ${tarMatch[0]}`);
@@ -22866,7 +22869,7 @@ function releasePublish(root) {
   if (has('--pack') || has('--npm-publish') || (!has('--git-push') && !has('--gh-release') && !has('--gh-pages'))) {
     if (dryRun) { log('(dry-run) npm pack 생략 (실행 안 함)'); }
     else {
-      const packR = cp.spawnSync('npm', ['pack'], { cwd: root, encoding: 'utf8', shell: true });
+      const packR = spawnNpmSync(['pack'], { cwd: root, encoding: 'utf8' });
       if (packR.status !== 0) { fail('npm pack 실패'); log(packR.stderr); process.exitCode = 1; return; }
       ok('npm pack 완료');
     }
@@ -22923,7 +22926,7 @@ function releasePublish(root) {
     const npmTag = _resolveNpmTag(arg('--npm-tag', null));
     const args = dryRun ? ['publish', '--dry-run', '--tag', npmTag] : ['publish', '--access', 'public', '--tag', npmTag];
     log('npm ' + args.join(' '));
-    const r = cp.spawnSync('npm', args, { cwd: root, encoding: 'utf8', shell: true });
+    const r = spawnNpmSync(args, { cwd: root, encoding: 'utf8' });
     log((r.stdout || '').split('\n').slice(-5).join('\n'));
     if (r.status !== 0) { fail('npm publish 실패'); process.exitCode = 1; return; }
   }
@@ -25859,10 +25862,11 @@ const LEERNESS_GATE_WORKFLOW = [
   '  gate:',
   '    runs-on: ubuntu-latest',
   '    steps:',
-  '      - uses: actions/checkout@v4',
-  '      - uses: actions/setup-node@v4',
+  '      - uses: actions/checkout@v7',
+  '      - uses: actions/setup-node@v7',
   '        with:',
-  "          node-version: '20'",
+  "          node-version: '24'",
+  '          package-manager-cache: false',
   '      - name: leerness gate',
   '        run: npx -y leerness@' + VERSION + ' gate .',
   '',

package/lib/npm-process.js

@@ -0,0 +1,90 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const cp = require('child_process');
+
+function _isFile(filePath) {
+  if (!filePath) return false;
+  try { return fs.statSync(filePath).isFile(); } catch { return false; }
+}
+
+function _envValue(env, name) {
+  if (!env) return null;
+  if (env[name]) return env[name];
+  const key = Object.keys(env).find(candidate => candidate.toLowerCase() === name.toLowerCase());
+  return key ? env[key] : null;
+}
+
+function _npmCliCandidates(execPath, env) {
+  const nodeDir = path.dirname(execPath);
+  const envExecPath = _envValue(env, 'npm_execpath');
+  const envNpmCli = /[\\/]npm-cli\.(?:c?js)$/i.test(String(envExecPath || '')) ? envExecPath : null;
+  return [
+    envNpmCli,
+    path.join(nodeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    path.resolve(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    path.resolve(nodeDir, '..', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+  ].filter(Boolean);
+}
+
+function resolveNpmCliPath(options = {}) {
+  const execPath = options.execPath || process.execPath;
+  const env = options.env || process.env;
+  const candidates = _npmCliCandidates(execPath, env);
+  for (const candidate of candidates) {
+    if (_isFile(candidate)) return candidate;
+  }
+
+  if ((options.platform || process.platform) !== 'win32') return null;
+  const where = cp.spawnSync('where.exe', ['npm.cmd'], {
+    encoding: 'utf8',
+    env,
+    timeout: 5000,
+    windowsHide: true,
+  });
+  if (where.status !== 0) return null;
+  for (const wrapper of String(where.stdout || '').split(/\r?\n/).filter(Boolean)) {
+    const candidate = path.join(path.dirname(wrapper.trim()), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+    if (_isFile(candidate)) return candidate;
+  }
+  return null;
+}
+
+function _missingNpmResult() {
+  const error = new Error('npm CLI JavaScript entrypoint not found');
+  error.code = 'ENOENT';
+  return {
+    pid: 0,
+    output: [null, '', error.message],
+    stdout: '',
+    stderr: error.message,
+    status: null,
+    signal: null,
+    error,
+  };
+}
+
+function spawnNpmSync(args, options = {}) {
+  if (!Array.isArray(args)) throw new TypeError('npm args must be an array');
+  const npmArgs = args.map(value => String(value));
+  const hasExplicitCli = Object.prototype.hasOwnProperty.call(options, 'npmCliPath');
+  const { npmCliPath: explicitCli, ...childOptions } = options;
+  const spawnOptions = { ...childOptions, shell: false };
+  const env = spawnOptions.env || process.env;
+  const resolvedCli = hasExplicitCli
+    ? (_isFile(explicitCli) ? explicitCli : null)
+    : resolveNpmCliPath({ execPath: process.execPath, env, platform: process.platform });
+
+  // npm_execpath가 가리키는 npm-cli.js를 우선하면 npm/pnpm을 섞어 실행하지 않고,
+  // Windows에서도 .cmd 셸 래퍼 없이 argv를 그대로 보존할 수 있다.
+  if (resolvedCli) {
+    if (spawnOptions.windowsHide === undefined) spawnOptions.windowsHide = true;
+    return cp.spawnSync(process.execPath, [resolvedCli, ...npmArgs], spawnOptions);
+  }
+
+  if (process.platform === 'win32' || hasExplicitCli) return _missingNpmResult();
+  return cp.spawnSync('npm', npmArgs, spawnOptions);
+}
+
+module.exports = { resolveNpmCliPath, spawnNpmSync };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leerness",
-  "version": "1.36.160",
+  "version": "1.36.161",
   "description": "The AI-coding operations layer that makes \"done\" require evidence — persistent memory, evidence-gated completion checks, and clean handoffs for any AI agent (Claude Code, Codex, Cursor). State lives as plain files in your repo. CLI + MCP, 0 runtime dependencies.",
   "keywords": [
     "leerness",
@@ -48,11 +48,11 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node ./scripts/lint.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && npm run test:commands && node ./scripts/e2e.js",
-    "test:core": "node ./scripts/lint.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js",
+    "test": "node ./scripts/lint.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && npm run test:commands && node ./scripts/e2e.js",
+    "test:core": "node ./scripts/lint.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js",
     "test:commands": "node ./scripts/e2e-command-surface.js",
     "test:handoff": "node ./scripts/handoff-readonly-probe.js",
-    "test:fast": "node ./scripts/lint.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/smoke.js",
+    "test:fast": "node ./scripts/lint.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/smoke.js",
     "test:smoke": "node ./scripts/smoke.js",
     "lint": "node ./scripts/lint.js",
     "prepack": "node ./bin/leerness.js readme sync . && node ./bin/leerness.js --version"

package/scripts/e2e.js

@@ -6746,12 +6746,15 @@ total++;
     cp.spawnSync(process.execPath, [CLI, 'init', d, '--yes'], { encoding: 'utf8', timeout: 30000 });
     const ci = cp.spawnSync(process.execPath, [CLI, 'ci', 'init', d], { encoding: 'utf8', timeout: 15000 });
     const wf = fs.readFileSync(path.join(d, '.github', 'workflows', 'leerness-gate.yml'), 'utf8');
-    // 버전 핀(설치 버전 == package.json) · 미핀 latest 부재 · 최소권한 · concurrency 취소 · gate 호출
+    // 버전 핀(설치 버전 == package.json) · 미핀 latest 부재 · 최소권한 · concurrency 취소 · Node 24 액션/런타임 · gate 호출
     const pinned = new RegExp('run: npx -y leerness@' + ver.replace(/\./g, '\\.') + ' gate \\.').test(wf);
     const noUnpinned = !/npx -y leerness gate \./.test(wf);
     const perms = /permissions:\n\s*contents: read/.test(wf);
     const conc = /concurrency:\n\s*group: leerness-gate-\$\{\{ github\.ref \}\}\n\s*cancel-in-progress: true/.test(wf);
-    const stillGate = /leerness-gate/.test(wf) && /pull_request:/.test(wf) && /actions\/checkout@v4/.test(wf);
+    const stillGate = /leerness-gate/.test(wf) && /pull_request:/.test(wf)
+      && /actions\/checkout@v7/.test(wf) && /actions\/setup-node@v7/.test(wf)
+      && /node-version:\s*'24'/.test(wf) && /package-manager-cache:\s*false/.test(wf)
+      && !/actions\/(?:checkout|setup-node)@v4/.test(wf);
     fs.rmSync(d, { recursive: true, force: true });
     ok = ci.status === 0 && pinned && noUnpinned && perms && conc && stillGate;
   } catch {}
@@ -7216,12 +7219,15 @@ total++;
     // ⑦ (1.28.2 Phase 10c) doctor: en 영어(한글 0) + ko 기본 한글 보존
     // 1.36.87: doctor 는 내부에서 selftest 를 돌린다 — 실측 19~24s 인데 제한이 20s 라 여유가 없었다(1.36.86 에서도 0.9s).
     //   제한을 올린 대신 종료코드도 함께 단언한다 — 타임아웃(status=null)이 출력 매칭만으로 통과하면 안 된다(codex 26차 #11).
-    // 1.36.127 (실측): 1.36.105 가 형제 블록의 doctor 제한을 120s→300s 로 올리며 "여유가 1.2배뿐이라
-    //   전체 부하에서 반복해 터진다" 고 적었는데, **이 클론은 120s 로 남아 있었다**(같은 수정의 누락분).
-    //   이번 게이트에서 실제로 여기서만 터졌고, 격리 실측은 `doctor --language en` **120s**(= 제한과 동일, 여유 1.0배).
-    //   측정 대상은 속도가 아니라 언어 렌더이므로 넉넉히 준다.
-    const docEnR = cp.spawnSync(process.execPath, [CLI, 'doctor', '--language', 'en'], { encoding: 'utf8', timeout: 300000, cwd: d });
-    const docKoR = cp.spawnSync(process.execPath, [CLI, 'doctor'], { encoding: 'utf8', timeout: 300000, cwd: d });
+    // 1.36.161: 전체 E2E 108분 부하에서는 300s도 한 번 초과했다. 같은 픽스처 격리 실측은 en/ko 각각 139s,
+    //   종료 0·언어 계약 통과였다. 측정 대상은 속도가 아니라 언어 렌더이므로 4배 이상 여유를 주고,
+    //   다시 실패하면 status/error/시간/출력 꼬리를 아래 디버그에 남긴다.
+    const docEnAt = Date.now();
+    const docEnR = cp.spawnSync(process.execPath, [CLI, 'doctor', '--language', 'en'], { encoding: 'utf8', timeout: 600000, cwd: d });
+    const docEnMs = Date.now() - docEnAt;
+    const docKoAt = Date.now();
+    const docKoR = cp.spawnSync(process.execPath, [CLI, 'doctor'], { encoding: 'utf8', timeout: 600000, cwd: d });
+    const docKoMs = Date.now() - docKoAt;
     const docEn = out(docEnR), docKo = out(docKoR);
     const doctorOk = docEnR.status === 0 && docKoR.status === 0
       && /install\/environment diagnosis/.test(docEn) && !H.test(docEn) && /설치\/환경 진단/.test(docKo);
@@ -7300,7 +7306,10 @@ total++;
     ok = lensKoOk && lensEnOk && noLeak && stOk && healthOk && driftOk && doctorOk && hoEnOk && hoKoOk && edEnOk && edKoOk && shEnOk && shKoOk && agEnOk && agKoOk && f3En && f3Ko && f4;
     // 1.36.87: 단언 18개를 && 로 묶고 실패 시 어느 것인지 알려주지 않아, 진단하려면 22분짜리 스위트를 통째로
     //   다시 돌려야 했다. 다른 블록들과 같은 규율으로 실패 플래그를 노출한다.
-    if (!ok) console.log('   [i18n 디버그] ' + JSON.stringify({ lensKoOk, lensEnOk, noLeak, stOk, healthOk, driftOk, doctorOk, hoEnOk, hoKoOk, edEnOk, edKoOk, shEnOk, shKoOk, agEnOk, agKoOk, f3En, f3Ko, f4 }));
+    if (!ok) console.log('   [i18n 디버그] ' + JSON.stringify({ lensKoOk, lensEnOk, noLeak, stOk, healthOk, driftOk, doctorOk,
+      doctor: { en: { status: docEnR.status, error: docEnR.error && docEnR.error.code, ms: docEnMs, tail: docEn.trim().split(/\r?\n/).slice(-2) },
+        ko: { status: docKoR.status, error: docKoR.error && docKoR.error.code, ms: docKoMs, tail: docKo.trim().split(/\r?\n/).slice(-2) } },
+      hoEnOk, hoKoOk, edEnOk, edKoOk, shEnOk, shKoOk, agEnOk, agKoOk, f3En, f3Ko, f4 }));
   } catch (e) { console.log('   [i18n 디버그] 예외: ' + ((e && e.message) || e)); }
   console.log(ok ? '✓ B(1.25.1/1.25.2/1.27.2/1.28.2/1.29.1/1.29.2/1.29.3/1.29.4/1.30.5) i18n 행위: --language en 런타임 영어(lens/health/drift/doctor/handoff보안요약/env-detect/shell-guard/agent-slash/워크플로가이드/verify-claim) + ko 기본 보존 + --language positional 무누출 + status 에러 en/ko (UR-0010)' : '✗ i18n 행위 회귀 가드 실패');
   if (!ok) failed++;

package/scripts/release-runtime-probe.js

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const cp = require('child_process');
+
+const root = path.resolve(__dirname, '..');
+const cliPath = path.join(root, 'bin', 'leerness.js');
+const npmProcessPath = path.join(root, 'lib', 'npm-process.js');
+const sandbox = fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-release-runtime-'));
+const marker = path.join(sandbox, 'shell-injection-marker');
+const fakeNpmDir = path.join(sandbox, 'fake-npm');
+const fakeNpmCli = path.join(fakeNpmDir, 'npm-cli.js');
+const fakeNpmLog = path.join(sandbox, 'fake-npm-calls.jsonl');
+const failures = [];
+
+function readFakeCalls() {
+  try {
+    return fs.readFileSync(fakeNpmLog, 'utf8').split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+  } catch { return []; }
+}
+
+function runCli(args, env = process.env) {
+  return cp.spawnSync(process.execPath, [cliPath, ...args], {
+    cwd: sandbox,
+    env,
+    encoding: 'utf8',
+    timeout: 60000,
+  });
+}
+
+function overrideEnvCaseInsensitive(base, overrides) {
+  const env = { ...base };
+  for (const [name, value] of Object.entries(overrides)) {
+    for (const key of Object.keys(env)) {
+      if (key.toLowerCase() === name.toLowerCase()) delete env[key];
+    }
+    env[name] = value;
+  }
+  return env;
+}
+
+try {
+  fs.mkdirSync(fakeNpmDir, { recursive: true });
+  fs.writeFileSync(path.join(sandbox, 'package.json'), JSON.stringify({ name: 'release-runtime-probe', version: '9.9.9' }) + '\n');
+  fs.writeFileSync(fakeNpmCli, [
+    "'use strict';",
+    "const fs = require('fs');",
+    'const args = process.argv.slice(2);',
+    "if (process.env.LEERNESS_NPM_PROBE_LOG) fs.appendFileSync(process.env.LEERNESS_NPM_PROBE_LOG, JSON.stringify(args) + '\\n');",
+    "if (args[0] === '--version') process.stdout.write('99.0.0\\n');",
+    "else if (args[0] === 'view' && args.includes('dist-tags')) process.stdout.write(JSON.stringify({ latest: '9.9.9', next: '10.0.0-next.1' }) + '\\n');",
+    "else if (args[0] === 'view') process.stdout.write('9.9.9\\n');",
+    "else if (args[0] === 'pack') process.stdout.write('release-runtime-probe-9.9.9.tgz\\n');",
+    "else if (args[0] === 'publish') process.stdout.write('+ release-runtime-probe@9.9.9\\n');",
+    'const exitCode = Number(process.env.LEERNESS_NPM_PROBE_EXIT || 0);',
+    'if (Number.isFinite(exitCode) && exitCode !== 0) process.exit(exitCode);',
+  ].join('\n') + '\n');
+
+  const childScript = [
+    `const { spawnNpmSync } = require(${JSON.stringify(npmProcessPath)});`,
+    'const warnings = [];',
+    "process.on('warning', warning => warnings.push({ code: warning.code, message: warning.message }));",
+    "const result = spawnNpmSync(['--version'], { encoding: 'utf8', timeout: 30000 });",
+    'setImmediate(() => {',
+    '  process.stdout.write(JSON.stringify({',
+    '    status: result.status,',
+    "    stdout: String(result.stdout || '').trim(),",
+    "    stderr: String(result.stderr || ''),",
+    '    error: result.error ? String(result.error.code || result.error.message) : null,',
+    '    warnings,',
+    '  }));',
+    '});',
+  ].join('\n');
+  const child = cp.spawnSync(process.execPath, ['--trace-deprecation', '-e', childScript], {
+    cwd: root,
+    encoding: 'utf8',
+    timeout: 60000,
+  });
+  let result = null;
+  try { result = JSON.parse(String(child.stdout || '')); } catch {}
+  if (child.status !== 0 || !result || result.status !== 0 || !/^\d+\.\d+\.\d+/.test(result.stdout || '')) {
+    failures.push(`shell 없는 npm --version 실행 실패: ${String(child.stderr || child.stdout || '').slice(0, 300)}`);
+  }
+  const warningText = `${String(child.stderr || '')} ${JSON.stringify(result && result.warnings || [])}`;
+  if (/DEP0190|shell option true/i.test(warningText)) failures.push('npm 실행에서 DEP0190 경고가 발생함');
+
+  const { resolveNpmCliPath, spawnNpmSync } = require(npmProcessPath);
+  const fakeEnv = overrideEnvCaseInsensitive(process.env, {
+    // test:fast deliberately runs the product offline. These cases exercise the
+    // real npm-backed release paths with a local fake CLI, so keep that parent
+    // policy from short-circuiting the behavior under test.
+    LEERNESS_OFFLINE: '0',
+    npm_execpath: fakeNpmCli,
+    LEERNESS_NPM_PROBE_LOG: fakeNpmLog,
+  });
+  const casingProbe = overrideEnvCaseInsensitive(
+    { NPM_EXECPATH: path.join(sandbox, 'inherited-wrong-npm-cli.js') },
+    { npm_execpath: fakeNpmCli },
+  );
+  const casingKeys = Object.keys(casingProbe).filter(key => key.toLowerCase() === 'npm_execpath');
+  if (casingKeys.length !== 1 || casingKeys[0] !== 'npm_execpath' || casingProbe.npm_execpath !== fakeNpmCli) {
+    failures.push(`Windows npm_execpath 대소문자 alias 정규화 실패: ${JSON.stringify(casingKeys)}`);
+  }
+  const resolved = resolveNpmCliPath({ env: fakeEnv });
+  if (resolved !== fakeNpmCli) {
+    failures.push(`자식 env의 npm_execpath를 사용하지 않음: ${resolved || '(없음)'}`);
+  }
+  fs.writeFileSync(fakeNpmLog, '');
+  const argvResult = spawnNpmSync([
+    '--version',
+    '&&',
+    process.execPath,
+    '-e',
+    `require('fs').writeFileSync(${JSON.stringify(marker)}, 'unsafe')`,
+  ], { cwd: sandbox, env: fakeEnv, encoding: 'utf8', timeout: 30000 });
+  const argvCalls = readFakeCalls();
+  const expectedArgv = ['--version', '&&', process.execPath, '-e', `require('fs').writeFileSync(${JSON.stringify(marker)}, 'unsafe')`];
+  if (argvResult.status !== 0 || argvCalls.length !== 1 || JSON.stringify(argvCalls[0]) !== JSON.stringify(expectedArgv)) {
+    failures.push(`npm argv 보존 실패: ${JSON.stringify(argvCalls)}`);
+  }
+  if (fs.existsSync(marker)) failures.push('npm 인자의 셸 메타문자가 별도 명령으로 실행됨');
+
+  const missing = spawnNpmSync(['--version'], {
+    npmCliPath: path.join(sandbox, 'missing', 'npm-cli.js'),
+    cwd: sandbox,
+    encoding: 'utf8',
+  });
+  if (missing.status !== null || !missing.error || missing.error.code !== 'ENOENT') {
+    failures.push(`npm CLI 누락 결과가 spawn 호환 ENOENT가 아님: ${JSON.stringify({ status: missing.status, code: missing.error && missing.error.code })}`);
+  }
+
+  fs.writeFileSync(fakeNpmLog, '');
+  const channel = runCli(['release', 'channel', sandbox, '--json'], fakeEnv);
+  let channelJson = null;
+  try { channelJson = JSON.parse(String(channel.stdout || '')); } catch {}
+  const channelCalls = readFakeCalls();
+  if (channel.status !== 0 || !channelJson || !channelJson.distTags || channelJson.distTags.latest !== '9.9.9'
+      || !channelCalls.some(call => JSON.stringify(call) === JSON.stringify(['view', 'leerness', 'dist-tags', '--json']))) {
+    failures.push(`release channel 실제 npm view 경로 실패: exit=${channel.status} calls=${JSON.stringify(channelCalls)}`);
+  }
+
+  const failingEnv = { ...fakeEnv, LEERNESS_NPM_PROBE_EXIT: '7' };
+  const channelFailure = runCli(['release', 'channel', sandbox, '--json'], failingEnv);
+  let channelFailureJson = null;
+  try { channelFailureJson = JSON.parse(String(channelFailure.stdout || '')); } catch {}
+  if (channelFailure.status !== 0 || !channelFailureJson || channelFailureJson.distTags !== null) {
+    failures.push(`release channel npm view 실패 폴백 오류: exit=${channelFailure.status}`);
+  }
+  const packFailure = runCli(['release', 'pack', sandbox, '--no-readme-sync'], failingEnv);
+  if (packFailure.status !== 1 || !/npm pack 실패/.test(String(packFailure.stdout || ''))) {
+    failures.push(`release pack npm 실패 전파 오류: exit=${packFailure.status}`);
+  }
+  const publishFailure = runCli(['release', 'publish', sandbox, '--dry-run', '--npm-publish'], failingEnv);
+  if (publishFailure.status !== 1 || !/npm publish 실패/.test(String(publishFailure.stdout || ''))) {
+    failures.push(`release publish npm 실패 전파 오류: exit=${publishFailure.status}`);
+  }
+
+  const workflow = fs.readFileSync(path.join(root, '.github', 'workflows', 'ci.yml'), 'utf8');
+  const refs = Array.from(workflow.matchAll(/uses:\s*actions\/(checkout|setup-node)@(v\d+)/g), match => `${match[1]}@${match[2]}`);
+  if (refs.length < 6 || refs.some(ref => !/@v7$/.test(ref))) {
+    failures.push(`CI 액션 런타임 major 불일치: ${refs.join(', ') || '(없음)'}`);
+  }
+  if (!/release-runtime:\s*[\s\S]*node:\s*\[24, 26\]/.test(workflow)
+      || !/name:\s*release runtime \(shell-free npm\)/.test(workflow)) {
+    failures.push('CI가 전체 게이트와 Node 24/26 매트릭스에서 릴리스 런타임 프로브를 실행하지 않음');
+  }
+
+  const ciFixture = path.join(sandbox, 'ci-init-fixture');
+  fs.mkdirSync(ciFixture, { recursive: true });
+  const ciInit = runCli(['ci', 'init', ciFixture, '--force', '--json'], { ...process.env, LEERNESS_OFFLINE: '1' });
+  const generatedWorkflowPath = path.join(ciFixture, '.github', 'workflows', 'leerness-gate.yml');
+  const generatedWorkflow = fs.existsSync(generatedWorkflowPath) ? fs.readFileSync(generatedWorkflowPath, 'utf8') : '';
+  if (ciInit.status !== 0 || !/actions\/checkout@v7/.test(generatedWorkflow)
+      || !/actions\/setup-node@v7/.test(generatedWorkflow)
+      || !/node-version:\s*'24'/.test(generatedWorkflow)
+      || !/package-manager-cache:\s*false/.test(generatedWorkflow)
+      || /actions\/(?:checkout|setup-node)@v4/.test(generatedWorkflow)) {
+    failures.push(`ci init 생성 워크플로 Node 24 런타임 전환 실패: exit=${ciInit.status}`);
+  }
+
+  const cliSource = fs.readFileSync(path.join(root, 'bin', 'leerness.js'), 'utf8');
+  const publishStart = cliSource.indexOf('function _publishToNpm');
+  const publishEnd = cliSource.indexOf('\nasync function releasePackCmd', publishStart);
+  const publishBlock = publishStart >= 0 && publishEnd > publishStart
+    ? cliSource.slice(publishStart, publishEnd) : '';
+  if (!publishBlock.includes('spawnNpmSync') || /cp\.spawnSync\(['"]npm['"]|shell:\s*true/.test(publishBlock)) {
+    failures.push('_publishToNpm이 shell 없는 공용 npm 실행 경로를 사용하지 않음');
+  }
+  const releaseStart = cliSource.indexOf('function releasePackCmd');
+  const releaseEnd = cliSource.indexOf('// ===== 1.9.7 A:', releaseStart);
+  const releaseBlock = releaseStart >= 0 && releaseEnd > releaseStart
+    ? cliSource.slice(releaseStart, releaseEnd) : '';
+  if (/cp\.spawnSync\(['"]npm['"]/.test(releaseBlock)) {
+    failures.push('release pack/publish 경로에 직접 npm spawn이 남아 있음');
+  }
+} catch (error) {
+  failures.push(String(error && (error.stack || error.message) || error));
+} finally {
+  try { fs.rmSync(sandbox, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 }); } catch {}
+}
+
+if (failures.length) {
+  process.stderr.write(`release runtime probe failed:\n- ${failures.join('\n- ')}\n`);
+  process.exit(1);
+}
+
+process.stdout.write('release runtime probe passed: Node 24 actions + shell-free npm argv\n');