leerness 1.36.167 → 1.36.169

package/lib/diagnostics.js

@@ -3,13 +3,151 @@
 //   - I/O: ./io(log).  node: child_process.
 //   - harness 고유 의존(VERSION · _selfTestCases · _detectShellCtx · _mcpToolCount · argv 파서 has · harnessPath)은 deps 주입(DI).
 //     _selfTestCases 의 각 case.run 클로저는 harness 스코프를 유지하므로 함수 참조 주입만으로 정상 동작.
-'use strict';
-const cp = require('child_process');
-const path = require('path');
+'use strict';
+const cp = require('child_process');
+const fs = require('fs');
+const path = require('path');
 const { log, fail, absRoot, exists, read } = require('./io');
 const { parseHarnessVersion, _parseChangelogBetween, compareVer } = require('./pure-utils');
 const { spawnNpmSync } = require('./npm-process');
 const { windowsPathCandidates } = require('./portable-process');
+
+const _WINDOWS_NPM_SHIM_EXTS = new Set(['', '.cmd', '.ps1']);
+
+function _pathKey(value, platform) {
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  let normalized = pathApi.normalize(String(value || ''));
+  if (platform === process.platform) {
+    try { normalized = fs.realpathSync.native(normalized); } catch {}
+  }
+  return platform === 'win32' ? normalized.toLowerCase() : normalized;
+}
+
+function _escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function _readSmallText(filePath) {
+  const stat = fs.statSync(filePath);
+  if (!stat.isFile() || stat.size > 64 * 1024) return null;
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+function _npmShimTargetsEntry(candidate, expectedEntry, platform) {
+  if (platform !== 'win32' || platform !== process.platform) return false;
+  const pathApi = path.win32;
+  const ext = pathApi.extname(candidate).toLowerCase();
+  if (!_WINDOWS_NPM_SHIM_EXTS.has(ext)) return false;
+  if (!ext) {
+    try {
+      if (_pathKey(fs.realpathSync.native(candidate), platform) === _pathKey(expectedEntry, platform)) return true;
+    } catch {}
+  }
+
+  let source;
+  try { source = _readSmallText(candidate); } catch { return false; }
+  if (source == null) return false;
+  const relative = pathApi.relative(pathApi.dirname(candidate), expectedEntry);
+  if (!relative || pathApi.isAbsolute(relative)) return false;
+  const lines = source.split(/\r?\n/);
+
+  if (!ext) {
+    const target = _escapeRegExp(`"$basedir/${relative.replace(/\\/g, '/')}"`);
+    const invocation = new RegExp(`^\\s*exec\\s+(?:"\\$basedir[\\\\/]node(?:\\.exe)?"|node(?:\\.exe)?)\\s+${target}\\s+"\\$@"\\s*$`, 'i');
+    const forwarded = lines.filter(line => !/^\s*#/.test(line) && /"\$@"\s*$/.test(line));
+    return forwarded.length > 0 && forwarded.every(line => invocation.test(line));
+  }
+
+  if (ext === '.cmd') {
+    const target = _escapeRegExp(`"%dp0%\\${relative.replace(/\//g, '\\')}"`);
+    const invocation = new RegExp(`^\\s*endLocal\\s+&\\s+goto\\s+#_undefined_#\\s+2>NUL\\s+\\|\\|\\s+title\\s+%COMSPEC%\\s+&\\s+"%_prog%"\\s+${target}\\s+%\\*\\s*$`, 'i');
+    const forwarded = lines.filter(line => !/^\s*(?:@?rem\b|::)/i.test(line) && /%\*\s*$/.test(line));
+    return forwarded.length === 1 && invocation.test(forwarded[0]);
+  }
+
+  const target = _escapeRegExp(`"$basedir/${relative.replace(/\\/g, '/')}"`);
+  const invocation = new RegExp(`^\\s*(?:\\$input\\s*\\|\\s*)?&\\s+(?:"\\$basedir[\\\\/]node\\$exe"|"node\\$exe")\\s+${target}\\s+\\$args\\s*$`, 'i');
+  const forwarded = lines.filter(line => !/^\s*#/.test(line) && /&/.test(line) && /\$args\s*$/.test(line));
+  return forwarded.length > 0 && forwarded.every(line => invocation.test(line));
+}
+
+function _npmPackageIdentity(candidate, options = {}) {
+  const platform = options.platform || process.platform;
+  if (platform !== process.platform) return null;
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  const command = String(options.command || 'leerness');
+  const packageName = String(options.packageName || command);
+  const dir = pathApi.dirname(candidate);
+  const manifests = [pathApi.join(dir, 'node_modules', packageName, 'package.json')];
+  if (pathApi.basename(dir).toLowerCase() === '.bin') {
+    manifests.push(pathApi.join(dir, '..', packageName, 'package.json'));
+  }
+  for (const manifest of manifests) {
+    try {
+      const stat = fs.statSync(manifest);
+      if (!stat.isFile() || stat.size > 64 * 1024) continue;
+      const pkg = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+      const declaredBin = typeof pkg.bin === 'string' ? pkg.bin
+        : (pkg.bin && typeof pkg.bin === 'object'
+          && Object.prototype.hasOwnProperty.call(pkg.bin, command) ? pkg.bin[command] : null);
+      if (pkg.name !== packageName || typeof declaredBin !== 'string'
+          || !declaredBin.trim() || /\u0000/.test(declaredBin)) continue;
+      const expectedEntry = pathApi.resolve(pathApi.dirname(manifest), declaredBin);
+      if (!fs.statSync(expectedEntry).isFile()) continue;
+      if (!_npmShimTargetsEntry(candidate, expectedEntry, platform)) continue;
+      return _pathKey(expectedEntry, platform);
+    } catch {}
+  }
+  return null;
+}
+
+// `where leerness` returns each executable shim, not each PATH installation. A normal
+// Windows npm install therefore yields both `leerness` and `leerness.cmd`. Only merge
+// variants when the adjacent package manifest and the shim's resolved bin target
+// prove they belong to the same package; unproven same-stem files remain separate.
+function _groupPathInstallations(candidates, options = {}) {
+  const platform = options.platform || process.platform;
+  const pathApi = platform === 'win32' ? path.win32 : path.posix;
+  const command = String(options.command || 'leerness').toLowerCase();
+  const packageIdentity = typeof options.packageIdentity === 'function'
+    ? options.packageIdentity
+    : candidate => _npmPackageIdentity(candidate, {
+      platform, command, packageName: options.packageName || command,
+    });
+  const groups = [];
+  const byKey = new Map();
+
+  for (const rawCandidate of Array.isArray(candidates) ? candidates : []) {
+    const candidate = String(rawCandidate || '').trim();
+    if (!candidate) continue;
+    const normalized = pathApi.normalize(candidate);
+    const base = pathApi.basename(normalized);
+    const ext = pathApi.extname(base).toLowerCase();
+    const isNpmShimVariant = platform === 'win32' && _WINDOWS_NPM_SHIM_EXTS.has(ext);
+    const stem = isNpmShimVariant && ext ? base.slice(0, -ext.length) : base;
+    const directory = pathApi.dirname(normalized);
+    let kind = 'candidate';
+    let key = `candidate:${_pathKey(normalized, platform)}`;
+
+    if (isNpmShimVariant && stem.toLowerCase() === command) {
+      let identity = null;
+      try { identity = packageIdentity(normalized); } catch { identity = null; }
+      if (identity) {
+        kind = 'npm-package';
+        key = `npm:${_pathKey(directory, platform)}:${String(identity).toLowerCase()}`;
+      }
+    }
+
+    let group = byKey.get(key);
+    if (!group) {
+      group = { directory, kind, candidates: [] };
+      byKey.set(key, group);
+      groups.push(group);
+    }
+    group.candidates.push(candidate);
+  }
+  return groups;
+}
 
 function doctorCmd(opts = {}, deps = {}) {
   const { VERSION, uiLang, _selfTestCases, _selfTestReport, _controlSelftestEnv,
@@ -86,59 +224,70 @@ function doctorCmd(opts = {}, deps = {}) {
   return report;
 }
 
-function whichCmd(deps = {}) {
-  const { VERSION, uiLang, has, harnessPath } = deps;
-  const t = (ko, en) => (uiLang === 'en' ? en : ko);  // 1.28.2 (UR-0010 Phase 10c)
-  const out = {
+function whichCmd(deps = {}) {
+  const { VERSION, uiLang, has, harnessPath } = deps;
+  const t = (ko, en) => (uiLang === 'en' ? en : ko);  // 1.28.2 (UR-0010 Phase 10c)
+  const platform = deps.platform || process.platform;
+  const out = {
     version: VERSION,
     runningFrom: harnessPath,
     nodeVersion: process.version,
-    platform: process.platform,
+    platform,
     arch: process.arch,
     npm: {},
-    pathCandidates: []
+    pathCandidates: [],
+    pathInstallations: []
   };
-  // npm root -g (글로벌 설치 경로)
-  try {
-    const r = spawnNpmSync(['root', '-g'], { encoding: 'utf8', timeout: 5000 });
-    if (r.status === 0) out.npm.globalRoot = (r.stdout || '').trim();
-  } catch {}
-  // npm cache (npx 캐시 경로)
-  try {
-    const r = spawnNpmSync(['config', 'get', 'cache'], { encoding: 'utf8', timeout: 5000 });
-    if (r.status === 0) out.npm.cacheDir = (r.stdout || '').trim();
-  } catch {}
-  // npm 글로벌 leerness 설치 정보
-  try {
-    const r = spawnNpmSync(['ls', '-g', 'leerness', '--depth=0', '--json'], { encoding: 'utf8', timeout: 8000 });
-    if (r.stdout) {
-      try {
-        const j = JSON.parse(r.stdout);
-        if (j.dependencies?.leerness) out.npm.globalInstalled = j.dependencies.leerness.version;
-      } catch {}
-    }
-  } catch {}
+  if (!deps.skipNpm) {
+    // npm root -g (글로벌 설치 경로)
+    try {
+      const r = spawnNpmSync(['root', '-g'], { encoding: 'utf8', timeout: 5000 });
+      if (r.status === 0) out.npm.globalRoot = (r.stdout || '').trim();
+    } catch {}
+    // npm cache (npx 캐시 경로)
+    try {
+      const r = spawnNpmSync(['config', 'get', 'cache'], { encoding: 'utf8', timeout: 5000 });
+      if (r.status === 0) out.npm.cacheDir = (r.stdout || '').trim();
+    } catch {}
+    // npm 글로벌 leerness 설치 정보
+    try {
+      const r = spawnNpmSync(['ls', '-g', 'leerness', '--depth=0', '--json'], { encoding: 'utf8', timeout: 8000 });
+      if (r.stdout) {
+        try {
+          const j = JSON.parse(r.stdout);
+          if (j.dependencies?.leerness) out.npm.globalInstalled = j.dependencies.leerness.version;
+        } catch {}
+      }
+    } catch {}
+  }
   // PATH 후보 (Windows: absolute System32 where + PATH-only 필터 / Unix: which)
   try {
-    const isWin = process.platform === 'win32';
-    if (isWin) {
+    const isWin = platform === 'win32';
+    if (Array.isArray(deps.pathCandidates)) {
+      out.pathCandidates = deps.pathCandidates.slice();
+    } else if (isWin) {
       out.pathCandidates = windowsPathCandidates('leerness', { env: process.env, cwd: process.cwd() });
     } else {
       const r = cp.spawnSync('which', ['-a', 'leerness'], { encoding: 'utf8', timeout: 5000, shell: false });
       if (r.stdout) out.pathCandidates = (r.stdout || '').trim().split(/\r?\n/).filter(Boolean);
     }
   } catch {}
+  out.pathInstallations = _groupPathInstallations(out.pathCandidates, {
+    platform, command: 'leerness', packageName: 'leerness',
+    ...(typeof deps.packageIdentity === 'function' ? { packageIdentity: deps.packageIdentity } : {}),
+  });
   // 진단: 글로벌 설치된 leerness 와 현재 실행 버전이 다르면 경고
   out.diagnostics = [];
   if (out.npm.globalInstalled && out.npm.globalInstalled !== VERSION) {
     out.diagnostics.push(t(`⚠ 글로벌 설치 ${out.npm.globalInstalled} ≠ 현재 실행 ${VERSION} — npx 캐시 또는 PATH 충돌 의심`, `⚠ global install ${out.npm.globalInstalled} ≠ running ${VERSION} — suspect npx cache or PATH conflict`));
     out.diagnostics.push(t(`  → 강제 최신: npm i -g leerness@latest  /  또는 npx --yes leerness@latest <command>`, `  → force latest: npm i -g leerness@latest  /  or npx --yes leerness@latest <command>`));
   }
-  if (out.pathCandidates.length > 1) {
-    out.diagnostics.push(t(`⚠ PATH 에 leerness 가 ${out.pathCandidates.length}개 — 우선순위 충돌 가능`, `⚠ leerness appears ${out.pathCandidates.length}× on PATH — possible precedence conflict`));
+  if (out.pathInstallations.length > 1) {
+    out.diagnostics.push(t(`⚠ PATH 에 leerness 설치가 ${out.pathInstallations.length}개 — 우선순위 충돌 가능`, `⚠ ${out.pathInstallations.length} leerness installations appear on PATH — possible precedence conflict`));
     out.diagnostics.push(t(`  → 명시적 경로 사용: ${out.runningFrom}`, `  → use the explicit path: ${out.runningFrom}`));
   }
-  if (has('--json')) { log(JSON.stringify(out, null, 2)); return; }
+  if (deps.quiet) return out;
+  if (has('--json')) { log(JSON.stringify(out, null, 2)); return out; }
   log(`# leerness which (1.9.164)`);
   log(`${t('현재 실행', 'running from')}: ${out.runningFrom}`);
   log(`${t('버전', 'version')}:      v${out.version}`);
@@ -149,10 +298,15 @@ function whichCmd(deps = {}) {
   if (out.npm.cacheDir)   log(t(`  npm cache:   ${out.npm.cacheDir}  (npx 옛 버전이 여기 캐싱 — 의심 시 \`npm cache clean --force\`)`, `  npm cache:   ${out.npm.cacheDir}  (npx caches old versions here — if suspect: \`npm cache clean --force\`)`));
   if (out.npm.globalInstalled) log(t(`  글로벌 설치: leerness@${out.npm.globalInstalled}`, `  global install: leerness@${out.npm.globalInstalled}`));
   else log(t(`  글로벌 설치: (없음 — npx 또는 로컬 경로만 사용 중)`, `  global install: (none — using npx or a local path only)`));
-  if (out.pathCandidates.length) {
-    log('');
-    log(t(`## PATH 후보 (${out.pathCandidates.length}개)`, `## PATH candidates (${out.pathCandidates.length})`));
-    for (const p of out.pathCandidates) log(`  - ${p}`);
+  if (out.pathCandidates.length) {
+    log('');
+    log(t(`## PATH 후보 (${out.pathCandidates.length}개 · 설치 ${out.pathInstallations.length}개)`, `## PATH candidates (${out.pathCandidates.length} · ${out.pathInstallations.length} installation(s))`));
+    for (const p of out.pathCandidates) log(`  - ${p}`);
+    const groupedShims = out.pathInstallations.filter(group => group.kind === 'npm-package' && group.candidates.length > 1);
+    if (groupedShims.length) {
+      const variants = groupedShims.reduce((sum, group) => sum + group.candidates.length, 0);
+      log(t(`  ⓘ 동일 npm 설치의 shim 변형 ${variants}개를 설치 ${groupedShims.length}개로 그룹화`, `  ⓘ grouped ${variants} shim variants into ${groupedShims.length} npm installation(s)`));
+    }
   }
   if (out.diagnostics.length) {
     log('');
@@ -166,8 +320,9 @@ function whichCmd(deps = {}) {
   log(t(`💡 강제 최신 실행 방법:`, `💡 how to force the latest:`));
   log(t(`  1) npx --yes leerness@latest <command>        # npx 캐시 무시하고 최신 다운로드`, `  1) npx --yes leerness@latest <command>        # bypass npx cache, download latest`));
   log(t(`  2) npm i -g leerness@latest                    # 글로벌 설치 갱신`, `  2) npm i -g leerness@latest                    # update the global install`));
-  log(t(`  3) npm cache clean --force                     # npx 캐시 강제 비우기 (의심 시)`, `  3) npm cache clean --force                     # force-clear the npx cache (if suspect)`));
-}
+  log(t(`  3) npm cache clean --force                     # npx 캐시 강제 비우기 (의심 시)`, `  3) npm cache clean --force                     # force-clear the npx cache (if suspect)`));
+  return out;
+}
 
 // 1.9.394 (UR-0025): whats-new — 현재 워크스페이스 버전 → 도구 버전 CHANGELOG 차분(신규 명령/플래그/파일 요약). introspection 핸들러.
 //   순수 파서 _parseChangelogBetween(pure-utils) 사용. deps: VERSION/arg/has. CHANGELOG 경로는 root 우선, 없으면 pkg 자체(lib/../).
@@ -261,4 +416,4 @@ function whatsNewCmd(root, deps = {}) {
   log(t(`  4. 상세: \`cat CHANGELOG.md\` 또는 \`leerness whats-new --json\``, `  4. Details: \`cat CHANGELOG.md\` or \`leerness whats-new --json\``));
 }
 
-module.exports = { doctorCmd, whichCmd, whatsNewCmd };
+module.exports = { doctorCmd, whichCmd, whatsNewCmd, _groupPathInstallations, _npmPackageIdentity };

package/lib/migrate.js

@@ -38,19 +38,41 @@ function migrateAuditCmd(root, opts = {}, deps = {}) {
 // UR-0075 Phase C (1.9.357): migrate apply — audit가 찾은 '안전 항목'(canonical 백필)만 비파괴 적용.
 // 기본 dry-run(변경 없음) · --yes 로 실제 적용. version-drift/missing-file 은 apply 범위 외(수동 안내).
 function migrateApplyCmd(root, opts = {}, deps = {}) {
-  const { VERSION, compareVer, REQUIRED_WORKSPACE_FILES, decisionsPath, decisionsJsonPath, lessonsPath, lessonsJsonPath, _loadDecisions, _saveDecisions, _loadLessons, _saveLessons } = deps;
+  const { VERSION, compareVer, REQUIRED_WORKSPACE_FILES, decisionsPath, decisionsJsonPath, lessonsPath, lessonsJsonPath, _loadDecisions, _saveDecisions, _loadLessons, _saveLessons, _withLock } = deps;
   root = absRoot(root);
   const apply = !!opts.yes;
+  if (apply && typeof _withLock !== 'function') throw new Error('migrate apply requires the canonical store lock dependency');
+  const withLock = typeof _withLock === 'function' ? _withLock : (_target, fn) => fn();
   const applied = [];   // 안전하게 적용 가능(또는 dry-run 예정): canonical 백필
   const skipped = [];   // apply 범위 외: 수동 조치 필요
   // canonical-pending: MD 항목 존재 + JSON 부재 → load(MD 백필)→save(canonical JSON + MD 정규화). idempotent(UR-0053).
   if (exists(decisionsPath(root)) && !exists(decisionsJsonPath(root)) && _loadDecisions(root).length > 0) {
-    if (apply) _saveDecisions(root, _loadDecisions(root));
-    applied.push({ kind: 'canonical-backfill', detail: 'decisions.md → decisions.json' });
+    let changed = !apply;
+    if (apply) {
+      // 1.36.169 (T-0108): exists/load/save 전체가 decision add/drop/restore와 같은 락 안이어야 한다.
+      // 바깥에서 읽은 legacy snapshot을 락 획득 뒤 쓰면 그 사이 추가된 결정을 지울 수 있다.
+      changed = withLock(decisionsJsonPath(root), () => {
+        if (!exists(decisionsPath(root)) || exists(decisionsJsonPath(root))) return false;
+        const current = _loadDecisions(root);
+        if (!current.length) return false;
+        _saveDecisions(root, current);
+        return true;
+      });
+    }
+    if (changed) applied.push({ kind: 'canonical-backfill', detail: 'decisions.md → decisions.json' });
   }
   if (exists(lessonsPath(root)) && !exists(lessonsJsonPath(root)) && _loadLessons(root).length > 0) {
-    if (apply) _saveLessons(root, _loadLessons(root));
-    applied.push({ kind: 'canonical-backfill', detail: 'lessons.md → lessons.json' });
+    let changed = !apply;
+    if (apply) {
+      changed = withLock(lessonsJsonPath(root), () => {
+        if (!exists(lessonsPath(root)) || exists(lessonsJsonPath(root))) return false;
+        const current = _loadLessons(root);
+        if (!current.length) return false;
+        _saveLessons(root, current);
+        return true;
+      });
+    }
+    if (changed) applied.push({ kind: 'canonical-backfill', detail: 'lessons.md → lessons.json' });
   }
   // version-drift / 누락 파일 — apply 가 안전하게 in-place 처리 불가(npm 재설치/재초기화 필요) → 수동 안내.
   const hvPath = path.join(root, '.leerness', 'HARNESS_VERSION');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leerness",
-  "version": "1.36.167",
+  "version": "1.36.169",
   "description": "The AI-coding operations layer that makes \"done\" require evidence — persistent memory, evidence-gated completion checks, and clean handoffs for any AI agent (Claude Code, Codex, Cursor). State lives as plain files in your repo. CLI + MCP, 0 runtime dependencies.",
   "keywords": [
     "leerness",
@@ -48,12 +48,13 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js",
-    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js",
-    "test:commands": "node ./scripts/command-flags-probe.js && node ./scripts/claims-baseline-probe.js && node ./scripts/claims-baseline-concurrency-probe.js && node ./scripts/e2e-command-surface.js",
+    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js",
+    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js",
+    "test:commands": "node ./scripts/command-flags-probe.js && node ./scripts/next-action-suggestion-probe.js && node ./scripts/claims-baseline-probe.js && node ./scripts/claims-baseline-concurrency-probe.js && node ./scripts/e2e-command-surface.js",
+    "test:next-actions": "node ./scripts/next-action-suggestion-probe.js",
     "test:installed": "node ./scripts/installed-cleanroom-probe.js",
     "test:handoff": "node ./scripts/handoff-readonly-probe.js",
-    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/smoke.js",
+    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/smoke.js",
     "test:smoke": "node ./scripts/smoke.js",
     "lint": "node ./scripts/lint.js",
     "prepack": "node ./bin/leerness.js readme sync . && node ./bin/leerness.js --version"

package/scripts/e2e-concurrency.js

@@ -44,8 +44,11 @@ function spawn(d, args, stallTarget) {
 }
 
 function waitForStall(d, target) {
-  const re = new RegExp('^' + target.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\.tmp-');
-  const hd = path.join(d, '.leerness');
+  const normalized = target.replace(/\\/g, '/');
+  const targetDir = path.dirname(normalized) === '.' ? '' : path.dirname(normalized);
+  const targetName = path.basename(normalized);
+  const re = new RegExp('^' + targetName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\.tmp-');
+  const hd = path.join(d, '.leerness', targetDir);
   for (let i = 0; i < 800; i++) {
     try { if (fs.readdirSync(hd).some(name => re.test(name))) return true; } catch {}
     nap(10);
@@ -60,6 +63,7 @@ async function race(name, config) {
     if (config.seed) config.seed(d);
     const first = spawn(d, config.first, config.stallTarget);
     const stalled = waitForStall(d, config.stallTarget);
+    if (config.beforeSecond) config.beforeSecond(d);
     const second = spawn(d, config.second);
     const exits = await Promise.all([wait(first), wait(second)]);
     const inspected = config.inspect(d);
@@ -132,6 +136,73 @@ async function race(name, config) {
       return { archived: plan.includes('archived'), survivor: plan.includes('survivor'), preserved: plan.includes('archived') && plan.includes('survivor') };
     }
   }));
+  results.push(await race('plan-init-vs-remove', {
+    stallTarget: 'plan.md',
+    seed: d => run(d, ['plan', 'add', 'victim']),
+    first: ['plan', 'remove', 'victim'],
+    second: ['plan', 'init', '--goal', 'survivor-goal'],
+    inspect: d => {
+      const plan = fs.readFileSync(path.join(d, '.leerness', 'plan.md'), 'utf8');
+      return {
+        victimRemoved: !plan.includes('victim'),
+        survivorPreserved: plan.includes('survivor-goal'),
+        preserved: !plan.includes('victim') && plan.includes('survivor-goal')
+      };
+    }
+  }));
+  results.push(await race('anchors-plan-vs-plan-add', {
+    stallTarget: 'plan.md',
+    seed: d => fs.writeFileSync(path.join(d, 'package.json'), JSON.stringify({ name: 'probe', version: '1.0.0', description: 'coordination probe' })),
+    first: ['anchors', 'draft', '--apply'],
+    second: ['plan', 'add', 'survivor-milestone'],
+    inspect: d => {
+      const plan = fs.readFileSync(path.join(d, '.leerness', 'plan.md'), 'utf8');
+      return { survivorPreserved: plan.includes('survivor-milestone'), preserved: plan.includes('survivor-milestone') };
+    }
+  }));
+  results.push(await race('migrate-decisions-vs-add', {
+    stallTarget: 'decisions.json',
+    seed: d => {
+      run(d, ['decision', 'add', 'legacy-decision']);
+      fs.unlinkSync(path.join(d, '.leerness', 'decisions.json'));
+    },
+    first: ['migrate', 'apply', '--yes'],
+    second: ['decision', 'add', 'survivor-decision'],
+    inspect: d => {
+      const titles = JSON.parse(fs.readFileSync(path.join(d, '.leerness', 'decisions.json'), 'utf8')).map(item => item.title);
+      return { titles, preserved: titles.includes('legacy-decision') && titles.includes('survivor-decision') };
+    }
+  }));
+  results.push(await race('migrate-lessons-vs-save', {
+    stallTarget: 'lessons.json',
+    seed: d => {
+      run(d, ['lesson', 'save', 'legacy-lesson']);
+      fs.unlinkSync(path.join(d, '.leerness', 'lessons.json'));
+    },
+    first: ['migrate', 'apply', '--yes'],
+    second: ['lesson', 'save', 'survivor-lesson'],
+    inspect: d => {
+      const texts = JSON.parse(fs.readFileSync(path.join(d, '.leerness', 'lessons.json'), 'utf8')).map(item => item.text);
+      return { texts, preserved: texts.includes('legacy-lesson') && texts.includes('survivor-lesson') };
+    }
+  }));
+  results.push(await race('rule-cache-verify-vs-verify', {
+    stallTarget: 'cache/rule-state.json',
+    seed: d => {
+      const pkg = version => fs.writeFileSync(path.join(d, 'package.json'), JSON.stringify({ name: 'probe', version }));
+      pkg('1.0.0');
+      run(d, ['rule', 'add', 'version bump required', '--trigger', 'every-update']);
+      run(d, ['rule', 'verify']);
+      pkg('1.0.1');
+    },
+    beforeSecond: d => fs.writeFileSync(path.join(d, 'package.json'), JSON.stringify({ name: 'probe', version: '1.0.2' })),
+    first: ['rule', 'verify'],
+    second: ['rule', 'verify'],
+    inspect: d => {
+      const cached = JSON.parse(fs.readFileSync(path.join(d, '.leerness', 'cache', 'rule-state.json'), 'utf8'));
+      return { cachedVersion: cached.packageVersion, preserved: cached.packageVersion === '1.0.2' };
+    }
+  }));
   const ok = results.every(result => result.ok);
   console.log(JSON.stringify({ ok, results }));
   if (!ok) process.exitCode = 1;

package/scripts/e2e.js

@@ -10688,7 +10688,10 @@ total++;
     if (syncUrl) CASES.push(['provider sync', ['provider', 'sync', syncUrl]]);
     dbg.syncCovered = !!syncUrl;
     const offenders = [], failedCmds = [];
-    const keysByFile = {};   // 파일 → 그 파일을 쓸 때 쥐고 있던 락 키 집합(명령을 가로질러 모은다)
+    // 파일 → 모든 쓰기에서 공통으로 쥔 락 키의 교집합. 보조 락이 더해져도 canonical 락이
+    // 공통이면 상호배제는 유지된다(예: progress → plan 순서의 2파일 transaction).
+    const commonKeysByFile = {};
+    const keySetsByFile = {};
     let lockedSeen = 0, rows = 0;
     for (const [label, argv, seed] of CASES) {
       const d = path.join(sb, label.replace(/[^a-z0-9]+/gi, '_'));
@@ -10713,8 +10716,10 @@ total++;
         byFile[l.file] = (l.file in byFile ? byFile[l.file] : true) && l.locked;
         // 어느 락 키로 지켰는지 모은다 — 파일 자신의 락이 아니면 다른 명령과 서로 배제되지 않는다.
         if (l.locked && !DERIVED.test(l.file) && !EXEMPT[l.file]) {
-          (keysByFile[l.file] = keysByFile[l.file] || new Set());
-          for (const k of (l.heldOn || [])) keysByFile[l.file].add(k);
+          const held = new Set(l.heldOn || []);
+          (keySetsByFile[l.file] = keySetsByFile[l.file] || new Set()).add([...held].sort().join(' + ') || '(none)');
+          if (!commonKeysByFile[l.file]) commonKeysByFile[l.file] = held;
+          else commonKeysByFile[l.file] = new Set([...commonKeysByFile[l.file]].filter(k => held.has(k)));
         }
       }
       for (const [f, lockedOk] of Object.entries(byFile)) {
@@ -10728,11 +10733,12 @@ total++;
     // codex 검수 P2(재현됨): "락을 하나라도 쥐었나" 는 너무 약하다. 상호배제는 **같은 키**를 쥘 때만 성립한다.
     //   session close 는 session-handoff.md.lock 을 쥔 채 current-state.md 를 썼고 audit --fix 는
     //   current-state.md.lock 을 쥐었다 — 둘 다 '락 보유' 인 채로 audit 의 갱신이 덮였다.
-    //   올바른 불변식은 "자기 이름의 락" 이 아니라 **"그 파일의 모든 쓰기가 같은 키를 쓴다"** 이다.
-    //   (decisions.md 를 decisions.json.lock 아래에서 쓰는 것은 정상 — 그 파일을 쓰는 유일한 경로가 거기뿐이면.)
+    //   올바른 불변식은 "자기 이름의 락" 이 아니라 **"그 파일의 모든 쓰기가 적어도 한 canonical 키를 공유한다"** 이다.
+    //   (decisions.md 를 decisions.json.lock 아래에서 쓰는 것은 정상이고, progress→plan transaction처럼
+    //   보조 락이 더해진 쓰기도 공통 plan.md.lock/progress-tracker.md.lock가 남으면 정상이다.)
     const wrongKey = [];
-    for (const [f, keys] of Object.entries(keysByFile)) {
-      if (keys.size !== 1) wrongKey.push(f + ' ← 서로 다른 락 ' + [...keys].sort().join(' / '));
+    for (const [f, common] of Object.entries(commonKeysByFile)) {
+      if (common.size === 0) wrongKey.push(f + ' ← 공통 락 없음 (' + [...keySetsByFile[f]].sort().join(' / ') + ')');
     }
     dbg.wrongKey = wrongKey;
     dbg.offenders = offenders;
@@ -10746,7 +10752,7 @@ total++;
     ok = dbg.probeAlive && dbg.coverage && dbg.syncCovered && offenders.length === 0 && wrongKey.length === 0;
     try { srv.kill(); } catch {}
   } catch (e) { dbg.err = String(e && e.message).slice(0, 200); } finally { try { fs.rmSync(sb, { recursive: true, force: true }); } catch {} }
-  console.log(ok ? `✓ L(1.36.108/T-0097) 사용자 상태 쓰기 ${dbg.rows}건 전부 락 안 + 파일당 락 키 일관 (락 관측 ${dbg.lockedSeen}건 = 계측 살아있음 · 명령 실패 0)`
+  console.log(ok ? `✓ L(1.36.108/T-0097, 1.36.169/T-0108) 사용자 상태 쓰기 ${dbg.rows}건 전부 락 안 + 파일별 canonical 락 교집합 존재 (락 관측 ${dbg.lockedSeen}건 = 계측 살아있음 · 명령 실패 0)`
     : '✗ 1.36.108 락 불변식 위반 ' + JSON.stringify(dbg));
   if (!ok) failed++;
 }
@@ -15527,8 +15533,8 @@ total++;
 }
 
 total++;
-// AO(1.36.152/T-0115) — write 시점의 락 관측만으로는 "읽은 사본도 락 안인가"를 증명할 수 없다.
-// 첫 프로세스의 최종 rename을 강제로 멈추고 두 번째 쓰기를 붙여, 서로 다른 RMW 여섯 쌍이 모두 생존하는지 확인한다.
+// AO(1.36.152/T-0115, 1.36.169/T-0108 확장) — write 시점의 락 관측만으로는 "읽은 사본도 락 안인가"를 증명할 수 없다.
+// 첫 프로세스의 최종 rename을 강제로 멈추고 두 번째 쓰기를 붙여, 서로 다른 RMW 11쌍이 모두 생존하는지 확인한다.
 {
   let ok = false; const dbg = {};
   try {
@@ -15543,9 +15549,9 @@ total++;
     dbg.exit = race.status; dbg.report = report;
     if (!report) dbg.stderr = String(race.stderr || '').slice(0, 500);
     ok = race.status === 0 && !!report && report.ok === true
-      && Array.isArray(report.results) && report.results.length === 6 && report.results.every(r => r.ok === true);
+      && Array.isArray(report.results) && report.results.length === 11 && report.results.every(r => r.ok === true);
   } catch (e) { dbg.err = String(e && e.message || e).slice(0, 200); }
-  console.log(ok ? '✓ AO(1.36.152/T-0115) 지연 경쟁 6쌍 모두 exit 0 + 양쪽 기록 보존'
+  console.log(ok ? '✓ AO(1.36.152/T-0115, 1.36.169/T-0108) 지연 경쟁 11쌍 모두 exit 0 + 양쪽 기록 보존'
     : '✗ 1.36.152 동시 RMW 회귀 ' + JSON.stringify(dbg));
   if (!ok) failed++;
 }