leerness 1.36.171 → 1.36.173

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.36.173 — 2026-08-27
+
+- Memory DELETE 5종(task/decision/lesson/rule/plan)의 성공 --json 경로를 단일 JSON 문서·clean stderr 계약으로 통일했습니다. onEveryChange 자동 로드맵은 JSON 출력에 사람용 로그를 섞지 않으면서 다섯 명령 각각 갱신되며, 명령별 산출물 재생성과 외부 Codex P2 재현을 회귀로 고정했습니다.
+
+## 1.36.172 — 2026-08-27
+
+- GitHub CI에서 재현된 동시 최초 .harness→.leerness 마이그레이션 TOCTOU를 수정했습니다. 라이브 마이그레이션이 두 번째 상태 검사와 충돌 스캔 전에 프로젝트 잠금을 획득하며, 실제 peer EEXIST와 잠금 해제 직전까지의 대기를 검증하는 결정론적 회귀를 fast/core/full 게이트에 연결했습니다.
+
 ## 1.36.171 — 2026-08-27
 
 - MCP handoff/session-close가 호출별 sessionKey로 presence를 등록·종료하고, Windows 환경변수 casing·일회성 marker·legacy case variant·손상 closedAt를 안전하게 처리하도록 개선했습니다. 전용 MCP presence 회귀 22/22와 전체 E2E 467/467를 추가·통과했습니다.

package/README.md

@@ -138,7 +138,7 @@ MIT
 <!-- leerness:project-readme:start -->
 ## Leerness Project Harness
 
-이 프로젝트는 Leerness v1.36.171 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
+이 프로젝트는 Leerness v1.36.173 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
 
 ### 정체성 — AI 에이전트 운영 레이어 (UR-0030)
 
@@ -192,7 +192,7 @@ leerness memory restore decision <date|title>
 
 ### MCP server (외부 AI 통합)
 
-Leerness v1.36.171는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **89개 도구**를 노출:
+Leerness v1.36.173는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **89개 도구**를 노출:
 
 ```jsonc
 // 카테고리별
@@ -213,7 +213,7 @@ Leerness v1.36.171는 stdio JSON-RPC MCP server를 내장합니다 — Claude Co
 `<<autonomous-loop-dynamic>>` 신호만 보내면 AI가:
 1) 다음 라운드 후보 선정 → 2) 코드 변경 → 3) 회귀 테스트 갱신 → 4) 전체 e2e 스위트 통과 → 5) npm publish + git tag → 6) main push → 7) session close → 8) 다음 라운드 예약.
 
-현재 누적: **v1.9.x → 1.36.171 릴리스 태그 이력** (수백 라운드) · _reports/는 비공개 보존.
+현재 누적: **v1.9.x → 1.36.173 릴리스 태그 이력** (수백 라운드) · _reports/는 비공개 보존.
 
 ### 성능 가이드
 
@@ -251,5 +251,5 @@ leerness release pack --close --auto-main-push
 - `.leerness/session-handoff.md`: 다음 세션 인수인계 (자동 작성)
 - `.leerness/lessons.md` / `decisions.md` / `rules.md`: 영구 메모리 (5 surface)
 
-Last synced by Leerness v1.36.171: 2026-08-27
+Last synced by Leerness v1.36.173: 2026-08-27
 <!-- leerness:project-readme:end -->

package/bin/leerness.js

@@ -48,7 +48,7 @@ const {
   migrateLegacyWorkspace,
 } = require('../lib/workspace-dir');
 
-const VERSION = '1.36.171';
+const VERSION = '1.36.173';
 
 // MCP lifecycle 주소 표식은 현재 CLI 호출 한 번에만 유효하다. CLI bootstrap에서 즉시 env에서
 // 떼어 두어 `--no-record`/hook처럼 presence 기록 함수에 도달하지 않는 경로도 후속 child에 유출하지 않는다.
@@ -10619,7 +10619,37 @@ function _p0103JsonOk() {
     // ④ --json 이 아예 구현되지 않아 사람용 텍스트를 내던 표면(게시본 3/30) — 계약 스윕
     const sweepBad = [['consistency', 'check', '--json'], ['agent-mode', 'tick', '--json'], ['graph', '--json']]
       .filter(a => !parse(R(a)));
-    return failuresOk && successOk && keepOk && sweepBad.length === 0;
+    // ⑤ Memory DELETE 성공 경로도 같은 계약을 지킨다. 종전에는 mutation은 끝냈지만
+    // stdout은 비고 사람용 ✓ 문구만 stderr에 남아 JSON 소비자가 성공할 때만 깨졌다(T-0093).
+    const taskAdded = parse(R(['task', 'add', 'json-delete-task', '--json']));
+    R(['decision', 'add', 'json-delete-decision']);
+    R(['lesson', 'save', 'json-delete-lesson']);
+    const ruleAdded = parse(R(['rule', 'add', 'json-delete-rule', '--trigger', 'every-session', '--json']));
+    R(['plan', 'add', 'json-delete-plan']);
+    if (!taskAdded?.id || !ruleAdded?.id) return false;
+    fs.mkdirSync(path.join(proj, '.leerness', 'cache'), { recursive: true });
+    fs.writeFileSync(path.join(proj, '.leerness', 'cache', 'auto-roadmap.json'), JSON.stringify({ enabled: true, onEveryChange: true }));
+    const liveEnv = Object.assign({}, process.env, { LEERNESS_OFFLINE: '1' });
+    delete liveEnv.LEERNESS_NO_AUTO_ROADMAP;
+    const RLive = (a) => cp2.spawnSync(process.execPath, [__filename, ...a], { cwd: proj, encoding: 'utf8', timeout: 180000, env: liveEnv });
+    const deleteArgs = [
+      ['task', 'drop', taskAdded.id, '--json'],
+      ['decision', 'drop', 'json-delete-decision', '--json'],
+      ['lesson', 'drop', 'json-delete-lesson', '--json'],
+      ['rule', 'remove', ruleAdded.id, '--json'],
+      ['plan', 'remove', 'json-delete-plan', '--json'],
+    ];
+    const graphPath = path.join(proj, 'leerness.html');
+    const deleteResults = [];
+    let roadmapOk = true;
+    for (const args of deleteArgs) {
+      fs.rmSync(graphPath, { force: true });
+      deleteResults.push(RLive(args));
+      roadmapOk = roadmapOk && fs.existsSync(graphPath);
+    }
+    const deleteOk = deleteResults.every(r => r.status === 0 && !(r.stderr || '').trim() && parse(r)?.ok === true)
+      && roadmapOk;
+    return failuresOk && successOk && keepOk && sweepBad.length === 0 && deleteOk;
   } catch { return false; } finally { try { fs.rmSync(arena, { recursive: true, force: true }); } catch { /* 정리 실패는 판정과 무관 */ } }
 }
 // 1.36.103: 값-플래그 등록 완전성 + 오타 가시성 회귀 가드.
@@ -14688,9 +14718,9 @@ function planProgress(root, opts = {}) {
 //   Memory Surface DELETE 5종 완전 완성 (task drop / decision drop / lesson drop / rule remove / plan remove)
 function planRemoveCmd(root, target) {
   root = absRoot(root);
-  if (!target) return fail('plan remove <M-XXXX|title-substring> 필요 — 매칭되는 milestone 블록을 제거하고 .leerness/plan.archive.md에 보존');
+  if (!target) return failJson(has('--json'), 'missing_target', 'plan remove <M-XXXX|title-substring> 필요 — 매칭되는 milestone 블록을 제거하고 .leerness/plan.archive.md에 보존');
   const pp = planPath(root);
-  if (!exists(pp)) return fail('plan.md 없음');
+  if (!exists(pp)) return failJson(has('--json'), 'plan_not_found', 'plan.md 없음');
   let removed = 0;
   let disappeared = false;
   // 1.36.152 (T-0115): plan restore/add와 archive를 공유한다. 락 안에서 다시 읽어야 새 milestone을 덮지 않는다.
@@ -14730,8 +14760,13 @@ function planRemoveCmd(root, target) {
     if (removed === 0) return;
     writeUtf8(pp, kept.join('\n'));
   });
-  if (disappeared) return fail('plan.md 없음');
+  if (disappeared) return failJson(has('--json'), 'plan_not_found', 'plan.md 없음');
   if (removed === 0) return failJson(has('--json'), 'milestone_not_found', `매칭 milestone 없음: "${target}"`);   // codex P2: --json 에러 구조화
+  if (has('--json')) {
+    _autoRoadmap(absRoot(root), 'data-change', { quiet: true });
+    log(JSON.stringify({ ok: true, surface: 'plan', action: 'remove', target, removedCount: removed, archive: '.leerness/plan.archive.md' }, null, 2));
+    return;
+  }
   ok(`milestone removed: ${removed}건 (보존: .leerness/plan.archive.md)`);
   _autoRoadmap(absRoot(root), 'data-change');
 }
@@ -15065,12 +15100,19 @@ function taskUpdate(root, id) {
 }
 function taskDrop(root, id) {
   if (!_requireInit(root, 'task drop')) return;  // 1.9.396 (6번째 외부평가/codex P1-B): init 가드
-  if (!id) return fail('id required');
+  if (!id) return failJson(has('--json'), 'missing_id', 'id required');
   const rows = readProgressRows(root);
   // 1.9.396 (6번째 외부평가/codex P1-B): 없는 task drop 시 가짜 row(request undefined) 생성 = 데이터 손상 → task update 와 동일하게 존재 확인 후 fail(no-op).
   if (!rows.find(r => r.id === id)) { failJson(has('--json'), 'task_not_found', `task ${id} not found in progress-tracker.md`); return; }  // codex P2: --json 에러 구조화
   const _tdEn = _uiLang(root) === 'en';   // 1.36.63 (검수 #2)
-  upsertProgress(root, { id, status: 'dropped', evidence: arg('--reason', _tdEn ? 'dropped by user request' : '사용자 요청으로 제외'), nextAction: _tdEn ? 'none' : '없음' });
+  const evidence = arg('--reason', _tdEn ? 'dropped by user request' : '사용자 요청으로 제외');
+  const nextAction = _tdEn ? 'none' : '없음';
+  upsertProgress(root, { id, status: 'dropped', evidence, nextAction });
+  if (has('--json')) {
+    _autoRoadmap(absRoot(root), 'data-change', { quiet: true });
+    log(JSON.stringify({ ok: true, surface: 'tasks', action: 'drop', id, status: 'dropped', evidence, nextAction }, null, 2));
+    return;
+  }
   ok(`task dropped: ${id}`);
   _autoRoadmap(absRoot(root), 'data-change');
 }
@@ -15385,7 +15427,7 @@ function lessonDropCmd(root, target) {
   // 1.36.140 (재검수 P3): 락/쓰기 헬퍼가 부모를 만들기 때문에, 오타 난 `--path` 로 실패하면서도
   //   그 경로와 `.leerness/` 를 만들었다(1.36.139 는 안 만들었다 — 대조군). 없으면 아무것도 만들지 않는다.
   if (!exists(root)) return failJson(has('--json'), 'path_not_found', `경로가 없습니다: ${root} — 디렉토리를 새로 만들지 않았습니다`);
-  if (!target) return fail('lesson drop <date|text-substring> 필요. 예: leerness lesson drop "2026-05-20" 또는 leerness lesson drop "JWT"');
+  if (!target) return failJson(has('--json'), 'missing_target', 'lesson drop <date|text-substring> 필요. 예: leerness lesson drop "2026-05-20" 또는 leerness lesson drop "JWT"');
   // archive 보존 — lessons.archive.md 에 projection MD 블록 형태로 추가
   const archivePath = path.join(root, '.leerness/lessons.archive.md');
   // 1.36.140 (재검수 P1, 재현): 종전엔 락 **밖**에서 매칭한 뒤 락 안에서 `${date}|${text}` 복합 키로
@@ -15417,6 +15459,11 @@ function lessonDropCmd(root, target) {
   });
   if (loadErr === 'no_lessons') return failJson(has('--json'), 'no_lessons', 'lessons 없음');   // codex P2: --json 에러 구조화
   if (loadErr === 'lesson_not_found' || !removed.length) return failJson(has('--json'), 'lesson_not_found', `매칭 lesson 없음: "${target}"`);
+  if (has('--json')) {
+    _autoRoadmap(absRoot(root), 'data-change', { quiet: true });
+    log(JSON.stringify({ ok: true, surface: 'lessons', action: 'drop', target, removedCount: removed.length, archive: '.leerness/lessons.archive.md' }, null, 2));
+    return;
+  }
   ok(`lesson dropped: ${removed.length}건 (보존: .leerness/lessons.archive.md)`);
   _autoRoadmap(absRoot(root), 'data-change');
 }
@@ -15494,7 +15541,7 @@ function decisionDropCmd(root, target) {
   // 1.36.140 (재검수 P3): 락/쓰기 헬퍼가 부모를 만들기 때문에, 오타 난 `--path` 로 실패하면서도
   //   그 경로와 `.leerness/` 를 만들었다(1.36.139 는 안 만들었다 — 대조군). 없으면 아무것도 만들지 않는다.
   if (!exists(root)) return failJson(has('--json'), 'path_not_found', `경로가 없습니다: ${root} — 디렉토리를 새로 만들지 않았습니다`);
-  if (!target) return fail('decision drop <date|title-substring> 필요. 예: leerness decision drop "2026-05-20" 또는 leerness decision drop "PostgreSQL"');
+  if (!target) return failJson(has('--json'), 'missing_target', 'decision drop <date|title-substring> 필요. 예: leerness decision drop "2026-05-20" 또는 leerness decision drop "PostgreSQL"');
   // 1.9.339 (UR-0053): canonical JSON 기준 drop (date 또는 title substring 매칭) — JSON+MD projection 동시 갱신.
   const archivePath = path.join(root, '.leerness/decisions.archive.md');
   // 1.36.138 (동시성 감사 실측): `decision add` 는 락 안인데 **drop 은 락 밖**이었다 —
@@ -15527,6 +15574,11 @@ function decisionDropCmd(root, target) {
   });
   if (loadErr === 'no_decisions') return failJson(has('--json'), 'no_decisions', 'decisions 없음');   // codex P2: --json 에러 구조화
   if (loadErr === 'decision_not_found' || !removed.length) return failJson(has('--json'), 'decision_not_found', `매칭 decision 없음: "${target}"`);
+  if (has('--json')) {
+    _autoRoadmap(absRoot(root), 'data-change', { quiet: true });
+    log(JSON.stringify({ ok: true, surface: 'decisions', action: 'drop', target, removedCount: removed.length, archive: '.leerness/decisions.archive.md' }, null, 2));
+    return;
+  }
   ok(`decision dropped: ${removed.length}건 (보존: .leerness/decisions.archive.md)`);
   _autoRoadmap(absRoot(root), 'data-change');
 }
@@ -22555,7 +22607,8 @@ function _autoRoadmapConfig(root) {
 function _saveAutoRoadmapConfig(root, cfg) {
   writeUtf8(_autoRoadmapConfigPath(root), JSON.stringify(cfg, null, 2) + '\n');
 }
-function _autoRoadmap(root, trigger) {
+function _autoRoadmap(root, trigger, opts = {}) {
+  const quiet = !!(opts && opts.quiet);
   try {
     if (process.env.LEERNESS_NO_AUTO_ROADMAP === '1') return false;
     if (!exists(path.join(root, '.leerness'))) return false;
@@ -22569,10 +22622,10 @@ function _autoRoadmap(root, trigger) {
     const outFile = path.resolve(cfg.outFile || path.join(root, 'leerness.html'));
     const s = _graph.graphHtmlCmd(root, { _roadmapData, _loadDecisions, _loadLessons, _parseFeatureGraph, _loadToggles: _tgl.loadToggles, _toggleRegistry: _tgl.TOGGLE_REGISTRY, _loadTechProfile: _tech.loadTechProfile, quiet: true }, outFile);
     const _en = _uiLang(root) === 'en';
-    log(_en ? `✓ ontology graph auto-updated (${trigger}) — ${rel(root, outFile)} (graph+roadmap+toggles)` : `✓ 온톨로지 그래프 자동 갱신 (${trigger}) — ${rel(root, outFile)} (그래프+로드맵+토글 탭)`);
+    if (!quiet) log(_en ? `✓ ontology graph auto-updated (${trigger}) — ${rel(root, outFile)} (graph+roadmap+toggles)` : `✓ 온톨로지 그래프 자동 갱신 (${trigger}) — ${rel(root, outFile)} (그래프+로드맵+토글 탭)`);
     return true;
   } catch (e) {
-    warn((_uiLang(root) === 'en' ? 'roadmap auto-update failed: ' : 'roadmap 자동 갱신 실패: ') + (e && e.message ? e.message : e));
+    if (!quiet) warn((_uiLang(root) === 'en' ? 'roadmap auto-update failed: ' : 'roadmap 자동 갱신 실패: ') + (e && e.message ? e.message : e));
     return false;
   }
 }
@@ -22850,7 +22903,7 @@ function _updateRules(root, mutate) {
 
 function ruleRemove(root, id) {
   root = absRoot(root);
-  if (!id) return fail('id required');
+  if (!id) return failJson(has('--json'), 'missing_id', 'id required');
   let removed = null;
   const res = _updateRules(root, (rules) => {
     const i = rules.findIndex(r => r.id === id);
@@ -22863,7 +22916,13 @@ function ruleRemove(root, id) {
     return removed;
   });
   if (res.error) return failJson(has('--json'), 'rule_not_found', `rule not found: ${id}`);   // codex P2: --json 에러 구조화
+  if (has('--json')) {
+    _autoRoadmap(root, 'data-change', { quiet: true });
+    log(JSON.stringify({ ok: true, surface: 'rules', action: 'remove', id, removedCount: 1, archive: '.leerness/rules.archive.md' }, null, 2));
+    return;
+  }
   ok(`rule removed: ${id} (보존: .leerness/rules.archive.md)`);
+  _autoRoadmap(root, 'data-change');
 }
 
 function rulePause(root, id) {

package/lib/workspace-dir.js

@@ -376,18 +376,18 @@ function _sameDestinationSnapshot(a, b) {
   return !!a && !!b && a.kind === b.kind && a.hash === b.hash;
 }
 
-function migrateLegacyWorkspace(root, opts = {}) {
-  const state = inspectWorkspace(root);
-  const dryRun = opts.dryRun === true;
-  const force = opts.force === true;
-  const version = String(opts.version || 'unknown');
+const _MIGRATION_LOCK_OWNED = Symbol('leerness.workspace-migration-lock-owned');
+
+function _migrationLockWaitMs(opts = {}) {
+  const parsed = Number(opts.lockWaitMs);
+  return Number.isFinite(parsed) ? Math.max(0, Math.min(60000, parsed)) : 10000;
+}
+
+function _newMigrationReport(state, opts = {}) {
   const at = opts.at || new Date().toISOString();
-  const parsedLockWait = Number(opts.lockWaitMs);
-  const lockWaitMs = Number.isFinite(parsedLockWait)
-    ? Math.max(0, Math.min(60000, parsedLockWait))
-    : 10000;
-  const lockFile = path.join(state.root, '.leerness-workspace-migration.lock');
-  const report = {
+  const version = String(opts.version || 'unknown');
+  const dryRun = opts.dryRun === true;
+  return {
     at,
     version,
     src: state.legacy.abs,
@@ -410,6 +410,74 @@ function migrateLegacyWorkspace(root, opts = {}) {
     waitedForLock: false,
     lockWaitedMs: 0,
   };
+}
+
+// Live first migrations serialize before the second workspace inspection or
+// any destination conflict scan. Acquiring later leaves a TOCTOU window where
+// a peer's in-progress canonical copy is mistaken for user-authored conflict.
+// Dry-runs and already-canonical roots stay read-only and skip lock creation.
+function migrateLegacyWorkspace(root, opts = {}) {
+  const initial = inspectWorkspace(root);
+  if (opts.dryRun === true || opts[_MIGRATION_LOCK_OWNED] === true || !initial.legacy.exists) {
+    return _migrateLegacyWorkspace(initial.root, opts);
+  }
+
+  const lockWaitMs = _migrationLockWaitMs(opts);
+  const lockFile = path.join(initial.root, '.leerness-workspace-migration.lock');
+  const startedAt = Date.now();
+  const deadline = startedAt + lockWaitMs;
+  let lockFd = null;
+  let waited = false;
+
+  while (lockFd === null) {
+    try { lockFd = fs.openSync(lockFile, 'wx'); }
+    catch (error) {
+      if (!error || (error.code !== 'EEXIST' && !_isTransientLockFsError(error))) {
+        const report = _newMigrationReport(initial, opts);
+        report.blocked = true;
+        report.blockedReason = 'workspace-dir-migration-failed';
+        report.errors.push(error && error.message ? error.message : String(error));
+        report.waitedForLock = waited;
+        report.lockWaitedMs = waited ? Math.max(0, Date.now() - startedAt) : 0;
+        return report;
+      }
+      waited = true;
+      if (Date.now() >= deadline) {
+        const report = _newMigrationReport(initial, opts);
+        report.blocked = true;
+        report.blockedReason = 'workspace-dir-migration-locked';
+        report.errors.push(`another workspace migration still owns: ${lockFile}`);
+        report.waitedForLock = true;
+        report.lockWaitedMs = Math.max(0, Date.now() - startedAt);
+        return report;
+      }
+      _sleepSync(Math.min(50, Math.max(1, deadline - Date.now())));
+    }
+  }
+
+  try {
+    const report = _migrateLegacyWorkspace(initial.root, { ...opts, [_MIGRATION_LOCK_OWNED]: true });
+    if (waited) {
+      report.waitedForLock = true;
+      report.lockWaitedMs = Math.max(report.lockWaitedMs || 0, Date.now() - startedAt);
+    }
+    return report;
+  } finally {
+    try { fs.closeSync(lockFd); } catch {}
+    _removeOwnedLockFile(lockFile);
+  }
+}
+
+function _migrateLegacyWorkspace(root, opts = {}) {
+  const state = inspectWorkspace(root);
+  const dryRun = opts.dryRun === true;
+  const migrationLockOwned = opts[_MIGRATION_LOCK_OWNED] === true;
+  const force = opts.force === true;
+  const version = String(opts.version || 'unknown');
+  const at = opts.at || new Date().toISOString();
+  const lockWaitMs = _migrationLockWaitMs(opts);
+  const lockFile = path.join(state.root, '.leerness-workspace-migration.lock');
+  const report = _newMigrationReport(state, opts);
 
   const block = (reason, message, extra = {}) => {
     report.blocked = true;
@@ -423,7 +491,7 @@ function migrateLegacyWorkspace(root, opts = {}) {
   // look foreign or dual-live while copying. Observe that transaction before
   // applying any conflict verdict; otherwise simultaneous first handoffs race
   // against an intermediate state and some fail before reaching the lock.
-  if (!dryRun && fs.existsSync(lockFile)) {
+  if (!dryRun && !migrationLockOwned && fs.existsSync(lockFile)) {
     const peerStartedAt = Date.now();
     const peerDeadline = peerStartedAt + lockWaitMs;
     report.waitedForLock = true;
@@ -559,7 +627,7 @@ function migrateLegacyWorkspace(root, opts = {}) {
   const stamp = at.replace(/[^A-Za-z0-9_-]/g, '-').slice(0, 96) || String(Date.now());
   const migrationRoot = path.join(state.canonical.abs, 'archive', `workspace-dir-migration-${stamp}`);
   const canonicalBackup = path.join(migrationRoot, 'canonical-before-merge');
-  let lockFd = null;
+  let lockFd = migrationLockOwned ? undefined : null;
   const created = [];
   const overwritten = [];
   const canonicalExisted = state.canonical.exists;
@@ -750,7 +818,7 @@ function migrateLegacyWorkspace(root, opts = {}) {
     }
     return report;
   } finally {
-    if (lockFd !== null) {
+    if (!migrationLockOwned && lockFd !== null) {
       try { fs.closeSync(lockFd); } catch {}
       _removeOwnedLockFile(lockFile);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leerness",
-  "version": "1.36.171",
+  "version": "1.36.173",
   "description": "The AI-coding operations layer that makes \"done\" require evidence — persistent memory, evidence-gated completion checks, and clean handoffs for any AI agent (Claude Code, Codex, Cursor). State lives as plain files in your repo. CLI + MCP, 0 runtime dependencies.",
   "keywords": [
     "leerness",
@@ -48,13 +48,14 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && node ./scripts/mcp-presence-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js",
-    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && node ./scripts/mcp-presence-probe.js",
+    "test": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && node ./scripts/mcp-presence-probe.js && npm run test:commands && npm run test:installed && node ./scripts/e2e.js",
+    "test:core": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/verify-code-cross-runtime-probe.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./bin/leerness.js --version && node ./bin/leerness.js selftest && node ./scripts/e2e-core.js && node ./scripts/handoff-readonly-probe.js && node ./scripts/mcp-presence-probe.js",
     "test:commands": "node ./scripts/command-flags-probe.js && node ./scripts/next-action-suggestion-probe.js && node ./scripts/claims-baseline-probe.js && node ./scripts/claims-baseline-concurrency-probe.js && node ./scripts/e2e-command-surface.js",
     "test:next-actions": "node ./scripts/next-action-suggestion-probe.js",
     "test:installed": "node ./scripts/installed-cleanroom-probe.js",
     "test:handoff": "node ./scripts/handoff-readonly-probe.js",
-    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/mcp-presence-probe.js && node ./scripts/smoke.js",
+    "test:fast": "node ./scripts/lint.js && node ./scripts/workspace-dir-source-ratchet.js && node ./scripts/workspace-dir-migration-probe.js && node ./scripts/workspace-dir-lock-order-probe.js && node ./scripts/lock-probe.js && node ./scripts/platform-smoke.js && node ./scripts/release-runtime-probe.js && node ./scripts/which-shim-probe.js && node ./scripts/mcp-presence-probe.js && node ./scripts/smoke.js",
+    "test:workspace-lock-order": "node ./scripts/workspace-dir-lock-order-probe.js",
     "test:mcp-presence": "node ./scripts/mcp-presence-probe.js",
     "test:smoke": "node ./scripts/smoke.js",
     "lint": "node ./scripts/lint.js",

package/scripts/e2e-core.js

@@ -207,12 +207,40 @@ console.log('# leerness core (test:core) — flagship behavioral guarantees');
 // (10) --json 무결성: 변형/조회 명령이 성공 경로에서도 유효 JSON (1.36.0, 클린룸 리뷰 B)
 {
   const d = fresh();
-  const okJson = (r) => { try { JSON.parse((r.stdout || '').trim()); return true; } catch { return false; } };
-  run(d, ['task', 'add', 'sample']);
+  const jsonResult = (r) => { try { return JSON.parse((r.stdout || '').trim()); } catch { return null; } };
+  const okJson = (r) => { const payload = jsonResult(r); return r.status === 0 && !(r.stderr || '').trim() && payload !== null && payload.ok !== false; };
+  const addedTask = jsonResult(run(d, ['task', 'add', 'sample', '--json']));
   assert('json: task update --status done --json → valid JSON (was plain text)', okJson(run(d, ['task', 'update', 'T-0002', '--status', 'done', '--json'])));
   assert('json: plan add --json → valid JSON', okJson(run(d, ['plan', 'add', 'a milestone', '--json'])));
   assert('json: rule verify --json → valid JSON', okJson(run(d, ['rule', 'verify', '--json'])));
   assert('json: reuse find --json → valid JSON', okJson(run(d, ['reuse', 'find', 'button', '--json'])));
+
+  // T-0093: Memory DELETE 다섯 표면은 mutation은 성공하면서 JSON을 전혀 내지 않고
+  // 사람용 ✓ 문구만 stderr에 썼다. 성공 payload와 stderr-0을 함께 고정한다.
+  run(d, ['decision', 'add', 'json delete decision']);
+  run(d, ['lesson', 'save', 'json delete lesson']);
+  const addedRule = jsonResult(run(d, ['rule', 'add', 'json delete rule', '--trigger', 'every-session', '--json']));
+  run(d, ['plan', 'add', 'json delete milestone']);
+  run(d, ['roadmap', 'auto', 'on', '--on-every-change']);
+  const deleteCases = [
+    ['task drop', ['task', 'drop', addedTask.id, '--json'], 'tasks'],
+    ['decision drop', ['decision', 'drop', 'json delete decision', '--json'], 'decisions'],
+    ['lesson drop', ['lesson', 'drop', 'json delete lesson', '--json'], 'lessons'],
+    ['rule remove', ['rule', 'remove', addedRule.id, '--json'], 'rules'],
+    ['plan remove', ['plan', 'remove', 'json delete milestone', '--json'], 'plan'],
+  ];
+  const graphPath = path.join(d, 'leerness.html');
+  for (const [label, args, surface] of deleteCases) {
+    fs.rmSync(graphPath, { force: true });
+    const result = run(d, args);
+    const payload = jsonResult(result);
+    assert(`json: ${label} --json → one success document + clean stderr + silent roadmap refresh`,
+      result.status === 0 && !(result.stderr || '').trim() && payload?.ok === true
+      && payload.surface === surface
+      && (surface === 'tasks' ? payload.status === 'dropped' : payload.removedCount === 1)
+      && fs.existsSync(graphPath),
+      `status=${result.status} stdout=${result.stdout} stderr=${result.stderr}`);
+  }
   fs.rmSync(d, { recursive: true, force: true });
 }
 

package/scripts/workspace-dir-lock-order-probe.js

@@ -0,0 +1,206 @@
+#!/usr/bin/env node
+'use strict';
+
+// A live legacy migration must own its project lock before the second workspace
+// inspection. Otherwise a peer can populate `.leerness/` after validation and
+// make the first caller misclassify the peer's intermediate copy as a user
+// conflict. This probe forces that interleaving without relying on scheduler luck.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const cp = require('child_process');
+const workspace = require('../lib/workspace-dir');
+
+const IS_PEER = process.argv[2] === '--peer';
+const root = IS_PEER
+  ? path.resolve(process.argv[3] || '.')
+  : fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-lock-order-'));
+const legacy = path.join(root, workspace.LEGACY_WORKSPACE_DIR);
+const canonical = path.join(root, workspace.CANONICAL_WORKSPACE_DIR);
+const lockFile = path.join(root, '.leerness-workspace-migration.lock');
+const peerReadyFile = path.join(root, '.leerness-lock-order-peer-ready');
+const peerContendedFile = path.join(root, '.leerness-lock-order-peer-contended');
+const peerDoneFile = path.join(root, '.leerness-lock-order-peer-done');
+
+function write(file, body) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, body, 'utf8');
+}
+
+function sleep(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function waitForPeerHandshake(timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const ready = fs.existsSync(peerReadyFile);
+    const contended = fs.existsSync(peerContendedFile);
+    const done = fs.existsSync(peerDoneFile);
+    if (ready && (contended || done)) return { ready, contended, done };
+    sleep(2);
+  }
+  return {
+    ready: fs.existsSync(peerReadyFile),
+    contended: fs.existsSync(peerContendedFile),
+    done: fs.existsSync(peerDoneFile),
+  };
+}
+
+function runPeer() {
+  const originalOpen = fs.openSync;
+  fs.openSync = function patchedOpen(target, flags, ...rest) {
+    try { return originalOpen.call(fs, target, flags, ...rest); }
+    catch (error) {
+      if (path.resolve(String(target)) === lockFile && flags === 'wx' && error && error.code === 'EEXIST') {
+        write(peerContendedFile, `${process.pid}\n`);
+      }
+      throw error;
+    }
+  };
+
+  write(peerReadyFile, `${process.pid}\n`);
+  let report;
+  try {
+    report = workspace.migrateLegacyWorkspace(root, {
+      version: 'lock-order-peer',
+      lockWaitMs: 20000,
+      at: '2026-08-27T00:00:01.000Z',
+    });
+  } finally {
+    fs.openSync = originalOpen;
+  }
+  write(peerDoneFile, `${JSON.stringify(report)}\n`);
+  if (!report || report.blocked || (!report.migrated && !report.alreadyCanonical)) process.exitCode = 1;
+}
+
+async function main() {
+  if (IS_PEER) {
+    runPeer();
+    return;
+  }
+
+  write(path.join(legacy, 'HARNESS_VERSION'), '1.36.161\n');
+  write(path.join(legacy, 'progress-tracker.md'), `# Read ${workspace.LEGACY_WORKSPACE_DIR}/progress-tracker.md\n`);
+  for (let i = 0; i < 1200; i++) {
+    write(path.join(legacy, 'bulk', `f-${String(i).padStart(4, '0')}.md`),
+      `Read ${workspace.LEGACY_WORKSPACE_DIR}/bulk/${i}\n${'x'.repeat(2048)}\n`);
+  }
+
+  const originalLstat = fs.lstatSync;
+  const originalUnlink = fs.unlinkSync;
+  let canonicalInspections = 0;
+  let peer = null;
+  let peerDone = null;
+  let earlyLockSeen = false;
+  let peerReadySeen = false;
+  let peerContentionSeen = false;
+  let peerCompletedBeforeRelease = false;
+  let lockReleaseObserved = false;
+  let peerBlockedUntilRelease = false;
+
+  fs.lstatSync = function patchedLstat(target, ...rest) {
+    const isCanonicalRoot = path.resolve(String(target)) === canonical;
+    let result;
+    let thrown;
+    try { result = originalLstat.call(fs, target, ...rest); }
+    catch (error) { thrown = error; }
+
+    if (isCanonicalRoot && ++canonicalInspections === 2) {
+      earlyLockSeen = fs.existsSync(lockFile);
+      peer = cp.spawn(process.execPath, [__filename, '--peer', root], {
+        cwd: root,
+        env: {
+          ...process.env,
+          LEERNESS_INTERNAL: '1',
+          LEERNESS_NO_BANNER: '1',
+          LEERNESS_NO_PROMPT: '1',
+          LEERNESS_NO_AUTOCHCP: '1',
+        },
+        stdio: ['ignore', 'ignore', 'ignore'],
+      });
+      peerDone = new Promise((resolve) => peer.on('close', (status) => resolve(status)));
+
+      // The child records an actual failed `open(..., "wx")`, not merely that
+      // it was spawned. This proves it reached lock acquisition while the
+      // victim is paused inside its second canonical workspace inspection.
+      const handshake = waitForPeerHandshake(20000);
+      peerReadySeen = handshake.ready;
+      peerContentionSeen = handshake.contended;
+      peerCompletedBeforeRelease = handshake.done;
+    }
+
+    if (thrown) throw thrown;
+    return result;
+  };
+  fs.unlinkSync = function patchedUnlink(target, ...rest) {
+    if (path.resolve(String(target)) === lockFile) {
+      lockReleaseObserved = true;
+      peerBlockedUntilRelease = peerReadySeen
+        && peerContentionSeen
+        && !fs.existsSync(peerDoneFile)
+        && peer !== null
+        && peer.exitCode === null;
+    }
+    return originalUnlink.call(fs, target, ...rest);
+  };
+
+  let victim;
+  try {
+    victim = workspace.migrateLegacyWorkspace(root, {
+      version: 'lock-order-probe',
+      lockWaitMs: 20000,
+      at: '2026-08-27T00:00:00.000Z',
+    });
+  } finally {
+    fs.lstatSync = originalLstat;
+    fs.unlinkSync = originalUnlink;
+  }
+
+  const peerStatus = peerDone ? await peerDone : null;
+  const ok = earlyLockSeen
+    && peerReadySeen
+    && peerContentionSeen
+    && !peerCompletedBeforeRelease
+    && lockReleaseObserved
+    && peerBlockedUntilRelease
+    && peerStatus === 0
+    && victim && victim.migrated === true && victim.blocked === false
+    && fs.existsSync(path.join(canonical, 'progress-tracker.md'))
+    && fs.existsSync(path.join(root, workspace.LEGACY_BACKUP_WORKSPACE_DIR, 'progress-tracker.md'))
+    && !fs.existsSync(legacy);
+
+  if (!ok) {
+    process.stderr.write(`WORKSPACE_LOCK_ORDER_RACE ${JSON.stringify({
+      earlyLockSeen,
+      peerReadySeen,
+      peerContentionSeen,
+      peerCompletedBeforeRelease,
+      lockReleaseObserved,
+      peerBlockedUntilRelease,
+      peerStatus,
+      victim: victim && {
+        migrated: victim.migrated,
+        alreadyCanonical: victim.alreadyCanonical,
+        blocked: victim.blocked,
+        blockedReason: victim.blockedReason,
+        errors: victim.errors,
+      },
+    })}\n`);
+    process.exitCode = 1;
+  } else {
+    process.stdout.write('WORKSPACE_LOCK_ORDER_OK\n');
+  }
+}
+
+main()
+  .catch((error) => {
+    process.stderr.write(`WORKSPACE_LOCK_ORDER_CRASH ${error && error.stack ? error.stack : error}\n`);
+    process.exitCode = 1;
+  })
+  .finally(() => {
+    if (!IS_PEER) {
+      try { fs.rmSync(root, { recursive: true, force: true }); } catch {}
+    }
+  });