leerness 1.36.181 → 1.36.183

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.36.183 — 2026-08-31
+
+- T-0163: English skill list now emits zero Hangul across stored, environment, and explicit locale paths while preserving Korean bytes and locale-independent JSON values. Adversarial external-skill metadata and injective ID rendering are covered, and the 39-command leakage ratchet tightens exactly from 34 to 30 lines.
+
+## 1.36.182 — 2026-08-31
+
+- T-0162: English-mode milestones now contains zero Hangul across stored, environment, and explicit locale paths while preserving Korean and locale-independent JSON contracts. The 39-command aggregate leakage ratchet tightens exactly from 38 to 34 lines. External Codex review findings are covered by UTC-midnight-safe ETA comparison and real CLI coverage of the 500+ terminal branch.
+
 ## 1.36.181 — 2026-08-30
 
 - T-0161: English-mode release cadence, idempotency audit, plan list, and round-history now contain zero Hangul across stored, environment, and explicit locale paths. A dedicated edge-state probe preserves Korean output, legacy plan sentinels, locale-independent auto-fix JSON/state writes, and the 39-command leakage ratchet tightens exactly from 58 to 38 lines so improvements cannot mask regressions elsewhere.

package/README.md

@@ -138,7 +138,7 @@ MIT
 <!-- leerness:project-readme:start -->
 ## Leerness Project Harness
 
-이 프로젝트는 Leerness v1.36.181 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
+이 프로젝트는 Leerness v1.36.183 하네스를 사용합니다. AI 에이전트는 작업 전 `leerness handoff`로 컨텍스트를 적재하고, 작업 후 `leerness check`/`leerness audit`/`leerness session close`를 수행해야 합니다.
 
 ### 정체성 — AI 에이전트 운영 레이어 (UR-0030)
 
@@ -192,7 +192,7 @@ leerness memory restore decision <date|title>
 
 ### MCP server (외부 AI 통합)
 
-Leerness v1.36.181는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **89개 도구**를 노출:
+Leerness v1.36.183는 stdio JSON-RPC MCP server를 내장합니다 — Claude Code · Cursor · Codex CLI 등 외부 AI에 **89개 도구**를 노출:
 
 ```jsonc
 // 카테고리별
@@ -213,7 +213,7 @@ Leerness v1.36.181는 stdio JSON-RPC MCP server를 내장합니다 — Claude Co
 `<<autonomous-loop-dynamic>>` 신호만 보내면 AI가:
 1) 다음 라운드 후보 선정 → 2) 코드 변경 → 3) 회귀 테스트 갱신 → 4) 전체 e2e 스위트 통과 → 5) npm publish + git tag → 6) main push → 7) session close → 8) 다음 라운드 예약.
 
-현재 누적: **v1.9.x → 1.36.181 릴리스 태그 이력** (수백 라운드) · _reports/는 비공개 보존.
+현재 누적: **v1.9.x → 1.36.183 릴리스 태그 이력** (수백 라운드) · _reports/는 비공개 보존.
 
 ### 성능 가이드
 
@@ -251,5 +251,5 @@ leerness release pack --close --auto-main-push
 - `.leerness/session-handoff.md`: 다음 세션 인수인계 (자동 작성)
 - `.leerness/lessons.md` / `decisions.md` / `rules.md`: 영구 메모리 (5 surface)
 
-Last synced by Leerness v1.36.181: 2026-08-31
+Last synced by Leerness v1.36.183: 2026-08-31
 <!-- leerness:project-readme:end -->

package/bin/leerness.js

@@ -49,7 +49,7 @@ const {
   migrateLegacyWorkspace,
 } = require('../lib/workspace-dir');
 
-const VERSION = '1.36.181';
+const VERSION = '1.36.183';
 
 // MCP lifecycle 주소 표식은 현재 CLI 호출 한 번에만 유효하다. CLI bootstrap에서 즉시 env에서
 // 떼어 두어 `--no-record`/hook처럼 presence 기록 함수에 도달하지 않는 경로도 후속 child에 유출하지 않는다.
@@ -129,6 +129,16 @@ const README_END = '<!-- leerness:project-readme:end -->';
 
 // 1.9.10: leerness-skillpack 동적 로드 (선택). 없으면 BUILTIN 사용.
 function _tryLoadSkillpack() {
+  // 0) Explicit path overrides ambient installs. Besides matching user intent,
+  // this keeps a pinned pack deterministic on hosts that also have another
+  // copy in cwd or the global npm root.
+  if (process.env.LEERNESS_SKILLPACK_PATH) {
+    try {
+      const f = path.resolve(process.env.LEERNESS_SKILLPACK_PATH);
+      const target = f.endsWith('.json') ? f : path.join(f, 'catalog.json');
+      if (fs.existsSync(target)) return { src: 'env', data: JSON.parse(fs.readFileSync(target, 'utf8')) };
+    } catch {}
+  }
   // 1) 정상 require resolution
   try { return { src: 'require', data: require('leerness-skillpack/catalog.json') }; } catch {}
   // 2) cwd/node_modules
@@ -146,14 +156,6 @@ function _tryLoadSkillpack() {
       if (fs.existsSync(f)) return { src: 'global', data: JSON.parse(fs.readFileSync(f, 'utf8')) };
     }
   } catch {}
-  // 4) 환경변수 명시 경로
-  if (process.env.LEERNESS_SKILLPACK_PATH) {
-    try {
-      const f = path.resolve(process.env.LEERNESS_SKILLPACK_PATH);
-      const target = f.endsWith('.json') ? f : path.join(f, 'catalog.json');
-      if (fs.existsSync(target)) return { src: 'env', data: JSON.parse(fs.readFileSync(target, 'utf8')) };
-    } catch {}
-  }
   return null;
 }
 
@@ -166,12 +168,17 @@ function _loadSkillCatalog() {
     SKILLPACK_META = { name: sp.data.name, version: sp.data.version };
     const out = {};
     for (const s of sp.data.skills) {
+      if (!s || typeof s !== 'object' || typeof s.id !== 'string' || !s.id) continue;
       out[s.id] = {
         displayNameKo: s.displayNameKo,
+        displayNameEn: s.displayNameEn,
+        displayName: s.displayName,
+        name: s.name,
         version: s.version,
         lastUpdated: s.lastUpdated,
         verification: s.verification,
         capabilities: s.capabilities,
+        capabilitiesEn: s.capabilitiesEn,
         _source: 'skillpack'
       };
     }
@@ -2321,6 +2328,81 @@ function _buildAllSkills(root) {
   }
   return out;
 }
+// English human output never guesses a translation. Prefer explicit English
+// metadata, accept already-English legacy metadata, then fall back to the
+// stable skill ID / an empty capability cell. Canonical JSON remains untouched.
+const _SKILL_HANGUL = /\p{Script=Hangul}/u;
+const _SKILL_LETTER = /\p{Letter}/u;
+const _SKILL_LATIN = /\p{Script=Latin}/u;
+function _skillHumanCell(value) {
+  let text = '';
+  try {
+    if (typeof value === 'string') text = value;
+    else if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') text = String(value);
+    else {
+      const encoded = JSON.stringify(value);
+      text = typeof encoded === 'string' ? encoded : '';
+    }
+  } catch {}
+  return text
+    .replace(/[\u0000-\u001F\u007F-\u009F]+/g, ' ')
+    .replace(/\|/g, '&#124;')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+// Korean mode keeps the legacy byte representation for valid scalar metadata.
+// Only malformed values need a total, non-throwing fallback; presentation
+// normalization belongs exclusively to the English table.
+function _skillKoreanValue(value) {
+  if (typeof value === 'string') return value;
+  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') return String(value);
+  try {
+    const encoded = JSON.stringify(value);
+    return typeof encoded === 'string' ? encoded : '';
+  } catch { return ''; }
+}
+function _skillOwnValue(object, key, fallback) {
+  if (object == null || !Object.prototype.hasOwnProperty.call(Object(object), key)) return fallback;
+  const value = object[key];
+  // `undefined` is not representable in a source JSON document and would make
+  // JSON.stringify omit the public key. Preserve every representable falsy or
+  // object value, while retaining the canonical fallback for absent fields.
+  return value === undefined ? fallback : value;
+}
+function _isEnglishSkillText(value) {
+  const text = typeof value === 'string' ? value.trim() : '';
+  return !!text && !_SKILL_HANGUL.test(text)
+    && Array.from(text).every(char => !_SKILL_LETTER.test(char) || _SKILL_LATIN.test(char));
+}
+function _englishSafeSkillId(id) {
+  const projected = Array.from(String(id)).map(char => {
+    const codePoint = char.codePointAt(0);
+    if (char === '\\') return '\\\\';
+    // Spaces must be escaped too: _skillHumanCell intentionally collapses and
+    // trims free text, which would otherwise make `a b`/`a  b` and ` `/`-`
+    // collide. The projected alphabet contains no character that sanitizer
+    // rewrites, while doubled input backslashes distinguish literal escapes.
+    if (codePoint >= 0x21 && codePoint <= 0x7E && char !== '|') return char;
+    return codePoint <= 0xFFFF
+      ? `\\u${codePoint.toString(16).toUpperCase().padStart(4, '0')}`
+      : `\\u{${codePoint.toString(16).toUpperCase()}}`;
+  }).join('');
+  return _skillHumanCell(projected) || '-';
+}
+function _englishSkillText(candidates, fallback) {
+  for (const candidate of candidates) {
+    if (_isEnglishSkillText(candidate)) return _skillHumanCell(candidate);
+  }
+  return _skillHumanCell(fallback);
+}
+function _englishSkillCapabilities(skill) {
+  const preferred = Array.isArray(skill.capabilitiesEn) ? skill.capabilitiesEn : [];
+  const legacy = Array.isArray(skill.capabilities) ? skill.capabilities : [];
+  const clean = values => values.filter(_isEnglishSkillText).map(_skillHumanCell).filter(Boolean);
+  const translated = clean(preferred);
+  return translated.length ? translated : clean(legacy);
+}
+
 // 1.9.66: skill 추가/제거 시 캐시 invalidate (외부 helper)
 function skillList(root) {
   const all = listAllSkills(root);
@@ -2328,25 +2410,58 @@ function skillList(root) {
   if (has('--json')) {
     const items = Object.entries(all).map(([id, v]) => ({
       id,
-      displayNameKo: v.displayNameKo || id,
+      displayNameKo: _skillOwnValue(v, 'displayNameKo', id),
       source: v._source,
-      capabilities: v.capabilities || [],
-      usageCount: v.usage?.count || 0,
-      lastUsed: v.usage?.lastUsed || null,
-      lastUpdated: v.lastUpdated || null
+      capabilities: _skillOwnValue(v, 'capabilities', []),
+      usageCount: _skillOwnValue(v.usage, 'count', 0),
+      lastUsed: _skillOwnValue(v.usage, 'lastUsed', null),
+      lastUpdated: _skillOwnValue(v, 'lastUpdated', null)
     }));
     log(JSON.stringify({ skillpack: SKILLPACK_SOURCE, total: items.length, items }, null, 2));
     return;
   }
-  if (SKILLPACK_SOURCE !== 'builtin') log(`# skillpack 출처: ${SKILLPACK_SOURCE}${SKILLPACK_META ? ` (${SKILLPACK_META.name} v${SKILLPACK_META.version})` : ''}`);
-  else log('# skillpack 미설치 — builtin fallback 사용 (leerness 본 패키지 내장 카탈로그)');
-  log('| ID | 한글명 | 출처 | 능력(요약) | 사용횟수 | 최종 |');
+  const english = _uiLang(root) === 'en';
+  if (SKILLPACK_SOURCE !== 'builtin') {
+    const koreanMeta = SKILLPACK_META
+      ? ` (${_skillKoreanValue(SKILLPACK_META.name)} v${_skillKoreanValue(SKILLPACK_META.version)})`
+      : '';
+    const englishMetaName = SKILLPACK_META ? _englishSkillText([SKILLPACK_META.name], '') : '';
+    const englishMetaVersion = SKILLPACK_META ? _englishSkillText([SKILLPACK_META.version], '') : '';
+    const englishMeta = englishMetaName
+      ? ` (${englishMetaName}${englishMetaVersion ? ` v${englishMetaVersion}` : ''})`
+      : '';
+    log(english ? `# skillpack source: ${SKILLPACK_SOURCE}${englishMeta}` : `# skillpack 출처: ${SKILLPACK_SOURCE}${koreanMeta}`);
+  } else {
+    log(english
+      ? '# skillpack not installed — using builtin fallback (catalog bundled with leerness)'
+      : '# skillpack 미설치 — builtin fallback 사용 (leerness 본 패키지 내장 카탈로그)');
+  }
+  log(english
+    ? '| ID | Name | Source | Capabilities (summary) | Uses | Last |'
+    : '| ID | 한글명 | 출처 | 능력(요약) | 사용횟수 | 최종 |');
   log('|---|---|---|---|---|---|');
   for (const [id, v] of Object.entries(all)) {
-    const cap = (v.capabilities || []).slice(0, 3).join(' / ') + ((v.capabilities || []).length > 3 ? ' …' : '');
-    const usage = v.usage?.count || 0;
-    const last = v.usage?.lastUsed?.slice(0, 10) || v.lastUpdated || '-';
-    log(`| ${id} | ${v.displayNameKo || id} | ${v._source} | ${cap} | ${usage} | ${last} |`);
+    const displayId = english ? _englishSafeSkillId(id) : id;
+    const capabilities = english
+      ? _englishSkillCapabilities(v)
+      : (Array.isArray(v.capabilities) ? v.capabilities.filter(value => typeof value === 'string') : []);
+    const cap = capabilities.length
+      ? capabilities.slice(0, 3).join(' / ') + (capabilities.length > 3 ? ' …' : '')
+      : (english ? '-' : '');
+    const name = english
+      ? _englishSkillText([v.displayNameEn, v.displayName, v.name, v.displayNameKo], displayId)
+      : (typeof v.displayNameKo === 'string' && v.displayNameKo.trim() ? v.displayNameKo : id);
+    const canonicalUsage = v.usage?.count;
+    const usage = typeof canonicalUsage === 'number' && Number.isFinite(canonicalUsage) && canonicalUsage >= 0
+      ? canonicalUsage
+      : 0;
+    const rawLastUsed = typeof v.usage?.lastUsed === 'string' ? v.usage.lastUsed.slice(0, 10) : null;
+    const rawLastUpdated = typeof v.lastUpdated === 'string' ? v.lastUpdated : null;
+    const canonicalLast = rawLastUsed || rawLastUpdated || '-';
+    const last = english ? _englishSkillText([canonicalLast], '-') : canonicalLast;
+    log(english
+      ? `| ${_skillHumanCell(displayId)} | ${_skillHumanCell(name)} | ${_skillHumanCell(v._source)} | ${_skillHumanCell(cap)} | ${_skillHumanCell(usage)} | ${_skillHumanCell(last)} |`
+      : `| ${displayId} | ${name} | ${v._source} | ${cap} | ${usage} | ${last} |`);
   }
 }
 
@@ -3408,6 +3523,7 @@ function _computeMilestones(root) {
 
 function milestonesCmd(root) {
   root = absRoot(root);
+  const _L = _uiLang(root); const t = (ko, en) => (_L === 'en' ? en : ko);
   const isTty = process.stdout && process.stdout.isTTY;
   const cy = s => isTty ? `\x1b[36m${s}\x1b[0m` : s;
   const gr = s => isTty ? `\x1b[32m${s}\x1b[0m` : s;
@@ -3416,29 +3532,31 @@ function milestonesCmd(root) {
   const data = _computeMilestones(root);
   if (data.gitHistoryState !== 'available') _throwGitHistoryUnavailable(data.gitHistoryError);
   if (has('--json')) { log(JSON.stringify(data, null, 2)); return; }
-  log(cy(`# leerness milestones (1.9.229) — 도달 마일스톤 + 다음 ETA`));
+  log(cy(t(`# leerness milestones (1.9.229) — 도달 마일스톤 + 다음 ETA`, `# leerness milestones (1.9.229) — reached milestones + next ETA`)));
   log('');
-  log(`  📦 총 라운드: ${gr(String(data.totalRounds))}`);
+  log(t(`  📦 총 라운드: ${gr(String(data.totalRounds))}`, `  📦 total rounds: ${gr(String(data.totalRounds))}`));
   if (data.baselineAt) log(`  📍 baseline: ${(data.baselineAt || '').split(' ')[0]}`);
-  if (data.avgRoundsPerDay) log(`  📊 평균: ${gr(data.avgRoundsPerDay + ' rounds/day')}`);
+  if (data.avgRoundsPerDay) log(t(`  📊 평균: ${gr(data.avgRoundsPerDay + ' rounds/day')}`, `  📊 average: ${gr(data.avgRoundsPerDay + ' rounds/day')}`));
   log('');
   if (data.reached.length === 0) {
-    log(dm(`  (도달 마일스톤 없음 — 첫 R25 마일스톤 진행 중)`));
+    log(dm(t(`  (도달 마일스톤 없음 — 첫 R25 마일스톤 진행 중)`, `  (no milestones reached — progressing toward the first R25 milestone)`)));
   } else {
-    log(`  도달 마일스톤 ${data.reached.length}개:`);
+    log(t(`  도달 마일스톤 ${data.reached.length}개:`, `  ${data.reached.length} milestone${data.reached.length === 1 ? '' : 's'} reached:`));
     for (const m of data.reached) {
       log(`    ✓ R${m.milestone} ${gr(`(v${m.version}, ${m.reachedAt}, +${m.daysFromBaseline}d)`)}`);
     }
   }
   log('');
   if (data.next) {
-    log(yl(`  🎯 다음 마일스톤: R${data.next.milestone}`));
-    log(`    • ${data.next.roundsRemaining} 라운드 남음`);
+    log(yl(t(`  🎯 다음 마일스톤: R${data.next.milestone}`, `  🎯 next milestone: R${data.next.milestone}`)));
+    log(t(`    • ${data.next.roundsRemaining} 라운드 남음`, `    • ${data.next.roundsRemaining} rounds remaining`));
     if (data.next.etaDays != null) {
-      log(`    • ETA: ${data.next.etaDate} (~${data.next.etaDays}일 후, 현재 속도 기준)`);
+      log(t(`    • ETA: ${data.next.etaDate} (~${data.next.etaDays}일 후, 현재 속도 기준)`, `    • ETA: ${data.next.etaDate} (~${data.next.etaDays} days from now, based on current pace)`));
     }
   } else {
-    log(data && (data.roundCount || data.totalRounds) ? gr(`  🎉 모든 마일스톤 달성 (500+)`) : dm(`  (이 저장소 계보의 릴리스 태그 이력 없음)`));   // 1.36.38 (#4): 이력 0 인데 달성 축하 금지
+    log(data && (data.roundCount || data.totalRounds)
+      ? gr(t(`  🎉 모든 마일스톤 달성 (500+)`, `  🎉 all milestones reached (500+)`))
+      : dm(t(`  (이 저장소 계보의 릴리스 태그 이력 없음)`, `  (no release-tag history for this repository lineage)`)));   // 1.36.38 (#4): 이력 0 인데 달성 축하 금지
   }
 }
 
@@ -31494,7 +31612,7 @@ async function main() {
   if (cmd === 'consistency' && args[1] === 'check')              return consistencyCheck(arg('--path', args[2] || process.cwd()));
   if (cmd === 'consistency' && args[1] === 'merge-design-guide') return mergeDesign(arg('--path', args[2] || process.cwd()));
   if (cmd === 'skill' && args[1] === 'lint')        return skillLintCmd(arg('--path', args[2] && !args[2].startsWith('-') && /^([A-Za-z]:[\\/]|\/|\.\.?[\\/])/.test(args[2]) ? args[2] : process.cwd()), args[2] && !args[2].startsWith('-') && !/^([A-Za-z]:[\\/]|\/|\.\.?[\\/])/.test(args[2]) ? args[2] : null);  // 1.36.26: 메타 품질 lint
-  if (cmd === 'skill' && args[1] === 'list')        return skillList(args[2] || arg('--path', process.cwd()));
+  if (cmd === 'skill' && args[1] === 'list')        return skillList(_resolveRoot(args[2]));
   if (cmd === 'skill' && args[1] === 'info')        return skillInfo(args[2], absRoot(arg('--path', process.cwd())));
   if (cmd === 'skill' && args[1] === 'add')         return addSkill(absRoot(arg('--path', process.cwd())), args[2]);
   if (cmd === 'skill' && args[1] === 'learn')       return skillLearn(absRoot(arg('--path', process.cwd())), args[2]);

package/lib/catalogs.js

@@ -362,9 +362,9 @@ const STRINGS = {
 
 // 1.9.341 (UR-0025 심층): 내장 스킬 catalog (9종) — harness 에서 분리. _loadSkillCatalog 의 builtin fallback.
 const BUILTIN_CATALOG = {
-  'feature-implementation':       { displayNameKo: '기능 구현 표준 스킬', description: '새 기능 구현을 시작할 때 사용 — feature-contract 작성, 재사용 우선 검사, 테스트 증거 수집이 필요한 구현 작업일 때. Use when starting to implement a new feature.', version: '1.0.0', lastUpdated: '2026-05-08', verification: 'unverified', capabilities: ['feature-contracts 작성', '재사용 우선 검사', '테스트 증거 수집', '핸드오프 트리거'] },
+  'feature-implementation':       { displayNameKo: '기능 구현 표준 스킬', displayNameEn: 'Feature implementation standard skill', description: '새 기능 구현을 시작할 때 사용 — feature-contract 작성, 재사용 우선 검사, 테스트 증거 수집이 필요한 구현 작업일 때. Use when starting to implement a new feature.', version: '1.0.0', lastUpdated: '2026-05-08', verification: 'unverified', capabilities: ['feature-contracts 작성', '재사용 우선 검사', '테스트 증거 수집', '핸드오프 트리거'], capabilitiesEn: ['feature contract authoring', 'reuse-first checks', 'test evidence collection', 'handoff triggers'] },
   // 1.9.11: 기본 내장 — 로드맵 자동 생성 스킬
-  'project-roadmap-generator':    { displayNameKo: '프로젝트 로드맵 자동 생성 스킬', description: '프로젝트 진행 상황을 로드맵 한 장으로 시각화해 달라고 할 때 사용 — .leerness 상태를 SVG 트리 HTML 로 뽑을 때. Use when the user asks for a visual roadmap.', version: '0.2.0', lastUpdated: '2026-05-12', verification: 'unverified', capabilities: ['leerness .leerness/* 통합 파싱 (plan/progress/skills/rules/decisions/handoff/current-state)', '좌→우 수평 트리 + 상하 중앙정렬 SVG', '7개 상태 색상 (완료/진행/보류/검토/예정/미완료/오류)', 'design-system + CSS variables 자동 주입', '화이트보드 panning/zoom + 더블클릭 reset', '단일 HTML 출력 (외부 의존성 0)'] }
+  'project-roadmap-generator':    { displayNameKo: '프로젝트 로드맵 자동 생성 스킬', displayNameEn: 'Project roadmap generator skill', description: '프로젝트 진행 상황을 로드맵 한 장으로 시각화해 달라고 할 때 사용 — .leerness 상태를 SVG 트리 HTML 로 뽑을 때. Use when the user asks for a visual roadmap.', version: '0.2.0', lastUpdated: '2026-05-12', verification: 'unverified', capabilities: ['leerness .leerness/* 통합 파싱 (plan/progress/skills/rules/decisions/handoff/current-state)', '좌→우 수평 트리 + 상하 중앙정렬 SVG', '7개 상태 색상 (완료/진행/보류/검토/예정/미완료/오류)', 'design-system + CSS variables 자동 주입', '화이트보드 panning/zoom + 더블클릭 reset', '단일 HTML 출력 (외부 의존성 0)'], capabilitiesEn: ['Parse integrated .leerness/* state (plan/progress/skills/rules/decisions/handoff/current-state)', 'Left-to-right SVG tree with vertical centering', 'Seven status colors (done/in progress/on hold/review/planned/incomplete/error)', 'Automatic design-system and CSS variable injection', 'Whiteboard pan/zoom and double-click reset', 'Single HTML output (zero external dependencies)'] }
 };
 
 // 1.9.342 (UR-0025 심층): roadmap.html 상태 라벨/색상 맵 (status → ko 라벨 / hex 색상) — harness 에서 분리.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "leerness",
-  "version": "1.36.181",
+  "version": "1.36.183",
   "description": "The AI-coding operations layer that makes \"done\" require evidence — persistent memory, evidence-gated completion checks, and clean handoffs for any AI agent (Claude Code, Codex, Cursor). State lives as plain files in your repo. CLI + MCP, 0 runtime dependencies.",
   "keywords": [
     "leerness",

package/scripts/e2e.js

@@ -10993,7 +10993,7 @@ total++;
     R(['task', 'add', 'Implement the parser']);
     R(['decision', 'add', 'Use JSON storage', '--reason', 'simplest']);
     R(['plan', 'add', 'Ship v1']);
-    const HANGUL = /[가-힣ㄱ-ㆎ]/;
+    const HANGUL = /\p{Script=Hangul}/u;
     // 측정 대상은 **도구가 말하는 표면**이다. 사용자 데이터(프로젝트명·과거 기록)는 한국어여도 정상이므로
     //   여기서는 영어 입력만 넣은 새 프로젝트를 쓴다 — 나오는 한글은 전부 도구의 것이다.
     // codex 검수 P2(재현됨): 목록이 좁으면 누출이 **목록 밖으로 옮겨가** 래칫을 빠져나간다.
@@ -11006,6 +11006,19 @@ total++;
       ['provider', 'list'], ['skill', 'list'], ['next-action', 'list'], ['session-resume'],
       ['idempotency', 'audit'], ['context', 'budget'], ['drift', 'check'], ['verify'],
       ['encoding', 'check'], ['scan', 'secrets'], ['which'], ['glossary'], ['release', 'cadence']];
+    // Freeze the measured residual per command as well as the total. Without
+    // this vector, a +1 regression can consume an unrelated -1 improvement and
+    // still satisfy the aggregate 30-line ratchet.
+    const EXPECTED_LEAKS = new Map([
+      ['commands', 0], ['status', 0], ['health', 0], ['pulse', 2], ['check', 0], ['mode', 3],
+      ['toggle list', 0], ['task list', 0], ['decision list', 1], ['plan list', 0], ['lesson list', 1],
+      ['rule list', 1], ['lens', 0], ['route feature', 0], ['milestones', 0], ['round-history', 0],
+      ['memory status', 2], ['reuse-map', 2], ['preview list', 2], ['feature list', 2], ['requests list', 1],
+      ['roles list', 3], ['permissions list', 3], ['insights', 0], ['agents list', 0], ['constraints list', 0],
+      ['provider list', 0], ['skill list', 0], ['next-action list', 2], ['session-resume', 3],
+      ['idempotency audit', 0], ['context budget', 0], ['drift check', 0], ['verify', 0],
+      ['encoding check', 0], ['scan secrets', 1], ['which', 0], ['glossary', 1], ['release cadence', 0],
+    ]);
     let leaky = 0, produced = 0; const worst = [], silent = [], measured = new Map();
     for (const a of CMDS) {
       const r = R(a);
@@ -11021,7 +11034,12 @@ total++;
     dbg.leaky = leaky; dbg.produced = produced; dbg.worst = worst.slice(0, 8); dbg.silent = silent;
     // 계측 판별력 — **모든** 프로브가 성공하고 출력을 내야 한다. 한 건이라도 조용하면 판정 불가다.
     dbg.probeAlive = silent.length === 0 && produced === CMDS.length;
-    dbg.coverage = CMDS.length >= 39;   // 케이스를 지워 통과시키는 우회 차단(줄이려면 근거를 적고 이 수도 함께 낮춰라)
+    const commandNames = CMDS.map(a => a.join(' '));
+    dbg.coverage = CMDS.length === 39 && new Set(commandNames).size === 39
+      && EXPECTED_LEAKS.size === 39 && commandNames.every(name => EXPECTED_LEAKS.has(name));
+    dbg.vectorDrift = [...measured].filter(([name, count]) => EXPECTED_LEAKS.get(name) !== count)
+      .map(([name, count]) => `${name}:${EXPECTED_LEAKS.get(name)}→${count}`);
+    dbg.perCommandRatchet = dbg.vectorDrift.length === 0;
     // 래칫: 지금 측정된 부채보다 **늘면 실패**. 줄어드는 것은 언제나 통과.
     // 1.36.111 실측. 처음엔 21개 명령만 재서 46 이었는데, 검수 지적으로 커버리지를 39개로 넓히자 **111** 이 드러났다 —
     //   좁은 목록의 기준선은 실제 부채보다 낙관적이었다. 줄인 만큼만 낮춘다(느슨하게 두면 그 안에서 조용히 썩는다).
@@ -11030,7 +11048,9 @@ total++;
     // 1.36.174: provider list 영어 모드의 요약/안내 두 줄을 영어화해 104로 조임(39개 명령 실측).
     // 1.36.180: agents list(18) + insights(17) + toggle list(11) 우선 표면을 영어화해 58로 조임.
     // 1.36.181: 공동 최상위 release cadence/idempotency audit/plan list/round-history(각 5)를 영어화해 38로 조임.
-    const BASELINE = 38;
+    // 1.36.182: milestones 빈 이력 표면 4줄을 영어화해 34로 조임. 도달/ETA 분기도 전용 probe가 고정한다.
+    // 1.36.183: skill list 기본 카탈로그 4줄을 영어화해 30으로 조임. stored/env/flag·ko·JSON은 전용 probe가 고정한다.
+    const BASELINE = 30;
     dbg.baseline = BASELINE;
     // 합계가 우연히 낮아진 뒤 다른 명령의 회귀가 그 여유를 소비하지 못하게 exact 로 잠근다.
     // 번역이 더 진행되면 실측값과 BASELINE을 같은 변경에서 함께 낮춰야 한다.
@@ -11038,7 +11058,7 @@ total++;
     // 이번 라운드가 고친 표면은 **0 이어야** 한다 — 래칫과 별개로 회귀를 직접 막는다.
     const cmdOut = String(R(['commands']).stdout || '');
     dbg.commandsClean = cmdOut.split('\n').filter(l => HANGUL.test(l)).length === 0;
-    dbg.nextClusterClean = ['release cadence', 'idempotency audit', 'plan list', 'round-history']
+    dbg.nextClusterClean = ['release cadence', 'idempotency audit', 'plan list', 'round-history', 'milestones', 'skill list']
       .every(cmd => measured.get(cmd) === 0);
     // 한국어 사용자가 보던 것은 **바뀌면 안 된다**. 영어화하면서 `개` 단위를 양쪽에서 없애는 회귀를 냈고
     //   직전 커밋과의 바이트 비교가 잡았다. 여기서는 한국어 출력이 여전히 한국어 관례를 지키는지 단언한다.
@@ -11052,7 +11072,8 @@ total++;
       && Object.values(cj.categories).every(list => list.every(e => typeof e.cmd === 'string' && typeof e.desc === 'string'
         && e.descEn === undefined && e.cmdEn === undefined))     // 내부 번역 키가 payload 로 새면 70% 부풀었다(검수 P1 실측)
       && cj.lang === 'en';                                        // 로케일 의존을 **명시**한다 — 암묵적으로 흔들리지 않는다
-    ok = dbg.gitInit && dbg.probeAlive && dbg.coverage && dbg.exactRatchet && dbg.commandsClean && dbg.nextClusterClean && dbg.koIntact && dbg.jsonContract;
+    ok = dbg.gitInit && dbg.probeAlive && dbg.coverage && dbg.exactRatchet && dbg.perCommandRatchet
+      && dbg.commandsClean && dbg.nextClusterClean && dbg.koIntact && dbg.jsonContract;
   } catch (e) { dbg.err = String(e && e.message).slice(0, 200); } finally { try { fs.rmSync(sb, { recursive: true, force: true }); } catch {} }
   console.log(ok ? `✓ O(1.36.111/T-0092) 영어 누출 ${dbg.leaky}줄 = exact 래칫 ${dbg.baseline} · commands/next-cluster 표면 0 · 한국어 출력 불변 · --json 계약 유지 · 계측 살아있음`
     : '✗ 1.36.111 i18n 래칫 위반 ' + JSON.stringify(dbg));

package/scripts/i18n-next-cluster-probe.js

@@ -6,7 +6,7 @@ const path = require('path');
 const cp = require('child_process');
 
 const CLI = path.resolve(__dirname, '..', 'bin', 'leerness.js');
-const HANGUL = /[가-힣ㄱ-ㆎ]/;
+const HANGUL = /\p{Script=Hangul}/u;
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'leerness-i18n-next-'));
 const project = path.join(tmp, 'project');
 
@@ -21,22 +21,24 @@ const baseEnv = {
   LEERNESS_OFFLINE: '1',
 };
 delete baseEnv.LEERNESS_LANG;
+delete baseEnv.LEERNESS_SKILLPACK_PATH;
 
-function run(args, env = baseEnv) {
+function run(args, env = baseEnv, cwd = project) {
   return cp.spawnSync(process.execPath, [CLI, ...args], {
-    cwd: project,
+    cwd,
     env,
     encoding: 'utf8',
     timeout: 300000,
   });
 }
 
-function git(args, extraEnv = {}) {
+function git(args, extraEnv = {}, input) {
   return cp.spawnSync('git', args, {
     cwd: project,
     env: { ...baseEnv, ...extraEnv },
     encoding: 'utf8',
     timeout: 30000,
+    input,
   });
 }
 
@@ -78,6 +80,17 @@ function normalizedJson(label, result) {
     throw new Error(`${label} did not return one JSON document: ${error.message}`);
   }
   if (parsed && typeof parsed === 'object') delete parsed.auditedAt;
+  // Milestone ETA is intentionally based on the wall clock. English and Korean
+  // probes run in separate processes, so they can legitimately straddle UTC
+  // midnight. Validate the public date shape, then remove only that volatility
+  // before comparing the locale-independent payloads.
+  if (parsed && parsed.next && Object.prototype.hasOwnProperty.call(parsed.next, 'etaDate')) {
+    const etaDate = parsed.next.etaDate;
+    if (etaDate !== null && !/^\d{4}-\d{2}-\d{2}$/.test(String(etaDate))) {
+      throw new Error(`${label} returned an invalid milestone etaDate: ${etaDate}`);
+    }
+    if (etaDate !== null) parsed.next.etaDate = '<clock-derived-date>';
+  }
   return parsed;
 }
 
@@ -92,6 +105,8 @@ const surfaces = [
   ['idempotency audit', ['idempotency', 'audit', '--path', project]],
   ['plan list', ['plan', 'list', '--path', project]],
   ['round-history', ['round-history', '--path', project]],
+  ['milestones', ['milestones', '--path', project]],
+  ['skill list', ['skill', 'list', '--path', project]],
 ];
 
 try {
@@ -106,20 +121,237 @@ try {
   requireSuccess('decision add', run(['decision', 'add', 'Use JSON storage', '--reason', 'simplest', '--path', project]));
   requireSuccess('plan add', run(['plan', 'add', 'Ship the parser', '--path', project]));
 
+  // A user skill may predate English catalog fields or contain malformed
+  // legacy usage metadata. English mode must not fall back to Korean-only
+  // presentation fields, leak a non-numeric count, or call string methods on
+  // a numeric timestamp. JSON keeps those canonical source values unchanged.
+  const koreanOnlySkillDir = path.join(project, '.leerness', 'skills', 'korean-only');
+  fs.mkdirSync(koreanOnlySkillDir, { recursive: true });
+  fs.writeFileSync(path.join(koreanOnlySkillDir, 'skill.json'), JSON.stringify({
+    name: 'korean-only',
+    displayNameKo: '한국어 전용 사용자 스킬',
+    displayNameEn: 'ㄴ invalid English label',
+    version: '1.0.0',
+    lastUpdated: '마지막',
+    verification: 'unverified',
+    capabilities: ['한국어 기능 설명'],
+    capabilitiesEn: ['ㄷ invalid English capability'],
+    usage: { count: '한국어 횟수', lastUsed: 1725062400000 },
+  }, null, 2) + '\n');
+  const unsafeCellsSkillDir = path.join(project, '.leerness', 'skills', 'unsafe-cells');
+  fs.mkdirSync(unsafeCellsSkillDir, { recursive: true });
+  fs.writeFileSync(path.join(unsafeCellsSkillDir, 'skill.json'), JSON.stringify({
+    name: 'unsafe-cells',
+    displayNameKo: '안전하지 않은 셀',
+    displayNameEn: 'Safe name\n| forged-name |',
+    lastUpdated: '2026-01-01\n| forged-last |',
+    capabilities: ['한국어 기능 설명'],
+    capabilitiesEn: ['safe | capability\ncontinued'],
+    usage: { count: '', lastUsed: 0 },
+  }, null, 2) + '\n');
+  const falsyJsonSkillDir = path.join(project, '.leerness', 'skills', 'falsy-json');
+  fs.mkdirSync(falsyJsonSkillDir, { recursive: true });
+  fs.writeFileSync(path.join(falsyJsonSkillDir, 'skill.json'), JSON.stringify({
+    name: 'falsy-json',
+    displayNameKo: '',
+    lastUpdated: false,
+    capabilities: false,
+    usage: { count: null, lastUsed: false },
+  }, null, 2) + '\n');
+  const hostileObjectSkillDir = path.join(project, '.leerness', 'skills', 'hostile-object');
+  fs.mkdirSync(hostileObjectSkillDir, { recursive: true });
+  fs.writeFileSync(path.join(hostileObjectSkillDir, 'skill.json'), JSON.stringify({
+    name: 'hostile-object',
+    displayNameKo: { toString: null },
+    lastUpdated: { toString: null },
+    capabilities: [{ toString: null }],
+    usage: { count: { toString: null }, lastUsed: { toString: null } },
+  }, null, 2) + '\n');
+  const hangulIdSkillDir = path.join(project, '.leerness', 'skills', '옛스킬');
+  fs.mkdirSync(hangulIdSkillDir, { recursive: true });
+  fs.writeFileSync(path.join(hangulIdSkillDir, 'skill.json'), JSON.stringify({
+    name: '옛스킬',
+    displayNameKo: '옛 사용자 스킬',
+    lastUpdated: '마지막',
+    capabilities: ['한국어 기능 설명'],
+    usage: { count: 0, lastUsed: null },
+  }, null, 2) + '\n');
+
+  const manifestFile = path.join(project, '.leerness', 'manifest.json');
+  const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
+
   // Stored project language, environment override, and explicit flag must all
   // reach the same English renderer. Flip the stored language to Korean before
   // checking overrides so a disconnected env/flag path cannot pass by falling
   // back to the already-English manifest.
+  const storedEnglish = new Map();
   for (const [label, args] of surfaces) {
-    requireNoHangul(`${label} (stored language)`, run(args));
+    storedEnglish.set(label, requireNoHangul(`${label} (stored language)`, run(args)));
   }
-  const manifestFile = path.join(project, '.leerness', 'manifest.json');
-  const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
+  const storedSkillList = storedEnglish.get('skill list');
+  const skillEnglishAnchors = [
+    '# skillpack not installed — using builtin fallback (catalog bundled with leerness)',
+    '| ID | Name | Source | Capabilities (summary) | Uses | Last |',
+    '| feature-implementation | Feature implementation standard skill | catalog+local | feature contract authoring / reuse-first checks / test evidence collection … |',
+    '| project-roadmap-generator | Project roadmap generator skill | catalog+local | Parse integrated .leerness/* state (plan/progress/skills/rules/decisions/handoff/current-state) / Left-to-right SVG tree with vertical centering / Seven status colors (done/in progress/on hold/review/planned/incomplete/error) … |',
+    '| korean-only | korean-only | user | - | 0 | - |',
+    '| unsafe-cells | Safe name &#124; forged-name &#124; | user | safe &#124; capability continued | 0 | 2026-01-01 &#124; forged-last &#124; |',
+    '| falsy-json | falsy-json | user | - | 0 | - |',
+    '| hostile-object | hostile-object | user | - | 0 | - |',
+    '| \\uC61B\\uC2A4\\uD0AC | \\uC61B\\uC2A4\\uD0AC | user | - | 0 | - |',
+  ];
+  for (const anchor of skillEnglishAnchors) {
+    if (!storedSkillList.includes(anchor)) throw new Error(`skill list English output lost anchor: ${anchor}`);
+  }
+  if (storedSkillList.split(/\r?\n/).some(line => /^\|\s*forged-/.test(line))) {
+    throw new Error('skill list English metadata forged a physical Markdown row');
+  }
+  // A real stored-Korean route prevents a default-English implementation from
+  // passing the stored-locale test accidentally. Run outside the target cwd so
+  // the locale must come from --path rather than cwd.
+  manifest.language = 'ko';
+  fs.writeFileSync(manifestFile, JSON.stringify(manifest, null, 2) + '\n');
+  const storedKoreanSkillList = requireSuccess('skill list stored Korean control', run(
+    ['skill', 'list', '--path', project], baseEnv, tmp
+  ));
+  if (!storedKoreanSkillList.includes('| ID | 한글명 | 출처 | 능력(요약) | 사용횟수 | 최종 |')) {
+    throw new Error('skill list ignored the stored Korean locale selected through --path');
+  }
+  manifest.language = 'en';
+  fs.writeFileSync(manifestFile, JSON.stringify(manifest, null, 2) + '\n');
+  // --path must outrank a conflicting positional root when resolving the
+  // stored locale. The pre-fix dispatcher passed args[2] straight through.
+  const koreanPositionalProject = path.join(tmp, 'korean-positional-project');
+  fs.mkdirSync(koreanPositionalProject, { recursive: true });
+  fs.writeFileSync(path.join(koreanPositionalProject, 'package.json'), '{"name":"korean-positional","version":"0.1.0"}\n');
+  requireSuccess('init Korean positional project', run(['init', koreanPositionalProject, '--yes', '--language', 'ko']));
+  requireNoHangul('skill list --path precedence', run(
+    ['skill', 'list', koreanPositionalProject, '--path', project], baseEnv, tmp
+  ));
+
+  // A separately loaded skillpack exercises the loader projection, including
+  // explicit English fields, legacy English fields, non-Latin text, complete
+  // Hangul-script coverage, and Markdown control-character sanitation.
+  const ambientSkillpackDir = path.join(project, 'node_modules', 'leerness-skillpack');
+  fs.mkdirSync(ambientSkillpackDir, { recursive: true });
+  fs.writeFileSync(path.join(ambientSkillpackDir, 'catalog.json'), JSON.stringify({
+    name: 'Ambient pack', version: '0.0.0', skills: [{ id: 'ambient-pack', displayNameEn: 'Ambient pack' }],
+  }, null, 2) + '\n');
+  const skillpackDir = path.join(tmp, 'skillpack');
+  fs.mkdirSync(skillpackDir, { recursive: true });
+  const nfdHangul = '한글'.normalize('NFD');
+  const literalEscapeId = String.raw`\uC61B`;
+  fs.writeFileSync(path.join(skillpackDir, 'catalog.json'), JSON.stringify({
+    name: 'External pack\n| forged-pack |',
+    version: { toString: null },
+    skills: [
+      { id: 'translated-pack', displayNameKo: '번역 스킬', displayNameEn: 'Translated pack skill', capabilities: ['한국어 기능'], capabilitiesEn: ['English capability'] },
+      { id: 'legacy-pack', displayNameKo: '레거시 스킬', displayName: 'Legacy pack name', capabilities: ['Legacy capability'] },
+      { id: 'legacy-name-pack', displayNameKo: '레거시 이름 스킬', name: 'Legacy name pack', capabilities: ['Legacy name capability'] },
+      { id: 'japanese-pack', displayNameKo: '日本語名', capabilities: ['日本語機能'] },
+      { id: 'jamo-pack', displayNameKo: '자모 스킬', displayNameEn: 'ㄴ invalid label', capabilities: ['한국어 기능'], capabilitiesEn: ['ㄷ invalid capability'] },
+      { id: nfdHangul, displayNameKo: '분해 자모 스킬', displayNameEn: nfdHangul, capabilities: ['한국어 기능'], capabilitiesEn: [nfdHangul] },
+      { id: 'a|b', displayNameEn: 'Pipe ID' },
+      { id: 'a&#124;b', displayNameEn: 'Literal entity ID' },
+      { id: 'a b', displayNameEn: 'Single-space ID' },
+      { id: 'a  b', displayNameEn: 'Double-space ID' },
+      { id: ' ', displayNameEn: 'Space-only ID' },
+      { id: '-', displayNameEn: 'Dash ID' },
+      { id: literalEscapeId, displayNameEn: 'Literal escape ID' },
+      { id: '옛', displayNameEn: 'Hangul ID' },
+      null,
+      { id: { toString: null }, displayNameEn: 'Malformed ID' },
+    ],
+  }, null, 2) + '\n');
+  const skillpackOutput = requireNoHangul('skill list external skillpack', run(
+    ['skill', 'list', '--path', project],
+    { ...baseEnv, LEERNESS_LANG: 'en', LEERNESS_SKILLPACK_PATH: skillpackDir }
+  ));
+  for (const anchor of [
+    '# skillpack source: env (External pack &#124; forged-pack &#124;)',
+    '| translated-pack | Translated pack skill | skillpack | English capability |',
+    '| legacy-pack | Legacy pack name | skillpack | Legacy capability |',
+    '| legacy-name-pack | Legacy name pack | skillpack | Legacy name capability |',
+    '| japanese-pack | japanese-pack | skillpack | - |',
+    '| jamo-pack | jamo-pack | skillpack | - |',
+    '| \\u1112\\u1161\\u11AB\\u1100\\u1173\\u11AF | \\u1112\\u1161\\u11AB\\u1100\\u1173\\u11AF | skillpack | - |',
+    '| a\\u007Cb | Pipe ID | skillpack | - |',
+    '| a&#124;b | Literal entity ID | skillpack | - |',
+    '| a\\u0020b | Single-space ID | skillpack | - |',
+    '| a\\u0020\\u0020b | Double-space ID | skillpack | - |',
+    '| \\u0020 | Space-only ID | skillpack | - |',
+    '| - | Dash ID | skillpack | - |',
+    '| \\\\uC61B | Literal escape ID | skillpack | - |',
+    '| \\uC61B | Hangul ID | skillpack | - |',
+  ]) {
+    if (!skillpackOutput.includes(anchor)) throw new Error(`skill list external skillpack lost anchor: ${anchor}`);
+  }
+  if (skillpackOutput.includes('日本語') || skillpackOutput.split(/\r?\n/).some(line => /^\|\s*forged-/.test(line))) {
+    throw new Error('skill list external metadata bypassed English fallback or forged a Markdown row');
+  }
+  const skillpackJsonEnv = normalizedJson('skill list external skillpack environment JSON', run(
+    ['skill', 'list', '--path', project, '--json'],
+    { ...baseEnv, LEERNESS_LANG: 'en', LEERNESS_SKILLPACK_PATH: skillpackDir }, tmp
+  ));
+  const skillpackJsonExplicit = normalizedJson('skill list external skillpack explicit JSON', run(
+    ['skill', 'list', '--path', project, '--json', '--language', 'en'],
+    { ...baseEnv, LEERNESS_LANG: 'ko', LEERNESS_SKILLPACK_PATH: skillpackDir }, tmp
+  ));
+  const skillpackJsonKorean = normalizedJson('skill list external skillpack Korean JSON', run(
+    ['skill', 'list', '--path', project, '--json'],
+    { ...baseEnv, LEERNESS_LANG: 'ko', LEERNESS_SKILLPACK_PATH: skillpackDir }, tmp
+  ));
+  const canonicalSkillKeys = ['capabilities', 'displayNameKo', 'id', 'lastUpdated', 'lastUsed', 'source', 'usageCount'];
+  const externalTranslatedJson = skillpackJsonEnv.items && skillpackJsonEnv.items.find(item => item.id === 'translated-pack');
+  if (JSON.stringify(skillpackJsonEnv) !== JSON.stringify(skillpackJsonExplicit)
+      || JSON.stringify(skillpackJsonEnv) !== JSON.stringify(skillpackJsonKorean)
+      || skillpackJsonEnv.skillpack !== 'env'
+      || !skillpackJsonEnv.items.every(item => JSON.stringify(Object.keys(item).sort()) === JSON.stringify(canonicalSkillKeys))
+      || skillpackJsonEnv.items.some(item => item.id === 'ambient-pack' || typeof item.id !== 'string')
+      || !skillpackJsonEnv.items.some(item => item.id === 'a|b')
+      || !skillpackJsonEnv.items.some(item => item.id === 'a b')
+      || !skillpackJsonEnv.items.some(item => item.id === 'a  b')
+      || !skillpackJsonEnv.items.some(item => item.id === ' ')
+      || !skillpackJsonEnv.items.some(item => item.id === '-')
+      || !skillpackJsonEnv.items.some(item => item.id === literalEscapeId)
+      || !externalTranslatedJson || externalTranslatedJson.displayNameKo !== '번역 스킬'
+      || externalTranslatedJson.capabilities[0] !== '한국어 기능') {
+    throw new Error('skill list external skillpack JSON changed across locale routes or exposed presentation-only fields');
+  }
+  // Valid Korean free text is a compatibility surface: unlike the English
+  // Markdown-safe projection it must retain repeated spaces byte-for-byte.
+  // Keep an ambient pack present so this also exercises explicit env priority.
+  const koreanBytePackDir = path.join(tmp, 'korean-byte-pack');
+  fs.mkdirSync(koreanBytePackDir, { recursive: true });
+  fs.writeFileSync(path.join(koreanBytePackDir, 'catalog.json'), JSON.stringify({
+    name: '외부  팩',
+    version: '1  2',
+    skills: [{
+      id: 'ko-space-pack',
+      displayNameKo: '가  나',
+      capabilities: ['첫  기능'],
+      lastUpdated: '2026  08',
+    }],
+  }, null, 2) + '\n');
+  const koreanByteOutput = requireSuccess('skill list external skillpack Korean byte preservation', run(
+    ['skill', 'list', '--path', project],
+    { ...baseEnv, LEERNESS_LANG: 'ko', LEERNESS_SKILLPACK_PATH: koreanBytePackDir }, tmp
+  ));
+  for (const anchor of [
+    '# skillpack 출처: env (외부  팩 v1  2)',
+    '| ko-space-pack | 가  나 | skillpack | 첫  기능 | 0 | 2026  08 |',
+  ]) {
+    if (!koreanByteOutput.includes(anchor)) throw new Error(`skill list Korean valid metadata changed bytes: ${anchor}`);
+  }
+  fs.rmSync(path.join(project, 'node_modules'), { recursive: true, force: true });
   manifest.language = 'ko';
   fs.writeFileSync(manifestFile, JSON.stringify(manifest, null, 2) + '\n');
   for (const [label, args] of surfaces) {
-    requireNoHangul(`${label} (environment language)`, run(args, { ...baseEnv, LEERNESS_LANG: 'en' }));
-    requireNoHangul(`${label} (explicit language)`, run([...args, '--language', 'en'], { ...baseEnv, LEERNESS_LANG: 'ko' }));
+    const envEnglish = requireNoHangul(`${label} (environment language)`, run(args, { ...baseEnv, LEERNESS_LANG: 'en' }));
+    const explicitEnglish = requireNoHangul(`${label} (explicit language)`, run([...args, '--language', 'en'], { ...baseEnv, LEERNESS_LANG: 'ko' }));
+    if (label === 'skill list' && (envEnglish !== storedSkillList || explicitEnglish !== storedSkillList)) {
+      throw new Error('skill list English output differs across stored, environment, or explicit locale routes');
+    }
   }
   manifest.language = 'en';
   fs.writeFileSync(manifestFile, JSON.stringify(manifest, null, 2) + '\n');
@@ -206,8 +438,19 @@ try {
   requireGitSuccess('git tag second snapshot', git(['tag', '-a', 'v1.0.1', '-m', 'v1.0.1'], {
     GIT_COMMITTER_DATE: secondDate,
   }));
+  // Reach R25 without manufacturing another 23 commits. Annotated tags have
+  // independent creation times, which is exactly the evidence milestones
+  // consumes, and exercise reached/next/ETA rendering in one small fixture.
+  for (let i = 2; i < 25; i++) {
+    const version = `v1.0.${i}`;
+    const tagDate = `2026-08-29T00:${String(i).padStart(2, '0')}:00+09:00`;
+    requireGitSuccess(`git tag ${version}`, git(['tag', '-a', version, '-m', version], {
+      GIT_COMMITTER_DATE: tagDate,
+    }));
+  }
   requireNoHangul('release cadence with measured history', run(['release', 'cadence', '--path', project]));
   requireNoHangul('round-history with tags', run(['round-history', '--path', project]));
+  requireNoHangul('milestones with reached history', run(['milestones', '--path', project]));
 
   // Machine payloads remain the canonical, locale-independent contract. The
   // idempotency timestamp is intentionally volatile and is normalized only
@@ -219,6 +462,27 @@ try {
       throw new Error(`${label} JSON contract changed with UI language`);
     }
   }
+  const skillJson = normalizedJson('skill list canonical JSON shape', run(['skill', 'list', '--path', project, '--json']));
+  const koreanOnlyJson = skillJson.items && skillJson.items.find(item => item.id === 'korean-only');
+  const unsafeCellsJson = skillJson.items && skillJson.items.find(item => item.id === 'unsafe-cells');
+  const falsyJson = skillJson.items && skillJson.items.find(item => item.id === 'falsy-json');
+  const hostileObjectJson = skillJson.items && skillJson.items.find(item => item.id === 'hostile-object');
+  const featureJson = skillJson.items && skillJson.items.find(item => item.id === 'feature-implementation');
+  const roadmapJson = skillJson.items && skillJson.items.find(item => item.id === 'project-roadmap-generator');
+  if (!skillJson || skillJson.skillpack !== 'builtin' || skillJson.total !== skillJson.items.length
+      || !koreanOnlyJson || koreanOnlyJson.displayNameKo !== '한국어 전용 사용자 스킬'
+      || koreanOnlyJson.capabilities[0] !== '한국어 기능 설명' || koreanOnlyJson.lastUpdated !== '마지막'
+      || koreanOnlyJson.usageCount !== '한국어 횟수' || koreanOnlyJson.lastUsed !== 1725062400000
+      || !unsafeCellsJson || unsafeCellsJson.usageCount !== '' || unsafeCellsJson.lastUsed !== 0
+      || !falsyJson || falsyJson.displayNameKo !== '' || falsyJson.capabilities !== false
+      || falsyJson.usageCount !== null || falsyJson.lastUsed !== false || falsyJson.lastUpdated !== false
+      || !hostileObjectJson || hostileObjectJson.usageCount.toString !== null
+      || hostileObjectJson.lastUsed.toString !== null || hostileObjectJson.lastUpdated.toString !== null
+      || !featureJson || featureJson.displayNameKo !== '기능 구현 표준 스킬' || featureJson.capabilities[0] !== 'feature-contracts 작성'
+      || !roadmapJson || roadmapJson.displayNameKo !== '프로젝트 로드맵 자동 생성 스킬' || !roadmapJson.capabilities[1].includes('좌→우 수평 트리')
+      || !skillJson.items.every(item => JSON.stringify(Object.keys(item).sort()) === JSON.stringify(canonicalSkillKeys))) {
+    throw new Error('skill list JSON no longer exposes the canonical locale-independent shape');
+  }
 
   const koEnv = { ...baseEnv, LEERNESS_LANG: 'ko' };
   const koreanAnchors = new Map([
@@ -226,6 +490,8 @@ try {
     ['idempotency audit', ['위반 발견', '중복 룰']],
     ['plan list', ['완료기준(Done-When)', 'Tasks:', '완료)']],
     ['round-history', ['자율 라운드 통계', '누적 라운드', '최근 10 tags']],
+    ['milestones', ['도달 마일스톤', '총 라운드', '다음 마일스톤', '라운드 남음']],
+    ['skill list', ['skillpack 미설치', '| ID | 한글명 | 출처 | 능력(요약) | 사용횟수 | 최종 |', '| feature-implementation | 기능 구현 표준 스킬 | catalog+local | feature-contracts 작성 / 재사용 우선 검사 / 테스트 증거 수집 … |', '| project-roadmap-generator | 프로젝트 로드맵 자동 생성 스킬 | catalog+local | leerness .leerness/* 통합 파싱 (plan/progress/skills/rules/decisions/handoff/current-state) / 좌→우 수평 트리 + 상하 중앙정렬 SVG / 7개 상태 색상 (완료/진행/보류/검토/예정/미완료/오류) … |', '한국어 전용 사용자 스킬', '옛 사용자 스킬', '| hostile-object | hostile-object | user |  | 0 | - |']],
   ]);
   for (const [label, args] of surfaces) {
     const output = requireSuccess(`${label} Korean control`, run(args, koEnv));
@@ -233,7 +499,30 @@ try {
     if (missing.length) throw new Error(`${label} Korean control lost anchors: ${missing.join(', ')}`);
   }
 
-  console.log('✓ Four next-cluster English surfaces contain no Hangul across locale paths and edge states; 4/4 Korean controls and JSON contracts remain intact');
+  // Exercise the terminal 500+ renderer without spawning another 475 `git tag`
+  // processes. Lightweight semver refs are valid release tags and one atomic
+  // update-ref process gives the real CLI a 500-tag history.
+  const headResult = git(['rev-parse', 'HEAD']);
+  requireGitSuccess('git resolve terminal milestone fixture', headResult);
+  const head = String(headResult.stdout || '').trim();
+  const refs = [];
+  for (let i = 25; i < 500; i++) refs.push(`create refs/tags/v1.0.${i} ${head}`);
+  requireGitSuccess('git create terminal milestone fixture', git(['update-ref', '--stdin'], {}, refs.join('\n') + '\n'));
+  const terminalEn = requireNoHangul('milestones all reached (English)', run(['milestones', '--path', project, '--language', 'en']));
+  if (!terminalEn.includes('all milestones reached (500+)')) {
+    throw new Error('milestones English terminal branch lost its 500+ completion marker');
+  }
+  const terminalKo = requireSuccess('milestones all reached (Korean)', run(['milestones', '--path', project], koEnv));
+  if (!terminalKo.includes('모든 마일스톤 달성 (500+)')) {
+    throw new Error('milestones Korean terminal branch lost its 500+ completion marker');
+  }
+  const terminalJson = normalizedJson('milestones terminal JSON', run(['milestones', '--path', project, '--json']));
+  if (terminalJson.totalRounds !== 500 || terminalJson.next !== null
+      || !Array.isArray(terminalJson.reached) || terminalJson.reached.at(-1)?.milestone !== 500) {
+    throw new Error('milestones terminal JSON did not preserve the 500-round contract');
+  }
+
+  console.log('✓ Six next-cluster English surfaces contain no Hangul across locale paths and edge states; 6/6 Korean controls and JSON contracts remain intact');
 } catch (error) {
   console.error(`✗ ${error && error.message ? error.message : error}`);
   process.exitCode = 1;