elanous 0.2.0 → 0.2.5

package/src/self-implement/orchestrator.ts

@@ -19,6 +19,7 @@ import {
   type PrEvidenceInput,
 } from './pr-evidence-artifact.js';
 import { assessImplementationArtifactCompleteness } from './implementation-artifact-completeness.js';
+import { runContractAtNode, type RunContract } from './graph-run-contract.js';
 export {
   PR_EVIDENCE_AXES,
   composePrEvidenceArtifact,
@@ -59,11 +60,15 @@ export function formatAutoMergeSuccessMessage(input: {
 }
 
 import { GoalRunStore, insertGoalRunRecord, type GoalPriorRuns } from './goal-run-store.js';
+import { writeGoalRunRecordFragment } from './goal-execution-records.js';
+import { getUserConfig } from '../user-config.js';
 import { appendRunLedgerEntry, loadRunLedger, parseRunShardIdentity, queryRunChain, type RunChainShardSibling, type RunLedgerEntry, type RunLedgerWriter, type RunOriginData, type RunShardIdentity } from './run-ledger.js';
 import { decideLineageSupersede, lineageSupersedeCloseComment, type LineageSupersedeOpenDraft } from './lineage-supersede.js';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { enqueueControlMemo, readSoftStopRequestStatus, type SoftStopRequestRead } from '../harness/control-inbox.js';
 import { debug } from '../debug/log.js';
+import { emitDecision } from '../live/detail-switch.js';
+import { reworkDecision } from './decision-events.js';
 import type { LogSink } from '../mss/logging/sink.js';
 import type { LogQuery, LogStoreRow } from '../mss/logging/log-store.js';
 import { refreshCodexQuotaSignals } from '../budget/codex-quota-refresh.js';
@@ -73,6 +78,7 @@ import { parseAskProseTitle } from '../self-dev/launch-preflight.js';
 import { classifyReviewProviderFailure } from '../self-dev/review-provider-fallback.js';
 import { classifyError } from '../session-runtime/retry-policy.js';
 import { decomposeSelfDevGoal, inferHotPaths, type SelfDevDecomposeOptions } from '../self-dev/decompose.js';
+import { boundaryGlobs, boundaryViolations } from './goal-boundary.js';
 import { targetScopedGoalText } from './goal-text-path-scope.js';
 import type { SelfDevGoalType } from '../self-dev/orchestrate.js';
 import { DEFAULT_BRANCH_WORKTREE_BASE, gateGitResidue, observeGitResidue } from '../git-fs/worktree.js';
@@ -86,11 +92,12 @@ import { originObservationFields } from '../agent/origin-observation.js';
 import { getHarnessSpace, normalizeSpaceId, resolveRunIdentity } from '../harness/harness-space.js';
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { harnessReleaseNote, releaseNotesDir, renderReleaseNoteSection, writeReleaseNote, type ReleaseNoteFragment } from '../release-loop/release-note.js';
 import { plannedSelfImplBranch } from '../harness/worktree-branch-prefix.js';
 export { slugifyFeature } from '../harness/worktree-branch-prefix.js';
 import { resolveAutoReviewLabels } from './context-capsule.js';
 import { GOAL_TYPES, extractVerbatimOriginalAsk, leadingGoalMetadata, parseAskFile, parseGoalType, type GoalType } from './goal-author.js';
-import { resolveAdaptiveMaxReworkDecision, resolveEscalateTier, resolveEscalateTarget, buildReworkFeature, failIndicator, appendReworkHistory, truncateReworkHistoryByItem, applyReworkBudgetDecision, parseContractConflictRelaxation, parseReworkBudgetDecision, resolveReworkBudgetCarry, stripReworkBudgetHeaders, countConsecutiveMustFixIds, mergeReworkNotes, resolveReworkKind, type ReworkPlanRevision, type ReworkNotePart } from './rework-policy.js';
+import { resolveAdaptiveMaxReworkDecision, resolveEscalateTier, resolveEscalateTarget, buildReworkFeature, failIndicator, isRepeatedUnverifiedOnlyGateFailure, unverifiedRepeatKey, appendReworkHistory, truncateReworkHistoryByItem, applyReworkBudgetDecision, parseContractConflictRelaxation, parseReworkBudgetDecision, resolveReworkBudgetCarry, stripReworkBudgetHeaders, countConsecutiveMustFixIds, mergeReworkNotes, resolveReworkKind, type ReworkPlanRevision, type ReworkNotePart } from './rework-policy.js';
 import type { SupervisionReworkSource } from './supervision-vocabulary.js';
 import { classifyReworkBudgetShadow } from './classify-shadow.js';
 import { createReworkBudgetJudgment, REWORK_BUDGET_JUDGMENT, reworkBudgetEvidenceForObservation, reworkBudgetWorkflow } from './rework-budget-judgment.js';
@@ -169,12 +176,15 @@ import type { RunOutcome, ReworkBudgetVerdict } from './run-outcome.js';
 import type { EscalateTier } from './rework-policy.js';
 import type { ClassifyShadowCallLLM } from './classify-shadow.js';
 import { hasModuleLoadFailure, type GateTestFailure } from './gate-baseline.js';
-import { defaultBranchRef } from './seams.js';
+import { commitWorktree, defaultBranchRef } from './seams.js';
+import { blockedDraftDisposition } from './blocked-draft-policy.js';
 import { formatLlmMergeOutcome } from '../autopilot/build/llm-conflict-merge.js';
 import { FOUND_CITED_PATH_REFUTATION_QUOTE, MISSING_CITED_PATH_REFUTATION_QUOTE, MUST_FIX_REFUTATION_ACKNOWLEDGEMENT_WITH_REASON, REFUTATION_QUOTE_GRAMMAR, observeMustFixCitedPaths, parseMustFixRefutationAcknowledgement, parseMustFixRefutations, renderMustFixCitedPathFacts, snapshotMustFixFindings, stableMustFixId, type ReflectEvidenceFacts, type ReflectGateFacts, type MustFixCitedPathFact, type MustFixFinding, type MustFixRecurrenceHistory, type MustFixRefutation, type MustFixRefutationKind } from './reflect-mustfix.js';
 import type { IngestionEntry } from '../agent-substrate/execution/ingestion-policy.js';
 import { buildReviewIntent } from '../agent-substrate/review-intent.js';
+import { collectPriorDraftFindings, goalTitleFromTargetGoalFile } from './prior-draft-findings.js';
 import { resolveDesignCheck, type DesignCheckOutcome } from '../design/design-check.js';
+import { runDesignGate, type DesignGateResult } from '../design/design-gate.js';
 import type { ReviewerContextBudget } from '../agent-substrate/pr-reviewer.js';
 import { persistReviewArtifact, type ReviewArtifactWriter } from '../agent-substrate/review-artifact.js';
 import { createArtifactStore } from '../artifact/index.js';
@@ -429,21 +439,30 @@ export function decideGateFailureDisposition(facts: {
   return 'rework';
 }
 
+function postSyncTimeoutOnly(facts: { introduced?: number; unknown?: number; timedOut?: number; flakyRerun?: number; childResponsibility?: string } | undefined): boolean {
+  // Post-sync attribution may omit childResponsibility; zero introduced/unknown with only
+  // timeout evidence is sufficient here, without weakening the main-loop predicate.
+  return (facts?.childResponsibility === undefined || facts.childResponsibility === 'none')
+    && isTimeoutOnlyUnmeasuredGate(facts && { ...facts, childResponsibility: 'none' });
+}
+
 function postSyncGatePolicy(
   passed: boolean,
-  childResponsibility: string | undefined,
+  facts: { introduced?: number; unknown?: number; timedOut?: number; flakyRerun?: number; childResponsibility?: string } | undefined,
   syncStatus: PostSyncStatus,
 ): PostSyncGatePolicy {
-  const exemptionWithheld = !passed
-    && childResponsibility === 'none'
+  const timeoutOnly = !passed && postSyncTimeoutOnly(facts);
+  const introduced = (facts?.introduced ?? 0) > 0;
+  const childResponsibility = facts?.childResponsibility;
+  const exemptionWithheld = !timeoutOnly && !passed
+    && !introduced && childResponsibility === 'none'
     && syncStatus === 'llm-resolved';
   const exempted = !passed
-    && childResponsibility === 'none'
-    && syncStatus === 'merged';
+    && (timeoutOnly || (!introduced && childResponsibility === 'none' && syncStatus === 'merged'));
   return {
     exempted,
     exemptionWithheld,
-    mustStop: !passed && (childResponsibility !== 'none' || exemptionWithheld),
+    mustStop: !passed && !timeoutOnly && (introduced || childResponsibility !== 'none' || exemptionWithheld),
   };
 }
 
@@ -455,7 +474,7 @@ export function postSyncGateObservation(
     testStepExecuted?: boolean;
     measuredFileCount?: number;
     comparisonBase?: string | null;
-    reflectGateFacts?: { introduced: number; preexisting: number; unknown: number; timedOut?: number; childResponsibility?: string };
+    reflectGateFacts?: { introduced: number; preexisting: number; unknown: number; timedOut?: number; flakyRerun?: number; childResponsibility?: string };
   },
   branch: string,
   detectModuleLoadFailure: (output: string) => boolean,
@@ -464,7 +483,7 @@ export function postSyncGateObservation(
   const facts = regate.reflectGateFacts;
   const { exempted, exemptionWithheld } = postSyncGatePolicy(
     regate.passed,
-    facts?.childResponsibility,
+    facts,
     syncStatus,
   );
   return {
@@ -590,6 +609,7 @@ export interface ReviewDiffContext {
   goalDocumentPath?: string;
   round?: number;
   appliedLastRound?: readonly string[];
+  priorRunFindings?: import('./prior-draft-findings.js').PriorDraftFinding[];
   /** Existing run-chain projection of sibling shards; absent means no sibling runs were observed. */
   shardSiblings?: {
     items: readonly RunChainShardSibling[];
@@ -622,6 +642,8 @@ export interface ReviewDiffContext {
   };
   /** Read-only comparison of the worktree DESIGN.md declaration and installed craft rulebooks. */
   designCheck?: DesignCheckOutcome;
+  /** Deterministic design-token result supplied to review, never the implementation gate. */
+  designGate?: DesignGateResult | { unmeasured: string };
 }
 
 /** 런 사실(커밋 제목·변경 파일)을 fail-soft 로 걷어 온다. seam(git) 이 실패하면 그 종류를 생략하고,
@@ -789,6 +811,13 @@ function observeDeclaredScopeDiff(
   // ⭐ 관측은 «언제나» 남기고, ***사람 줄은 「하나도 안 만들었을 때만»*** 낸다.
   const line = declaredScopeUnmadeLine(diff);
   if (line !== null) input.progress?.('declared-targets-unmade', line);
+  // ⭐ 그 옆 — `경계:` 글로브에 닿은 변경. 못 읽었거나 변경 목록이 없으면 조용하다.
+  if (goalDocument !== null && input.changedFiles !== undefined) {
+    const violations = boundaryViolations(boundaryGlobs(goalDocument), input.changedFiles);
+    if (violations.length > 0) {
+      input.progress?.('boundary-violated', `⚠️ 경계로 선언한 경로를 고쳤다 — ${violations.join(' · ')}`);
+    }
+  }
 }
 
 /**
@@ -946,10 +975,14 @@ export interface SelfImplementSeams {
    *  `buildReviewIntent` 가 `goal` 하나로 직접 추출한다(`extractIntentBlocks` · 결정론 · LLM 0).
    *  ⇒ 같은 값을 두 경로로 나르면 갈라진다. 골을 SSOT 로 둔다. */
   reviewDiff?: (cwd: string, ctx?: ReviewDiffContext) => Promise<SelfImplementReview>;
+  /** Read-only prior-draft reviewer findings; tests inject the lookup to avoid network access. */
+  collectPriorDraftFindings?: typeof collectPriorDraftFindings;
   /** Existing run-chain query projection. The orchestrator only selects the current entry's producer-computed siblings. */
   queryRunChain?: () => { entries: readonly { runId: string; prNumber?: number | null; merged?: boolean; shardSiblings: readonly RunChainShardSibling[] }[] };
   /** Computes the worktree's design declaration verdict for review context; informational only. */
   resolveDesignCheck?: (worktreePath: string) => DesignCheckOutcome;
+  /** Read-only design-token check for HTML/CSS changes; exceptions remain review-visible. */
+  runDesignGate?: typeof runDesignGate;
   /** 실행 원장 우선, 기존 base 브랜치 PR 코멘트 폴백으로 자동 반영 항목을 읽는다. 실패·부재는 빈 목록으로 수렴한다. */
   findAppliedReviewItems?: (branch: string, goalId?: string) => Promise<{ basePrLocated: boolean; items: readonly string[]; headlineComments?: number; source?: 'ledger' | 'pr-comment' | 'unavailable' }>;
   /** ★ 반사-기각 seam(RFC-selfdev-judgment-context-substrate Facet C) — must-fix 재주입 前 각 항목을
@@ -962,6 +995,8 @@ export interface SelfImplementSeams {
   /** PR을 열기 전에 보존할 산출물이 있는지 판별한다. `base` 대비 branch 고유 변경과 미커밋 변경을 함께 본다.
    *  생략 시 기존 주입 seam 호환을 위해 산출물이 있다고 본다. */
   preservationHasChanges?: (ctx: { cwd: string; base?: string }) => boolean | Promise<boolean>;
+  /** Test seam for blocked environment branch persistence; return whether the branch was pushed. */
+  preserveBlockedBranch?: (ctx: { cwd: string; branch: string; title: string }) => boolean | Promise<boolean>;
   /** Hard-cap salvage evidence: a clean worktree and commits ahead of origin/main. */
   readReworkSalvageEvidence?: (cwd: string) => Promise<ReworkSalvageEvidence>;
   /** Starts exactly one detached `elanous dev --file <goal> --base <branch>` follow-up. */
@@ -978,7 +1013,7 @@ export interface SelfImplementSeams {
   readPrDiff?: (opts: { number: number; cwd: string; baseCommit: string; headCommit: string }) => Promise<string>;
   /** ★ ⑦ 병합 seam(2026-07-21·auto-merge) — 열린 PR 을 실제 병합(gh pr merge --squash). `matchHeadCommit`이 있으면
    * 검사한 고정 head 뒤 변경을 gh가 거부한다. autoMerge + 리뷰 clean 일 때만 호출(outward-facing·main 자율병합). */
-  mergePr?: (opts: { number: number; cwd: string; matchHeadCommit?: string }) => Promise<{ merged: boolean; baseRefName?: string; detail?: string }>;
+  mergePr?: (opts: { number: number; cwd: string; matchHeadCommit?: string }) => Promise<{ merged: boolean; baseRefName?: string; mergeCommit?: string; detail?: string }>;
   /** Post-merge cleanup is opt-in and injectable so tests never touch the filesystem. */
   postMergeCleanup?: {
     enabled: boolean;
@@ -1052,6 +1087,8 @@ export const SELF_IMPLEMENT_PROGRESS_STAGES = [
   //    ⛔ 기존 단계 이름을 «빌려 쓰지 않는다» — `progress()` 는 단계 이름으로 원장 행을 만들므로
   //       빌려 쓰면 그 단계 집계가 오염된다([T] 2026-09-12 · `#17767` 이후 계약).
   'declared-targets-unmade',
+  // ⭐ `경계:` 글로브에 실제로 닿은 변경. 막지 않고 이름만 낸다.
+  'boundary-violated',
 ] as const;
 
 export type SelfImplementProgressStage = typeof SELF_IMPLEMENT_PROGRESS_STAGES[number];
@@ -1821,7 +1858,6 @@ export type GoalRunRecordWriter = (goalFile: string, record: GoalExecutionRecord
 
 export function appendGoalExecutionRecord(goalFile: string, record: GoalExecutionRecord): void {
   const existing = readFileSync(goalFile, 'utf8');
-  if (existing.includes(`- runId: ${record.runId}\n`)) return;
   const entry = [
     '## 실행 기록',
     `- runId: ${record.runId}`,
@@ -1890,6 +1926,14 @@ export function appendGoalExecutionRecord(goalFile: string, record: GoalExecutio
       : []),
     '',
   ].join('\n');
+  const goalId = existing.match(/^- GoalId: ([0-9a-f]{16})$/m)?.[1];
+  if (goalId) {
+    const path = writeGoalRunRecordFragment(goalId, record.runId, entry);
+    logRunAwareFailSoft(record.runId, 'goal-record-fragment-written', { goalId, path });
+  }
+  // Legacy documents without GoalId have no fragment key; retain the append so the run is not lost.
+  if (goalId && getUserConfig().tools.selfImplement.goalRecordInDoc === false) return;
+  if (existing.includes(`- runId: ${record.runId}\n`)) return;
   appendFileSync(goalFile, `${existing.endsWith('\n') ? '' : '\n'}${entry}`);
 }
 
@@ -1899,13 +1943,6 @@ export interface SelfImplementOptions {
    *    ⇒ 런 슈퍼바이저는 「시도의 요약 판정」만 보고 「어떻게 걸었나」를 «못 봤다».
    *  ⛔ 관측용이다 — 흐름을 바꾸지 않는다. ⛔ 던져도 런이 안 죽는다(호출부가 감싼다). */
   onNodeEntry?: (node: PipelineNodeId, round: number) => void;
-  /** ⛔⭐ 실험 — 그래프 선언을 «실행 권위»로 올린다(RFC §5 1단계). config 를 «이긴다».
-   *
-   *  📌 이 칸이 있는 이유가 둘이다:
-   *    ⓐ 「건너뛰는 쪽」을 시험에서 «누를 수» 있어야 한다 — 없으면 그 갈래는 실물로만 확인된다.
-   *    ⓑ `resolveGraphAuthority` 의 `source: 'flag'` 가 «아무도 안 쓰는» 퇴화 축이었다
-   *       (같은 날 `goalTypeSource` 가 같은 병을 앓았다 — 값이 언제나 하나면 그 축은 아무것도 안 가른다). */
-  graphAuthoritative?: boolean;
   /** 시험이 런치 오버레이를 빼 «지금 YAML 예산»을 읽게 할 때 쓴다. 생략하면 디스크 오버레이다. */
   graphOverlays?: readonly GraphOverlaySpec[];
   /** ★ K run-identity — 이 self-implement 호출의 per-run join anchor. 미지정 시 상속(env)→canonical mint.
@@ -1985,6 +2022,8 @@ export interface SelfImplementOptions {
    *  outward-facing(main 병합)이라 명시 opt-in 만. mergePr seam 이 있어야 실제 병합(없으면 non-draft PR 까지).
    *  completion이 없던 기존 호출자의 호환 입력으로 유지한다. */
   autoMerge?: boolean;
+  /** Pod-only: stop after passing the same merge guards, leaving the ready PR for host regate. */
+  mergeByHost?: boolean;
   /** ★ G8 자기판단(2026-07-23·[[ROADMAP-elanous-is-all-pty-unified-autonomy-2026-07-21]] §2b) — PR 을 열 때
    *  `auto-review` opt-in 라벨을 붙일지. **2단 게이트**: 이 플래그(사람 옵트인) AND assessAutonomyEligibility
    *  (작업 위험도 자기판단·fail-safe) 통과여야 부착. 부적합(외부배포·실주문·설계분기·파괴·보안·리뷰 must-fix)이면
@@ -2096,6 +2135,8 @@ export interface SelfImplementResult {
   supervisorWantedContinue?: true;
   /** Additive hard-cap disposition; outcome remains the stable public terminal contract. */
   salvage?: 'launched' | 'parked';
+  /** Rework stopped on exclusively baseline/flaky/precondition failures; do not retry this goal against the same base. */
+  terminationReason?: 'blocked-by-baseline';
   sessionId?: string;
   worktreePath?: string;
   branch?: string;
@@ -2134,6 +2175,7 @@ export interface SelfImplementResult {
   mergeReason?: string;
   prUrl?: string;
   prNumber?: number;
+  checkedHeadCommit?: string;
   detail?: string;
 }
 
@@ -2443,7 +2485,30 @@ function formatGoalFileForPrBody(goalFile: string, cwd = process.cwd()): string
   return relative(canonicalRoot, canonicalGoal).split(sep).join('/');
 }
 
-function prBody(feature: string, implSummary: string, gateLog?: string, review?: SelfImplementReview, reviewIntent?: string, autoReviewDeclineReasons?: readonly string[], evidence?: string, goalFile?: string, planRevision?: ReworkPlanRevision): string {
+export class MergedReleaseNoteWriteError extends Error {
+  readonly prNumber: number;
+  readonly prUrl: string;
+  readonly directory: string;
+  readonly fragment: ReleaseNoteFragment;
+
+  constructor(prUrl: string, directory: string, fragment: ReleaseNoteFragment, cause: unknown) {
+    super(`PR #${fragment.pr} was merged, but its release note could not be written to ${directory}: ${safeErrorDescription(cause)}`, { cause });
+    this.name = 'MergedReleaseNoteWriteError';
+    this.prNumber = fragment.pr;
+    this.prUrl = prUrl;
+    this.directory = directory;
+    this.fragment = fragment;
+  }
+}
+
+function goalDocumentForReleaseNote(goalFile?: string): string {
+  if (!goalFile) return '';
+  try { return readFileSync(goalFile, 'utf8'); }
+  catch { return ''; }
+}
+
+function prBody(feature: string, implSummary: string, gateLog?: string, review?: SelfImplementReview, reviewIntent?: string, autoReviewDeclineReasons?: readonly string[], evidence?: string, goalFile?: string, planRevision?: ReworkPlanRevision, releaseNote?: ReturnType<typeof harnessReleaseNote>): string {
+  const note = releaseNote ?? harnessReleaseNote(goalDocumentForReleaseNote(goalFile), prTitle(feature));
   const relaxation = planRevision?.relaxation
     ? ['', '## 감독 수용 기준 완화', `- 대상: ${planRevision.relaxation.target}`, `- 이전: ${planRevision.relaxation.expected}`, `- 완화: ${planRevision.relaxation.replacement}`, `- 이유: ${planRevision.reason}`, `- 적용: ${planRevision.application?.status ?? 'failed'}${planRevision.application?.detail ? ` (${planRevision.application.detail})` : ''}`, ...(planRevision.disposition ? [`- 충돌 처분: ${planRevision.disposition}`] : [])]
     : [];
@@ -2454,6 +2519,8 @@ function prBody(feature: string, implSummary: string, gateLog?: string, review?:
     '',
     '## 구현 요약',
     implSummary.trim() || '(요약 없음)',
+    '',
+    renderReleaseNoteSection(note).trimEnd(),
     // ★ I-9 — 성공 경로도 수확본을 싣는다. blocked 쪽만 실으면 **통과한 PR 에서 증거가 사라진다**.
     ...(evidence ? ['', '## 자식이 남긴 증거 (EVIDENCE/RESULT · 화면 전체에서 수확)', '```', evidence, '```'] : []),
     ...(reviewIntent ? ['', '## 리뷰 intent', reviewIntent] : []),
@@ -2972,11 +3039,11 @@ export function federationObservation(shardIdentity: RunShardIdentity): Record<s
  *   🚨 그것을 `pr-only` 라 부르면 ***「PR 을 연다」로 읽히는데 worktree-only 도 여기 들어온다*** — 이름이 거짓이 된다.
  *   ⇒ 📌 세 번째 값이 필요하면 `completion` 자체를 seam 으로 내려보내야 한다(계약 변경).
  */
-export function completionIntentOf(opts: Pick<SelfImplementOptions, 'completion' | 'autoMerge'>): SelfImplementOptions['completion'] | 'not-auto-merge' {
-  return opts.completion ?? (opts.autoMerge === true ? 'auto-merge' : 'not-auto-merge');
+export function completionIntentOf(opts: Pick<SelfImplementOptions, 'completion' | 'autoMerge' | 'mergeByHost'>): SelfImplementOptions['completion'] | 'not-auto-merge' {
+  return opts.completion ?? (opts.autoMerge === true || opts.mergeByHost === true ? 'auto-merge' : 'not-auto-merge');
 }
 
-function autoMergeEnabled(opts: Pick<SelfImplementOptions, 'completion' | 'autoMerge'>): boolean {
+function autoMergeEnabled(opts: Pick<SelfImplementOptions, 'completion' | 'autoMerge' | 'mergeByHost'>): boolean {
   return completionIntentOf(opts) === 'auto-merge';
 }
 
@@ -3240,9 +3307,14 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
   if (opts.childLlm && (typeof opts.childLlm.provider !== 'string' || !opts.childLlm.provider.trim() || typeof opts.childLlm.model !== 'string' || !opts.childLlm.model.trim())) {
     throw new Error('childLlm.provider and childLlm.model must both be non-empty');
   }
-  const branch = opts.branchName ?? plannedSelfImplBranch(opts.feature, opts.goalId);
   const identity = resolveRunIdentity({ explicit: opts.runId });
   const { runId } = identity;
+  const branch = opts.branchName ?? plannedSelfImplBranch(opts.feature, opts.goalId, runId);
+  try {
+    debug.log('self-implement.branch', 'planned', {
+      runId, goalId: opts.goalId, branch, runSuffix: opts.branchName === undefined ? branch.match(/-r[a-z0-9]{6}$/)?.[0] ?? null : null,
+    });
+  } catch { /* observation must not block the run */ }
   const attemptOrdinal = incrementRunAttemptOrdinal(runId);
   const shardIdentity = parseRunShardIdentity(opts.feature);
   const observeOuter = makeRunObserver(runId, opts.goalId, debug.log.bind(debug), opts.seams.writeRunLedger, shardIdentity);
@@ -3314,13 +3386,30 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
   };
   let loopRegistered = false;
   let mergeApprovalReceived = false;
+  let autoMergeAuthorizedBeforeSync = false;
   let lastParsedSupervisorVerdict: ReworkBudgetVerdict | undefined;
   let lastParsedSupervisorReason: string | undefined;
   let providerErrorCount = 0;
   let credentialFailureCount = 0;
+  let failureSequence = 0;
+  let lastProviderErrorSeq = 0;
+  let lastCredentialFailureSeq = 0;
+  let lastFailedGateSeq = 0;
+  let lastMustFixReviewSeq = 0;
+  const recordFailureVerdict = async (kind: 'gate' | 'review'): Promise<void> => {
+    // Capture child errors at the verdict boundary, not when terminal reporting eventually reads them.
+    await mergeChildProviderErrors();
+    if (kind === 'gate') lastFailedGateSeq = ++failureSequence;
+    else lastMustFixReviewSeq = ++failureSequence;
+  };
+  const latestVerdictSeq = (): number => Math.max(lastFailedGateSeq, lastMustFixReviewSeq);
+  const hasCurrentProviderError = (): boolean => providerErrorCount > 0 && lastProviderErrorSeq > latestVerdictSeq();
+  const hasCurrentCredentialFailure = (): boolean => credentialFailureCount > 0 && lastCredentialFailureSeq > latestVerdictSeq();
   let lastProviderError: { provider?: string; message?: string } | undefined;
   let lastCredentialFailure: { provider?: string; message?: string } | undefined;
   let childProviderErrorQueryStatus: 'found' | 'none' | 'unavailable' | 'not-configured' = 'not-configured';
+  let queriedProviderErrorCount = 0;
+  let queriedCredentialFailureCount = 0;
   const providerErrorsForResult = (): Pick<SelfImplementResult, 'providerErrors'> => {
     if (providerErrorCount === 0) return {};
     const message = lastProviderError?.message ?? '';
@@ -3340,8 +3429,14 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
       const result = await query({ runId, sinceMs: startedAtMs, untilMs: Date.now() });
       childProviderErrorQueryStatus = result.status;
       if (result.status !== 'found') return;
-      providerErrorCount += result.providerErrorCount;
-      credentialFailureCount += result.credentialFailureCount;
+      const newProviderErrors = Math.max(0, result.providerErrorCount - queriedProviderErrorCount);
+      const newCredentialFailures = Math.max(0, result.credentialFailureCount - queriedCredentialFailureCount);
+      providerErrorCount += newProviderErrors;
+      credentialFailureCount += newCredentialFailures;
+      if (newProviderErrors > 0) lastProviderErrorSeq = ++failureSequence;
+      if (newCredentialFailures > 0) lastCredentialFailureSeq = newProviderErrors > 0 ? lastProviderErrorSeq : ++failureSequence;
+      queriedProviderErrorCount = Math.max(queriedProviderErrorCount, result.providerErrorCount);
+      queriedCredentialFailureCount = Math.max(queriedCredentialFailureCount, result.credentialFailureCount);
       lastProviderError = result.lastProviderError ?? lastProviderError;
       lastCredentialFailure = result.lastCredentialFailure ?? lastCredentialFailure;
     } catch {
@@ -3356,6 +3451,7 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
       if (!data || typeof data !== 'object') return;
       const { provider, message } = data as Record<string, unknown>;
       providerErrorCount++;
+      lastProviderErrorSeq = ++failureSequence;
       lastProviderError = {
         ...(typeof provider === 'string' ? { provider } : {}),
         ...(typeof message === 'string' ? { message } : {}),
@@ -3371,6 +3467,7 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
       //   여기서 문면 정규식으로 다시 재면 소비자마다 다른 답이 나온다.
       if ((data as Record<string, unknown>).authRejected === true) {
         credentialFailureCount++;
+        lastCredentialFailureSeq = lastProviderErrorSeq;
         lastCredentialFailure = { ...lastProviderError };
       }
     },
@@ -3379,6 +3476,15 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
   const progressDelivery = { delivered: 0, unwired: 0, callbackFailed: 0 };
   let capturedPrNumber: number | undefined;
   let openPrInvoked = false;
+  const defaultProviderName = opts.seams.currentProviderName?.() ?? currentProviderName();
+  const runProviderName = opts.childLlm?.provider ?? defaultProviderName;
+  const logQuotaProvider = (assessment: QuotaExhaustionAssessment | undefined): void => {
+    try {
+      debug.log('self-implement.abandoned', 'quota-provider', {
+        runProvider: runProviderName, defaultProvider: defaultProviderName, used: assessment?.exhausted !== undefined,
+      });
+    } catch { /* observation must not change the terminal result */ }
+  };
   const instrumentedOpts: SelfImplementOptions = {
     ...opts,
     seams: {
@@ -3418,6 +3524,7 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
   /** ⭐ 방문 예산을 읽으려면 «지금 도는 선언»이 필요하다 — 신원과 «같은 패턴»으로 한 번 심는다.
    *  ⛔ 걸음(`traversedNodes`)은 이 스코프에 있고 선언은 안쪽에서 정해지므로, 둘을 잇는 자리가 여기다. */
   let runGraphTemplate: GraphTemplate | undefined;
+  let runContract: RunContract | undefined;
   let runGraphIdentity: { graphId: string; graphVersion: string } | undefined;
   const setRunGraphIdentity = (identity: { graphId: string; graphVersion: string }): void => {
     runGraphIdentity = identity;
@@ -3469,6 +3576,7 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
     traversedNodes.push(node);
     if (node === 'implement') roundCount++;
     const fallbackGraphIdentity = observedGraphIdentity();
+    const contractAtNode = runContract === undefined ? undefined : runContractAtNode(runContract);
     observePipeline('pipeline-node-entry', {
       ...pipelineNodeEntryPayload(
         runGraphTemplate ?? { graphId: fallbackGraphIdentity.graphId, version: fallbackGraphIdentity.graphVersion, nodes: [] },
@@ -3476,7 +3584,15 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
       ),
       node,
       round,
+      ...contractAtNode,
     });
+    if (contractAtNode?.contractHonored === false) {
+      observeOuter('graph-contract-violation', {
+        node, round,
+        contractSubstrate: contractAtNode.contractSubstrate,
+        actualSubstrate: contractAtNode.actualSubstrate,
+      }, { level: 'warn' });
+    }
   };
   const observeRoundClassification = (classification: LifecycleScreenComparison): void => {
     roundClassifications.push(classification);
@@ -3731,29 +3847,37 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
       }),
       instrumentedOpts.seams.reworkBudgetReviewFindingRecurrence ?? (() => null),
       () => { mergeApprovalReceived = true; },
+      () => { autoMergeAuthorizedBeforeSync = true; },
       (verdict) => { lastParsedSupervisorVerdict = verdict; },
       (reason) => { lastParsedSupervisorReason = reason; },
       (base) => { resolvedBase = base ?? undefined; },
       (basis) => { observationMeasurementBasis = basis; },
       (timeout) => { clarificationTimeout = timeout; },
-      () => providerErrorCount > 0,
-      () => credentialFailureCount > 0,
-      () => providerErrorsForResult().providerErrors?.category,
+      hasCurrentProviderError,
+      hasCurrentCredentialFailure,
+      () => hasCurrentProviderError() ? providerErrorsForResult().providerErrors?.category : undefined,
       (rejectedCount) => { reviewReflectRejectedCount = (reviewReflectRejectedCount ?? 0) + rejectedCount; },
       observeOuter,
       (active) => { runActiveProvider = active; },
       (sessionId) => { terminalSessionId = sessionId; },
+      (contract) => { runContract = contract; },
+      recordFailureVerdict,
+      () => providerErrorCount > 0,
+      () => credentialFailureCount > 0,
+      hasCurrentProviderError,
+      hasCurrentCredentialFailure,
     );
     terminalNode = result.node;
     await mergeChildProviderErrors();
     const addressedResult = attachAbandonedClassification(
       attachReviewReflectionOutcome({ ...result, ...providerErrorsForResult(), runId, ...(lastParsedSupervisorReason ? { supervisorReason: lastParsedSupervisorReason } : {}), ...(mergeApprovalReceived ? { mergeApprovalReceived: true } : {}) }),
       opts.goalFile,
-      providerErrorCount > 0,
-      credentialFailureCount > 0,
+      hasCurrentProviderError(),
+      hasCurrentCredentialFailure(),
       opts.seams.inspectCodexRotation,
-      opts.seams.currentProviderName?.(),
+      runProviderName,
     );
+    if (isAbandonedClassificationOutcome(addressedResult.outcome)) logQuotaProvider(addressedResult.quotaExhaustionAssessment);
     observeOuter('child-provider-error-query', { status: childProviderErrorQueryStatus });
     if (lastProviderError) {
       observeOuter('provider-error-observed', { count: providerErrorCount, ...lastProviderError });
@@ -3823,14 +3947,15 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
         branch,
         ...(worktreePath ? { worktreePath } : {}),
         ...(lastParsedSupervisorReason ? { supervisorReason: lastParsedSupervisorReason } : {}),
-        ...(mergeApprovalReceived ? { mergeApprovalReceived: true } : {}),
+        ...(mergeApprovalReceived || (e.step === 'merge' && autoMergeAuthorizedBeforeSync) ? { mergeApprovalReceived: true } : {}),
         detail: worktreePath
           ? `자율 단계 '${e.step}' wall-clock ${e.ms}ms 초과 — hang 방지 종결(worktree 회수 경로: ${worktreePath})`
           : `자율 단계 '${e.step}' wall-clock ${e.ms}ms 초과 — hang 방지 종결(worktree 생성 전)`,
       };
       terminalNode = result.node;
       await mergeChildProviderErrors();
-      const addressedResult = attachAbandonedClassification(attachReviewReflectionOutcome({ ...result, ...providerErrorsForResult() }), opts.goalFile, providerErrorCount > 0, credentialFailureCount > 0, opts.seams.inspectCodexRotation, opts.seams.currentProviderName?.());
+      const addressedResult = attachAbandonedClassification(attachReviewReflectionOutcome({ ...result, ...providerErrorsForResult() }), opts.goalFile, hasCurrentProviderError(), hasCurrentCredentialFailure(), opts.seams.inspectCodexRotation, runProviderName);
+      logQuotaProvider(addressedResult.quotaExhaustionAssessment);
       observeOuter('child-provider-error-query', { status: childProviderErrorQueryStatus });
       if (lastProviderError) {
         observeOuter('provider-error-observed', { count: providerErrorCount, ...lastProviderError });
@@ -4012,12 +4137,24 @@ export function readQuotaExhausted(
     // ⛔⭐⭐⭐ 그리고 이 신호는 **codex 전용**이다(2R must-fix) — provider 를 «안 보면»
     //   Claude·Grok 으로 돈 런까지 codex 쿼터로 «오분류»한다. 그건 이 PR 이 고치려던
     //   「잡통」의 «반대 방향» 오류다.
-    //   ⚠️ 한계: 이것은 «부모의 현재 설정»이지 그 런이 실제로 쓴 provider 가 아니다
-    //     (자식이 tier 를 올렸을 수 있다). 그 정확한 귀속은 자식 계측이 선결이라 별개 축이다.
+    //   호출자는 구현 자식 provider 를 우선 넘긴다. 자식 선택이 없으면 프로세스 기본 provider 로 귀속한다.
+    //   부모(리뷰·감독)의 별도 폴백이나 자식 내부 전환은 이 평가의 범위 밖이다.
     const snapshot = rotationInspector();
     // ⭐ 좁히지 않는다 — 스냅샷이 «이미 아는» 것을 증거로 그대로 옮긴다(`quotaAvailabilityEvidence`).
     // ⛔⭐ 「언제 읽었나」를 «값으로» 박는다 — 이 읽기는 런이 «끝난 뒤»다(타입 머리말 참조).
-    return assessQuotaExhaustion(providerName, { ...quotaAvailabilityEvidence(snapshot), readPoint: 'postmortem' });
+    const evidence = { ...quotaAvailabilityEvidence(snapshot), readPoint: 'postmortem' as const };
+    // ⛔⭐ 정본 스토어가 아는 계정이 «0개»면 회전이 구성되지 않은 것이다 — 「쓸 계정 없음」을 소진으로 읽지 않는다.
+    //   🩸 P6(2026-09-26 Pod 실물): Pod 는 계정 사본 하나만 받고 회전 목록이 없어 no-candidate → 「할당량 소진」으로
+    //     분류됐다. 진짜 원인(게이트의 tsc 127 · P5)이 그 오분류에 가려졌다. 호스트의 진짜 소진(계정은 있는데 전부 찼다)은 그대로다.
+    if (snapshot.knownAccountCount === 0) return { exhausted: undefined, accountAvailability: evidence };
+    // ⛔⭐ 아는 계정이 «하나»뿐이면 no-candidate 는 «돌릴 곳이 원래 없다»는 뜻이지 «찼다»가 아니다.
+    //   🩸 P2 #20869(2026-09-27 Pod 실물): Pod 는 배분받은 계정 사본 «하나»(third · 잔량 넉넉)만 갖고 그 계정의 사용률 신호가
+    //     없었다 → 회전은 no-candidate → 「할당량 소진」으로 분류돼 진짜 원인(리뷰 UNCONVERGEABLE)을 가렸다.
+    //   ⇒ 그 한 계정의 사용률도 도달 신호도 없으면 «모름». 사용률을 알면 종전 판정(임계 미만=false · 이상=true)에 맡긴다.
+    if (snapshot.knownAccountCount === 1 && evidence.reason === 'no-candidate' && snapshot.currentUsedPercent === undefined && snapshot.currentReached !== true) {
+      return { exhausted: undefined, accountAvailability: evidence };
+    }
+    return assessQuotaExhaustion(providerName, evidence);
   } catch {
     return { exhausted: undefined, accountAvailability: undefined };   // fail-soft — 관측은 결론을 막지 않는다
   }
@@ -4085,7 +4222,7 @@ export function attachAbandonedClassification(
       ...(quotaExhaustionAssessment.accountAvailability ? { quotaAccountAvailability: quotaExhaustionAssessment.accountAvailability } : {}),
       ...(credentialFailure ? { credentialFailure: true } : {}),
       ...(providerError ? { providerError: true } : {}),
-      ...(result.providerErrors?.category ? { providerErrorCategory: result.providerErrors.category } : {}),
+      ...(providerError && result.providerErrors?.category ? { providerErrorCategory: result.providerErrors.category } : {}),
       worktreePorcelain: worktree.worktreePorcelain,
       ...(worktree.gitResidue ? { gitResidue: worktree.gitResidue } : {}),
       ...(result.completionDisposition ? { completionDisposition: result.completionDisposition } : {}),
@@ -4268,6 +4405,7 @@ async function runSelfImplementInner(
    *  이제 null 이면 measureReviewFindingRecurrence 가 «실제로» 잰다. */
   reworkBudgetReviewFindingRecurrence: () => ReviewFindingRecurrence | null = () => null,
   onMergeApprovalReceived: () => void = () => {},
+  onAutoMergeAuthorizedBeforeSync: () => void = () => {},
   onSupervisorVerdictParsed: (verdict: ReworkBudgetVerdict) => void = () => {},
   onSupervisorReasonParsed: (reason: string | undefined) => void = () => {},
   onResolvedBase: (base: string | null) => void = () => {},
@@ -4282,16 +4420,20 @@ async function runSelfImplementInner(
    *  (그러면 「런이 끝날 무렵의 provider」가 되어 `F45` 를 그대로 밟는다). 시작 시점 값을 넘긴다. */
   onActiveProvider: (active: { provider?: string; model?: string; auth?: string }) => void = () => {},
   onSessionCreated: (sessionId: string) => void = () => {},
+  onRunContractResolved: (contract: RunContract) => void = () => {},
+  onFailureVerdict: (kind: 'gate' | 'review') => Promise<void> = async () => {},
+  hasObservedProviderError: () => boolean = hasProviderError,
+  hasObservedCredentialFailure: () => boolean = hasCredentialFailure,
+  hasCurrentProviderError: () => boolean = hasProviderError,
+  hasCurrentCredentialFailure: () => boolean = hasCredentialFailure,
 ): Promise<Omit<SelfImplementResult, 'runId'>> {
   const s = opts.seams;
   const pipelineStartedAtMs = Date.now();
-  // Graph authority defaults ON and preserves flag → config → default provenance.
+  // Graph authority is always ON; retain the resolved event with default provenance.
   // For research documents, its declared docs-only routing intentionally skips the gate.
-  const userConfig = (await import('../user-config.js')).getUserConfig();
-  const graphAuthority = resolveGraphAuthorityForUserConfig(userConfig, opts.graphAuthoritative);
+  const graphAuthority = resolveGraphAuthorityForUserConfig();
   // ⛔ 골 파일이 «없을 수» 있다 — 그때는 골 종류를 모르므로 implement-loop 으로 간다(없는 길로 안 보낸다).
   // ⭐ 대표 지시 ② «변형» — 「최초 결정 시 해당 템플릿 변형을 한다」.
-  //   ⛔ 승격이 꺼져 있으면 `decideTemplate` 은 `activeTemplate` 과 «같은 값»을 낸다(고르지도 않는다).
   const graphGoalType = opts.goalFile === undefined ? undefined : (goalTypeFields(opts.goalFile).goalType as GoalType | undefined);
   // ⛔ 오버레이는 «한 번» 읽는다 — 라운드마다 디스크를 읽으면 도는 중에 파일이 바뀌어 걸음이 갈린다.
   // ⛔ 이름이 `graph`인 이유: launch(②)·runtime(③) «둘 다» 이 목록에서 고른다. 단계는 인자로 갈린다.
@@ -4308,24 +4450,28 @@ async function runSelfImplementInner(
   // ⛔⭐ `let` 인 이유는 ③ «다이나믹»이다 — 라운드마다 runtime 오버레이가 «앞을 보는 것»만 바꾼다.
   //   ⛔ 지난 노드를 재정의하지 않는다(RFC §6: 그러면 원장을 사후에 해석할 수 없다).
   let graphTemplate = graphDecision.template;
-  /** 단계 이름 → 그 템플릿의 노드 이름. ⛔ 꺼져 있으면 «항등»이다. */
+  /** 단계 이름 → 그 템플릿의 노드 이름. */
   const node = (stage: PipelineNodeId): PipelineNodeId => nodeNameForStage(stage, graphTemplate) as PipelineNodeId;
   // ⛔⭐ 맥락이 정해진 «직후» 관측기에 심는다 — 이 줄이 없으면 걸음은 YAML 을 따르고 «신원은 안 따른다».
   onGraphResolved(graphIdentityOf(graphTemplate));
-  // ⭐ 제어 «출처»를 런마다 «한 번» 남긴다 — ⛔ 승격 여부와 무관하게 «언제나».
-  //   🩸 2026-09-08: 이 값은 `gate-skipped-by-graph` «한 자리»에서만 났고, 그 사건은
-  //     research-loop 이 문서만 바꿨을 때만 난다 ⇒ ***대부분의 런에서 「무엇이 켰나」가 원장에 없었다***.
-  //   ⛔ 그래서 A/B 의 관문(「두 팔이 갈렸나」)이 «원리상» 답을 못 얻었다.
-  //   ⛔ 「켜짐」만 남기지 않는다 — `source` 가 「안 켰다」와 「켰는데 안 먹었다」를 가른다.
+  // 권위는 항상 켜지지만 이벤트의 필드 모양은 유지하고 출처를 default로 기록한다.
   observe('graph-authority-resolved', graphAuthorityFields(graphAuthority, graphTemplate));
+  // ⭐ 런 계약 — 런 시작 «한 번» 해석한다(대표 2026-09-26 «초반 계약을 노드가 준수»). 해석 출처(source)와
+  //   실제 칸(actualSubstrate)을 같이 남겨 「계약이 Pod 인데 로컬에서 돌았나」를 원장이 답하게 한다.
+  //   노드 진입 대조는 관측만 하며 실행을 막지 않는다.
+  {
+    const { resolveRunContract } = await import('./graph-run-contract.js');
+    const runContract = resolveRunContract({ ...(graphTemplate.runContract ? { graph: graphTemplate.runContract } : {}), env: process.env });
+    onRunContractResolved(runContract);
+    observe('graph-run-contract-resolved', { ...graphIdentityOf(graphTemplate), ...runContract, ...runContractAtNode(runContract) });
+  }
   // ⛔ 승격이 꺼져 있으면 «심지 않는다» — 그러면 예산 관측도 안 난다(운영 원장이 오늘과 같다).
   if (graphAuthority.enabled) onGraphTemplateResolved(graphTemplate);
   // ⛔ 선택을 «전부» 싣는다 — 얹힌 것만 실으면 「왜 안 얹혔나」를 사후에 못 묻는다.
-  //   ⛔ 「없음」과 「안 봤음」을 가른다: 승격이 꺼졌으면 selections 가 «빈 배열»이고 그것이 값이다.
   /** ⭐ ③ «다이나믹» — 라운드마다 runtime 오버레이를 다시 고른다.
    *  ⛔ **매번 «기준 선언»에서 다시 얹는다** — 이전 라운드 결과 위에 겹쳐 얹으면
    *    「이 걸음을 무엇이 만들었나」가 «누적»이 되어 사후에 못 푼다.
-   *  ⛔ 승격이 꺼져 있으면 아무 일도 안 한다(오늘과 같은 걸음). */
+   *  오버레이 적용은 기존 실행 경로를 그대로 따른다. */
   const applyRuntimeOverlays = (round: number): void => {
     if (!graphAuthority.enabled) return;
     // ⛔ 「지금 아는 것」만 준다 — 없는 값을 0 으로 지어내지 않는다(key-absent 가 그것을 말한다).
@@ -4376,8 +4522,8 @@ async function runSelfImplementInner(
     roundClassifications.push(classification);
     onRoundClassification(classification);
   };
-  const branch = opts.branchName ?? plannedSelfImplBranch(opts.feature, opts.goalId);
   const { runId, source: runIdSource } = identity ?? resolveRunIdentity({ explicit: opts.runId });
+  const branch = opts.branchName ?? plannedSelfImplBranch(opts.feature, opts.goalId, runId);
   try {
     debug.log('run-identity', 'own', {
       runId, branch, source: runIdSource, nestDepth: nestInfo().depth, ...originObservationFields(),
@@ -4406,11 +4552,13 @@ async function runSelfImplementInner(
   // ⭐ 관측 이벤트와 «같은 값»을 원장으로도 보낸다 — 로그에만 있으면 원장 질의가 못 센다(`F12`).
   try { onActiveProvider(activeProvider); } catch { /* 보조 기록이 런을 죽이지 않는다 */ }
   const boundedFeature = boundReadableText(opts.feature, RUN_START_FEATURE_MAX_CHARS);
+  const launchCwd = resolve(process.cwd());
   observe('start', {
     feature: boundedFeature.text, featureTruncated: boundedFeature.truncated, featureOriginalChars: boundedFeature.originalChars,
     branch, base: opts.base ?? null, draft: opts.draft ?? true,
     willFork: !!(opts.parentSessionId && s.forkSession), parentSessionId: opts.parentSessionId ?? null,
-    nestDepth: nestInfo().depth, goalSource, goalFile: opts.goalFile ?? null, ...originObservationFields(),
+    nestDepth: nestInfo().depth, goalSource, goalFile: opts.goalFile === undefined ? null : resolve(launchCwd, opts.goalFile),
+    targetRoot: gitRootOf(launchCwd) ?? launchCwd, ...originObservationFields(),
     provider: activeProvider.provider ?? null, model: activeProvider.model ?? null, auth: activeProvider.auth ?? null,
     ...(opts.correlationId !== undefined ? { correlationId: opts.correlationId } : {}),
   });
@@ -4777,12 +4925,15 @@ async function runSelfImplementInner(
     return occurrencePattern.test(reason) && roundsPattern.test(reason);
   };
   const failCounts: number[] = [];
+  // 직전 gate 실패 라운드의 미검증 집합(정렬 키). 통과하면 비운다 — «연속» 반복만 센다.
+  let lastGateUnverifiedKey: string | undefined;
   const reworkHistory: string[] = [];
   const supervisorDecisionHistory: Array<{ round: number; verdict: ReworkBudgetVerdict; reason: string }> = [];
   let judgedEffectiveMax: number | undefined;
   let lastReworkVerdict: ReworkBudgetVerdict | undefined;
   let lastSupervisorVerdict: ReworkBudgetVerdict | undefined;
   let lastSupervisorReason: string | undefined;
+  let consecutiveUnresolvedBudget = 0;
   let pendingPlanRevision: ReworkPlanRevision | undefined;
   let lastPlanRevision: ReworkPlanRevision | undefined;
   const isReviewRework = (source: SupervisionReworkSource): boolean => {
@@ -4818,8 +4969,23 @@ async function runSelfImplementInner(
       observe('review-context-carried', { base: opts.base, basePrLocated: false, carriedItems: 0, headlineComments: 0, source: 'unavailable', error: true, reason: 'lookup-failed' }, { level: 'warn' });
     }
   }
+  const goalTitle = opts.goalFile ? goalTitleFromTargetGoalFile(opts.goalFile, wt.path) : undefined;
+  let priorRunFindings: Awaited<ReturnType<typeof collectPriorDraftFindings>> = [];
+  if (goalTitle) {
+    try {
+      priorRunFindings = await (s.collectPriorDraftFindings ?? collectPriorDraftFindings)({ goalTitle, currentRunId: runId, repoPath: wt.path });
+    } catch (error) {
+      observe('prior-findings.unreadable', { error: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  if (priorRunFindings.length) {
+    observe('prior-findings.loaded', {
+      prs: priorRunFindings.length,
+      items: priorRunFindings.reduce((sum, finding) => sum + finding.items.length, 0),
+    });
+  }
   let appliedLastRound: string[] | undefined;
-  let reviewIntent = buildReviewIntent({ goal: opts.feature, goalFile: opts.goalFile });
+  let reviewIntent = buildReviewIntent({ goal: opts.feature, goalFile: opts.goalFile, ...(priorRunFindings.length ? { priorRunFindings } : {}) });
   // ⛔⭐ 리뷰 루프가 만든 마지막 컨텍스트를 잡아 둔다 — PR 본문 조립 직전에 **최종 커밋**의
   //   런 사실로 갱신하기 위해서다(3R must-fix). 루프 안 수집은 `openPr` 단계가 만드는 커밋을
   //   못 본다: 자식은 파일만 남기고 실제 커밋은 `commitWork` 가 루프 뒤에서 만든다.
@@ -4996,9 +5162,10 @@ async function runSelfImplementInner(
     }
   };
   let preservationBase = wt.resolvedBase;
+  const runProviderName = opts.childLlm?.provider ?? (s.currentProviderName?.() ?? currentProviderName());
   let cachedQuotaExhaustionAssessment: QuotaExhaustionAssessment | undefined;
   const quotaExhaustionAssessmentForRun = (): QuotaExhaustionAssessment => {
-    cachedQuotaExhaustionAssessment ??= readQuotaExhausted(s.inspectCodexRotation, s.currentProviderName?.());
+    cachedQuotaExhaustionAssessment ??= readQuotaExhausted(s.inspectCodexRotation, runProviderName);
     return cachedQuotaExhaustionAssessment;
   };
   const classifyUnfinishedRun = (stage: SelfImplementStage, verdict?: ReworkBudgetVerdict, decomposition?: TerminalDecomposition): AbandonedClassificationResult => {
@@ -5008,9 +5175,9 @@ async function runSelfImplementInner(
       ...(opts.goalFile ? { goalType: goalTypeFields(opts.goalFile).goalType } : {}),
       ...(quotaExhaustionAssessment.exhausted ? { quotaExhausted: true } : {}),
       ...(quotaExhaustionAssessment.accountAvailability ? { quotaAccountAvailability: quotaExhaustionAssessment.accountAvailability } : {}),
-      ...(hasCredentialFailure() ? { credentialFailure: true } : {}),
-      ...(hasProviderError() ? { providerError: true } : {}),
-      ...(providerErrorCategory() ? { providerErrorCategory: providerErrorCategory() } : {}),
+      ...(hasCurrentCredentialFailure() ? { credentialFailure: true } : {}),
+      ...(hasCurrentProviderError() ? { providerError: true } : {}),
+      ...(hasCurrentProviderError() && providerErrorCategory() ? { providerErrorCategory: providerErrorCategory() } : {}),
       worktreePorcelain: worktree.worktreePorcelain,
       ...(worktree.gitResidue ? { gitResidue: worktree.gitResidue } : {}),
       ...(impl.completionDisposition ? { completionDisposition: impl.completionDisposition } : {}),
@@ -5145,30 +5312,76 @@ async function runSelfImplementInner(
       opts.goalFile,
       s.persistPrBodyArtifact,
     );
-    // worktree-only 는 원격이 없어 draft PR 을 열 수 없다. 시도 실패로 사유를 전하지 않고
-    // 같은 본문을 아티팩트로 남긴 뒤 워크트리·브랜치를 보존한다. no-changes 가 먼저다.
-    if (opts.completion === 'worktree-only') {
+    // no-changes wins; worktree-only remains local even for environment stops.
+    const environmentStop = blockedDraftDisposition(classificationRecord.classification) === 'preserve-branch';
+    const worktreeOnly = opts.completion === 'worktree-only';
+    if (worktreeOnly || environmentStop) {
       let artifactPath: string | undefined;
       let artifactError: string | undefined;
       try {
         artifactPath = persistFullPrBody(s.persistPrBodyArtifact, {
-          origin: 'self-implement-blocked-draft-pr-worktree-only',
+          origin: worktreeOnly ? 'self-implement-blocked-draft-pr-worktree-only' : 'self-implement-blocked-draft-pr-environment-stop',
           body: assembled.body,
           originalChars: assembled.originalChars,
         });
       } catch (persistenceError) {
         artifactError = persistenceError instanceof Error ? persistenceError.message : String(persistenceError);
       }
+      let pushed = false;
+      let committed = false;
+      let pushError: Error | undefined;
+      let preservationErrorStep: 'worktree' | 'commit' | 'push' | undefined;
+      if (environmentStop && !worktreeOnly) {
+        try {
+          if (!s.preserveBlockedBranch && !existsSync(wt.path)) {
+            preservationErrorStep = 'worktree';
+            throw new Error(`worktree not found: ${wt.path}`);
+          }
+          if (s.preserveBlockedBranch) {
+            pushed = await s.preserveBlockedBranch({ cwd: wt.path, branch: wt.branch, title: prTitle(opts.feature) });
+            if (!pushed) throw new Error('브랜치 push가 성공하지 않았음');
+          } else {
+            preservationErrorStep = 'commit';
+            const commit = commitWorktree(wt.path, prTitle(opts.feature));
+            if (!commit.ok && !/nothing to commit/.test(commit.out)) throw new Error(commit.out);
+            committed = commit.ok;
+            if (runGitCommand(wt.path, ['remote', 'get-url', 'origin']).status === 0) {
+              preservationErrorStep = 'push';
+              const push = runGitCommand(wt.path, ['push', '-u', 'origin', `HEAD:refs/heads/${wt.branch}`]);
+              if (push.status !== 0) throw new Error(push.stderr || push.stdout);
+              pushed = true;
+            }
+          }
+        } catch (error) {
+          pushError = error instanceof Error ? error : new Error(String(error));
+        }
+      }
       observe('rework-blocked-draft-pr', {
         ...observation,
-        skipped: 'worktree-only',
+        skipped: worktreeOnly ? 'worktree-only' : 'environment-stop',
+        ...(!worktreeOnly && environmentStop ? { pushed, committed } : {}),
         worktreePath: wt.path,
+        ...(pushError ? { pushError: pushError.message, preservationErrorStep: preservationErrorStep ?? 'push' } : {}),
         ...(artifactPath ? { prBodyArtifactPath: artifactPath } : {}),
         ...(artifactError ? { prBodyArtifactError: artifactError } : {}),
-      });
-      progress(stage, artifactPath
-        ? `worktree-only 완료: draft PR을 열지 않음(worktree·branch 보존 · 중단 사유 보존: ${artifactPath} · worktree: ${wt.path} · branch: ${wt.branch})`
-        : `worktree-only 완료: draft PR을 열지 않음(worktree·branch 보존 · 중단 사유 보존 실패: ${artifactError ?? 'unknown error'} · worktree: ${wt.path} · branch: ${wt.branch})`);
+      }, pushError ? { level: 'warn' } : undefined);
+      if (pushError) {
+        const failure = preservationErrorStep === 'worktree' ? '워크트리 부재로 보존 실패' : preservationErrorStep === 'commit' ? '로컬 브랜치 커밋 실패' : '원격 브랜치 보존 실패';
+        progress('aborted', `환경 탓 중단 — ${failure}: ${wt.branch} (${pushError.message}; worktree: ${wt.path})`);
+        if (preservationErrorStep === 'worktree') return undefined;
+        throw new Error(`환경 탓 중단 — ${failure}: ${wt.branch} (worktree: ${wt.path})`, { cause: pushError });
+      }
+      if (worktreeOnly) {
+        progress(stage, artifactPath
+          ? `worktree-only 완료: draft PR을 열지 않음(worktree·branch 보존 · 중단 사유 보존: ${artifactPath} · worktree: ${wt.path} · branch: ${wt.branch})`
+          : `worktree-only 완료: draft PR을 열지 않음(worktree·branch 보존 · 중단 사유 보존 실패: ${artifactError ?? 'unknown error'} · worktree: ${wt.path} · branch: ${wt.branch})`);
+      } else {
+        // No draft PR on this path, so the stop reason must be findable from the progress line itself.
+        const reasonNote = artifactPath ? `중단 사유 보존: ${artifactPath}` : `중단 사유 보존 실패: ${artifactError ?? 'unknown error'}`;
+        progress(stage, pushed
+          ? `환경 탓 중단 — draft PR 없이 브랜치만 보존: ${wt.branch} · ${reasonNote}`
+          : `환경 탓 중단 — draft PR 없이 로컬 브랜치만 보존(원격 origin 없음): ${wt.branch} · worktree: ${wt.path} · ${reasonNote}`);
+      }
       return undefined;
     }
     progress('pr-opening', '중단 산출물을 draft PR로 보존…');
@@ -5315,6 +5528,23 @@ async function runSelfImplementInner(
     await flushPrComments(pr);
     return { decision, pr };
   };
+  const baselineOnlyGate = (): boolean => {
+    const failures = gate?.baselineFailures;
+    return gate?.passed === false && !!failures?.length && gate.reflectGateFacts?.introduced === 0
+      && gate.reflectGateFacts.unknown === 0
+      && failures.every(({ attribution }) => attribution === 'preexisting' || attribution === 'flaky-timeout'
+        || attribution === 'flaky-rerun' || attribution === 'precondition-unmet');
+  };
+  const noRetryBaseline = (): { terminationReason?: 'blocked-by-baseline' } => {
+    if (!baselineOnlyGate()) return {};
+    const failures = gate!.baselineFailures!;
+    debug.log('self-implement.supervisor', 'no-retry-baseline', {
+      runId,
+      preexisting: failures.filter(({ attribution }) => attribution === 'preexisting').length,
+      flaky: failures.filter(({ attribution }) => attribution === 'flaky-timeout' || attribution === 'flaky-rerun').length,
+    });
+    return { terminationReason: 'blocked-by-baseline' };
+  };
   const salvageHardCap = async (hardCapBlockedExtend: boolean, pr?: { number: number }): Promise<'launched' | 'parked'> => {
     let evidence: ReworkSalvageEvidence | undefined;
     if (hardCapBlockedExtend) {
@@ -5333,21 +5563,27 @@ async function runSelfImplementInner(
       ...(opts.goalFile ? { goalType: goalTypeFields(opts.goalFile).goalType } : {}),
       ...(quotaExhaustionAssessment.exhausted ? { quotaExhausted: true } : {}),
       ...(quotaExhaustionAssessment.accountAvailability ? { quotaAccountAvailability: quotaExhaustionAssessment.accountAvailability } : {}),
-      ...(hasCredentialFailure() ? { credentialFailure: true } : {}),
-      ...(hasProviderError() ? { providerError: true } : {}),
-      ...(providerErrorCategory() ? { providerErrorCategory: providerErrorCategory() } : {}),
+      ...(hasCurrentCredentialFailure() ? { credentialFailure: true } : {}),
+      ...(hasCurrentProviderError() ? { providerError: true } : {}),
+      ...(hasCurrentProviderError() && providerErrorCategory() ? { providerErrorCategory: providerErrorCategory() } : {}),
       worktreePorcelain: worktree.worktreePorcelain,
       ...(worktree.gitResidue ? { gitResidue: worktree.gitResidue } : {}),
       stage: isReviewRework(reworkKind) ? 'review-blocked' : 'gate-failed',
       reviewResultObserved: review !== undefined,
       mustFixReported: (review?.mustFix.length ?? 0) > 0,
     });
+    observe('rework-salvage-classification', { ...abandonedClassification, branch: wt.branch });
+    // Salvage may resume an observed environment interruption even when a later
+    // gate/review verdict is the terminal classification. Keep its cause distinct.
+    const salvageClassification = abandonedClassification.classification === 'implementation-deficit' && hasObservedProviderError()
+      ? hasObservedCredentialFailure() ? 'credential-failure' : 'provider-error'
+      : abandonedClassification.classification;
     const decision = decideReworkSalvage({
       hardCapBlockedExtend,
       goalFile: opts.goalFile,
       salvageAttempt: opts.salvageAttempt,
       evidence,
-      abandonedClassification: abandonedClassification.classification,
+      abandonedClassification: salvageClassification,
     });
     if (decision.action !== 'launch') {
       const reason = decision.reason;
@@ -5360,7 +5596,7 @@ async function runSelfImplementInner(
     const launchObservation = {
       branch: wt.branch,
       goalFile: opts.goalFile,
-      ...(environmentReason ? { reason: environmentReason, abandonedClassification: abandonedClassification.classification } : {}),
+      ...(environmentReason ? { reason: environmentReason, abandonedClassification: salvageClassification } : {}),
       ...(salvageEvidence ? { clean: salvageEvidence.clean, aheadCommits: salvageEvidence.aheadCommits } : {}),
     };
     observe('rework-salvage', { action: 'launching', ...launchObservation });
@@ -5437,36 +5673,48 @@ async function runSelfImplementInner(
         const judgmentCallLLM = s.judgmentCallLLM;
         if (diagnosedDecision?.verdict !== 'CONTRACT-CONFLICT' && !judgmentCallLLM) throw new Error('rework-budget@v1 requires a judgment provider');
         const judgmentProvider = judgmentCallLLM ? createReworkBudgetJudgment(judgmentCallLLM) : undefined;
-        const result = diagnosedDecision?.verdict === 'CONTRACT-CONFLICT'
-          ? undefined
-          : await withStepTimeout(
-            runWorkflowToCompletion(
-              {
-                workflow: reworkBudgetWorkflow,
-                arguments: diagnosis,
-                artifactsDir: '',
-                persistRun: false,
-                judgmentContext: { kind: reworkKind, history: priorHistory },
-              },
-              {
-                callLLM: judgmentCallLLM!,
-                runBash: async () => ({ stdout: '', stderr: '', exitCode: 0 }),
-                runJudgment: judgmentProvider!,
-              },
-            ),
-            T.review,
-            'review',
-          );
-        if (result) {
-          const classified = result.outputs['rework-budget'];
-          if (!result.ok || !classified?.ok || typeof classified.output !== 'string') {
-            throw new Error(classified?.error ?? 'rework-budget@v1 judgment failed');
+        try {
+          const result = diagnosedDecision?.verdict === 'CONTRACT-CONFLICT'
+            ? undefined
+            : await withStepTimeout(
+              runWorkflowToCompletion(
+                {
+                  workflow: reworkBudgetWorkflow,
+                  arguments: diagnosis,
+                  artifactsDir: '',
+                  persistRun: false,
+                  judgmentContext: { kind: reworkKind, history: priorHistory },
+                },
+                {
+                  callLLM: judgmentCallLLM!,
+                  runBash: async () => ({ stdout: '', stderr: '', exitCode: 0 }),
+                  runJudgment: judgmentProvider!,
+                },
+              ),
+              T.review,
+              'review',
+            );
+          if (result) {
+            const classified = result.outputs['rework-budget'];
+            if (!result.ok || !classified?.ok || typeof classified.output !== 'string') {
+              throw new Error(classified?.error ?? 'rework-budget@v1 judgment failed');
+            }
+            const picked = classified.output === 'EXTEND' || classified.output === 'SUFFICIENT' || classified.output === 'UNCONVERGEABLE'
+              ? classified.output
+              : undefined;
+            if (!picked) throw new Error(`rework-budget@v1 returned unsupported class '${String(classified.output)}'`);
+            parsedDecision = { verdict: picked, reason: diagnosedDecision?.reason ?? 'workflow-fabric classification' };
           }
-          const picked = classified.output === 'EXTEND' || classified.output === 'SUFFICIENT' || classified.output === 'UNCONVERGEABLE'
-            ? classified.output
+          consecutiveUnresolvedBudget = 0;
+        } catch (error) {
+          const message = safeErrorDescription(error);
+          if (!message.startsWith('rework-budget@v1 classification did not resolve a supported class')
+            && !message.startsWith('rework-budget@v1 returned unsupported class')) throw error;
+          consecutiveUnresolvedBudget++;
+          observe('rework-budget-unresolved-fallback', { round, error: message.slice(0, 200), consecutive: consecutiveUnresolvedBudget }, { level: 'warn' });
+          parsedDecision = consecutiveUnresolvedBudget >= 2
+            ? { verdict: 'UNCONVERGEABLE', reason: 'rework-budget classification unresolved ×2' }
             : undefined;
-          if (!picked) throw new Error(`rework-budget@v1 returned unsupported class '${String(classified.output)}'`);
-          parsedDecision = { verdict: picked, reason: diagnosedDecision?.reason ?? 'workflow-fabric classification' };
         }
         let fabricObservation: Record<string, unknown> | undefined;
         if (s.classifyCallLLM) {
@@ -5497,7 +5745,7 @@ async function runSelfImplementInner(
           selfImplementConfig.reworkBudget.maxRounds,
           reworkKind,
           priorHistory.length,
-          shadowStop,
+          consecutiveUnresolvedBudget >= 2 ? false : shadowStop,
           supervisorDecisionHistory.at(-1)?.verdict,
         );
         effectiveMax = budgetDecision.effectiveMax;
@@ -5688,9 +5936,11 @@ async function runSelfImplementInner(
               const quotaExhaustionAssessment = quotaExhaustionAssessmentForRun();
               return { ok: false, stage: 'review-blocked', node: 'rework', ...terminal, ...supervisorOutcome, sessionId, worktreePath: wt.path, branch: wt.branch, gate, review, quotaExhaustionAssessment, ...(lastSupervisorReason ? { supervisorReason: lastSupervisorReason } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: `rework judged unconvergeable after ${round} rework round(s): ${parsedDecision.reason}` };
             }
-            const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', verdict: parsedDecision.verdict, reason: parsedDecision.reason, gate, decomposition: terminalDecomposition, salvageStatusExpected: false });
+            const baselineStop = noRetryBaseline();
+            const reason = baselineStop.terminationReason ?? parsedDecision.reason;
+            const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', verdict: parsedDecision.verdict, reason, gate, decomposition: terminalDecomposition, salvageStatusExpected: false });
             const quotaExhaustionAssessment = quotaExhaustionAssessmentForRun();
-            return { ok: false, stage: 'gate-failed', node: 'rework', ...terminal, ...supervisorOutcome, sessionId, worktreePath: wt.path, branch: wt.branch, gate, quotaExhaustionAssessment, ...(lastSupervisorReason ? { supervisorReason: lastSupervisorReason } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: `rework judged unconvergeable after ${round} rework round(s): ${parsedDecision.reason}` };
+            return { ok: false, stage: 'gate-failed', node: 'rework', ...terminal, ...supervisorOutcome, ...baselineStop, sessionId, worktreePath: wt.path, branch: wt.branch, gate, quotaExhaustionAssessment, ...(lastSupervisorReason ? { supervisorReason: lastSupervisorReason } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: baselineStop.terminationReason ?? `rework judged unconvergeable after ${round} rework round(s): ${parsedDecision.reason}` };
           }
         } else {
           const repeatedBlockingIds = repeatedBlockingFindingIds(currentBlockingFindings, previousBlockingFindings);
@@ -5699,7 +5949,10 @@ async function runSelfImplementInner(
         }
       } catch (error) {
         if (judgmentStarted) throw error;
+        consecutiveUnresolvedBudget = 0;
       }
+    } else if (round > 0) {
+      consecutiveUnresolvedBudget = 0;
     }
     if (round > effectiveMax) {
       finalizeSupervisorDeliveries('rework-round-limit');
@@ -5711,8 +5964,9 @@ async function runSelfImplementInner(
           const pr = await preserveBlockedArtifacts({ stage: 'review-blocked', verdict: lastReworkVerdict, reason, gate, salvageStatusExpected: false });
           return { ok: false, stage: 'review-blocked', node: 'rework', ...terminal, sessionId, worktreePath: wt.path, branch: wt.branch, gate, review, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(lastSupervisorVerdict === 'CONTRACT-CONFLICT' ? { supervisorVerdict: lastSupervisorVerdict } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
         }
-        const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', verdict: lastReworkVerdict, reason, gate, salvageStatusExpected: false });
-        return { ok: false, stage: 'gate-failed', node: 'rework', ...terminal, sessionId, worktreePath: wt.path, branch: wt.branch, gate, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(lastSupervisorVerdict === 'CONTRACT-CONFLICT' ? { supervisorVerdict: lastSupervisorVerdict } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
+        const baselineStop = noRetryBaseline();
+        const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', verdict: lastReworkVerdict, reason: baselineStop.terminationReason ?? reason, gate, salvageStatusExpected: false });
+        return { ok: false, stage: 'gate-failed', node: 'rework', ...terminal, ...baselineStop, sessionId, worktreePath: wt.path, branch: wt.branch, gate, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(lastSupervisorVerdict === 'CONTRACT-CONFLICT' ? { supervisorVerdict: lastSupervisorVerdict } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: baselineStop.terminationReason ?? reason };
       }
       const terminal = resolveRunOutcome({ termination: 'budget-exhausted', ...(lastReworkVerdict ? { lastVerdict: lastReworkVerdict } : {}) });
       // ⛔⭐ **보존(=커밋·push) 뒤에 발사한다.** 종전엔 발사가 먼저라, 인수 자식이 `--base <그 브랜치>`
@@ -5751,10 +6005,11 @@ async function runSelfImplementInner(
         const disposition = { ...terminal, ...(salvage ? { salvage } : {}) };
         return { ok: false, stage: 'review-blocked', node: 'rework', ...disposition, sessionId, worktreePath: wt.path, branch: wt.branch, gate, review, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(lastSupervisorVerdict === 'CONTRACT-CONFLICT' ? { supervisorVerdict: lastSupervisorVerdict } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
       }
-      const reason = `gate failed after ${round - 1} rework round(s)`;
-      const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', reason, gate, salvageStatusExpected: true });
-      const salvage = await salvageHardCap(canSalvage, pr);
-      const disposition = { ...terminal, ...(salvage ? { salvage } : {}) };
+      const baselineStop = noRetryBaseline();
+      const reason = baselineStop.terminationReason ?? `gate failed after ${round - 1} rework round(s)`;
+      const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', reason, gate, salvageStatusExpected: !baselineStop.terminationReason });
+      const salvage = baselineStop.terminationReason ? 'parked' : await salvageHardCap(canSalvage, pr);
+      const disposition = { ...terminal, ...(salvage ? { salvage } : {}), ...baselineStop };
       return { ok: false, stage: 'gate-failed', node: 'rework', ...disposition, sessionId, worktreePath: wt.path, branch: wt.branch, gate, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(lastSupervisorVerdict === 'CONTRACT-CONFLICT' ? { supervisorVerdict: lastSupervisorVerdict } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
     }
 
@@ -5787,6 +6042,9 @@ async function runSelfImplementInner(
     progress('implementing', round === 0
       ? '구현 중 (헤드리스 goal-loop·수분 소요)…'
       : formatReworkProgressLine(round, effectiveMax, escalateTier, attemptOrdinal));
+    if (round > 0) {
+      try { emitDecision(reworkDecision({ runId, round, effectiveMax, escalateTier, kind: reworkKind })); } catch { /* observation must not interrupt rework */ }
+    }
     let reworkArtifactPath: string | undefined;
     if (round > 0) {
       try {
@@ -6111,7 +6369,9 @@ async function runSelfImplementInner(
     progress('gated', !runsGate
       ? `gate 미실행 — 이 그래프(${graphTemplate.graphId})는 gate 노드를 갖지 않는다`
       : gate.passed ? 'gate 통과' : `gate 실패(라운드 ${round})`);
+    if (gate.passed) lastGateUnverifiedKey = undefined;
     if (!gate.passed) {
+      await onFailureVerdict('gate');
       const facts = gate.reflectGateFacts;
       const failureDisposition = decideGateFailureDisposition(facts);
       // 타임아웃«뿐» — 도입 0 · 미분류 0 · 자식 책임 없음. 재작업으로 보내지 않고 리뷰로 진행한다.
@@ -6183,6 +6443,23 @@ async function runSelfImplementInner(
         const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', reason, gate, salvageStatusExpected: false });
         return { ok: false, stage: 'gate-failed', node: 'rework', ...resolveRunOutcome({ termination: 'abandoned' }), sessionId, worktreePath: wt.path, branch: wt.branch, gate, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
       }
+      // ⭐ 반복 열쇠 = 미검증 집합. 실패 시험 0건인데 직전 gate 실패와 «같은» 집합이면 재작업이 그 신호를 못 바꾼다
+      //   (run-7dd4cce6: 리뷰 지적 비교는 incomparable · 점수 1/3 · 예산 판정 EXTEND 로 헛돌았다).
+      if (isRepeatedUnverifiedOnlyGateFailure({ previousKey: lastGateUnverifiedKey, unverified: gate.unverified, gateLog: gate.log, ...(facts ? { introduced: facts.introduced } : {}) })) {
+        finalizeSupervisorDeliveries('gate-failed-unverified-repeat');
+        const unverifiedFiles = [...new Set(gate.unverified ?? [])].sort();
+        const reason = `gate failed twice in a row with no failing test and the same ${unverifiedFiles.length} unverified file(s); rework cannot change that signal — escalating without rework`;
+        observe('gate-failed-unverified-repeat-escalated', {
+          round,
+          unverified: unverifiedFiles.slice(0, 20),
+          unverifiedCount: unverifiedFiles.length,
+          reason,
+        }, { level: 'warn' });
+        progress('gate-failed', `중단 — 실패 시험 0건 · 같은 미검증 파일 ${unverifiedFiles.length}개가 되풀이(재작업으로 안 바뀐다 · 사람 판단 대기)`);
+        const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', reason, gate, salvageStatusExpected: false });
+        return { ok: false, stage: 'gate-failed', node: 'rework', ...resolveRunOutcome({ termination: 'abandoned' }), sessionId, worktreePath: wt.path, branch: wt.branch, gate, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
+      }
+      lastGateUnverifiedKey = unverifiedRepeatKey(gate.unverified);
       round++;
       continue;
       }
@@ -6225,6 +6502,26 @@ async function runSelfImplementInner(
         path: designCheck.path,
       });
     }
+    const runFacts = collectRunFacts(wt.path);
+    let designGate: ReviewDiffContext['designGate'];
+    // Git porcelain collapses untracked directories to `site/`; inspect their files too.
+    let untrackedFiles: string[] = [];
+    if (runFacts.changedFiles?.some((file) => file.endsWith('/'))) {
+      try {
+        const untracked = runGitCommand(wt.path, ['ls-files', '--others', '--exclude-standard'], { encoding: 'utf8' });
+        if (untracked.status === 0) untrackedFiles = untracked.stdout.split(/\r?\n/).filter(Boolean);
+      } catch { /* change discovery must not stop review */ }
+    }
+    if ([...(runFacts.changedFiles ?? []), ...(gateRouteFiles ?? []), ...untrackedFiles].some((file) => /\.(?:html|css)$/i.test(file))) {
+      try {
+        designGate = (s.runDesignGate ?? runDesignGate)({ projectDir: wt.path, base: wt.resolvedBase });
+      } catch (error) {
+        designGate = { unmeasured: safeErrorDescription(error) };
+      }
+      observe('design-gate', 'unmeasured' in designGate
+        ? { verdict: null, reason: null, p0Total: null, advisoryTotal: null, files: null, unmeasured: designGate.unmeasured }
+        : { verdict: designGate.verdict, reason: designGate.reason ?? null, p0Total: designGate.p0Total, advisoryTotal: designGate.advisoryTotal, files: designGate.files.length });
+    }
     let goalDocumentPath: string | undefined;
     try {
       goalDocumentPath = opts.goalId ? s.goalDocumentPathByGoalId?.(opts.goalId) : undefined;
@@ -6233,9 +6530,10 @@ async function runSelfImplementInner(
     }
     const reviewContext = {
       runId,
-      ...collectRunFacts(wt.path),
+      ...runFacts,
       goal: opts.feature,
       goalFile: opts.goalFile,
+      ...(priorRunFindings.length ? { priorRunFindings } : {}),
       ...(goalDocumentPath ? { goalDocumentPath } : {}),
       round,
       ...((round === 0 ? carriedAppliedItems : appliedLastRound)?.length
@@ -6248,6 +6546,7 @@ async function runSelfImplementInner(
       // ⛔⭐ 하니스가 이미 센 것을 판정자에게 준다(원장 `JDG-S4`·`JDG-S5` — 로그에만 있으면 못 본다).
       ...(evidenceCoverage ? { evidenceCoverage } : {}),
       ...(designCheck ? { designCheck } : {}),
+      ...(designGate ? { designGate } : {}),
       ...(gateEvidence ? { gateEvidenceNote: gateEvidence } : {}),
       ...(gate.baselineFailures?.some((failure) => failure.attribution === 'preexisting')
         ? { preexistingTestFailures: gate.baselineFailures
@@ -6274,6 +6573,7 @@ async function runSelfImplementInner(
         throw error;
       }
       onReviewFindings(round, review.mustFix);
+      if (review.mustFix.length > 0) await onFailureVerdict('review');
       const reviewFindings = snapshotMustFixFindings([...review.mustFix, ...review.shouldFix]);
       const reviewMustFixFindings = reviewFindings.slice(0, review.mustFix.length);
       observeReviewFindingRecurrence(round, review.mustFix);
@@ -6507,7 +6807,7 @@ async function runSelfImplementInner(
   const { latestSignalIncomplete } = signalIncompleteState(roundClassifications);
   const autoMerge = autoMergeEnabled(opts);
   const gateTimeoutUnmeasured = isTimeoutOnlyUnmeasuredGate(gate.reflectGateFacts);
-  const canAuto = !gateTimeoutUnmeasured && autoMerge && reviewReal && review!.verdict !== 'fail' && reviewDiffComplete && !requiredEvidenceMissing && !latestSignalIncomplete && !decisionSignalRed;
+  let canAuto = !gateTimeoutUnmeasured && autoMerge && reviewReal && review!.verdict !== 'fail' && reviewDiffComplete && !requiredEvidenceMissing && !latestSignalIncomplete && !decisionSignalRed;
   // ⭐⭐ 통과의 «이유»를 둘로 가른다 — ⛔ 막지는 «않는다»(대표 판단 2026-08-11: ⓐ 문면만).
   //   📏 근거(`JDG-T36` · merge-decision 300건 전수): `verifyByBreaking` 이 실린 8건의 auto 중 ***5건***이
   //     ***ran=true 인데 distinguishes=0***(아무것도 안 가르는 자기검증)이었고, 그 다섯이 «전부»
@@ -6518,7 +6818,7 @@ async function runSelfImplementInner(
   //     그건 `skippedReason` 이 이미 가른다. 그래서 여기 조건에 넣지 않는다.
   const verifyInconclusive = gate.verifyByBreaking?.ran === true && (gate.verifyByBreaking.distinguishes ?? 0) === 0;
   const verifyNothingAtBase = verifyInconclusive && (gate.verifyByBreaking?.missingAtBase ?? 0) > 0;
-  const mergeReason = canAuto ? (verifyNothingAtBase ? 'review-clean-verify-nothing-at-base' : verifyInconclusive ? 'review-clean-verify-inconclusive' : 'review-clean-armed')
+  let mergeReason = canAuto ? (verifyNothingAtBase ? 'review-clean-verify-nothing-at-base' : verifyInconclusive ? 'review-clean-verify-inconclusive' : 'review-clean-armed')
     : gateTimeoutUnmeasured ? GATE_TIMEOUT_UNMEASURED_MERGE_REASON
     : !autoMerge ? 'no-auto-flag'
       : requiredEvidenceMissing ? 'required-evidence-uncovered'
@@ -6528,9 +6828,9 @@ async function runSelfImplementInner(
           : review!.verdict === 'fail' ? 'review-must-fix'
             : review!.diffTruncated === true ? 'review-diff-truncated'
               : 'review-diff-budget-unknown';
-  const mergeSkipReason = canAuto ? undefined : mergeReason;
-  if (canAuto) onMergeApprovalReceived();
-  observe('merge-decision', {
+  let mergeSkipReason = canAuto ? undefined : mergeReason;
+  if (canAuto) onAutoMergeAuthorizedBeforeSync();
+  const mergeDecisionObservation = {
     autoMerge, reviewed: reviewReal, verdict: review?.verdict ?? 'none',
     decision: canAuto ? 'auto' : 'hitl', reason: mergeReason,
     ...mergeDecisionEvidenceCoverage(evidenceCoverage),
@@ -6552,8 +6852,15 @@ async function runSelfImplementInner(
     ...(gate.verifyByBreaking ? { verifyByBreaking: gate.verifyByBreaking } : {}),
     ...(decisionSignalPress ? { decisionSignalPress, decisionSignalBaselineOnly } : {}),
     ...(decisionSignalPressReason ? { decisionSignalPressReason } : {}),
-  });
+  };
+  const recordMergeDecision = () => {
+    observe('merge-decision', {
+      ...mergeDecisionObservation,
+      decision: canAuto ? 'auto' : 'hitl', reason: mergeReason,
+    });
+  };
   if (opts.completion === 'worktree-only' && !decisionSignalRed) {
+    recordMergeDecision();
     progress('worktree-completed', '✅ 작업 트리 완료 — PR 생성 없이 worktree 보존');
     observe('worktree-completed', { branch: wt.branch, hadApprover: !!s.approvePr });
     return {
@@ -6561,10 +6868,11 @@ async function runSelfImplementInner(
       detail: 'worktree-only completion: PR creation skipped',
     };
   }
-  const approved = canAuto ? true : (s.approvePr
+  let approved = canAuto ? true : (s.approvePr
     ? await s.approvePr({ branch: wt.branch, ...(gate.log ? { gateLog: gate.log } : {}), implSummary: impl.summary, ...(review ? { review } : {}) })
     : false);
   if (!approved) {
+    recordMergeDecision();
     observe('pr-declined', { branch: wt.branch, hadApprover: !!s.approvePr });
     return {
       ok: false, stage: 'pr-declined', node: 'open-pr', ...resolveRunOutcome({ termination: 'abandoned' }), ...decisionSignalResult, sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), ...(mergeSkipReason ? { mergeReason: mergeSkipReason } : {}),
@@ -6585,6 +6893,9 @@ async function runSelfImplementInner(
         ...(resolvedTarget.error === undefined ? {} : { resolveError: resolvedTarget.error }),
       });
       progress('merge-conflict', '⚠️ 기본 브랜치 해석 실패 — 자동병합 차단(수동 정합 필요·HITL 결정)');
+      canAuto = false;
+      mergeReason = 'default-branch-unresolved';
+      recordMergeDecision();
       return { ok: false, stage: 'merge-conflict', node: 'main-sync', ...resolveRunOutcome({ termination: 'abandoned' }), ...decisionSignalResult, sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), detail: 'pre-PR main sync default-branch-unresolved' };
     }
     progress('gating', `최신 ${mergeTarget} 정합 (병렬 드리프트·LLM 충돌해결)…`);
@@ -6593,6 +6904,9 @@ async function runSelfImplementInner(
     observe('pre-pr-sync', mainSyncObservation(sync, mergeTarget, opts.base, wt.branch));
     if (sync.status === 'conflict-unresolved' || sync.status === 'error') {
       progress('merge-conflict', `⚠️ ${mergeTarget} 정합 ${sync.status}${sync.errorStep === undefined ? '' : ` (${sync.errorStep})`} — 자동병합 차단(수동 정합 필요·HITL 결정)`);
+      canAuto = false;
+      mergeReason = `main-sync-${sync.status}`;
+      recordMergeDecision();
       return { ok: false, stage: 'merge-conflict', node: 'main-sync', ...resolveRunOutcome({ termination: 'abandoned' }), ...decisionSignalResult, sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), detail: `pre-PR main sync ${sync.status}` };
     }
     if (sync.status === 'llm-resolved' || sync.status === 'merged') {
@@ -6602,14 +6916,33 @@ async function runSelfImplementInner(
         : `${mergeTarget} 정합됨 — 통합 결과 full 재-gate…`);
       onNodeEntry('regate', round);
       const regate = await withStepTimeout(s.gate(wt.path, { runId, mode: 'postsync' }), T.gate, 'gate');
+      if (!regate.passed) await onFailureVerdict('gate');
       // `mode` name/meaning stay: `full` = existing gate including tests. Both
       // conflict-resolved and clean-merge reuse this same `s.gate` invocation.
+      const timeoutOnlyPostSync = !regate.passed && postSyncTimeoutOnly(regate.reflectGateFacts);
       const postSyncPolicy = postSyncGatePolicy(
         regate.passed,
-        regate.reflectGateFacts?.childResponsibility,
+        regate.reflectGateFacts,
         sync.status,
       );
       observe('gate.postsync', postSyncGateObservation(regate, wt.branch, hasModuleLoadFailure, sync.status));
+      if (timeoutOnlyPostSync) {
+        const facts = regate.reflectGateFacts!;
+        observe('post-sync-gate-timeout-only-continued', {
+          introduced: facts.introduced, unknown: facts.unknown, timedOut: facts.timedOut ?? 0,
+        }, { level: 'warn' });
+        canAuto = false;
+        mergeReason = GATE_TIMEOUT_UNMEASURED_MERGE_REASON;
+        mergeSkipReason = mergeReason;
+        approved = s.approvePr
+          ? await s.approvePr({
+            branch: wt.branch,
+            gateLog: [regate.log, `post-sync gate timeout-only (introduced=${facts.introduced}, unknown=${facts.unknown}, timedOut=${facts.timedOut ?? 'unmeasured'}, flakyRerun=${facts.flakyRerun ?? 'unmeasured'}); merge reason: ${GATE_TIMEOUT_UNMEASURED_MERGE_REASON}`].filter(Boolean).join('\n'),
+            implSummary: impl.summary,
+            ...(review ? { review } : {}),
+          })
+          : false;
+      }
       if (postSyncPolicy.mustStop) {
         progress('gate-failed', sync.status === 'llm-resolved'
           ? '중단 — main 충돌해결 후 gate 실패(면책 보류·통합 깨짐)'
@@ -6619,16 +6952,27 @@ async function runSelfImplementInner(
           : sync.status === 'llm-resolved'
             ? 'gate failed after main-sync (conflict-resolved integration break)'
             : 'gate failed after main-sync (clean-merge integration break)';
+        canAuto = false;
+        mergeReason = 'post-sync-gate-failed';
+        recordMergeDecision();
         const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', reason, gate: regate, salvageStatusExpected: false });
         return { ok: false, stage: 'gate-failed', node: 'regate', ...resolveRunOutcome({ termination: 'abandoned' }), ...decisionSignalResult, sessionId, worktreePath: wt.path, branch: wt.branch, gate: regate, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(review ? { review } : {}), ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
       }
       if (!regate.passed) {
-        progress('gating', 'main 정합 후 gate 실패는 자식 책임 없음으로 면책 — 통합 깨짐으로 중단하지 않고 계속 진행');
+        progress('gating', timeoutOnlyPostSync
+          ? 'main 정합 후 gate 타임아웃만 — 사람 확인으로 진행'
+          : 'main 정합 후 gate 실패는 자식 책임 없음으로 면책 — 통합 깨짐으로 중단하지 않고 계속 진행');
       }
       gate = regate;
     }
   }
 
+  recordMergeDecision();
+  if (!approved) {
+    observe('pr-declined', { branch: wt.branch, hadApprover: !!s.approvePr });
+    return { ok: false, stage: 'pr-declined', node: 'open-pr', ...resolveRunOutcome({ termination: 'abandoned' }), ...decisionSignalResult, sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), mergeReason, detail: s.approvePr ? 'PR not approved' : 'no approvePr seam — fail-closed(자동승인 금지)' };
+  }
+  if (canAuto) onMergeApprovalReceived();
   const extractedOriginalAsk = extractVerbatimOriginalAsk(opts.feature);
   const { labels, declineReasons, eligibility } = resolveAutoReviewLabels(!!opts.autoReview, {
     objective: opts.feature,
@@ -6670,8 +7014,8 @@ async function runSelfImplementInner(
   //     재면 각각 셋·다섯 칸이 «비어» 있었고, 그중 「원장」과 「위험」은 «둘 다» 0이었다.
   //     `prBody` 는 모든 인자가 optional 이라 비면 그 절이 «조용히 사라진다» — 그래서 결손이
   //     정상 산출과 구별되지 않았다. 이 관문이 그 부재를 «이름으로» 말한다.
-  //   ⛔ 기본은 «막지 않는다»(config `tools.selfImplement.prEvidenceArtifactEnforce`) — 골의 내용과
-  //     무관하게 착지를 죽이지 않기 위한 의도적 결정이다. 다만 ***거절은 항상 관측으로 남는다***.
+  //   ⛔ «막지 않는다» — 골의 내용과 무관하게 착지를 죽이지 않는다. ***거절은 항상 관측으로 남는다***.
+  //     (차단 스위치 `prEvidenceArtifactEnforce` 는 2026-09-26 설정 졸업으로 지웠다 — 한 번도 기본으로 안 켜졌다.)
   const prEvidence = collectPrEvidence({
     feature: opts.feature,
     goalFile: opts.goalFile,
@@ -6686,28 +7030,19 @@ async function runSelfImplementInner(
     provider: activeProvider.provider,
     planRevision: lastPlanRevision,
   });
-  const prEvidenceDecision = decidePrEvidenceGate(prEvidence, {
-    enforce: userConfig.tools.selfImplement.prEvidenceArtifactEnforce === true,
-  });
+  const prEvidenceDecision = decidePrEvidenceGate(prEvidence);
   observe('pr-evidence-artifact', {
     accepted: prEvidenceDecision.missing.length === 0,
-    blocked: prEvidenceDecision.blocked,
-    enforced: prEvidenceDecision.enforced,
     axes: PR_EVIDENCE_AXES.length,
     missingCount: prEvidenceDecision.missing.length,
     missing: prEvidenceDecision.missing,
     ...(prEvidenceDecision.reason ? { reason: prEvidenceDecision.reason } : {}),
     ...(prEvidenceDecision.body ? { bodyChars: prEvidenceDecision.body.length } : {}),
   });
-  if (prEvidenceDecision.blocked) {
-    // ⛔ 준비 «전»에 멎는다 — 부실한 본문으로 PR 을 열지 않는다. worktree·브랜치는 보존한다.
-    const location = `PR 근거 아티팩트 관문 차단 — ${prEvidenceDecision.reason} (worktree·branch 보존 · ${wt.branch} · ${wt.path})`;
-    progress('aborted', location);
-    throw new Error(location);
-  }
+  const releaseNote = harnessReleaseNote(goalDocumentForReleaseNote(opts.goalFile), prTitle(opts.feature));
   const preparedPrBody = preparePrBody(
     [
-      prBody(opts.feature, impl.summary, gate.log, review, reviewIntent, declineReasons, harvestedForPr(), opts.goalFile, lastPlanRevision),
+      prBody(opts.feature, impl.summary, gate.log, review, reviewIntent, declineReasons, harvestedForPr(), opts.goalFile, lastPlanRevision, releaseNote),
       ...(prEvidenceDecision.body ? ['', '---', '', prEvidenceDecision.body] : []),
     ].join('\n'),
     s.persistPrBodyArtifact,
@@ -6747,7 +7082,7 @@ async function runSelfImplementInner(
   });
   await flushPrComments(pr);
 
-  if (canAuto && s.mergePr) {
+  if (canAuto && (s.mergePr || opts.mergeByHost)) {
     let docsMarkdownDeletions: number | undefined;
     let nonDocsMarkdownDeletions: number | undefined;
     let checkedHeadCommit: string | undefined;
@@ -6777,6 +7112,7 @@ async function runSelfImplementInner(
         guardFailure = `${checkedHeadCommit === undefined ? 'readPrCommitShas' : 'readPrDiff'} failed: ${error instanceof Error ? error.message : String(error)}`;
       }
     }
+    if (opts.mergeByHost && checkedHeadCommit && !/^[0-9a-f]{40}$/i.test(checkedHeadCommit)) guardFailure = 'checked head SHA is not a full commit hash';
     const blocked = guardFailure !== undefined || docsMarkdownDeletions! >= DOCS_MARKDOWN_AUTO_MERGE_DELETION_THRESHOLD;
     observe('auto-merge-docs-deletion-guard', {
       number: pr.number, threshold: DOCS_MARKDOWN_AUTO_MERGE_DELETION_THRESHOLD, blocked,
@@ -6795,11 +7131,29 @@ async function runSelfImplementInner(
       const guardSkipReason = mergeSkipReason ?? (guardFailure ? 'merge-guard-unevaluated' : 'docs-deletion-threshold');
       return { ok: true, stage: 'pr-opened', node: 'open-pr', ...resolveRunOutcome({ termination: 'completed' }), ...decisionSignalResult, ...preservedCompletionResult, ...(completionStatus ? { completionStatus } : {}), sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), mergeReason: guardSkipReason, prUrl: pr.url, prNumber: pr.number, detail };
     }
+    if (opts.mergeByHost) {
+      observe('merge-ready', { number: pr.number, checkedHeadCommit });
+      progress('pr-opened', `호스트 재게이트 대기 (#${pr.number})`);
+      return { ok: true, stage: 'merge-ready', node: 'open-pr', ...resolveRunOutcome({ termination: 'completed' }), ...decisionSignalResult, ...preservedCompletionResult, ...(completionStatus ? { completionStatus } : {}), sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), checkedHeadCommit: checkedHeadCommit!, prUrl: pr.url, prNumber: pr.number };
+    }
     onNodeEntry('merge', round);
     progress('merging', '자동 병합 (리뷰 clean·squash)…');
-    const m = await withStepTimeout(s.mergePr({ number: pr.number, cwd: wt.path, matchHeadCommit: checkedHeadCommit! }), T.pr, 'pr');
+    const m = await withStepTimeout(s.mergePr!({ number: pr.number, cwd: wt.path, matchHeadCommit: checkedHeadCommit! }), T.pr, 'pr');
     observe('merged', { number: pr.number, merged: m.merged, detail: m.detail ?? null });
     if (m.merged) {
+      const directory = releaseNotesDir(elanousStateRoot());
+      const fragment: ReleaseNoteFragment = {
+        pr: pr.number,
+        ...releaseNote,
+        source: 'harness',
+        ...(m.mergeCommit ? { mergeSha: m.mergeCommit } : {}),
+      };
+      try {
+        writeReleaseNote(directory, fragment);
+      } catch (error) {
+        observe('release-note-write-failed', { number: pr.number, prUrl: pr.url, directory, fragment, error: safeErrorDescription(error) }, { level: 'error' });
+        throw new MergedReleaseNoteWriteError(pr.url, directory, fragment, error);
+      }
       const mergedBase = m.baseRefName?.trim() || observedPrBase;
       const defaultBranch = resolveDefaultBranchTarget(s.defaultBranchRef ?? defaultBranchRef, wt.path).target ?? undefined;
       progress('merged', formatAutoMergeSuccessMessage({ prNumber: pr.number, mergedBase, defaultBranch }));