elanous 0.2.12 → 0.2.14

package/src/self-implement/goal-archive.ts

@@ -0,0 +1,222 @@
+import { execFileSync } from 'node:child_process';
+import { appendFileSync, closeSync, copyFileSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, rmdirSync, rmSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, relative, resolve, sep } from 'node:path';
+import { elanousStateRoot } from '../autopilot/state-paths.js';
+import { debug } from '../debug/log.js';
+import { isGoalAuthorFileName } from './goal-document.js';
+import { hasTerminalRunStatus, loadRunLedger, queryUnfinishedRunLedgers, runLedgerDir } from './run-ledger.js';
+
+export interface GoalArchiveOptions {
+  repoRoot?: string;
+  stateRoot?: string;
+  before?: string;
+  apply?: boolean;
+  trustDocRecord?: boolean;
+  /** Failure-injection seam for the two write stages (copy · index); defaults use the real filesystem.
+   *  The repository is never written: removing the originals is a human PR from `filesForPr`. */
+  writes?: {
+    copy?: (source: string, destination: string) => void;
+    appendIndex?: (path: string, line: string) => void;
+  };
+}
+
+export interface GoalArchiveEntry {
+  goalId: string;
+  runId: string;
+  pr: number | null;
+  outcome: 'merged' | 'abandoned' | 'superseded';
+  source: 'ledger' | 'doc-record';
+  originalPath: string;
+  archivePath: string;
+}
+
+export interface GoalArchiveResult {
+  candidates: GoalArchiveEntry[];
+  applied: GoalArchiveEntry[];
+  skipped: Record<string, number>;
+  trustDocRecordAdds: number;
+  filesForPr: string[];
+}
+
+function gitRead(root: string, ...args: string[]): string {
+  return execFileSync('git', args, {
+    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+    env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' },
+  });
+}
+
+function applyArchiveEntry(index: string, source: string,
+  entry: GoalArchiveEntry, document: string, writes: GoalArchiveOptions['writes']): void {
+  const directory = dirname(entry.archivePath);
+  const hadDirectory = existsSync(directory);
+  const priorIndex = existsSync(index) ? readFileSync(index) : null;
+  let ownedCopy = false;
+  let indexAttempted = false;
+  try {
+    mkdirSync(directory, { recursive: true });
+    const reservation = openSync(entry.archivePath, 'wx');
+    ownedCopy = true;
+    closeSync(reservation);
+    (writes?.copy ?? copyFileSync)(source, entry.archivePath);
+    if (readFileSync(entry.archivePath, 'utf8') !== document) throw new Error(`archive copy mismatch: ${entry.originalPath}`);
+    indexAttempted = true;
+    (writes?.appendIndex ?? ((path, line) => appendFileSync(path, line, 'utf8')))(index, `${JSON.stringify(entry)}\n`);
+  } catch (error) {
+    try {
+      if (indexAttempted) {
+        if (priorIndex === null) rmSync(index, { force: true });
+        else if (!readFileSync(index).equals(priorIndex)) writeFileSync(index, priorIndex);
+      }
+      if (ownedCopy) rmSync(entry.archivePath, { force: true });
+      if (ownedCopy && !hadDirectory && existsSync(directory)) rmdirSync(directory);
+    } catch (rollbackError) {
+      throw new Error(`archive failed for ${entry.originalPath}: ${String(error)}; recovery required (archive rollback: ${String(rollbackError)}). Preserve ${entry.archivePath} and ${index}; reconcile the index before retry.`);
+    }
+    throw error;
+  }
+}
+
+function beforeDate(value: string | undefined): string | undefined {
+  if (value === undefined) return undefined;
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value) || Number.isNaN(Date.parse(`${value}T00:00:00Z`))
+    || new Date(`${value}T00:00:00Z`).toISOString().slice(0, 10) !== value) {
+    throw new Error(`--before requires a valid YYYY-MM-DD date: ${value}`);
+  }
+  return value;
+}
+
+function ledgerGoalFileContradicts(goalFile: unknown, originalPath: string): boolean {
+  if (typeof goalFile !== 'string' || !goalFile.trim()) return false;
+  const normalized = goalFile.replaceAll('\\', '/');
+  return normalized !== originalPath && !normalized.endsWith(`/${originalPath}`);
+}
+
+function lastExecution(document: string): Record<string, string> | null {
+  const sections = document.split(/^## 실행 기록\s*$/m).slice(1);
+  const block = sections.at(-1)?.split(/^#{1,2} /m, 1)[0];
+  const run = block?.split(/^- runId: /m).slice(1).at(-1);
+  if (!run) return null;
+  const id = run.split(/\r?\n/, 1)[0]?.trim();
+  if (!id) return null;
+  const fields: Record<string, string> = { runId: id };
+  for (const [, key, value] of run.matchAll(/^  (stage|outcome|prNumber|completedAt): ([^\r\n]*)$/gm)) fields[key!] = value!.trim();
+  return fields;
+}
+
+/** Preview by default. --apply only copies to the state archive and indexes; it never removes or stages anything in the repository —
+ *  `filesForPr` is the list a human removes in one PR. A missing ledger requires explicit trust in the document's finished-run record. */
+export function archiveGoals(options: GoalArchiveOptions = {}): GoalArchiveResult {
+  const root = resolve(options.repoRoot ?? gitRead(process.cwd(), 'rev-parse', '--show-toplevel').trim());
+  const state = resolve(options.stateRoot ?? elanousStateRoot());
+  const cutoff = beforeDate(options.before);
+  const goals = join(root, 'docs', 'goals');
+  const archive = join(state, 'goal-archive');
+  const index = join(archive, 'index.jsonl');
+  const result: GoalArchiveResult = { candidates: [], applied: [], skipped: {}, trustDocRecordAdds: 0, filesForPr: [] };
+  const skip = (reason: string): void => { result.skipped[reason] = (result.skipped[reason] ?? 0) + 1; };
+  const lock = join(archive, '.apply.lock');
+  if (options.apply) {
+    mkdirSync(archive, { recursive: true });
+    try { mkdirSync(lock); }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      throw new Error(`EEXIST: goal archive --apply is already running or a previous run stopped mid-way (${lock}). `
+        + `If no other archive is running: compare ${index} with ${archive}/<YYYY-MM>/ copies, drop index lines whose copy is missing, then remove ${lock} and retry.`);
+    }
+  }
+  try {
+    const tracked = new Set(gitRead(root, 'ls-files', '-z', '--', 'docs/goals').split('\0').filter(Boolean));
+  const pendingRemovals = new Set(gitRead(root, 'diff', '--cached', '--name-only', '--diff-filter=D', '-z', '--', 'docs/goals').split('\0').filter(Boolean));
+  const unfinished = queryUnfinishedRunLedgers({ dir: runLedgerDir(state), goalsDir: goals, noCache: true });
+  if (unfinished.unreadableLedgerCount > 0) throw new Error('run ledger contains unreadable runs; archive refused');
+  const activePaths = new Set(unfinished.entries.filter((entry) => entry.goalDocumentPath)
+    .map((entry) => resolve(root, entry.goalDocumentPath!)));
+  const activeRunIds = new Set(unfinished.entries.map((entry) => entry.runId));
+  const indexed = new Set<string>();
+  if (existsSync(index)) {
+    for (const line of readFileSync(index, 'utf8').split('\n').filter(Boolean)) {
+      const entry = JSON.parse(line) as { originalPath: string };
+      indexed.add(entry.originalPath);
+    }
+  }
+  let names: string[];
+  try { names = readdirSync(goals).sort(); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    names = [];
+  }
+  for (const name of names) {
+    if (!isGoalAuthorFileName(name)) continue;
+    const path = join(goals, name);
+    const originalPath = relative(root, path).split(sep).join('/');
+    if (!tracked.has(originalPath) || pendingRemovals.has(originalPath)) { skip('untracked'); continue; }
+    const fileStat = lstatSync(path, { throwIfNoEntry: false });
+    if (!fileStat?.isFile() || fileStat.isSymbolicLink()) { skip('not-file'); continue; }
+    if (indexed.has(originalPath)) { skip('already-indexed'); continue; }
+    if (activePaths.has(path)) { skip('active-goal-run'); continue; }
+    const document = readFileSync(path, 'utf8');
+    const fields = lastExecution(document);
+    if (!fields) { skip('no-execution-record'); continue; }
+    const runId = fields.runId!;
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(runId)) { skip('invalid-run-id'); continue; }
+    if (activeRunIds.has(runId)) { skip('active-goal-run'); continue; }
+    const outcome = fields.stage === 'merged' && (fields.outcome === 'completed' || fields.outcome === 'merged') ? 'merged'
+      : fields.outcome === 'abandoned' ? 'abandoned'
+      : fields.outcome === 'superseded' ? 'superseded' : null;
+    if (!outcome) { skip('unfinished'); continue; }
+    let ledger;
+    try { ledger = loadRunLedger(runId, runLedgerDir(state)); }
+    catch (error) {
+      skip(error instanceof Error && /runId does not match /.test(error.message) ? 'ledger-run-id-mismatch' : 'unreadable-ledger');
+      continue;
+    }
+    const missingLedger = !ledger?.length;
+    if (missingLedger && (!fields.stage || !fields.outcome)) { skip('unfinished'); continue; }
+    const documentGoalId = /^- GoalId:\s*([0-9a-f]{16})\s*$/m.exec(document.split(/^## 실행 기록\s*$/m, 1)[0] ?? '')?.[1];
+    if (!documentGoalId) { skip('missing-goal-id'); continue; }
+    if (!missingLedger) {
+      const entries = ledger!;
+      const ledgerGoalIds = new Set(entries.map((entry) => entry.goalId).filter((id): id is string => typeof id === 'string'));
+      if (ledgerGoalIds.size !== 1 || !ledgerGoalIds.has(documentGoalId)) { skip('ledger-goal-id-mismatch'); continue; }
+      const starts = entries.filter((entry) => entry.event === 'start');
+      if (starts.length === 0 || starts.some((entry) => ledgerGoalFileContradicts(entry.data.goalFile, originalPath))) {
+        skip('ledger-goal-mismatch'); continue;
+      }
+    }
+    const latest = ledger?.filter((entry) => entry.event === 'run-status').at(-1);
+    if (!missingLedger) {
+      if (!latest || !hasTerminalRunStatus(ledger!) || !['completed', 'failed', 'cancelled'].includes(String(latest.data.runStatus))) {
+        skip('running-or-unconfirmed'); continue;
+      }
+      if (outcome === 'merged' && (latest.data.runStatus !== 'completed' || (latest.data.stage !== undefined && latest.data.stage !== 'merged'))
+        || outcome === 'abandoned' && latest.data.runStatus === 'completed'
+        || outcome === 'superseded' && latest.data.runStatus === 'failed') {
+        skip('status-mismatch'); continue;
+      }
+    }
+    const completedAt = missingLedger ? fields.completedAt : fields.completedAt ?? latest?.timestamp;
+    if (!completedAt || !Number.isFinite(Date.parse(completedAt))) { skip('no-completion-date'); continue; }
+    const date = new Date(completedAt).toISOString().slice(0, 10);
+    if (cutoff && date >= cutoff) { skip('after-before'); continue; }
+    const prRaw = fields.prNumber;
+    const pr = prRaw && /^[1-9]\d*$/.test(prRaw) && Number.isSafeInteger(Number(prRaw)) ? Number(prRaw) : null;
+    const archivePath = join(archive, date.slice(0, 7), basename(path));
+    if (existsSync(archivePath)) { skip('archive-collision'); continue; }
+    if (gitRead(root, 'status', '--porcelain', '--', originalPath).trim()) { skip('dirty'); continue; }
+    if (missingLedger && !options.trustDocRecord) { skip('missing-ledger'); result.trustDocRecordAdds += 1; continue; }
+    const entry: GoalArchiveEntry = { goalId: documentGoalId, runId, pr, outcome, source: missingLedger ? 'doc-record' : 'ledger', originalPath, archivePath };
+    result.candidates.push(entry);
+    if (options.apply) {
+      applyArchiveEntry(index, path, entry, document, options.writes);
+      result.applied.push(entry);
+      result.filesForPr.push(originalPath);
+    } else {
+      result.filesForPr.push(originalPath);
+    }
+  }
+  try { debug.log('harness.goal', 'archive', { candidates: result.candidates.length, applied: result.applied.length, skipped: result.skipped }); } catch { /* observation is fail-soft */ }
+  return result;
+  } finally {
+    if (options.apply) rmdirSync(lock);
+  }
+}

package/src/self-implement/goal-lookup.ts

@@ -0,0 +1,147 @@
+import { readFileSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { selfDevRunsDir, type SelfDevRunState } from '../self-dev/run-store.js';
+import { isGoalAuthorFileName } from './goal-document.js';
+
+export interface GoalLookupOptions {
+  /** Defaults to the current repository's docs/goals directory. */
+  goalsDir?: string;
+  /** Defaults to the current instance's self-dev-runs directory. */
+  runsDir?: string;
+}
+
+export interface GoalLookupRecord {
+  runId: string;
+  stage: string | null;
+  outcome: string | null;
+  prNumber: number | null;
+}
+
+/** The two sources are independent: null means that side did not match. */
+export interface GoalLookupResult {
+  goalBody: string | null;
+  goalFile: string | null;
+  kanId: string | null;
+  runId: string | null;
+  record: GoalLookupRecord | null;
+  runState: SelfDevRunState | null;
+}
+
+function filesIn(directory: string): string[] {
+  try {
+    return readdirSync(directory, { withFileTypes: true })
+      .filter((entry) => entry.isFile())
+      .map((entry) => entry.name)
+      .sort();
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+}
+
+type ValidResult = { runId: string; stage?: string | null; prNumber?: number | null };
+
+function isValidResult(result: unknown): result is ValidResult {
+  if (result === null || typeof result !== 'object' || Array.isArray(result)) return false;
+  const r = result as { runId?: unknown; stage?: unknown; prNumber?: unknown };
+  return typeof r.runId === 'string' && r.runId.length > 0
+    && (r.stage == null || typeof r.stage === 'string')
+    && (r.prNumber == null || (typeof r.prNumber === 'number' && Number.isSafeInteger(r.prNumber) && r.prNumber > 0));
+}
+
+function prNumber(value: string | undefined): number | null {
+  if (!value || !/^[1-9]\d*$/.test(value)) return null;
+  const number = Number(value);
+  return Number.isSafeInteger(number) ? number : null;
+}
+
+function executionRecords(document: string): GoalLookupRecord[] {
+  const sections = document.split(/^## 실행 기록\s*$/m).slice(1);
+  return sections.flatMap((section) => {
+    const block = section.split(/^#{1,2} /m, 1)[0] ?? '';
+    const entries = block.split(/^- runId: /m).slice(1);
+    return entries.flatMap((entry) => {
+      const runId = entry.split(/\r?\n/, 1)[0]?.trim();
+      if (!runId) return [];
+      const field = (name: string): string | undefined =>
+        new RegExp(`^  ${name}: ([^\\r\\n]*)$`, 'm').exec(entry)?.[1]?.trim();
+      return [{ runId, stage: field('stage') ?? null, outcome: field('outcome') ?? null, prNumber: prNumber(field('prNumber')) }];
+    });
+  });
+}
+
+/** Local, read-only lookup. A bare positive integer (or #number) is a PR; all other input is an exact run ID. */
+export function lookupGoal(reference: string, options: GoalLookupOptions = {}): GoalLookupResult {
+  const input = reference.trim();
+  const requestedPr = prNumber(input.replace(/^#/, ''));
+  const requestedRunId = requestedPr === null ? input : null;
+  const runsDir = options.runsDir ?? selfDevRunsDir();
+  const findRun = (matches: (result: ValidResult) => boolean, wantedRunId: string | null) => {
+    for (const name of filesIn(runsDir)) {
+      if (!/^[A-Za-z0-9][A-Za-z0-9_-]*\.json$/.test(name)) continue;
+      let candidate: SelfDevRunState;
+      try {
+        candidate = JSON.parse(readFileSync(join(runsDir, name), 'utf8')) as SelfDevRunState;
+      } catch { continue; }
+      if (!candidate || candidate.runId !== name.slice(0, -'.json'.length) || !Array.isArray(candidate.results)) continue;
+      const matchingResult = (candidate.results as unknown[]).find((result): result is ValidResult => isValidResult(result) && matches(result));
+      if (matchingResult || (wantedRunId !== null && candidate.runId === wantedRunId)) {
+        const runId = matchingResult?.runId ?? candidate.runId;
+        const record: GoalLookupRecord | null = matchingResult
+          ? { runId, stage: matchingResult.stage ?? null, outcome: null, prNumber: matchingResult.prNumber ?? null }
+          : null;
+        return { runState: candidate, runId, record };
+      }
+    }
+    return null;
+  };
+  const found = findRun((result) => requestedPr !== null ? result.prNumber === requestedPr : result.runId === requestedRunId, requestedRunId);
+  let runState: SelfDevRunState | null = found?.runState ?? null;
+  const resultRunId: string | null = found?.runId ?? null;
+  let runRecord: GoalLookupRecord | null = found?.record ?? null;
+
+  const goalsDir = options.goalsDir ?? resolve(process.cwd(), 'docs', 'goals');
+  let fallback: { goalFile: string; document: string; record: GoalLookupRecord } | null = null;
+  let selected: { goalFile: string; document: string; record: GoalLookupRecord } | null = null;
+  for (const name of filesIn(goalsDir)) {
+    if (!isGoalAuthorFileName(name)) continue;
+    const goalFile = join(goalsDir, name);
+    let document: string;
+    try { document = readFileSync(goalFile, 'utf8'); } catch { continue; }
+    const records = executionRecords(document);
+    const direct = records.find((candidate) => requestedPr !== null
+      ? candidate.prNumber === requestedPr
+      : candidate.runId === requestedRunId);
+    if (direct) { selected = { goalFile, document, record: direct }; break; }
+    if (requestedPr !== null && resultRunId !== null && fallback === null) {
+      const record = records.find((candidate) => candidate.prNumber === null && candidate.runId === resultRunId);
+      if (record) fallback = { goalFile, document, record };
+    }
+  }
+  const match = selected ?? fallback;
+  if (match) {
+    const { goalFile, document, record } = match;
+    // The returned run state must belong to the selected document record's run (review must-fix): re-resolve, or drop it.
+    if (resultRunId !== record.runId) {
+      const again = findRun((result) => result.runId === record.runId, record.runId);
+      runState = again?.runState ?? null;
+      runRecord = again?.record ?? null;
+    }
+    const body = document.split(/^## 실행 기록\s*$/m, 1)[0]!.replace(/\r?\n$/, '');
+    // A kan ID is only reported when the authored document explicitly names one.
+    const kanId = /^- Kan(?:Id|-ID):\s*(\S+)\s*$/im.exec(body)?.[1] ?? null;
+    return {
+      goalBody: body, goalFile, kanId, runId: record.runId,
+      record: {
+        ...record,
+        ...(runRecord?.runId === record.runId ? {
+          stage: record.stage ?? runRecord.stage,
+          outcome: record.outcome ?? runRecord.outcome,
+          prNumber: record.prNumber ?? runRecord.prNumber,
+        } : {}),
+      },
+      runState,
+    };
+  }
+  return { goalBody: null, goalFile: null, kanId: null, runId: resultRunId ?? requestedRunId, record: runRecord, runState };
+}

package/src/self-implement/heal-intake.ts

@@ -0,0 +1,79 @@
+import { appendFileSync, mkdirSync, readFileSync, rmdirSync, statSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { debug } from '../debug/log.js';
+
+export type FailureSource = 'release-run' | 'harness-run' | 'loop-tick' | 'cron';
+
+export interface FailureEvent {
+  source: FailureSource;
+  kind: string;
+  ref: string;
+  summary: string;
+  at: string;
+}
+
+const FOLD_WINDOW_MS = 60 * 60 * 1_000;
+
+function inboxPath(root: string): string {
+  return join(root, 'heal', 'inbox.jsonl');
+}
+
+function readInbox(file: string): FailureEvent[] {
+  let content: string;
+  try { content = readFileSync(file, 'utf8'); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return [];
+    throw error;
+  }
+  return content.split('\n').filter(Boolean).map(line => JSON.parse(line) as FailureEvent);
+}
+
+/** Lock the read/fold/append transaction across processes, not just within one runner. */
+function withInboxLock<T>(file: string, work: () => T): T {
+  mkdirSync(dirname(file), { recursive: true });
+  const lock = `${file}.lock`;
+  const deadline = Date.now() + 5_000;
+  for (;;) {
+    try { mkdirSync(lock); break; }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      try {
+        if (Date.now() - statSync(lock).mtimeMs > 60_000) {
+          rmdirSync(lock);
+          continue;
+        }
+      } catch (cause) {
+        if ((cause as NodeJS.ErrnoException).code !== 'ENOENT') throw cause;
+      }
+      if (Date.now() >= deadline) throw new Error(`heal inbox lock is held: ${file}`);
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+    }
+  }
+  try { return work(); }
+  finally { rmdirSync(lock); }
+}
+
+/** One durable JSON line per failure; repeat source+ref within an hour is folded. */
+export function recordFailureEvent(event: FailureEvent, root = effectiveInstanceRoot()): { folded: boolean } {
+  if (!['release-run', 'harness-run', 'loop-tick', 'cron'].includes(event.source) ||
+      !event.kind || !event.ref || !event.summary || !Number.isFinite(Date.parse(event.at))) {
+    throw new Error('invalid heal failure event');
+  }
+  const file = inboxPath(root);
+  const folded = withInboxLock(file, () => {
+    const incoming = Date.parse(event.at);
+    if (readInbox(file).some(previous => previous.source === event.source && previous.ref === event.ref &&
+      incoming - Date.parse(previous.at) >= 0 && incoming - Date.parse(previous.at) < FOLD_WINDOW_MS)) return true;
+    appendFileSync(file, JSON.stringify(event) + '\n');
+    return false;
+  });
+  debug.log('heal.intake', 'recorded', { source: event.source, kind: event.kind, ref: event.ref, folded });
+  return { folded };
+}
+
+export function readFailureInbox({ since }: { since?: string } = {}, root = effectiveInstanceRoot()): FailureEvent[] {
+  const threshold = since === undefined ? -Infinity : Date.parse(since);
+  if (Number.isNaN(threshold)) throw new Error('invalid heal inbox since');
+  return readInbox(inboxPath(root)).filter(event => Date.parse(event.at) >= threshold);
+}

package/src/self-implement/host-regate.ts

@@ -3,6 +3,9 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync,
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { debug } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
+import { publicExposureFiles, runExposeGate } from './expose-gate.js';
+import { admitLandingMerge } from './frozen-merges.js';
 import { releaseGitDiffPaths, releasePathHold, releasePathHoldShouldPost, releasePathHoldComment, releasePathHoldCommentsArgs, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { detectTestInterference, parseFailureCount, runBunTest } from '../../scripts/detect-test-interference.js';
 import { runTestInterferenceGate } from '../../scripts/ci-test-interference-gate.js';
@@ -17,8 +20,8 @@ export function needsPwaBuild(files: readonly string[]): boolean {
   return files.some((file) => file.startsWith('apps/pwa/') || (file.startsWith('src/') && !/\.test\.tsx?$/.test(file)));
 }
 
-export interface HostRegateInput { prNumber: number; headCommit: string; repoRoot: string; verifyOnly?: boolean }
-export interface HostRegateResult { passed: boolean; failures: Array<{ step: string; detail: string }>; os: string; status?: 'passed' | 'failed' | 'unmeasured'; /** verifyOnly: 실제로 얹어 잰 base 끝 */ baseCommit?: string }
+export interface HostRegateInput { prNumber: number; headCommit: string; repoRoot: string; verifyOnly?: boolean; /** Called by a resume sweep that already holds this PR's claim. */ resumed?: true }
+export interface HostRegateResult { passed: boolean; failures: Array<{ step: string; detail: string }>; os: string; status?: 'passed' | 'failed' | 'unmeasured' | 'frozen'; /** verifyOnly: 실제로 얹어 잰 base 끝 */ baseCommit?: string }
 export type HostRegateDeps = {
   command?: (bin: string, args: readonly string[], cwd: string, env?: NodeJS.ProcessEnv) => { status: number | null; stdout: string; stderr: string };
   interference?: (files: readonly string[], cwd: string) => Promise<{ passed: boolean; detail?: string; unmeasured?: boolean }>;
@@ -26,6 +29,8 @@ export type HostRegateDeps = {
   removeTemp?: (path: string) => void;
   acquire?: (repoRoot: string) => Promise<() => void>;
   log?: (event: 'passed' | 'failed' | 'unmeasured' | 'base-raced', data: Record<string, unknown>) => void;
+  freezeRoot?: string;
+  runExposeGate?: typeof runExposeGate;
 };
 
 const SPAWN_MAX_BUFFER = 256 * 1024 * 1024;
@@ -122,6 +127,8 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
   let worktree: string | undefined;
   let attached = false;
   let release: (() => void) | undefined;
+  let endLanding: ((merged?: boolean) => void) | undefined;
+  let landed = false;
   let verifiedBase: string | undefined;
   const result = (event: 'passed' | 'failed' | 'unmeasured', step?: string, detail?: string): HostRegateResult => {
     if (step) failures.push({ step, detail: detail ?? 'unknown' });
@@ -203,6 +210,13 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
       const interference = await (deps.interference ?? ((f: readonly string[], c: string) => defaultInterference(f, c, { neighbors: !input.verifyOnly })))(files, worktree);
       if (!interference.passed) return result(interference.unmeasured ? 'unmeasured' : 'failed', 'test-interference', interference.detail);
     } catch (e) { return result('unmeasured', 'test-interference', String(e)); }
+    // Landing can also be initiated by the host after the child gate; judge the checked PR here too.
+    if (publicExposureFiles(files).length > 0) {
+      const exposure = (deps.runExposeGate ?? runExposeGate)(worktree, files,
+        getUserConfig().harness?.exposeGate === 'strict' ? 'strict' : 'warn',
+        (bin, args, dir) => command(bin, args, dir));
+      if (!exposure.passed) return result('failed', 'expose', exposure.log);
+    }
     // verifyOnly: 통합 후보는 «지금 main 끝»(baseCommit)에 얹은 것이다 — 옛 merge-base 로 비교하면 그사이 main 착지분
     //   수백 파일이 «이 PR 의 변경»으로 잡혀 저장소 전체 검사로 승격된다(2026-09-28 #21239 실측: 456파일 · PWA 636건).
     try { run('bun', ['scripts/ci-typecheck-changed.ts'], worktree, { ...process.env, TSC_BASE_REF: input.verifyOnly ? baseCommit : base }); }
@@ -226,6 +240,13 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
     // --match-head-commit pins the head. gh has no base pin, so the base was re-read just
     // above; the seconds between that read and the merge are checked after the fact below.
     if (input.verifyOnly) return result('passed');
+    const landing = admitLandingMerge({ prNumber: input.prNumber, headCommit: input.headCommit, repoRoot: input.repoRoot }, deps.freezeRoot, {}, input.resumed ? undefined : { prNumber: input.prNumber, repoRoot: input.repoRoot, headCommit: input.headCommit });
+    if (landing.kind !== 'merge') {
+      debug.log('harness.merge', 'frozen', { pr: input.prNumber, ...(landing.kind === 'held' ? { reason: landing.freeze.reason, until: landing.freeze.until } : { resumedElsewhere: true }) });
+      return { passed: true, failures: [], os: process.platform, status: 'frozen' };
+    }
+    // The marker and claim are held through the merge «and» its confirmation; released in the outer finally.
+    endLanding = landing.end;
     try { run('gh', ['pr', 'merge', String(input.prNumber), '--squash', '--match-head-commit', input.headCommit], input.repoRoot); }
     catch (e) { return result('failed', 'merge', String(e)); }
     type MergedView = { state?: string; mergeCommit?: { oid?: string } | null };
@@ -233,6 +254,7 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
     try { merged = JSON.parse(run('gh', ['pr', 'view', String(input.prNumber), '--json', 'state,mergeCommit'], input.repoRoot)); }
     catch (e) { return result('unmeasured', 'merge-confirm', String(e)); }
     if (merged.state !== 'MERGED') return result('unmeasured', 'merge-confirm', `PR state after merge is ${merged.state ?? 'unknown'}`);
+    landed = true;
     const mergeCommit = merged.mergeCommit?.oid ?? '';
     let mergedOnto = '';
     try {
@@ -249,6 +271,7 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
   } catch (e) {
     return result('unmeasured', 'host-regate', String(e));
   } finally {
+    try { endLanding?.(landed); } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'landing-release', detail: String(e) }); }
     try { if (attached && worktree) run('git', ['worktree', 'remove', '--force', worktree], input.repoRoot); }
     catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
     try { if (worktree) (deps.removeTemp ?? ((path) => rmSync(path, { recursive: true, force: true })))(worktree); }