elanous 0.2.12 → 0.2.14

package/src/self-implement/l8-merge-queue.ts

@@ -1,8 +1,9 @@
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { NEXT_MD_PATH, resolveNextMdConflict } from '../release-loop/next-md-merge.js';
+import { getDefaultLogStore } from '../mss/logging/log-store.js';
 
 type Command = (bin: string, args: readonly string[], cwd: string) => { status: number | null; stdout: string; stderr: string };
 export type L8MergeQueueInput = { number: number; cwd: string; matchHeadCommit: string };
@@ -13,6 +14,161 @@ export type L8MergeQueueDeps = {
   acquire?: (cwd: string) => Promise<() => void>;
 };
 
+export type L8ShadowVerdict = { number: number; head: string; base?: string; verdict: 'pass' | 'conflict' | 'fail'; detail?: string; tests: string[]; at: string };
+export type L8ShadowQueueState = { pending: { number: number; head: string }[]; verdicts: L8ShadowVerdict[] };
+export type L8ShadowQueueDeps = L8MergeQueueDeps & { observe?: (verdict: L8ShadowVerdict) => void | Promise<void> };
+
+function shadowCommand(execute: Command, bin: string, args: string[], cwd: string): string {
+  const result = execute(bin, args, cwd);
+  if (result.status !== 0) throw new Error(`${bin} ${args.join(' ')}: ${(result.stderr || result.stdout || `exit ${result.status}`).trim().slice(0, 500)}`);
+  return args.includes('-z') ? result.stdout : result.stdout.trim();
+}
+
+function shadowQueuePath(cwd: string, execute: Command): string {
+  const dir = shadowCommand(execute, 'git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], cwd);
+  if (!dir) throw new Error('merge queue common git directory unavailable');
+  return join(dir, 'elanous-l8-shadow-queue.json');
+}
+
+function readShadowQueue(path: string): L8ShadowQueueState {
+  if (!existsSync(path)) return { pending: [], verdicts: [] };
+  const value: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  if (!value || typeof value !== 'object' || !('pending' in value) || !Array.isArray(value.pending)
+    || !value.pending.every((p: { number?: number; head?: string }) => Number.isSafeInteger(p?.number) && p.number! > 0 && typeof p.head === 'string' && /^[0-9a-f]{40}$/i.test(p.head))
+    || !('verdicts' in value) || !Array.isArray(value.verdicts)) throw new Error('invalid shadow queue ledger');
+  return value as L8ShadowQueueState;
+}
+
+function writeShadowQueue(path: string, state: L8ShadowQueueState): void {
+  const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync(temp, JSON.stringify(state, null, 2) + '\n', { flag: 'wx' });
+    renameSync(temp, path);
+  } finally { rmSync(temp, { force: true }); }
+}
+
+async function withShadowQueue<T>(cwd: string, deps: L8ShadowQueueDeps, fn: (state: L8ShadowQueueState, path: string) => Promise<T>): Promise<T> {
+  const release = await (deps.acquire ?? acquireL8MergeQueue)(cwd);
+  try {
+    const path = shadowQueuePath(cwd, deps.command ?? command);
+    return await fn(readShadowQueue(path), path);
+  } finally { release(); }
+}
+
+export function shadowPrNumber(raw: string): number {
+  const text = raw.replace(/^#/, '');
+  const number = Number(text);
+  if (!/^[1-9]\d*$/.test(text) || !Number.isSafeInteger(number)) throw new Error('expected a positive PR number');
+  return number;
+}
+
+export async function statusL8ShadowQueue(cwd: string, deps: L8ShadowQueueDeps = {}): Promise<L8ShadowQueueState> {
+  return withShadowQueue(cwd, deps, async (state) => state);
+}
+
+export async function enqueueL8ShadowQueue(cwd: string, number: number, deps: L8ShadowQueueDeps = {}): Promise<L8ShadowQueueState> {
+  if (!Number.isSafeInteger(number) || number <= 0) throw new Error('expected a positive PR number');
+  return withShadowQueue(cwd, deps, async (state, path) => {
+    const execute = deps.command ?? command;
+    const view = JSON.parse(shadowCommand(execute, 'gh', ['pr', 'view', String(number), '--json', 'headRefOid,baseRefName,state,isDraft,isCrossRepository'], cwd)) as {
+      headRefOid?: string; baseRefName?: string; state?: string; isDraft?: boolean; isCrossRepository?: boolean;
+    };
+    if (!view.headRefOid || !/^[0-9a-f]{40}$/i.test(view.headRefOid) || view.baseRefName !== 'main'
+      || view.state !== 'OPEN' || view.isDraft !== false || view.isCrossRepository !== false) throw new Error('PR is not an open, ready, same-repository main PR');
+    if (state.pending.some((p) => p.number === number)) throw new Error(`PR #${number} already queued`);
+    state.pending.push({ number, head: view.headRefOid });
+    writeShadowQueue(path, state);
+    return state;
+  });
+}
+
+/** Evaluate one pinned queue head against freshly fetched main. Never push or call a merge API. */
+export async function runL8ShadowQueue(cwd: string, deps: L8ShadowQueueDeps = {}): Promise<L8ShadowVerdict | null> {
+  return withShadowQueue(cwd, deps, async (state, path) => {
+    const item = state.pending[0];
+    if (!item) return null;
+    const execute = deps.command ?? command;
+    const run = (bin: string, args: string[], where = cwd) => shadowCommand(execute, bin, args, where);
+    const verdict: L8ShadowVerdict = { number: item.number, head: item.head, verdict: 'fail', tests: [], at: new Date().toISOString() };
+    const view = JSON.parse(run('gh', ['pr', 'view', String(item.number), '--json', 'headRefOid,baseRefName,state,isDraft,isCrossRepository'])) as {
+      headRefOid?: string; baseRefName?: string; state?: string; isDraft?: boolean; isCrossRepository?: boolean;
+    };
+    if (view.headRefOid !== item.head || view.baseRefName !== 'main' || view.state !== 'OPEN'
+      || view.isDraft !== false || view.isCrossRepository !== false) throw new Error('queued PR changed or is not ready');
+    run('git', ['fetch', 'origin', 'refs/heads/main']);
+    const base = run('git', ['rev-parse', 'FETCH_HEAD']);
+    if (!/^[0-9a-f]{40}$/i.test(base)) throw new Error('main commit unavailable');
+    verdict.base = base;
+    run('git', ['fetch', 'origin', `refs/pull/${item.number}/head`]);
+    if (run('git', ['rev-parse', 'FETCH_HEAD']) !== item.head) throw new Error('fetched PR head changed');
+    let temp: string | undefined;
+    let attached = false;
+    try {
+      temp = mkdtempSync(join(tmpdir(), 'elanous-l8-shadow-'));
+      run('git', ['worktree', 'add', '--detach', temp, base]);
+      attached = true;
+      const fork = run('git', ['merge-base', base, item.head], temp);
+      const changed = run('git', ['diff', '--name-only', '-z', fork, item.head], temp).split('\0').filter(Boolean);
+      if (!changed.length) throw new Error('PR changed-file paths unavailable');
+      const diff = run('git', ['diff', '--name-only', '-z', '--diff-filter=ACMRT', fork, item.head], temp);
+      const files = diff.split('\0').filter(Boolean);
+      if (changed.some((file) => file.startsWith('-') || file.startsWith('/') || file.split('/').includes('..') || file.includes('\\'))) throw new Error('unsafe changed-file path');
+      verdict.tests = files.filter((file) => /(?:^|\/)[^/]+\.(?:test|spec)\.(?:[cm]?[jt]sx?)$/.test(file));
+      const merge = execute('git', ['-c', 'user.name=elanous shadow', '-c', 'user.email=shadow@localhost', 'merge', '--no-ff', '--no-edit', item.head], temp);
+      if (merge.status !== 0) {
+        const unresolved = run('git', ['diff', '--name-only', '--diff-filter=U'], temp);
+        if (!unresolved) throw new Error(`git merge failed: ${merge.stderr.trim() || `exit ${merge.status}`}`);
+        verdict.verdict = 'conflict';
+        verdict.detail = unresolved;
+      } else {
+        if (verdict.tests.length) {
+          if (verdict.tests.some((file) => !existsSync(join(temp!, file)))) throw new Error('changed test path unavailable');
+          run('bun', ['install', '--frozen-lockfile'], temp);
+          const result = execute('bun', ['run', 'test:deterministic', ...verdict.tests], temp);
+          const output = `${result.stdout}\n${result.stderr}`;
+          const counts = /\b(\d+) pass\b[\s\S]*?\b(\d+) fail\b[\s\S]*?Ran ([1-9]\d*) tests? across ([1-9]\d*) files?/.exec(output);
+          if (!counts || Number(counts[1]) + Number(counts[2]) !== Number(counts[3])
+            || Number(counts[4]) !== verdict.tests.length || (result.status !== 0 && Number(counts[2]) === 0)) {
+            throw new Error(`changed tests unmeasured: ${output.slice(-400)}`);
+          }
+          if (Number(counts[2]) > 0 || Number(counts[1]) === 0) {
+            verdict.detail = `changed tests failed: ${output.slice(-400)}`;
+          } else {
+            verdict.verdict = 'pass';
+          }
+        } else {
+          verdict.verdict = 'pass';
+        }
+      }
+    } finally {
+      try {
+        if (attached && temp) run('git', ['worktree', 'remove', '--force', temp]);
+      } finally {
+        if (temp) rmSync(temp, { recursive: true, force: true });
+      }
+    }
+    if (verdict.verdict === 'pass') {
+      run('git', ['fetch', 'origin', 'refs/heads/main']);
+      if (run('git', ['rev-parse', 'FETCH_HEAD']) !== verdict.base) throw new Error('main advanced during shadow verification');
+      const current = JSON.parse(run('gh', ['pr', 'view', String(item.number), '--json', 'headRefOid,baseRefName,state,isDraft,isCrossRepository'])) as {
+        headRefOid?: string; baseRefName?: string; state?: string; isDraft?: boolean; isCrossRepository?: boolean;
+      };
+      if (current.headRefOid !== item.head || current.baseRefName !== 'main' || current.state !== 'OPEN'
+        || current.isDraft !== false || current.isCrossRepository !== false) throw new Error('PR changed during shadow verification');
+    }
+    // A rejected insert leaves the pinned item queued for a later evaluation.
+    await (deps.observe ?? ((entry) => {
+      const store = getDefaultLogStore();
+      if (!store) throw new Error('merge-queue observation store unavailable');
+      store.insertBatch([{ rec: { ts: new Date().toISOString(), category: 'merge-queue', event: 'shadow-verdict', data: entry }, surface: 'merge-queue' }]);
+    }))(verdict);
+    state.pending.shift();
+    state.verdicts.push(verdict);
+    writeShadowQueue(path, state);
+    return verdict;
+  });
+}
+
 const command: Command = (bin, args, cwd) => {
   const r = spawnSync(bin, [...args], { cwd, encoding: 'utf8', timeout: 600_000, maxBuffer: 32 * 1024 * 1024 });
   return { status: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + (r.error?.message ?? '') };

package/src/self-implement/orchestrator.ts

@@ -68,6 +68,7 @@ import { decideLineageSupersede, lineageSupersedeCloseComment, type LineageSuper
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { enqueueControlMemo, readSoftStopRequestStatus, type SoftStopRequestRead } from '../harness/control-inbox.js';
 import { debug } from '../debug/log.js';
+import { recordFailureEvent } from './heal-intake.js';
 import { releasePathHold, releasePathHoldComment, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { reworkDecision } from './decision-events.js';
@@ -83,6 +84,7 @@ import { decomposeSelfDevGoal, inferHotPaths, type SelfDevDecomposeOptions } fro
 import { boundaryGlobs, boundaryViolations } from './goal-boundary.js';
 import { askAtExecution, type ExecutionClarificationResult } from './execution-clarification.js';
 import { targetScopedGoalText } from './goal-text-path-scope.js';
+import { dropStaleReverts, type RevertGuardResult } from './revert-guard.js';
 import type { SelfDevGoalType } from '../self-dev/orchestrate.js';
 import { DEFAULT_BRANCH_WORKTREE_BASE, gateGitResidue, observeGitResidue } from '../git-fs/worktree.js';
 import { runGitCommand } from '../git-fs/runner.js';
@@ -96,6 +98,8 @@ import { getHarnessSpace, normalizeSpaceId, resolveRunIdentity } from '../harnes
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { addNextMdReleaseNote, harnessReleaseNote, parseReleaseNoteSection, releaseNotesDir, renderReleaseNoteSection, writeReleaseNote, type ReleaseNoteFragment, type ReleaseNoteSection } from '../release-loop/release-note.js';
+import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
+import { admitLandingMerge, owningRepoRoot } from './frozen-merges.js';
 import { plannedSelfImplBranch } from '../harness/worktree-branch-prefix.js';
 export { slugifyFeature } from '../harness/worktree-branch-prefix.js';
 import { AUTO_REVIEW_LABEL, resolveAutoReviewLabels } from './context-capsule.js';
@@ -757,6 +761,33 @@ function declaredPathsFromGoalDocumentText(document: string): { readable: boolea
   return parseDeclaredTargetPathsFromAsk(originalAsk);
 }
 
+/** Only paths explicitly designated as targets in the ask or piece text protect an intentional revert. */
+function declaredRevertGuardPaths(text: string): string[] {
+  const lines = targetScopedGoalText(text).split(/\r?\n/);
+  const pieceTargets: string[] = [];
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index]!.replace(/^\s*(?:[-*+]\s+|>\s*)+/, '');
+    const declaration = /^(?:조각\s+)?(?:대상\s*경로|target\s*paths?)\s*[:：]\s*(.*)$/i.exec(line);
+    if (!declaration) continue;
+    const fragments = [declaration[1]!];
+    while (index + 1 < lines.length) {
+      const next = lines[index + 1]!.trim().replace(/^(?:[-*+]\s+|>\s*)+/, '');
+      const paths = parseDeclaredTargetPathsFromAsk(`대상 경로: ${next}`).paths;
+      const tokens = next.split(/[·,]/).map((part) => part.trim().replace(/^`+|`+$/g, ''));
+      if (!tokens.length || !tokens.every((token) => token && paths.includes(normalizeDeclaredScopePath(token)))) break;
+      fragments.push(next);
+      index++;
+    }
+    pieceTargets.push(...parseDeclaredTargetPathsFromAsk(`대상 경로: ${fragments.join(',')}`).paths);
+  }
+  return pieceTargets;
+}
+
+function revertGuardTargetPaths(feature: string, goalDocument?: string): string[] {
+  const originalAsk = goalDocument ? extractVerbatimOriginalAsk(goalDocument)?.ask : undefined;
+  return [...new Set([...declaredRevertGuardPaths(feature), ...(originalAsk ? declaredRevertGuardPaths(originalAsk) : [])])];
+}
+
 export function detectDeclaredScopeDiff(input: {
   goalDocument?: string | null;
   changedFiles?: readonly string[] | null;
@@ -972,7 +1003,7 @@ export interface SelfImplementSeams {
   /** 변경 전 ref의 runtime source 전체. 생략 시 git에서 읽으며, 읽기 실패는 판정 미지로 남긴다. */
   reviewBaselineObservationSource?: (cwd: string, base: string) => Promise<string | undefined>;
   /** ④ gate — cwd 에서 bun test/build. postsync=정합 후 재게이트(merge-base 실행 범위). */
-  gate: (cwd: string, ctx?: { runId?: string; mode?: 'postsync' }) => Promise<SelfImplementGateResult>;
+  gate: (cwd: string, ctx?: { runId?: string; mode?: 'postsync'; round?: number }) => Promise<SelfImplementGateResult>;
   /** Gate가 실행된 worktree HEAD가 local origin/main보다 뒤처진 커밋 수. 실패는 undefined(unknown)로 정직하게 남긴다. */
   gateWorktreeBehindMain?: (cwd: string) => Promise<number | undefined>;
   /** 변경 파일 목록 — 게이트 «라우터»가 「코드가 바뀌었나」를 판정하는 입력.
@@ -1029,6 +1060,8 @@ export interface SelfImplementSeams {
   /** ★ ⑦ 병합 seam(2026-07-21·auto-merge) — 열린 PR 을 실제 병합(gh pr merge --squash). `matchHeadCommit`이 있으면
    * 검사한 고정 head 뒤 변경을 gh가 거부한다. autoMerge + 리뷰 clean 일 때만 호출(outward-facing·main 자율병합). */
   mergePr?: (opts: { number: number; cwd: string; matchHeadCommit?: string }) => Promise<{ merged: boolean; baseRefName?: string; mergeCommit?: string; detail?: string }>;
+  /** Only successful merges trigger this injected, fail-closed draft inventory and mutation seam. */
+  supersedeDraftsOnMerge?: (number: number, cwd: string) => Promise<void>;
   /** Post-merge cleanup is opt-in and injectable so tests never touch the filesystem. */
   postMergeCleanup?: {
     enabled: boolean;
@@ -2551,12 +2584,16 @@ function releaseNoteForRun(goalFile: string | undefined, feature: string): Relea
 }
 
 /** GATE-CALLERS (OP 10-03): caller tests that exceeded the gate cap must stay visible in the PR body even when the gate log is cut. */
+export function exposeGateLines(gateLog?: string): string[] {
+  return (gateLog ?? '').split('\n').filter((line) => line.startsWith('[expose]'));
+}
+
 export function gateNotRunSection(gateLog?: string): string[] {
   const lines = (gateLog ?? '').split('\n').filter((line) => line.startsWith('⚠️ caller test cap exceeded'));
   return lines.length ? ['', '## Gate · 안 돈 소비자 시험(상한 초과)', ...lines.map((line) => `- ${line.replace(/^⚠️ caller test cap exceeded — not run: /, '')}`)] : [];
 }
 
-function prBody(feature: string, implSummary: string, gateLog?: string, review?: SelfImplementReview, reviewIntent?: string, autoReviewDeclineReasons?: readonly string[], evidence?: string, goalFile?: string, planRevision?: ReworkPlanRevision, releaseNote?: ReturnType<typeof harnessReleaseNote>): string {
+function prBody(feature: string, implSummary: string, gateLog?: string, review?: SelfImplementReview, reviewIntent?: string, autoReviewDeclineReasons?: readonly string[], evidence?: string, goalFile?: string, planRevision?: ReworkPlanRevision, releaseNote?: ReturnType<typeof harnessReleaseNote>, revertGuard?: RevertGuardResult): string {
   const note = releaseNote ?? releaseNoteForRun(goalFile, feature);
   const relaxation = planRevision?.relaxation
     ? ['', '## 감독 수용 기준 완화', `- 대상: ${planRevision.relaxation.target}`, `- 이전: ${planRevision.relaxation.expected}`, `- 완화: ${planRevision.relaxation.replacement}`, `- 이유: ${planRevision.reason}`, `- 적용: ${planRevision.application?.status ?? 'failed'}${planRevision.application?.detail ? ` (${planRevision.application.detail})` : ''}`, ...(planRevision.disposition ? [`- 충돌 처분: ${planRevision.disposition}`] : [])]
@@ -2577,7 +2614,14 @@ function prBody(feature: string, implSummary: string, gateLog?: string, review?:
       ...(review.shouldFix.length ? ['', '**should-fix (비블로킹):**', ...review.shouldFix.slice(0, 8).map((f) => `- ${f}`)] : [])] : []),
     ...(autoReviewDeclineReasons?.length ? ['', '## Auto-review label not applied', 'The requested auto-review label was declined by the autonomy gate:', ...autoReviewDeclineReasons.map((reason) => `- ${reason}`)] : []),
     ...gateNotRunSection(gateLog),
-    ...(gateLog ? ['', '## Gate', '```', gateLog.trim().slice(0, 3000), '```'] : []),
+    ...(gateLog || revertGuard ? ['', '## Gate',
+      // 경고는 잘린 gate 로그의 코드블록 밖에서도 한눈에 보인다.
+      ...((gateLog ?? '').split('\n').filter((line) => line.startsWith('⚠️ 동작 검증 0:'))),
+      ...exposeGateLines(gateLog),
+      ...(gateLog ? ['```', gateLog.trim().slice(0, 3000), '```'] : []),
+      ...(revertGuard?.reverted.length ? [`- 되돌림 방지: ${revertGuard.reverted.length}파일 제외`] : []),
+      ...(revertGuard?.protected.length ? [`- 되돌림 경고: 대상 경로 ${revertGuard.protected.length}파일 유지 (${revertGuard.protected.join(', ')})`] : []),
+      ...(revertGuard?.warning ? [`- 되돌림 검사 실패(커밋 계속): ${revertGuard.warning}`] : [])] : []),
     ...relaxation,
     '',
     '🤖 self-implement 오케스트레이터 (elanous 자율 구현·리뷰-게이트 병합)',
@@ -2807,7 +2851,7 @@ function blockedDraftPrBody(feature: string, implSummary: string, state: Blocked
     ...(state.gate === undefined
       ? ['(게이트 미실행)']
       : state.gate.log
-        ? ['```', state.gate.log.trim().slice(0, 3000), '```']
+        ? [...state.gate.log.split('\n').filter((line) => line.startsWith('⚠️ 동작 검증 0:')), ...exposeGateLines(state.gate.log), '```', state.gate.log.trim().slice(0, 3000), '```'] // 경고는 절단된 로그 밖에도 보존한다.
         : ['(게이트 실행됨 · 로그 없음)']),
     '',
     '## Main-sync typecheck',
@@ -4087,6 +4131,19 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
     throw e;
   } finally {
     if (loopRegistered) registerRunLoop('ended');
+    const terminalStage = terminalResult?.stage ?? 'crashed';
+    try {
+      const mappedStatus = mapStageToRunStatus(terminalStage)?.runStatus;
+      if (!terminalResult || mappedStatus === 'failed' || (mappedStatus === undefined && terminalResult.ok === false) || signalIncompleteState(roundClassifications).latestSignalIncomplete) {
+        recordFailureEvent({
+          source: 'harness-run', kind: terminalStage, ref: runId,
+          summary: opts.feature.split(/\r?\n/, 1)[0]?.trim() || `Harness run ${runId} failed`,
+          at: new Date().toISOString(),
+        });
+      }
+    } catch (error) {
+      logRunAwareFailSoft(runId, 'heal-intake-record-failed', { stage: terminalStage, error: safeErrorDescription(error) });
+    }
     if (terminalResult) await recordGoalExecution(terminalResult);
     // ⛔⭐⭐⭐ 종결을 «못 적고» 죽는 길을 막는다 (2026-08-11 · 🅣 71차 · 대표 「종료 때 정리가 안 되면 설계 문제」).
     //   `terminalResult` 는 «두 자리»에서만 선다 — 정상 종료 ⊕ `StepTimeoutError` 분기.
@@ -5279,6 +5336,13 @@ async function runSelfImplementInner(
   let finishedChildCommitMissing = false;
   let finishedChildCommitFailure: string | undefined;
   let finishedChildCommitted = false;
+  const revertGuard: RevertGuardResult = { reverted: [], protected: [] };
+  const inspectStaleReverts = (targets: readonly string[]): void => {
+    const inspected = dropStaleReverts(wt.path, targets, runId, getUserConfig().harness?.revertGuard?.depth);
+    for (const file of inspected.reverted) if (!revertGuard.reverted.includes(file)) revertGuard.reverted.push(file);
+    for (const file of inspected.protected) if (!revertGuard.protected.includes(file)) revertGuard.protected.push(file);
+    if (inspected.warning) revertGuard.warning = inspected.warning;
+  };
   const classifyUnfinishedRun = (stage: SelfImplementStage, verdict?: ReworkBudgetVerdict, decomposition?: TerminalDecomposition): AbandonedClassificationResult => {
     const quotaExhaustionAssessment = quotaExhaustionAssessmentForRun();
     const worktree = unfinishedWorktreeObservation(wt.path);
@@ -6306,6 +6370,7 @@ async function runSelfImplementInner(
           .filter((path) => !harnessSeededPaths.includes(path)
             && targets.some((target) => changedFileIsInsideDeclaredTarget(path, target)));
         if (eligible.length) {
+          inspectStaleReverts(revertGuardTargetPaths(opts.feature, goalDocument));
           const message = `self-implement: ${prTitle(opts.feature)}`;
           let outcome: { ok: boolean; out: string };
           try {
@@ -6514,7 +6579,7 @@ async function runSelfImplementInner(
           return { ...stoppedBeforeGate, ...resolveRunOutcome({ termination: 'abandoned' }), sessionId, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(review ? { review } : {}) };
         }
         onNodeEntry(node('gate'), round);
-        gate = await stepTimeout(s.gate(wt.path, { runId }), T.gate, 'gate');
+        gate = await stepTimeout(s.gate(wt.path, { runId, round }), T.gate, 'gate');
       } else {
         observe('gate-skipped-by-graph', { ...graphAuthorityFields(graphAuthority, graphTemplate), round, reason: gateRoute.reason, changedFileCount: gateRouteFiles?.length ?? null });
         gate = {
@@ -7106,6 +7171,11 @@ async function runSelfImplementInner(
 
   if (s.mergeMain && s.commitWork) {
     onNodeEntry('main-sync', round);
+    let goalDocument: string | undefined;
+    if (opts.goalFile) {
+      try { goalDocument = readFileSync(opts.goalFile, 'utf8'); } catch { /* no documented targets */ }
+    }
+    inspectStaleReverts(revertGuardTargetPaths(opts.feature, goalDocument));
     s.commitWork(wt.path, prTitle(opts.feature));
     // ⛔⭐ resume 경로와 «같은» 해석기를 쓴다 — 두 자리가 갈리면 같은 원인이 다른 얼굴로 나온다.
     const resolvedTarget = resolveDefaultBranchTarget(s.defaultBranchRef ?? defaultBranchRef, wt.path);
@@ -7139,7 +7209,7 @@ async function runSelfImplementInner(
         ? `${mergeTarget} 충돌해결됨 — ${formatLlmMergeOutcome(sync)} — 통합 결과 full 재-gate…`
         : `${mergeTarget} 정합됨 — 통합 결과 full 재-gate…`);
       onNodeEntry('regate', round);
-      const regate = await withStepTimeout(s.gate(wt.path, { runId, mode: 'postsync' }), T.gate, 'gate');
+      const regate = await withStepTimeout(s.gate(wt.path, { runId, mode: 'postsync', round }), T.gate, 'gate');
       if (!regate.passed) await onFailureVerdict('gate');
       // `mode` name/meaning stay: `full` = existing gate including tests. Both
       // conflict-resolved and clean-merge reuse this same `s.gate` invocation.
@@ -7269,7 +7339,7 @@ async function runSelfImplementInner(
   addNextMdReleaseNote(wt.path, releaseNote);
   const preparedPrBody = preparePrBody(
     [
-      prBody(opts.feature, impl.summary, gate.log, review, reviewIntent, declineReasons, harvestedForPr(), opts.goalFile, lastPlanRevision, releaseNote),
+      prBody(opts.feature, impl.summary, gate.log, review, reviewIntent, declineReasons, harvestedForPr(), opts.goalFile, lastPlanRevision, releaseNote, revertGuard),
       ...(prEvidenceDecision.body ? ['', '---', '', prEvidenceDecision.body] : []),
     ].join('\n'),
     s.persistPrBodyArtifact,
@@ -7418,11 +7488,45 @@ async function runSelfImplementInner(
       progress('pr-opened', `호스트 재게이트 대기 (#${pr.number})`);
       return { ok: true, stage: 'merge-ready', node: 'open-pr', ...resolveRunOutcome({ termination: 'completed' }), ...decisionSignalResult, ...preservedCompletionResult, ...(completionStatus ? { completionStatus } : {}), sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), checkedHeadCommit: checkedHeadCommit!, prUrl: pr.url, prNumber: pr.number };
     }
-    onNodeEntry('merge', round);
-    progress('merging', '자동 병합 (리뷰 clean·squash)…');
-    const m = await withStepTimeout(s.mergePr!({ number: pr.number, cwd: wt.path, matchHeadCommit: checkedHeadCommit! }), T.pr, 'pr');
+    // Landing freeze: the in-flight marker is written before the freeze is read, so a `freeze on` racing this merge waits.
+    // The resume sweep merges from the repository that owns the run worktree (the worktree itself may be cleaned up).
+    const heldEntry = () => {
+      if (!checkedHeadCommit || !/^[0-9a-f]{40}$/i.test(checkedHeadCommit)) return null;
+      const owner = owningRepoRoot(wt.path);
+      // Without a known owning repository the held PR stays queued for a person; no sweep resumes it from a worktree.
+      return owner ? { prNumber: pr.number, headCommit: checkedHeadCommit, repoRoot: owner } : { prNumber: pr.number, headCommit: checkedHeadCommit, repoRoot: wt.path, manual: true as const };
+    };
+    const landing = admitLandingMerge(heldEntry, undefined, {}, { prNumber: pr.number, repoRoot: owningRepoRoot(wt.path) ?? wt.path, ...(checkedHeadCommit ? { headCommit: checkedHeadCommit } : {}) });
+    if (landing.kind === 'held' && !(checkedHeadCommit && /^[0-9a-f]{40}$/i.test(checkedHeadCommit))) {
+      return { ok: true, stage: 'pr-opened', node: 'open-pr', ...resolveRunOutcome({ termination: 'completed' }), ...decisionSignalResult, ...preservedCompletionResult, ...(completionStatus ? { completionStatus } : {}), sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), mergeReason: 'merge-guard-unevaluated', prUrl: pr.url, prNumber: pr.number, detail: 'freeze: checked head SHA unavailable; PR left ready for review' };
+    }
+    if (landing.kind !== 'merge') {
+      const detail = landing.kind === 'held' ? landingFreezeMessage(landing.freeze) : 'freeze lifted; a resume sweep is merging this PR';
+      debug.log('harness.merge', 'frozen', { pr: pr.number, ...(landing.kind === 'held' ? { reason: landing.freeze.reason, until: landing.freeze.until } : { resumedElsewhere: true }) });
+      progress('pr-opened', `#${pr.number} ready · ${detail}`);
+      return { ok: true, stage: 'pr-opened', node: 'open-pr', ...resolveRunOutcome({ termination: 'completed' }), ...decisionSignalResult, ...preservedCompletionResult, ...(completionStatus ? { completionStatus } : {}), sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), mergeReason: landing.kind === 'held' ? 'frozen' : 'resumed-elsewhere', prUrl: pr.url, prNumber: pr.number, detail };
+    }
+    // The marker and claim live until the merge call itself settles — a step timeout does not stop a merge already
+    // sent — and anything that throws before the merge call is made releases them.
+    let merging: ReturnType<NonNullable<typeof s.mergePr>>;
+    try {
+      onNodeEntry('merge', round);
+      progress('merging', '자동 병합 (리뷰 clean·squash)…');
+      merging = s.mergePr!({ number: pr.number, cwd: wt.path, matchHeadCommit: checkedHeadCommit! });
+    } catch (error) { landing.end(); throw error; }
+    // The default merge seam resolves only after `gh pr view` reads MERGED, so settling is the confirmation.
+    const release = (merged: boolean) => {
+      try { landing.end(merged); } catch (error) { observe('landing-release-failed', { number: pr.number, error: safeErrorDescription(error) }, { level: 'error' }); }
+    };
+    void merging.then((outcome) => release(outcome.merged === true), () => release(false));
+    const m = await withStepTimeout(merging, T.pr, 'pr');
     observe('merged', { number: pr.number, merged: m.merged, detail: m.detail ?? null });
     if (m.merged) {
+      try {
+        await s.supersedeDraftsOnMerge?.(pr.number, wt.path);
+      } catch (error) {
+        observe('draft-supersede-on-merge-failed', { number: pr.number, error: safeErrorDescription(error) }, { level: 'warn' });
+      }
       const directory = releaseNotesDir(elanousStateRoot());
       const fragment: ReleaseNoteFragment = {
         pr: pr.number,

package/src/self-implement/revert-guard.ts

@@ -0,0 +1,62 @@
+import { execFileSync } from 'node:child_process';
+import { lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug } from '../debug/log.js';
+
+export type RevertGuardResult = { reverted: string[]; protected: string[]; warning?: string };
+
+/** Compare the worktree's exact bytes with blobs from recent HEAD ancestry, before add -A. */
+export function dropStaleReverts(cwd: string, targets: readonly string[], runId: string, depth = 50): RevertGuardResult {
+  const result: RevertGuardResult = { reverted: [], protected: [] };
+  const git = (...args: string[]): Buffer => execFileSync('git', args, { cwd, timeout: 20_000, maxBuffer: 16 * 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe'] });
+  const reason = (error: unknown): string => (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ').slice(0, 240);
+  try {
+    const limit = Number.isSafeInteger(depth) && depth > 0 ? depth : 50;
+    const commits = git('rev-list', `--max-count=${limit + 1}`, 'HEAD').toString('utf8').trim().split('\n');
+    const changed = git('diff', '--name-only', '--diff-filter=M', '-z', 'HEAD', '--').toString('utf8').split('\0').filter(Boolean);
+    const staged = git('diff', '--cached', '--name-only', '--diff-filter=M', '-z', 'HEAD', '--').toString('utf8').split('\0').filter(Boolean);
+    for (const file of new Set([...changed, ...staged])) {
+      try {
+        if (!lstatSync(join(cwd, file)).isFile()) continue;
+        const current = readFileSync(join(cwd, file));
+        const rawOid = execFileSync('git', ['hash-object', '--stdin'], { cwd, input: current, timeout: 20_000 }).toString('utf8').trim();
+        const headEntry = git('ls-tree', 'HEAD', '--', file).toString('utf8').trim();
+        const head = /^\d+ blob ([0-9a-f]+)\t/.exec(headEntry)?.[1];
+        if (!head) continue;
+        const sameBytes = (oid: string): boolean => oid === rawOid || git('cat-file', 'blob', oid).equals(current);
+        if (sameBytes(head)) continue;
+        let matchedCommit: string | undefined;
+        const inspectedOids = new Set<string>();
+        for (const commit of commits.slice(1)) {
+          // A path may not have existed in an ancestor; that is not a failed inspection.
+          const blob = git('ls-tree', commit, '--', file).toString('utf8').trim();
+          const oid = /^\d+ blob ([0-9a-f]+)\t/.exec(blob)?.[1];
+          if (oid && !inspectedOids.has(oid)) {
+            if (sameBytes(oid)) { matchedCommit = commit; break; }
+            inspectedOids.add(oid);
+          }
+        }
+        if (!matchedCommit) continue;
+        const scoped = targets.some((target) => {
+          const path = target.replace(/^\.\//, '').replace(/\/+$/, '');
+          return path !== '' && (file === path || file.startsWith(`${path}/`));
+        });
+        if (scoped) {
+          result.protected.push(file);
+          debug.log('self-implement.revert-guard', 'protected-target', { runId, files: [file], matchedCommit }, { level: 'warn' });
+        } else {
+          git('checkout', 'HEAD', '--', file);
+          result.reverted.push(file);
+          debug.log('self-implement.revert-guard', 'reverted-stale', { runId, files: [file], matchedCommit });
+        }
+      } catch (error) {
+        result.warning = `git inspection/checkout failed for ${file}: ${reason(error)}`;
+        debug.log('self-implement.revert-guard', 'fail-open', { runId, reason: result.warning }, { level: 'warn' });
+      }
+    }
+  } catch (error) {
+    result.warning = `git inspection failed: ${reason(error)}`;
+    debug.log('self-implement.revert-guard', 'fail-open', { runId, reason: result.warning }, { level: 'warn' });
+  }
+  return result;
+}

package/src/self-implement/run-ledger.ts

@@ -276,7 +276,7 @@ interface RunLedgerLookupTarget {
   targetName: string | null;
 }
 
-function resolveFederatedRunLedgerTargets(options: Pick<FederatedRunLedgerLookupOptions, 'includeTest' | 'targets'>): RunLedgerLookupTarget[] {
+export function resolveFederatedRunLedgerTargets(options: Pick<FederatedRunLedgerLookupOptions, 'includeTest' | 'targets'>): RunLedgerLookupTarget[] {
   const resolved = options.targets ? { targets: [...options.targets] } : resolveLogTargets({ all: true, includeTest: options.includeTest });
   if (resolved.error) throw new Error(resolved.error);
   const targets = new Map<string, string>();

package/src/self-implement/seams.ts

@@ -37,7 +37,8 @@ import { iosFilesIn, runIosUnitTestGate } from '../../scripts/ci-ios-unit-tests.
 import { detectGateCommand } from './detect-gate.js';
 import { writeScopedTypecheckConfig } from './scoped-typecheck-config.js';
 // ⭐ 게이트 스코프 근본 수리(2026-07-26) — 풀 `bun test` 폴백 제거 + 연관 테스트 유도(순수).
-import { resolveGateScope } from './gate-scope.js';
+import { formatNoRelatedTestsWarning, resolveGateScope } from './gate-scope.js';
+import { publicExposureFiles, runExposeGate } from './expose-gate.js';
 import { buildImporterTestIndex, isTestPath } from './importer-test-index.js';
 import { buildRouteConsumerTestIndex } from './route-consumer-test-index.js';
 import { countTestDeclarations } from './test-declarations.js';
@@ -976,6 +977,7 @@ export interface DefaultSeamsOptions {
   runIosUnitTestGate?: (io: { args: readonly string[]; cwd: string }) => number;
   /** Source-policy gate adapter for focused seam tests. */
   runHarnessPolicyGates?: typeof runHarnessPolicyGates;
+  runExposeGate?: typeof runExposeGate;
   /** Dependency-wide validation adapter for focused seam tests. */
   runDependencyChangeGate?: typeof runDependencyChangeGate;
   /** 워크트리 시험 묶음(없으면 실패 파일)을 base에서 재실행하는 seam. 실패 경로에서만 호출된다. */
@@ -1409,6 +1411,10 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       },
       removeMatchingGoalCopy,
     },
+    supersedeDraftsOnMerge: async (number, cwd) => {
+      const { supersedeMergedGoalDrafts } = await import('../harness/harness-cli-command.js');
+      await supersedeMergedGoalDrafts(number, cwd);
+    },
     lineageSupersede: {
       listOpenDrafts: () => listOpenDraftsForLineage(),
       readRunLedger: (runId) => {
@@ -1810,8 +1816,13 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       const observationChanges = gateChangedFiles(cwd, comparisonBase);
       const observationChangedFiles = observationChanges.files;
       const postsync = ctx?.mode === 'postsync';
-      // 정합 전 일반 게이트는 worktree-only. 정합 후 재게이트만 이미 계산된 merge-base 목록을 실행 범위로 쓴다.
-      const changedAll = postsync ? observationChangedFiles : gitChangedFiles(cwd);
+      // 일반 게이트는 기존 worktree 범위를 유지하되 fork 이후 커밋된 시험을 더한다.
+      // HEAD 대비 미커밋 목록만 쓰면 릴리스 노트만 남은 재작업 라운드에서
+      // 커밋된 시험을 놓쳐 docs-only 로 건너뛴다. postsync는 종전처럼 전 변경을 잰다.
+      const changedAll = postsync ? observationChangedFiles : [...new Set([
+        ...gitChangedFiles(cwd),
+        ...observationChangedFiles.filter((file) => isTestPath(file)),
+      ])];
       // ⚠️ **regular-file 판정**(리뷰 should-fix 5R) — `existsSync` 는 **디렉터리도 true** 다.
       //   계약은 "실존 테스트 **파일**"이므로 파일 여부까지 확인한다(디렉터리를 testArgs 로 넘기면
       //   필터 무매치 → "0 files ran" 부당 실패).
@@ -1824,11 +1835,19 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         trackedFiles.filter(isTestPath),
         [...new Set([...trackedFiles, ...changedAll, ...observationChangedFiles])].filter((file) => /\.(?:[cm]?[jt]sx?)$/.test(file)),
       );
-      const routeConsumerTestIndex = buildRouteConsumerTestIndex(cwd, trackedFiles.filter(isTestPath), changedAll, comparisonBase ?? 'HEAD');
+      // 런 전체 재탐색 시 앞 라운드의 변경·삭제 서버 경로도 비교-base 소비자 색인에 있어야 한다.
+      const routeConsumerTestIndex = buildRouteConsumerTestIndex(cwd, trackedFiles.filter(isTestPath),
+        [...new Set([...changedAll, ...observationChangedFiles])], comparisonBase ?? 'HEAD');
       // 워크트리에 없는 변경 경로 = 지운 파일 — 미검증으로 세지 않는다(gate-scope `isDeleted` · 2026-09-26 run-7dd4cce6).
       const isDeleted = (path: string): boolean => !isFile(path);
-      const scopeOpts = { isDeleted, routeConsumerTestIndex: routeConsumerTestIndex ?? undefined };
+      const scopeOpts = { isDeleted, routeConsumerTestIndex: routeConsumerTestIndex ?? undefined,
+        runChanged: observationChangedFiles, round: ctx?.round };
       const scope = resolveGateScope(changedAll, isFile, importerTestIndex ?? undefined, postsync ? { ...scopeOpts, mode: 'postsync' } : scopeOpts);
+      // The landing scope is the PR diff, not only this round's uncommitted test files.
+      const expose = publicExposureFiles(observationChangedFiles).length > 0
+        ? (o.runExposeGate ?? runExposeGate)(cwd, observationChangedFiles,
+          getUserConfig().harness?.exposeGate === 'strict' ? 'strict' : 'warn')
+        : { passed: true, log: '' };
       const comparisonFailureReason = observationChanges.comparisonBaseStatus === 'unavailable'
         ? 'comparison-base-unavailable'
         : observationChanges.comparisonBaseStatus === 'comparison-failed'
@@ -1865,6 +1884,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       debug.log('self-implement', 'gate.scope', {
         ...(ctx?.runId ? { runId: ctx.runId } : {}),
         targeted: gateOpts.testArgs?.length ?? 0, files: (gateOpts.testArgs ?? []).slice(0, 8),
+        'evaluated-changes': changedAll.slice(0, 8), evaluatedChangeCount: changedAll.length,
         changedTests: observedChangedTestFiles.slice(0, 8), changedTestCount: observedChangedTestFiles.length,
         srcChanged: scope.sourceFiles.length, testStepSkipped,
         scopeReason, derived: scope.derived.length, ignoredOutsideSrc: scope.ignoredOutsideSrc,
@@ -2053,7 +2073,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       //   `tc`(변경파일 tsc) **전에** 실행해서, tsc 가 깨져 **최종 게이트가 실패한 런에도**
       //   base 를 다시 돌리고 `gate.log` 를 바꿨다 ⇒ *"게이트 실패 경로 무변경"* 경계 위반.
       //   ⇒ 조건을 최종 판정과 같은 식으로 묶는다.
-      const gatePassed = !comparisonFailureReason && !unmeasuredPostsync && integrityPassed && tc.passed && policy.passed && (dependencyGate?.passed ?? true);
+      const gatePassed = !comparisonFailureReason && !unmeasuredPostsync && integrityPassed && tc.passed && policy.passed && expose.passed && (dependencyGate?.passed ?? true);
       const verifyIdentity = gateVerifyIdentity(ctx?.runId);
       if (gatePassed && scope.skipTestStep) {
         verifyByBreaking = { ran: false, distinguishes: 0, 'does-not-distinguish': 0, unknown: 0, skippedReason: scope.reason };
@@ -2204,7 +2224,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           + (scope.reason === 'no-related-tests'
             // ⭐ **미검증 파일 목록**(2026-07-27 사후 리뷰 수리) — 종전엔 `sourceFiles` 를 실어
             //   `package.json`·설정·스크립트 변경 시 **빈 목록**이 나갔다(그 파일들은 소스 확장자가 아니다).
-            ? `동작 검증을 못 한 변경: ${scope.unverified.slice(0, 8).join(', ')}`
+            ? `\n\n${formatNoRelatedTestsWarning(scope.unverified)}\n\n동작 검증을 못 한 변경: ${scope.unverified.slice(0, 8).join(', ')}`
               + `\n⚠️ 이 라운드는 **동작 검증이 되지 않았다**(변경파일 tsc 만 통과) — "게이트 통과=검증됨"으로 결론내지 말 것.`
               // ⚠️ 안내를 일반화(리뷰 should-fix) — `package.json`·lockfile·설정·스크립트에는
               //   "해당 소스의 테스트"라는 표현이 부정확하다(그 변경엔 대응 테스트 관례가 없다).
@@ -2229,7 +2249,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         : '';
       return {
         passed: gatePassed,
-        log: `${baseLog}${policyFailureLog}${dependencyFailureLog}${dependencyUnmeasuredNote}${comparisonFailureLog}${baselineNote}${verifyByBreakingNote}${scopeNote}${uncoveredNote}${pulledInRelatedTestsNote}${callerOverflowNote}${routeLookupNote}`,
+        log: `${baseLog}${policyFailureLog}${dependencyFailureLog}${dependencyUnmeasuredNote}${comparisonFailureLog}${baselineNote}${verifyByBreakingNote}${scopeNote}${uncoveredNote}${pulledInRelatedTestsNote}${callerOverflowNote}${routeLookupNote}${expose.log ? `\n\n${expose.log}` : ''}`,
         testStepExecuted: !testStepSkipped && testStep !== undefined && !testStep.skipped,
         scopeReason,
         comparisonBaseStatus: observationChanges.comparisonBaseStatus,

package/src/session/index.ts

@@ -213,6 +213,8 @@ export interface SessionMeta {
   tgBotId?: string;
   /** Stable identity for a persona's resident conversation. */
   personaId?: string;
+  /** Optional persona selected for this conversation's replies (not resident identity). */
+  chatPersonaId?: string;
   /** Telegram session-key used for lookup by chat, e.g.
    *  `telegram:8799226199:dm:123:0` (bot-scoped) or legacy
    *  `telegram:dm:123:0`. Constructed once at create time. */