elanous 0.2.13 → 0.2.14

package/src/self-implement/orchestrator.ts

@@ -68,6 +68,7 @@ import { decideLineageSupersede, lineageSupersedeCloseComment, type LineageSuper
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { enqueueControlMemo, readSoftStopRequestStatus, type SoftStopRequestRead } from '../harness/control-inbox.js';
 import { debug } from '../debug/log.js';
+import { recordFailureEvent } from './heal-intake.js';
 import { releasePathHold, releasePathHoldComment, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { reworkDecision } from './decision-events.js';
@@ -83,6 +84,7 @@ import { decomposeSelfDevGoal, inferHotPaths, type SelfDevDecomposeOptions } fro
 import { boundaryGlobs, boundaryViolations } from './goal-boundary.js';
 import { askAtExecution, type ExecutionClarificationResult } from './execution-clarification.js';
 import { targetScopedGoalText } from './goal-text-path-scope.js';
+import { dropStaleReverts, type RevertGuardResult } from './revert-guard.js';
 import type { SelfDevGoalType } from '../self-dev/orchestrate.js';
 import { DEFAULT_BRANCH_WORKTREE_BASE, gateGitResidue, observeGitResidue } from '../git-fs/worktree.js';
 import { runGitCommand } from '../git-fs/runner.js';
@@ -96,6 +98,8 @@ import { getHarnessSpace, normalizeSpaceId, resolveRunIdentity } from '../harnes
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { addNextMdReleaseNote, harnessReleaseNote, parseReleaseNoteSection, releaseNotesDir, renderReleaseNoteSection, writeReleaseNote, type ReleaseNoteFragment, type ReleaseNoteSection } from '../release-loop/release-note.js';
+import { landingFreezeMessage } from '../release-loop/landing-freeze.js';
+import { admitLandingMerge, owningRepoRoot } from './frozen-merges.js';
 import { plannedSelfImplBranch } from '../harness/worktree-branch-prefix.js';
 export { slugifyFeature } from '../harness/worktree-branch-prefix.js';
 import { AUTO_REVIEW_LABEL, resolveAutoReviewLabels } from './context-capsule.js';
@@ -757,6 +761,33 @@ function declaredPathsFromGoalDocumentText(document: string): { readable: boolea
   return parseDeclaredTargetPathsFromAsk(originalAsk);
 }
 
+/** Only paths explicitly designated as targets in the ask or piece text protect an intentional revert. */
+function declaredRevertGuardPaths(text: string): string[] {
+  const lines = targetScopedGoalText(text).split(/\r?\n/);
+  const pieceTargets: string[] = [];
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index]!.replace(/^\s*(?:[-*+]\s+|>\s*)+/, '');
+    const declaration = /^(?:조각\s+)?(?:대상\s*경로|target\s*paths?)\s*[:：]\s*(.*)$/i.exec(line);
+    if (!declaration) continue;
+    const fragments = [declaration[1]!];
+    while (index + 1 < lines.length) {
+      const next = lines[index + 1]!.trim().replace(/^(?:[-*+]\s+|>\s*)+/, '');
+      const paths = parseDeclaredTargetPathsFromAsk(`대상 경로: ${next}`).paths;
+      const tokens = next.split(/[·,]/).map((part) => part.trim().replace(/^`+|`+$/g, ''));
+      if (!tokens.length || !tokens.every((token) => token && paths.includes(normalizeDeclaredScopePath(token)))) break;
+      fragments.push(next);
+      index++;
+    }
+    pieceTargets.push(...parseDeclaredTargetPathsFromAsk(`대상 경로: ${fragments.join(',')}`).paths);
+  }
+  return pieceTargets;
+}
+
+function revertGuardTargetPaths(feature: string, goalDocument?: string): string[] {
+  const originalAsk = goalDocument ? extractVerbatimOriginalAsk(goalDocument)?.ask : undefined;
+  return [...new Set([...declaredRevertGuardPaths(feature), ...(originalAsk ? declaredRevertGuardPaths(originalAsk) : [])])];
+}
+
 export function detectDeclaredScopeDiff(input: {
   goalDocument?: string | null;
   changedFiles?: readonly string[] | null;
@@ -972,7 +1003,7 @@ export interface SelfImplementSeams {
   /** 변경 전 ref의 runtime source 전체. 생략 시 git에서 읽으며, 읽기 실패는 판정 미지로 남긴다. */
   reviewBaselineObservationSource?: (cwd: string, base: string) => Promise<string | undefined>;
   /** ④ gate — cwd 에서 bun test/build. postsync=정합 후 재게이트(merge-base 실행 범위). */
-  gate: (cwd: string, ctx?: { runId?: string; mode?: 'postsync' }) => Promise<SelfImplementGateResult>;
+  gate: (cwd: string, ctx?: { runId?: string; mode?: 'postsync'; round?: number }) => Promise<SelfImplementGateResult>;
   /** Gate가 실행된 worktree HEAD가 local origin/main보다 뒤처진 커밋 수. 실패는 undefined(unknown)로 정직하게 남긴다. */
   gateWorktreeBehindMain?: (cwd: string) => Promise<number | undefined>;
   /** 변경 파일 목록 — 게이트 «라우터»가 「코드가 바뀌었나」를 판정하는 입력.
@@ -1029,6 +1060,8 @@ export interface SelfImplementSeams {
   /** ★ ⑦ 병합 seam(2026-07-21·auto-merge) — 열린 PR 을 실제 병합(gh pr merge --squash). `matchHeadCommit`이 있으면
    * 검사한 고정 head 뒤 변경을 gh가 거부한다. autoMerge + 리뷰 clean 일 때만 호출(outward-facing·main 자율병합). */
   mergePr?: (opts: { number: number; cwd: string; matchHeadCommit?: string }) => Promise<{ merged: boolean; baseRefName?: string; mergeCommit?: string; detail?: string }>;
+  /** Only successful merges trigger this injected, fail-closed draft inventory and mutation seam. */
+  supersedeDraftsOnMerge?: (number: number, cwd: string) => Promise<void>;
   /** Post-merge cleanup is opt-in and injectable so tests never touch the filesystem. */
   postMergeCleanup?: {
     enabled: boolean;
@@ -2551,12 +2584,16 @@ function releaseNoteForRun(goalFile: string | undefined, feature: string): Relea
 }
 
 /** GATE-CALLERS (OP 10-03): caller tests that exceeded the gate cap must stay visible in the PR body even when the gate log is cut. */
+export function exposeGateLines(gateLog?: string): string[] {
+  return (gateLog ?? '').split('\n').filter((line) => line.startsWith('[expose]'));
+}
+
 export function gateNotRunSection(gateLog?: string): string[] {
   const lines = (gateLog ?? '').split('\n').filter((line) => line.startsWith('⚠️ caller test cap exceeded'));
   return lines.length ? ['', '## Gate · 안 돈 소비자 시험(상한 초과)', ...lines.map((line) => `- ${line.replace(/^⚠️ caller test cap exceeded — not run: /, '')}`)] : [];
 }
 
-function prBody(feature: string, implSummary: string, gateLog?: string, review?: SelfImplementReview, reviewIntent?: string, autoReviewDeclineReasons?: readonly string[], evidence?: string, goalFile?: string, planRevision?: ReworkPlanRevision, releaseNote?: ReturnType<typeof harnessReleaseNote>): string {
+function prBody(feature: string, implSummary: string, gateLog?: string, review?: SelfImplementReview, reviewIntent?: string, autoReviewDeclineReasons?: readonly string[], evidence?: string, goalFile?: string, planRevision?: ReworkPlanRevision, releaseNote?: ReturnType<typeof harnessReleaseNote>, revertGuard?: RevertGuardResult): string {
   const note = releaseNote ?? releaseNoteForRun(goalFile, feature);
   const relaxation = planRevision?.relaxation
     ? ['', '## 감독 수용 기준 완화', `- 대상: ${planRevision.relaxation.target}`, `- 이전: ${planRevision.relaxation.expected}`, `- 완화: ${planRevision.relaxation.replacement}`, `- 이유: ${planRevision.reason}`, `- 적용: ${planRevision.application?.status ?? 'failed'}${planRevision.application?.detail ? ` (${planRevision.application.detail})` : ''}`, ...(planRevision.disposition ? [`- 충돌 처분: ${planRevision.disposition}`] : [])]
@@ -2577,7 +2614,14 @@ function prBody(feature: string, implSummary: string, gateLog?: string, review?:
       ...(review.shouldFix.length ? ['', '**should-fix (비블로킹):**', ...review.shouldFix.slice(0, 8).map((f) => `- ${f}`)] : [])] : []),
     ...(autoReviewDeclineReasons?.length ? ['', '## Auto-review label not applied', 'The requested auto-review label was declined by the autonomy gate:', ...autoReviewDeclineReasons.map((reason) => `- ${reason}`)] : []),
     ...gateNotRunSection(gateLog),
-    ...(gateLog ? ['', '## Gate', '```', gateLog.trim().slice(0, 3000), '```'] : []),
+    ...(gateLog || revertGuard ? ['', '## Gate',
+      // 경고는 잘린 gate 로그의 코드블록 밖에서도 한눈에 보인다.
+      ...((gateLog ?? '').split('\n').filter((line) => line.startsWith('⚠️ 동작 검증 0:'))),
+      ...exposeGateLines(gateLog),
+      ...(gateLog ? ['```', gateLog.trim().slice(0, 3000), '```'] : []),
+      ...(revertGuard?.reverted.length ? [`- 되돌림 방지: ${revertGuard.reverted.length}파일 제외`] : []),
+      ...(revertGuard?.protected.length ? [`- 되돌림 경고: 대상 경로 ${revertGuard.protected.length}파일 유지 (${revertGuard.protected.join(', ')})`] : []),
+      ...(revertGuard?.warning ? [`- 되돌림 검사 실패(커밋 계속): ${revertGuard.warning}`] : [])] : []),
     ...relaxation,
     '',
     '🤖 self-implement 오케스트레이터 (elanous 자율 구현·리뷰-게이트 병합)',
@@ -2807,7 +2851,7 @@ function blockedDraftPrBody(feature: string, implSummary: string, state: Blocked
     ...(state.gate === undefined
       ? ['(게이트 미실행)']
       : state.gate.log
-        ? ['```', state.gate.log.trim().slice(0, 3000), '```']
+        ? [...state.gate.log.split('\n').filter((line) => line.startsWith('⚠️ 동작 검증 0:')), ...exposeGateLines(state.gate.log), '```', state.gate.log.trim().slice(0, 3000), '```'] // 경고는 절단된 로그 밖에도 보존한다.
         : ['(게이트 실행됨 · 로그 없음)']),
     '',
     '## Main-sync typecheck',
@@ -4087,6 +4131,19 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
     throw e;
   } finally {
     if (loopRegistered) registerRunLoop('ended');
+    const terminalStage = terminalResult?.stage ?? 'crashed';
+    try {
+      const mappedStatus = mapStageToRunStatus(terminalStage)?.runStatus;
+      if (!terminalResult || mappedStatus === 'failed' || (mappedStatus === undefined && terminalResult.ok === false) || signalIncompleteState(roundClassifications).latestSignalIncomplete) {
+        recordFailureEvent({
+          source: 'harness-run', kind: terminalStage, ref: runId,
+          summary: opts.feature.split(/\r?\n/, 1)[0]?.trim() || `Harness run ${runId} failed`,
+          at: new Date().toISOString(),
+        });
+      }
+    } catch (error) {
+      logRunAwareFailSoft(runId, 'heal-intake-record-failed', { stage: terminalStage, error: safeErrorDescription(error) });
+    }
     if (terminalResult) await recordGoalExecution(terminalResult);
     // ⛔⭐⭐⭐ 종결을 «못 적고» 죽는 길을 막는다 (2026-08-11 · 🅣 71차 · 대표 「종료 때 정리가 안 되면 설계 문제」).
     //   `terminalResult` 는 «두 자리»에서만 선다 — 정상 종료 ⊕ `StepTimeoutError` 분기.
@@ -5279,6 +5336,13 @@ async function runSelfImplementInner(
   let finishedChildCommitMissing = false;
   let finishedChildCommitFailure: string | undefined;
   let finishedChildCommitted = false;
+  const revertGuard: RevertGuardResult = { reverted: [], protected: [] };
+  const inspectStaleReverts = (targets: readonly string[]): void => {
+    const inspected = dropStaleReverts(wt.path, targets, runId, getUserConfig().harness?.revertGuard?.depth);
+    for (const file of inspected.reverted) if (!revertGuard.reverted.includes(file)) revertGuard.reverted.push(file);
+    for (const file of inspected.protected) if (!revertGuard.protected.includes(file)) revertGuard.protected.push(file);
+    if (inspected.warning) revertGuard.warning = inspected.warning;
+  };
   const classifyUnfinishedRun = (stage: SelfImplementStage, verdict?: ReworkBudgetVerdict, decomposition?: TerminalDecomposition): AbandonedClassificationResult => {
     const quotaExhaustionAssessment = quotaExhaustionAssessmentForRun();
     const worktree = unfinishedWorktreeObservation(wt.path);
@@ -6306,6 +6370,7 @@ async function runSelfImplementInner(
           .filter((path) => !harnessSeededPaths.includes(path)
             && targets.some((target) => changedFileIsInsideDeclaredTarget(path, target)));
         if (eligible.length) {
+          inspectStaleReverts(revertGuardTargetPaths(opts.feature, goalDocument));
           const message = `self-implement: ${prTitle(opts.feature)}`;
           let outcome: { ok: boolean; out: string };
           try {
@@ -6514,7 +6579,7 @@ async function runSelfImplementInner(
           return { ...stoppedBeforeGate, ...resolveRunOutcome({ termination: 'abandoned' }), sessionId, quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(), ...(review ? { review } : {}) };
         }
         onNodeEntry(node('gate'), round);
-        gate = await stepTimeout(s.gate(wt.path, { runId }), T.gate, 'gate');
+        gate = await stepTimeout(s.gate(wt.path, { runId, round }), T.gate, 'gate');
       } else {
         observe('gate-skipped-by-graph', { ...graphAuthorityFields(graphAuthority, graphTemplate), round, reason: gateRoute.reason, changedFileCount: gateRouteFiles?.length ?? null });
         gate = {
@@ -7106,6 +7171,11 @@ async function runSelfImplementInner(
 
   if (s.mergeMain && s.commitWork) {
     onNodeEntry('main-sync', round);
+    let goalDocument: string | undefined;
+    if (opts.goalFile) {
+      try { goalDocument = readFileSync(opts.goalFile, 'utf8'); } catch { /* no documented targets */ }
+    }
+    inspectStaleReverts(revertGuardTargetPaths(opts.feature, goalDocument));
     s.commitWork(wt.path, prTitle(opts.feature));
     // ⛔⭐ resume 경로와 «같은» 해석기를 쓴다 — 두 자리가 갈리면 같은 원인이 다른 얼굴로 나온다.
     const resolvedTarget = resolveDefaultBranchTarget(s.defaultBranchRef ?? defaultBranchRef, wt.path);
@@ -7139,7 +7209,7 @@ async function runSelfImplementInner(
         ? `${mergeTarget} 충돌해결됨 — ${formatLlmMergeOutcome(sync)} — 통합 결과 full 재-gate…`
         : `${mergeTarget} 정합됨 — 통합 결과 full 재-gate…`);
       onNodeEntry('regate', round);
-      const regate = await withStepTimeout(s.gate(wt.path, { runId, mode: 'postsync' }), T.gate, 'gate');
+      const regate = await withStepTimeout(s.gate(wt.path, { runId, mode: 'postsync', round }), T.gate, 'gate');
       if (!regate.passed) await onFailureVerdict('gate');
       // `mode` name/meaning stay: `full` = existing gate including tests. Both
       // conflict-resolved and clean-merge reuse this same `s.gate` invocation.
@@ -7269,7 +7339,7 @@ async function runSelfImplementInner(
   addNextMdReleaseNote(wt.path, releaseNote);
   const preparedPrBody = preparePrBody(
     [
-      prBody(opts.feature, impl.summary, gate.log, review, reviewIntent, declineReasons, harvestedForPr(), opts.goalFile, lastPlanRevision, releaseNote),
+      prBody(opts.feature, impl.summary, gate.log, review, reviewIntent, declineReasons, harvestedForPr(), opts.goalFile, lastPlanRevision, releaseNote, revertGuard),
       ...(prEvidenceDecision.body ? ['', '---', '', prEvidenceDecision.body] : []),
     ].join('\n'),
     s.persistPrBodyArtifact,
@@ -7418,11 +7488,45 @@ async function runSelfImplementInner(
       progress('pr-opened', `호스트 재게이트 대기 (#${pr.number})`);
       return { ok: true, stage: 'merge-ready', node: 'open-pr', ...resolveRunOutcome({ termination: 'completed' }), ...decisionSignalResult, ...preservedCompletionResult, ...(completionStatus ? { completionStatus } : {}), sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), checkedHeadCommit: checkedHeadCommit!, prUrl: pr.url, prNumber: pr.number };
     }
-    onNodeEntry('merge', round);
-    progress('merging', '자동 병합 (리뷰 clean·squash)…');
-    const m = await withStepTimeout(s.mergePr!({ number: pr.number, cwd: wt.path, matchHeadCommit: checkedHeadCommit! }), T.pr, 'pr');
+    // Landing freeze: the in-flight marker is written before the freeze is read, so a `freeze on` racing this merge waits.
+    // The resume sweep merges from the repository that owns the run worktree (the worktree itself may be cleaned up).
+    const heldEntry = () => {
+      if (!checkedHeadCommit || !/^[0-9a-f]{40}$/i.test(checkedHeadCommit)) return null;
+      const owner = owningRepoRoot(wt.path);
+      // Without a known owning repository the held PR stays queued for a person; no sweep resumes it from a worktree.
+      return owner ? { prNumber: pr.number, headCommit: checkedHeadCommit, repoRoot: owner } : { prNumber: pr.number, headCommit: checkedHeadCommit, repoRoot: wt.path, manual: true as const };
+    };
+    const landing = admitLandingMerge(heldEntry, undefined, {}, { prNumber: pr.number, repoRoot: owningRepoRoot(wt.path) ?? wt.path, ...(checkedHeadCommit ? { headCommit: checkedHeadCommit } : {}) });
+    if (landing.kind === 'held' && !(checkedHeadCommit && /^[0-9a-f]{40}$/i.test(checkedHeadCommit))) {
+      return { ok: true, stage: 'pr-opened', node: 'open-pr', ...resolveRunOutcome({ termination: 'completed' }), ...decisionSignalResult, ...preservedCompletionResult, ...(completionStatus ? { completionStatus } : {}), sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), mergeReason: 'merge-guard-unevaluated', prUrl: pr.url, prNumber: pr.number, detail: 'freeze: checked head SHA unavailable; PR left ready for review' };
+    }
+    if (landing.kind !== 'merge') {
+      const detail = landing.kind === 'held' ? landingFreezeMessage(landing.freeze) : 'freeze lifted; a resume sweep is merging this PR';
+      debug.log('harness.merge', 'frozen', { pr: pr.number, ...(landing.kind === 'held' ? { reason: landing.freeze.reason, until: landing.freeze.until } : { resumedElsewhere: true }) });
+      progress('pr-opened', `#${pr.number} ready · ${detail}`);
+      return { ok: true, stage: 'pr-opened', node: 'open-pr', ...resolveRunOutcome({ termination: 'completed' }), ...decisionSignalResult, ...preservedCompletionResult, ...(completionStatus ? { completionStatus } : {}), sessionId, worktreePath: wt.path, branch: wt.branch, gate, ...(review ? { review } : {}), mergeReason: landing.kind === 'held' ? 'frozen' : 'resumed-elsewhere', prUrl: pr.url, prNumber: pr.number, detail };
+    }
+    // The marker and claim live until the merge call itself settles — a step timeout does not stop a merge already
+    // sent — and anything that throws before the merge call is made releases them.
+    let merging: ReturnType<NonNullable<typeof s.mergePr>>;
+    try {
+      onNodeEntry('merge', round);
+      progress('merging', '자동 병합 (리뷰 clean·squash)…');
+      merging = s.mergePr!({ number: pr.number, cwd: wt.path, matchHeadCommit: checkedHeadCommit! });
+    } catch (error) { landing.end(); throw error; }
+    // The default merge seam resolves only after `gh pr view` reads MERGED, so settling is the confirmation.
+    const release = (merged: boolean) => {
+      try { landing.end(merged); } catch (error) { observe('landing-release-failed', { number: pr.number, error: safeErrorDescription(error) }, { level: 'error' }); }
+    };
+    void merging.then((outcome) => release(outcome.merged === true), () => release(false));
+    const m = await withStepTimeout(merging, T.pr, 'pr');
     observe('merged', { number: pr.number, merged: m.merged, detail: m.detail ?? null });
     if (m.merged) {
+      try {
+        await s.supersedeDraftsOnMerge?.(pr.number, wt.path);
+      } catch (error) {
+        observe('draft-supersede-on-merge-failed', { number: pr.number, error: safeErrorDescription(error) }, { level: 'warn' });
+      }
       const directory = releaseNotesDir(elanousStateRoot());
       const fragment: ReleaseNoteFragment = {
         pr: pr.number,

package/src/self-implement/revert-guard.ts

@@ -0,0 +1,62 @@
+import { execFileSync } from 'node:child_process';
+import { lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { debug } from '../debug/log.js';
+
+export type RevertGuardResult = { reverted: string[]; protected: string[]; warning?: string };
+
+/** Compare the worktree's exact bytes with blobs from recent HEAD ancestry, before add -A. */
+export function dropStaleReverts(cwd: string, targets: readonly string[], runId: string, depth = 50): RevertGuardResult {
+  const result: RevertGuardResult = { reverted: [], protected: [] };
+  const git = (...args: string[]): Buffer => execFileSync('git', args, { cwd, timeout: 20_000, maxBuffer: 16 * 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe'] });
+  const reason = (error: unknown): string => (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ').slice(0, 240);
+  try {
+    const limit = Number.isSafeInteger(depth) && depth > 0 ? depth : 50;
+    const commits = git('rev-list', `--max-count=${limit + 1}`, 'HEAD').toString('utf8').trim().split('\n');
+    const changed = git('diff', '--name-only', '--diff-filter=M', '-z', 'HEAD', '--').toString('utf8').split('\0').filter(Boolean);
+    const staged = git('diff', '--cached', '--name-only', '--diff-filter=M', '-z', 'HEAD', '--').toString('utf8').split('\0').filter(Boolean);
+    for (const file of new Set([...changed, ...staged])) {
+      try {
+        if (!lstatSync(join(cwd, file)).isFile()) continue;
+        const current = readFileSync(join(cwd, file));
+        const rawOid = execFileSync('git', ['hash-object', '--stdin'], { cwd, input: current, timeout: 20_000 }).toString('utf8').trim();
+        const headEntry = git('ls-tree', 'HEAD', '--', file).toString('utf8').trim();
+        const head = /^\d+ blob ([0-9a-f]+)\t/.exec(headEntry)?.[1];
+        if (!head) continue;
+        const sameBytes = (oid: string): boolean => oid === rawOid || git('cat-file', 'blob', oid).equals(current);
+        if (sameBytes(head)) continue;
+        let matchedCommit: string | undefined;
+        const inspectedOids = new Set<string>();
+        for (const commit of commits.slice(1)) {
+          // A path may not have existed in an ancestor; that is not a failed inspection.
+          const blob = git('ls-tree', commit, '--', file).toString('utf8').trim();
+          const oid = /^\d+ blob ([0-9a-f]+)\t/.exec(blob)?.[1];
+          if (oid && !inspectedOids.has(oid)) {
+            if (sameBytes(oid)) { matchedCommit = commit; break; }
+            inspectedOids.add(oid);
+          }
+        }
+        if (!matchedCommit) continue;
+        const scoped = targets.some((target) => {
+          const path = target.replace(/^\.\//, '').replace(/\/+$/, '');
+          return path !== '' && (file === path || file.startsWith(`${path}/`));
+        });
+        if (scoped) {
+          result.protected.push(file);
+          debug.log('self-implement.revert-guard', 'protected-target', { runId, files: [file], matchedCommit }, { level: 'warn' });
+        } else {
+          git('checkout', 'HEAD', '--', file);
+          result.reverted.push(file);
+          debug.log('self-implement.revert-guard', 'reverted-stale', { runId, files: [file], matchedCommit });
+        }
+      } catch (error) {
+        result.warning = `git inspection/checkout failed for ${file}: ${reason(error)}`;
+        debug.log('self-implement.revert-guard', 'fail-open', { runId, reason: result.warning }, { level: 'warn' });
+      }
+    }
+  } catch (error) {
+    result.warning = `git inspection failed: ${reason(error)}`;
+    debug.log('self-implement.revert-guard', 'fail-open', { runId, reason: result.warning }, { level: 'warn' });
+  }
+  return result;
+}

package/src/self-implement/run-ledger.ts

@@ -276,7 +276,7 @@ interface RunLedgerLookupTarget {
   targetName: string | null;
 }
 
-function resolveFederatedRunLedgerTargets(options: Pick<FederatedRunLedgerLookupOptions, 'includeTest' | 'targets'>): RunLedgerLookupTarget[] {
+export function resolveFederatedRunLedgerTargets(options: Pick<FederatedRunLedgerLookupOptions, 'includeTest' | 'targets'>): RunLedgerLookupTarget[] {
   const resolved = options.targets ? { targets: [...options.targets] } : resolveLogTargets({ all: true, includeTest: options.includeTest });
   if (resolved.error) throw new Error(resolved.error);
   const targets = new Map<string, string>();

package/src/self-implement/seams.ts

@@ -37,7 +37,8 @@ import { iosFilesIn, runIosUnitTestGate } from '../../scripts/ci-ios-unit-tests.
 import { detectGateCommand } from './detect-gate.js';
 import { writeScopedTypecheckConfig } from './scoped-typecheck-config.js';
 // ⭐ 게이트 스코프 근본 수리(2026-07-26) — 풀 `bun test` 폴백 제거 + 연관 테스트 유도(순수).
-import { resolveGateScope } from './gate-scope.js';
+import { formatNoRelatedTestsWarning, resolveGateScope } from './gate-scope.js';
+import { publicExposureFiles, runExposeGate } from './expose-gate.js';
 import { buildImporterTestIndex, isTestPath } from './importer-test-index.js';
 import { buildRouteConsumerTestIndex } from './route-consumer-test-index.js';
 import { countTestDeclarations } from './test-declarations.js';
@@ -976,6 +977,7 @@ export interface DefaultSeamsOptions {
   runIosUnitTestGate?: (io: { args: readonly string[]; cwd: string }) => number;
   /** Source-policy gate adapter for focused seam tests. */
   runHarnessPolicyGates?: typeof runHarnessPolicyGates;
+  runExposeGate?: typeof runExposeGate;
   /** Dependency-wide validation adapter for focused seam tests. */
   runDependencyChangeGate?: typeof runDependencyChangeGate;
   /** 워크트리 시험 묶음(없으면 실패 파일)을 base에서 재실행하는 seam. 실패 경로에서만 호출된다. */
@@ -1409,6 +1411,10 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       },
       removeMatchingGoalCopy,
     },
+    supersedeDraftsOnMerge: async (number, cwd) => {
+      const { supersedeMergedGoalDrafts } = await import('../harness/harness-cli-command.js');
+      await supersedeMergedGoalDrafts(number, cwd);
+    },
     lineageSupersede: {
       listOpenDrafts: () => listOpenDraftsForLineage(),
       readRunLedger: (runId) => {
@@ -1810,8 +1816,13 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       const observationChanges = gateChangedFiles(cwd, comparisonBase);
       const observationChangedFiles = observationChanges.files;
       const postsync = ctx?.mode === 'postsync';
-      // 정합 전 일반 게이트는 worktree-only. 정합 후 재게이트만 이미 계산된 merge-base 목록을 실행 범위로 쓴다.
-      const changedAll = postsync ? observationChangedFiles : gitChangedFiles(cwd);
+      // 일반 게이트는 기존 worktree 범위를 유지하되 fork 이후 커밋된 시험을 더한다.
+      // HEAD 대비 미커밋 목록만 쓰면 릴리스 노트만 남은 재작업 라운드에서
+      // 커밋된 시험을 놓쳐 docs-only 로 건너뛴다. postsync는 종전처럼 전 변경을 잰다.
+      const changedAll = postsync ? observationChangedFiles : [...new Set([
+        ...gitChangedFiles(cwd),
+        ...observationChangedFiles.filter((file) => isTestPath(file)),
+      ])];
       // ⚠️ **regular-file 판정**(리뷰 should-fix 5R) — `existsSync` 는 **디렉터리도 true** 다.
       //   계약은 "실존 테스트 **파일**"이므로 파일 여부까지 확인한다(디렉터리를 testArgs 로 넘기면
       //   필터 무매치 → "0 files ran" 부당 실패).
@@ -1824,11 +1835,19 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         trackedFiles.filter(isTestPath),
         [...new Set([...trackedFiles, ...changedAll, ...observationChangedFiles])].filter((file) => /\.(?:[cm]?[jt]sx?)$/.test(file)),
       );
-      const routeConsumerTestIndex = buildRouteConsumerTestIndex(cwd, trackedFiles.filter(isTestPath), changedAll, comparisonBase ?? 'HEAD');
+      // 런 전체 재탐색 시 앞 라운드의 변경·삭제 서버 경로도 비교-base 소비자 색인에 있어야 한다.
+      const routeConsumerTestIndex = buildRouteConsumerTestIndex(cwd, trackedFiles.filter(isTestPath),
+        [...new Set([...changedAll, ...observationChangedFiles])], comparisonBase ?? 'HEAD');
       // 워크트리에 없는 변경 경로 = 지운 파일 — 미검증으로 세지 않는다(gate-scope `isDeleted` · 2026-09-26 run-7dd4cce6).
       const isDeleted = (path: string): boolean => !isFile(path);
-      const scopeOpts = { isDeleted, routeConsumerTestIndex: routeConsumerTestIndex ?? undefined };
+      const scopeOpts = { isDeleted, routeConsumerTestIndex: routeConsumerTestIndex ?? undefined,
+        runChanged: observationChangedFiles, round: ctx?.round };
       const scope = resolveGateScope(changedAll, isFile, importerTestIndex ?? undefined, postsync ? { ...scopeOpts, mode: 'postsync' } : scopeOpts);
+      // The landing scope is the PR diff, not only this round's uncommitted test files.
+      const expose = publicExposureFiles(observationChangedFiles).length > 0
+        ? (o.runExposeGate ?? runExposeGate)(cwd, observationChangedFiles,
+          getUserConfig().harness?.exposeGate === 'strict' ? 'strict' : 'warn')
+        : { passed: true, log: '' };
       const comparisonFailureReason = observationChanges.comparisonBaseStatus === 'unavailable'
         ? 'comparison-base-unavailable'
         : observationChanges.comparisonBaseStatus === 'comparison-failed'
@@ -1865,6 +1884,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       debug.log('self-implement', 'gate.scope', {
         ...(ctx?.runId ? { runId: ctx.runId } : {}),
         targeted: gateOpts.testArgs?.length ?? 0, files: (gateOpts.testArgs ?? []).slice(0, 8),
+        'evaluated-changes': changedAll.slice(0, 8), evaluatedChangeCount: changedAll.length,
         changedTests: observedChangedTestFiles.slice(0, 8), changedTestCount: observedChangedTestFiles.length,
         srcChanged: scope.sourceFiles.length, testStepSkipped,
         scopeReason, derived: scope.derived.length, ignoredOutsideSrc: scope.ignoredOutsideSrc,
@@ -2053,7 +2073,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       //   `tc`(변경파일 tsc) **전에** 실행해서, tsc 가 깨져 **최종 게이트가 실패한 런에도**
       //   base 를 다시 돌리고 `gate.log` 를 바꿨다 ⇒ *"게이트 실패 경로 무변경"* 경계 위반.
       //   ⇒ 조건을 최종 판정과 같은 식으로 묶는다.
-      const gatePassed = !comparisonFailureReason && !unmeasuredPostsync && integrityPassed && tc.passed && policy.passed && (dependencyGate?.passed ?? true);
+      const gatePassed = !comparisonFailureReason && !unmeasuredPostsync && integrityPassed && tc.passed && policy.passed && expose.passed && (dependencyGate?.passed ?? true);
       const verifyIdentity = gateVerifyIdentity(ctx?.runId);
       if (gatePassed && scope.skipTestStep) {
         verifyByBreaking = { ran: false, distinguishes: 0, 'does-not-distinguish': 0, unknown: 0, skippedReason: scope.reason };
@@ -2204,7 +2224,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           + (scope.reason === 'no-related-tests'
             // ⭐ **미검증 파일 목록**(2026-07-27 사후 리뷰 수리) — 종전엔 `sourceFiles` 를 실어
             //   `package.json`·설정·스크립트 변경 시 **빈 목록**이 나갔다(그 파일들은 소스 확장자가 아니다).
-            ? `동작 검증을 못 한 변경: ${scope.unverified.slice(0, 8).join(', ')}`
+            ? `\n\n${formatNoRelatedTestsWarning(scope.unverified)}\n\n동작 검증을 못 한 변경: ${scope.unverified.slice(0, 8).join(', ')}`
               + `\n⚠️ 이 라운드는 **동작 검증이 되지 않았다**(변경파일 tsc 만 통과) — "게이트 통과=검증됨"으로 결론내지 말 것.`
               // ⚠️ 안내를 일반화(리뷰 should-fix) — `package.json`·lockfile·설정·스크립트에는
               //   "해당 소스의 테스트"라는 표현이 부정확하다(그 변경엔 대응 테스트 관례가 없다).
@@ -2229,7 +2249,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         : '';
       return {
         passed: gatePassed,
-        log: `${baseLog}${policyFailureLog}${dependencyFailureLog}${dependencyUnmeasuredNote}${comparisonFailureLog}${baselineNote}${verifyByBreakingNote}${scopeNote}${uncoveredNote}${pulledInRelatedTestsNote}${callerOverflowNote}${routeLookupNote}`,
+        log: `${baseLog}${policyFailureLog}${dependencyFailureLog}${dependencyUnmeasuredNote}${comparisonFailureLog}${baselineNote}${verifyByBreakingNote}${scopeNote}${uncoveredNote}${pulledInRelatedTestsNote}${callerOverflowNote}${routeLookupNote}${expose.log ? `\n\n${expose.log}` : ''}`,
         testStepExecuted: !testStepSkipped && testStep !== undefined && !testStep.skipped,
         scopeReason,
         comparisonBaseStatus: observationChanges.comparisonBaseStatus,

package/src/session/index.ts

@@ -213,6 +213,8 @@ export interface SessionMeta {
   tgBotId?: string;
   /** Stable identity for a persona's resident conversation. */
   personaId?: string;
+  /** Optional persona selected for this conversation's replies (not resident identity). */
+  chatPersonaId?: string;
   /** Telegram session-key used for lookup by chat, e.g.
    *  `telegram:8799226199:dm:123:0` (bot-scoped) or legacy
    *  `telegram:dm:123:0`. Constructed once at create time. */

package/src/task-cards/card-cli.ts

@@ -1,7 +1,7 @@
 import type { Command } from 'commander';
 import { join, resolve } from 'node:path';
 import { scanWishFolder } from '../intake-plane/wish-folder.js';
-import { LINEAR_WISH_KEY_MISSING, scanLinearWishes } from '../intake-plane/linear-wish.js';
+import { LINEAR_WISH_KEY_MISSING, scanLinearWishes, suggestLinearWishes } from '../intake-plane/linear-wish.js';
 import type { fetchLinearIssues } from '../connectors/linear.js';
 import { CardStore, type TaskCard } from './card-store.js';
 
@@ -145,10 +145,18 @@ export function registerCardCommand(program: Command, deps: CardCliDeps = {}): C
     .description('Create wish cards from open Linear issues')
     .requiredOption('--team <key>', 'Linear team key')
     .option('--label <name>', 'Wish label or title prefix', 'wish')
+    .option('--suggest', 'Suggest wish labels without writing to Linear or creating cards')
     .option('--json', 'Output JSON')
-    .action(async (options: { team: string; label: string; json?: boolean }) => {
+    .action(async (options: { team: string; label: string; suggest?: boolean; json?: boolean }) => {
       let store: CardStore | undefined;
       try {
+        if (options.suggest) {
+          const suggestions = await suggestLinearWishes({ teamKey: options.team,
+            deps: { getApiKey: deps.getApiKey, fetchIssues: deps.fetchIssues } });
+          write(options.json ? `${JSON.stringify(suggestions)}\n` :
+            suggestions.map(item => `${item.identifier}\t${item.title}\t${item.reason}\n`).join(''));
+          return;
+        }
         store = createStore();
         const result = await scanLinearWishes({ teamKey: options.team, label: options.label, store,
           deps: { getApiKey: deps.getApiKey, fetchIssues: deps.fetchIssues } });

package/src/task-cards/card-store.ts

@@ -42,7 +42,7 @@ export const SECTION_OWNERS: Readonly<Record<string, string | null>> = {
   gates: 'execution-loop', relations: 'execution-loop', memory: 'execution-loop',
   workspace: 'executor', run: 'executor',
   landing: 'landing-loop', release: 'release-loop', 'test-diet': 'test-diet',
-  incidents: null,
+  incidents: null, orch: 'orchestrator', flow: 'flow',
 };
 
 export function sectionOf(key: string): string {
@@ -80,10 +80,11 @@ export class CardStore {
   private readonly db: Database;
   readonly root: string;
 
-  constructor(root: string = elanousStateRoot()) {
+  constructor(root: string = elanousStateRoot(), private readonly readOnly = false) {
     this.root = root;
-    mkdirSync(taskCardsDir(root), { recursive: true });
-    this.db = new Database(cardIndexPath(root));
+    if (!readOnly) mkdirSync(taskCardsDir(root), { recursive: true });
+    this.db = readOnly ? new Database(cardIndexPath(root), { readonly: true }) : new Database(cardIndexPath(root));
+    if (readOnly) return;
     try {
       this.db.exec('PRAGMA busy_timeout = 5000');
       this.db.exec('PRAGMA journal_mode = WAL');
@@ -127,6 +128,7 @@ export class CardStore {
   }
 
   private reconcile(): void {
+    if (this.readOnly) return;
     for (const file of readdirSync(taskCardsDir(this.root))) {
       if (!/^[a-zA-Z0-9_-]+\.jsonl$/.test(file)) continue;
       const id = file.slice(0, -'.jsonl'.length);
@@ -220,6 +222,7 @@ export class CardStore {
   }
 
   getCard(id: string): TaskCard | null {
+    if (this.readOnly) return this.readCard(id);
     return this.db.transaction(() => {
       this.reconcile();
       return this.readCard(id);
@@ -227,12 +230,13 @@ export class CardStore {
   }
 
   listCards(options: { open?: boolean } = {}): TaskCard[] {
-    return this.db.transaction(() => {
+    const list = () => {
       this.reconcile();
       const rows = this.db.query(`SELECT id FROM cards ${options.open ? "WHERE status = 'open'" : ''} ORDER BY created_at DESC, id DESC`)
         .all() as Array<{ id: string }>;
       return rows.map(({ id }) => this.readCard(id)!);
-    }).immediate();
+    };
+    return this.readOnly ? list() : this.db.transaction(list).immediate();
   }
 
   close(): void {

package/src/task-orchestrator/surfaces/pod-lease.ts

@@ -12,12 +12,15 @@ export const POD_HOST_LEASE_ANNOTATION = 'elanous.dev/host-lease-admitted';
 
 // `get pods --all-namespaces -o json` on a busy cluster is several MB — the default spawnSync
 // buffer fails with ENOBUFS (10-03 node-b measured). Same proxy stripping as the Pod launch kubectl.
-const LEASE_KUBECTL_MAX_BUFFER = 256 * 1024 * 1024;
+export const LEASE_KUBECTL_MAX_BUFFER = 256 * 1024 * 1024;
 export function leaseKubectl(args: readonly string[], input?: string): { status: number | null; stdout: string; stderr: string } {
   const env = { ...process.env };
   for (const k of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[k];
   const r = spawnSync('kubectl', [...args], { encoding: 'utf8', input, env, timeout: 120_000, maxBuffer: LEASE_KUBECTL_MAX_BUFFER });
-  return { status: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + (r.error ? String(r.error) : '') };
+  const error = (r.error as NodeJS.ErrnoException | undefined)?.code === 'ENOBUFS'
+    ? `kubectl 출력 너무 큼 (ENOBUFS; maxBuffer=${LEASE_KUBECTL_MAX_BUFFER} bytes)`
+    : r.error ? String(r.error) : '';
+  return { status: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + error };
 }
 
 export interface PodLeaseMember {