elanous 0.2.13 → 0.2.15

package/src/self-dev/run-supervisor.ts

@@ -5,10 +5,19 @@ import type { DeployVerifyFinding } from '../harness/browser-verify.js';
 import type { SelfDevJobResult } from './orchestrate.js';
 import { recordSelfDevRunSupervisorStop, selfDevRunsDir } from './run-store.js';
 import { debug } from '../debug/log.js';
+import { sweepFrozenMerges } from '../self-implement/frozen-merges.js';
 
 export interface SupervisorRound {
   round: number;
   landed: number;
+  /**
+   * Pieces that finished (`ok=true`) with at least one new commit against
+   * this run's own `--base` — not a main merge. Omitted on rounds that
+   * never measured it, so older history stays comparable.
+   */
+  baseCompleted?: number;
+  /** The run's own `--base` those completions were counted against. */
+  base?: string;
   actionable: number;
   reviewMustFixTrend?: SupervisorDecision['reviewMustFixTrend'];
 }
@@ -21,6 +30,7 @@ export type SupervisorStopReason =
   | 'parent-signals-red'
   | 'needs-human'
   | 'no-actionable-work'
+  | 'harvestable-awaiting-human'
   | 'handed-off-to-salvage'
   | 'max-rounds'
   | 'no-progress'
@@ -38,6 +48,7 @@ export const SUPERVISOR_STOP_REASONS = [
   'parent-signals-red',
   'needs-human',
   'no-actionable-work',
+  'harvestable-awaiting-human',
   'handed-off-to-salvage',
   'max-rounds',
   'no-progress',
@@ -104,9 +115,25 @@ export function countLanded(results: readonly SelfDevJobResult[]): number {
   return results.filter(hasDelivered).length;
 }
 
+/** One base label for the round. Mixed or missing bases stay unnamed. */
+export function roundBase(results: readonly SelfDevJobResult[]): string | undefined {
+  const bases = [...new Set(results.flatMap((result) => result.base === undefined ? [] : [result.base]))];
+  return bases.length === 1 ? bases[0] : undefined;
+}
+
+/**
+ * Finished pieces (`ok=true`) that added at least one commit against this
+ * run's own `--base`. A main merge is not required, and a commit without
+ * `ok=true` is not completion.
+ */
+export function countBaseCompleted(results: readonly SelfDevJobResult[]): number {
+  return results.filter((result) => result.ok === true && (result.commitsAheadOfBase ?? 0) >= 1).length;
+}
+
 export function madeProgress(prev: SupervisorRound | undefined, next: SupervisorRound): boolean {
   if (!prev) return true;
   if (next.landed > 0) return true;
+  if ((next.baseCompleted ?? 0) > (prev.baseCompleted ?? 0)) return true;
   if (next.actionable < prev.actionable) return true;
   return next.reviewMustFixTrend === 'improving';
 }
@@ -190,8 +217,16 @@ export function decideNextRun(input: {
   const t = triageRun(activeResults, deployFindings, observation === 'failed');
   const round = history.length;
   const landed = countLanded(results);
+  const baseCompleted = countBaseCompleted(results);
+  const completionBase = roundBase(results);
   const actionable = countActionable(t);
-  const thisRound: SupervisorRound = { round, landed, actionable, reviewMustFixTrend };
+  const thisRound: SupervisorRound = {
+    round,
+    landed,
+    ...(baseCompleted > 0 || completionBase !== undefined ? { baseCompleted, ...(completionBase === undefined ? {} : { base: completionBase }) } : {}),
+    actionable,
+    reviewMustFixTrend,
+  };
   const goalPlanRevisionObservation = formatGoalPlanRevisionObservation(results);
   const withGoalPlanRevisionObservation = (why: string): string => goalPlanRevisionObservation
     && goalPlanRevisionObservation !== GOAL_PLAN_REVISION_OBSERVATION_UNAVAILABLE
@@ -225,6 +260,16 @@ export function decideNextRun(input: {
     };
   }
 
+  const harvestable = results.filter((result) => result.harvestable === true && !!result.branch);
+  if (harvestable.length > 0) {
+    return {
+      ...base,
+      action: 'stop',
+      stopReason: 'harvestable-awaiting-human',
+      why: withGoalPlanRevisionObservation(`구현 완료 · 수확 대기 — ${harvestable.map((result) => result.branch).join(' · ')}`),
+    };
+  }
+
   if (deliverableMergeCompleteness === 'complete') {
     return {
       ...base,
@@ -363,7 +408,7 @@ export function decideNextRun(input: {
         ...base,
         action: 'stop',
         stopReason: 'no-progress',
-        why: withNoProgressGoalPlanRevisionObservation(`${stallRounds}라운드 연속 제자리 — 착지도 안 늘고 남은 조각도 안 줄었다(${actionable}). 골·불변식을 의심할 자리`),
+        why: withNoProgressGoalPlanRevisionObservation(`${stallRounds}라운드 연속 제자리 — base=${completionBase ?? 'main'} 기준 완료 ${baseCompleted} · 착지 ${landed} · 남은 조각도 안 줄었다(${actionable}). 골·불변식을 의심할 자리`),
       };
     }
   }
@@ -389,9 +434,12 @@ export function appendRound(
   reviewMustFixTrend?: SupervisorDecision['reviewMustFixTrend'],
 ): SupervisorRound[] {
   const t = triageRun(results.filter((result) => result.salvage !== 'launched'));
+  const baseCompleted = countBaseCompleted(results);
+  const base = roundBase(results);
   return [...history, {
     round: history.length,
     landed: countLanded(results),
+    ...(baseCompleted > 0 || base !== undefined ? { baseCompleted, ...(base === undefined ? {} : { base }) } : {}),
     actionable: countActionable(t),
     ...(reviewMustFixTrend === undefined ? {} : { reviewMustFixTrend }),
   }];
@@ -410,6 +458,7 @@ export interface SuperviseRunOptions {
   onRound?: (results: readonly SupervisorJobResult[]) => void;
   runStore?: { runId?: string; operatorDir?: string; dir?: string; isolatedDir?: string };
   observe?: (event: string, data: Record<string, unknown>) => void;
+  sweepPendingMerges?: typeof sweepFrozenMerges;
   observeDeliverables?: () => Promise<{
     readonly deployFindings: ReadonlyMap<string, { target: string; findings?: readonly DeployVerifyFinding[] | readonly unknown[] }>;
     readonly unmeasured: readonly unknown[];
@@ -432,6 +481,12 @@ export async function superviseRun(opts: SuperviseRunOptions): Promise<Superviso
   let history: SupervisorRound[] = [];
 
   for (;;) {
+    try {
+      const resumed = await (opts.sweepPendingMerges ?? sweepFrozenMerges)();
+      if (resumed.pending || resumed.merged) opts.observe?.('frozen-merges', resumed);
+    } catch (error) {
+      try { debug.log('harness.merge', 'resume-failed', { error: String(error) }); } catch { /* observation must not interrupt supervision */ }
+    }
     if (opts.enrich) results = [...opts.enrich(results)];
 
     let observed: {

package/src/self-dev/self-orchestrate-runtime.ts

@@ -13,7 +13,7 @@ import { posix as posixPath } from 'node:path';
 import type { LLMToolSpec } from '../llm.js';
 import type { ToolRuntime, ToolRuntimeContext } from '../tool-runtime/types.js';
 import { orchestrateSelfDev, type SelfDevJobResult, type OrchestrateSelfDevOptions, type SelfDevGoal } from './orchestrate.js';
-import type { SelfDevRunParticipant, SelfDevRunState } from './run-store.js';
+import { processBirthId, type SelfDevRunParticipant, type SelfDevRunState } from './run-store.js';
 import { HARNESS_RUN_ID_ENV, resolveRunIdentity as defaultResolveRunIdentity } from '../harness/harness-space.js';
 import { decomposeSelfDevGoal, type SelfDevDecomposition, type SelfDevDecomposeOptions } from './decompose.js';
 import { decomposeFabricRequest, type FabricDecomposeRequestOptions, type FabricDecomposeRequestResult } from './fabric-decompose-adapter.js';
@@ -302,6 +302,7 @@ interface OrchestrateRunLedgerInput {
   readonly prior: Pick<SelfDevRunState, 'dependencies' | 'results'> | null;
   readonly goals: readonly SelfDevGoal[];
   readonly pid: number;
+  readonly seat?: SelfDevRunState['seat'];
   readonly runIdSource: SelfDevRunParticipant['runIdSource'];
   readonly now: () => number;
   readonly onPersistenceFailure?: (stage: 'checkpoint' | 'participant', error: unknown) => void;
@@ -421,6 +422,7 @@ export function bindOrchestrateRunLedger(
   input: OrchestrateRunLedgerInput,
 ): OrchestrateRunLedgerBinding {
   const dependencies = deps.checkpointDependencies(input.prior, input.goals);
+  const pidStart = processBirthId(input.pid);
   const checkpoint = (results: SelfDevRunState['results']): void => {
     try {
       deps.saveRun({
@@ -431,6 +433,8 @@ export function bindOrchestrateRunLedger(
         dependencies,
         goals: [...input.goals],
         pid: input.pid,
+        ...(pidStart ? { pidStart } : {}),
+        ...(input.seat ? { seat: input.seat } : {}),
       });
     } catch (error) {
       if (input.onPersistenceFailure) input.onPersistenceFailure('checkpoint', error);

package/src/self-implement/budget-gate.ts

@@ -3,8 +3,10 @@
 
 import type { RotationCandidate } from '../oauth/codex-account-rotation.js';
 import { inspectCodexRotation } from '../oauth/codex-account-store.js';
+import { codexPolicyAllowsCredits } from '../oauth/codex-quota-policy.js';
 import { getUsageStore } from '../budget/usage-store.js';
 import type { UsageSnapshot } from '../budget/types.js';
+import { debug } from '../debug/log.js';
 import {
   DEFAULT_BUDGET_GATE_MAX_USED_PERCENT,
   type BudgetGateMaxUsedPercent,
@@ -25,6 +27,9 @@ export interface BudgetCodexCandidate {
   readonly name: string;
   readonly reached?: boolean;
   readonly usedPercent?: number;
+  /** 선불 크레딧 잔액(계정에 귀속된 신호만). 모르면 비운다. */
+  readonly creditBalance?: number;
+  readonly hasCredits?: boolean;
 }
 
 export interface DecideBudgetInput {
@@ -36,6 +41,8 @@ export interface DecideBudgetInput {
   /** 주간 사용률. `undefined` 는 «모름» — 쓸 수 있다고 보지 않는다. */
   readonly grokUsedPercent: number | undefined;
   readonly maxUsedPercent: BudgetGateMaxUsedPercent;
+  /** codex 한도 정책이 credits 인가(`codexPolicyAllowsCredits` · 회전·Pod 배분과 같은 해석). 없으면 false. */
+  readonly codexCreditsAllowed?: boolean;
 }
 
 export interface BudgetDecision {
@@ -50,6 +57,7 @@ export interface BudgetInputs {
   readonly codexCandidates: readonly BudgetCodexCandidate[];
   readonly grokUsedPercent: number | undefined;
   readonly maxUsedPercent: BudgetGateMaxUsedPercent;
+  readonly codexCreditsAllowed?: boolean;
 }
 
 const WEEKLY_WINDOW_MINUTES = 7 * 24 * 60;
@@ -98,6 +106,16 @@ function codexCandidateUsable(candidate: BudgetCodexCandidate, cap: number | und
   return candidate.usedPercent < cap;
 }
 
+/** BUDGET-GATE(10-05) — 정책이 credits 면 구독 % 가 차도 크레딧 잔액이 «확인된» 계정으로 계속 간다(Pod 배분과 같은 결론).
+ *  잔액을 모르면 쓰지 않는다 — 크레딧은 돈이라 fail-closed. 잔액이 가장 큰 계정 하나를 돌려준다. */
+function codexCreditCandidate(input: DecideBudgetInput): BudgetCodexCandidate | undefined {
+  if (input.codexCreditsAllowed !== true) return undefined;
+  return input.codexCandidates
+    .filter((candidate) => candidate.hasCredits !== false
+      && typeof candidate.creditBalance === 'number' && Number.isFinite(candidate.creditBalance) && candidate.creditBalance > 0)
+    .sort((a, b) => (b.creditBalance! - a.creditBalance!) || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))[0];
+}
+
 function slotUsable(
   provider: string,
   input: DecideBudgetInput,
@@ -106,6 +124,13 @@ function slotUsable(
   if (provider === CODEX_PROVIDER) {
     const cap = capFor(input.maxUsedPercent, CODEX_PROVIDER);
     const measuredUsable = input.codexCandidates.some((candidate) => codexCandidateUsable(candidate, cap));
+    const credit = measuredUsable ? undefined : codexCreditCandidate(input);
+    if (credit) {
+      try {
+        debug.log('budget.gate', 'credits-allowed', { used: credit.usedPercent ?? null, balance: credit.creditBalance, policy: 'credits' });
+      } catch { /* observation is fail-soft */ }
+      return { usable: true, reason: `${formatCodexReason(input.codexCandidates, cap)} · credits allowed (balance ${credit.creditBalance})` };
+    }
     const unmeasured = allowUnmeasured && !measuredUsable && (input.codexCandidates.length === 0
       || input.codexCandidates.some((candidate) => candidate.reached !== true
         && (typeof candidate.usedPercent !== 'number' || !Number.isFinite(candidate.usedPercent))));
@@ -188,6 +213,8 @@ export function codexCandidatesFromRotation(
     name: candidate.name,
     ...(candidate.reached !== undefined ? { reached: candidate.reached } : {}),
     ...(candidate.usedPercent !== undefined ? { usedPercent: candidate.usedPercent } : {}),
+    ...(candidate.creditBalance !== undefined ? { creditBalance: candidate.creditBalance } : {}),
+    ...(candidate.hasCredits !== undefined ? { hasCredits: candidate.hasCredits } : {}),
   }));
 }
 
@@ -212,6 +239,8 @@ export function readBudgetInputs(deps: ReadBudgetInputsDeps = {}): BudgetInputs
     codexCandidates: codexCandidatesFromRotation(rotation.candidates),
     grokUsedPercent: grokWeeklyUsedPercent(snapshot),
     maxUsedPercent,
+    // 회전·Pod 배분과 같은 해석(`resolveCodexQuotaPolicy` → `codexPolicyAllowsCredits`)을 읽는다 — 다시 짓지 않는다.
+    ...(rotation.policy && codexPolicyAllowsCredits(rotation.policy.policy) ? { codexCreditsAllowed: true } : {}),
   };
 }
 

package/src/self-implement/expose-gate.ts

@@ -0,0 +1,47 @@
+import { spawnSync } from 'node:child_process';
+import { debug } from '../debug/log.js';
+
+type ExposeMode = 'warn' | 'strict';
+type ProcessResult = { status: number | null; stdout?: string; stderr?: string; error?: Error };
+type ExposeResult = { passed: boolean; log: string };
+
+/** The rubric only accepts root-level public Markdown documents. */
+export function publicExposureFiles(changed: readonly string[]): string[] {
+  return [...new Set(changed.filter((file) => /^release\/public\/docs\/[^/]+\.md$/.test(file)))];
+}
+
+export function runExposeGate(
+  cwd: string,
+  changed: readonly string[],
+  mode: ExposeMode,
+  run: (command: string, args: string[], cwd: string) => ProcessResult = (command, args, dir) => {
+    const result = spawnSync(command, args, { cwd: dir, encoding: 'utf8', timeout: 300_000 });
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '', error: result.error };
+  },
+): ExposeResult {
+  const files = publicExposureFiles(changed);
+  if (files.length === 0) return { passed: true, log: '' };
+  let unreviewed: number | null = null;
+  let failed: number | null = null;
+  let docs: number | null = null;
+  let error = '';
+  try {
+    const result = run('bun', ['scripts/expose-rubric-check.ts', '--json', '--files', ...files], cwd);
+    if (result.status !== 0 || result.error) throw new Error(result.stderr?.trim() || result.error?.message || `exit ${result.status}`);
+    const parsed = JSON.parse(result.stdout ?? '') as Record<string, unknown>;
+    const lists = ['missing', 'orphan', 'failing', 'internal', 'unreviewed', 'unjudged'] as const;
+    if (!Number.isSafeInteger(parsed.docs) || (parsed.docs as number) < 0 || !lists.every((key) => Array.isArray(parsed[key]))) {
+      throw new Error('invalid exposure rubric JSON');
+    }
+    docs = parsed.docs as number;
+    unreviewed = new Set([...(parsed.missing as string[]), ...(parsed.unjudged as string[])]).size;
+    failed = new Set([...(parsed.orphan as string[]), ...(parsed.failing as Array<{ path: string }>).map((item) => item.path), ...(parsed.internal as string[])]).size;
+  } catch (cause) {
+    error = cause instanceof Error ? cause.message : String(cause);
+  }
+  try { debug.log('self-implement.gate', 'expose', { files, unreviewed, failed, mode }); } catch { /* observation must not change judgment */ }
+  const log = docs === null
+    ? `[expose] 못 쟀다 — ${error}`
+    : `[expose] ${files.length}개 · 미판정 ${unreviewed} · fail ${failed}`;
+  return { passed: mode === 'warn' || (docs !== null && unreviewed === 0 && failed === 0), log };
+}

package/src/self-implement/frozen-merges.ts

@@ -0,0 +1,295 @@
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dlopen, FFIType } from 'bun:ffi';
+import { createHash } from 'node:crypto';
+import { dirname, join, resolve } from 'node:path';
+import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { debug } from '../debug/log.js';
+import { beginLandingMerge, readLandingFreeze, type LandingFreeze } from '../release-loop/landing-freeze.js';
+
+/** `manual`: the owning repository could not be determined — a sweep never resumes it; a person does. */
+export interface FrozenMerge { prNumber: number; headCommit: string; repoRoot: string; manual?: true; /** Host goal document, so a resumed merge can still apply its «이 칸 완료» declaration (CL-AUTO). */ goalFile?: string }
+/** What a resume sweep hands its merge function: the held entry, marked as already claimed by this sweep. */
+export type ResumedMerge = FrozenMerge & { resumed: true };
+
+function queuePath(root: string): string { return join(root, 'landing-freeze-pending.json'); }
+
+/** flock(2) through bun:ffi — the kernel drops the lock when its holder exits, so there is no stale lock to reclaim
+ *  and no reclaim race. The lock file itself is never deleted (unlinking a flock file would split later lockers). */
+const LOCK_EX = 2, LOCK_NB = 4;
+let flockCall: ((fd: number, op: number) => number) | undefined;
+function flock(fd: number, op: number): number {
+  if (!flockCall) {
+    const names = process.platform === 'darwin' ? ['libc.dylib'] : ['libc.so.6', `libc.musl-${process.arch === 'arm64' ? 'aarch64' : 'x86_64'}.so.1`];
+    let lastError: unknown;
+    for (const name of names) {
+      try {
+        const lib = dlopen(name, { flock: { args: [FFIType.i32, FFIType.i32], returns: FFIType.i32 } });
+        flockCall = (descriptor, operation) => lib.symbols.flock(descriptor, operation) as number;
+        break;
+      } catch (error) { lastError = error; }
+    }
+    if (!flockCall) throw new Error(`flock unavailable (${names.join(', ')}): ${String(lastError)}`);
+  }
+  return flockCall(fd, op);
+}
+
+export function tryLandingLock(path: string): (() => void) | null {
+  mkdirSync(dirname(path), { recursive: true });
+  const fd = openSync(path, 'a', 0o600);
+  if (flock(fd, LOCK_EX | LOCK_NB) !== 0) { closeSync(fd); return null; }
+  let released = false;
+  return () => { if (!released) { released = true; closeSync(fd); } };
+}
+
+function tryLock(path: string): (() => void) | null { return tryLandingLock(path); }
+
+function lockedQueue<T>(root: string, action: () => T): T {
+  mkdirSync(root, { recursive: true });
+  const path = join(root, 'landing-freeze-pending.lock');
+  const deadline = Date.now() + 5_000;
+  let release = tryLock(path);
+  while (!release) {
+    if (Date.now() >= deadline) throw new Error(`frozen merge queue lock busy: ${path}`);
+    Bun.sleepSync(25);
+    release = tryLock(path);
+  }
+  try { return action(); }
+  finally { release(); }
+}
+
+function readQueue(root: string): FrozenMerge[] {
+  const path = queuePath(root);
+  if (!existsSync(path)) return [];
+  const data: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  if (!Array.isArray(data) || !data.every((item) => item && typeof item === 'object' &&
+    Number.isSafeInteger(item.prNumber) && item.prNumber > 0 &&
+    typeof item.headCommit === 'string' && /^[a-f0-9]{40}$/i.test(item.headCommit) &&
+    typeof item.repoRoot === 'string' && item.repoRoot.length > 0 &&
+    (item.manual === undefined || item.manual === true) &&
+    (item.goalFile === undefined || (typeof item.goalFile === 'string' && item.goalFile.length > 0)))) throw new Error(`invalid frozen merge queue: ${path}`);
+  return data as FrozenMerge[];
+}
+
+function writeQueue(root: string, entries: FrozenMerge[]): void {
+  mkdirSync(root, { recursive: true });
+  const path = queuePath(root);
+  const temp = `${path}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    writeFileSync(temp, `${JSON.stringify(entries, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temp, path);
+  } finally { rmSync(temp, { force: true }); }
+}
+
+/** Ordering of two heads of one PR in `repoRoot`: 'older' when `a` is a strict ancestor of `b`, 'newer' when `b` is one
+ *  of `a`, otherwise unknown (unrelated, or git cannot see both objects). */
+function headOrder(repoRoot: string, a: string, b: string): 'older' | 'newer' | 'unknown' {
+  const ancestor = (x: string, y: string) => {
+    try { return Bun.spawnSync(['git', '-C', repoRoot, 'merge-base', '--is-ancestor', x, y], { env: process.env }).exitCode === 0; }
+    catch { return false; }
+  };
+  if (a === b) return 'unknown';
+  if (ancestor(a, b)) return 'older';
+  if (ancestor(b, a)) return 'newer';
+  return 'unknown';
+}
+
+/** GitHub's current head of the PR, or null when it cannot be read. */
+function githubHead(entry: FrozenMerge): string | null {
+  try {
+    const gh = Bun.which('gh', { PATH: process.env.PATH ?? '' }) ?? 'gh';
+    const view = Bun.spawnSync([gh, 'pr', 'view', String(entry.prNumber), '--json', 'headRefOid'], { cwd: entry.repoRoot, env: process.env, timeout: 30_000 });
+    if (view.exitCode !== 0) return null;
+    const head = (JSON.parse(view.stdout.toString()) as { headRefOid?: string }).headRefOid;
+    return typeof head === 'string' && /^[0-9a-f]{40}$/i.test(head) ? head : null;
+  } catch { return null; }
+}
+
+export function queueFrozenMerge(entry: FrozenMerge, root = effectiveInstanceRoot(), currentHead: (entry: FrozenMerge) => string | null = githubHead): void {
+  if (!Number.isSafeInteger(entry.prNumber) || entry.prNumber <= 0 || !/^[0-9a-f]{40}$/i.test(entry.headCommit) || !entry.repoRoot) throw new Error('invalid frozen merge entry');
+  const repoRoot = repoIdentity(entry.repoRoot);
+  // Slow lookups (git, GitHub) happen outside the queue lock; inside it only the held head they were judged against
+  // is re-checked — if it changed meanwhile, the judgement is made again.
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const seen = readQueue(root).find((item) => item.repoRoot === repoRoot && item.prNumber === entry.prNumber)?.headCommit;
+    let keepExisting = false;
+    let by = 'none';
+    if (seen && seen !== entry.headCommit) {
+      const order = headOrder(repoRoot, entry.headCommit, seen);
+      if (order !== 'unknown') { keepExisting = order === 'older'; by = 'ancestry'; }
+      else { keepExisting = currentHead({ ...entry, repoRoot }) !== entry.headCommit; by = 'github-or-unknown'; }
+    }
+    const done = lockedQueue(root, () => {
+      const current = readQueue(root);
+      const existing = current.find((item) => item.repoRoot === repoRoot && item.prNumber === entry.prNumber);
+      if (existing?.headCommit !== seen) return false; // changed while we looked: judge again
+      if (existing && keepExisting) {
+        debug.log('harness.merge', 'frozen-head-kept', { pr: entry.prNumber, kept: existing.headCommit, ignored: entry.headCommit, by });
+        return true;
+      }
+      writeQueue(root, [...current.filter((item) => item !== existing), { ...entry, repoRoot }]);
+      return true;
+    });
+    if (done) return;
+  }
+  throw new Error(`frozen merge queue kept changing for PR ${entry.prNumber}`);
+}
+
+export function pendingFrozenMerges(root = effectiveInstanceRoot()): number { return readQueue(root).length; }
+
+/** The repository a run worktree belongs to, as a path that outlives the worktree: the main worktree when there is
+ *  one (also with a separate git dir), else the bare repository directory; the worktree itself only if git cannot say. */
+export function owningRepoRoot(worktree: string, spawn: typeof Bun.spawnSync = Bun.spawnSync): string | null {
+  let list: ReturnType<typeof Bun.spawnSync>;
+  try { list = spawn(['git', '-C', worktree, 'worktree', 'list', '--porcelain'], { env: process.env }); }
+  catch { return null; } // git could not even run: unknown owner — the held PR stays for a person
+  if (list.exitCode === 0) {
+    const first = (list.stdout?.toString() ?? "").split('\n\n')[0] ?? '';
+    const path = /^worktree (.+)$/m.exec(first)?.[1];
+    if (path) return path; // main worktree, or the bare repository directory (gh reads the remote from the git dir)
+  }
+  return null;
+}
+
+const sameEntry = (a: FrozenMerge, b: FrozenMerge) => a.prNumber === b.prNumber && a.repoRoot === b.repoRoot && a.headCommit === b.headCommit;
+
+/** One runner per held PR: whoever creates the claim file (resume sweep or the original lander) merges it. */
+/** One identity per repository path: symlinks and `..` resolve to the real path (absolute path when it does not exist). */
+export function repoIdentity(path: string): string {
+  try { return realpathSync(path); } catch { return resolve(path); }
+}
+
+/** A claim names the repository as well as the PR number — the queue tells PRs apart the same way. */
+export function claimPath(key: { prNumber: number; repoRoot: string }, root: string): string {
+  const repo = createHash('sha256').update(repoIdentity(key.repoRoot)).digest('hex').slice(0, 12);
+  return join(root, `landing-freeze-claim-${key.prNumber}-${repo}.lock`);
+}
+
+function claimFrozenMerge(entry: FrozenMerge, root: string): { release: () => void } | null {
+  mkdirSync(root, { recursive: true });
+  const release = tryLock(claimPath(entry, root));
+  return release ? { release } : null;
+}
+
+export type LandingAdmission =
+  | { kind: 'merge'; /** `true` once the merge is confirmed: drops this lander's own held entry. */ end: (merged?: boolean) => void }
+  | { kind: 'held'; freeze: LandingFreeze }
+  | { kind: 'taken' };
+
+/** Gate one merge/publication on the freeze. While frozen the entry is queued; if the freeze is lifted while queueing,
+ *  the entry is taken back and the caller merges now — unless a resume sweep already claimed it ('taken'). */
+export function admitLandingMerge(
+  heldEntry: FrozenMerge | null | (() => FrozenMerge | null),
+  root = effectiveInstanceRoot(),
+  hooks: { afterQueue?: () => void } = {},
+  claimKey?: { prNumber: number; repoRoot: string; headCommit?: string },
+): LandingAdmission {
+  let entry: FrozenMerge | null | undefined;
+  // A held PR is merged by exactly one runner: the claim (repository + PR) is held from admission until the lander's
+  // merge has ended. Its queue entry stays until that merge is confirmed — `end(true)` removes this lander's own head;
+  // a failed or interrupted merge leaves it for the next resume sweep.
+  let claim: { release: () => void } | null = null;
+  let ownHead: { prNumber: number; repoRoot: string; headCommit?: string } | null = null;
+  const finish = (landing: { end: () => void }, held: { release: () => void } | null, own: typeof ownHead) => (merged?: boolean) => {
+    try {
+      // Only a confirmed merge of a known head removes that head; without a head nothing is dequeued (a sweep will
+      // find the PR merged on GitHub and drop it).
+      if (merged && own?.headCommit) {
+        const head = own.headCommit;
+        lockedQueue(root, () => writeQueue(root, readQueue(root).filter((item) =>
+          item.prNumber !== own.prNumber || item.repoRoot !== own.repoRoot || item.headCommit !== head)));
+      }
+    } finally { landing.end(); held?.release(); }
+  };
+  for (;;) {
+    const landing = beginLandingMerge(root);
+    if (!landing.frozen) {
+      if (!claim && claimKey) {
+        const key = { prNumber: claimKey.prNumber, repoRoot: repoIdentity(claimKey.repoRoot), headCommit: claimKey.headCommit };
+        const queued = () => readQueue(root).some((item) => item.prNumber === key.prNumber && item.repoRoot === key.repoRoot);
+        if (existsSync(claimPath(key, root)) || queued()) {
+          const probe = tryLock(claimPath(key, root));
+          if (!probe) { landing.end(); return { kind: 'taken' }; }
+          claim = { release: probe };
+          ownHead = key;
+        }
+      }
+      return { kind: 'merge', end: finish(landing, claim, ownHead) };
+    }
+    claim?.release();
+    claim = null;
+    ownHead = null;
+    if (entry === undefined) entry = typeof heldEntry === 'function' ? heldEntry() : heldEntry; // only built when frozen
+    if (!entry) return { kind: 'held', freeze: landing.frozen };
+    queueFrozenMerge(entry, root);
+    hooks.afterQueue?.();
+    if (readLandingFreeze(root)) return { kind: 'held', freeze: landing.frozen };
+    const mine = { ...entry, repoRoot: repoIdentity(entry.repoRoot) };
+    claim = claimFrozenMerge(mine, root);
+    if (!claim) return { kind: 'taken' };
+    // A resume sweep already merged and dequeued it between our queueing and our claim: nothing left to merge.
+    let stillHeld = false;
+    try { stillHeld = readQueue(root).some((item) => sameEntry(item, mine)); }
+    catch (error) { claim.release(); throw error; }
+    if (!stillHeld) { claim.release(); return { kind: 'taken' }; }
+    ownHead = mine;
+    debug.log('harness.merge', 'freeze-lifted-while-queueing', { pr: entry.prNumber });
+  }
+}
+
+/** Default «is this PR already merged at this head?» check — GitHub is the final word. */
+function githubMergedAt(entry: FrozenMerge): boolean {
+  try {
+    // Resolve gh against the current PATH (Bun's spawn would otherwise use the PATH from process start).
+    const gh = Bun.which('gh', { PATH: process.env.PATH ?? '' }) ?? 'gh';
+    const view = Bun.spawnSync([gh, 'pr', 'view', String(entry.prNumber), '--json', 'state,headRefOid'], { cwd: entry.repoRoot, env: process.env, timeout: 30_000 });
+    if (view.exitCode !== 0) return false;
+    const pr = JSON.parse(view.stdout.toString()) as { state?: string; headRefOid?: string };
+    return pr.state === 'MERGED' && pr.headRefOid === entry.headCommit;
+  } catch { return false; } // unknown is «not known merged»: the head-pinned merge still refuses a second merge
+}
+
+/** Invoke at a supervision tick. A failed re-gate remains queued; only a confirmed merge is removed.
+ *  «Merged once» does not rest on the claim lock alone: every merge is pinned to the held head
+ *  (`gh pr merge --match-head-commit`, which refuses an already-merged PR), and before and after each attempt the
+ *  sweep asks GitHub whether the PR is already merged at that head — a duplicate runner can at most repeat a re-gate. */
+export async function sweepFrozenMerges(
+  merge: (entry: ResumedMerge) => Promise<{ passed: boolean; status?: string }> = async (entry) => {
+    const { runHostRegate } = await import('./host-regate.js');
+    return runHostRegate(entry);
+  },
+  root = effectiveInstanceRoot(),
+  alreadyMerged: (entry: FrozenMerge) => boolean | Promise<boolean> = githubMergedAt,
+): Promise<{ pending: number; merged: number }> {
+  const frozen = readLandingFreeze(root);
+  if (frozen) return { pending: readQueue(root).length, merged: 0 };
+  const pending = readQueue(root);
+  let merged = 0;
+  for (const entry of pending) {
+    if (readLandingFreeze(root)) break;
+    const claim = claimFrozenMerge(entry, root);
+    if (!claim) continue; // another sweep or the original lander is on it
+    try {
+      if (!readQueue(root).some((item) => sameEntry(item, entry))) continue; // taken back by its lander
+      if (entry.manual) { debug.log('harness.merge', 'resume-manual', { pr: entry.prNumber, repoRoot: entry.repoRoot }); continue; }
+      if (!(await alreadyMerged(entry))) {
+        const outcome = await merge({ ...entry, resumed: true });
+        if (outcome.status === 'frozen') continue;
+        // Whatever the merge call reported, only GitHub showing the PR merged at the held head dequeues it.
+        if (!(await alreadyMerged(entry))) {
+          if (outcome.passed) debug.log('harness.merge', 'resume-unconfirmed', { pr: entry.prNumber, head: entry.headCommit });
+          continue;
+        }
+      }
+      lockedQueue(root, () => {
+        const current = readQueue(root);
+        if (current.some((item) => sameEntry(item, entry))) {
+          writeQueue(root, current.filter((item) => !sameEntry(item, entry)));
+          merged++;
+        }
+      });
+    } catch (error) {
+      debug.log('harness.merge', 'resume-failed', { pr: entry.prNumber, error: String(error) });
+    } finally { claim.release(); }
+  }
+  return { pending: readQueue(root).length, merged };
+}

package/src/self-implement/gate-cli.ts

@@ -12,6 +12,8 @@ import { runMockModuleRestoreGate } from '../../scripts/ci-mock-module-restore-g
 import { parseReviewDepthFromFilesJson } from '../agent-mission/review-depth.js';
 import { buildGateBaselineReport, calculateGateTestCountChange, formatGateBaselineNote, formatGateTestCountNote, isGateTestFile, runGateBaseline, type BaselineProcessResult, type BaselineProcessStatus, type GateTestFailure } from './gate-baseline.js';
 import { resolveGateScope } from './gate-scope.js';
+import { publicExposureFiles, runExposeGate } from './expose-gate.js';
+import { getUserConfig } from '../user-config.js';
 import { debug } from '../debug/log.js';
 import { buildDocumentGuardianIndex, formatDocumentGuardians } from './document-guardian-index.js';
 import { buildImporterTestIndex, isTestPath, type ImporterTestIndex } from './importer-test-index.js';
@@ -585,6 +587,9 @@ export function runSelfGateCli(cwd: string, options: SelfGateCliOptions = {}, de
     ? buildRouteConsumerTestIndex(cwd, availableIndex.testPaths, selection.files, selection.baseRef) : null;
   const scope = resolveGateScope(selection.files, exists, availableIndex,
     { routeConsumerTestIndex: routeIndex ?? undefined });
+  const expose = publicExposureFiles(selection.files).length > 0
+    ? runExposeGate(cwd, selection.files, getUserConfig().harness?.exposeGate === 'strict' ? 'strict' : 'warn', deps.runCommand)
+    : { passed: true, log: '' };
   const testFiles = [...(scope.testArgs ?? [])];
   const unrunImporterTotal = lookupFailed ? null : (scope.importerTestsNotRun?.total ?? 0);
   const importerLookupFailed = Boolean(lookupFailed);
@@ -615,6 +620,7 @@ export function runSelfGateCli(cwd: string, options: SelfGateCliOptions = {}, de
     ...(scope.callerTestsOverflow.length ? [`⚠️ caller test cap exceeded — not run: ${scope.callerTestsOverflow.map(({ file, reasons }) => `${file} (${reasons.join('+')})`).join(', ')}`] : []),
     changedTestCountNote(cwd, selection.files, selection.baseRef, deps.runCommand, deps.readFile),
   ];
+  if (expose.log) lines.push(expose.log);
   if (options.pr) {
     const worktreeObservation = observePrWorktreeDirtiness(cwd, selection.prHeadRefName, {
       runCommand: deps.runCommand,
@@ -638,7 +644,7 @@ export function runSelfGateCli(cwd: string, options: SelfGateCliOptions = {}, de
   if (scope.skipTestStep) {
     const policyPassed = runPolicyGates(selection.files, cwd, lines, deps);
     logGateCliBaseline(cwd, { ...ZERO_GATE_BASELINE, unrunImporterTotal, lookupFailed: importerLookupFailed });
-    return { exitCode: androidPassed && iosPassed && pwaPassed && policyPassed ? 0 : 1, lines, changedFiles: selection.files, testFiles: [], unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests };
+    return { exitCode: androidPassed && iosPassed && pwaPassed && policyPassed && expose.passed ? 0 : 1, lines, changedFiles: selection.files, testFiles: [], unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests };
   }
 
   if (options.shards !== undefined) {
@@ -662,7 +668,7 @@ export function runSelfGateCli(cwd: string, options: SelfGateCliOptions = {}, de
     }
     const policyPassed = runPolicyGates(selection.files, cwd, lines, deps);
     return {
-      exitCode: aggregate.status !== 'passed' || !policyPassed || !androidPassed || !iosPassed || !pwaPassed ? 1 : 0,
+      exitCode: aggregate.status !== 'passed' || !policyPassed || !androidPassed || !iosPassed || !pwaPassed || !expose.passed ? 1 : 0,
       lines, changedFiles: selection.files, testFiles, unverified: scope.unverified,
       documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests,
     };
@@ -674,7 +680,7 @@ export function runSelfGateCli(cwd: string, options: SelfGateCliOptions = {}, de
     lines.push(formatPartialObservationNote(unrunImporterTotal ?? 0, `tests: pass (${testFiles.length} files)`));
     const policyPassed = runPolicyGates(selection.files, cwd, lines, deps);
     logGateCliBaseline(cwd, { ...ZERO_GATE_BASELINE, unrunImporterTotal, lookupFailed: importerLookupFailed });
-    return { exitCode: policyPassed && androidPassed && iosPassed && pwaPassed ? 0 : 1, lines, changedFiles: selection.files, testFiles, unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests };
+    return { exitCode: policyPassed && androidPassed && iosPassed && pwaPassed && expose.passed ? 0 : 1, lines, changedFiles: selection.files, testFiles, unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests };
   }
 
   if (worktreeLog.includes('deterministic environment setup failed')) lines.push(worktreeLog);
@@ -695,6 +701,6 @@ export function runSelfGateCli(cwd: string, options: SelfGateCliOptions = {}, de
   });
   lines.push(formatPartialObservationNote(unrunImporterTotal ?? 0, formatGateBaselineNote(report, unrunImporterTotal ?? 0)));
   const policyPassed = runPolicyGates(selection.files, cwd, lines, deps);
-  const exitCode = !androidPassed || !iosPassed || !pwaPassed || !policyPassed || report.introduced > 0 || report.unknown > 0 || report.preconditionUnmet > 0 ? 1 : 0;
+  const exitCode = !androidPassed || !iosPassed || !pwaPassed || !policyPassed || !expose.passed || report.introduced > 0 || report.unknown > 0 || report.preconditionUnmet > 0 ? 1 : 0;
   return { exitCode, lines, changedFiles: selection.files, testFiles, unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests };
 }