elanous 0.2.16 → 0.2.18

package/src/self-dev/round-pr-supersede.ts

@@ -0,0 +1,244 @@
+// DRAFT-TRIAGE (TC 10-07) — a supervisor rework round of the same run and goal opens a new PR
+// (new task id → new goal hash → new branch). Continuing the branch would mean pinning the shard
+// identity and the Pod child's run suffix, so this closes the previous round's draft instead:
+// label `elanous:superseded`, comment with the newer PR link, close. Same run = one tracker per
+// supervised invocation; same goal = `resumeKey(feature)`, the key the resume path already uses.
+
+import { spawnSync } from 'node:child_process';
+import { debug } from '../debug/log.js';
+import { PR_LABELS } from '../github/pr-labels.js';
+import { PROTECTED_LABELS } from './draft-triage-rules.js';
+import { resumeKey, type SelfDevJobResult } from './orchestrate.js';
+
+const SUPERSEDED_LABEL = PR_LABELS.find((label) => label.name.endsWith(':superseded'))!.name;
+
+export interface RoundPrRef {
+  readonly repository: string;
+  readonly number: number;
+  readonly url: string;
+}
+
+export interface RoundPrView {
+  readonly state: string;
+  readonly isDraft: boolean;
+  readonly labels: readonly string[];
+  readonly mergedAt?: string | null;
+  /** Comment bodies — a link already posted (even by a write that reported failure) is not posted again.
+   *  An adapter that cannot read them returns a null view, so nothing is written. */
+  readonly comments: readonly string[];
+}
+
+/** gh seams. A null view or a false write means «not observed / not applied» — never a reason to close. */
+export interface RoundPrAdapters {
+  view(pr: RoundPrRef): RoundPrView | null;
+  addLabel(pr: RoundPrRef, label: string): boolean;
+  comment(pr: RoundPrRef, body: string): boolean;
+  close(pr: RoundPrRef): boolean;
+}
+
+type SupersedeOutcome =
+  | { kind: 'superseded'; round: number; prevPr: number; pr: number }
+  | { kind: 'kept'; round: number; prevPr: number; pr: number; reason: string };
+
+type RoundPrOutcome = SupersedeOutcome | { kind: 'continued'; round: number; prevPr: number; pr: number };
+
+export function roundPrRef(prUrl: string | undefined): RoundPrRef | null {
+  if (!prUrl) return null;
+  try {
+    const url = new URL(prUrl.trim());
+    const match = /^\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/.exec(url.pathname);
+    return url.protocol === 'https:' && url.hostname === 'github.com' && match
+      // GitHub owner/repo names are case-insensitive: one PR has one identity.
+      ? { repository: `${match[1]}/${match[2]}`.toLowerCase(), number: Number(match[3]), url: `https://github.com/${match[1]}/${match[2]}/pull/${match[3]}` }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+const prId = (pr: RoundPrRef): string => `${pr.repository}#${pr.number}`;
+
+const commentMarker = (prev: RoundPrRef, next: RoundPrRef): string => `<!-- elanous:round-pr-superseded ${prId(prev)} -> ${prId(next)} -->`;
+
+function roundPrSupersedeComment(input: { runId: string | null; round: number; prev?: RoundPrRef; next: RoundPrRef }): string {
+  return `${input.prev ? `${commentMarker(input.prev, input.next)}\n` : ''}Supervisor round ${input.round}${input.runId ? ` of ${input.runId}` : ''}: superseded by #${input.next.number} (${input.next.url}) — same run and goal, the rework round opened a new PR. Branch preserved.`;
+}
+
+/**
+ * One tracker per supervised run. `record(results, round)` after each round: for every goal whose newest PR
+ * differs from a PR an earlier round of this run opened, the earlier one is superseded exactly once —
+ * only while it is an open draft, unmerged, without a protected label, in the same repository.
+ */
+export function createRoundPrTracker(input: {
+  runId: string | null;
+  adapters: RoundPrAdapters;
+  observe?: (event: string, data: Record<string, unknown>) => void;
+}) {
+  const byGoal = new Map<string, Array<{ ref: RoundPrRef; merged: boolean; round: number }>>();
+  const handled = new Set<string>();
+  // The link comment is written once per PR even when the close after it fails and is retried next round.
+  const commented = new Set<string>();
+  const emit = (event: string, data: Record<string, unknown>): void => {
+    try { (input.observe ?? ((e, d) => debug.log('self-dev.supervisor', e, d)))(event, data); } catch { /* observation must not interrupt supervision */ }
+  };
+
+  const supersede = (prev: RoundPrRef, next: RoundPrRef, round: number): SupersedeOutcome => {
+    const base = { round, prevPr: prev.number, pr: next.number };
+    if (prev.repository !== next.repository) return { kind: 'kept', ...base, reason: 'other-repository' };
+    if (prId(prev) === prId(next)) return { kind: 'kept', ...base, reason: 'same-pr' };
+    let view: RoundPrView | null = null;
+    try { view = input.adapters.view(prev); } catch { view = null; }
+    if (!view) return { kind: 'kept', ...base, reason: 'view-unobserved' };
+    if (view.state !== 'OPEN' || view.mergedAt) return { kind: 'kept', ...base, reason: `state:${view.mergedAt ? 'MERGED' : view.state}` };
+    if (!view.isDraft) return { kind: 'kept', ...base, reason: 'not-draft' };
+    const held = view.labels.find((label) => PROTECTED_LABELS.has(label));
+    if (held) return { kind: 'kept', ...base, reason: `label:${held}` };
+    // Label first: a closed but unlabelled PR would fall outside every later sweep (draft-sweep rule).
+    let labelled = view.labels.includes(SUPERSEDED_LABEL);
+    if (!labelled) {
+      try { labelled = input.adapters.addLabel(prev, SUPERSEDED_LABEL); } catch { labelled = false; }
+    }
+    if (!labelled) return { kind: 'kept', ...base, reason: 'label-failed' };
+    const id = prId(prev);
+    if (view.comments.some((body) => body.includes(commentMarker(prev, next)))) commented.add(id);
+    if (!commented.has(id)) {
+      let ok = false;
+      try { ok = input.adapters.comment(prev, roundPrSupersedeComment({ runId: input.runId, round, prev, next })); } catch { ok = false; }
+      if (!ok) return { kind: 'kept', ...base, reason: 'comment-failed' };
+      commented.add(id);
+    }
+    let closed = false;
+    try { closed = input.adapters.close(prev); } catch { closed = false; }
+    return closed ? { kind: 'superseded', ...base } : { kind: 'kept', ...base, reason: 'close-failed' };
+  };
+
+  /** Unfinished supersedes, keyed by the earlier PR; `next` stays the first successor so retries link the same PR. */
+  const pending = new Map<string, { prev: { ref: RoundPrRef; merged: boolean }; next: RoundPrRef }>();
+
+  return {
+    /** Record one round's results, then (re)try every unfinished supersede — even when this round has no PR. */
+    record(results: readonly SelfDevJobResult[], round: number): RoundPrOutcome[] {
+      const outcomes: RoundPrOutcome[] = [];
+      for (const result of results) {
+        const ref = roundPrRef(result.prUrl);
+        if (!ref) continue;
+        const key = resumeKey(result.feature);
+        const seen = byGoal.get(key) ?? [];
+        // A PR already seen in this run is never a new successor — only a new PR is.
+        const known = seen.find((entry) => prId(entry.ref) === prId(ref));
+        if (known) {
+          known.merged ||= result.merged === true;
+          // A carried (skipped) shard is not a new round's work.
+          if (result.resumeDisposition !== 'skip' && known.round < round) {
+            outcomes.push({ kind: 'continued', round, prevPr: known.ref.number, pr: ref.number });
+            emit('round-pr-continued', { runId: input.runId, round, prevPr: known.ref.number, pr: ref.number });
+          }
+          continue;
+        }
+        // A carried result this run has not seen before was opened by an earlier process — not this run's PR,
+        // so it is neither recorded nor allowed to supersede anything.
+        if (result.resumeDisposition === 'skip') continue;
+        // Only PRs opened in an earlier round are superseded — never a sibling of the same round.
+        for (const prev of seen) {
+          const id = prId(prev.ref);
+          if (prev.round >= round || handled.has(id) || pending.has(id)) continue;
+          if (prev.merged) {
+            handled.add(id);
+            outcomes.push({ kind: 'kept', round, prevPr: prev.ref.number, pr: ref.number, reason: 'merged' });
+            continue;
+          }
+          pending.set(id, { prev, next: ref });
+        }
+        seen.push({ ref, merged: result.merged === true, round });
+        byGoal.set(key, seen);
+      }
+      for (const [id, { prev: entry, next }] of [...pending]) {
+        const prev = entry.ref;
+        // A result may have reported the earlier PR merged after it was queued — re-checked right before any write.
+        const outcome: SupersedeOutcome = entry.merged
+          ? { kind: 'kept', round, prevPr: prev.number, pr: next.number, reason: 'merged' }
+          : supersede(prev, next, round);
+        outcomes.push(outcome);
+        // Retry only what was not observed or not applied; a decided keep/supersede is final for this run.
+        if (outcome.kind === 'superseded' || !/^(?:view-unobserved|label-failed|comment-failed|close-failed)$/.test(outcome.reason)) {
+          handled.add(id);
+          pending.delete(id);
+        }
+        if (outcome.kind === 'superseded') {
+          emit('round-pr-superseded', { runId: input.runId, round, prevPr: prev.number, pr: next.number });
+        } else {
+          emit('round-pr-supersede-kept', { runId: input.runId, round, prevPr: prev.number, pr: next.number, reason: outcome.reason });
+        }
+      }
+      return outcomes;
+    },
+  };
+}
+
+function ghEnv(): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const [k, v] of Object.entries(process.env)) if (v !== undefined && !/^(https?|all|no)_proxy$/i.test(k)) env[k] = v;
+  return env;
+}
+
+/** Real gh adapters: proxy variables removed, App identity when available (never the personal login by choice). */
+export async function defaultRoundPrAdapters(deps: {
+  appToken?: () => string | null;
+  run?: (args: string[], env: Record<string, string>) => { status: number | null; stdout: string };
+  inTest?: () => boolean;
+} = {}): Promise<RoundPrAdapters> {
+  const env = ghEnv();
+  let tokenSource: () => string | null = () => null;
+  try {
+    tokenSource = deps.appToken ?? (await import('../auth/github-app-token.js')).githubAutomationToken;
+  } catch { /* no App credential module — every write refuses */ }
+  const freshToken = (): string | null => { try { return tokenSource(); } catch { return null; } };
+  const gh = (args: string[], token?: string | null) => {
+    const callEnv = { ...env };
+    if (token) callEnv.GH_TOKEN = token;
+    return deps.run
+      ? deps.run(args, callEnv)
+      : spawnSync('gh', args, { encoding: 'utf8', env: callEnv as NodeJS.ProcessEnv, timeout: 30_000 });
+  };
+  // Writes (label · comment · close) run only as the automation App — the token is fetched per write, so a
+  // token that was missing or expired earlier in the run recovers; without it the write refuses and is retried.
+  // Reads may use the machine login.
+  const write = (op: string, pr: RoundPrRef, args: string[]): boolean => {
+    const token = freshToken();
+    if (!token) {
+      try { debug.log('self-dev.supervisor', 'round-pr-write-refused', { op, pr: pr.number, reason: 'no-app-token' }); } catch { /* fail-open */ }
+      return false;
+    }
+    return gh(args, token).status === 0;
+  };
+  const inTest = deps.inTest ?? ((): boolean => process.env.NODE_ENV === 'test');
+  return {
+    view(pr) {
+      if (inTest()) return null;
+      const out = gh(['pr', 'view', String(pr.number), '--repo', pr.repository, '--json', 'state,isDraft,labels,mergedAt,comments'], freshToken());
+      if (out.status !== 0) return null;
+      try {
+        const parsed = JSON.parse(out.stdout) as { state?: unknown; isDraft?: unknown; labels?: unknown; mergedAt?: unknown; comments?: unknown };
+        if (typeof parsed.state !== 'string' || typeof parsed.isDraft !== 'boolean' || !Array.isArray(parsed.labels)) return null;
+        const labels = parsed.labels.map((label) => (label as { name?: unknown })?.name);
+        if (labels.some((name) => typeof name !== 'string')) return null;
+        // Unverifiable comments make the whole view unobserved — no write may follow it.
+        if (!Array.isArray(parsed.comments)) return null;
+        const comments = parsed.comments.map((comment) => (comment as { body?: unknown })?.body);
+        if (comments.some((body) => typeof body !== 'string')) return null;
+        return { state: parsed.state, isDraft: parsed.isDraft, labels: labels as string[], mergedAt: typeof parsed.mergedAt === 'string' && parsed.mergedAt ? parsed.mergedAt : null, comments: comments as string[] };
+      } catch {
+        return null;
+      }
+    },
+    addLabel(pr, label) {
+      return !inTest() && write('label', pr, ['pr', 'edit', String(pr.number), '--repo', pr.repository, '--add-label', label]);
+    },
+    comment(pr, body) {
+      return !inTest() && write('comment', pr, ['pr', 'comment', String(pr.number), '--repo', pr.repository, '--body', body]);
+    },
+    close(pr) {
+      return !inTest() && write('close', pr, ['pr', 'close', String(pr.number), '--repo', pr.repository]);
+    },
+  };
+}

package/src/self-dev/run-store.ts

@@ -28,6 +28,7 @@ import type { RunIdSource } from '../harness/harness-space.js';
 import { withFileLockSync } from '../storage/file-lock.js';
 import type { SelfDevJobResult, SelfDevGoal } from './orchestrate.js';
 import type { SupervisorStopReason } from './run-supervisor.js';
+import type { SupervisorNext } from './supervisor-verdict-edges.js';
 import { loadMirroredRunRecord, mirrorRunRecord } from './run-record-mirror.js';
 
 export interface SelfDevRunParticipant {
@@ -92,6 +93,8 @@ export interface SelfDevRunState {
   parkedResolution?: SelfDevRunResolution;
   /** The closed supervisor termination reason, persisted independently from per-goal results. */
   supervisorStopReason?: SupervisorStopReason;
+  /** Named next step at supervisor termination; legacy checkpoints omit it. */
+  next?: SupervisorNext;
   /** ★ C(2026-07-21·HITL 정황 품질) — 이 run 을 구동하는 오케스트레이터 프로세스 pid. 살아있으면
    *  non-terminal goal 은 **실행중(running)** 이지 막힌(interrupted) 게 아니다. 죽었으면(오케스트레이터
    *  killed) 진짜 interrupted. isPidAlive 로 구분해 라이브 잡을 parked/repair-signals 에서 제외. */
@@ -311,13 +314,14 @@ export function recordSelfDevRunSupervisorStop(
   runId: string,
   supervisorStopReason: SupervisorStopReason,
   dir = selfDevRunsDir(),
+  next?: SupervisorNext,
 ): SupervisorStopPersistenceOutcome {
   try {
     if (!existsSync(dir)) return { outcome: 'missing-directory' };
     return withFileLockSync(join(dir, `${runId}.lock`), () => {
       const state = loadSelfDevRunFromPath(runPath(runId, dir));
       if (!state) return { outcome: 'missing-record' };
-      writeSelfDevRun({ ...state, updatedAt: Date.now(), supervisorStopReason }, dir);
+      writeSelfDevRun({ ...state, updatedAt: Date.now(), supervisorStopReason, ...(next === undefined ? {} : { next }) }, dir);
       return { outcome: 'persisted' };
     });
   } catch {

package/src/self-dev/run-supervisor.ts

@@ -6,6 +6,8 @@ import type { SelfDevJobResult } from './orchestrate.js';
 import { recordSelfDevRunSupervisorStop, selfDevRunsDir } from './run-store.js';
 import { debug } from '../debug/log.js';
 import { sweepFrozenMerges } from '../self-implement/frozen-merges.js';
+import { routeSupervisorVerdict, type SupervisorNext } from './supervisor-verdict-edges.js';
+import { recordTaskAgentShadowMove, type TaskAgentShadowInput } from '../task-agent/shadow.js';
 
 export interface SupervisorRound {
   round: number;
@@ -186,6 +188,7 @@ function formatGoalPlanRevisionObservation(results: readonly SelfDevJobResult[])
 export type SupervisorJobResult = SelfDevJobResult & {
   reviewReason?: string;
   salvage?: 'launched' | 'parked';
+  next?: SupervisorNext;
 };
 
 export function decideNextRun(input: {
@@ -459,6 +462,11 @@ export interface SuperviseRunOptions {
   runStore?: { runId?: string; operatorDir?: string; dir?: string; isolatedDir?: string };
   observe?: (event: string, data: Record<string, unknown>) => void;
   sweepPendingMerges?: typeof sweepFrozenMerges;
+  /**
+   * TASK-AGENT-SHADOW — 멈춤이 확정되면 판단부를 그림자로 부른다(기본 `recordTaskAgentShadowMove`).
+   * `false` 면 끈다. 던져도 런의 결말은 바뀌지 않는다(fail-soft).
+   */
+  taskAgentShadow?: ((input: TaskAgentShadowInput) => unknown) | false;
   observeDeliverables?: () => Promise<{
     readonly deployFindings: ReadonlyMap<string, { target: string; findings?: readonly DeployVerifyFinding[] | readonly unknown[] }>;
     readonly unmeasured: readonly unknown[];
@@ -592,9 +600,13 @@ export async function superviseRun(opts: SuperviseRunOptions): Promise<Superviso
     } catch { /* fail-open */ }
 
     if (decision.action === 'stop') {
+      const reason = decision.stopReason ?? 'unregistered-stop';
+      const next = routeSupervisorVerdict(reason, results).next;
+      try { debug.log('self-dev.supervisor', 'verdict-edge', { runId, reason, next }); } catch { /* observation must not interrupt supervision */ }
+      results = results.map((result) => ({ ...result, next }));
       if (runId && decision.stopReason) {
         const storage = resolveSupervisorStopStorage(opts.runStore);
-        const persistence = recordSelfDevRunSupervisorStop(runId, decision.stopReason, storage.path);
+        const persistence = recordSelfDevRunSupervisorStop(runId, decision.stopReason, storage.path, next);
         const storageObservation = {
           storagePath: storage.path,
           storageSource: storage.source,
@@ -608,6 +620,14 @@ export async function superviseRun(opts: SuperviseRunOptions): Promise<Superviso
           });
         } catch { /* fail-open */ }
       }
+      if (decision.stopReason && opts.taskAgentShadow !== false) {
+        // TASK-AGENT-SHADOW — 판단부를 그림자로 부른다(실행 0). 어떤 오류도 런의 결말을 바꾸지 않는다.
+        try {
+          await (opts.taskAgentShadow ?? recordTaskAgentShadowMove)({ runId, stopReason: decision.stopReason, results });
+        } catch (error) {
+          try { debug.log('task-agent', 'shadow-move-failed', { runId, stopReason: decision.stopReason, error: String(error) }); } catch { /* fail-open */ }
+        }
+      }
       return results;
     }
 

package/src/self-dev/supervisor-verdict-edges.ts

@@ -0,0 +1,46 @@
+import type { SelfDevJobResult } from './orchestrate.js';
+import type { SupervisorStopReason } from './run-supervisor.js';
+
+export type SupervisorNext = 'harvest' | 'scope-decompose' | 'self-review' | 'human-gate' | 'proposal';
+export type SupervisorVerdictEdge = { readonly meaning: string; readonly next: SupervisorNext };
+
+// 목표 규칙: 사람 관문은 결제·공개·자격·비가역 결정에만. 지금 max-rounds·provider-exhausted·step-timeout 이 human-gate 인 것은
+// 그 규칙의 예외로 «그대로» 둔 값이다(시험에 고정 — 바꾸면 보인다).
+export const SUPERVISOR_VERDICT_EDGES = {
+  converged: { meaning: 'run converged', next: 'harvest' },
+  'human-stopped': { meaning: 'human stopped the run', next: 'human-gate' },
+  'parent-signals-red': { meaning: 'parent decision signals are red', next: 'human-gate' },
+  'needs-human': { meaning: 'unresolved human or harvest decision', next: 'human-gate' },
+  'no-actionable-work': { meaning: 'no actionable work remains', next: 'self-review' },
+  'harvestable-awaiting-human': { meaning: 'implementation awaits harvest', next: 'harvest' },
+  'handed-off-to-salvage': { meaning: 'salvage already owns the work', next: 'harvest' },
+  'max-rounds': { meaning: 'round budget exhausted', next: 'human-gate' },
+  'no-progress': { meaning: 'run stalled', next: 'scope-decompose' },
+  'provider-exhausted': { meaning: 'provider quota exhausted', next: 'human-gate' },
+  'step-timeout': { meaning: 'step budget exhausted', next: 'human-gate' },
+  'decomposable-no-progress': { meaning: 'stalled with a decomposition proposal', next: 'scope-decompose' },
+  'review-unobserved': { meaning: 'review was not observed', next: 'self-review' },
+  'deliverable-unobserved': { meaning: 'deliverable was not observed', next: 'self-review' },
+  'deliverable-merged': { meaning: 'deliverable is merged', next: 'harvest' },
+} as const satisfies Record<SupervisorStopReason, SupervisorVerdictEdge>;
+
+const HUMAN_GATE_MERGE_REASONS: ReadonlySet<string> = new Set(['decision-signal-red', 'signal-incomplete', 'parent-unlanded', 'human-gate']);
+
+/** Unknown stop vocabularies are proposals, never silently treated as approved edges. */
+export function routeSupervisorVerdict(
+  reason: string,
+  results: readonly Partial<Pick<SelfDevJobResult, 'status' | 'stage' | 'merged' | 'prNumber' | 'prUrl' | 'blockReason' | 'mergeReason'>>[] = [],
+): SupervisorVerdictEdge {
+  const edge = Object.hasOwn(SUPERVISOR_VERDICT_EDGES, reason)
+    ? SUPERVISOR_VERDICT_EDGES[reason as SupervisorStopReason]
+    : undefined;
+  if (!edge) return { meaning: 'unregistered supervisor stop reason', next: 'proposal' };
+  if (reason !== 'needs-human') return edge;
+  if (results.some((result) => result.blockReason === 'parent-unlanded')) return edge;
+  // A human-gate reason on ANY result in the run keeps the whole run at the human gate.
+  if (results.some((result) => HUMAN_GATE_MERGE_REASONS.has(String(result.mergeReason)))) return edge;
+  const openPrs = results.filter((result) => result.status === 'done' && result.stage === 'pr-opened'
+    && result.merged !== true && (result.prNumber !== undefined || Boolean(result.prUrl)));
+  if (openPrs.length === 0) return edge;
+  return { meaning: 'open PR ready for harvest', next: 'harvest' };
+}

package/src/self-implement/follow-up-goals.ts

@@ -12,7 +12,7 @@ import { addHarnessQueue, type QueueSeat } from '../harness/harness-queue.js';
 import { debug } from '../debug/log.js';
 import { withFileLockSync } from '../storage/file-lock.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
-import { devVersion, listChecklist, parseOwner } from '../release-loop/checklist.js';
+import { checklistDevVersion, listChecklist, parseOwner } from '../release-loop/checklist.js';
 import { getUserConfig } from '../user-config.js';
 
 export const FOLLOW_UP_DEPTH_LIMIT = 3;
@@ -193,7 +193,7 @@ function defaultAppendDraft(stateRoot: string, record: FollowUpDraftRecord): voi
 
 function defaultCellOwner(cellId: string): string | undefined {
   try {
-    return listChecklist(devVersion()).items.find((item) => item.id === cellId)?.owner;
+    return listChecklist(checklistDevVersion()).items.find((item) => item.id === cellId)?.owner;
   } catch {
     return undefined;
   }

package/src/self-implement/frozen-merges.ts

@@ -2,9 +2,9 @@ import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync,
 import { dlopen, FFIType } from 'bun:ffi';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
-import { effectiveInstanceRoot } from '../instance/resolve.js';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
 import { debug } from '../debug/log.js';
-import { beginLandingMerge, readLandingFreeze, type LandingFreeze } from '../release-loop/landing-freeze.js';
+import { beginLandingMerge, type LandingFreeze } from '../release-loop/landing-freeze.js';
 
 /** `manual`: the owning repository could not be determined — a sweep never resumes it; a person does. */
 export interface FrozenMerge { prNumber: number; headCommit: string; repoRoot: string; manual?: true; /** Host goal document, so a resumed merge can still apply its «이 칸 완료» declaration (CL-AUTO). */ goalFile?: string }
@@ -182,8 +182,10 @@ export function admitLandingMerge(
   root = effectiveInstanceRoot(),
   hooks: { afterQueue?: () => void } = {},
   claimKey?: { prNumber: number; repoRoot: string; headCommit?: string },
+  opts: { prodFreezeRoot?: string; forceReason?: string } = {},
 ): LandingAdmission {
   let entry: FrozenMerge | null | undefined;
+  const prodFreezeRoot = opts.prodFreezeRoot ?? prodInstanceRoot();
   // A held PR is merged by exactly one runner: the claim (repository + PR) is held from admission until the lander's
   // merge has ended. Its queue entry stays until that merge is confirmed — `end(true)` removes this lander's own head;
   // a failed or interrupted merge leaves it for the next resume sweep.
@@ -201,7 +203,7 @@ export function admitLandingMerge(
     } finally { landing.end(); held?.release(); }
   };
   for (;;) {
-    const landing = beginLandingMerge(root);
+    const landing = beginLandingMerge(root, new Date(), prodFreezeRoot, opts.forceReason);
     if (!landing.frozen) {
       if (!claim && claimKey) {
         const key = { prNumber: claimKey.prNumber, repoRoot: repoIdentity(claimKey.repoRoot), headCommit: claimKey.headCommit };
@@ -222,17 +224,19 @@ export function admitLandingMerge(
     if (!entry) return { kind: 'held', freeze: landing.frozen };
     queueFrozenMerge(entry, root);
     hooks.afterQueue?.();
-    if (readLandingFreeze(root)) return { kind: 'held', freeze: landing.frozen };
-    const mine = { ...entry, repoRoot: repoIdentity(entry.repoRoot) };
-    claim = claimFrozenMerge(mine, root);
-    if (!claim) return { kind: 'taken' };
-    // A resume sweep already merged and dequeued it between our queueing and our claim: nothing left to merge.
-    let stillHeld = false;
-    try { stillHeld = readQueue(root).some((item) => sameEntry(item, mine)); }
-    catch (error) { claim.release(); throw error; }
-    if (!stillHeld) { claim.release(); return { kind: 'taken' }; }
-    ownHead = mine;
-    debug.log('harness.merge', 'freeze-lifted-while-queueing', { pr: entry.prNumber });
+    const afterQueue = beginLandingMerge(root, new Date(), prodFreezeRoot, opts.forceReason);
+    if (afterQueue.frozen) return { kind: 'held', freeze: afterQueue.frozen };
+    try {
+      const mine = { ...entry, repoRoot: repoIdentity(entry.repoRoot) };
+      claim = claimFrozenMerge(mine, root);
+      if (!claim) return { kind: 'taken' };
+      // A resume sweep already merged and dequeued it between our queueing and our claim: nothing left to merge.
+      const stillHeld = readQueue(root).some((item) => sameEntry(item, mine));
+      if (!stillHeld) { claim.release(); return { kind: 'taken' }; }
+      ownHead = mine;
+      debug.log('harness.merge', 'freeze-lifted-while-queueing', { pr: entry.prNumber });
+    } catch (error) { claim?.release(); throw error; }
+    finally { afterQueue.end(); }
   }
 }
 
@@ -259,16 +263,17 @@ export async function sweepFrozenMerges(
   },
   root = effectiveInstanceRoot(),
   alreadyMerged: (entry: FrozenMerge) => boolean | Promise<boolean> = githubMergedAt,
+  prodFreezeRoot = prodInstanceRoot(),
 ): Promise<{ pending: number; merged: number }> {
-  const frozen = readLandingFreeze(root);
-  if (frozen) return { pending: readQueue(root).length, merged: 0 };
   const pending = readQueue(root);
   let merged = 0;
   for (const entry of pending) {
-    if (readLandingFreeze(root)) break;
-    const claim = claimFrozenMerge(entry, root);
-    if (!claim) continue; // another sweep or the original lander is on it
+    const guard = beginLandingMerge(root, new Date(), prodFreezeRoot);
+    if (guard.frozen) break;
+    let claim: { release: () => void } | null = null;
     try {
+      claim = claimFrozenMerge(entry, root);
+      if (!claim) continue; // another sweep or the original lander is on it
       if (!readQueue(root).some((item) => sameEntry(item, entry))) continue; // taken back by its lander
       if (entry.manual) { debug.log('harness.merge', 'resume-manual', { pr: entry.prNumber, repoRoot: entry.repoRoot }); continue; }
       if (!(await alreadyMerged(entry))) {
@@ -289,7 +294,7 @@ export async function sweepFrozenMerges(
       });
     } catch (error) {
       debug.log('harness.merge', 'resume-failed', { pr: entry.prNumber, error: String(error) });
-    } finally { claim.release(); }
+    } finally { guard.end(); claim?.release(); }
   }
   return { pending: readQueue(root).length, merged };
 }