elanous 0.2.20 → 0.2.22

package/src/task-orchestrator/surfaces/pod-gate-deps.ts

@@ -0,0 +1,123 @@
+// GATE-IMAGE-DEPS (0.2.21 · GATE-SPEED) — the release-gate shards' dependencies come baked in the harness image.
+//
+// Measured on the 0.2.20 cut gate (~/.elanous/release/0.2.20/gate-logs/cut · 24 root shards · pod-<n>.log ⊕ .junit.xml):
+//   install-slot wait median 156 s (max 509 s) ⊕ `bun install` root+pwa median 104 s (max 160 s) = median ≈ 260 s of a
+//   ≈ 1200 s shard spent before the first test — and the shards that waited longest were the ones the 1200 s deadline cut
+//   (pod-1 · 3 · 11 · 21 · 22 waited 327–509 s and ran only 215–436 s of tests). Alone the install takes seconds; 24 at
+//   once thrash the node (GATE-INSTALL-CACHE). Not installing at all removes both the wait and the install.
+//
+// How: `docker/harness/build.sh` stages each install tree's lockfile ⊕ the install-relevant projection of its package.json
+// ({@link GATE_DEPS_PROJECTION_JS}) into `gate-deps/`; the Dockerfile installs them once into {@link GATE_DEPS_DIR}
+// (`--frozen-lockfile`). The layer's inputs change only when dependencies change, so the per-commit rebuild reuses it from
+// the build cache. A shard links `node_modules` to the baked tree only when its own lockfile and projection are
+// byte-identical to the baked ones; anything else — no baked tree (old image), a different lockfile, a different
+// projection, an existing node_modules, a failed link — falls back to the old path (install slot ⊕ `bun install`).
+// The link is a symlink: copying (or hard-linking across overlay layers) is the very I/O the install slots were throttling.
+// Module resolution follows the real path, and the baked layout mirrors the repo (`<dir>/node_modules`,
+// `<dir>/apps/pwa/node_modules`), so the parent lookup from a package inside the pwa tree is the same as before.
+
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** Baked dependency root inside the full harness image (mirrors the repo layout). */
+export const GATE_DEPS_DIR = '/opt/elanous-gate-deps';
+/** The install trees, relative to the repo root, in install order (same as the old `bun install && (cd apps/pwa && bun install)`). */
+export const GATE_DEPS_TREES = ['.', 'apps/pwa'] as const;
+
+/**
+ * The part of a package.json that decides what `bun install` produces: dependency maps, overrides, trusted/patched
+ * dependencies and the install lifecycle scripts. `version`, `description` and every other script are dropped, so a
+ * release bump or a new script does not invalidate the baked layer. Run as `bun -e <this> <package.json>` (stdout).
+ * ⛔ build.sh (bake) and the shard (check) run this same text — changing it simply makes the next shards fall back once.
+ */
+export const GATE_DEPS_PROJECTION_JS = [
+  "const p=JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'));const o={};",
+  "for(const k of ['name','dependencies','devDependencies','optionalDependencies','peerDependencies','trustedDependencies','overrides','resolutions','patchedDependencies','workspaces'])if(p[k]!==undefined)o[k]=p[k];",
+  "const s={};for(const k of ['preinstall','install','postinstall','prepare'])if(p.scripts&&p.scripts[k]!==undefined)s[k]=p.scripts[k];",
+  "if(Object.keys(s).length)o.scripts=s;process.stdout.write(JSON.stringify(o,null,2)+'\\n');",
+].join('');
+
+/** Same projection in-process (tests · build staging). */
+export function projectDepsManifest(manifest: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const key of ['name', 'dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies', 'trustedDependencies', 'overrides', 'resolutions', 'patchedDependencies', 'workspaces']) {
+    if (manifest[key] !== undefined) out[key] = manifest[key];
+  }
+  const scripts = manifest.scripts as Record<string, unknown> | undefined;
+  const lifecycle: Record<string, unknown> = {};
+  for (const key of ['preinstall', 'install', 'postinstall', 'prepare']) if (scripts && scripts[key] !== undefined) lifecycle[key] = scripts[key];
+  if (Object.keys(lifecycle).length) out.scripts = lifecycle;
+  return out;
+}
+
+/**
+ * build.sh staging: `<dest>/<tree>/bun.lock` (verbatim) ⊕ `<dest>/<tree>/package.json` (the projection) for every install
+ * tree. The digest (sha256 of the staged bytes, 12 hex) becomes the image label `elanous.gate-deps`.
+ */
+export function stageGateDeps(root: string, dest: string): { digest: string; trees: string[] } {
+  const hash = createHash('sha256');
+  const trees: string[] = [];
+  mkdirSync(dest, { recursive: true });
+  for (const tree of GATE_DEPS_TREES) {
+    const lock = join(root, tree, 'bun.lock');
+    const manifest = join(root, tree, 'package.json');
+    if (!existsSync(lock) || !existsSync(manifest)) continue;
+    const out = join(dest, tree);
+    mkdirSync(out, { recursive: true });
+    const lockBytes = readFileSync(lock);
+    const projected = `${JSON.stringify(projectDepsManifest(JSON.parse(readFileSync(manifest, 'utf8')) as Record<string, unknown>), null, 2)}\n`;
+    writeFileSync(join(out, 'bun.lock'), lockBytes, { mode: 0o644 });
+    writeFileSync(join(out, 'package.json'), projected, { mode: 0o644 });
+    hash.update(`${tree}\0`).update(lockBytes).update('\0').update(projected).update('\0');
+    trees.push(tree);
+  }
+  return { digest: hash.digest('hex').slice(0, 12), trees };
+}
+
+const sq = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`;
+
+/**
+ * Bash that installs the shard's dependencies (cwd = the repo clone) and sets `irc` (0 = ready). Each tree is linked to
+ * the baked tree when it matches, else installed — only the installs take an install slot (`install_slot_acquire` /
+ * `install_slot_release` from `installSlotScript` must already be defined when `installSlots > 0`). Every decision is a
+ * `[gate] deps <tree> baked|miss (<why>)` line in `log` (the shard's install.log).
+ */
+export function gateDepsInstallScript(o: { log: string; installSlots: number; depsDir?: string }): string {
+  const deps = sq(o.depsDir ?? GATE_DEPS_DIR);
+  const log = o.log;
+  return [
+    'gate_deps_link() {',
+    `  local t="$1" d=${deps} want`,
+    '  [ "$t" = . ] || d="$d/$t"',
+    '  if [ ! -d "$d/node_modules" ]; then echo "[gate] deps $t miss (no baked deps)"; return 1; fi',
+    '  if [ -e "$t/node_modules" ] || [ -L "$t/node_modules" ]; then echo "[gate] deps $t miss (node_modules exists)"; return 1; fi',
+    '  if ! cmp -s "$t/bun.lock" "$d/bun.lock"; then echo "[gate] deps $t miss (bun.lock differs)"; return 1; fi',
+    `  want=$(bun -e ${sq(GATE_DEPS_PROJECTION_JS)} "$t/package.json" 2>/dev/null) || { echo "[gate] deps $t miss (package.json unreadable)"; return 1; }`,
+    '  if [ "$want" != "$(cat "$d/package.json" 2>/dev/null)" ]; then echo "[gate] deps $t miss (package.json differs)"; return 1; fi',
+    '  if ! ln -s "$d/node_modules" "$t/node_modules"; then echo "[gate] deps $t miss (link failed)"; return 1; fi',
+    '  echo "[gate] deps $t baked"',
+    '}',
+    'irc=0; gate_deps_need=',
+    `for t in ${GATE_DEPS_TREES.join(' ')}; do gate_deps_link "$t" >> ${log} 2>&1 || gate_deps_need="$gate_deps_need $t"; done`,
+    'if [ -n "$gate_deps_need" ]; then',
+    ...(o.installSlots > 0 ? [`  install_slot_acquire >> ${log} 2>&1`] : []),
+    `  for t in $gate_deps_need; do (cd "$t" && bun install) >> ${log} 2>&1; irc=$?; [ "$irc" -eq 0 ] || break; done`,
+    ...(o.installSlots > 0 ? ['  install_slot_release'] : []),
+    'fi',
+  ].join('\n');
+}
+
+/** Per-tree decisions from a shard's install log (`baked` · `miss:<why>`), for the gate's `pod-shard` observation. */
+export function parseGateDeps(log: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const match of log.matchAll(/^\[gate\] deps (\S+) (baked|miss \(([^)]*)\))$/gm)) out[match[1]!] = match[2] === 'baked' ? 'baked' : `miss:${match[3]}`;
+  return out;
+}
+
+if (import.meta.main) {
+  const [cmd, dest] = process.argv.slice(2);
+  if (cmd !== 'stage' || !dest) { console.error('usage: pod-gate-deps.ts stage <dir>'); process.exit(2); }
+  const staged = stageGateDeps(process.cwd(), dest);
+  console.log(`digest=${staged.digest} trees=${staged.trees.join(',') || '-'}`);
+}

package/src/task-orchestrator/surfaces/pod-pool.ts

@@ -16,13 +16,14 @@
  * 풀을 안 주면 종전처럼 «현재 컨텍스트» 하나다(동작 불변).
  */
 import { spawn, spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, rmSync, utimesSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { debug } from '../../debug/log.js';
 import { PodLeaseAdmission, type PodLeasePredecessor, type PodLeaseRelease } from '../../pod-lease/admission.js';
 import { predecessorState, type PredecessorState } from '../../pod-lease/dependency-state.js';
-import { HostPoolLease, leaseHasPendingPod } from '../../pod-lease/host-lease.js';
+import { HostPoolLease, hostLeaseBaseDir, leaseHasPendingPod } from '../../pod-lease/host-lease.js';
+import { acquireLockSync } from '../../storage/file-lock.js';
 import { harnessCpuSlotsBesideGate, measurePoolLease, recommendConcurrency, type PodLeaseMember, type PoolDnsProbe, type PoolLeaseRecommendation } from './pod-lease.js';
 
 export interface PodPoolMember {
@@ -473,13 +474,64 @@ type LocalImageInspect = (image: string) => { status: number | null; stdout: str
 /** `docker save | ssh docker load` 한 번. 시험이 실제 전송 대신 호출 횟수만 센다. */
 type ImageShip = (member: PodPoolMember, image: string) => { status: number | null; stderr: string };
 
+const IMAGE_SHIP_TIMEOUT_MS = 1_800_000;
+const REMOTE_RUN_TIMEOUT_MS = 900_000;
+
+/**
+ * Runs a shell pipeline in its «own process group» and kills the whole group, not just bash (flood 10-08:
+ * 186 orphaned `docker save | gzip | ssh` pipes after runs timed out or died).
+ *   - `perl setpgrp` gives the pipeline a group of its own, so `kill 0` cannot reach the caller.
+ *   - The pipeline runs in the background and bash `wait`s, because bash defers a trap until a «foreground»
+ *     command finishes — a TERM from the spawnSync timeout would otherwise wait out `docker save`.
+ *   - A watchdog in the group polls the parent pid: if the caller dies (kill -9 included), the group goes too.
+ *   - On a normal finish the group is swept as well (watchdog and its `sleep`).
+ * ⚠️ The background pipeline's stdin is /dev/null (non-interactive bash) — fine for `docker save`.
+ */
+export function runProcessGroupPipeline(pipeline: string, opts: { timeoutMs: number; parentPid?: number; watchIntervalSec?: number }): { status: number | null; stderr: string; timedOut: boolean } {
+  const script = [
+    `trap 'trap "" TERM HUP INT; kill -TERM 0 2>/dev/null; exit 143' TERM HUP INT`,
+    `( while kill -0 "$ELANOUS_PIPE_PARENT" 2>/dev/null; do sleep "$ELANOUS_PIPE_WATCH"; done; kill -TERM 0 2>/dev/null ) &`,
+    `( set -o pipefail; eval "$ELANOUS_PIPE_CMD" ) &`,
+    'wait $!',
+    'rc=$?',
+    `trap "" TERM HUP INT`,
+    'kill -TERM 0 2>/dev/null',
+    'exit $rc',
+  ].join('\n');
+  const r = spawnSync('perl', ['-e', 'setpgrp(0,0) or die "setpgrp: $!"; exec @ARGV or die "exec: $!"', 'bash', '-c', script], {
+    encoding: 'utf8',
+    timeout: opts.timeoutMs,
+    killSignal: 'SIGTERM',
+    env: { ...process.env, ELANOUS_PIPE_CMD: pipeline, ELANOUS_PIPE_PARENT: String(opts.parentPid ?? process.pid), ELANOUS_PIPE_WATCH: String(opts.watchIntervalSec ?? 2) },
+  });
+  const timedOut = (r.error as NodeJS.ErrnoException | undefined)?.code === 'ETIMEDOUT';
+  return { status: r.status, stderr: (r.stderr ?? '') + (timedOut ? ` · timed out after ${opts.timeoutMs}ms (process group killed)` : r.error ? ` · ${String(r.error)}` : ''), timedOut };
+}
+
 function defaultImageShip(member: PodPoolMember, image: string): { status: number | null; stderr: string } {
-  const ship = spawnSync('bash', ['-c', `set -o pipefail; docker save ${image} | gzip -1 | ssh -o BatchMode=yes -o ConnectTimeout=10 ${member.sshHost} 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; gunzip | docker load'`], { encoding: 'utf8', timeout: 1_800_000 });
-  return { status: ship.status, stderr: ship.stderr ?? '' };
+  const ship = runProcessGroupPipeline(`docker save ${image} | gzip -1 | ssh -o BatchMode=yes -o ConnectTimeout=10 ${member.sshHost} 'export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; gunzip | docker load'`, { timeoutMs: IMAGE_SHIP_TIMEOUT_MS });
+  return { status: ship.status, stderr: ship.stderr };
+}
+
+/** This machine's image ID (`sha256:…` — `docker save | docker load` keeps it). Null when unreadable. */
+function defaultLocalImageId(image: string): { status: number | null; stdout: string } {
+  const r = spawnSync('docker', ['image', 'inspect', image, '--format', '{{.Id}}'], { encoding: 'utf8', timeout: 30_000 });
+  return { status: r.status, stdout: r.stdout ?? '' };
+}
+
+function imageIdFrom(r: { status: number | null; stdout: string }): string | null {
+  const v = r.status === 0 ? r.stdout.trim() : '';
+  return /^sha256:[0-9a-f]{64}$/.test(v) ? v : null;
+}
+
+/** The remote node's image ID. Null when unreadable — never read as «same». */
+export function remoteImageId(member: PodPoolMember, image: string, run: RemoteRun = defaultRemoteRun): string | null {
+  if (!member.sshHost) return null;
+  return imageIdFrom(run(member.sshHost, `docker image inspect ${image} --format '{{.Id}}'`));
 }
 
 export function defaultRemoteRun(host: string, script: string): { status: number | null; stdout: string; stderr: string } {
-  const r = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, `export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy; ${script}`], { encoding: 'utf8', timeout: 900_000 });
+  const r = spawnSync('ssh', ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', host, `export PATH=/opt/homebrew/bin:/usr/local/bin:$HOME/.orbstack/bin:$PATH; unset HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy; ${script}`], { encoding: 'utf8', timeout: REMOTE_RUN_TIMEOUT_MS });
   return { status: r.status, stdout: r.stdout ?? '', stderr: (r.stderr ?? '') + (r.error ? String(r.error) : '') };
 }
 
@@ -491,29 +543,100 @@ export function remoteImageCommit(member: PodPoolMember, image: string, run: Rem
   return v && v !== '<no value>' ? v : null;
 }
 
+/** Cross-process lock options for one image ship per host (tests shrink them). */
+export interface ImageShipLockOptions {
+  /** Directory for the per-host lock files. Default = the machine-wide pod lease dir (shared by every universe on this machine). */
+  dir?: string;
+  retryMs?: number;
+  /** A lock older than this is a crash leftover. Default = ship timeout ⊕ import timeout ⊕ 2 min. */
+  staleMs?: number;
+  maxTries?: number;
+}
+
+export function imageShipLockPath(host: string, dir: string = join(hostLeaseBaseDir(), 'image-ship')): string {
+  return join(dir, `${host.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 120) || 'host'}.lock`);
+}
+
 /**
  * 원격 노드에 이 기계의 이미지를 보낸다(판이 다를 때만) — `docker save | ssh docker load` ⊕ `k3d image import`.
  * ⛔ Pod 의 elanous 는 이미지 판이다(피드백: Pod 는 main 이 아니라 이미지를 돈다) — 노드마다 판이 다르면 같은 골이 노드마다 다른 코드로 돈다.
+ * 🩸 10-08 flood: many runs saw the same stale label at once and all shipped together — ssh refused them
+ *   (`Session open refused by peer` · `kex_exchange_identification`). Now:
+ *   ① «same image» = commit label OR (label missing) the same image ID on both sides — never ship it twice.
+ *   ② one ship per host, under a cross-process lock; whoever gets the lock re-checks and skips if another process shipped.
+ *   ③ the ship pipeline runs in its own process group (`runProcessGroupPipeline`).
  */
-export function syncPoolImage(member: PodPoolMember, image: string, localCommit: string | null, run: RemoteRun | { run?: RemoteRun; inspect?: LocalImageInspect; transfer?: ImageShip } = defaultRemoteRun): { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string } {
-  const opts = typeof run === 'function' ? { run } : { run: run.run ?? defaultRemoteRun, inspect: run.inspect, transfer: run.transfer };
+export function syncPoolImage(member: PodPoolMember, image: string, localCommit: string | null, run: RemoteRun | { run?: RemoteRun; inspect?: LocalImageInspect; inspectId?: LocalImageInspect; transfer?: ImageShip; lock?: ImageShipLockOptions } = defaultRemoteRun): { ok: boolean; action: 'local' | 'fresh' | 'built' | 'shipped' | 'failed'; detail: string } {
+  const opts = typeof run === 'function' ? { run } : { run: run.run ?? defaultRemoteRun, inspect: run.inspect, inspectId: run.inspectId, transfer: run.transfer, lock: run.lock };
   const remote = opts.run ?? defaultRemoteRun;
   const inspect = opts.inspect ?? defaultLocalImageInspect;
+  // An injected label inspect without an ID inspect = a hermetic caller: the ID check is off (no real docker call).
+  const inspectId = opts.inspectId ?? (opts.inspect ? null : defaultLocalImageId);
   const transfer = opts.transfer ?? defaultImageShip;
   if (!member.sshHost) return { ok: true, action: 'local', detail: 'this machine' };
+  const host = member.sshHost;
   const before = remoteImageCommit(member, image, remote);
   if (localCommit && before === localCommit) return { ok: true, action: 'fresh', detail: before.slice(0, 12) };
   // 통째 전송은 이 기계 이미지의 커밋 라벨이 목표와 같을 때만. 다르면 낡은 판을 보내지 않는다.
   const here = localImageCommit(image, inspect);
   if (localCommit && here !== localCommit) return { ok: false, action: 'failed', detail: '로컬 이미지 판이 다르다 · 보내지 않음' };
-  const ship = transfer(member, image);
-  if (ship.status !== 0) return { ok: false, action: 'failed', detail: `docker load rc=${ship.status}: ${(ship.stderr ?? '').slice(-300)}` };
-  const imp = remote(member.sshHost, `k3d image import ${image} -c ${member.k3dCluster}`);
-  if (imp.status !== 0) return { ok: false, action: 'failed', detail: `k3d import rc=${imp.status}: ${imp.stderr.slice(-300)}` };
-  const after = remoteImageCommit(member, image, remote);
-  return after && (!localCommit || after === localCommit)
-    ? { ok: true, action: 'shipped', detail: `${before?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)}` }
-    : { ok: false, action: 'failed', detail: `보낸 뒤 판이 ${after ?? '없음'} — 기대 ${localCommit ?? '?'}` };
+  const localId = inspectId ? imageIdFrom(inspectId(image)) : null;
+  /** Fresh = the commit label matches, or the very same image (ID) is already there. Null = not fresh. */
+  const freshDetail = (label: string | null): string | null => {
+    if (localCommit && label === localCommit) return label.slice(0, 12);
+    if (localId && remoteImageId(member, image, remote) === localId) return `same image id ${localId.slice(7, 19)}`;
+    return null;
+  };
+  const sameId = freshDetail(before);
+  if (sameId) {
+    debug.log('pod.pool', 'image-ship-skipped-same-id', { host, image, localCommit, remoteCommit: before, detail: sameId });
+    return { ok: true, action: 'fresh', detail: sameId };
+  }
+
+  const lockOpts = opts.lock ?? {};
+  const retryMs = lockOpts.retryMs ?? 2_000;
+  const staleMs = lockOpts.staleMs ?? IMAGE_SHIP_TIMEOUT_MS + REMOTE_RUN_TIMEOUT_MS + 120_000;
+  const lockDir = lockOpts.dir ?? join(hostLeaseBaseDir(), 'image-ship');
+  const lockPath = imageShipLockPath(host, lockDir);
+  const t0 = Date.now();
+  let waited = false;
+  let release: () => void;
+  try {
+    mkdirSync(lockDir, { recursive: true });
+    release = acquireLockSync(lockPath, {
+      staleMs,
+      retryBusyMs: retryMs,
+      maxTries: lockOpts.maxTries ?? Math.ceil(staleMs / retryMs) + 10,
+      breakDeadHolder: true,
+      onWait: (holder) => { waited = true; debug.log('pod.pool', 'image-ship-lock-wait', { host, image, lockPath, holder }); },
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    debug.log('pod.pool', 'image-ship-lock-failed', { host, image, lockPath, reason }, { level: 'warn' });
+    return { ok: false, action: 'failed', detail: `image ship lock: ${reason}` };
+  }
+  try {
+    debug.log('pod.pool', 'image-ship-lock-acquired', { host, image, lockPath, waited, waitedMs: Date.now() - t0 });
+    // ⭐ Re-check after the lock: the holder we waited for may have shipped this very image.
+    const labelNow = waited ? remoteImageCommit(member, image, remote) : before;
+    const fresh = waited ? freshDetail(labelNow) : null;
+    if (fresh) {
+      debug.log('pod.pool', 'image-ship-skipped-fresh-after-wait', { host, image, localCommit, remoteCommit: labelNow, detail: fresh, waitedMs: Date.now() - t0 });
+      return { ok: true, action: 'fresh', detail: `${fresh} (shipped by another process while waiting)` };
+    }
+    const ship = transfer(member, image);
+    if (ship.status !== 0) return { ok: false, action: 'failed', detail: `docker load rc=${ship.status}: ${(ship.stderr ?? '').slice(-300)}` };
+    // The import phase gets its own stale window (the lock file's age restarts here).
+    try { const now = new Date(); utimesSync(lockPath, now, now); } catch { /* lock gone · finish anyway */ }
+    const imp = remote(host, `k3d image import ${image} -c ${member.k3dCluster}`);
+    if (imp.status !== 0) return { ok: false, action: 'failed', detail: `k3d import rc=${imp.status}: ${imp.stderr.slice(-300)}` };
+    const after = remoteImageCommit(member, image, remote);
+    return after && (!localCommit || after === localCommit)
+      ? { ok: true, action: 'shipped', detail: `${labelNow?.slice(0, 12) ?? '없음'} → ${after.slice(0, 12)}` }
+      : { ok: false, action: 'failed', detail: `보낸 뒤 판이 ${after ?? '없음'} — 기대 ${localCommit ?? '?'}` };
+  } finally {
+    release();
+  }
 }
 
 export type PoolKubectl = (args: readonly string[], input?: string) => { status: number | null; stdout: string; stderr: string };

package/src/task-orchestrator/surfaces/self-implement-pod.ts

@@ -59,6 +59,8 @@ import { homedir } from 'node:os';
 import { isAbsolute, join, normalize, relative, resolve, sep } from 'node:path';
 import { findGitDir } from '../../git-fs/locate.js';
 import { debug } from '../../debug/log.js';
+import { enterJourneyNode, exitJourneyNode, passJourneyNode } from '../../self-dev/graph-journey-nodes.js';
+import { routeJourneyEdge } from '../../self-dev/graph-journey-route.js';
 import { selectLiveDetail } from '../../live/detail-switch.js';
 import { authStorePath } from '../../oauth/store.js';
 import { grokAuthFilePath, isGrokSubscriptionExpiring, refreshGrokSubscriptionToken, resolveGrokCredential } from '../../grok/credential.js';
@@ -1066,9 +1068,27 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         : { exitCode: null, output: '', error: { code: 'aborted', message: 'aborted before a pool slot opened' } };
       const unfitDone = await unfitFailure();
       if (unfitDone) return unfitDone;
-      if (!await acquireAdmission()) return admissionFailure();
-      let member: PodPoolMember | null = await acquireSlot();
-      if (options.pool && !member) return { exitCode: null, output: '', error: { code: 'aborted', message: 'aborted before a pool slot opened' } };
+      // HARNESS-FULL-GRAPH — Pod 입장(입장 관문 ⊕ 멤버 슬롯)은 그래프 노드 pool-admit 이다.
+      // 2판: decompose →(substrate=pod) pool-admit 간선은 «여기»(Pod 입장 직전 · 실제 단계 경계)에서 남긴다.
+      routeJourneyEdge('decompose', 'pod', { substrate: 'pod' });
+      enterJourneyNode('pool-admit', { provenance: 'self-implement-pod', data: { spaceId: input.spaceId } });
+      // ⛔ 감싸는 함수(async 래퍼)를 쓰지 않는다 — 마이크로태스크가 늘면 Job apply 순서가 밀린다(시험이 잡았다). 같은 자리 try/catch 로.
+      const podAdmitError = (error: unknown): void => {
+        exitJourneyNode('pool-admit', { provenance: 'self-implement-pod', outcome: 'error', data: { spaceId: input.spaceId, error: error instanceof Error ? error.message : String(error) } });
+      };
+      let admitted: boolean;
+      try { admitted = await acquireAdmission(); } catch (error) { podAdmitError(error); throw error; }
+      if (!admitted) {
+        exitJourneyNode('pool-admit', { provenance: 'self-implement-pod', outcome: 'refused', data: { spaceId: input.spaceId, reason: 'admission' } });
+        return admissionFailure();
+      }
+      let member: PodPoolMember | null;
+      try { member = await acquireSlot(); } catch (error) { podAdmitError(error); throw error; }
+      if (options.pool && !member) {
+        exitJourneyNode('pool-admit', { provenance: 'self-implement-pod', outcome: 'refused', data: { spaceId: input.spaceId, reason: 'no-slot' } });
+        return { exitCode: null, output: '', error: { code: 'aborted', message: 'aborted before a pool slot opened' } };
+      }
+      exitJourneyNode('pool-admit', { provenance: 'self-implement-pod', outcome: 'admitted', data: { spaceId: input.spaceId, ...(member ? { context: member.context } : {}) } });
       const currentContext = member ? null : baseKubectl(['config', 'current-context']);
       let context = member?.context ?? (currentContext?.status === 0 ? currentContext.stdout.trim() : '');
       const kubectl: Kubectl = (args, stdin) => baseKubectl(['--context', context, ...args], stdin);
@@ -1135,10 +1155,17 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         };
         const candidates = grok ? [] : plannedCodexAccounts ?? [plannedAccount];
         const usable: Array<{ name: string; credential: ReturnType<typeof accountCredentials> }> = [];
-        for (const candidate of candidates) {
-          const credential = await podCodexCredentialWithPrerefresh(candidate, prerefreshDeps);
-          if (credential) usable.push({ name: candidate, credential });
+        enterJourneyNode('credential-refresh', { provenance: 'self-implement-pod', data: { spaceId: input.spaceId, candidates: candidates.length } });
+        try {
+          for (const candidate of candidates) {
+            const credential = await podCodexCredentialWithPrerefresh(candidate, prerefreshDeps);
+            if (credential) usable.push({ name: candidate, credential });
+          }
+        } catch (error) {
+          exitJourneyNode('credential-refresh', { provenance: 'self-implement-pod', outcome: 'error', data: { spaceId: input.spaceId, error: error instanceof Error ? error.message : String(error) } });
+          throw error;
         }
+        exitJourneyNode('credential-refresh', { provenance: 'self-implement-pod', outcome: grok || usable.length > 0 ? 'usable' : 'exhausted', data: { spaceId: input.spaceId, usable: usable.length } });
         if (!grok && usable.length === 0) throw new Error(`openai-codex 후보(${candidates.join(', ')}) access token 이 전부 3시간 안에 만료 — 선갱신도 못 했다(본부 임대 없음 또는 갱신 실패 · pod.credential-prerefresh 를 보라)`);
         const account = grok ? plannedAccount : usable[0]!.name;
         if (account !== plannedAccount) debug.log('self-implement.pod', 'account-skipped-expiring', { spaceId: input.spaceId, from: plannedAccount, to: account });
@@ -1725,6 +1752,12 @@ export function podSelfImplementSpawn(options: PodSpawnOptions = {}): SelfImplem
         // SCHED-CONTRACT: a failed child must say why outside the Pod, not «no error diagnostic».
         const podReason = podExitCode === 1 ? extractPodFailureReason({ logs, logTailReason, containerReason, jobReason: failedReason || undefined, deadlineSeconds, result: disposition ? { stage: disposition.stage, prUrl: disposition.prUrl ?? null, prNumber: disposition.prNumber ?? null } : null }) : undefined;
         if (podReason) debug.log('self-implement.pod', 'failure-reason', { job: name, reason: podReason });
+        if (podExitCode === 1) {
+          // HARNESS-FULL-GRAPH — 실패 쪽 두 노드: 결과 해석(result-parse) → 수확(salvage, Pod Job 이 push 한 줄로 판정).
+          passJourneyNode('result-parse', { provenance: 'self-implement-pod', outcome: podReason ? 'parsed' : 'no-reason', data: { job: name } });
+          const salvageOutcome = /^ELANOUS_POD_SALVAGE \S+ \S+$/m.test(logs) ? 'pushed' : logs.includes('ELANOUS_POD_SALVAGE_NONE') ? 'none' : 'unknown';
+          passJourneyNode('salvage', { provenance: 'self-implement-pod', outcome: salvageOutcome, data: { job: name } });
+        }
         return {
           exitCode: podExitCode,
           output: tail,

package/src/task-orchestrator/surfaces/self-implement.ts

@@ -55,6 +55,8 @@ export interface SelfImplementDisposition {
   prNumber?: number;
   /** Head SHA checked by the Pod before host regate. */
   checkedHeadCommit?: string;
+  /** Review verdict only when the child bound a real pass to a clean, unchanged worktree head. */
+  selfReview?: { verdict: 'pass'; head: string };
   hostRegate?: { passed: boolean; failures: Array<{ step: string; detail: string }>; os: string };
   merged?: boolean;
   detail?: string;
@@ -469,6 +471,11 @@ export function parseSelfImplementJson(stdout: string): SelfImplementDisposition
         ...(typeof o.prUrl === 'string' ? { prUrl: o.prUrl } : {}),
         ...(typeof o.prNumber === 'number' ? { prNumber: o.prNumber } : {}),
         ...(typeof o.checkedHeadCommit === 'string' ? { checkedHeadCommit: o.checkedHeadCommit } : {}),
+        ...(o.reviewedHeadCommit && typeof o.reviewedHeadCommit === 'string' && /^[0-9a-f]{40}$/i.test(o.reviewedHeadCommit)
+          && o.review && typeof o.review === 'object' && !Array.isArray(o.review)
+          && (o.review as { reviewed?: unknown; verdict?: unknown }).reviewed === true
+          && (o.review as { verdict?: unknown }).verdict === 'pass'
+          ? { selfReview: { verdict: 'pass' as const, head: o.reviewedHeadCommit } } : {}),
         ...(typeof o.hostRegate === 'object' && o.hostRegate !== null ? { hostRegate: o.hostRegate as SelfImplementDisposition['hostRegate'] } : {}),
         ...(typeof o.merged === 'boolean' ? { merged: o.merged } : {}),
         ...(typeof o.detail === 'string' ? { detail: o.detail } : {}),

package/src/telegram-commands.ts

@@ -56,6 +56,8 @@ import { telegramDecisionOwner } from './decisions/telegram-decision-cards.js';
 import { CardStore } from './task-cards/card-store.js';
 import type { ContextNowDeps } from './context-bus/context-now.js';
 import type { RunningRunsResult } from './self-implement/running-runs.js';
+import { checklistBoardSlash } from './release-loop/checklist-board.js';
+import type { Checklist } from './release-loop/checklist.js';
 
 /** How many prior user/assistant turns to pass into `executeSkill` as
  *  the `## Recent conversation` block. Mirrors the dashboard default
@@ -348,6 +350,7 @@ export function defaultTelegramCommands(
   coreCommands: readonly SlashCommand[] = SLASH_COMMANDS,
   maturity: { tuiSlash: Readonly<Record<string, Maturity>>; telegramCommand: Readonly<Record<string, Maturity>>; discordCommand: Readonly<Record<string, Maturity>> } = FEATURE_MATURITY,
   runningRunsQuery?: () => RunningRunsResult,
+  checklistRead?: (version: string) => Checklist,
 ): TgSlashCommand[] {
   const handled: TgSlashCommand[] = [
     {
@@ -376,6 +379,11 @@ export function defaultTelegramCommands(
       description: 'Running harness runs — same output as TUI /harness runs',
       handler: async (args) => telegramRunsSlash(args, runningRunsQuery),
     },
+    {
+      name: 'board',
+      description: '판 체크리스트 — /board [판]',
+      handler: async (args) => checklistBoardSlash(args, checklistRead),
+    },
     {
       name: 'release',
       description: '발행 현황 — 지금 런·노드·막힘을 한 통으로',

package/src/telegram-project-command.ts

@@ -121,6 +121,12 @@ export function attachTelegramProjectButtons(
       await bot.answerCallbackQuery(q.id, { text: '개인 대화에서만 고를 수 있습니다' });
       return;
     }
+    // Reject callbacks outside Telegram's 64-byte limit and empty project ids.
+    if (Buffer.byteLength(q.data, 'utf8') > 64 || q.data.length === 4) {
+      debug.log('telegram.project', 'button-rejected', { reason: 'invalid-callback-data', chatId: q.chatId });
+      await bot.answerCallbackQuery(q.id, { text: '프로젝트를 다시 골라 주세요' });
+      return;
+    }
     const chatId = q.chatId;
     const session = deps.findSession(chatId, q.threadId, bot.botId);
     if (!session) {

package/src/telegram.ts

@@ -81,7 +81,7 @@ import { maybeHandleCardPhoto, type CardPhotoDeps } from './telegram-card-follow
 import { attachTelegramProjectButtons } from './telegram-project-command.js';
 import { attachTelegramFabricPlan } from './telegram-fabric-plan.js';
 import { contextNow as readContextNow, type ContextNowDeps } from './context-bus/context-now.js';
-import { renderTelegramNow } from './context-bus/context-now-surfaces.js';
+import { renderContextFirstNow } from './context-bus/context-now-surfaces.js';
 import { createContextFirstGate, renderContextFirst } from './context-bus/context-first.js';
 
 export type TgAttachmentKind = 'photo' | 'voice' | 'audio' | 'document';
@@ -437,7 +437,7 @@ export class TelegramBot {
     const cfg = this.slashContext?.userConfig.telegram;
     if (cfg?.contextFirst === false) return;
     try {
-      await this.sendMessage(ctx.chatId, renderContextFirst(this.readContextNow, this.contextNowDeps, renderTelegramNow), { replyTo: ctx.messageId, threadId: ctx.threadId });
+      await this.sendMessage(ctx.chatId, renderContextFirst(this.readContextNow, this.contextNowDeps, renderContextFirstNow), { replyTo: ctx.messageId, threadId: ctx.threadId });
     } catch (err) {
       this.log(`telegram context-first failed: ${err instanceof Error ? err.message : String(err)}`);
     }

package/src/tool-runtime/browser-runtime.ts

@@ -16,6 +16,12 @@
 // D1). It holds a lazy singleton per elanous process: first call
 // spawns Chrome, subsequent calls reuse; the client lives until the
 // process exits or `closeBrowserRuntime()` is invoked.
+// BrowserRead remains read-only. An explicitly requested BrowserNavigate
+// input asks a person through the HITL confirmation channels only and fails
+// closed without approval. The shell-command approver is never consulted: an
+// unattended surface may auto-allow shell patterns, which must not type into a page.
+// Click still runs through performBrowserAction in src/harness/browser-act.ts,
+// where armed, reversibility and host-boundary checks precede CdpClient.click.
 
 import type { CdpClient } from '../browser-cdp/client.js';
 import { createCdpClient, CdpUnavailable } from '../browser-cdp/client.js';
@@ -24,6 +30,9 @@ import { defaultControlSignalBus } from '../input/control-signal.js';
 import type { LLMToolSpec } from '../llm.js';
 import { debug } from '../debug/log.js';
 import { getHarnessRunId } from '../harness/harness-space.js';
+import { decideTypeAction } from '../harness/browser-act-type.js';
+import { requestConfirmation } from '../hitl/confirm.js';
+import type { TypeTarget } from '../harness/bot-type-request.js';
 import type { ToolRuntime, ToolRuntimeContext } from './types.js';
 
 // ─── Dependency injection ───────────────────────────────────────
@@ -116,6 +125,8 @@ export async function closeBrowserRuntime(): Promise<void> {
 export interface BrowserNavigateArgs {
   /** Absolute URL. Scheme required. */
   url: string;
+  /** Input requires a selected target and explicit approval; no form submission. */
+  input?: { selector: string; text: string };
   /** When true, block until Page.loadEventFired (or timeoutMs).
    *  Default true. */
   waitForLoad?: boolean;
@@ -147,6 +158,16 @@ export function buildBrowserNavigateTool(): LLMToolSpec {
           type: 'string',
           description: 'Absolute URL including scheme (https://...). about:blank also accepted.',
         },
+        input: {
+          type: 'object',
+          description: 'Type into a selected page field only after explicit approval. Never submits a form.',
+          properties: {
+            selector: { type: 'string', description: 'CSS selector of the input field.' },
+            text: { type: 'string', description: 'Text without newlines (at most 200 characters).' },
+          },
+          required: ['selector', 'text'],
+          additionalProperties: false,
+        },
         waitForLoad: {
           type: 'boolean',
           description: 'Wait for Page.loadEventFired before returning. Default true.',
@@ -165,9 +186,33 @@ export function buildBrowserNavigateTool(): LLMToolSpec {
 const DEFAULT_NAV_TIMEOUT_MS = 10_000;
 const MAX_NAV_TIMEOUT_MS = 60_000;
 
-export async function dispatchBrowserNavigate(args: BrowserNavigateArgs): Promise<BrowserNavigateResult> {
+export async function dispatchBrowserNavigate(args: BrowserNavigateArgs, ctx?: ToolRuntimeContext): Promise<BrowserNavigateResult> {
   ensureBrowserControlSignalConsumer();
   const url = String(args.url ?? '').trim();
+  const input = args.input;
+  // Input is never an implicit side effect of navigation. Approval is scoped
+  // to this URL, selector and text, before connecting or dispatching CDP.
+  if (input !== undefined) {
+    if (typeof input.selector !== 'string' || !input.selector.trim()
+      || typeof input.text !== 'string' || !input.text.trim()
+      || /[\r\n]/.test(input.text) || input.text.length > 200) {
+      return { output: '# BrowserNavigate: invalid input', finalUrl: '', title: '', loadMs: 0 };
+    }
+    let httpUrl = false;
+    try { httpUrl = ['http:', 'https:'].includes(new URL(url).protocol); } catch { /* invalid URL */ }
+    if (!httpUrl) return { output: '# BrowserNavigate: invalid input URL', finalUrl: '', title: '', loadMs: 0 };
+    let approved = false;
+    try {
+      // Human confirmation only — `ctx.approver` is the shell-command approver (TC review of #24990).
+      approved = (await requestConfirmation({
+        prompt: `Browser input on ${url}`,
+        detail: `Selector: ${input.selector}\nText: ${input.text}`,
+        ...(ctx?.confirmChannels ? { channels: ctx.confirmChannels } : {}),
+        onTimeout: () => false,
+      })).answer === true;
+    } catch { /* approval failure is denial */ }
+    if (!approved) return { output: '# BrowserNavigate: input not approved', finalUrl: '', title: '', loadMs: 0 };
+  }
   if (!url) {
     observeBrowserAction({ action: 'navigate', url: '', target: 'url', ok: false, error: 'url is required' });
     return { output: '# BrowserNavigate: error\nurl is required', finalUrl: '', title: '', loadMs: 0 };
@@ -233,6 +278,45 @@ export async function dispatchBrowserNavigate(args: BrowserNavigateArgs): Promis
     timedOut = r.timedOut;
   }
 
+  if (input !== undefined) {
+    try {
+      if (!client.input) throw new Error('CDP input unavailable');
+      const currentUrl = await client.evaluate('document.location.href');
+      if (currentUrl !== new URL(url).href) throw new Error('CDP input refused: page URL changed after approval');
+      const inspected = await client.evaluate(`(() => {
+        const element = document.querySelector(${JSON.stringify(input.selector)});
+        if (!(element instanceof HTMLElement)) return null;
+        return { tag: element.tagName.toLowerCase(),
+          type: element instanceof HTMLInputElement ? element.type : null,
+          name: element.getAttribute('name'), id: element.getAttribute('id'),
+          contentEditable: element.isContentEditable, inForm: !!element.closest('form') };
+      })()`);
+      const candidate = inspected && typeof inspected === 'object' ? inspected as Record<string, unknown> : null;
+      const target: TypeTarget | null = candidate
+        && typeof candidate.tag === 'string'
+        && (candidate.type === null || typeof candidate.type === 'string')
+        && (candidate.name === null || typeof candidate.name === 'string')
+        && (candidate.id === null || typeof candidate.id === 'string')
+        && typeof candidate.contentEditable === 'boolean' && typeof candidate.inForm === 'boolean'
+        ? candidate as TypeTarget : null;
+      const verdict = decideTypeAction({ url, selector: input.selector, text: input.text,
+        // The caller's approval is for this exact URL; it cannot authorize a different host.
+        actionHosts: [new URL(url).hostname], armed: true, target });
+      if (!verdict.allowed) throw new Error(verdict.reason);
+      const focused = await client.evaluate(`(() => {
+        const element = document.querySelector(${JSON.stringify(input.selector)});
+        if (!(element instanceof HTMLElement)) return false;
+        element.focus();
+        return document.activeElement === element;
+      })()`);
+      if (focused !== true) throw new Error('CDP input target could not be focused');
+      await client.input(input.text);
+    } catch (err) {
+      return { output: `# BrowserNavigate: input error\n${err instanceof Error ? err.message : String(err)}`,
+        finalUrl: url, title: '', loadMs: Date.now() - started };
+    }
+  }
+
   const loadMs = Date.now() - started;
 
   // Best-effort metadata. Errors here don't abort the tool.
@@ -255,8 +339,8 @@ export async function dispatchBrowserNavigate(args: BrowserNavigateArgs): Promis
 export const browserNavigateRuntime: ToolRuntime<BrowserNavigateArgs, BrowserNavigateResult> = {
   id: 'browser_navigate',
   spec: buildBrowserNavigateTool(),
-  async run(req, _ctx: ToolRuntimeContext) {
-    return dispatchBrowserNavigate(req);
+  async run(req, ctx: ToolRuntimeContext) {
+    return dispatchBrowserNavigate(req, ctx);
   },
 };
 

package/src/tool-runtime/index.ts

@@ -177,6 +177,7 @@ export { setWorktreeRuntimeDeps } from './git-worktree-runtimes.js';
 export {
   setSelfImplementApprover,
   setSelfImplementRuntimeDeps,
+  setSelfImplementSoftStopSpaceObserver,
 } from '../self-implement/self-implement-runtime.js';
 export {
   setTerminalSessionsGetter,