elanous 0.2.22 → 0.2.23

package/src/self-implement/goal-author.ts

@@ -3,7 +3,7 @@ import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSy
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { dirname, isAbsolute, join, normalize, relative, resolve, sep } from 'node:path';
-import { groundMissionInCodebase, isRepositoryImplementationCandidate, type CodebaseGrounding } from '../autopilot/mission-codebase-gate.js';
+import { isRepositoryImplementationCandidate, type CodebaseGrounding } from '../autopilot/codebase-grounding.js';
 import { extractSlugSource, generateMissionSlug, slugify } from '../autopilot/mission-registry.js';
 import { enhancePrompt, type EnhanceOpts, type EnhanceResult } from '../prompt-enhance/enhance.js';
 import type { LLMUsage } from '../prompt-cache/types.js';
@@ -44,7 +44,7 @@ import { extractGoalDocSections, type GoalDocSourceLine } from './goal-doc/secti
 import { isGoalAuthorFileName } from './goal-document.js';
 import { resolveGoalDocumentsDir } from './goal-documents-dir.js';
 import { REQUIRED_EVIDENCE_COMMAND_SEPARATOR } from './off-diff-evidence.js';
-import { renderLaunchPreflight, siblingTestPath, type LaunchPreflightResult } from '../self-dev/launch-preflight.js';
+import { renderLaunchPreflight, siblingTestPath, type LaunchPreflightResult } from '../self-dev/launch-preflight-text.js';
 import { quoteShellArg } from '../cli/logs-cli.js';
 import type { HarnessGroundingProvenance } from './context-capsule.js';
 import { hasGoalStepCodeName } from './goal-step-code-name.js';
@@ -121,6 +121,21 @@ export interface GoalAuthorGroundingResult {
   facts: CodebaseGrounding;
 }
 
+// A function-local slot is initialized only on access, after cyclic ESM evaluation has finished.
+function goalAuthorGroundMissionSlot(): { fn?: NonNullable<GoalAuthorGroundingDeps['groundMission']> } {
+  const key = Symbol.for('elanous.goalAuthor.groundMission');
+  const registry = globalThis as typeof globalThis & { [key: symbol]: { fn?: NonNullable<GoalAuthorGroundingDeps['groundMission']> } };
+  return registry[key] ??= {};
+}
+
+export function registerGoalAuthorGroundMission(fn: NonNullable<GoalAuthorGroundingDeps['groundMission']> | undefined): void {
+  goalAuthorGroundMissionSlot().fn = fn;
+}
+
+export function hasGoalAuthorGroundMission(): boolean {
+  return goalAuthorGroundMissionSlot().fn !== undefined;
+}
+
 export interface GoalAuthorPersistentGroundingDecision {
   readonly enabled: boolean;
   readonly source: ObserveOnlySource;
@@ -5583,12 +5598,17 @@ export async function groundForGoalAuthor(
   cwd: string,
   deps: GoalAuthorGroundingDeps = {},
 ): Promise<GoalAuthorGroundingResult> {
+  const groundMission = deps.groundMission ?? goalAuthorGroundMissionSlot().fn;
+  if (!groundMission) {
+    debug.log('goal-author.grounding', 'route-unregistered', { cwd });
+    throw new Error('route-unregistered: mission-codebase-gate 를 로드하라');
+  }
   return {
     path: 'groundMissionInCodebase',
     // ⛔⭐ 사람이 ask 에 «이름을 댄» 경로를 접지에 «넘긴다» — 접지가 그것을 후보로 쓴다.
     //   ⛔ 추출기를 «새로 만들지 않는다» — 이 파일이 이미 갖고 있는 askPathTokens 하나를 쓴다
     //     (2026-08-11 72차: 같은 것에 두 이름을 준 병을 하루에 여섯 번 셌다).
-    facts: await (deps.groundMission ?? groundMissionInCodebase)(ask, {
+    facts: await groundMission(ask, {
       cwd,
       seedPaths: askPathTokens(ask),
       ...(deps.persistent !== undefined ? { persistent: deps.persistent } : {}),
@@ -5694,7 +5714,7 @@ export function defaultGoalAuthorDeps(cwd: string): GoalAuthorDeps {
      *   이 칸을 «안 주므로» 기본값 `coverage-gate` 로 종전 문면을 그대로 받는다.
      */
     enhance(ask, opts) {
-      return enhancePrompt(ask, { ...opts, checklistUse: 'authoring' });
+      return enhancePrompt(ask, { ...opts, checklistUse: 'authoring', config: opts?.config ?? getUserConfig() });
     },
     readSourceFile: createRepositoryReferencedFileReader(cwd),
     runHelpProbe: (argv) => runDefaultHelpProbe(cwd, argv),

package/src/self-implement/goal-digest.ts

@@ -89,6 +89,25 @@ function scaled(limit: number): { reserved: number; minSection: number } {
   return { reserved: Math.floor(RESERVED_FOR_NOTICE * k), minSection: Math.max(40, Math.floor(MIN_SECTION_CHARS * k)) };
 }
 
+/** 골 문서에서 `판정 신호` 절만 뽑아 리뷰 acceptance 로 쓴다. 계보 = self-implement seams. */
+export function extractHarnessReviewAcceptance(goalDocument: string | undefined): { goal: string | undefined; acceptance: string | undefined } {
+  let goal: string | undefined;
+  try {
+    goal = goalDocument?.trim() || undefined;
+  } catch {
+    return { goal: undefined, acceptance: undefined };
+  }
+  if (!goal) return { goal: undefined, acceptance: undefined };
+  try {
+    const acceptance = splitGoalSections(supervisorGoalDigest(goal, 3000).text)
+      .find((section) => isSupervisorDecisionSection(section.title) && section.title.includes('판정 신호'))
+      ?.body.trim() || undefined;
+    return { goal, acceptance };
+  } catch {
+    return { goal, acceptance: undefined };
+  }
+}
+
 /** `## <제목>` 기준으로 절을 가른다. 헤더 앞 서두는 제목 `''` 로 담는다. */
 export function splitGoalSections(goal: string): Section[] {
   return extractGoalDocSections(goal, {

package/src/self-implement/graph-overlay-condition.ts

@@ -53,6 +53,10 @@ export function evaluateOverlayCondition(
   const { key, operator, literal } = parsed.condition;
   if (!(key in state)) return { kind: 'key-absent', key };
   const actual = state[key];
+  if (actual === undefined || actual === null) return { kind: 'key-absent', key };
+  // Measured boolean branch keys accept only a real boolean observation — any textual lookalike
+  // ('true', 'TRUE', 'yes', 1) is unknown, whatever the literal spelling in the condition.
+  if ((key === 'sibling_overlap' || key === 'main_sync_conflict') && typeof actual !== 'boolean') return { kind: 'key-absent', key };
 
   if (typeof literal === 'number') {
     // ⛔ 수 비교인데 값이 수가 아니면 「비교 불가」다 — 거짓으로 접지 않는다.

package/src/self-implement/headless-elanous-driver.ts

@@ -996,8 +996,8 @@ export interface HeadlessGoalLoopPtyOptions {
   /** 밖에서 쓴 이력 조회 심 — 기본은 실물(`pty-control-ipc`). ⭐ 테스트가 전역을 찌르지 않게
    *  `spawn`·`ptyAvailable` 과 **같은 방식**으로 주입한다(새 패턴 아님 · 테스트 전용 export 도 아님). */
   externalWriteProvenance?: (ptyId: string) => { externalWrites: number; externalWriteAgoMs: number; externalWriteActor: string } | undefined;
-  /** ★S4 P2b — brain 상담 1회 최대 대기(ms·기본 15초). 초과 시 abort + fail-soft(`brain.fail`).
-   *  ⚠️ **테스트 seam 겸용**(리뷰 must-fix — 이게 없으면 timeout fail-soft 경로를 15초 없이 검증할 수
+  /** ★S4 P2b — brain 상담 1회 최대 대기(ms·기본 45초). 초과 시 abort + fail-soft(`brain.fail`).
+   *  ⚠️ **테스트 seam 겸용**(리뷰 must-fix — 이게 없으면 timeout fail-soft 경로를 45초 없이 검증할 수
    *  없다). 프로덕션은 기본값을 쓴다(호출부 미지정). */
   brainTimeoutMs?: number;
   /** ★S4 P3 **관측 시계 seam**(테스트 전용·기본 `Date.now`).
@@ -1520,8 +1520,8 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
     let previousStallMetrics: { toolCalls: number; chars: number } | undefined;
     let keyframeSeq = 0; // 이 run 의 키프레임 순번(파일 키·seq 순 추출).
     // ⭐⭐ **wall-clock 상한**(리뷰 must-fix 2026-07-26) — 이 루프의 회계는 `i`(≈초·pollMs≈1000ms 가정)
-    //   기반이다. S4 P2b brain 상담이 tick 당 최대 `brainTimeoutMs`(기본 15초)를 **직렬 await** 하므로
-    //   전이가 반복되면 1 tick 이 ~16초가 되어 `maxWaitSec` 계약을 **최대 16배 초과**한다(600s → ~2.7h).
+    //   기반이다. S4 P2b brain 상담이 tick 당 최대 `brainTimeoutMs`(기본 45초)를 **직렬 await** 하므로
+    //   전이가 반복되면 1 tick 이 ~46초가 되어 `maxWaitSec` 계약을 초과할 수 있다.
     //   ⇒ 기존 활동-grace 의미(i 기반)는 **그대로 두고** 절대 경과시간을 **추가 상한**으로만 얹는다.
     //   단조 안전: 더 **일찍** 멈출 뿐 늦게 멈추는 경우가 없다. brain 미주입이면 i≈초라 두 조건이 일치
     //   (무회귀). ROADMAP §2 P1(종료 지연)의 회계 구조를 재작성하지 않는 최소 개입이다.
@@ -1563,7 +1563,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
         debug.log('self-implement', 'poll.heartbeat', { ptyId, runId, i, alive: h.isAlive(), lastActivityI, silentFor, ...parentObservation });
       }
       // #24 finer 마커 — stall 시 "poll 루프 안(자식 구동·정상)" vs "다른 동기 op" 구분.
-      setEventLoopActivity(`headless:poll-${i}:alive-${h.isAlive() ? 1 : 0}`);
+      setEventLoopActivity(`headless:poll:alive-${h.isAlive() ? 1 : 0}`);
       const delta = h.drainDelta();
       phase = 'snapshot';
       const snap = h.snapshot();   // ★ 1회 캡처 — 화면 릴레이 + GOAL-COMPLETE 공용(중복 snapshot 제거)
@@ -1697,6 +1697,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                 if (opts.signal?.aborted) onBrainAbort();
                 else opts.signal?.addEventListener('abort', onBrainAbort, { once: true });
                 let timer: ReturnType<typeof setTimeout> | undefined;
+                const brainStartedMs = Date.now();
                 try {
                   // Lost and unknown are the same ownership axis exercised by the stalled-screen
                   // tests, not separate stances. Preserve their measured ownership and observation
@@ -1709,12 +1710,12 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                     Promise.resolve(opts.brain.decide(controlObs, controller.signal)),
                     new Promise<ControlDecision>((_, reject) => {
                       // ⭐ **남은 절대 예산으로 clamp**(리뷰 must-fix 2R) — wall-clock 상한은 **tick 시작**에서만
-                      //   검사하므로, deadline 직전에 시작된 상담이 그대로면 최대 brainTimeoutMs(기본 15초)만큼
+                      //   검사하므로, deadline 직전에 시작된 상담이 그대로면 최대 brainTimeoutMs(기본 45초)만큼
                       //   hard deadline 을 **초과**한다. 상담 자체를 남은 예산 안으로 묶어 창을 닫는다.
                       //   최소 1ms(음수·0 이면 즉시 timeout → 다음 tick 상단 wall-clock 체크가 루프를 끊는다).
                       const remainMs = Math.max(1, hardI * 1000 - (Date.now() - loopStartedMs));
                       timer = setTimeout(() => { controller.abort(); reject(new Error('brain suggestion timeout')); },
-                        Math.min(opts.brainTimeoutMs ?? 15_000, remainMs));
+                        Math.min(opts.brainTimeoutMs ?? 45_000, remainMs));
                     }),
                     ...(parentAbort ? [parentAbort] : []),
                   ]);
@@ -1761,6 +1762,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                     // 관측 계약은 화면 분류 원문을 보존한다. 완료 정보량·자동 정지는 아래의
                     // `completionState` 폐쇄형 정규화만 소비하므로 blocked/idle 기록을 잃지 않는다.
                     ptyId: h.id, runId, moment: 'in-round', step: i, trigger, state: curState, action: decision.action,
+                    durationMs: Date.now() - brainStartedMs,
                     // `delivery-outcome` is a follow-up observation, not another verdict. Consumers count
                     // either initial stage once per decision and can distinguish verdicts without input.
                     supervisionRecordStage: decision.action === 'input' ? 'verdict-input' : 'verdict-no-input',
@@ -1848,7 +1850,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                   }
                 } catch (e) {
                   // Parent cancel outranks suggestion observation: leave the poll loop immediately so PTY cleanup is not
-                  // held by the 15s consultation timeout, even when a custom brain ignores its AbortSignal.
+                  // held by the 45s consultation timeout, even when a custom brain ignores its AbortSignal.
                   if (opts.signal?.aborted) {
                     timedOut = false;
                     exitReason = 'abort';
@@ -1856,7 +1858,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                   }
                   debug.log('self-implement', 'brain.fail', {
                     ptyId: h.id, runId, step: i, trigger, state: curState,
-                    roundContextPresent,
+                    roundContextPresent, durationMs: Date.now() - brainStartedMs,
                     error: String(e instanceof Error ? e.message : e).slice(0, 120),
                   });
                 } finally {

package/src/self-implement/host-regate.ts

@@ -1,7 +1,7 @@
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
 import { getUserConfig } from '../user-config.js';
 import { publicExposureFiles, runExposeGate } from './expose-gate.js';
@@ -9,23 +9,32 @@ import { admitLandingMerge } from './frozen-merges.js';
 import { releaseGitDiffPaths, releasePathHold, releasePathHoldShouldPost, releasePathHoldComment, releasePathHoldCommentsArgs, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { detectTestInterference, parseFailureCount, runBunTest } from '../../scripts/detect-test-interference.js';
 import { MAX_INSPECTED_TEST_FILES, runTestInterferenceGate } from '../../scripts/ci-test-interference-gate.js';
+import { pwaGraph, pwaReach } from '../../scripts/ci-pwa-build-gate.js';
+
+/** Use pr-land's PWA reachability (including its undecidable-graph build fallback), not a blanket src/** trigger. */
+export function needsPwaBuild(files: readonly string[], repoRoot: string, graph: (root: string) => ReturnType<typeof pwaGraph> = pwaGraph): boolean {
+  return pwaReach(files, () => graph(repoRoot)).reaches;
+}
 
 /**
- * The PWA's static build type-checks every `src/**` file it imports, under Next's stricter
- * `ProcessEnv` — a change that only touches `src/**` can break it while tsc and bun test stay
- * green (2026-09-27: two such changes kept main's PWA build red for two hours). Build whenever
- * app code or non-test source changed; test files are never imported by the PWA.
+ * Give a temporary checkout the source checkout's dependencies: link `<dir>/node_modules` when it is really installed
+ * there (its `marker` package exists), otherwise install into the candidate. Shared by host regate and the task agent's
+ * land worktree (TA-LAND-WORKTREE).
  */
-export function needsPwaBuild(files: readonly string[]): boolean {
-  return files.some((file) => file.startsWith('apps/pwa/') || (file.startsWith('src/') && !/\.test\.tsx?$/.test(file)));
+export function provideCheckoutDependencies(candidate: string, sourceRoot: string, dir: string, marker: string, install: (cwd: string) => void): void {
+  if (existsSync(join(candidate, dir, 'node_modules'))) return;
+  if (existsSync(join(sourceRoot, dir, 'node_modules', marker, 'package.json'))) {
+    symlinkSync(join(sourceRoot, dir, 'node_modules'), join(candidate, dir, 'node_modules'), 'dir');
+  } else install(join(candidate, dir));
 }
 
-export interface HostRegateInput { prNumber: number; headCommit: string; repoRoot: string; goalFile?: string; verifyOnly?: boolean; /** Called by a resume sweep that already holds this PR's claim. */ resumed?: true }
+export interface HostRegateInput { prNumber: number; headCommit: string; repoRoot: string; goalFile?: string; verifyOnly?: boolean; /** TA-LIVE-LAND-2: run the full landing gates (release-path hold · neighbours · PR re-read) but stop before the freeze admission and `gh pr merge` — the task agent lands it later via `pr land --expected-head`. */ noMerge?: true; /** Called by a resume sweep that already holds this PR's claim. */ resumed?: true }
 export interface HostRegateResult { passed: boolean; failures: Array<{ step: string; detail: string }>; os: string; status?: 'passed' | 'failed' | 'unmeasured' | 'frozen'; /** verifyOnly: 실제로 얹어 잰 base 끝 */ baseCommit?: string }
 export type InterferenceVerdict = { passed: boolean; detail?: string; unmeasured?: boolean; /** neighbour tests left out so the selection fits the inspection cap */ neighborsTrimmed?: number };
 export type HostRegateDeps = {
   command?: (bin: string, args: readonly string[], cwd: string, env?: NodeJS.ProcessEnv) => { status: number | null; stdout: string; stderr: string };
   interference?: (files: readonly string[], cwd: string) => Promise<InterferenceVerdict>;
+  /** Legacy injection for callers that supply an ephemeral worktree instead of a locked slot. */
   makeTemp?: () => string;
   removeTemp?: (path: string) => void;
   acquire?: (repoRoot: string) => Promise<() => void>;
@@ -104,7 +113,7 @@ function slotOwnerAlive(slot: string): boolean {
   }
 }
 
-export async function acquireSlot(repoRoot: string, opts: { waitMs?: number; pollMs?: number; now?: () => number } = {}): Promise<() => void> {
+export async function acquireSlot(repoRoot: string, opts: { waitMs?: number; pollMs?: number; now?: () => number } = {}): Promise<(() => void) & { worktree: string }> {
   const gitDir = spawnSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], { cwd: repoRoot, encoding: 'utf8' });
   if (gitDir.status !== 0 || !gitDir.stdout.trim()) throw new Error('git common directory unavailable for host regate lock');
   const root = join(gitDir.stdout.trim(), 'elanous-host-regate');
@@ -117,7 +126,7 @@ export async function acquireSlot(repoRoot: string, opts: { waitMs?: number; pol
       try {
         mkdirSync(slot);
         writeFileSync(join(slot, 'pid'), String(process.pid));
-        return () => rmSync(slot, { recursive: true, force: true });
+        return Object.assign(() => rmSync(slot, { recursive: true, force: true }), { worktree: join(root, `worktree-${i}`) });
       } catch (error) {
         if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
         // A slot left by a crashed host process would otherwise block every later run.
@@ -133,6 +142,24 @@ export async function acquireSlot(repoRoot: string, opts: { waitMs?: number; pol
   }
 }
 
+function removeBrokenSlotRegistration(repoRoot: string, worktree: string): void {
+  const gitDir = spawnSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], { cwd: repoRoot, encoding: 'utf8' });
+  if (gitDir.status !== 0 || !gitDir.stdout.trim()) throw new Error('git common directory unavailable for slot repair');
+  const registrations = join(gitDir.stdout.trim(), 'worktrees');
+  if (!existsSync(registrations)) return;
+  for (const name of readdirSync(registrations)) {
+    const registration = join(registrations, name);
+    if (!lstatSync(registration).isDirectory()) continue;
+    const pointer = join(registration, 'gitdir');
+    if (!existsSync(pointer) || lstatSync(pointer).isSymbolicLink()) continue;
+    if (resolve(readFileSync(pointer, 'utf8').trim()) !== resolve(worktree, '.git')) continue;
+    rmSync(registration, { recursive: true });
+  }
+}
+
+/** Callers: podSelfImplementSpawn in src/task-orchestrator/surfaces/self-implement-pod.ts calls
+ *  (options.hostRegate ?? runHostRegate)({ prNumber, headCommit, repoRoot: hostRoot, ... });
+ *  sweepFrozenMerges in frozen-merges.ts also calls runHostRegate(entry); landing queue serialization stays there. */
 export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps = {}): Promise<HostRegateResult> {
   const command = deps.command ?? defaultCommand;
   const log = deps.log ?? ((event: 'passed' | 'failed' | 'unmeasured' | 'base-raced', data: Record<string, unknown>) => debug.log('harness.host-regate', event, data));
@@ -141,6 +168,19 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
   let base = '';
   let worktree: string | undefined;
   let attached = false;
+  let ephemeral = false;
+  let slotCommonDir: string | undefined;
+  const verifySlot = (): void => {
+    if (!worktree || !slotCommonDir || lstatSync(worktree).isSymbolicLink() || !lstatSync(worktree).isDirectory()) throw new Error('slot worktree mismatch');
+    const pointer = join(worktree, '.git');
+    if (!lstatSync(pointer).isFile() || lstatSync(pointer).isSymbolicLink()) throw new Error('slot worktree mismatch');
+    const common = realpathSync(run('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], worktree));
+    const registration = realpathSync(run('git', ['rev-parse', '--path-format=absolute', '--git-dir'], worktree));
+    if (common !== slotCommonDir || dirname(registration) !== join(slotCommonDir, 'worktrees')
+      || resolve(readFileSync(join(registration, 'gitdir'), 'utf8').trim()) !== resolve(pointer)
+      || resolve(readFileSync(pointer, 'utf8').trim().replace(/^gitdir: /, '')) !== registration
+      || run('git', ['rev-parse', '--show-toplevel'], worktree) !== worktree) throw new Error('slot worktree mismatch');
+  };
   let release: (() => void) | undefined;
   let endLanding: ((merged?: boolean) => void) | undefined;
   let landed = false;
@@ -168,16 +208,57 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
     const baseRefName = view.baseRefName;
     // verifyOnly(승인 탭): PR 에 기록된 base(baseRefOid)는 main 의 «지금 끝»보다 늙을 수 있다 — 지금 끝에 얹어 잰다.
     let baseCommit = view.baseRefOid!;
+    // REGATE-STALE-BASE: GitHub's baseRefOid can stay at the PR-open tip after main moves. After the bounded re-reads the
+    // regate measures on the fetched base tip (what the squash merge lands on) and records the stale PR base instead of failing.
+    // The closing PR re-read must still show the last PR base seen here (a PR that changed again is not the PR we measured).
+    let stalePrBase: string | undefined;
+    const initialPrBase = baseCommit;
+    let buildPwa = false;
     try {
       run('git', ['fetch', 'origin', `refs/heads/${baseRefName}`], input.repoRoot);
-      const fetchedBase = run('git', ['rev-parse', 'FETCH_HEAD'], input.repoRoot);
+      let fetchedBase = run('git', ['rev-parse', 'FETCH_HEAD'], input.repoRoot);
       if (input.verifyOnly) { baseCommit = fetchedBase; verifiedBase = fetchedBase; }
-      else if (fetchedBase !== baseCommit) throw new Error('fetched PR base differs from checked SHA');
+      else {
+        for (let attempt = 1; fetchedBase !== baseCommit; attempt++) {
+          debug.log('harness.host-regate', 'base-moved-retry', { pr: input.prNumber, attempt, checked: baseCommit, fetched: fetchedBase });
+          if (attempt === 3) {
+            stalePrBase = baseCommit;
+            debug.log('harness.host-regate', 'base-stale', { pr: input.prNumber, prBaseRefOidInitial: initialPrBase, prBaseRefOid: baseCommit, fetched: fetchedBase, candidateBase: fetchedBase });
+            baseCommit = fetchedBase;
+            break;
+          }
+          await new Promise((resolve) => setTimeout(resolve, 1_000));
+          view = readPr();
+          if (view.headRefOid !== input.headCommit || view.state !== 'OPEN' || view.isDraft !== false || view.baseRefName !== baseRefName || !/^[0-9a-f]{40}$/i.test(view.baseRefOid ?? '')) {
+            return result('unmeasured', 'pr-head', 'PR head, base commit, ready state or open state unavailable or changed');
+          }
+          baseCommit = view.baseRefOid!;
+          run('git', ['fetch', 'origin', `refs/heads/${baseRefName}`], input.repoRoot);
+          fetchedBase = run('git', ['rev-parse', 'FETCH_HEAD'], input.repoRoot);
+        }
+      }
       run('git', ['fetch', 'origin', `refs/pull/${input.prNumber}/head`], input.repoRoot);
       if (run('git', ['rev-parse', 'FETCH_HEAD'], input.repoRoot) !== input.headCommit) throw new Error('fetched PR head differs from checked SHA');
-      worktree = (deps.makeTemp ?? (() => mkdtempSync(join(tmpdir(), 'elanous-host-regate-'))))();
-      run('git', ['worktree', 'add', '--detach', worktree, baseCommit], input.repoRoot);
-      attached = true;
+      const slotWorktree = (release as (() => void) & { worktree?: string }).worktree;
+      ephemeral = !!deps.makeTemp || !slotWorktree;
+      worktree = deps.makeTemp?.() ?? slotWorktree ?? mkdtempSync(join(tmpdir(), 'host-regate-'));
+      if (ephemeral && slotWorktree && resolve(worktree) === resolve(slotWorktree)) throw new Error('temporary worktree overlaps locked slot');
+      if (!ephemeral && !deps.acquire) {
+        slotCommonDir = realpathSync(run('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], input.repoRoot));
+      }
+      if (!ephemeral && existsSync(worktree)) {
+        if (slotCommonDir) verifySlot();
+        attached = true;
+        // A previous host may have died mid-merge; never carry its index or untracked files into this run.
+        run('git', ['reset', '--hard'], worktree);
+        run('git', ['clean', '-fdx', '-e', 'node_modules', '-e', '.next', '-e', '*.tsbuildinfo'], worktree);
+        run('git', ['checkout', '--detach', baseCommit], worktree);
+      }
+      if (!attached) {
+        if (!ephemeral && !deps.acquire) removeBrokenSlotRegistration(input.repoRoot, worktree);
+        run('git', ['worktree', 'add', '--detach', worktree, baseCommit], input.repoRoot);
+        attached = true;
+      }
       if (run('git', ['rev-parse', 'HEAD'], worktree) !== baseCommit) throw new Error('worktree base HEAD mismatch');
       base = run('git', ['merge-base', baseCommit, input.headCommit], worktree);
       files = run('git', ['diff', '--name-only', base, input.headCommit], worktree).split('\n').filter(Boolean);
@@ -213,14 +294,10 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
       // a temporary checkout whose node_modules is empty or purged; linking it turned every gate into
       // «Cannot find package 'typescript'» (unmeasured · 2026-09-29 #21239). Install into the candidate instead.
       const candidate = worktree;
-      const provide = (dir: string, marker: string): void => {
-        if (existsSync(join(candidate, dir, 'node_modules'))) return;
-        if (existsSync(join(input.repoRoot, dir, 'node_modules', marker, 'package.json'))) {
-          symlinkSync(join(input.repoRoot, dir, 'node_modules'), join(candidate, dir, 'node_modules'), 'dir');
-        } else run('bun', ['install', '--frozen-lockfile'], join(candidate, dir));
-      };
+      const provide = (dir: string, marker: string): void => provideCheckoutDependencies(candidate, input.repoRoot, dir, marker, (cwd) => { run('bun', ['install', '--frozen-lockfile'], cwd); });
       provide('', 'typescript');
-      if (needsPwaBuild(files) && existsSync(join(worktree, 'apps/pwa'))) provide('apps/pwa', 'next');
+      buildPwa = needsPwaBuild(files, worktree);
+      if (buildPwa && existsSync(join(worktree, 'apps/pwa'))) provide('apps/pwa', 'next');
     } catch (e) { return result('unmeasured', 'worktree', String(e)); }
     try {
       const interference = await (deps.interference ?? ((f: readonly string[], c: string) => defaultInterference(f, c, { neighbors: !input.verifyOnly })))(files, worktree);
@@ -244,19 +321,21 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
       try { run('bun', ['scripts/ci-isolation-hardcode-gate.ts', '--changed-files', ...files], worktree); }
       catch (e) { return result(/\[isolation-gate\] FAIL/.test(String(e)) ? 'failed' : 'unmeasured', 'isolation-gate', String(e)); }
     }
-    if (needsPwaBuild(files)) {
+    if (buildPwa) {
       try { run('bun', ['bin/elanous.mjs', '--test', 'nexus', 'build'], worktree); }
       catch (e) { return result(String(e).includes('command unavailable') ? 'unmeasured' : 'failed', 'nexus-build', String(e)); }
     }
     let current: PrView;
     try { current = readPr(); }
     catch (e) { return result('unmeasured', 'pr-view', String(e)); }
-    if (current.headRefOid !== input.headCommit || current.baseRefName !== baseRefName || (!input.verifyOnly && current.baseRefOid !== baseCommit) || current.state !== 'OPEN' || current.isDraft !== false) {
+    if (current.headRefOid !== input.headCommit || current.baseRefName !== baseRefName || (!input.verifyOnly && current.baseRefOid !== (stalePrBase ?? baseCommit)) || current.state !== 'OPEN' || current.isDraft !== false) {
       return result('unmeasured', 'pr-base-changed', 'PR head or base changed during host regate; rerun against the new base');
     }
     // --match-head-commit pins the head. gh has no base pin, so the base was re-read just
     // above; the seconds between that read and the merge are checked after the fact below.
     if (input.verifyOnly) return result('passed');
+    // TA-REJUDGE-ON-HEAD — 병합 없는 재게이트는 «잰 base 끝»을 같이 낸다(겹침 증거의 gate.baseCommit).
+    if (input.noMerge) return { ...result('passed'), status: 'passed', baseCommit };
     const landing = admitLandingMerge({ prNumber: input.prNumber, headCommit: input.headCommit, repoRoot: input.repoRoot, ...(input.goalFile ? { goalFile: input.goalFile } : {}) }, deps.freezeRoot, {}, input.resumed ? undefined : { prNumber: input.prNumber, repoRoot: input.repoRoot, headCommit: input.headCommit }, { prodFreezeRoot: deps.prodFreezeRoot });
     if (landing.kind !== 'merge') {
       debug.log('harness.merge', 'frozen', { pr: input.prNumber, ...(landing.kind === 'held' ? { reason: landing.freeze.reason, until: landing.freeze.until } : { resumedElsewhere: true }) });
@@ -295,10 +374,22 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
     return result('unmeasured', 'host-regate', String(e));
   } finally {
     try { endLanding?.(landed); } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'landing-release', detail: String(e) }); }
-    try { if (attached && worktree) run('git', ['worktree', 'remove', '--force', worktree], input.repoRoot); }
-    catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
-    try { if (worktree) (deps.removeTemp ?? ((path) => rmSync(path, { recursive: true, force: true })))(worktree); }
-    catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
+    try {
+      if (attached && worktree) {
+        if (slotCommonDir) verifySlot();
+        run('git', ['reset', '--hard'], worktree);
+        run('git', ['clean', '-fdx', '-e', 'node_modules', '-e', '.next', '-e', '*.tsbuildinfo'], worktree);
+      }
+    } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
+    if (ephemeral && worktree) {
+      try {
+        if (attached) run('git', ['worktree', 'remove', '--force', worktree], input.repoRoot);
+      } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
+      try {
+        if (deps.removeTemp) deps.removeTemp(worktree);
+        else rmSync(worktree, { recursive: true, force: true });
+      } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
+    }
     try { release?.(); }
     catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'lock', detail: String(e) }); }
     if (failures.length && failures[0]?.step !== 'release-path-hold') {

package/src/self-implement/l8-merge-queue.ts

@@ -30,9 +30,27 @@ export type L8MergeQueueDeps = {
 };
 
 export type L8ShadowVerdict = { number: number; head: string; base?: string; verdict: 'pass' | 'conflict' | 'fail'; detail?: string; tests: string[]; at: string };
-export type L8ShadowQueueState = { pending: { number: number; head: string }[]; verdicts: L8ShadowVerdict[] };
+export type L8ShadowQueueItem = {
+  number: number;
+  head: string;
+  files?: string[];
+  filesUnmeasured?: true;
+  overlapsWith?: number[];
+  overlapsUnknownWith?: number[];
+};
+export type L8ShadowQueueState = { pending: L8ShadowQueueItem[]; verdicts: L8ShadowVerdict[] };
+export type L8ShadowEnqueueObservation = {
+  number: number;
+  head: string;
+  fileCount: number | null;
+  filesUnmeasured: boolean;
+  overlapsWith: number[];
+  overlapsUnknownWith: number[];
+  pendingAfter: number;
+};
 export type L8ShadowQueueDeps = L8MergeQueueDeps & {
   observe?: (verdict: L8ShadowVerdict) => void | Promise<void>;
+  observeEnqueue?: (entry: L8ShadowEnqueueObservation) => void | Promise<void>;
   resolveConflict?: (file: string, conflicted: string, target: string, worktree: string) => Promise<string>;
 };
 
@@ -80,23 +98,67 @@ export function shadowPrNumber(raw: string): number {
   return number;
 }
 
+// Keep the CLI's existing pending return shape; metadata remains in the shared ledger and enqueue observation.
+function publicShadowQueueState(state: L8ShadowQueueState): L8ShadowQueueState {
+  return { ...state, pending: state.pending.map(({ number, head }) => ({ number, head })) };
+}
+
 export async function statusL8ShadowQueue(cwd: string, deps: L8ShadowQueueDeps = {}): Promise<L8ShadowQueueState> {
-  return withShadowQueue(cwd, deps, async (state) => state);
+  return withShadowQueue(cwd, deps, async (state) => publicShadowQueueState(state));
 }
 
 export async function enqueueL8ShadowQueue(cwd: string, number: number, deps: L8ShadowQueueDeps = {}): Promise<L8ShadowQueueState> {
   if (!Number.isSafeInteger(number) || number <= 0) throw new Error('expected a positive PR number');
   return withShadowQueue(cwd, deps, async (state, path) => {
     const execute = deps.command ?? command;
-    const view = JSON.parse(shadowCommand(execute, 'gh', ['pr', 'view', String(number), '--json', 'headRefOid,baseRefName,state,isDraft,isCrossRepository'], cwd)) as {
+    const view = JSON.parse(shadowCommand(execute, 'gh', ['pr', 'view', String(number), '--json', 'headRefOid,baseRefName,state,isDraft,isCrossRepository,files'], cwd)) as {
       headRefOid?: string; baseRefName?: string; state?: string; isDraft?: boolean; isCrossRepository?: boolean;
+      files?: { path?: string }[];
     };
     if (!view.headRefOid || !/^[0-9a-f]{40}$/i.test(view.headRefOid) || view.baseRefName !== 'main'
       || view.state !== 'OPEN' || view.isDraft !== false || view.isCrossRepository !== false) throw new Error('PR is not an open, ready, same-repository main PR');
     if (state.pending.some((p) => p.number === number)) throw new Error(`PR #${number} already queued`);
-    state.pending.push({ number, head: view.headRefOid });
+    const files = Array.isArray(view.files) && view.files.length < 100
+      && view.files.every((file) => typeof file?.path === 'string')
+      ? [...new Set(view.files.map((file) => file.path!))].sort()
+      : undefined;
+    const filesUnmeasured = !files;
+    const overlapsWith: number[] = [];
+    const overlapsUnknownWith: number[] = [];
+    const paths = new Set(files);
+    for (const previous of state.pending) {
+      if (filesUnmeasured || !Array.isArray(previous.files) || previous.filesUnmeasured) {
+        overlapsUnknownWith.push(previous.number);
+      } else if (previous.files.some((file) => paths.has(file))) {
+        overlapsWith.push(previous.number);
+      }
+    }
+    const item: L8ShadowQueueItem = {
+      number, head: view.headRefOid, ...(files ? { files } : { filesUnmeasured: true as const }),
+      overlapsWith, overlapsUnknownWith,
+    };
+    const entry: L8ShadowEnqueueObservation = {
+      number, head: view.headRefOid, fileCount: files?.length ?? null, filesUnmeasured,
+      overlapsWith, overlapsUnknownWith, pendingAfter: state.pending.length + 1,
+    };
+    state.pending.push(item);
     writeShadowQueue(path, state);
-    return state;
+    try {
+      await (deps.observeEnqueue ?? ((data) => {
+        const store = getDefaultLogStore();
+        if (!store) {
+          if (process.env.NODE_ENV === 'test') return;
+          throw new Error('merge-queue observation store unavailable');
+        }
+        store.insertBatch([{ rec: { ts: new Date().toISOString(), category: 'merge-queue', event: 'enqueued', data }, surface: 'merge-queue' }]);
+      }))(entry);
+    } catch (error) {
+      // The shared queue is still locked: remove only this unobserved enqueue, leaving older items intact.
+      state.pending.pop();
+      writeShadowQueue(path, state);
+      throw error;
+    }
+    return publicShadowQueueState(state);
   });
 }