elanous 0.2.22 → 0.2.24

package/src/self-implement/claude-acp-implement.ts

@@ -0,0 +1,67 @@
+// ── CLAUDE-IMPL-LANE — `--child-llm-provider claude-acp` 의 구현 실행 (호스트 레인 · 구독 ACP) ──
+//
+// claude-acp 는 «LLM provider» 가 아니라 구현 실행기 선택이다. 이 갈래는 implement seam 이 PTY 자식
+// (`elanous chat` · getProvider) 대신 부른다 — PTY 자식으로 보내면 getProviderForConfig 가 모델 이름(claude-…)을
+// 보고 anthropic(API 키 provider)으로 풀어 «구독» 런이 API 로 과금된다(10-11 #26277 보류 판독).
+//
+// fail-closed: 구독 확인 실패 · 사용률 미측정 · 상한(기본 85%) 이상 · 프록시 주소 없음이면 거부하고
+// 다른 공급자로 조용히 새지 않는다(거부 사유는 관측 `self-implement.claude-acp` `refused`).
+import { debug } from '../debug/log.js';
+import { makeAcpImplementer, type AcpImplementerOpts, type AcpImplementerResult } from '../agent-substrate/acp-implementer.js';
+import { subscriptionReviewerAvailability, type SubscriptionReviewerDeps } from '../self-dev/review-provider-fallback.js';
+
+/** 구현 레인의 구독 사용률 상한(%) — 대표 10-11 «Claude 구독(ACP) = 계정 둘 · 85 까지». 리뷰어 상한(95)과 별개 값. */
+export const CLAUDE_ACP_IMPLEMENT_CAP_DEFAULT = 85;
+export const CLAUDE_ACP_PROVIDER = 'claude-acp';
+
+export function isClaudeAcpChild(childLlm: { provider?: string } | undefined): boolean {
+  return childLlm?.provider?.trim().toLowerCase() === CLAUDE_ACP_PROVIDER;
+}
+
+/** 상한은 `ELANOUS_CLAUDE_ACP_CAP`(0~100)로만 바꾼다 — 잘못된 값은 기본 85(올려 잡지 않는다). */
+export function claudeAcpImplementCap(env: NodeJS.ProcessEnv = process.env): number {
+  const raw = env.ELANOUS_CLAUDE_ACP_CAP?.trim();
+  const n = raw ? Number(raw) : Number.NaN;
+  return Number.isFinite(n) && n >= 0 && n <= 100 ? n : CLAUDE_ACP_IMPLEMENT_CAP_DEFAULT;
+}
+
+export type ClaudeAcpImplementOutcome =
+  | { kind: 'refused'; reason: string }
+  | { kind: 'ran'; result: AcpImplementerResult };
+
+export interface ClaudeAcpImplementInput {
+  cwd: string;
+  prompt: string;
+  model?: string;
+  runId?: string;
+  env?: NodeJS.ProcessEnv;
+  /** 시험 주입 — 구독 확인·상태 읽기. */
+  availabilityDeps?: SubscriptionReviewerDeps;
+  /** 시험 주입 — ACP 에이전트 생성기(makeAcpImplementer 로 그대로 넘긴다). */
+  createAgent?: AcpImplementerOpts['createAgent'];
+  timeoutMs?: number;
+}
+
+export async function runClaudeAcpImplement(input: ClaudeAcpImplementInput): Promise<ClaudeAcpImplementOutcome> {
+  const env = input.env ?? process.env;
+  const cap = claudeAcpImplementCap(env);
+  const availability = subscriptionReviewerAvailability({ provider: CLAUDE_ACP_PROVIDER }, cap, env, input.availabilityDeps ?? {});
+  if (!availability.spawn) {
+    const reason = availability.reason ?? 'Claude subscription unavailable';
+    debug.log('self-implement.claude-acp', 'refused', { reason, cap, ...(input.runId ? { runId: input.runId } : {}) }, { level: 'warn' });
+    return { kind: 'refused', reason };
+  }
+  const proxyBaseUrl = availability.spawn.env.ANTHROPIC_BASE_URL;
+  debug.log('self-implement.claude-acp', 'start', { cap, proxy: proxyBaseUrl !== undefined, model: input.model ?? '(default)', ...(input.runId ? { runId: input.runId } : {}) });
+  const implement = makeAcpImplementer({
+    worktree: input.cwd,
+    env,
+    ...(proxyBaseUrl ? { proxyBaseUrl } : {}),
+    ...(input.model ? { model: input.model } : {}),
+    ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),
+    ...(input.createAgent ? { createAgent: input.createAgent } : {}),
+  });
+  const result = await implement(input.prompt);
+  debug.log('self-implement.claude-acp', 'done', { chars: result.text.length, allowed: result.allowed, denied: result.denied, ...(input.runId ? { runId: input.runId } : {}) });
+  return { kind: 'ran', result };
+}

package/src/self-implement/draft-on-stop-mode.ts

@@ -0,0 +1,18 @@
+/**
+ * DRAFT-NOT-ARCHIVE (RFC-draft-pr-accumulation-root-fix R1 · 첫 조각)
+ *
+ * S: 멈춘 런은 산출을 draft PR 로 남겼다 — PR 이 «실패 보관소»가 되어 열린 PR 이 200 을 넘고 겹침 검사가 눈이 멀었다.
+ * C: 닫힌 147건 중 사람이 실제로 봐야 했던 것은 «주인 자리» 47건뿐이었다.
+ * Q: 어느 멈춤이 PR 을 열 자격이 있나?
+ * A: 사람 판단이 필요한 멈춤(needs-owner)만. 나머지(harvestable)는 수확 가지 `salvage/<run>/<leaf>` ⊕ 런 원장의 «사유 · 다음 수»로 남긴다.
+ *    `tools.selfImplement.draftOnStop` = 'always'(기본 · 종전) | 'needs-owner-only'.
+ */
+export type DraftOnStopMode = 'needs-owner-only' | 'always';
+export const DRAFT_ON_STOP_MODES = ['needs-owner-only', 'always'] as const satisfies readonly DraftOnStopMode[];
+export const DEFAULT_DRAFT_ON_STOP: DraftOnStopMode = 'always';
+
+export function parseDraftOnStopMode(raw: unknown): { mode: DraftOnStopMode; invalid: boolean } {
+  if (raw === undefined) return { mode: DEFAULT_DRAFT_ON_STOP, invalid: false };
+  if (typeof raw === 'string' && (DRAFT_ON_STOP_MODES as readonly string[]).includes(raw)) return { mode: raw as DraftOnStopMode, invalid: false };
+  return { mode: DEFAULT_DRAFT_ON_STOP, invalid: true };
+}

package/src/self-implement/flex-signals.ts

@@ -0,0 +1,59 @@
+/**
+ * 재작업 라운드 관측 신호 넷 — 관측 전용 순수 계산(FLEX-RFC §A-①).
+ *
+ * ⛔ 판정·분기·오버레이 상태를 만들지 않는다. 호출자는 결과를 원장에 «남기기만» 한다.
+ * ⛔ 모르는 값은 0 으로 지어내지 않고 키를 뺀다(key-absent) — 0 은 «측정했더니 없었다»의 값이다.
+ */
+
+export interface FlexSignalsInput {
+  /** 오래된 라운드 → 최신 라운드 순의 게이트 실패 id 목록. `undefined`·빈 목록은 «실패 id 를 못 쟀다». */
+  gateFailedIdsByRound: readonly (readonly string[] | undefined)[];
+  /** 최신 게이트 실패들의 base 귀속(`preexisting`·`introduced`·`unknown` …). 못 쟀으면 `undefined`. */
+  failureAttributions?: readonly string[] | undefined;
+  /** 지금 orchestrator 가 알고 있는 review_repeat 값 그대로. */
+  reviewRepeat?: number | undefined;
+  /** 지금까지 쓴 라운드 수. */
+  round: number;
+  /** 계획된 라운드 상한(effectiveMax). 모르면 `undefined`. */
+  plannedRounds?: number | undefined;
+}
+
+export interface FlexSignals {
+  fail_signature_repeat?: number;
+  base_reproduce?: number;
+  review_repeat?: number;
+  budget_burn?: number;
+}
+
+function failureKey(ids: readonly string[] | undefined): string | undefined {
+  return ids?.length ? JSON.stringify([...new Set(ids)].sort()) : undefined;
+}
+
+/** 최신 라운드의 실패 id 집합이 그 이전 라운드들에서 «같은 집합»으로 나온 횟수. 최신 집합을 모르면 `undefined`. */
+function failSignatureRepeat(rounds: FlexSignalsInput['gateFailedIdsByRound']): number | undefined {
+  if (rounds.length === 0) return undefined;
+  const latest = failureKey(rounds[rounds.length - 1]);
+  if (latest === undefined) return undefined;
+  return rounds.slice(0, -1).filter((ids) => failureKey(ids) === latest).length;
+}
+
+/** base 에서도 재현된(`preexisting`) 실패 수. 귀속이 비었거나 하나라도 `unknown` 이면 `undefined`. */
+function baseReproduce(attributions: FlexSignalsInput['failureAttributions']): number | undefined {
+  if (attributions === undefined || attributions.length === 0) return undefined;
+  if (attributions.includes('unknown')) return undefined;
+  return attributions.filter((attribution) => attribution === 'preexisting').length;
+}
+
+export function computeFlexSignals(input: FlexSignalsInput): FlexSignals {
+  const repeat = failSignatureRepeat(input.gateFailedIdsByRound);
+  const reproduce = baseReproduce(input.failureAttributions);
+  const burn = input.plannedRounds !== undefined && input.plannedRounds > 0
+    ? input.round / input.plannedRounds
+    : undefined;
+  return {
+    ...(repeat === undefined ? {} : { fail_signature_repeat: repeat }),
+    ...(reproduce === undefined ? {} : { base_reproduce: reproduce }),
+    ...(input.reviewRepeat === undefined ? {} : { review_repeat: input.reviewRepeat }),
+    ...(burn === undefined ? {} : { budget_burn: burn }),
+  };
+}

package/src/self-implement/follow-up-goals.ts

@@ -1,6 +1,6 @@
-// FOLLOWUP-LOOP① — after a harness PR merges, leftover findings become one
-// follow-up goal draft. Default mode is shadow: record only. `live` also
-// enqueues through the same function as `harness queue add`.
+// FOLLOWUP-LOOP① — leftover findings after a merge or blocked run become
+// follow-up drafts. Default mode is shadow; only merged drafts in `live` mode
+// enqueue through the same function as `harness queue add`.
 //
 // The test process injects every store. Nothing here opens the operational
 // ledger or queue unless the caller passes those seams.
@@ -25,6 +25,9 @@ export type FollowUpMode = 'shadow' | 'live';
 
 export interface FollowUpDraftRecord {
   prNumber: number;
+  ending?: 'blocked';
+  runId?: string;
+  stage?: 'review-blocked' | 'gate-failed';
   cellId: string;
   depth: number;
   draftHash: string;
@@ -54,6 +57,17 @@ export interface FollowUpMergeInput {
   goalFile?: string;
 }
 
+export interface FollowUpBlockedInput {
+  runId: string;
+  prNumber?: number;
+  stage: 'review-blocked' | 'gate-failed';
+  unresolvedMustFix?: readonly string[];
+  decompositionPieces?: readonly string[];
+  feature: string;
+  cellId?: string;
+  goalFile?: string;
+}
+
 export interface FollowUpSeams {
   stateRoot?: string;
   mode?: FollowUpMode;
@@ -144,10 +158,15 @@ export function followUpDraftHash(text: string): string {
   return createHash('sha256').update(text).digest('hex').slice(0, 16);
 }
 
+/** Legacy merge rows have no ending; blocked rows use run identity even without a PR. */
+function followUpRecordKey(record: Pick<FollowUpDraftRecord, 'prNumber' | 'ending' | 'runId'>): string {
+  return record.ending === 'blocked' ? `run:${record.runId}` : `pr:${record.prNumber}`;
+}
+
 /** Chain length of follow-up goals already recorded for this cell, before this one. */
-export function followUpChainDepth(prior: readonly Pick<FollowUpDraftRecord, 'kind' | 'prNumber'>[]): number {
-  // 한 PR 이 «기록 → 대기열 확정» 두 줄을 남길 수 있으니 PR 번호로 센다.
-  return new Set(prior.filter((record) => record.kind === 'draft' || record.kind === 'op-card-required').map((record) => record.prNumber)).size;
+export function followUpChainDepth(prior: readonly Pick<FollowUpDraftRecord, 'kind' | 'prNumber' | 'ending' | 'runId'>[]): number {
+  // 기록 → 대기열 확정 두 줄은 하나로 세되, PR 없는 서로 다른 런은 분리한다.
+  return new Set(prior.filter((record) => record.kind === 'draft' || record.kind === 'op-card-required').map(followUpRecordKey)).size;
 }
 
 /** Seat = the cell's owner. `TC/rel` keeps the seat `TC`. Unknown or absent owners go to OP (ONEDOOR). */
@@ -175,13 +194,23 @@ function defaultReadDrafts(stateRoot: string, cellId: string): FollowUpDraftReco
   return out;
 }
 
-/** 같은 PR 은 칸과 무관하게 한 번 — 칸 id 가 달리 들어와도 다시 만들지 않는다. */
-function defaultPrRecorded(stateRoot: string, prNumber: number): boolean {
+/** 같은 PR 또는 같은 blocked 런은 칸과 무관하게 한 번 기록한다. */
+function defaultRecordExists(stateRoot: string, key: string): boolean {
   let text = '';
   try { text = readFileSync(followUpDraftsPath(stateRoot), 'utf8'); } catch { return false; }
   return text.split('\n').some((line) => {
     if (!line.trim()) return false;
-    try { return (JSON.parse(line) as FollowUpDraftRecord).prNumber === prNumber; } catch { return false; }
+    try { return followUpRecordKey(JSON.parse(line) as FollowUpDraftRecord) === key; } catch { return false; }
+  });
+}
+
+function defaultAppendFirst(stateRoot: string, record: FollowUpDraftRecord): boolean {
+  const path = followUpDraftsPath(stateRoot);
+  mkdirSync(dirname(path), { recursive: true });
+  return withFileLockSync(`${path}.lock`, () => {
+    if (defaultRecordExists(stateRoot, followUpRecordKey(record))) return false;
+    defaultAppendDraft(stateRoot, record);
+    return true;
   });
 }
 
@@ -209,7 +238,10 @@ export async function recordFollowUpOnMerge(input: FollowUpMergeInput, seams: Fo
   const log = seams.log ?? ((category, event, data) => { debug.log(category, event, data); });
   try {
     const remainings = collectRemainings(input);
-    if (remainings.length === 0) return null;
+    if (remainings.length === 0) {
+      log('self-implement.follow-up', 'draft-skipped-empty', { ending: 'merged', prNumber: input.prNumber });
+      return null;
+    }
     // No injected store and no explicit state root: this is the test process.
     // Do not open the operational ledger or the harness queue.
     // A test process handed the operational root (defaultSeams) is refused the same way.
@@ -222,8 +254,9 @@ export async function recordFollowUpOnMerge(input: FollowUpMergeInput, seams: Fo
       return null;
     }
     const prior = (seams.readDrafts ?? ((id) => defaultReadDrafts(stateRoot, id)))(cellId);
-    if (prior.some((record) => record.prNumber === input.prNumber)) return null;
-    if (!seams.readDrafts && defaultPrRecorded(stateRoot, input.prNumber)) return null;
+    const key = followUpRecordKey({ prNumber: input.prNumber });
+    if (prior.some((record) => followUpRecordKey(record) === key)) return null;
+    if (!seams.readDrafts && defaultRecordExists(stateRoot, key)) return null;
     const depth = followUpChainDepth(prior) + 1;
     const firstLine = originalAskFirstLine(input.feature);
     const mode = seams.mode ?? readFollowUpMode();
@@ -245,39 +278,37 @@ export async function recordFollowUpOnMerge(input: FollowUpMergeInput, seams: Fo
     const append = seams.appendDraft ?? ((row: FollowUpDraftRecord) => defaultAppendDraft(stateRoot, row));
     const appendFirst = seams.appendDraft
       ? (row: FollowUpDraftRecord) => { append(row); return true; }
-      : (row: FollowUpDraftRecord) => (mkdirSync(dirname(followUpDraftsPath(stateRoot)), { recursive: true }), withFileLockSync(`${followUpDraftsPath(stateRoot)}.lock`, () => {
-        if (defaultPrRecorded(stateRoot, row.prNumber)) return false;
-        defaultAppendDraft(stateRoot, row);
-        return true;
-      }));
+      : (row: FollowUpDraftRecord) => defaultAppendFirst(stateRoot, row);
     if (!overDepth && mode === 'live' && draft) record.seat = seatForCellOwner((seams.cellOwner ?? defaultCellOwner)(cellId));
     // 원장 기록을 먼저 확정한다 — 기록이 실패하면 대기열에 넣지 않는다(같은 PR 한 번 · 원장 밖 연결골 0).
     if (!appendFirst(record)) return null;
     if (!overDepth && mode === 'live' && draft && record.seat) {
       const seat = record.seat;
-      if (testProcess && !seams.enqueue) return record;
-      try {
-        await (seams.enqueue ?? ((item) => addHarnessQueue({ seat: item.seat, say: item.say, idempotencyKey: item.idempotencyKey })))({
-          seat,
-          say: draft,
-          idempotencyKey: `follow-up:${input.prNumber}`,
-        });
-        record.queued = true;
-      } catch (error) {
-        // 대기열 넣기가 실패해도 초안은 남긴다 — 같은 PR 은 다시 오지 않으므로 여기서 잃으면 영영 없다.
-        // queued=false ⊕ enqueueError 로 원장에 남기고, 재투입은 같은 idempotencyKey 로 사람이·다음 수리 노드가 한다.
-        record.enqueueError = (error instanceof Error ? error.message : String(error)).slice(0, 300);
-        log('self-implement.follow-up', 'enqueue-failed', { prNumber: input.prNumber, seat, error: record.enqueueError });
-      }
-      // 대기열 결과를 원장에 한 줄 더 — 이 쓰기의 실패는 대기열 실패와 다른 사건이다.
-      try {
-        append({ ...record });
-      } catch (error) {
-        log('self-implement.follow-up', 'ledger-confirm-failed', {
-          prNumber: input.prNumber, seat, queued: record.queued, error: error instanceof Error ? error.message : String(error),
-        });
+      if (!(testProcess && !seams.enqueue)) {
+        try {
+          await (seams.enqueue ?? ((item) => addHarnessQueue({ seat: item.seat, say: item.say, idempotencyKey: item.idempotencyKey })))({
+            seat,
+            say: draft,
+            idempotencyKey: `follow-up:${input.prNumber}`,
+          });
+          record.queued = true;
+        } catch (error) {
+          // 대기열 넣기가 실패해도 초안은 남긴다 — 같은 PR 은 다시 오지 않으므로 여기서 잃으면 영영 없다.
+          // queued=false ⊕ enqueueError 로 원장에 남기고, 재투입은 같은 idempotencyKey 로 사람이·다음 수리 노드가 한다.
+          record.enqueueError = (error instanceof Error ? error.message : String(error)).slice(0, 300);
+          log('self-implement.follow-up', 'enqueue-failed', { prNumber: input.prNumber, seat, error: record.enqueueError });
+        }
+        // 대기열 결과를 원장에 한 줄 더 — 이 쓰기의 실패는 대기열 실패와 다른 사건이다.
+        try {
+          append({ ...record });
+        } catch (error) {
+          log('self-implement.follow-up', 'ledger-confirm-failed', {
+            prNumber: input.prNumber, seat, queued: record.queued, error: error instanceof Error ? error.message : String(error),
+          });
+        }
       }
     }
+    log('self-implement.follow-up', 'drafted', { ending: 'merged', prNumber: input.prNumber, cellId, depth, kind: record.kind, mode, queued: record.queued, remainingCount: remainings.length });
     return record;
   } catch (error) {
     log('self-implement.follow-up', 'draft-failed', {
@@ -287,3 +318,48 @@ export async function recordFollowUpOnMerge(input: FollowUpMergeInput, seams: Fo
     return null;
   }
 }
+
+/** Blocked runs leave a draft in the ledger only, even when follow-up mode is live. */
+export async function recordFollowUpOnBlocked(input: FollowUpBlockedInput, seams: FollowUpSeams = {}): Promise<FollowUpDraftRecord | null> {
+  const log = seams.log ?? ((category, event, data) => { debug.log(category, event, data); });
+  const prNumber = input.prNumber ?? 0;
+  try {
+    const remainings = collectRemainings({ followUpMustFix: input.unresolvedMustFix, shouldFix: input.decompositionPieces });
+    if (remainings.length === 0) {
+      log('self-implement.follow-up', 'draft-skipped-empty', { ending: 'blocked', prNumber, runId: input.runId });
+      return null;
+    }
+    const testProcess = process.env.NODE_ENV === 'test' || !!process.env.ELANOUS_TEST_HOME;
+    if (!seams.readDrafts && !seams.appendDraft && (!seams.stateRoot || (testProcess && seams.stateRoot === elanousStateRoot()))) return null;
+    const stateRoot = seams.stateRoot ?? elanousStateRoot();
+    const cellId = followUpCellId(input);
+    if (!cellId) {
+      log('self-implement.follow-up', 'draft-skipped-no-cell', { ending: 'blocked', prNumber, runId: input.runId });
+      return null;
+    }
+    const prior = (seams.readDrafts ?? ((id) => defaultReadDrafts(stateRoot, id)))(cellId);
+    const key = followUpRecordKey({ ending: 'blocked', runId: input.runId, prNumber });
+    if (prior.some((record) => followUpRecordKey(record) === key)) return null;
+    if (!seams.readDrafts && defaultRecordExists(stateRoot, key)) return null;
+    const depth = followUpChainDepth(prior) + 1;
+    const firstLine = originalAskFirstLine(input.feature);
+    const mode = seams.mode ?? readFollowUpMode();
+    const overDepth = depth > FOLLOW_UP_DEPTH_LIMIT;
+    const draft = overDepth ? undefined : followUpDraftText(firstLine, remainings);
+    const record: FollowUpDraftRecord = {
+      ending: 'blocked', runId: input.runId, stage: input.stage, prNumber, cellId, depth,
+      draftHash: followUpDraftHash(draft ?? `${firstLine}\n${FOLLOW_UP_OP_CARD_REQUIRED}`),
+      kind: overDepth ? 'op-card-required' : 'draft', originalAskFirstLine: firstLine, remainings,
+      ...(draft ? { draft } : {}),
+      ...(overDepth ? { note: FOLLOW_UP_OP_CARD_REQUIRED } : {}),
+      queued: false,
+    };
+    if (seams.appendDraft) seams.appendDraft(record);
+    else if (!defaultAppendFirst(stateRoot, record)) return null;
+    log('self-implement.follow-up', 'drafted', { ending: 'blocked', prNumber, runId: input.runId, stage: input.stage, cellId, depth, kind: record.kind, mode, queued: false, remainingCount: remainings.length });
+    return record;
+  } catch (error) {
+    log('self-implement.follow-up', 'draft-failed', { ending: 'blocked', prNumber, runId: input.runId, stage: input.stage, error: error instanceof Error ? error.message : String(error) });
+    return null;
+  }
+}

package/src/self-implement/frozen-merges.ts

@@ -5,7 +5,7 @@ import { dirname, join, resolve } from 'node:path';
 import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
 import { debug } from '../debug/log.js';
 import { enterJourneyNode, exitJourneyNode, passJourneyNode, withJourneyNodeSync } from '../self-dev/graph-journey-nodes.js';
-import { routeJourneyEdge } from '../self-dev/graph-journey-route.js';
+import { freezeCheckHolds, routeJourneyEdge } from '../self-dev/graph-journey-route.js';
 import { beginLandingMerge, type LandingFreeze } from '../release-loop/landing-freeze.js';
 
 /** `manual`: the owning repository could not be determined — a sweep never resumes it; a person does. */
@@ -194,8 +194,13 @@ export function admitLandingMerge(
     () => admitLandingMergeUnobserved(heldEntry, root, hooks, claimKey, opts));
   const freezeLabel = admission.kind === 'merge' ? 'open' : admission.kind === 'held' ? 'frozen' : 'taken';
   exitJourneyNode('freeze-check', { provenance: 'admit-landing-merge', outcome: freezeLabel, ...(pr === undefined ? {} : { data: { pr } }) });
-  // 2판: 간선 판독을 남긴다(관측). 승인 요구(open→hold) 강제는 0.2.22 — 보류 사유 값이 먼저다(RFC §3).
-  routeJourneyEdge('freeze-check', freezeLabel, { freeze: freezeLabel });
+  const route = routeJourneyEdge('freeze-check', freezeLabel, { freeze: freezeLabel });
+  // 그래프가 열린 병합을 hold 로 보내면(launch 오버레이의 «승인 요구») 병합하지 않고 보류한다. 답이 없으면 오늘 판정 그대로.
+  if (admission.kind === 'merge' && freezeCheckHolds(freezeLabel, route)) {
+    admission.end();
+    passJourneyNode('hold', { provenance: 'admit-landing-merge', outcome: 'graph-hold', ...(pr === undefined ? {} : { data: { pr } }) });
+    return { kind: 'held', freeze: { reason: 'graph freeze-check → hold', startedAt: new Date().toISOString(), until: null, by: 'graph' } };
+  }
   return admission;
 }
 

package/src/self-implement/gate-baseline-reap.ts

@@ -0,0 +1,157 @@
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, isAbsolute, join, resolve } from 'node:path';
+import { debug } from '../debug/log.js';
+import { runGitCommand, type GitCommandRunner } from '../git-fs/runner.js';
+
+export interface GateWorktreeReapResult {
+  ok: boolean;
+  listed: number;
+  candidates: number;
+  removed: number;
+  keptLive: number;
+  keptYoung: number;
+  deferred: number;
+  failed: number;
+  orphanDirsRemoved: number;
+}
+
+export interface GateWorktreeReapOptions {
+  prefixes?: readonly string[];
+  minAgeMs?: number;
+  max?: number;
+}
+
+export interface GateWorktreeReapDeps {
+  run?: GitCommandRunner;
+  isPidAlive?: (pid: number) => boolean;
+  now?: () => number;
+  tmpRoots?: readonly string[];
+}
+
+interface Registration { path: string; reason?: string }
+
+function pidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+function registrations(output: string): Registration[] {
+  return output.split(/\n\s*\n/).flatMap((block) => {
+    const lines = block.split('\n');
+    const path = lines.find((line) => line.startsWith('worktree '))?.slice('worktree '.length);
+    if (!path || !isAbsolute(path)) return [];
+    return [{ path: resolve(path), reason: lines.find((line) => line.startsWith('locked '))?.slice('locked '.length) }];
+  });
+}
+
+function metadataFor(path: string, metadataRoot: string): string | undefined {
+  for (const entry of readdirSync(metadataRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const folder = join(metadataRoot, entry.name);
+    const gitdir = join(folder, 'gitdir');
+    try {
+      if (!lstatSync(gitdir).isFile()) continue;
+      const target = readFileSync(gitdir, 'utf8').trim();
+      if (isAbsolute(target) && resolve(target) === join(path, '.git')) return folder;
+    } catch { continue; }
+  }
+  return undefined;
+}
+
+/** Only gate-prefixed registrations and direct children of the supplied temp roots are eligible. */
+export function reapStaleGateWorktrees(
+  cwd: string,
+  opts: GateWorktreeReapOptions = {},
+  deps: GateWorktreeReapDeps = {},
+): GateWorktreeReapResult {
+  const result: GateWorktreeReapResult = {
+    ok: false, listed: 0, candidates: 0, removed: 0, keptLive: 0,
+    keptYoung: 0, deferred: 0, failed: 0, orphanDirsRemoved: 0,
+  };
+  const emit = (): GateWorktreeReapResult => {
+    if (!result.ok || result.candidates > 0) debug.log('self-implement.gate-baseline', 'reap', { ...result });
+    return result;
+  };
+  const run = deps.run ?? runGitCommand;
+  const git = (args: string[]) => run(cwd, args, { encoding: 'utf8', timeout: 60_000 });
+  try {
+    const listing = git(['worktree', 'list', '--porcelain']);
+    if (listing.status !== 0 || listing.signal || typeof listing.stdout !== 'string') return emit();
+    if (!listing.stdout.startsWith('worktree ')) return emit();
+    const entries = registrations(listing.stdout);
+    result.ok = true;
+    result.listed = entries.length;
+    const prefixes = opts.prefixes ?? ['elanous-gate-baseline-'];
+    const minAgeMs = opts.minAgeMs ?? 2 * 60 * 60_000;
+    const max = Math.max(0, opts.max ?? 20);
+    const now = (deps.now ?? Date.now)();
+    const isAlive = deps.isPidAlive ?? pidAlive;
+    const registered = new Set(entries.map((entry) => entry.path));
+    const matches = (path: string) => prefixes.some((prefix) => prefix.length > 0 && basename(path).startsWith(prefix));
+    const candidates = entries.filter((entry) => matches(entry.path));
+    result.candidates = candidates.length;
+    let metadataRoot: string | undefined;
+    const getMetadataRoot = (): string | undefined => {
+      if (metadataRoot) return metadataRoot;
+      const common = git(['rev-parse', '--git-common-dir']);
+      if (common.status !== 0 || typeof common.stdout !== 'string' || !common.stdout.trim()) return undefined;
+      const root = common.stdout.trim();
+      metadataRoot = join(realpathSync(isAbsolute(root) ? root : resolve(cwd, root)), 'worktrees');
+      return metadataRoot;
+    };
+    let attempted = 0;
+    for (const entry of candidates) {
+      try {
+        const owner = entry.reason?.match(/^elanous-gate pid=([1-9]\d*)\b/);
+        if (owner && isAlive(Number(owner[1]))) {
+          result.keptLive++;
+          continue;
+        }
+        const started = owner ? entry.reason?.match(/\bstarted=(\d+)\b/) : undefined;
+        const startedAt = started ? Number(started[1]) : undefined;
+        const root = startedAt === undefined || !existsSync(entry.path) ? getMetadataRoot() : undefined;
+        const metadata = root ? metadataFor(entry.path, root) : undefined;
+        const timestamp = startedAt !== undefined && Number.isSafeInteger(startedAt)
+          ? startedAt : metadata ? statSync(metadata).mtimeMs : undefined;
+        if (timestamp === undefined || !Number.isFinite(timestamp)) { result.failed++; continue; }
+        if (now - timestamp < minAgeMs) { result.keptYoung++; continue; }
+        if (attempted >= max) { result.deferred++; continue; }
+        attempted++;
+        const removed = git(['worktree', 'remove', '--force', '--force', entry.path]);
+        if (removed.status === 0) { result.removed++; continue; }
+        // A missing checkout cannot be removed by git. Verify the single metadata record before unlinking it.
+        if (!existsSync(entry.path) && metadata && metadataFor(entry.path, root!) === metadata) {
+          rmSync(metadata, { recursive: true });
+          result.removed++;
+        } else result.failed++;
+      } catch { result.failed++; }
+    }
+    for (const root of deps.tmpRoots ?? [realpathSync(tmpdir())]) {
+      try {
+        const realRoot = realpathSync(root);
+        for (const entry of readdirSync(realRoot, { withFileTypes: true })) {
+          const path = join(realRoot, entry.name);
+          if (!entry.isDirectory() || !matches(path) || registered.has(path)) continue;
+          try {
+            const stat = lstatSync(path);
+            if (!stat.isDirectory() || now - stat.mtimeMs < minAgeMs) continue;
+            // A checkout owned by another repository is absent from this repository's listing.
+            // Its .git file (or directory) must never be treated as an unregistered orphan.
+            // With no .git, only an empty directory is provably unused; preserve unknown contents.
+            if (existsSync(join(path, '.git')) || readdirSync(path).length !== 0) continue;
+            rmSync(path, { recursive: true });
+            result.orphanDirsRemoved++;
+          } catch { result.failed++; }
+        }
+      } catch { result.failed++; }
+    }
+  } catch {
+    result.ok = false;
+  }
+  return emit();
+}