elanous 0.2.22 → 0.2.24

package/src/self-implement/graph-yaml.ts

@@ -24,12 +24,16 @@ export interface GraphNodeSpec {
   readonly kind: GraphNodeKind | (string & {});
   readonly recipe: string;
   readonly maxVisits: number;
+  /** L0 journey-stage declaration (optional for other graph templates). */
+  readonly journeyStage?: string;
   readonly progress?: readonly string[];
   readonly phases?: readonly string[];
   readonly terminalStages?: readonly string[];
   /** ⭐ 「아크마다 한 번」처럼 «한 노드가 여럿 돈다」를 값으로. 없으면 한 번이다. */
   readonly fanOut?: string;
   readonly contract?: GraphNodeContract;
+  readonly call?: string;
+  readonly budget?: { readonly innerSteps: number };
 }
 
 export interface GraphEdgeSpec {
@@ -50,11 +54,13 @@ export interface GraphTemplateSpec {
   readonly version: number;
   readonly entryNode: string;
   readonly terminalNodes: readonly string[];
+  readonly journeyStages?: readonly string[];
   /** 문서 전용 변경이면 gate 노드를 건너뛸 수 있다는 템플릿 정책. */
   readonly docsOnlyGateSkip?: boolean;
   readonly state?: readonly string[];
   /** ⭐ 런 계약(선택) — 이 그래프가 «기본으로» 요구하는 실행 칸 등. 발사 인자가 덮는다(graph-run-contract.ts). */
   readonly runContract?: GraphRunContractSpec;
+  readonly unit?: { readonly inputs: readonly string[]; readonly outputs: readonly string[]; readonly exits: readonly string[] };
   readonly nodes: readonly GraphNodeSpec[];
   readonly edges: readonly GraphEdgeSpec[];
 }
@@ -102,6 +108,12 @@ export function parseGraphTemplateYaml(source: string, label = '<inline>'): Grap
   const terminalNodes = asArray(doc.terminal_nodes).filter((v): v is string => typeof v === 'string');
   if (terminalNodes.length === 0) errors.push({ path: `${label}/terminal_nodes`, message: 'terminal_nodes 가 비었다 — 끝날 수 없는 그래프다' });
 
+  const journeyStages = doc.journey_stages;
+  if (journeyStages !== undefined && (!Array.isArray(journeyStages) || journeyStages.length === 0
+    || !journeyStages.every((stage) => typeof stage === 'string' && stage.trim())
+    || new Set(journeyStages).size !== journeyStages.length)) {
+    errors.push({ path: `${label}/journey_stages`, message: 'journey_stages 는 중복 없는 비어 있지 않은 문자열 목록이어야 한다' });
+  }
   const nodes: GraphNodeSpec[] = [];
   for (const [index, entry] of asArray(doc.nodes).entries()) {
     const at = `${label}/nodes/${index}`;
@@ -126,6 +138,13 @@ export function parseGraphTemplateYaml(source: string, label = '<inline>'): Grap
       errors.push({ path: `${at}/max_visits`, message: 'max_visits 는 1 이상의 정수여야 한다' });
       continue;
     }
+    if (n.journey_stage !== undefined && (typeof n.journey_stage !== 'string' || !n.journey_stage.trim()
+      || (Array.isArray(journeyStages) && !journeyStages.includes(n.journey_stage)))) {
+      errors.push({ path: `${at}/journey_stage`, message: typeof n.journey_stage === 'string' && n.journey_stage.trim()
+        ? `journey_stage '${n.journey_stage}' 가 journey_stages 목록에 없다`
+        : 'journey_stage 는 비어 있지 않은 문자열이어야 한다' });
+      continue;
+    }
     const contractRaw = n.contract as Record<string, unknown> | undefined;
     const contract: GraphNodeContract | undefined = contractRaw && typeof contractRaw === 'object'
       ? {
@@ -134,17 +153,38 @@ export function parseGraphTemplateYaml(source: string, label = '<inline>'): Grap
           outputs: asArray(contractRaw.outputs).filter((v): v is string => typeof v === 'string'),
         }
       : undefined;
+    // A subgraph node becomes a unit call only when it names `call:`; without it the node keeps the
+    // pre-unit meaning (catalog role / recipe node), so existing declarations stay valid.
+    if (kind === 'subgraph' && (n.call !== undefined || n.budget !== undefined)) {
+      if (typeof n.call !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]*@(?:\^?[1-9]\d*)$/.test(n.call))
+        errors.push({ path: `${at}/call`, message: 'call 은 id@정수판 또는 id@^주판이어야 한다' });
+      const budget = n.budget as Record<string, unknown> | undefined;
+      if (!budget || typeof budget !== 'object' || Array.isArray(budget) ||
+          !Number.isSafeInteger(budget.inner_steps) || (budget.inner_steps as number) < 1 || Object.keys(budget).some(key => key !== 'inner_steps'))
+        errors.push({ path: `${at}/budget/inner_steps`, message: 'inner_steps 는 1 이상의 안전한 정수여야 한다' });
+      if (!contractRaw || !Array.isArray(contractRaw.inputs) || !contractRaw.inputs.every(v => typeof v === 'string') ||
+          !Array.isArray(contractRaw.outputs) || !contractRaw.outputs.every(v => typeof v === 'string'))
+        errors.push({ path: `${at}/contract`, message: 'subgraph 에는 inputs·outputs 계약이 필요하다' });
+      if (recipe !== 'none') errors.push({ path: `${at}/recipe`, message: 'subgraph 는 recipe 를 실행하지 않는다' });
+    } else if (kind !== 'subgraph' && (n.call !== undefined || n.budget !== undefined)) {
+      errors.push({ path: at, message: 'call·budget 은 subgraph 전용이다' });
+    }
     // ⛔ 계약이 없으면 「이 노드가 무엇을 할 수 있나」를 답할 수 없다 — 경고로 남긴다(거절은 오버레이 쪽).
     if (contract === undefined) warnings.push({ path: `${at}/contract`, message: '계약(inputs·tools·outputs)이 없다 — 권한을 코드에서만 알 수 있다' });
     else if (contract.tools === '') warnings.push({ path: `${at}/contract/tools`, message: 'tools 가 비었다' });
 
     nodes.push({
       nodeId, kind, recipe, maxVisits,
+      ...(typeof n.journey_stage === 'string' ? { journeyStage: n.journey_stage } : {}),
       ...(Array.isArray(n.progress) ? { progress: n.progress.filter((v): v is string => typeof v === 'string') } : {}),
       ...(Array.isArray(n.phases) ? { phases: n.phases.filter((v): v is string => typeof v === 'string') } : {}),
       ...(Array.isArray(n.terminal_stages) ? { terminalStages: n.terminal_stages.filter((v): v is string => typeof v === 'string') } : {}),
       ...(typeof n.fan_out === 'string' ? { fanOut: n.fan_out } : {}),
       ...(contract ? { contract } : {}),
+      ...(kind === 'subgraph' && typeof n.call === 'string' ? { call: n.call } : {}),
+      ...(kind === 'subgraph' && n.budget && typeof n.budget === 'object' && !Array.isArray(n.budget) &&
+        typeof (n.budget as Record<string, unknown>).inner_steps === 'number'
+        ? { budget: { innerSteps: (n.budget as { inner_steps: number }).inner_steps } } : {}),
     });
   }
   if (nodes.length === 0) errors.push({ path: `${label}/nodes`, message: '노드가 하나도 없다' });
@@ -198,6 +238,20 @@ export function parseGraphTemplateYaml(source: string, label = '<inline>'): Grap
   if (entryNode !== undefined && !known.has(entryNode)) errors.push({ path: `${label}/entry_node`, message: `'${entryNode}' 는 선언된 노드가 아니다` });
   for (const t of terminalNodes) if (!known.has(t)) errors.push({ path: `${label}/terminal_nodes`, message: `'${t}' 는 선언된 노드가 아니다` });
 
+  let unit: GraphTemplateSpec['unit'];
+  if (doc.unit !== undefined) {
+    const rawUnit = doc.unit as Record<string, unknown>;
+    if (!rawUnit || typeof rawUnit !== 'object' || Array.isArray(rawUnit) ||
+        Object.keys(rawUnit).some(key => !['inputs', 'outputs', 'exits'].includes(key)) ||
+        !['inputs', 'outputs', 'exits'].every(key => Array.isArray(rawUnit[key]) &&
+          (rawUnit[key] as unknown[]).every(v => typeof v === 'string' && v.length > 0) &&
+          new Set(rawUnit[key] as string[]).size === (rawUnit[key] as string[]).length) ||
+        !(rawUnit.exits as string[]).length ||
+        (rawUnit.exits as string[]).some(exit => !terminalNodes.includes(exit)) ||
+        terminalNodes.some(exit => !(rawUnit.exits as string[]).includes(exit))) {
+      errors.push({ path: `${label}/unit`, message: 'unit 의 inputs·outputs·exits 및 terminal_nodes 가 일치해야 한다' });
+    } else unit = { inputs: rawUnit.inputs as string[], outputs: rawUnit.outputs as string[], exits: rawUnit.exits as string[] };
+  }
   const runContract = parseGraphRunContract(doc.run_contract);
   if (runContract.error) errors.push({ path: `${label}/run_contract`, message: runContract.error });
   let loop: GraphTemplateSpec['loop'];
@@ -225,6 +279,8 @@ export function parseGraphTemplateYaml(source: string, label = '<inline>'): Grap
   return {
     template: {
       graphId: graphId!, version: version!, entryNode: entryNode!, terminalNodes, nodes, edges,
+      ...(unit ? { unit } : {}),
+      ...(Array.isArray(journeyStages) ? { journeyStages: journeyStages as string[] } : {}),
       ...(loop ? { loop } : {}),
       ...(typeof doc.docs_only_gate_skip === 'boolean' ? { docsOnlyGateSkip: doc.docs_only_gate_skip } : {}),
       ...(Array.isArray(doc.state) ? { state: doc.state.filter((v): v is string => typeof v === 'string') } : {}),

package/src/self-implement/headless-elanous-driver.ts

@@ -996,8 +996,8 @@ export interface HeadlessGoalLoopPtyOptions {
   /** 밖에서 쓴 이력 조회 심 — 기본은 실물(`pty-control-ipc`). ⭐ 테스트가 전역을 찌르지 않게
    *  `spawn`·`ptyAvailable` 과 **같은 방식**으로 주입한다(새 패턴 아님 · 테스트 전용 export 도 아님). */
   externalWriteProvenance?: (ptyId: string) => { externalWrites: number; externalWriteAgoMs: number; externalWriteActor: string } | undefined;
-  /** ★S4 P2b — brain 상담 1회 최대 대기(ms·기본 15초). 초과 시 abort + fail-soft(`brain.fail`).
-   *  ⚠️ **테스트 seam 겸용**(리뷰 must-fix — 이게 없으면 timeout fail-soft 경로를 15초 없이 검증할 수
+  /** ★S4 P2b — brain 상담 1회 최대 대기(ms·기본 45초). 초과 시 abort + fail-soft(`brain.fail`).
+   *  ⚠️ **테스트 seam 겸용**(리뷰 must-fix — 이게 없으면 timeout fail-soft 경로를 45초 없이 검증할 수
    *  없다). 프로덕션은 기본값을 쓴다(호출부 미지정). */
   brainTimeoutMs?: number;
   /** ★S4 P3 **관측 시계 seam**(테스트 전용·기본 `Date.now`).
@@ -1520,8 +1520,8 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
     let previousStallMetrics: { toolCalls: number; chars: number } | undefined;
     let keyframeSeq = 0; // 이 run 의 키프레임 순번(파일 키·seq 순 추출).
     // ⭐⭐ **wall-clock 상한**(리뷰 must-fix 2026-07-26) — 이 루프의 회계는 `i`(≈초·pollMs≈1000ms 가정)
-    //   기반이다. S4 P2b brain 상담이 tick 당 최대 `brainTimeoutMs`(기본 15초)를 **직렬 await** 하므로
-    //   전이가 반복되면 1 tick 이 ~16초가 되어 `maxWaitSec` 계약을 **최대 16배 초과**한다(600s → ~2.7h).
+    //   기반이다. S4 P2b brain 상담이 tick 당 최대 `brainTimeoutMs`(기본 45초)를 **직렬 await** 하므로
+    //   전이가 반복되면 1 tick 이 ~46초가 되어 `maxWaitSec` 계약을 초과할 수 있다.
     //   ⇒ 기존 활동-grace 의미(i 기반)는 **그대로 두고** 절대 경과시간을 **추가 상한**으로만 얹는다.
     //   단조 안전: 더 **일찍** 멈출 뿐 늦게 멈추는 경우가 없다. brain 미주입이면 i≈초라 두 조건이 일치
     //   (무회귀). ROADMAP §2 P1(종료 지연)의 회계 구조를 재작성하지 않는 최소 개입이다.
@@ -1563,7 +1563,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
         debug.log('self-implement', 'poll.heartbeat', { ptyId, runId, i, alive: h.isAlive(), lastActivityI, silentFor, ...parentObservation });
       }
       // #24 finer 마커 — stall 시 "poll 루프 안(자식 구동·정상)" vs "다른 동기 op" 구분.
-      setEventLoopActivity(`headless:poll-${i}:alive-${h.isAlive() ? 1 : 0}`);
+      setEventLoopActivity(`headless:poll:alive-${h.isAlive() ? 1 : 0}`);
       const delta = h.drainDelta();
       phase = 'snapshot';
       const snap = h.snapshot();   // ★ 1회 캡처 — 화면 릴레이 + GOAL-COMPLETE 공용(중복 snapshot 제거)
@@ -1697,6 +1697,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                 if (opts.signal?.aborted) onBrainAbort();
                 else opts.signal?.addEventListener('abort', onBrainAbort, { once: true });
                 let timer: ReturnType<typeof setTimeout> | undefined;
+                const brainStartedMs = Date.now();
                 try {
                   // Lost and unknown are the same ownership axis exercised by the stalled-screen
                   // tests, not separate stances. Preserve their measured ownership and observation
@@ -1709,12 +1710,12 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                     Promise.resolve(opts.brain.decide(controlObs, controller.signal)),
                     new Promise<ControlDecision>((_, reject) => {
                       // ⭐ **남은 절대 예산으로 clamp**(리뷰 must-fix 2R) — wall-clock 상한은 **tick 시작**에서만
-                      //   검사하므로, deadline 직전에 시작된 상담이 그대로면 최대 brainTimeoutMs(기본 15초)만큼
+                      //   검사하므로, deadline 직전에 시작된 상담이 그대로면 최대 brainTimeoutMs(기본 45초)만큼
                       //   hard deadline 을 **초과**한다. 상담 자체를 남은 예산 안으로 묶어 창을 닫는다.
                       //   최소 1ms(음수·0 이면 즉시 timeout → 다음 tick 상단 wall-clock 체크가 루프를 끊는다).
                       const remainMs = Math.max(1, hardI * 1000 - (Date.now() - loopStartedMs));
                       timer = setTimeout(() => { controller.abort(); reject(new Error('brain suggestion timeout')); },
-                        Math.min(opts.brainTimeoutMs ?? 15_000, remainMs));
+                        Math.min(opts.brainTimeoutMs ?? 45_000, remainMs));
                     }),
                     ...(parentAbort ? [parentAbort] : []),
                   ]);
@@ -1761,6 +1762,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                     // 관측 계약은 화면 분류 원문을 보존한다. 완료 정보량·자동 정지는 아래의
                     // `completionState` 폐쇄형 정규화만 소비하므로 blocked/idle 기록을 잃지 않는다.
                     ptyId: h.id, runId, moment: 'in-round', step: i, trigger, state: curState, action: decision.action,
+                    durationMs: Date.now() - brainStartedMs,
                     // `delivery-outcome` is a follow-up observation, not another verdict. Consumers count
                     // either initial stage once per decision and can distinguish verdicts without input.
                     supervisionRecordStage: decision.action === 'input' ? 'verdict-input' : 'verdict-no-input',
@@ -1848,7 +1850,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                   }
                 } catch (e) {
                   // Parent cancel outranks suggestion observation: leave the poll loop immediately so PTY cleanup is not
-                  // held by the 15s consultation timeout, even when a custom brain ignores its AbortSignal.
+                  // held by the 45s consultation timeout, even when a custom brain ignores its AbortSignal.
                   if (opts.signal?.aborted) {
                     timedOut = false;
                     exitReason = 'abort';
@@ -1856,7 +1858,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                   }
                   debug.log('self-implement', 'brain.fail', {
                     ptyId: h.id, runId, step: i, trigger, state: curState,
-                    roundContextPresent,
+                    roundContextPresent, durationMs: Date.now() - brainStartedMs,
                     error: String(e instanceof Error ? e.message : e).slice(0, 120),
                   });
                 } finally {

package/src/self-implement/heal-intake.ts

@@ -170,7 +170,11 @@ function withInboxLock<T>(file: string, work: () => T): T {
   finally { rmdirSync(lock); }
 }
 
-/** One durable JSON line per failure; repeat source+ref within an hour is folded. */
+/** One durable JSON line per failure; repeat source+ref within an hour is folded.
+ *  POD-HEAL-HOST — the loop start itself is refused inside a Pod (`startHealLoop` → `skipped-in-pod`):
+ *  a loop started there dies with the Pod. The line stays in the inbox, and the host re-records the
+ *  recovered Pod ledger failure into the HOST universe (`pod-ledger-collect.ts` → `intakeCollectedFailure`),
+ *  so the host heal loop triages it (harvest + narrowed relaunch). */
 export function recordFailureEvent(event: FailureEvent, root = effectiveInstanceRoot(), startLoop: StartHealLoop = startHealLoop): { folded: boolean } {
   if (!['release-run', 'harness-run', 'loop-tick', 'cron'].includes(event.source) ||
       !event.kind || !event.ref || !event.summary || !Number.isFinite(Date.parse(event.at))) {

package/src/self-implement/host-regate.ts

@@ -1,7 +1,7 @@
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { debug } from '../debug/log.js';
 import { getUserConfig } from '../user-config.js';
 import { publicExposureFiles, runExposeGate } from './expose-gate.js';
@@ -9,23 +9,32 @@ import { admitLandingMerge } from './frozen-merges.js';
 import { releaseGitDiffPaths, releasePathHold, releasePathHoldShouldPost, releasePathHoldComment, releasePathHoldCommentsArgs, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { detectTestInterference, parseFailureCount, runBunTest } from '../../scripts/detect-test-interference.js';
 import { MAX_INSPECTED_TEST_FILES, runTestInterferenceGate } from '../../scripts/ci-test-interference-gate.js';
+import { pwaGraph, pwaReach } from '../../scripts/ci-pwa-build-gate.js';
+
+/** Use pr-land's PWA reachability (including its undecidable-graph build fallback), not a blanket src/** trigger. */
+export function needsPwaBuild(files: readonly string[], repoRoot: string, graph: (root: string) => ReturnType<typeof pwaGraph> = pwaGraph): boolean {
+  return pwaReach(files, () => graph(repoRoot)).reaches;
+}
 
 /**
- * The PWA's static build type-checks every `src/**` file it imports, under Next's stricter
- * `ProcessEnv` — a change that only touches `src/**` can break it while tsc and bun test stay
- * green (2026-09-27: two such changes kept main's PWA build red for two hours). Build whenever
- * app code or non-test source changed; test files are never imported by the PWA.
+ * Give a temporary checkout the source checkout's dependencies: link `<dir>/node_modules` when it is really installed
+ * there (its `marker` package exists), otherwise install into the candidate. Shared by host regate and the task agent's
+ * land worktree (TA-LAND-WORKTREE).
  */
-export function needsPwaBuild(files: readonly string[]): boolean {
-  return files.some((file) => file.startsWith('apps/pwa/') || (file.startsWith('src/') && !/\.test\.tsx?$/.test(file)));
+export function provideCheckoutDependencies(candidate: string, sourceRoot: string, dir: string, marker: string, install: (cwd: string) => void): void {
+  if (existsSync(join(candidate, dir, 'node_modules'))) return;
+  if (existsSync(join(sourceRoot, dir, 'node_modules', marker, 'package.json'))) {
+    symlinkSync(join(sourceRoot, dir, 'node_modules'), join(candidate, dir, 'node_modules'), 'dir');
+  } else install(join(candidate, dir));
 }
 
-export interface HostRegateInput { prNumber: number; headCommit: string; repoRoot: string; goalFile?: string; verifyOnly?: boolean; /** Called by a resume sweep that already holds this PR's claim. */ resumed?: true }
+export interface HostRegateInput { prNumber: number; headCommit: string; repoRoot: string; goalFile?: string; verifyOnly?: boolean; /** TA-LIVE-LAND-2: run the full landing gates (release-path hold · neighbours · PR re-read) but stop before the freeze admission and `gh pr merge` — the task agent lands it later via `pr land --expected-head`. */ noMerge?: true; /** Called by a resume sweep that already holds this PR's claim. */ resumed?: true }
 export interface HostRegateResult { passed: boolean; failures: Array<{ step: string; detail: string }>; os: string; status?: 'passed' | 'failed' | 'unmeasured' | 'frozen'; /** verifyOnly: 실제로 얹어 잰 base 끝 */ baseCommit?: string }
 export type InterferenceVerdict = { passed: boolean; detail?: string; unmeasured?: boolean; /** neighbour tests left out so the selection fits the inspection cap */ neighborsTrimmed?: number };
 export type HostRegateDeps = {
   command?: (bin: string, args: readonly string[], cwd: string, env?: NodeJS.ProcessEnv) => { status: number | null; stdout: string; stderr: string };
   interference?: (files: readonly string[], cwd: string) => Promise<InterferenceVerdict>;
+  /** Legacy injection for callers that supply an ephemeral worktree instead of a locked slot. */
   makeTemp?: () => string;
   removeTemp?: (path: string) => void;
   acquire?: (repoRoot: string) => Promise<() => void>;
@@ -104,7 +113,7 @@ function slotOwnerAlive(slot: string): boolean {
   }
 }
 
-export async function acquireSlot(repoRoot: string, opts: { waitMs?: number; pollMs?: number; now?: () => number } = {}): Promise<() => void> {
+export async function acquireSlot(repoRoot: string, opts: { waitMs?: number; pollMs?: number; now?: () => number } = {}): Promise<(() => void) & { worktree: string }> {
   const gitDir = spawnSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], { cwd: repoRoot, encoding: 'utf8' });
   if (gitDir.status !== 0 || !gitDir.stdout.trim()) throw new Error('git common directory unavailable for host regate lock');
   const root = join(gitDir.stdout.trim(), 'elanous-host-regate');
@@ -117,7 +126,7 @@ export async function acquireSlot(repoRoot: string, opts: { waitMs?: number; pol
       try {
         mkdirSync(slot);
         writeFileSync(join(slot, 'pid'), String(process.pid));
-        return () => rmSync(slot, { recursive: true, force: true });
+        return Object.assign(() => rmSync(slot, { recursive: true, force: true }), { worktree: join(root, `worktree-${i}`) });
       } catch (error) {
         if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
         // A slot left by a crashed host process would otherwise block every later run.
@@ -133,6 +142,24 @@ export async function acquireSlot(repoRoot: string, opts: { waitMs?: number; pol
   }
 }
 
+function removeBrokenSlotRegistration(repoRoot: string, worktree: string): void {
+  const gitDir = spawnSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], { cwd: repoRoot, encoding: 'utf8' });
+  if (gitDir.status !== 0 || !gitDir.stdout.trim()) throw new Error('git common directory unavailable for slot repair');
+  const registrations = join(gitDir.stdout.trim(), 'worktrees');
+  if (!existsSync(registrations)) return;
+  for (const name of readdirSync(registrations)) {
+    const registration = join(registrations, name);
+    if (!lstatSync(registration).isDirectory()) continue;
+    const pointer = join(registration, 'gitdir');
+    if (!existsSync(pointer) || lstatSync(pointer).isSymbolicLink()) continue;
+    if (resolve(readFileSync(pointer, 'utf8').trim()) !== resolve(worktree, '.git')) continue;
+    rmSync(registration, { recursive: true });
+  }
+}
+
+/** Callers: podSelfImplementSpawn in src/task-orchestrator/surfaces/self-implement-pod.ts calls
+ *  (options.hostRegate ?? runHostRegate)({ prNumber, headCommit, repoRoot: hostRoot, ... });
+ *  sweepFrozenMerges in frozen-merges.ts also calls runHostRegate(entry); landing queue serialization stays there. */
 export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps = {}): Promise<HostRegateResult> {
   const command = deps.command ?? defaultCommand;
   const log = deps.log ?? ((event: 'passed' | 'failed' | 'unmeasured' | 'base-raced', data: Record<string, unknown>) => debug.log('harness.host-regate', event, data));
@@ -141,6 +168,19 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
   let base = '';
   let worktree: string | undefined;
   let attached = false;
+  let ephemeral = false;
+  let slotCommonDir: string | undefined;
+  const verifySlot = (): void => {
+    if (!worktree || !slotCommonDir || lstatSync(worktree).isSymbolicLink() || !lstatSync(worktree).isDirectory()) throw new Error('slot worktree mismatch');
+    const pointer = join(worktree, '.git');
+    if (!lstatSync(pointer).isFile() || lstatSync(pointer).isSymbolicLink()) throw new Error('slot worktree mismatch');
+    const common = realpathSync(run('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], worktree));
+    const registration = realpathSync(run('git', ['rev-parse', '--path-format=absolute', '--git-dir'], worktree));
+    if (common !== slotCommonDir || dirname(registration) !== join(slotCommonDir, 'worktrees')
+      || resolve(readFileSync(join(registration, 'gitdir'), 'utf8').trim()) !== resolve(pointer)
+      || resolve(readFileSync(pointer, 'utf8').trim().replace(/^gitdir: /, '')) !== registration
+      || run('git', ['rev-parse', '--show-toplevel'], worktree) !== worktree) throw new Error('slot worktree mismatch');
+  };
   let release: (() => void) | undefined;
   let endLanding: ((merged?: boolean) => void) | undefined;
   let landed = false;
@@ -168,16 +208,57 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
     const baseRefName = view.baseRefName;
     // verifyOnly(승인 탭): PR 에 기록된 base(baseRefOid)는 main 의 «지금 끝»보다 늙을 수 있다 — 지금 끝에 얹어 잰다.
     let baseCommit = view.baseRefOid!;
+    // REGATE-STALE-BASE: GitHub's baseRefOid can stay at the PR-open tip after main moves. After the bounded re-reads the
+    // regate measures on the fetched base tip (what the squash merge lands on) and records the stale PR base instead of failing.
+    // The closing PR re-read must still show the last PR base seen here (a PR that changed again is not the PR we measured).
+    let stalePrBase: string | undefined;
+    const initialPrBase = baseCommit;
+    let buildPwa = false;
     try {
       run('git', ['fetch', 'origin', `refs/heads/${baseRefName}`], input.repoRoot);
-      const fetchedBase = run('git', ['rev-parse', 'FETCH_HEAD'], input.repoRoot);
+      let fetchedBase = run('git', ['rev-parse', 'FETCH_HEAD'], input.repoRoot);
       if (input.verifyOnly) { baseCommit = fetchedBase; verifiedBase = fetchedBase; }
-      else if (fetchedBase !== baseCommit) throw new Error('fetched PR base differs from checked SHA');
+      else {
+        for (let attempt = 1; fetchedBase !== baseCommit; attempt++) {
+          debug.log('harness.host-regate', 'base-moved-retry', { pr: input.prNumber, attempt, checked: baseCommit, fetched: fetchedBase });
+          if (attempt === 3) {
+            stalePrBase = baseCommit;
+            debug.log('harness.host-regate', 'base-stale', { pr: input.prNumber, prBaseRefOidInitial: initialPrBase, prBaseRefOid: baseCommit, fetched: fetchedBase, candidateBase: fetchedBase });
+            baseCommit = fetchedBase;
+            break;
+          }
+          await new Promise((resolve) => setTimeout(resolve, 1_000));
+          view = readPr();
+          if (view.headRefOid !== input.headCommit || view.state !== 'OPEN' || view.isDraft !== false || view.baseRefName !== baseRefName || !/^[0-9a-f]{40}$/i.test(view.baseRefOid ?? '')) {
+            return result('unmeasured', 'pr-head', 'PR head, base commit, ready state or open state unavailable or changed');
+          }
+          baseCommit = view.baseRefOid!;
+          run('git', ['fetch', 'origin', `refs/heads/${baseRefName}`], input.repoRoot);
+          fetchedBase = run('git', ['rev-parse', 'FETCH_HEAD'], input.repoRoot);
+        }
+      }
       run('git', ['fetch', 'origin', `refs/pull/${input.prNumber}/head`], input.repoRoot);
       if (run('git', ['rev-parse', 'FETCH_HEAD'], input.repoRoot) !== input.headCommit) throw new Error('fetched PR head differs from checked SHA');
-      worktree = (deps.makeTemp ?? (() => mkdtempSync(join(tmpdir(), 'elanous-host-regate-'))))();
-      run('git', ['worktree', 'add', '--detach', worktree, baseCommit], input.repoRoot);
-      attached = true;
+      const slotWorktree = (release as (() => void) & { worktree?: string }).worktree;
+      ephemeral = !!deps.makeTemp || !slotWorktree;
+      worktree = deps.makeTemp?.() ?? slotWorktree ?? mkdtempSync(join(tmpdir(), 'host-regate-'));
+      if (ephemeral && slotWorktree && resolve(worktree) === resolve(slotWorktree)) throw new Error('temporary worktree overlaps locked slot');
+      if (!ephemeral && !deps.acquire) {
+        slotCommonDir = realpathSync(run('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], input.repoRoot));
+      }
+      if (!ephemeral && existsSync(worktree)) {
+        if (slotCommonDir) verifySlot();
+        attached = true;
+        // A previous host may have died mid-merge; never carry its index or untracked files into this run.
+        run('git', ['reset', '--hard'], worktree);
+        run('git', ['clean', '-fdx', '-e', 'node_modules', '-e', '.next', '-e', '*.tsbuildinfo'], worktree);
+        run('git', ['checkout', '--detach', baseCommit], worktree);
+      }
+      if (!attached) {
+        if (!ephemeral && !deps.acquire) removeBrokenSlotRegistration(input.repoRoot, worktree);
+        run('git', ['worktree', 'add', '--detach', worktree, baseCommit], input.repoRoot);
+        attached = true;
+      }
       if (run('git', ['rev-parse', 'HEAD'], worktree) !== baseCommit) throw new Error('worktree base HEAD mismatch');
       base = run('git', ['merge-base', baseCommit, input.headCommit], worktree);
       files = run('git', ['diff', '--name-only', base, input.headCommit], worktree).split('\n').filter(Boolean);
@@ -213,14 +294,10 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
       // a temporary checkout whose node_modules is empty or purged; linking it turned every gate into
       // «Cannot find package 'typescript'» (unmeasured · 2026-09-29 #21239). Install into the candidate instead.
       const candidate = worktree;
-      const provide = (dir: string, marker: string): void => {
-        if (existsSync(join(candidate, dir, 'node_modules'))) return;
-        if (existsSync(join(input.repoRoot, dir, 'node_modules', marker, 'package.json'))) {
-          symlinkSync(join(input.repoRoot, dir, 'node_modules'), join(candidate, dir, 'node_modules'), 'dir');
-        } else run('bun', ['install', '--frozen-lockfile'], join(candidate, dir));
-      };
+      const provide = (dir: string, marker: string): void => provideCheckoutDependencies(candidate, input.repoRoot, dir, marker, (cwd) => { run('bun', ['install', '--frozen-lockfile'], cwd); });
       provide('', 'typescript');
-      if (needsPwaBuild(files) && existsSync(join(worktree, 'apps/pwa'))) provide('apps/pwa', 'next');
+      buildPwa = needsPwaBuild(files, worktree);
+      if (buildPwa && existsSync(join(worktree, 'apps/pwa'))) provide('apps/pwa', 'next');
     } catch (e) { return result('unmeasured', 'worktree', String(e)); }
     try {
       const interference = await (deps.interference ?? ((f: readonly string[], c: string) => defaultInterference(f, c, { neighbors: !input.verifyOnly })))(files, worktree);
@@ -244,19 +321,21 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
       try { run('bun', ['scripts/ci-isolation-hardcode-gate.ts', '--changed-files', ...files], worktree); }
       catch (e) { return result(/\[isolation-gate\] FAIL/.test(String(e)) ? 'failed' : 'unmeasured', 'isolation-gate', String(e)); }
     }
-    if (needsPwaBuild(files)) {
+    if (buildPwa) {
       try { run('bun', ['bin/elanous.mjs', '--test', 'nexus', 'build'], worktree); }
       catch (e) { return result(String(e).includes('command unavailable') ? 'unmeasured' : 'failed', 'nexus-build', String(e)); }
     }
     let current: PrView;
     try { current = readPr(); }
     catch (e) { return result('unmeasured', 'pr-view', String(e)); }
-    if (current.headRefOid !== input.headCommit || current.baseRefName !== baseRefName || (!input.verifyOnly && current.baseRefOid !== baseCommit) || current.state !== 'OPEN' || current.isDraft !== false) {
+    if (current.headRefOid !== input.headCommit || current.baseRefName !== baseRefName || (!input.verifyOnly && current.baseRefOid !== (stalePrBase ?? baseCommit)) || current.state !== 'OPEN' || current.isDraft !== false) {
       return result('unmeasured', 'pr-base-changed', 'PR head or base changed during host regate; rerun against the new base');
     }
     // --match-head-commit pins the head. gh has no base pin, so the base was re-read just
     // above; the seconds between that read and the merge are checked after the fact below.
     if (input.verifyOnly) return result('passed');
+    // TA-REJUDGE-ON-HEAD — 병합 없는 재게이트는 «잰 base 끝»을 같이 낸다(겹침 증거의 gate.baseCommit).
+    if (input.noMerge) return { ...result('passed'), status: 'passed', baseCommit };
     const landing = admitLandingMerge({ prNumber: input.prNumber, headCommit: input.headCommit, repoRoot: input.repoRoot, ...(input.goalFile ? { goalFile: input.goalFile } : {}) }, deps.freezeRoot, {}, input.resumed ? undefined : { prNumber: input.prNumber, repoRoot: input.repoRoot, headCommit: input.headCommit }, { prodFreezeRoot: deps.prodFreezeRoot });
     if (landing.kind !== 'merge') {
       debug.log('harness.merge', 'frozen', { pr: input.prNumber, ...(landing.kind === 'held' ? { reason: landing.freeze.reason, until: landing.freeze.until } : { resumedElsewhere: true }) });
@@ -295,10 +374,22 @@ export async function runHostRegate(input: HostRegateInput, deps: HostRegateDeps
     return result('unmeasured', 'host-regate', String(e));
   } finally {
     try { endLanding?.(landed); } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'landing-release', detail: String(e) }); }
-    try { if (attached && worktree) run('git', ['worktree', 'remove', '--force', worktree], input.repoRoot); }
-    catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
-    try { if (worktree) (deps.removeTemp ?? ((path) => rmSync(path, { recursive: true, force: true })))(worktree); }
-    catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
+    try {
+      if (attached && worktree) {
+        if (slotCommonDir) verifySlot();
+        run('git', ['reset', '--hard'], worktree);
+        run('git', ['clean', '-fdx', '-e', 'node_modules', '-e', '.next', '-e', '*.tsbuildinfo'], worktree);
+      }
+    } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
+    if (ephemeral && worktree) {
+      try {
+        if (attached) run('git', ['worktree', 'remove', '--force', worktree], input.repoRoot);
+      } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
+      try {
+        if (deps.removeTemp) deps.removeTemp(worktree);
+        else rmSync(worktree, { recursive: true, force: true });
+      } catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'cleanup', detail: String(e) }); }
+    }
     try { release?.(); }
     catch (e) { log('unmeasured', { pr: input.prNumber, files, os: process.platform, failedStep: 'lock', detail: String(e) }); }
     if (failures.length && failures[0]?.step !== 'release-path-hold') {

package/src/self-implement/l8-merge-queue.ts

@@ -30,9 +30,27 @@ export type L8MergeQueueDeps = {
 };
 
 export type L8ShadowVerdict = { number: number; head: string; base?: string; verdict: 'pass' | 'conflict' | 'fail'; detail?: string; tests: string[]; at: string };
-export type L8ShadowQueueState = { pending: { number: number; head: string }[]; verdicts: L8ShadowVerdict[] };
+export type L8ShadowQueueItem = {
+  number: number;
+  head: string;
+  files?: string[];
+  filesUnmeasured?: true;
+  overlapsWith?: number[];
+  overlapsUnknownWith?: number[];
+};
+export type L8ShadowQueueState = { pending: L8ShadowQueueItem[]; verdicts: L8ShadowVerdict[] };
+export type L8ShadowEnqueueObservation = {
+  number: number;
+  head: string;
+  fileCount: number | null;
+  filesUnmeasured: boolean;
+  overlapsWith: number[];
+  overlapsUnknownWith: number[];
+  pendingAfter: number;
+};
 export type L8ShadowQueueDeps = L8MergeQueueDeps & {
   observe?: (verdict: L8ShadowVerdict) => void | Promise<void>;
+  observeEnqueue?: (entry: L8ShadowEnqueueObservation) => void | Promise<void>;
   resolveConflict?: (file: string, conflicted: string, target: string, worktree: string) => Promise<string>;
 };
 
@@ -80,23 +98,67 @@ export function shadowPrNumber(raw: string): number {
   return number;
 }
 
+// Keep the CLI's existing pending return shape; metadata remains in the shared ledger and enqueue observation.
+function publicShadowQueueState(state: L8ShadowQueueState): L8ShadowQueueState {
+  return { ...state, pending: state.pending.map(({ number, head }) => ({ number, head })) };
+}
+
 export async function statusL8ShadowQueue(cwd: string, deps: L8ShadowQueueDeps = {}): Promise<L8ShadowQueueState> {
-  return withShadowQueue(cwd, deps, async (state) => state);
+  return withShadowQueue(cwd, deps, async (state) => publicShadowQueueState(state));
 }
 
 export async function enqueueL8ShadowQueue(cwd: string, number: number, deps: L8ShadowQueueDeps = {}): Promise<L8ShadowQueueState> {
   if (!Number.isSafeInteger(number) || number <= 0) throw new Error('expected a positive PR number');
   return withShadowQueue(cwd, deps, async (state, path) => {
     const execute = deps.command ?? command;
-    const view = JSON.parse(shadowCommand(execute, 'gh', ['pr', 'view', String(number), '--json', 'headRefOid,baseRefName,state,isDraft,isCrossRepository'], cwd)) as {
+    const view = JSON.parse(shadowCommand(execute, 'gh', ['pr', 'view', String(number), '--json', 'headRefOid,baseRefName,state,isDraft,isCrossRepository,files'], cwd)) as {
       headRefOid?: string; baseRefName?: string; state?: string; isDraft?: boolean; isCrossRepository?: boolean;
+      files?: { path?: string }[];
     };
     if (!view.headRefOid || !/^[0-9a-f]{40}$/i.test(view.headRefOid) || view.baseRefName !== 'main'
       || view.state !== 'OPEN' || view.isDraft !== false || view.isCrossRepository !== false) throw new Error('PR is not an open, ready, same-repository main PR');
     if (state.pending.some((p) => p.number === number)) throw new Error(`PR #${number} already queued`);
-    state.pending.push({ number, head: view.headRefOid });
+    const files = Array.isArray(view.files) && view.files.length < 100
+      && view.files.every((file) => typeof file?.path === 'string')
+      ? [...new Set(view.files.map((file) => file.path!))].sort()
+      : undefined;
+    const filesUnmeasured = !files;
+    const overlapsWith: number[] = [];
+    const overlapsUnknownWith: number[] = [];
+    const paths = new Set(files);
+    for (const previous of state.pending) {
+      if (filesUnmeasured || !Array.isArray(previous.files) || previous.filesUnmeasured) {
+        overlapsUnknownWith.push(previous.number);
+      } else if (previous.files.some((file) => paths.has(file))) {
+        overlapsWith.push(previous.number);
+      }
+    }
+    const item: L8ShadowQueueItem = {
+      number, head: view.headRefOid, ...(files ? { files } : { filesUnmeasured: true as const }),
+      overlapsWith, overlapsUnknownWith,
+    };
+    const entry: L8ShadowEnqueueObservation = {
+      number, head: view.headRefOid, fileCount: files?.length ?? null, filesUnmeasured,
+      overlapsWith, overlapsUnknownWith, pendingAfter: state.pending.length + 1,
+    };
+    state.pending.push(item);
     writeShadowQueue(path, state);
-    return state;
+    try {
+      await (deps.observeEnqueue ?? ((data) => {
+        const store = getDefaultLogStore();
+        if (!store) {
+          if (process.env.NODE_ENV === 'test') return;
+          throw new Error('merge-queue observation store unavailable');
+        }
+        store.insertBatch([{ rec: { ts: new Date().toISOString(), category: 'merge-queue', event: 'enqueued', data }, surface: 'merge-queue' }]);
+      }))(entry);
+    } catch (error) {
+      // The shared queue is still locked: remove only this unobserved enqueue, leaving older items intact.
+      state.pending.pop();
+      writeShadowQueue(path, state);
+      throw error;
+    }
+    return publicShadowQueueState(state);
   });
 }