elanous 0.2.28 → 0.2.31

package/src/self-implement/running-runs.ts

@@ -9,7 +9,7 @@ import { isPidAlive } from '../git-fs/worktree.js';
 import { LogStore } from '../mss/logging/log-store.js';
 import { loadSelfDevRun, selfDevRunsDir, type SelfDevRunState } from '../self-dev/run-store.js';
 import { listPtyManifestRowsAt } from '../pty-shell/pty-manifest.js';
-import { classifyFederatedLedgerDirectoryReadFailure, isTerminatedUnfinishedLifecycle, queryFederatedUnfinishedRunLedgers, resolveFederatedRunLedgerDirectories, type FederatedUnfinishedRunLedgerEntry, type FederatedUnfinishedRunLedgerQuery, type UnfinishedRunLifecycle } from './run-ledger.js';
+import { classifyFederatedLedgerDirectoryReadFailure, isTerminatedUnfinishedLifecycle, queryFederatedUnfinishedRunLedgers, resolveFederatedRunLedgerDirectories, type FederatedUnfinishedRunLedgerEntry, type FederatedUnfinishedRunLedgerQuery, type NonBlockingRunLedgerRecord, type UnfinishedRunLifecycle } from './run-ledger.js';
 import { SELF_IMPLEMENT_PROGRESS_STAGES } from './orchestrator.js';
 
 export type RunningRunStatus = 'running' | 'probable-running' | 'ended-unclosed' | 'unknown';
@@ -55,6 +55,8 @@ export interface RunningRunAssessment {
   readonly ptyUpdatedAt: number | null;
   readonly ledgerDirectories: readonly string[];
   readonly ptyRefs: readonly Pick<FederatedPtyRef, 'instance' | 'id' | 'kind'>[];
+  /** Non-blocking request record (kind·reason·next) carried by this runId's ledger; absent for runs without one. */
+  readonly nonBlocking?: NonBlockingRunLedgerRecord;
 }
 
 export interface RunningRunsObservation {
@@ -376,14 +378,16 @@ export function assessRunningRuns(
     const ledgerDirectories = [...new Set(matchingLedgers.map((entry) => entry.ledgerDirectory))].sort();
     const phase = { phaseObservation: phaseObservation === 'not-observed' && latestPhase ? 'observed' as const : phaseObservation, lastPhase: latestPhase?.phase ?? null, lastPhaseObservedAt: latestPhase?.observedAt ?? null };
     const ptyRefs = refs.map(({ instance, id, kind }) => ({ instance, id, kind }));
+    const nonBlocking = matchingLedgers.find((entry) => entry.nonBlocking)?.nonBlocking;
+    const nonBlockingField = nonBlocking === undefined ? {} : { nonBlocking };
     if (matchingLedgers.some((entry) => isTerminatedUnfinishedLifecycle(entry.lifecycle))) {
-      return { runId, status: 'ended-unclosed' as const, presence: refs.length > 0 ? 'ledger-and-pty-observed' as const : 'ledger-without-pty-observed' as const, reason: 'ledger-positive-termination-evidence', lifecycle, lastActivityTimestamp, ...phase, ptyUpdatedAt, ledgerDirectories, ptyRefs };
+      return { runId, status: 'ended-unclosed' as const, presence: refs.length > 0 ? 'ledger-and-pty-observed' as const : 'ledger-without-pty-observed' as const, reason: 'ledger-positive-termination-evidence', lifecycle, lastActivityTimestamp, ...phase, ptyUpdatedAt, ledgerDirectories, ptyRefs, ...nonBlockingField };
     }
     if (refs.length > 0 && lifecycle === 'live') {
-      return { runId, status: 'running' as const, presence: 'ledger-live-and-pty-observed' as const, reason: 'ledger-live-and-pty-alive', lifecycle, lastActivityTimestamp, ...phase, ptyUpdatedAt, ledgerDirectories, ptyRefs };
+      return { runId, status: 'running' as const, presence: 'ledger-live-and-pty-observed' as const, reason: 'ledger-live-and-pty-alive', lifecycle, lastActivityTimestamp, ...phase, ptyUpdatedAt, ledgerDirectories, ptyRefs, ...nonBlockingField };
     }
     if (matchingLedgers.length > 0 && lifecycle === 'live' && pty.unreadable.length === 0 && refs.length === 0) {
-      return { runId, status: 'probable-running' as const, presence: 'ledger-live-pty-not-observed' as const, reason: 'ledger-without-live-pty', lifecycle, lastActivityTimestamp, ...phase, ptyUpdatedAt, ledgerDirectories, ptyRefs };
+      return { runId, status: 'probable-running' as const, presence: 'ledger-live-pty-not-observed' as const, reason: 'ledger-without-live-pty', lifecycle, lastActivityTimestamp, ...phase, ptyUpdatedAt, ledgerDirectories, ptyRefs, ...nonBlockingField };
     }
     const ledgerUnreadable = hasUnreadableLedgerObservation(ledgerObservation);
     const reason = matchingLedgers.length === 0
@@ -395,7 +399,7 @@ export function assessRunningRuns(
       : matchingLedgers.length === 0 ? 'pty-without-ledger-observed'
       : refs.length === 0 ? 'ledger-without-pty-observed'
       : 'ledger-and-pty-observed';
-    return { runId, status: 'unknown' as const, presence, reason, lifecycle, lastActivityTimestamp, ...phase, ptyUpdatedAt, ledgerDirectories, ptyRefs };
+    return { runId, status: 'unknown' as const, presence, reason, lifecycle, lastActivityTimestamp, ...phase, ptyUpdatedAt, ledgerDirectories, ptyRefs, ...nonBlockingField };
   });
   const counts: Record<RunningRunStatus, number> = { running: 0, 'probable-running': 0, 'ended-unclosed': 0, unknown: 0 };
   for (const entry of entries) counts[entry.status] += 1;
@@ -657,7 +661,7 @@ export function renderRunningRuns(result: RunningRunsResult): string {
     `observed live ptys: ${result.pty.observedRefCount} without runId: ${result.pty.withoutRunIdCount} not counted as running: ${result.pty.notCountedRefCount}`,
     `unreadable pty roots: ${result.pty.unreadable.join(',') || 'none'}`,
     `phase stores: ${result.phases?.targetCount ?? 0} readable: ${result.phases?.readableTargetCount ?? 0} unreadable: ${result.phases?.unreadableTargetCount ?? 0} unreadable targets: ${result.phases?.unreadableTargets.join(',') || 'none'} non-stage events discarded: ${result.phases?.discardedNonStageEventCount ?? 0}`,
-    ...result.entries.map((entry) => `runId=${entry.runId} status=${entry.status} presence=${entry.presence} reason=${entry.reason} lifecycle=${entry.lifecycle ?? 'none'} lastActivity=${entry.lastActivityTimestamp ?? 'null'} phaseObservation=${entry.phaseObservation ?? 'not-observed'} lastPhase=${entry.lastPhase ?? 'none'} lastPhaseObservedAt=${entry.lastPhaseObservedAt ?? 'none'} ledgerDirectories=${entry.ledgerDirectories.join(',') || 'none'} ptyRefs=${entry.ptyRefs.map((ref) => `${ref.instance}:${ref.id}`).join(',') || 'none'}`),
+    ...result.entries.map((entry) => `runId=${entry.runId} status=${entry.status} presence=${entry.presence} reason=${entry.reason} lifecycle=${entry.lifecycle ?? 'none'} lastActivity=${entry.lastActivityTimestamp ?? 'null'} phaseObservation=${entry.phaseObservation ?? 'not-observed'} lastPhase=${entry.lastPhase ?? 'none'} lastPhaseObservedAt=${entry.lastPhaseObservedAt ?? 'none'} ledgerDirectories=${entry.ledgerDirectories.join(',') || 'none'} ptyRefs=${entry.ptyRefs.map((ref) => `${ref.instance}:${ref.id}`).join(',') || 'none'}${entry.nonBlocking ? ` nonBlocking=kind:${entry.nonBlocking.kind} reason:${entry.nonBlocking.reason ?? 'none'} next:${entry.nonBlocking.next ?? 'none'}` : ''}`),
     partial
       ? `quantity scope: running=unknown lowerBound=${lowerBound} population=${result.quantities.running.population}; total=unknown entries=unknown population=${result.quantities.total.population}; ${observationScopeText(result.observation)}`
       : `quantity scope: running=${result.quantities.running.value} population=${result.quantities.running.population}; total=${result.quantities.total.value} entries=${result.quantities.entries.value} population=${result.quantities.total.population}; ${observationScopeText(result.observation)}`,

package/src/self-implement/seams.ts

@@ -2493,6 +2493,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
 
     openPr: async ({ title, body, head, base, draft, labels, cwd }) => {
       const resolvedBase = assertBaseBranchOnOrigin(cwd, base);
+      const harnessSeat = process.env.ELANOUS_HARNESS_SEAT;
       const outcome = (o.prManager ?? makePrManager()).upsertPr({
         branch: head,
         worktreePath: cwd,
@@ -2501,6 +2502,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         commitMessage: title,
         ...(resolvedBase ? { base: resolvedBase } : {}),
         ...(draft !== undefined ? { draft } : {}),
+        ...(harnessSeat === 'OP' || harnessSeat === 'TC' || harnessSeat === 'MK' || harnessSeat === 'UX' ? { seat: harnessSeat } : {}),
         // BENCH-ISOLATED-ARMS ② — base 가 `bench/<id>/base` 면 라벨 `elanous:bench` 를 더한다.
         ...(() => {
           const all = benchIdFromBase(resolvedBase) && !labels?.includes(BENCH_LABEL) ? [...(labels ?? []), BENCH_LABEL] : labels;

package/src/self-implement/self-implement-runtime.ts

@@ -29,6 +29,7 @@ import { normalizeTargetPaths, observeDecomposerSelection, selectFabricDecompose
 import { parseAskProseTitle } from '../self-dev/launch-preflight.js';
 import { getUserConfig } from '../user-config.js';
 import { mintRunId } from '../harness/harness-space.js';
+import { recordNonBlockingRunPending, recordNonBlockingRunResult } from './run-ledger.js';
 
 type SelfImplementApprover = NonNullable<SelfImplementSeams['approvePr']>;
 type SelfImplementGoalAuthor = (ask: string, cwd: string, deps?: { goalTitle?: string }) => Promise<{ path: string }>;
@@ -67,6 +68,16 @@ export function setSelfImplementRuntimeDeps(d: SelfImplementRuntimeDeps | null):
   runtimeDeps = d ?? {};
 }
 
+// ── non-blocking 원장 기록 dir (테스트 seam · 기본 = 정본 run ledger dir) ──
+// #26634 칸 NONBLOCKING-RESULT-LEDGER: pending requestId 와 완료 kind·reason·next 를
+// appendRunLedgerEntry 로 정본 run ledger 에 보존한다. 테스트 격리에서만 이 dir 을 바꾼다.
+let nonBlockingLedgerDir: string | undefined;
+
+/** 테스트 헬퍼 — non-blocking 원장 기록 dir 주입. null = un-set(정본 run ledger dir). */
+export function _setSelfImplementNonBlockingLedgerDirForTesting(dir: string | null): void {
+  nonBlockingLedgerDir = dir ?? undefined;
+}
+
 // ── seam factory (테스트 seam) ──
 let seamsFactory: (o: DefaultSeamsOptions) => SelfImplementSeams = defaultSeams;
 
@@ -859,6 +870,9 @@ export const selfImplementRuntime: ToolRuntime<SelfImplementRuntimeRequest, Self
       const runId = allocatedRunId ?? mintRunId();
       const requestId = runId;
       const lookup = `eln logs --category self-implement --event runtime.non-blocking-completed,runtime.non-blocking-failed --grep ${requestId} --since 3h --all --include-test`;
+      const ledgerDirOptions = nonBlockingLedgerDir === undefined ? {} : { dir: nonBlockingLedgerDir };
+      // 즉시 pending 관측 기록 — appendRunLedgerEntry 는 fail-soft 계약이라 호출자가 지킨다.
+      try { recordNonBlockingRunPending(requestId, ledgerDirOptions); } catch { /* observer record cannot break the run */ }
       void drive(runId).then(
         (result) => {
           debug.log('self-implement', result.kind === 'failed' ? 'runtime.non-blocking-failed' : 'runtime.non-blocking-completed', {
@@ -870,6 +884,16 @@ export const selfImplementRuntime: ToolRuntime<SelfImplementRuntimeRequest, Self
             ok: result.ok,
             ...(result.stage === undefined ? {} : { stage: result.stage }),
           }, result.kind === 'failed' ? { level: 'warn' } : undefined);
+          try {
+            recordNonBlockingRunResult(requestId, {
+              kind: result.kind,
+              ...(result.reason === undefined ? {} : { reason: result.reason }),
+              // next는 런이 실제로 산출한 값만 원장에 남긴다(unknown 보존 — 기본 문구 지어내기 없음).
+              ...(result.next === undefined ? {} : { next: result.next }),
+              ok: result.ok,
+              ...(result.runId ? { runId: result.runId } : {}),
+            }, ledgerDirOptions);
+          } catch { /* observer record cannot break the run */ }
         },
         (error) => {
           const reason = error instanceof Error ? error.message : String(error);
@@ -879,6 +903,14 @@ export const selfImplementRuntime: ToolRuntime<SelfImplementRuntimeRequest, Self
             reason,
             next: '요청과 실패 이유를 확인한 뒤 다시 요청',
           }, { level: 'warn' });
+          try {
+            // reject 경로엔 런이 산출한 next가 없다 — 원장에는 생략해 unknown 보존(기본 문구는 debug.log 임시 경로에만 남긴다).
+            recordNonBlockingRunResult(requestId, {
+              kind: 'failed',
+              reason,
+              ok: false,
+            }, ledgerDirOptions);
+          } catch { /* observer record cannot break the run */ }
         },
       );
       return {

package/src/self-implement/shadow-stage.ts

@@ -10,6 +10,7 @@
 // 배선은 P4(현재 비-git 은 front door 에서 refuse 유지 → 이 적용 경로는 프로덕션 미도달).
 
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { cpSync, existsSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
@@ -49,7 +50,7 @@ export function stageNonGitDir(opts: { target: string; branch: string }): StageN
   const slug = basename(target).replace(/[^a-zA-Z0-9._-]/g, '-');
   const shadowPath = join(tmpdir(), `elanous-shadow-${slug}-${process.pid}`);
   // 이전 세대 잔여 정리(고아 방지·createWorktree resetExisting 정합).
-  try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS }); } catch { /* fail-soft */ }
+  try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER }); } catch { /* fail-soft */ }
 
   // ② 대상 → 그림자 복사(내용 전체·심볼릭 보존 X: cpSync 기본).
   cpSync(target, shadowPath, { recursive: true });
@@ -69,7 +70,7 @@ export function stageNonGitDir(opts: { target: string; branch: string }): StageN
     path: shadowPath,
     branch,
     base,
-    cleanup: () => { try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS }); } catch { /* fail-soft */ } },
+    cleanup: () => { try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER }); } catch { /* fail-soft */ } },
   };
 }
 
@@ -94,9 +95,9 @@ export function stageFile(opts: { target: string; branch: string }): StageFileRe
   const fileName = basename(target);
   const slug = fileName.replace(/[^a-zA-Z0-9._-]/g, '-');
   const shadowPath = join(tmpdir(), `elanous-shadow-file-${slug}-${process.pid}`);
-  try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS }); } catch { /* fail-soft */ }
+  try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER }); } catch { /* fail-soft */ }
 
-  spawnSync('mkdir', ['-p', shadowPath], { timeout: GIT_TIMEOUT_MS });
+  spawnSync('mkdir', ['-p', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   cpSync(target, join(shadowPath, fileName));
 
   git(shadowPath, ['init', '-b', 'shadow-base']);
@@ -113,7 +114,7 @@ export function stageFile(opts: { target: string; branch: string }): StageFileRe
     fileName,
     branch,
     base,
-    cleanup: () => { try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS }); } catch { /* fail-soft */ } },
+    cleanup: () => { try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER }); } catch { /* fail-soft */ } },
   };
 }
 
@@ -166,7 +167,7 @@ export function applyShadowToTarget(opts: { shadowPath: string; target: string;
   debug.log('harness.target', 'apply.backup', { target: target.slice(-48), backup: backup.slice(-48) });
 
   // ② rsync 미러링(--delete·그림자 git 메타 제외). rsync 부재 = fail-closed(백업만 남기고 미적용).
-  const probe = spawnSync('rsync', ['--version'], { encoding: 'utf8', timeout: 5_000 });
+  const probe = spawnSync('rsync', ['--version'], { encoding: 'utf8', timeout: 5_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   if (probe.status !== 0) {
     debug.log('harness.target', 'apply.no-rsync', { target: target.slice(-48) });
     return { backup, applied: false, log: 'rsync 미설치 → 적용 안 함(백업만 생성·fail-closed). 수동 적용 필요.' };

package/src/self-implement/stop-autoheal.ts

@@ -13,7 +13,7 @@
  *   main-sync          → rebase-regate            리베이스(MERGE-INTENT-RESOLVE 의도 해석) 뒤 재게이트
  *   pod-died           → resume-from-salvage      `salvage/run-<6hex>/<leaf>` 가지에서 resume(DRAFT-NOT-ARCHIVE)
  *   evidence-uncovered → derive-evidence-rejudge  런 출력·시험·배선에서 증거를 끌어내 1회 재판정
- *   review-repeat · review-out-of-scope · fabric · launch-failed · unclassified → needs-owner(새 라운드 없음)
+ *   review-repeat · review-out-of-scope · fabric · launch-failed · gate-failed · unclassified → needs-owner(새 라운드 없음)
  *
  * 사다리의 «출처»: `graphs/overlays/stop-heal-ladder.yaml` 이 갈래마다 처방 노드(id = 처방 이름)를 선언한다.
  *    그 갈래에 얹힌 오버레이가 더한 노드 id 가 처방이다(source='graph'). 선언이 없거나 못 읽으면
@@ -52,6 +52,7 @@ export const AUTOHEAL_ACTION_BY_CLASS: Readonly<Record<RunStopClass, AutohealAct
   'review-out-of-scope': 'needs-owner',
   fabric: 'needs-owner',
   'launch-failed': 'needs-owner',
+  'gate-failed': 'needs-owner',
   unclassified: 'needs-owner',
 };
 

package/src/self-implement/train-gate-remote.ts

@@ -3,9 +3,10 @@
  *  Unlike `dispatchHeavyCheck` it never falls back to a local run: a busy host or an infra failure is «unmeasured».
  *  The only local commands are git (cat-file · rev-parse · push · diff). */
 import { debug } from '../debug/log.js';
+import { parseGateScenario, readGateScenarioFile } from './gate-scenario.js';
 import { getDefaultLogStore } from '../mss/logging/log-store.js';
 import {
-  realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote,
+  gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote,
   type GateRemoteRunner, type GateRemoteSettings, type RemoteRunOutcome,
 } from './gate-remote.js';
 
@@ -21,6 +22,9 @@ export interface TrainGateInput {
   changedFiles: readonly string[];
   /** Paths deleted by the integration commit — kept in `changedFiles` for tsc/PWA reach, never run as tests. */
   deletedFiles?: readonly string[];
+  /** Optional v0 JSON scenario. Selected tests are additive; invalid input is unmeasured. */
+  scenario?: unknown;
+  scenarioFile?: string;
   settings?: GateRemoteSettings;
 }
 
@@ -42,9 +46,10 @@ const quote = (value: string) => `'${value.replaceAll("'", `'\\''`)}'`;
 const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
 
 /** The host-side shell body: each step runs only if the one before it passed. Exported for tests. */
-export function trainGateScript(baseSha: string, changedFiles: readonly string[], deleted: ReadonlySet<string> = new Set()): string {
+export function trainGateScript(baseSha: string, changedFiles: readonly string[], deleted: ReadonlySet<string> = new Set(), scenarioTests: readonly string[] = []): string {
   // A deleted test file is a changed path (tsc/PWA reach) but not something to run.
-  const tests = changedFiles.filter((file) => TEST_FILE.test(file) && !deleted.has(file));
+  const changedTests = changedFiles.filter((file) => TEST_FILE.test(file) && !deleted.has(file));
+  const tests = scenarioTests.length ? [...new Set([...changedTests, ...scenarioTests])] : changedTests;
   const steps = [
     `TSC_BASE_REF=${quote(baseSha)} bun scripts/ci-typecheck-changed.ts --local`,
     ...(tests.length ? [`bun run test:deterministic ${tests.map(quote).join(' ')}`] : []),
@@ -72,6 +77,30 @@ export const TRAIN_GATE_HOST = 'node-b';
 export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemoteRunner = realGateRemoteRunner, deps: TrainGateDeps = {}): Promise<TrainGateResult> {
   const settings = input.settings ?? await loadSettings();
   const host = settings.host;
+  const hostCap = gateRemoteHostCap(settings, host);
+  let scenarioTests: string[] = [];
+  if (input.scenario !== undefined || input.scenarioFile !== undefined) {
+    try {
+      if (input.scenario !== undefined && input.scenarioFile !== undefined) throw new Error('choose scenario or scenarioFile');
+      const scenario = parseGateScenario(input.scenarioFile === undefined ? input.scenario : readGateScenarioFile(input.scenarioFile), { baseSha: input.baseSha, headSha: input.commit, changedFiles: input.changedFiles });
+      if (scenario.selectedTests.some(({ path }) => input.deletedFiles?.includes(path))) throw new Error('selected test deleted');
+      scenarioTests = scenario.selectedTests.map(({ path }) => path);
+      // The remote checks out this exact commit. Verify every path against its tree locally before spending a host slot.
+      for (const path of scenarioTests) {
+        const file = runner.local('git', ['cat-file', '-e', `${input.commit}:${path}`], input.repo);
+        if (file.rc !== 0 || file.error) throw new Error(`selected test missing at head: ${path}`);
+        const tree = runner.local('git', ['ls-tree', '-z', input.commit, '--', path], input.repo);
+        if (tree.rc !== 0 || tree.error || !/^100(?:644|755) blob [0-9a-f]{40}\t/.test(tree.stdout)
+          || !tree.stdout.endsWith(`\t${path}\0`)) throw new Error(`selected test is not a regular file at head: ${path}`);
+      }
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      const entry: TrainGateObservation = { host, commit: input.commit, baseSha: input.baseSha, outcome: 'unmeasured', reason, changedFiles: input.changedFiles.length };
+      debug.log('merge-queue', 'train-gate', entry);
+      try { (deps.observe ?? defaultObserve)(entry); } catch { /* observation only */ }
+      return { outcome: 'unmeasured', host, reason };
+    }
+  }
   if (host !== TRAIN_GATE_HOST) {
     const entry: TrainGateObservation = { host, commit: input.commit, baseSha: input.baseSha, outcome: 'unmeasured', reason: `host-not-gate-host (${host} ≠ ${TRAIN_GATE_HOST})`, changedFiles: input.changedFiles.length };
     debug.log('merge-queue', 'train-gate', entry);
@@ -81,13 +110,13 @@ export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemo
   const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
   const now = deps.now ?? Date.now;
   const deadline = now() + settings.slotWaitSeconds * 1000;
-  const script = trainGateScript(input.baseSha, input.changedFiles, new Set(input.deletedFiles ?? []));
+  const script = trainGateScript(input.baseSha, input.changedFiles, new Set(input.deletedFiles ?? []), scenarioTests);
   let outcome: RemoteRunOutcome;
   for (;;) {
     try {
       outcome = runOnRemote({
         repo: input.repo, host, mirror: settings.mirror, commit: input.commit, refs: [input.baseSha],
-        argv: ['sh', '-c', script], installPwa: true, hostCap: settings.hostCap,
+        argv: ['sh', '-c', script], installPwa: true, hostCap,
       }, runner);
     } catch (error) {
       outcome = { kind: 'infra', reason: `exception: ${error instanceof Error ? error.message : String(error)}` };
@@ -100,7 +129,7 @@ export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemo
   }
   const result: TrainGateResult = outcome.kind === 'ran'
     ? { outcome: outcome.rc === 0 ? 'pass' : 'fail', host, ms: outcome.ms, rc: outcome.rc }
-    : { outcome: 'unmeasured', host, reason: outcome.kind === 'busy' ? `host-busy (cap ${settings.hostCap} held for ${settings.slotWaitSeconds}s)` : outcome.reason };
+    : { outcome: 'unmeasured', host, reason: outcome.kind === 'busy' ? `host-busy (occupied ${outcome.occupied ?? 'unknown'}/${hostCap}, held for ${settings.slotWaitSeconds}s)` : outcome.reason };
   const entry: TrainGateObservation = {
     host, commit: input.commit, baseSha: input.baseSha, outcome: result.outcome,
     rc: result.rc, ms: result.ms, reason: result.reason, changedFiles: input.changedFiles.length,
@@ -116,7 +145,7 @@ export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemo
  *  integration commit's diff against `baseSha` (local git only); a diff failure is «unmeasured», never a local run. */
 export type TrainGate = (commitSha: string, prNumbers: readonly number[]) => Promise<TrainGateOutcome>;
 
-export function trainGateOnHost(opts: { repo: string; baseSha: string; settings?: GateRemoteSettings }, runner: GateRemoteRunner = realGateRemoteRunner, deps: TrainGateDeps = {}): TrainGate {
+export function trainGateOnHost(opts: { repo: string; baseSha: string; settings?: GateRemoteSettings; scenario?: unknown; scenarioFile?: string }, runner: GateRemoteRunner = realGateRemoteRunner, deps: TrainGateDeps = {}): TrainGate {
   const unmeasured = (commitSha: string, reason: string): 'unmeasured' => {
     const entry: TrainGateObservation = { host: opts.settings?.host ?? TRAIN_GATE_HOST, commit: commitSha, baseSha: opts.baseSha, outcome: 'unmeasured', reason, changedFiles: 0 };
     debug.log('merge-queue', 'train-gate', entry);
@@ -128,7 +157,7 @@ export function trainGateOnHost(opts: { repo: string; baseSha: string; settings?
       const diff = runner.local('git', ['diff', '--name-status', '-z', opts.baseSha, commitSha], opts.repo);
       if (diff.rc !== 0 || diff.error) return unmeasured(commitSha, 'changed-files-unavailable');
       const { changedFiles, deletedFiles } = parseNameStatus(diff.stdout);
-      return (await runTrainGateOnHost({ repo: opts.repo, commit: commitSha, baseSha: opts.baseSha, changedFiles, deletedFiles, settings: opts.settings }, runner, deps)).outcome;
+      return (await runTrainGateOnHost({ repo: opts.repo, commit: commitSha, baseSha: opts.baseSha, changedFiles, deletedFiles, settings: opts.settings, scenario: opts.scenario, scenarioFile: opts.scenarioFile }, runner, deps)).outcome;
     } catch (error) {
       // Any preparation failure (local git spawn, parse, settings) is «unmeasured» — never a rejected promise, never a local run.
       return unmeasured(commitSha, `prepare-failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 200));

package/src/self-implement/train-reach-grouping.ts

@@ -0,0 +1,157 @@
+import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
+import { isAbsolute } from 'node:path';
+import { selectGateTestFiles } from './gate-cli.js';
+
+export interface TrainReachCandidate {
+  pr: string;
+  headSha: string;
+  tree: string;
+  changedFiles: string[];
+}
+
+export interface TrainReachInput {
+  version: 1;
+  baseSha: string;
+  queueSig: string;
+  prs: TrainReachCandidate[];
+}
+
+export interface TrainReachObservation {
+  changedFiles: readonly string[];
+  testFiles: readonly string[];
+  unverified: readonly string[];
+  unrunImporterTotal: number | null;
+  lookupFailed?: string;
+  routeLookupFailures: readonly { source: string; reason: string }[];
+  callerTestsOverflow: readonly { file: string }[];
+  alwaysIncludeMissing: readonly string[];
+}
+
+export interface TrainReachGroup {
+  prs: string[];
+  reachTests: string[];
+  interactionTests: string[];
+  overlapEdges: Array<{ a: string; b: string; tests: string[]; paths: string[] }>;
+  status: 'measured' | 'unmeasured';
+  capacityBlocked: boolean;
+  reasons: string[];
+}
+
+export interface TrainReachDecision {
+  version: 1;
+  baseSha: string;
+  queueSig: string;
+  parallelSafe: boolean;
+  groups: TrainReachGroup[];
+  deferred: Array<{ pr: string; reason: string }>;
+}
+
+type InspectCandidate = (candidate: TrainReachCandidate, baseSha: string) => TrainReachObservation;
+
+const SHA40 = /^[a-f0-9]{40}$/i;
+const SHA256 = /^[a-f0-9]{64}$/i;
+const safePath = (path: string) => path.length > 0 && !path.startsWith('/')
+  && !path.includes('\\') && !/[\x00-\x1f\x7f]/.test(path)
+  && !path.split('/').some((part) => part === '..' || part === '.');
+const sortedUnique = (values: readonly string[]) => [...new Set(values)].sort();
+
+function git(tree: string, ...args: string[]): string {
+  const result = spawnSync('git', args, { cwd: tree, encoding: 'utf8', timeout: 15_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  if (result.status !== 0 || result.error) {
+    throw new Error(`git ${args[0]} unmeasured: ${result.error?.message ?? result.stderr?.trim() ?? `rc=${result.status}`}`);
+  }
+  return result.stdout.trim();
+}
+
+/** The selector's own base...HEAD comparison is independently checked against the queue snapshot. */
+function inspectTrainReachCandidate(candidate: TrainReachCandidate, baseSha: string): TrainReachObservation {
+  if (git(candidate.tree, 'rev-parse', 'HEAD').toLowerCase() !== candidate.headSha.toLowerCase()) {
+    throw new Error('tree HEAD differs from queued headSha');
+  }
+  if (git(candidate.tree, 'status', '--porcelain=v1')) throw new Error('tree is dirty');
+  git(candidate.tree, 'cat-file', '-e', `${baseSha}^{commit}`);
+  const observation = selectGateTestFiles(candidate.tree, { base: baseSha, includeImporterTests: true });
+  if (git(candidate.tree, 'rev-parse', 'HEAD').toLowerCase() !== candidate.headSha.toLowerCase()) {
+    throw new Error('tree HEAD changed during reach selection');
+  }
+  if (git(candidate.tree, 'status', '--porcelain=v1')) throw new Error('tree changed during reach selection');
+  return observation;
+}
+
+function validateInput(input: TrainReachInput): void {
+  if (input?.version !== 1 || !SHA40.test(input.baseSha) || !SHA256.test(input.queueSig) || !Array.isArray(input.prs)) {
+    throw new Error('train reach input identity unmeasured');
+  }
+  const seen = new Set<string>();
+  for (const candidate of input.prs) {
+    if (!/^[1-9]\d*$/.test(candidate?.pr) || seen.has(candidate.pr) || !SHA40.test(candidate.headSha)
+      || !isAbsolute(candidate.tree) || !Array.isArray(candidate.changedFiles) || candidate.changedFiles.length === 0
+      || !candidate.changedFiles.every((path) => typeof path === 'string' && safePath(path))) {
+      throw new Error(`train reach candidate invalid: ${candidate?.pr ?? 'unknown'}`);
+    }
+    seen.add(candidate.pr);
+  }
+}
+
+/** Pure grouping after one independently measured selector observation per queued PR. */
+export function buildTrainReachDecision(input: TrainReachInput, inspect: InspectCandidate = inspectTrainReachCandidate): TrainReachDecision {
+  validateInput(input);
+  const measured: Array<{ candidate: TrainReachCandidate; tests: string[]; files: string[] }> = [];
+  const deferred: TrainReachDecision['deferred'] = [];
+  for (const candidate of input.prs) {
+    try {
+      const observed = inspect(candidate, input.baseSha);
+      const actual = sortedUnique(observed.changedFiles);
+      const expected = sortedUnique(candidate.changedFiles);
+      if (actual.length !== expected.length || actual.some((path, index) => path !== expected[index])) {
+        throw new Error('changedFiles differ from selector observation');
+      }
+      if (observed.lookupFailed || observed.routeLookupFailures.length || observed.unrunImporterTotal !== 0
+        || observed.callerTestsOverflow.length || observed.alwaysIncludeMissing.length || observed.unverified.length) {
+        throw new Error('test selection has unmeasured reach');
+      }
+      if (!observed.testFiles.every(safePath)) throw new Error('selected test path invalid');
+      measured.push({ candidate, tests: sortedUnique(observed.testFiles), files: sortedUnique(observed.changedFiles) });
+    } catch (error) {
+      deferred.push({ pr: candidate.pr, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+
+  const parent = measured.map((_, index) => index);
+  const find = (index: number): number => {
+    while (parent[index] !== index) index = parent[index] = parent[parent[index]];
+    return index;
+  };
+  const edges: Array<{ left: number; right: number; tests: string[]; paths: string[] }> = [];
+  for (let left = 0; left < measured.length; left++) {
+    for (let right = left + 1; right < measured.length; right++) {
+      const tests = measured[left].tests.filter((path) => measured[right].tests.includes(path));
+      const paths = measured[left].files.filter((path) => measured[right].files.includes(path));
+      if (!tests.length && !paths.length) continue;
+      edges.push({ left, right, tests, paths });
+      parent[find(right)] = find(left);
+    }
+  }
+  const components = new Map<number, number[]>();
+  for (let index = 0; index < measured.length; index++) {
+    const root = find(index);
+    components.set(root, [...(components.get(root) ?? []), index]);
+  }
+  const groups = [...components.values()].map((indices): TrainReachGroup => {
+    const prs = indices.map((index) => measured[index].candidate.pr);
+    const counts = new Map<string, number>();
+    for (const index of indices) for (const test of measured[index].tests) counts.set(test, (counts.get(test) ?? 0) + 1);
+    const reachTests = sortedUnique([...counts.keys()]);
+    const interactionTests = reachTests.filter((test) => (counts.get(test) ?? 0) > 1);
+    const overlapEdges = edges.filter(({ left, right }) => indices.includes(left) && indices.includes(right))
+      .map(({ left, right, tests, paths }) => ({ a: measured[left].candidate.pr, b: measured[right].candidate.pr, tests, paths }));
+    const capacityBlocked = indices.length > 5;
+    const reasons = capacityBlocked ? ['connected reach group exceeds five PR train limit'] : [];
+    return { prs, reachTests, interactionTests, overlapEdges,
+      status: 'measured', capacityBlocked, reasons };
+  });
+  return { version: 1, baseSha: input.baseSha, queueSig: input.queueSig,
+    parallelSafe: deferred.length === 0 && groups.every(({ status, capacityBlocked }) => status === 'measured' && !capacityBlocked),
+    groups, deferred };
+}

package/src/self-implement/train-scenario-layers.ts

@@ -0,0 +1,133 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { isGateSpawnLaneFile } from '../self-dev/spawn-lane-files.js';
+import { isTestPath } from './importer-test-index.js';
+import type { TrainReachDecision, TrainReachInput } from './train-reach-grouping.js';
+
+export interface TrainRiskEvidence {
+  /** Only evidence-backed paths; an empty list asserts no known hot paths for this queue. */
+  verifiedHotFiles: Array<{ path: string; evidence: string }>;
+  /** Both endpoints are test paths; evidence must describe a reproduced interaction. */
+  verifiedInterferencePairs: Array<{ a: string; b: string; evidence: string }>;
+  /** Unreproduced pairs remain visible and prohibit parallel apply when either endpoint is reached. */
+  suspectedPairs: Array<{ a: string; b: string; reason: string }>;
+}
+
+export interface TrainScenarioGroup {
+  prs: string[];
+  reachTests: string[];
+  interactionTests: string[];
+  riskTests: string[];
+  riskReasons: Array<{ test: string; reason: string; evidence: string }>;
+  groupRiskReasons: Array<{ reason: string; evidence: string }>;
+  canaryTests: string[];
+  scenarioTests: string[];
+  populationSize: number;
+  eligiblePopulationSize: number;
+  canaryTarget: number;
+  /** Reproducible SHA-256 input prefix: baseSha, queueSig, and sorted PRs separated by NUL. */
+  canarySelectionKey: string;
+  canaryHashMethod: string;
+  unmeasured: string[];
+}
+
+export interface TrainScenarioDecision {
+  version: 1;
+  baseSha: string;
+  queueSig: string;
+  parallelSafe: boolean;
+  groups: TrainScenarioGroup[];
+  unmeasured: string[];
+}
+
+const sorted = (paths: readonly string[]) => [...new Set(paths)].sort();
+const validPath = (path: unknown): path is string => typeof path === 'string' && !!path && !path.startsWith('/') && !path.includes('\\')
+  && !/[\x00-\x1f\x7f]/.test(path) && !path.split('/').some((part) => part === '.' || part === '..');
+const hash = (value: string) => createHash('sha256').update(value).digest('hex');
+
+/** Read the tracked test population from the pinned base commit, including paths containing spaces. */
+export function readTrainTestPopulation(tree: string, baseSha: string): string[] {
+  if (!/^[a-f0-9]{40}$/i.test(baseSha)) throw new Error('invalid baseSha for test population');
+  const result = spawnSync('git', ['ls-tree', '-r', '-z', '--name-only', baseSha],
+    { cwd: tree, encoding: 'utf8', timeout: 30_000, maxBuffer: 256 * 1024 * 1024 });
+  if (result.error || result.status !== 0) throw new Error(`test population unmeasured: ${result.error?.message ?? result.stderr?.trim() ?? result.status}`);
+  return sorted(result.stdout.split('\0').filter(isTestPath));
+}
+
+/** Pure scenario composition. No unverified hot path or interference guess is promoted to a verified risk. */
+export function buildTrainScenarioDecision(
+  input: TrainReachInput, reach: TrainReachDecision, population: readonly string[], evidence: TrainRiskEvidence,
+): TrainScenarioDecision {
+  if (reach.version !== 1 || reach.baseSha !== input.baseSha || reach.queueSig !== input.queueSig
+    || !Array.isArray(population) || !population.every((path) => typeof path === 'string' && validPath(path) && isTestPath(path))
+    || !evidence || !Array.isArray(evidence.verifiedHotFiles) || !Array.isArray(evidence.verifiedInterferencePairs)
+    || !Array.isArray(evidence.suspectedPairs)) throw new Error('scenario identity or population unmeasured');
+  const tests = sorted(population);
+  const commonTests = new Set(tests);
+  const known = new Set([...tests, ...reach.groups.flatMap((group) => group.reachTests)]);
+  const validEvidence = (value: unknown): value is string => typeof value === 'string' && value.trim().length > 0;
+  for (const item of evidence.verifiedHotFiles) {
+    if (!validPath(item?.path) || !validEvidence(item?.evidence)) throw new Error('hot-file evidence unmeasured');
+  }
+  for (const item of [...evidence.verifiedInterferencePairs, ...evidence.suspectedPairs]) {
+    if (!validPath(item?.a) || !validPath(item?.b) || !known.has(item.a) || !known.has(item.b)
+      || item.a === item.b || !validEvidence(item && 'evidence' in item ? item.evidence : item?.reason)) {
+      throw new Error('interference-pair evidence unmeasured');
+    }
+  }
+  const changedByPr = new Map(input.prs.map(({ pr, changedFiles }) => [pr, changedFiles]));
+  const groups = reach.groups.map((group): TrainScenarioGroup => {
+    const reached = new Set(group.reachTests);
+    if ([...reached].some((path) => !validPath(path) || !isTestPath(path))) throw new Error('reached test path invalid');
+    const riskReasons: TrainScenarioGroup['riskReasons'] = [];
+    const groupRiskReasons: TrainScenarioGroup['groupRiskReasons'] = [];
+    const unavailable: string[] = [];
+    const risk = new Set<string>();
+    const addRisk = (test: string, reason: string, source: string): void => {
+      risk.add(test);
+      riskReasons.push({ test, reason, evidence: source });
+    };
+    for (const test of reached) if (isGateSpawnLaneFile(test)) addRisk(test, 'spawn-lane', 'src/self-dev/spawn-lane-files.ts');
+    const changed = new Set(group.prs.flatMap((pr) => changedByPr.get(pr) ?? []));
+    for (const hot of evidence.verifiedHotFiles) if (changed.has(hot.path)) {
+      groupRiskReasons.push({ reason: `hot-file:${hot.path}`, evidence: hot.evidence });
+    }
+    for (const pair of evidence.verifiedInterferencePairs) {
+      if (reached.has(pair.a) || reached.has(pair.b)) {
+        const endpoints: Array<[string, string]> = [[pair.a, pair.b], [pair.b, pair.a]];
+        for (const [test, other] of endpoints) {
+          if (reached.has(test) || commonTests.has(test)) addRisk(test, `interference-with:${other}`, pair.evidence);
+          else unavailable.push(`verified interference endpoint unavailable in every PR head: ${test}`);
+        }
+      }
+    }
+    const canaryPrefix = `${input.baseSha}\0${input.queueSig}\0${sorted(group.prs).join(',')}`;
+    const used = new Set([...reached, ...risk]);
+    const eligible = tests.filter((test) => !used.has(test));
+    const canaryTarget = eligible.length ? Math.max(1, Math.round(eligible.length * 0.02)) : 0;
+    const canaryTests = eligible
+      .sort((a, b) => hash(`${canaryPrefix}\0${a}`).localeCompare(hash(`${canaryPrefix}\0${b}`)) || a.localeCompare(b))
+      .slice(0, canaryTarget).sort();
+    const scenarioTests = sorted([...reached, ...risk, ...canaryTests]);
+    const scenarioSet = new Set(scenarioTests);
+    const unmeasured = [...unavailable, ...evidence.suspectedPairs
+      .filter((pair) => scenarioSet.has(pair.a) || scenarioSet.has(pair.b))
+      .map((pair) => `suspected interference ${pair.a} ↔ ${pair.b}: ${pair.reason}`)];
+    return { prs: group.prs, reachTests: group.reachTests, interactionTests: group.interactionTests,
+      riskTests: sorted([...risk]), riskReasons, groupRiskReasons, canaryTests,
+      scenarioTests, populationSize: tests.length, eligiblePopulationSize: eligible.length,
+      canaryTarget, canarySelectionKey: canaryPrefix,
+      canaryHashMethod: 'sha256(canarySelectionKey\\0path)', unmeasured };
+  });
+  const unmeasured = groups.flatMap((group) => group.unmeasured);
+  // A verified interference pair executed by multiple scenarios bars parallel trains, including canary selection.
+  for (const pair of evidence.verifiedInterferencePairs) {
+    const aOwners = groups.flatMap((group, index) => group.scenarioTests.includes(pair.a) ? [index] : []);
+    const bOwners = groups.flatMap((group, index) => group.scenarioTests.includes(pair.b) ? [index] : []);
+    if (aOwners.some((a) => bOwners.some((b) => a !== b))) {
+      unmeasured.push(`verified interference crosses groups ${pair.a} ↔ ${pair.b}: ${pair.evidence}`);
+    }
+  }
+  return { version: 1, baseSha: input.baseSha, queueSig: input.queueSig,
+    parallelSafe: reach.parallelSafe && unmeasured.length === 0, groups, unmeasured };
+}

package/src/self-implement/uncommitted-work.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { isElanousRuntimeArtifactPath } from './gate-scope.js';
 
 export type UncommittedWork =
@@ -19,6 +20,7 @@ export function detectUncommittedWork(worktree: string): UncommittedWork {
       env: gitEnv,
       encoding: 'utf8',
       timeout: 10_000,
+      maxBuffer: SPAWN_SYNC_MAX_BUFFER,
     });
   } catch (error) {
     return { status: 'unavailable', reason: error instanceof Error ? error.message : String(error) };