elanous 0.2.28 → 0.2.31

package/scripts/release-loop/version-node.ts

@@ -20,6 +20,41 @@ export function nextDevVersion(version: string): string {
   return `${match[1]}.${match[2]}.${BigInt(match[3]!) + 1n}-dev.0`;
 }
 
+/** Is main carrying the published release immediately before this cut (patch, minor, or major boundary)? */
+function previousPublishedLine(version: string, current: string): string | null {
+  const target = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(baseVersion(version));
+  const carried = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-dev\.(0|[1-9]\d*))?$/.exec(current);
+  if (!target || !carried) return null;
+  const [major, minor, patch] = [BigInt(target[1]!), BigInt(target[2]!), BigInt(target[3]!)];
+  const [priorMajor, priorMinor, priorPatch] = [BigInt(carried[1]!), BigInt(carried[2]!), BigInt(carried[3]!)];
+  const nextPatch = priorMajor === major && priorMinor === minor && priorPatch + 1n === patch;
+  const nextMinor = priorMajor === major && priorMinor + 1n === minor && patch === 0n;
+  const nextMajor = priorMajor + 1n === major && minor === 0n && patch === 0n;
+  return nextPatch || nextMinor || nextMajor ? `${priorMajor}.${priorMinor}.${priorPatch}` : null;
+}
+
+function compareVersionParts(left: readonly bigint[], right: readonly bigint[]): number {
+  for (let index = 0; index < 3; index++) {
+    if (left[index] !== right[index]) return left[index]! < right[index]! ? -1 : 1;
+  }
+  return 0;
+}
+
+/** At a minor/major boundary, the carried line must be the latest published stable tag before the cut. */
+function latestPublishedStableBefore(repo: string, version: string): string | null {
+  const target = baseVersion(version).split('.').map(BigInt);
+  let latest: { version: string; parts: bigint[] } | null = null;
+  const tags = git(repo, 'ls-remote', '--tags', '--refs', 'origin', 'refs/tags/v*');
+  for (const line of tags.split('\n')) {
+    const match = /\brefs\/tags\/v((?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*))$/.exec(line);
+    if (!match) continue;
+    const parts = match[1]!.split('.').map(BigInt);
+    if (compareVersionParts(parts, target) >= 0) continue;
+    if (!latest || compareVersionParts(parts, latest.parts) > 0) latest = { version: match[1]!, parts };
+  }
+  return latest?.version ?? null;
+}
+
 function run(command: string, args: string[], cwd: string): string {
   const result = spawnSync(command, args, { cwd, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
   if (result.status !== 0 || result.error) {
@@ -120,13 +155,32 @@ function currentFreeze(): LandingFreeze | null {
   return readLandingFreeze(prod) ?? (root === prod ? null : readLandingFreeze(root));
 }
 
+/**
+ * RELEASE-DEVBUMP-ALWAYS (대표 10-14 07:0x): main still carries the previous line (<previous> or <previous>-dev.N)
+ * while that release is already published (tag v<previous> advertised) — its post-publish dev bump was
+ * stranded by an earlier failed run. Land the stranded dev bump (to <version>-dev.0) so this release cuts
+ * from its own -dev line. Returns false without touching anything when the carried version is not the
+ * immediately previous line or that line is not published yet.
+ */
+function strandedDevBumpHealed(repo: string, version: string, current: string, deps: BranchCutDeps): boolean {
+  const previous = previousPublishedLine(version, current);
+  if (previous === null) return false;
+  const tag = git(repo, 'ls-remote', '--tags', 'origin', `refs/tags/v${previous}`);
+  if (!tag.trim()) return false;
+  const devBump = `${baseVersion(version)}-dev.0`;
+  if (devBump !== nextDevVersion(previous) && latestPublishedStableBefore(repo, version) !== previous) return false;
+  landing(repo, 'dev-bump', previous, undefined, undefined, deps.forceFreeze === true, true, devBump);
+  debug.log('release-loop.version-dev-bump', 'self-healed', { version, mainVersion: current, devBump, published: previous });
+  return true;
+}
+
 /**
  * RELEASE-BRANCH (대표 10-06 20:0x «0.2.18부터 브랜치 방식»): the release commit lives on `release/<v>`, never on main.
  * An existing branch is reused as is (a resumed run, or a branch a repair appended to) — its tip is the release commit.
  * Otherwise the branch is cut from origin/main and the version bump is committed on it; main keeps its -dev.N version
  * until the post-publish dev bump.
  */
-export function cutReleaseBranchForRun(repo: string, version: string, deps: BranchCutDeps = {}): Output {
+export function cutReleaseBranchForRun(repo: string, version: string, deps: BranchCutDeps = {}, selfHealed = false): Output {
   if (!isReleaseVersion(version)) throw new Error(`invalid release version: ${version}`);
   // The run does not need a freeze, but one that is on is the emergency stop: neither a new nor a reused cut passes it.
   const frozen = (deps.freeze ?? currentFreeze)();
@@ -160,7 +214,11 @@ export function cutReleaseBranchForRun(repo: string, version: string, deps: Bran
   const current = versionAt(repo, base);
   const stable = baseVersion(version);
   const devOfStable = new RegExp(`^${stable.replaceAll('.', '\\.')}-dev\\.(0|[1-9][0-9]*)$`);
-  if (current !== version && !devOfStable.test(current)) throw new Error(`origin/main version ${current} is not ${stable}-dev.N (release ${version})`);
+  if (current !== version && !devOfStable.test(current)) {
+    // RELEASE-DEVBUMP-ALWAYS: self-heal once — a stranded previous dev bump never strands this release's cut too.
+    if (!selfHealed && strandedDevBumpHealed(repo, version, current, deps)) return cutReleaseBranchForRun(repo, version, deps, true);
+    throw new Error(`origin/main version ${current} is not ${stable}-dev.N (release ${version})`);
+  }
   const temp = mkdtempSync(join(tmpdir(), 'release-branch-cut-'));
   const worktree = join(temp, 'tree');
   let added = false;
@@ -189,14 +247,14 @@ export function cutReleaseBranchForRun(repo: string, version: string, deps: Bran
   }
 }
 
-function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string, cutCommit?: string, forceFreeze = false, branchCut = false): Output {
+function landing(repo: string, kind: Kind, releaseVersion: string, cut?: string, cutCommit?: string, forceFreeze = false, branchCut = false, devTarget?: string): Output {
   if (kind === 'release' && branchCut && cutCommit === undefined) return cutReleaseBranchForRun(repo, releaseVersion, { forceFreeze });
   if (kind === 'dev-bump' && prereleaseKind(releaseVersion) !== null) {
     // A prerelease (rehearsal) never moves main: the next stable release still owns this -dev line.
     debug.log('release-loop.version-dev-bump', 'skipped', { version: releaseVersion, reason: 'prerelease' });
     return { outcome: 'ok', kind, version: releaseVersion, commit: null, pr: null, skipped: 'prerelease' };
   }
-  const target = kind === 'release' ? releaseVersion : nextDevVersion(releaseVersion);
+  const target = kind === 'release' ? releaseVersion : devTarget ?? nextDevVersion(releaseVersion);
   // With the release on its branch, main still carries <v>-dev.N when the dev bump runs.
   const source = kind === 'release' ? `${releaseVersion}-dev.N` : branchCut ? `${releaseVersion}-dev.N` : releaseVersion;
   fetchMain(repo);

package/scripts/test-deterministic.ts

@@ -39,44 +39,15 @@ import * as ts from 'typescript';
 // importing THIS file used to spawn the suite at load time. The runner is now
 // behind `import.meta.main` / `runDeterministicTests()`, but the filter stays
 // in the helper so an untested credential check cannot rot silently.
-import { isCredentialKey } from './lib/deterministic-env.js';
-import { envLiteral } from '../src/platform/env-literal.js';
+import { GIT_LOCATION_ENV_KEYS, prepareIsolatedTestEnv } from './lib/deterministic-env.js';
 
 export const TEMP_ROOT_PREFIX = 'elanous-deterministic-test-';
 export const CHILD_EXIT_GRACE_MS = 2_000;
 
-// A deterministic test child is not a harness executor: these inherited
-// markers would activate write-boundary policy against each test's temp files.
-const HARNESS_TEST_ENV_KEYS = [
-  'ELANOUS_HARNESS_SPACE',
-  'ELANOUS_HARNESS_SPACE_ID',
-  'ELANOUS_HARNESS_BOUNDARY',
-  'ELANOUS_HARNESS_ROLE',
-  'ELANOUS_HARNESS_DETACHED',
-] as const;
-
-// Discovery: rg -n "process\.env\.ELANOUS_(HOST|RUN|ORIGIN|SUPERVISOR|PARENT)" src
-// These are ambient execution identities, not inputs to a deterministic test.
-// debug.log also attributes SUBSTRATE and ARM_ID to every plain-object record.
-export const GIT_LOCATION_ENV_KEYS = [
-  'GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE',
-  'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES',
-] as const;
-
-const EXECUTION_ORIGIN_ENV_KEYS = [
-  'ELANOUS_HOST_ID',
-  'ELANOUS_RUN_ID',
-  'ELANOUS_RUN_CONTEXT',
-  'ELANOUS_PARENT_RUN_ID',
-  'ELANOUS_PARENT_PTY_ID',
-  'ELANOUS_PARENT_SELF_DEV_RUNS_DIR',
-  'ELANOUS_SUBSTRATE',
-  'ELANOUS_ARM_ID',
-  // Parent account selection changes CLI rotation assertions in the child.
-  'ELANOUS_CODEX_ACCOUNT',
-  // A parent's derived-root label must not reclassify a test's explicit state dir.
-  'ELANOUS_STATE_DIR_SOURCE',
-] as const;
+// Key lists and the isolated child env live in the side-effect-free `lib/deterministic-env.ts` (R7 · 10-16):
+// the host regate runner needs the same env, and importing this file would pull `typescript`/Bun stream types into
+// graphs (the PWA tsc program) that must not see them.
+export { GIT_LOCATION_ENV_KEYS, prepareIsolatedTestEnv } from './lib/deterministic-env.js';
 
 export type ShutdownSignal = 'SIGINT' | 'SIGTERM';
 
@@ -297,33 +268,6 @@ function gitConfig(cwd: string, args: string[]): string | undefined {
   return args.includes('--get-all') ? result.stdout : result.stdout.trim();
 }
 
-export function prepareIsolatedTestEnv(sourceEnv: NodeJS.ProcessEnv, testRoot: string): NodeJS.ProcessEnv {
-  const env = Object.fromEntries(
-    Object.entries(sourceEnv).filter(([key]) => !isCredentialKey(key)
-      && !HARNESS_TEST_ENV_KEYS.includes(key as typeof HARNESS_TEST_ENV_KEYS[number])
-      && !EXECUTION_ORIGIN_ENV_KEYS.includes(key as typeof EXECUTION_ORIGIN_ENV_KEYS[number])
-      && !GIT_LOCATION_ENV_KEYS.includes(key as typeof GIT_LOCATION_ENV_KEYS[number])),
-  );
-  env.HOME = testRoot;
-  // userConfigPath() warns whenever XDG_CONFIG_HOME is set, including when
-  // config.json is absent. Use its non-XDG path; migrateLegacyXdgUserConfig()
-  // resolves the old path through ELANOUS_TEST_HOME rather than the real home.
-  delete env.XDG_CONFIG_HOME;
-  env.ELANOUS_TEST_HOME = testRoot;
-  // HOME and ELANOUS_STATE_DIR isolate both the state and default config roots.
-  // ELANOUS_CONFIG_DIR is not a config-dir override; discard an inherited value
-  // rather than passing an ignored variable that appears to provide isolation.
-  env.ELANOUS_STATE_DIR = join(testRoot, 'state');
-  delete env.ELANOUS_CONFIG_DIR;
-  // All ambient execution identities are removed by EXECUTION_ORIGIN_ENV_KEYS
-  // above, before the child is spawned; logger API-shape tests need their absence.
-  // ⚠️ No `ELANOUS_TEST_DETERMINISTIC` marker is exported. Nothing reads it yet,
-  // and an env var with no consumer is a surface that looks like a contract
-  // while guaranteeing nothing — a later test could branch on it believing it
-  // means something. The tier work in PLAN-test-suite-diet introduces the
-  // signal together with the code that honours it.
-  return envLiteral(env);
-}
 
 /** Read every stderr line, retaining only Bun's verdict signals. A long test
  * log must not become a second in-memory copy of the full output. */
@@ -539,9 +483,12 @@ function hasModuleMockCall(source: string, file: string): boolean {
 /** Parse every Bun-discovered test: text search misses valid calls with a
  * comment between `mock` and `.module`. An extra solo file costs time, while a
  * missed call can contaminate every later file in the Bun process. */
-export function deriveMockModuleTestFiles(deps: { spawnSync?: typeof Bun.spawnSync; cwd?: string } = {}): string[] {
+export function deriveMockModuleTestFiles(
+  deps: { spawnSync?: typeof Bun.spawnSync; cwd?: string; files?: string[] } = {},
+): string[] {
   const cwd = deps.cwd ?? process.cwd();
-  const files = deriveTestFiles({ spawnSync: deps.spawnSync, cwd });
+  // `files` narrows the parse to a caller-selected subset of discovered tests.
+  const files = deps.files ?? deriveTestFiles({ spawnSync: deps.spawnSync, cwd });
   const mocks: string[] = [];
   // A bounded program keeps the public syntax check below 600 MB on the
   // current repository, rather than retaining all 5,836 ASTs at once.
@@ -723,12 +670,10 @@ function replaceBulkSelectors(argv: string[], replacement: (selector: string) =>
   return result;
 }
 
-/** Return one bulk command and one command per selected global module mock. */
-export function planDeterministicTestCommands(
-  argv: string[], cdpPatterns: string[], mockFiles: string[], allTestFiles: string[] = [], testCwd = process.cwd(),
-): string[][] {
-  const { selectors: pathArgs, soloArgs } = partitionBunTestArguments(argv);
-  const explicitPaths = pathArgs.length > 0;
+/** How a positional selector picks discovered test files: a directory selects
+ * the files under it, an exact discovered path selects itself, and anything
+ * else is Bun's substring filter. */
+function testSelectorMatcher(allTestFiles: string[], testCwd: string) {
   const directory = (selector: string): string | undefined => {
     const path = resolve(testCwd, selector);
     try { return statSync(path).isDirectory() ? path : undefined; } catch { return undefined; }
@@ -746,6 +691,25 @@ export function planDeterministicTestCommands(
       ? resolve(testCwd, file) === resolve(testCwd, selector)
       : file.includes(selector.replace(/^\.\//, ''));
   };
+  return { directory, insideDirectory, isExact, matchesSelector };
+}
+
+/** Discovered test files that a path-selected run can reach. With explicit
+ * paths the planner only isolates mock files inside this set, so parsing the
+ * rest of the repository (≈20 s per gate shard under load) cannot change it. */
+export function selectedTestFiles(argv: string[], allTestFiles: string[], testCwd: string): string[] {
+  const { selectors } = partitionBunTestArguments(argv);
+  const { matchesSelector } = testSelectorMatcher(allTestFiles, testCwd);
+  return allTestFiles.filter((file) => selectors.some((selector) => matchesSelector(file, selector)));
+}
+
+/** Return one bulk command and one command per selected global module mock. */
+export function planDeterministicTestCommands(
+  argv: string[], cdpPatterns: string[], mockFiles: string[], allTestFiles: string[] = [], testCwd = process.cwd(),
+): string[][] {
+  const { selectors: pathArgs, soloArgs } = partitionBunTestArguments(argv);
+  const explicitPaths = pathArgs.length > 0;
+  const { directory, insideDirectory, isExact, matchesSelector } = testSelectorMatcher(allTestFiles, testCwd);
   const callerIgnoreGlobs = bunTestOptionValues(argv, '--path-ignore-patterns').map((pattern) => new Bun.Glob(pattern));
   const selectedMocks = mockFiles.filter((file) => !cdpPatterns.includes(file)
     && !callerIgnoreGlobs.some((glob) => glob.match(file) || glob.match(resolve(testCwd, file)))
@@ -872,10 +836,19 @@ export async function runDeterministicTests(deps: DeterministicRunnerDeps = {}):
   const testCwd = effectiveTestCwd(argv, cwd);
   const cdpPatterns = explicitPaths ? [] : (deps.deriveCdpPatterns ?? (() => deriveCdpTestPatterns({ cwd: testCwd })))();
   const explicitFiles = classifyExplicitTestFiles(argv, testCwd);
-  const mockFiles = [...new Set([...(deps.deriveMockModuleFiles ?? (() => deriveMockModuleTestFiles({ cwd: testCwd })))(), ...explicitFiles.mockFiles])];
-  const allTestFiles = (explicitPaths || fullBail) && mockFiles.length > 0
-    ? [...new Set([...(deps.deriveTestFiles ?? (() => deriveTestFiles({ cwd: testCwd })))(), ...explicitFiles.files])]
-    : [];
+  let discovered: string[] | undefined;
+  const discoverTestFiles = (): string[] => discovered ??=
+    [...new Set([...(deps.deriveTestFiles ?? (() => deriveTestFiles({ cwd: testCwd })))(), ...explicitFiles.files])];
+  // With explicit paths, parse only the files the selectors reach; files that
+  // classifyExplicitTestFiles already parsed are not parsed twice.
+  const scanMocks = (): string[] => {
+    if (!explicitPaths) return deriveMockModuleTestFiles({ cwd: testCwd });
+    const classified = new Set(explicitFiles.files);
+    const files = selectedTestFiles(argv, discoverTestFiles(), testCwd).filter((file) => !classified.has(file));
+    return files.length === 0 ? [] : deriveMockModuleTestFiles({ cwd: testCwd, files });
+  };
+  const mockFiles = [...new Set([...(deps.deriveMockModuleFiles ?? scanMocks)(), ...explicitFiles.mockFiles])];
+  const allTestFiles = (explicitPaths || fullBail) && mockFiles.length > 0 ? discoverTestFiles() : [];
   let commands = planDeterministicTestCommands(argv, cdpPatterns, mockFiles, allTestFiles, testCwd);
   const optionTokens = bunTestOptionTokens(argv);
   // Bun writes these outputs to one caller-selected file. Separate children

package/scripts/train-reach-grouping.ts

@@ -0,0 +1,48 @@
+#!/usr/bin/env bun
+import { existsSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { buildTrainReachDecision, type TrainReachInput } from '../src/self-implement/train-reach-grouping.js';
+import { buildTrainScenarioDecision, readTrainTestPopulation, type TrainRiskEvidence } from '../src/self-implement/train-scenario-layers.js';
+
+type ScenarioInput = TrainReachInput & { riskEvidence?: TrainRiskEvidence };
+
+function option(name: string): string {
+  const index = process.argv.indexOf(name);
+  const value = process.argv[index + 1];
+  if (index < 0 || !value || value.startsWith('--') || !isAbsolute(value)) throw new Error(`${name} requires an absolute path`);
+  return value;
+}
+
+let temporary = '';
+let outputPath = '';
+let protectsInput = false;
+try {
+  if (process.argv.length !== 6) throw new Error('usage: train-reach-grouping.ts --input <absolute> --output <absolute>');
+  const inputPath = option('--input');
+  outputPath = option('--output');
+  if (!existsSync(inputPath)) throw new Error('input file missing');
+  protectsInput = resolve(inputPath) === resolve(outputPath)
+    || (existsSync(outputPath) && realpathSync(inputPath) === realpathSync(outputPath));
+  if (protectsInput) throw new Error('input and output paths must differ');
+  const input = JSON.parse(readFileSync(inputPath, 'utf8')) as ScenarioInput;
+  const reach = buildTrainReachDecision(input);
+  const scenario = input.riskEvidence === undefined ? undefined : (() => {
+    if (input.prs.length === 0) throw new Error('scenario has no PR tree for pinned population');
+    const baseTests = readTrainTestPopulation(input.prs[0]!.tree, input.baseSha);
+    const headTests = input.prs.map((candidate) => new Set(readTrainTestPopulation(candidate.tree, candidate.headSha)));
+    const survivingTests = baseTests.filter((test) => headTests.every((present) => present.has(test)));
+    return buildTrainScenarioDecision(input, reach, survivingTests, input.riskEvidence!);
+  })();
+  const result = scenario ? { ...reach, scenario, parallelSafe: scenario.parallelSafe } : reach;
+  temporary = `${outputPath}.tmp-${process.pid}`;
+  writeFileSync(temporary, JSON.stringify(result, null, 2) + '\n', { flag: 'wx' });
+  renameSync(temporary, outputPath);
+  temporary = '';
+  if (!result.parallelSafe) process.exitCode = 2;
+} catch (error) {
+  if (outputPath && !protectsInput) rmSync(outputPath, { force: true }); // never reuse a previous decision after failure
+  console.error(`train reach unmeasured: ${error instanceof Error ? error.message : String(error)}`);
+  process.exitCode = 2;
+} finally {
+  if (temporary) rmSync(temporary, { force: true });
+}

package/scripts/tsc-incremental-cache.ts

@@ -0,0 +1,86 @@
+/** Opt-in compiler graph cache for an exclusive, stable remote gate checkout. */
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { hostname } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { normalizedDiagnosticSet } from './tsc-incremental-diagnostics.js';
+
+export interface CachedTscRun { out: string; ran: boolean; why?: string; exitCode?: number }
+type Reference = { schema: 1; key: string; out: string; exitCode: number; decision: boolean; head?: string };
+export interface IncrementalCacheInput<T extends CachedTscRun> {
+  cwd: string;
+  base: string;
+  head?: string;
+  changed: ReadonlySet<string>;
+  config: string;
+  command: string;
+  cacheDir: string;
+  run: (command: string) => T;
+  decision: (result: T) => boolean;
+  log: (message: string) => void;
+}
+
+function compilerOutcome(result: CachedTscRun): 'clean' | 'diagnostics' | 'unmeasured' {
+  if (!result.ran) return 'unmeasured';
+  if (result.exitCode === 0) return 'clean';
+  return result.exitCode === 1 || result.exitCode === 2 ? 'diagnostics' : 'unmeasured';
+}
+
+function equivalent<T extends CachedTscRun>(current: T, baseline: T, decide: (result: T) => boolean): boolean {
+  const a = normalizedDiagnosticSet(current.out);
+  const b = normalizedDiagnosticSet(baseline.out);
+  return a !== null && a === b && compilerOutcome(current) !== 'unmeasured'
+    && compilerOutcome(current) === compilerOutcome(baseline) && decide(current) === decide(baseline);
+}
+
+export function incrementalCacheKey(input: Pick<IncrementalCacheInput<CachedTscRun>, 'cwd' | 'base' | 'changed' | 'config'>): string {
+  const files = [input.config, 'tsconfig.json', 'tsconfig.gate.json', 'tsconfig.pwa-env.json', 'apps/pwa/tsconfig.json', 'bun.lock', 'node_modules/typescript/package.json'];
+  const hash = createHash('sha256');
+  for (const field of [hostname(), input.cwd, input.base, ...[...input.changed].sort()]) hash.update(field + '\0');
+  for (const file of files) {
+    hash.update(file + '\0');
+    try { hash.update(readFileSync(join(input.cwd, file))); }
+    catch { hash.update('<missing>'); }
+    hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+
+/** A cache hit is accepted only when the prior cold reference still has the same diagnostic set and gate decision. */
+export function runIncrementalCachedTsc<T extends CachedTscRun>(input: IncrementalCacheInput<T>): T {
+  if (!isAbsolute(input.cacheDir) || !/^[-\w./]+$/.test(input.cacheDir) || !/^[0-9a-f]{40}$/.test(input.base)) return input.run(input.command);
+  const key = incrementalCacheKey(input);
+  try { mkdirSync(input.cacheDir, { recursive: true, mode: 0o700 }); }
+  catch (cause) {
+    input.log(`[tsc-cache] unavailable key=${key.slice(0, 12)} reason=${cause instanceof Error ? cause.message : String(cause)}; cold`);
+    return input.run(input.command);
+  }
+  const buildInfo = join(input.cacheDir, `${key}.tsbuildinfo`);
+  const metaFile = join(input.cacheDir, `${key}.json`);
+  let reference: Reference | null = null;
+  try {
+    const parsed = JSON.parse(readFileSync(metaFile, 'utf8')) as Reference;
+    if (parsed.schema === 1 && parsed.key === key && typeof parsed.out === 'string'
+      && Number.isInteger(parsed.exitCode) && typeof parsed.decision === 'boolean' && existsSync(buildInfo)) reference = parsed;
+  } catch { /* missing or damaged cache is a cold miss */ }
+  const incremental = input.run(`${input.command} --incremental --tsBuildInfoFile '${buildInfo}'`);
+  const prior = reference ? { out: reference.out, ran: true, exitCode: reference.exitCode } as T : null;
+  if (prior && equivalent(incremental, prior, input.decision) && input.decision(prior) === reference!.decision) {
+    input.log(`[tsc-cache] hit key=${key.slice(0, 12)} warmRc=${incremental.exitCode} coldRc=${prior.exitCode} warmGate=${input.decision(incremental) ? 'PASS' : 'FAIL'} coldGate=${reference!.decision ? 'PASS' : 'FAIL'}`);
+    return incremental;
+  }
+  const cold = input.run(input.command);
+  const matched = equivalent(incremental, cold, input.decision);
+  input.log(`[tsc-cache] ${reference ? 'mismatch-cold' : 'miss-cold'} key=${key.slice(0, 12)} warmRc=${incremental.exitCode ?? 'unknown'} coldRc=${cold.exitCode ?? 'unknown'} warmGate=${incremental.ran ? input.decision(incremental) ? 'PASS' : 'FAIL' : 'unmeasured'} coldGate=${cold.ran ? input.decision(cold) ? 'PASS' : 'FAIL' : 'unmeasured'} normalized=${matched ? 'same' : 'different'}`);
+  if (matched && cold.exitCode !== undefined) {
+    const next: Reference = { schema: 1, key, out: cold.out, exitCode: cold.exitCode, decision: input.decision(cold), head: input.head };
+    const temp = `${metaFile}.${process.pid}.tmp`;
+    try { writeFileSync(temp, JSON.stringify(next), { mode: 0o600 }); renameSync(temp, metaFile); }
+    catch {
+      for (const path of [temp, metaFile, buildInfo]) { try { rmSync(path, { force: true }); } catch { /* next run must cold-check damaged cache */ } }
+    }
+  } else {
+    for (const path of [metaFile, buildInfo]) { try { rmSync(path, { force: true }); } catch { /* invalid metadata remains a cold miss */ } }
+  }
+  return cold;
+}

package/scripts/tsc-incremental-diagnostics.ts

@@ -0,0 +1,76 @@
+/** Diagnostic comparison for the incremental compiler. Only union member order is ignored. */
+
+function atomAt(value: string, start: number): { text: string; end: number } | null {
+  if (value[start] === '"') {
+    const end = value.indexOf('"', start + 1);
+    return end < 0 ? null : { text: value.slice(start, end + 1), end: end + 1 };
+  }
+  const name = /^[A-Za-z_$][\w$]*/.exec(value.slice(start));
+  if (!name) return null;
+  let end = start + name[0].length;
+  if (value[end] === '<') {
+    let depth = 1;
+    let cursor = end + 1;
+    let quoted = false;
+    for (; cursor < value.length; cursor++) {
+      if (value[cursor] === '"' && value[cursor - 1] !== '\\') quoted = !quoted;
+      if (quoted) continue;
+      if (value[cursor] === '<') depth++;
+      else if (value[cursor] === '>' && --depth === 0) break;
+    }
+    if (depth === 0) end = cursor + 1;
+  }
+  const raw = value.slice(start, end);
+  return { text: raw.includes(' | ') && raw.includes('<') && raw.endsWith('>')
+    ? `${name[0]}<${normalizeUnionAtoms(raw.slice(name[0].length + 1, -1))}>` : raw, end };
+}
+
+function normalizeUnionAtoms(line: string): string {
+  let result = '';
+  for (let i = 0; i < line.length;) {
+    const first = atomAt(line, i);
+    if (!first || line.slice(first.end, first.end + 3) !== ' | ') {
+      if (first) { result += first.text; i = first.end; }
+      else { result += line[i]!; i++; }
+      continue;
+    }
+    const parts = [first.text];
+    let end = first.end;
+    while (line.slice(end, end + 3) === ' | ') {
+      const next = atomAt(line, end + 3);
+      if (!next) break;
+      parts.push(next.text);
+      end = next.end;
+    }
+    result += parts.sort().join(' | ');
+    i = end;
+  }
+  return result;
+}
+
+function normalizeDiagnosticLine(line: string): string {
+  // The observed reorder is a TypeScript union containing quoted literal members.
+  // Bare quoted prose such as 'a | b' may be a string value, so keep it byte-exact.
+  return line.replace(/'([^'\n]*\|[^'\n]*)'/g, (quoted, type: string) => type.includes('"') ? `'${normalizeUnionAtoms(type)}'` : quoted);
+}
+
+/** Include continuation lines; the existing gate parser reads only TS header lines. */
+export function normalizedDiagnosticSet(output: string): string | null {
+  const blocks: string[] = [];
+  const other: string[] = [];
+  let block: string[] | null = null;
+  for (const line of output.split(/\r?\n/)) {
+    if (/^.+?\.[cm]?tsx?\(\d+,\d+\): error TS\d+:/.test(line)) {
+      if (block) blocks.push(block.map(normalizeDiagnosticLine).join('\n'));
+      block = [line];
+    } else if (block && /^\s/.test(line)) block.push(line);
+    else {
+      if (block) blocks.push(block.map(normalizeDiagnosticLine).join('\n'));
+      block = null;
+      if (line.trim()) other.push(line);
+    }
+  }
+  if (block) blocks.push(block.map(normalizeDiagnosticLine).join('\n'));
+  if (/error TS\d+/.test(output) && blocks.length === 0) return null;
+  return JSON.stringify({ blocks: blocks.sort(), other });
+}

package/scripts/tsc-main-safety-net.ts

@@ -3,7 +3,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { debug } from '../src/debug/log.js';
 import { effectiveInstanceRoot } from '../src/instance/resolve.js';
-import { GATE_REMOTE_DEFAULTS, isValidGateHost, resolveGateRemoteSettings, runOnRemote, type ExecResult, type RemoteRunOptions, type RemoteRunOutcome } from '../src/self-implement/gate-remote.js';
+import { GATE_REMOTE_DEFAULTS, gateRemoteHostCap, isValidGateHost, resolveGateRemoteSettings, runOnRemote, type ExecResult, type RemoteRunOptions, type RemoteRunOutcome } from '../src/self-implement/gate-remote.js';
 import { getUserConfig } from '../src/user-config.js';
 import { parseTypecheckErrors, tscEnv } from '../src/typecheck-ratchet.js';
 import { compareDiagnostics, normalizeDiagnostics, type NormalizedDiagnostic } from './tsc-baseline-comparison.js';
@@ -143,7 +143,7 @@ export async function runSafetyNet(repo: string, argv: readonly string[] = [], d
       diagnostics = diagnosticsOf(result, worktree);
       if (!diagnostics) reason = 'local tsc did not produce a complete measurement';
     } else {
-      const result = remote({ repo: worktree, host, mirror: settings.mirror, hostCap: settings.hostCap, argv: TSC_ARGV });
+      const result = remote({ repo: worktree, host, mirror: settings.mirror, hostCap: gateRemoteHostCap(settings, host), argv: TSC_ARGV });
       if (result.kind === 'ran') {
         if (result.commit !== commit) throw new Error('remote measured a different commit');
         diagnostics = diagnosticsOf({ rc: result.rc, stdout: result.stdout.toString('utf8'), stderr: result.stderr.toString('utf8') }, worktree);

package/scripts/usage-rollup.ts

@@ -10,10 +10,14 @@
 import { spawnSync } from 'node:child_process';
 
 export interface UsageRow { site: string; provider: string; model: string; calls: number; inputTokens: number; outputTokens: number; cacheReadInputTokens: number; cacheCreationInputTokens: number; cacheCreationUnmeasuredCalls: number; usdKnown: number; unknownCostCalls: number; includedCalls: number; apiEquivalentUsd: number;
+  /** Preserve only metadata observed on the source usage row. */
+  role?: string; stage?: string; account?: string;
   /** OR-BYOK-COST — BYOK 호출 수 ⊕ 그중 상류 청구액 합(알려진 것만) ⊕ 상류를 모르는 호출 수. BYOK 를 본 행에만 있다(종전 행 바이트 불변). */
   byokCalls?: number; byokUpstreamUsd?: number; byokUpstreamUnknownCalls?: number }
 
-type UsageData = { site?: string; provider?: string; billingProvider?: string; model?: string; inputTokens?: number; outputTokens?: number; cacheReadInputTokens?: number; cacheCreationInputTokens?: number; cost?: { kind?: string; usd?: number }; podRollupKey?: string; partial?: boolean; partialSeq?: number; partialAt?: string };
+type UsageData = { site?: string; provider?: string; billingProvider?: string; model?: string; role?: unknown; stage?: unknown; account?: unknown; inputTokens?: number; outputTokens?: number; cacheReadInputTokens?: number; cacheCreationInputTokens?: number; cost?: { kind?: string; usd?: number }; podRollupKey?: string; partial?: boolean; partialSeq?: number; partialAt?: string };
+
+const observedTag = (value: unknown): string | undefined => typeof value === 'string' && value.trim() ? value : undefined;
 
 /** 재방출 행 dedup 에 필요한 칸만 — 호스트 소비처(bench-report · `elanous usage`)도 같은 규칙을 쓴다. */
 export type PodRollupKeyed = { podRollupKey?: unknown; partial?: unknown; partialSeq?: unknown; partialAt?: unknown };
@@ -68,8 +72,12 @@ export function rollup(lines: readonly string[]): { rows: UsageRow[]; truncated:
   const entries = dedupePodRollupRows(parsed);
   for (const d of entries) {
     const provider = d.billingProvider ?? d.provider ?? '?';   // ⭐ 과금 주체 우선(B10)
-    const key = `${d.site ?? '?'}|${provider}|${d.model ?? '?'}`;
-    const row = by.get(key) ?? { site: d.site ?? '?', provider, model: d.model ?? '?', calls: 0, inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0, cacheCreationInputTokens: 0, cacheCreationUnmeasuredCalls: 0, usdKnown: 0, unknownCostCalls: 0, includedCalls: 0, apiEquivalentUsd: 0 };
+    const role = observedTag(d.role), stage = observedTag(d.stage), account = observedTag(d.account);
+    // A site/model bucket can contain different roles or accounts. Keeping those
+    // dimensions separate is required before the host can report who used a model.
+    const key = JSON.stringify([d.site ?? '?', provider, d.model ?? '?', role ?? null, stage ?? null, account ?? null]);
+    const row = by.get(key) ?? { site: d.site ?? '?', provider, model: d.model ?? '?', calls: 0, inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0, cacheCreationInputTokens: 0, cacheCreationUnmeasuredCalls: 0, usdKnown: 0, unknownCostCalls: 0, includedCalls: 0, apiEquivalentUsd: 0,
+      ...(role !== undefined ? { role } : {}), ...(stage !== undefined ? { stage } : {}), ...(account !== undefined ? { account } : {}) };
     row.calls++;
     row.inputTokens += Number(d.inputTokens ?? 0);
     row.outputTokens += Number(d.outputTokens ?? 0);

package/src/acp/client.ts

@@ -692,6 +692,7 @@ export class AcpAgent {
     sessionId: SessionId;
     cwd?: string;
     mcpServers?: McpServer[];
+    _meta?: Record<string, unknown>;
   }): Promise<LoadSessionResponse> {
     if (!this.connection) throw new Error('AcpAgent not started');
     if (!this.peerCapabilities?.loadSession) {
@@ -701,6 +702,7 @@ export class AcpAgent {
       sessionId: req.sessionId,
       cwd: req.cwd ?? this.cwd,
       mcpServers: req.mcpServers ?? [],
+      ...(req._meta ? { _meta: req._meta } : {}),
     });
   }
 
@@ -764,13 +766,14 @@ export class AcpAgent {
 
   /** Begin a new session in the configured cwd. Returns the agent-
    *  assigned sessionId — caller stores this for follow-up turns. */
-  async newSession(): Promise<SessionId> {
+  async newSession(meta?: Record<string, unknown>): Promise<SessionId> {
     if (!this.connection) throw new Error('AcpAgent not started');
     let response;
     try {
       response = await this.connection.newSession({
         cwd: this.cwd,
         mcpServers: [],
+        ...(meta ? { _meta: meta } : {}),
       });
     } catch (error) {
       if (this.spec.id === 'claude'