elanous 0.2.29 → 0.2.31

package/src/harness/harness-substrate-default.ts

@@ -1,6 +1,7 @@
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { loadavg, cpus, freemem } from 'node:os';
 import { effectiveInstanceRoot, prodInstanceRoot, treeDerivedRootFor } from '../instance/resolve.js';
 import { getElanousConfigDirOverride } from '../elanous-config-dir.js';
 import { buildUserConfig, getUserConfig, type UserConfig } from '../user-config.js';
@@ -99,6 +100,60 @@ export interface AutoSubstrateDecision {
   reason: string;
 }
 
+export interface AutoSubstrateReadDeps {
+  loadavg?: typeof loadavg;
+  cpus?: typeof cpus;
+  freemem?: typeof freemem;
+  podAdmission?: () => AutoSubstrateSignals['podAdmission'];
+  localLaneOpen?: () => boolean;
+  /** Resolved by the launch decision, using its flag → env → config → context precedence. */
+  pool?: string | null;
+  config?: Pick<UserConfig, 'harness' | 'pod'>;
+  measurePoolLease?: typeof import('../task-orchestrator/surfaces/pod-lease.js').measurePoolLease;
+}
+
+/** Read Pod admission using the same pool, usage and account inputs as dispatch backpressure. */
+function readAutoPodAdmission(deps: AutoSubstrateReadDeps): AutoSubstrateSignals['podAdmission'] {
+  // Keep Pod lease dependencies lazy for local-only launches.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { leaseKubectl, measurePoolLease, recommendConcurrency } = require('../task-orchestrator/surfaces/pod-lease.js') as typeof import('../task-orchestrator/surfaces/pod-lease.js');
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { parsePodPool, resolvePodPoolSpec } = require('../task-orchestrator/surfaces/pod-pool.js') as typeof import('../task-orchestrator/surfaces/pod-pool.js');
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const { listCodexAccountsInStore } = require('../oauth/codex-account-store.js') as typeof import('../oauth/codex-account-store.js');
+  // A direct collector call can resolve its own pool. The launch resolver passes a string or null
+  // explicitly so it never substitutes another universe's pool when the launch pool is unreadable.
+  const fallback = deps.pool === undefined ? (deps.config ?? getUserConfig()) : null;
+  const spec = fallback ? resolvePodPoolSpec(undefined, process.env, () => fallback.harness?.podPool ?? fallback.pod?.pool) : null;
+  const current = fallback && !spec ? leaseKubectl(['config', 'current-context']) : null;
+  const pool = deps.pool === undefined ? (spec ?? (current?.status === 0 ? current.stdout.trim() : null)) : deps.pool;
+  if (!pool) return null;
+  const members = parsePodPool(pool);
+  const measure = (deps.measurePoolLease ?? measurePoolLease)(members, { measureUsage: true, skipDnsProbe: true });
+  let accounts = -1;
+  try { accounts = listCodexAccountsInStore().length; } catch { /* Accounts are only observed, not a limit. */ }
+  const { recommended, limitedBy } = recommendConcurrency(measure, {
+    capacity: members.reduce((sum, member) => sum + member.capacity, 0),
+    accounts, perAccount: (deps.config ?? getUserConfig()).pod?.lease?.perAccount ?? 4,
+  });
+  return recommended === null || limitedBy === null ? null : { recommended, limitedBy };
+}
+
+/** Collect observations on the launch host; an unreadable Pod recommendation is not a refusal. */
+export function readAutoSubstrateSignals(deps: AutoSubstrateReadDeps = {}): AutoSubstrateSignals {
+  let podAdmission: AutoSubstrateSignals['podAdmission'];
+  try { podAdmission = (deps.podAdmission ?? (() => readAutoPodAdmission(deps)))() ?? null; }
+  catch { podAdmission = null; }
+  if (podAdmission?.recommended === null || podAdmission?.limitedBy === null) podAdmission = null;
+  return {
+    load1: (deps.loadavg ?? loadavg)()[0],
+    cores: (deps.cpus ?? cpus)().length,
+    availableMemoryBytes: (deps.freemem ?? freemem)(),
+    podAdmission,
+    localLaneOpen: deps.localLaneOpen?.() ?? false,
+  };
+}
+
 export interface NextLocalLaneCapInput {
   current: number;
   wanted: number;
@@ -194,28 +249,44 @@ export function checkHarnessPodPool(pool: string, run?: PoolKubectl): HarnessPoo
 export function resolveHarnessSubstrate({ flag, config, env, currentContext = () => {
   const result = spawnSync('kubectl', ['config', 'current-context'], { encoding: 'utf8', timeout: 5000 });
   return result.status === 0 ? result.stdout?.trim() : undefined;
-}, autoSignals, poolCheck = checkHarnessPodPool }: {
+  }, autoSignals, readAutoSignals, autoReadDeps, poolCheck = checkHarnessPodPool }: {
   flag?: { substrate?: HarnessSubstrate | 'auto'; podPool?: string };
   config?: Pick<UserConfig, 'harness' | 'pod'>;
   env?: NodeJS.ProcessEnv;
   currentContext?: () => string | undefined;
   /** Signals must come from the launch host and Pod admission, not a worktree's cached config. */
   autoSignals?: AutoSubstrateSignals;
+  /** Inject the collector at the decision boundary; explicit requests never invoke it. */
+  readAutoSignals?: () => AutoSubstrateSignals;
+  /** Inject measurement dependencies without bypassing the default collector or pool selection. */
+  autoReadDeps?: Omit<AutoSubstrateReadDeps, 'pool' | 'config' | 'podAdmission'>;
   /** POD-POOL-UNCAPPED-SPEC — pre-launch check of the implicit kube context; tests inject it instead of shelling out. */
   poolCheck?: (pool: string) => HarnessPoolCheck;
 }): ResolvedHarnessSubstrate {
   const requested = flag?.substrate ?? config?.harness?.substrate ?? 'local';
   if (requested !== 'local' && requested !== 'pod' && requested !== 'auto') throw new Error('harness.substrate: local, pod 또는 auto 만 허용한다');
   const source = flag?.substrate ? 'flag' : config?.harness?.substrate ? 'config' : 'default';
-  // Missing signals mean admission was not observed, not that the Pod has room.
-  const decision = requested === 'auto' ? routeAutoSubstrate(autoSignals ?? {
-    podAdmission: null, load1: null, cores: null, availableMemoryBytes: null, localLaneOpen: false,
-  }) : null;
+  const explicit = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim();
+  // Reuse the same pool choice for admission and launch; do not fall back to a different universe's pool.
+  let implicit: string | undefined;
+  let contextRead = false;
+  const selectedPool = () => {
+    if (explicit) return explicit;
+    if (!contextRead) { implicit = currentContext()?.trim(); contextRead = true; }
+    return implicit;
+  };
+  const signals = requested === 'auto'
+    ? (autoSignals ?? (readAutoSignals ?? (() => readAutoSubstrateSignals({ ...autoReadDeps, pool: selectedPool() ?? null, config })))())
+    : null;
+  if (signals && autoSignals === undefined) debug.log('harness.substrate', 'auto-signals', {
+    load1: signals.load1, cores: signals.cores, availableMemoryBytes: signals.availableMemoryBytes,
+    podAdmission: signals.podAdmission, localLaneOpen: signals.localLaneOpen,
+  });
+  const decision = signals ? routeAutoSubstrate(signals) : null;
   const substrate: HarnessSubstrate = requested === 'auto' ? decision!.substrate : requested;
   if (decision) debug.log('harness.substrate', 'route', { substrate, reason: decision.reason, source });
   if (substrate === 'local') return { substrate, pool: null, source };
-  const explicit = flag?.podPool?.trim() || env?.ELANOUS_POD_POOL?.trim() || config?.harness?.podPool?.trim() || config?.pod?.pool?.trim();
-  const pool = explicit || currentContext()?.trim();
+  const pool = selectedPool();
   if (!pool) throw new Error(`harness.substrate=${decision ? `auto→pod(${decision.reason})` : 'pod'}: Pod 풀 또는 현재 컨텍스트에 닿지 못했다 — 풀을 설정하거나 \`--substrate local\` 로 명시하라`);
   // POD-POOL-UNCAPPED-SPEC — an explicit pool is the operator's own statement and gets `checkPodPool` at the launch
   //   site (`src/index.ts` self orchestrate · `src/loops/orchestrator/tick.ts` · `pod-command-job.ts`). The implicit

package/src/harness/harness-worktree-auto.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { readFileSync } from 'node:fs';
 import { resolveMainRepoRoot, type HarnessWorktreeCommand } from '../git-fs/worktree.js';
 import { goalTitleFromDocument } from '../self-implement/seams.js';
@@ -25,7 +26,7 @@ interface DevWorktreeGoal {
 }
 
 function git(cwd: string, args: string[]): string {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   if (result.status !== 0) {
     const message = (result.stderr || result.stdout || '').trim() || `git exited ${result.status}`;
     throw new Error(`dev auto-worktree inspection failed — ${message}`);

package/src/harness/harness-worktrees.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { resolve } from 'node:path';
 import { debug } from '../debug/log.js';
 import { gitStdout, type GitRunner } from './harness-clean.js';
@@ -146,7 +147,7 @@ export function renderHarnessWorktreesReport(report: WorktreeAssessmentReport, r
 
 export type GhWorktreeRunner = (args: string[], cwd: string) => { status: number | null; stdout: string };
 const defaultGhRunner: GhWorktreeRunner = (args, cwd) => {
-  const result = spawnSync('gh', args, { cwd, encoding: 'utf8', timeout: 25_000 });
+  const result = spawnSync('gh', args, { cwd, encoding: 'utf8', timeout: 25_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   return { status: result.status, stdout: result.stdout ?? '' };
 };
 
@@ -366,7 +367,7 @@ export function execHarnessWorktrees(deps: {
   progress?: (line: string) => void;
 } = {}): WorktreeAssessmentReport {
   const run: GitRunner = deps.run ?? ((args) => {
-    const result = spawnSync('git', args, { encoding: 'utf8', timeout: 25_000 });
+    const result = spawnSync('git', args, { encoding: 'utf8', timeout: 25_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
     return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
   });
   const worktrees = listRegisteredWorktrees(run);

package/src/hooks/dispatch.ts

@@ -24,7 +24,8 @@ const DEFAULT_SEAT_ROUTES = [
  *  So a delivered card with the seat loop off is not retried (the card waits in the inbox), and a shadow loop's wake is
  *  recorded as `wake_status = 'shadow'` — visible as «not executed», not mistaken for a real run. */
 export async function dispatchHook(event: QueuedHook, root: string, config: EventsConfig,
-  wake: HookWake = seat => runSeatLoopOnce(seat, { root, config: getUserConfig().loops?.seat ?? { mode: 'off' } }),
+  // Autonomous hook wake: the needs-owner hold stays on (NEEDS-OWNER-BOUNDARY).
+  wake: HookWake = seat => runSeatLoopOnce(seat, { root, needsOwnerGate: true, config: getUserConfig().loops?.seat ?? { mode: 'off' } }),
   now: () => number = Date.now): Promise<void> {
   const key = `${event.provider}:${event.eventId}`;
   const route = config.routes.find(candidate => candidate.source === event.provider && candidate.kind === event.kind);

package/src/index.ts

@@ -489,7 +489,17 @@ async function executeHarnessSelfRun(
   runId: string,
   startDraftTriage: typeof import('./self-dev/dev-cli.js')['startDraftTriage'],
   startDraftTriageOptions?: RunDevAskStartDraftTriageOptions,
+  entranceId?: EntranceId,
 ): Promise<Awaited<ReturnType<RunDevAskRunDevPipeline>>> {
+  // TA harness say/ask may be decomposed into parallel text goals before
+  // runDevPipeline reads the authored file. Check the original GOAL here,
+  // before any orchestrator or Pod child can be dispatched.
+  const isGoalFile = existsSync(input);
+  if (process.env.ELANOUS_TASK_CARD_ID?.trim() || isGoalFile) {
+    const { preflightGoalDoneBoundary } = await import('./self-dev/dev-pipeline.js');
+    preflightGoalDoneBoundary({ file: isGoalFile ? input : '<harness request>' }, isGoalFile ? readFileSync(input, 'utf8') : input,
+      process.env.ELANOUS_TASK_CARD_ID, entranceId, isGoalFile ? 'goal' : 'request');
+  }
   startDraftTriage(runId, startDraftTriageOptions);
   // 정지 요청의 «신선도» 기준 — 첫 런 «전»에 잰다(첫 런 도중의 정지도 이 호출의 것이다).
   const invocationStartedAtMs = Date.now();
@@ -651,6 +661,11 @@ async function runDevAskFromAskFile(askPath: string, opts: HarnessAskSayChildLlm
     },
   );
   if (flowResult.kind !== 'launch') {
+    // ⭐ 프리플라이트 거절은 «자식 결과» 봉투로 마지막 JSON 행을 남긴다 — Pod 원장(pod-failure-reason.nestedPodResult)이
+    //   {ok, kind, result:{stage, blockers}} 중첩 행에서 사유 코드·검사 이름·경로를 읽는다. 나머지 중단은 기존대로 조용히 exit(1).
+    if (opts.json && flowResult.kind === 'stopped-by-preflight') {
+      await writeStdoutJson(`${JSON.stringify({ ok: false, kind: 'self', result: { stage: 'preflight-blocked', ok: false, blockers: flowResult.blockers } })}\n`);
+    }
     runDevAskFromGoalFileDeps.setExitCode(1);
     return;
   }
@@ -677,6 +692,7 @@ async function runDevAskFromAskFile(askPath: string, opts: HarnessAskSayChildLlm
     identity.runId,
     startDraftTriage,
     startDraftTriageOptions,
+    CLI_HARNESS_ASK_ENTRANCE.id,
   );
   const ok = devResultOk(result);
   if (opts.json) {
@@ -782,6 +798,7 @@ async function runDevAskFromGoalFile(goalPath: string, opts: HarnessAskSayChildL
     identity.runId,
     startDraftTriage,
     startDraftTriageOptions,
+    CLI_HARNESS_ASK_ENTRANCE.id,
   );
   const ok = devResultOk(result);
   if (opts.json) {
@@ -886,6 +903,7 @@ async function runDevSayFromWords(
     identity.runId,
     startDraftTriage,
     startDraftTriageOptions,
+    entrance,
   );
   const ok = devResultOk(result);
   if (opts.json) {
@@ -4319,10 +4337,15 @@ selfCmd
   .option('--base <ref>', '커밋됐지만 PR 없는 변경의 비교 기준(ref...HEAD)')
   .option('--pr <number>', '열린 PR 번호에서 gh pr view files로 변경 파일을 읽는다')
   .option('--shards [number]', '메모리 예산에 맞춰 시험을 별도 프로세스로 분할한다 (기본 2)')
+  .option('--fixed-shard-distribution', '--shards N 과 함께만: RSS 사전 측정 없이 정렬된 파일을 N 조각에 라운드로빈 고정 배정한다(opt-in · 메모리 보증 아님 · 조각 타임아웃/OOM = unmeasured)')
+  .option('--include-importers', '변경 모듈을 가져오는 importer 시험도 실행한다 (기본 caller 한도 밖까지)')
   .option('--remote [host]', 'GATE-REMOTE — 같은 커밋을 원격 호스트(기본 config gateRemote.host=node-b)에서 돌리고 결과만 가져온다(깨끗한 트리 · --pr 은 로컬)')
   .option('--local', '원격 자동 분배(로컬 1분 부하 > gateRemote.loadThreshold=20)를 끄고 로컬에서 돌린다')
-  .action(async (opts: { changed?: boolean; base?: string; pr?: string; shards?: string | boolean; remote?: string | boolean; local?: boolean }) => {
+  .option('--artifact-dir <dir>', '조각별 지금/기준 JUnit ⊕ summary.json 을 이 디렉토리에 남긴다(판정 불변 · JUnit 은 --shards 경로만 · 원격 실행이면 그 호스트에서 가져온다)')
+  .action(async (opts: { changed?: boolean; base?: string; pr?: string; shards?: string | boolean; fixedShardDistribution?: boolean; includeImporters?: boolean; remote?: string | boolean; local?: boolean; artifactDir?: string }) => {
     if (!opts.changed && opts.shards === undefined) { ui.error('self gate requires --changed or --shards'); process.exitCode = 2; return; }
+    if (opts.fixedShardDistribution && opts.shards === undefined) { ui.error('self gate: --fixed-shard-distribution requires --shards <n>'); process.exitCode = 2; return; }
+    if (opts.artifactDir !== undefined && !opts.artifactDir.trim()) { ui.error('self gate: --artifact-dir needs a non-empty directory'); process.exitCode = 2; return; }
     // The root strips `--local` from argv anywhere (remote-bookmark attach · src/cli/remote-resolve.ts) before Commander
     // sees it, so this subcommand reads it from the untouched process.argv.
     opts.local = !!opts.local || process.argv.slice(2).includes('--local');
@@ -4332,10 +4355,13 @@ selfCmd
       if (!isValidGateHost(opts.remote)) { ui.error(`self gate: invalid --remote host: ${opts.remote}`); process.exitCode = 2; return; }
     }
     const shards = opts.shards === undefined ? undefined : opts.shards === true ? 2 : Number(opts.shards);
+    let ranLocal = false;
+    let remoteArtifacts: { dir: string; fetch?: { ok: true; summaryPath: string; junitFiles: string[]; remoteDirKept: boolean } | { ok: false; reason: string } } | { unsupported: true } | undefined;
     const runLocal = () => {
+      ranLocal = true;
       try {
         const { runSelfGateCli } = require('./self-implement/gate-cli.js') as typeof import('./self-implement/gate-cli.js');
-        const result = runSelfGateCli(process.cwd(), { base: opts.base, pr: opts.pr, shards });
+        const result = runSelfGateCli(process.cwd(), { base: opts.base, pr: opts.pr, shards, ...(opts.fixedShardDistribution ? { fixedShardDistribution: true } : {}), includeImporterTests: !!opts.includeImporters, ...(opts.artifactDir !== undefined ? { artifactDir: opts.artifactDir } : {}) });
         console.log(result.lines.join('\n'));
         return result.exitCode;
       } catch (error) {
@@ -4350,23 +4376,74 @@ selfCmd
       if (topLevel.status !== 0) throw new Error(`git rev-parse --show-toplevel failed: ${topLevel.stderr.trim() || `rc=${topLevel.status}`}`);
       const repo = topLevel.stdout.trim();
       // Only a committed --base range is reproducible on another host: the default mode measures uncommitted files, --pr
-      // reads files through gh on this host, and the remote checkout runs from the repository root — those stay local.
+      // reads files through gh on this host, and the remote checkout runs from the repository root — automatic placement
+      // falls back locally; an explicit --remote reports that this check was not measured.
       const { realpathSync } = await import('node:fs');
       const localOnlyReason = opts.pr ? 'self gate --pr reads PR files through gh on this host'
         : !opts.base ? 'self gate without --base measures uncommitted files on this host'
         : realpathSync(repo) !== realpathSync(process.cwd()) ? 'self gate run from a sub-directory' : undefined;
+      // SIDE-VERIFY-GATE-SHARDS ② — the host writes its artifacts outside its scratch tree (which its trap removes) and we
+      // fetch them back after the run. Only when the measured commit knows --artifact-dir: an unknown option would kill the
+      // remote CLI and change the verdict itself.
+      if (opts.artifactDir !== undefined) {
+        const { remoteCommitSupportsArtifactDir, newRemoteArtifactDir } = await import('./self-implement/gate-artifacts.js');
+        remoteArtifacts = remoteCommitSupportsArtifactDir(repo) ? { dir: newRemoteArtifactDir() } : { unsupported: true };
+      }
+      const remoteArtifactArgs = remoteArtifacts && 'dir' in remoteArtifacts ? ['--artifact-dir', remoteArtifacts.dir] : [];
       // origin/main is pinned to this machine's origin/main on the host; any other base is passed as its resolved sha.
       const remoteArgv = (sha: (ref: string) => string) => ['bun', 'bin/elanous.mjs', 'self', 'gate', '--local', ...(opts.changed ? ['--changed'] : []),
-        ...(opts.base ? ['--base', opts.base === 'origin/main' ? opts.base : sha(opts.base)] : []), ...(shards !== undefined ? ['--shards', String(shards)] : [])];
+        ...(opts.base ? ['--base', opts.base === 'origin/main' ? opts.base : sha(opts.base)] : []), ...(shards !== undefined ? ['--shards', String(shards)] : []),
+        // A measured commit without this option rejects it (exit ≠ 0) — read as not passed, never as a silent measured run.
+        ...(opts.fixedShardDistribution ? ['--fixed-shard-distribution'] : []),
+        ...(opts.includeImporters ? ['--include-importers'] : []), ...remoteArtifactArgs];
+      const { gateHostReservationRoot } = await import('./release-loop/gate-host-reservation.js');
       process.exitCode = await dispatchHeavyCheck({
-        tool: 'self-gate', repo, installPwa: true, remoteArgv, refs: opts.base ? [opts.base] : [],
+        tool: 'self-gate', repo, installPwa: true, remoteArgv, refs: opts.base ? [opts.base] : [], reservationRoot: gateHostReservationRoot(),
         localOnlyReason,
+        explicitRemoteOnly: opts.remote !== undefined, reportRemoteHost: true,
         flags: { remote: typeof opts.remote === 'string' ? opts.remote : opts.remote ? true : undefined, local: !!opts.local },
         runLocal,
+        ...(remoteArtifacts && 'dir' in remoteArtifacts && opts.artifactDir !== undefined ? {
+          onRemoteOutcome: ((outcome, host, runner) => {
+            const { fetchRemoteGateArtifacts, remoteArtifactCleanupScript, resolveArtifactDir } = require('./self-implement/gate-artifacts.js') as typeof import('./self-implement/gate-artifacts.js');
+            const target = remoteArtifacts as { dir: string; fetch?: { ok: true; summaryPath: string; junitFiles: string[]; remoteDirKept: boolean } | { ok: false; reason: string } };
+            if (outcome.kind === 'ran') {
+              target.fetch = fetchRemoteGateArtifacts({ host, remoteDir: target.dir, localDir: resolveArtifactDir(opts.artifactDir!, process.cwd()), ssh: runner.ssh });
+            } else if (outcome.kind === 'infra') {
+              // The run may have started before it broke — remove the host-side dir; automatic placement's local fallback writes its own.
+              try { runner.ssh(host, remoteArtifactCleanupScript(target.dir), 30_000); } catch { /* best effort */ }
+            }
+          }) satisfies NonNullable<import('./self-implement/gate-remote.js').DispatchOptions['onRemoteOutcome']>,
+        } : {}),
       });
     } catch (error) {
-      ui.error(`self gate dispatch failed: ${error instanceof Error ? error.message : String(error)}`);
-      process.exitCode = runLocal();
+      const reason = error instanceof Error ? error.message : String(error);
+      if (opts.remote !== undefined) {
+        ui.error(`self gate remote unmeasured — ${reason.replace(/\s+/g, ' ').trim()}`);
+        process.exitCode = 1;
+      } else {
+        ui.error(`self gate dispatch failed: ${reason}`);
+        process.exitCode = runLocal();
+      }
+    }
+    // 원격에서 돌았으면 그 호스트의 산출을 가져와 같은 꼴로 썼다 — 못 가져왔으면 «조용히» 비우지 않고 summary 에 이유를 적는다(판정 불변).
+    if (opts.artifactDir !== undefined && !ranLocal) {
+      const fetched = remoteArtifacts && 'dir' in remoteArtifacts ? remoteArtifacts.fetch : undefined;
+      try {
+        if (fetched?.ok) {
+          console.log(`artifacts: ${fetched.summaryPath} (junit ${fetched.junitFiles.length} · fetched from remote)`);
+          if (fetched.remoteDirKept) console.log(`⚠ artifacts: 원격 산출 디렉토리를 못 지웠다 — ${(remoteArtifacts as { dir: string }).dir} (판정은 그대로다)`);
+        }
+        else {
+          const reason = remoteArtifacts && 'unsupported' in remoteArtifacts ? 'remote-unsupported' as const : 'remote-fetch-failed' as const;
+          if (reason === 'remote-fetch-failed') console.log(`⚠ artifacts: 원격 산출을 못 가져왔다 — ${fetched && !fetched.ok ? fetched.reason : 'no remote fetch ran'} (판정은 그대로다)`);
+          const { writeRemoteUnavailableGateArtifacts } = await import('./self-implement/gate-artifacts.js');
+          const written = writeRemoteUnavailableGateArtifacts(opts.artifactDir, process.cwd(), opts.base, Number(process.exitCode ?? 0), reason);
+          console.log(`artifacts: ${written.summaryPath} (junit 0 · unavailable=${reason})`);
+        }
+      } catch (error) {
+        console.log(`⚠ artifacts: ${opts.artifactDir} 에 못 썼다 — ${error instanceof Error ? error.message : String(error)} (판정은 그대로다)`);
+      }
     }
   });
 
@@ -7505,7 +7582,7 @@ const selfDevCmd = program
             cfg: reloadUserConfig(),
             userText: text,
             explicitSessionId: chat.session,
-            reuseActive: !chat.forceNew,
+            reuseActive: chat.continueActive === true,
             forceNew: chat.forceNew === true,
             json: chat.json === true,
             enableTools: chat.enableTools,
@@ -7790,7 +7867,7 @@ configCmd
   .command('set <path> <value>')
   .description('Set a dotted config path. Value is parsed as JSON when possible.')
   .option('--no-backup', "Don't write config.json.bak before saving")
-  .action((path: string, value: string, opts: { backup?: boolean }) => {
+  .action(async (path: string, value: string, opts: { backup?: boolean }) => {
     const parsed = parseConfigValue(value);
     const cfg = getUserConfig() as unknown as Record<string, unknown>;
     const previousProvider = getConfigPath(cfg, 'llm.provider');
@@ -7809,6 +7886,7 @@ configCmd
       : undefined;
 
     if (opts.backup !== false) backupUserConfig(userConfigPath());
+    const prev = getConfigPath(cfg, path); // CFG-STORE2 감사 이력 — 변경 «전» 값
     setConfigPath(cfg, path, parsed);
     if (credential?.apiKey && (credential.source === 'rotation' || credential.source === 'env')) {
       setConfigPath(cfg, 'llm.apiKey', credential.apiKey);
@@ -7822,6 +7900,8 @@ configCmd
       console.error(`⚠️ set ${path} — 저장 후 값 미반영(직렬화 드롭). 읽힌값=${JSON.stringify(after)}`);
       process.exit(1);
     }
+    // CFG-STORE2 — 저장 «성공» 뒤 감사 이력 한 줄 · fail-open(기록 실패가 set 을 막지 않는다).
+    try { (await import('./cli/config-audit.js')).recordConfigChange({ key: path, prev, next: parsed, why: 'config set' }); } catch (err) { ui.warn(`config 감사 이력 기록 실패(무시): ${err instanceof Error ? err.message : String(err)}`); }
     if (credential?.apiKey && (credential.source === 'rotation' || credential.source === 'env')) {
       ui.info(`provider credential updated: ${parsed} via ${credential.source} (${credential.apiKey.length} chars)`);
     } else if (credential?.source === 'none' && !isKeylessProvider(nextProvider)) {
@@ -7836,9 +7916,10 @@ configCmd
   .command('unset <path>')
   .description('Remove a dotted config path (set 의 역 · 배열 인덱스 지원). 이미 없으면 no-op.')
   .option('--no-backup', "Don't write config.json.bak before saving")
-  .action((path: string, opts: { backup?: boolean }) => {
+  .action(async (path: string, opts: { backup?: boolean }) => {
     const cfg = getUserConfig() as unknown as Record<string, unknown>;
-    if (getConfigPath(cfg, path) === undefined) {
+    const prev = getConfigPath(cfg, path); // CFG-STORE2 감사 이력 — 삭제 «전» 값
+    if (prev === undefined) {
       ui.info(`unset ${path} — 이미 없음 (no-op)`);
       return;
     }
@@ -7852,6 +7933,8 @@ configCmd
       console.error(`⚠️ unset ${path} — 삭제 후에도 값 잔존. 남은값=${JSON.stringify(after)}`);
       process.exit(1);
     }
+    // CFG-STORE2 — 삭제 저장 «성공» 뒤 감사 이력 한 줄 · fail-open(기록 실패가 unset 을 막지 않는다).
+    try { (await import('./cli/config-audit.js')).recordConfigChange({ key: path, prev, why: 'config unset' }); } catch (err) { ui.warn(`config 감사 이력 기록 실패(무시): ${err instanceof Error ? err.message : String(err)}`); }
     ui.info(`unset ${path}`);
   });
 
@@ -8050,6 +8133,7 @@ program
       reuseActive: opts.reuse === true,
       forceNew: false,
       json: opts.json === true,
+      surface: 'ask',
     });
   });
 
@@ -8900,15 +8984,26 @@ function announceChatToolsCompatibility(): void {
 
 // ── chat (single-turn helper, non-TUI) ──
 program
-  .command('chat <text...>')
-  .description('Send one message in the active session (or a new one) and print the reply')
-  .option('--new', 'Force a new session instead of using the active one')
-  .option('--session <id>', 'Continue an explicit session (id or unique prefix). Overrides --new and active session.')
+  .command('chat [text...]')
+  .description('Send one message in a new session (or a continued one with --continue/--resume/--session) and print the reply')
+  .option('--new', 'Start a new session (the default since 0.2.31 — kept for compatibility)')
+  .option('--continue', 'Continue the active session instead of starting a new one')
+  .option('--resume [id]', 'Continue a session: the given id (or unique prefix), or the active session when no id is given. A word after --resume that is not session-id shaped (hex uuid) is read as the prompt, not the id.')
+  .option('--session <id>', 'Continue an explicit session (id or unique prefix). Overrides --new, --continue and --resume.')
   .option('--json', 'Emit a single JSON line {sessionId, provider, model, reply, logPath, budget} instead of streaming text + ui.info trailer. Stable shape for LLM self-spawn.')
   .option('--tools', 'Enable the tool-loop path (Read/Grep/Glob/ListDir/Edit/Write + Bash). Default off — chat is text-only by default for backward compatibility. `elanous agent` is a thin wrapper that flips this on.')
   .option('--goal-loop', 'Arm the across-turn goal loop (runGoalLoop): wrap the tool-loop so the model keeps iterating until the goal is complete (GOAL-COMPLETE evidence gate) or maxIterations. Requires --tools. Same engine as ACP/dashboard (재발명 없음). Config `llm.goalLoop.enabled` also arms it.')
   .option('--implement', 'Bypass the harness goal-loop guard for the legacy implementation child entrypoint')
-  .action(async (parts: string[], opts: { new?: boolean; session?: string; json?: boolean; tools?: boolean; goalLoop?: boolean; implement?: boolean }) => {
+  .action(async (rawParts: string[], opts: { new?: boolean; continue?: boolean; resume?: string | boolean; session?: string; json?: boolean; tools?: boolean; goalLoop?: boolean; implement?: boolean }) => {
+    // TUI-H8-FOLLOW ② — `chat --resume "질문"` 에서 Commander 가 질문 첫 낱말을 세션 id 로 먹지 않게.
+    const { splitResumeArgument } = await import('./session/session-start.js');
+    const split = splitResumeArgument(opts.resume, rawParts ?? [], 'chat', process.argv.slice(2));
+    opts.resume = split.resume;
+    const parts = split.parts;
+    if (parts.length === 0) {
+      console.error("error: missing required argument 'text'");
+      process.exit(1);
+    }
     if (getHarnessSpace() && opts.tools && opts.goalLoop && !opts.implement) {
       process.stderr.write('Harness chat goal-loop requires `dev --implement`; use that implementation entrypoint instead.\n');
       process.exitCode = 1;
@@ -8951,7 +9046,7 @@ program
         cfg: refreshed,
         userText: text,
         explicitSessionId: chat.session,
-        reuseActive: !chat.forceNew,
+        reuseActive: chat.continueActive === true,
         forceNew: chat.forceNew === true,
         json: chat.json === true,
         enableTools: chat.enableTools,
@@ -8963,8 +9058,10 @@ program
 // ── repl (sticky multi-turn REPL) ──
 program
   .command('repl')
-  .description('Sticky multi-turn REPL — same session across turns, no per-turn process boot. Drives chat / agent / scenario from one shell. Uses --new for a fresh session, --session <id> to resume, --scenario <yaml> for a scripted run, JSONL on stdin for piped automation.')
-  .option('--new', 'Force a new session at boot instead of resuming the active one')
+  .description('Sticky multi-turn REPL — same session across turns, no per-turn process boot. Drives chat / agent / scenario from one shell. Boots a new session by default; --continue/--resume continue the active one, --session <id> resumes an explicit one, --scenario <yaml> for a scripted run, JSONL on stdin for piped automation.')
+  .option('--new', 'Start a new session at boot (the default since 0.2.31 — kept for compatibility)')
+  .option('--continue', 'Continue the active session at boot instead of starting a new one')
+  .option('--resume [id]', 'Continue a session at boot: the given id (or unique prefix), or the active session when no id is given')
   .option('--session <id>', 'Resume an explicit session (id or unique prefix)')
   .option('--scenario <path>', 'Run a YAML multi-turn scenario before handing back to interactive (or exit)')
   .option('--replay <session-id>', 'Re-execute the user prompts from a previous session in a fresh REPL run. User prompts are extracted in order and fed through the same dispatcher as --scenario; assistant/tool messages and attachments are dropped. Mutually exclusive with --scenario.')
@@ -8975,6 +9072,8 @@ program
   .option('--stdin-jsonl', 'Force JSONL-on-stdin mode even when stdin is a TTY (useful for testing automation paths)')
   .action(async (opts: {
     new?: boolean;
+    continue?: boolean;
+    resume?: string | boolean;
     session?: string;
     scenario?: string;
     replay?: string;
@@ -8999,8 +9098,9 @@ program
     const exitAfterScenario = opts.exitAfterScenario === undefined ? exitDefault : opts.exitAfterScenario;
     const code = await runRepl({
       cfg: refreshed,
-      initialSessionId: opts.session,
+      initialSessionId: opts.session ?? (typeof opts.resume === 'string' ? opts.resume : undefined),
       forceNew: opts.new === true,
+      continueActive: opts.continue === true || opts.resume === true,
       enableTools: opts.tools !== false,
       scenarioPath: opts.scenario,
       replaySessionId: opts.replay,
@@ -11432,7 +11532,14 @@ voiceCmd
   });
 
 // ── Default: Dashboard (no subcommand) ──
-const DASHBOARD_FLAGS = new Set(['--debug', '--chat-only', '--chat', '--yolo', '--benchmark']);
+const DASHBOARD_FLAGS = new Set(['--debug', '--chat-only', '--chat', '--yolo', '--benchmark', '--continue']);
+
+/** 대표 #73 — `--resume` 뒤 토큰이 세션 id 인가(없거나 다른 플래그면 «id 없는 이어하기» = 최신 세션). */
+export function rootResumeIdAt(rawArgs: readonly string[], resumeFlagIdx: number): string | undefined {
+  if (resumeFlagIdx < 0) return undefined;
+  const next = rawArgs[resumeFlagIdx + 1];
+  return next !== undefined && !next.startsWith('-') ? next : undefined;
+}
 
 export function filterDashboardArgs(rawArgs: readonly string[], resumeFlagIdx?: number): string[] {
   const rootResumeFlagIdx = resumeFlagIdx ?? rawArgs.findIndex((arg, index) =>
@@ -11447,7 +11554,8 @@ export function filterDashboardArgs(rawArgs: readonly string[], resumeFlagIdx?:
   return rawArgs.filter((a, i) => {
     if (!leadsWithSubcommand && (DASHBOARD_FLAGS.has(a) || a === '--rich')) return false;
     if (!leadsWithSubcommand && i === rootResumeFlagIdx) return false;
-    if (!leadsWithSubcommand && rootResumeFlagIdx >= 0 && i === rootResumeFlagIdx + 1) return false;
+    if (!leadsWithSubcommand && rootResumeFlagIdx >= 0 && i === rootResumeFlagIdx + 1
+      && rootResumeIdAt(rawArgs, rootResumeFlagIdx) !== undefined) return false;
     return true;
   });
 }
@@ -11645,13 +11753,32 @@ async function main(): Promise<void> {
     //    🩹 옛 손버릇은 `readRemoteFlag` 쪽 오류 문면이 «갈 곳을 말해» 받는다.
     arg === '--resume' && rawArgs.slice(0, index).every((prior) => prior.startsWith('-')),
   );
-  const resumeFromFlag = resumeFlagIdx >= 0 ? rawArgs[resumeFlagIdx + 1] : undefined;
+  const resumeFromFlag = rootResumeIdAt(rawArgs, resumeFlagIdx);
   // Step 5 PR γ — env read routes through readDeprecatedEnv so the
   // user gets a one-shot deprecation warning when the env override
   // drives the resume path. CLI flag wins outright (no warning).
   const { readDeprecatedEnv: readDeprecatedEnvForResume } = await import('./control-client/env-resolver.js');
-  const resumeFromEnv = readDeprecatedEnvForResume('ELANOUS_RESUME_SESSION').value;
-  const resumeSessionId = (resumeFromFlag ?? resumeFromEnv ?? '').trim() || undefined;
+  // 대표 #73 — 인자 없는 `elanous` 는 새 세션. 이어하기는 `--resume <id>` · id 없는 `--resume` · `--continue`(= 최신 세션)일 때만.
+  const leadsWithSubcommandForResume = rawArgs.length > 0 && !rawArgs[0]!.startsWith('-');
+  const continueLatest = !leadsWithSubcommandForResume
+    && (rawArgs.includes('--continue') || (resumeFlagIdx >= 0 && resumeFromFlag === undefined));
+  // 우선순위: `--resume <id>` > `--continue`·id 없는 `--resume`(최신) > (폐기 예정) ELANOUS_RESUME_SESSION.
+  //   ⛔ 명시 인자가 있으면 환경변수가 이기지 않는다(TUI-H8 r1 must-fix).
+  const { resolveLatestSessionId, resolveRootResumeSessionId } = await import('./session/session-start.js');
+  const rootResume = resolveRootResumeSessionId({
+    ...(resumeFromFlag !== undefined ? { flagId: resumeFromFlag } : {}),
+    continueLatest,
+    // 명시 인자가 있으면 env 를 «읽지도» 않는다(폐기 경고가 명시 이어하기에 섞이지 않게).
+    readEnvId: () => readDeprecatedEnvForResume('ELANOUS_RESUME_SESSION').value ?? null,
+    latest: () => resolveLatestSessionId({
+      activeSessionId: () => getActiveSessionId(),
+      latestSessionId: () => listSessions({ limit: 1 })[0]?.id ?? null,
+      // TUI-H8-FOLLOW ① — 활성 표지가 사라진 세션이면 최신 세션으로(#28509 리뷰 should-fix).
+      sessionExists: (id) => loadSession(id) !== null,
+    }),
+  });
+  if (rootResume.source === 'continue-none') console.log('[elanous] --continue: 이어갈 세션이 없다 — 새 세션으로 시작한다');
+  const resumeSessionId = rootResume.sessionId;
 
   // user-config can opt into benchmark mode persistently
   // (`dashboard.benchmark: true`) so callers don't have to retype the

package/src/input/external-input-queue.ts

@@ -12,6 +12,9 @@
 //    - Enter 없는 글: 빈 composer 면 종전대로 채우고, 바쁘면(턴 중·버퍼에 글자) «거부»한다 —
 //      나중에 사용자 composer 에 채우면 다시 섞이므로 대기시키지 않는다(IPC 가 실패로 정산 → rc≠0).
 //    대기열은 «턴이 끝나고 composer 가 비었을 때» 한 건씩 나간다 — 사용자 버퍼는 건드리지 않는다.
+//    - ⏹ 정확히 `/stop`·`/esc` 인 글(TUI-STOP-INPUT-BYPASS · #68): 대기열을 «건너뛰고» 지금 턴의 ESC 중단 경로
+//      (`requestStop` → 대시보드 escGate)를 바로 부른다. 대기 중인 일반 항목은 그대로·순서대로 남는다.
+//      턴이 없으면 아무것도 안 하고 `tui-stop-no-active-turn`(멈출 길이 없으면 `tui-stop-undelivered`)으로 던져 바깥 호출자(rc≠0)에게 알린다.
 //
 // ⚠️ herdr/tmux 처럼 «터미널 자체»에 쓰는 길은 키보드와 구별할 수 없다 — 이 라우터는
 //    elanous 제어 IPC(`pty text`) 경로만 가른다.
@@ -33,11 +36,15 @@ export interface ExternalInputHost {
   hasPendingKeys(): boolean;
   /** 별도 메시지로 제출한다. 못 보냈으면 false(항목은 대기열에 남는다). */
   submit(text: string, source: InputSourceRef): boolean;
+  /** 지금 턴을 ESC 와 같은 경로로 멈춘다. 멈출 턴(escGate)이 없으면 false. 없으면 외부 stop 은 «턴 없음»으로 처리. */
+  requestStop?(): boolean;
+  /** 외부 stop 의 결과 표지(채팅 로그 한 줄). */
+  onExternalStop?(result: 'stopped' | 'no-turn' | 'failed'): void;
   /** 대기열이 바뀌었다 — 화면 표지를 다시 그린다. */
   onQueueChange?(pending: readonly ExternalInputItem[], event: 'queued' | 'delivered'): void;
 }
 
-export type ExternalInputRoute = 'passthrough' | 'submitted' | 'queued';
+export type ExternalInputRoute = 'passthrough' | 'submitted' | 'queued' | 'stopped';
 export type ExternalInputDecision = 'passthrough' | 'submit-now' | 'queue' | 'reject';
 
 const EXTERNAL_INPUT_SOURCE: InputSourceRef = { kind: 'terminal', provider: 'pty' };
@@ -57,6 +64,11 @@ export function parseExternalTextLine(chars: string): { text: string; submit: bo
   return { text, submit };
 }
 
+/** 외부 «멈춰» 명령인가 — 정확히 `/stop` 또는 `/esc`(앞뒤 공백·대소문자 변형은 일반 글). */
+export function isExternalStopCommand(text: string): boolean {
+  return text === '/stop' || text === '/esc';
+}
+
 /** 라우팅 판정(순수). */
 export function decideExternalInputRoute(input: {
   line: { text: string; submit: boolean } | null;
@@ -102,11 +114,14 @@ export interface ExternalInputQueueDeps {
   /** 펌프 스케줄러 — 정지 함수를 돌려준다. 시험이 손으로 돌린다. */
   schedule?: (tick: () => void, ms: number) => () => void;
   log?: (event: string, data: Record<string, unknown>) => void;
+  /** 외부 stop 관측 — 기본 `debug.log('tui.input', …)`. */
+  logInput?: (event: string, data: Record<string, unknown>) => void;
 }
 
 export function createExternalInputQueue(deps: ExternalInputQueueDeps = {}) {
   const now = deps.now ?? Date.now;
   const log = deps.log ?? ((event, data) => debug.log('tui.external-input', event, data));
+  const logInput = deps.logInput ?? ((event, data) => debug.log('tui.input', event, data));
   const schedule = deps.schedule ?? ((tick, ms) => {
     const t = setInterval(tick, ms);
     (t as { unref?: () => void }).unref?.();
@@ -153,6 +168,22 @@ export function createExternalInputQueue(deps: ExternalInputQueueDeps = {}) {
     return true;
   }
 
+  /** ⏹ 외부 stop — 대기열을 건너뛰고 지금 턴의 escGate 로. 대기열은 건드리지 않는다. */
+  function routeStop(h: ExternalInputHost, text: string): ExternalInputRoute {
+    let turnActive = false;
+    try { turnActive = h.isTurnActive(); } catch { turnActive = false; }
+    let stopped = false;
+    if (turnActive && h.requestStop) {
+      try { stopped = h.requestStop(); } catch { stopped = false; }
+    }
+    logInput('external-stop', { hadTurn: turnActive, stopped, command: text, pending: pending.length });
+    const result = stopped ? 'stopped' : turnActive ? 'failed' : 'no-turn';
+    try { h.onExternalStop?.(result); } catch { /* fail-soft */ }
+    if (result === 'no-turn') throw new Error('tui-stop-no-active-turn');
+    if (result === 'failed') throw new Error('tui-stop-undelivered');
+    return 'stopped';
+  }
+
   return {
     register(next: ExternalInputHost): () => void {
       host = next;
@@ -169,6 +200,7 @@ export function createExternalInputQueue(deps: ExternalInputQueueDeps = {}) {
       // `pty key`(input-key)는 «키»다 — 공백·`j` 처럼 출력 가능한 키도 종전대로 넣는다.
       if (keyCommandDepth > 0) return 'passthrough';
       const line = parseExternalTextLine(chars);
+      if (line && host && isExternalStopCommand(line.text)) return routeStop(host, line.text);
       let turnActive = false; let composer: string | undefined; let pendingKeys = false;
       if (host && line) {
         try { turnActive = host.isTurnActive(); composer = host.composerText(); pendingKeys = host.hasPendingKeys(); }