elanous 0.2.29 → 0.2.32

package/src/self-implement/run-ttl.ts

@@ -5,7 +5,9 @@
  * Past `tools.selfImplement.runTtlHours` (default 24) since its last commit, the sweep makes one pre-emptive move:
  *   · live owning run → one resync memo in its control inbox (same path as SIBLING-RESYNC #24893/#24899),
  *                       at most once per (PR, head sha) — a rebase moves the head and re-arms it
- *   · no live run     → the registered `elanous:needs-rebase` label, once (QUIET-PR-COMMENTS: never a comment)
+ *   · no live run     → the registered `elanous:needs-rebase` label, once (QUIET-PR-COMMENTS: never a comment);
+ *                       when `requestRegate` is supplied, at most one of those stale PRs is also selected
+ *                       for a re-gate request (shadow: would-regate observation only; live: one call)
  *
  * Mode `tools.selfImplement.runTtl.mode`: `shadow` (default) only logs what it would do; `live` writes.
  * Cost bound: a PR opened inside the TTL is still inside its own time-to-landing and is never fetched
@@ -63,6 +65,8 @@ export interface RunTtlResult {
   readonly memo: readonly number[];
   /** Label added (live) or would be added (shadow). */
   readonly label: readonly number[];
+  /** Re-gate requested (live) or would be requested (shadow). Empty when the adapter is omitted. */
+  readonly regate: readonly number[];
   readonly alreadyMarked: readonly number[];
   readonly alreadyMemoed: readonly number[];
   /** Owning run lookup failed — left alone (a failed lookup is not a dead run). */
@@ -109,6 +113,8 @@ export async function runRunTtlSweep(input: {
   concurrency?: number;
   now?: () => number;
   log?: (category: string, event: string, data: Record<string, unknown>) => void;
+  /** Optional: among stale PRs with no live run, request a re-gate for at most one per sweep. */
+  requestRegate?: (pr: RunTtlCandidate) => Promise<void> | void;
 }): Promise<RunTtlResult> {
   const { adapters } = input;
   const now = input.now ?? Date.now;
@@ -132,6 +138,7 @@ export async function runRunTtlSweep(input: {
   const stale: number[] = [];
   const memo: number[] = [];
   const label: number[] = [];
+  const regate: number[] = [];
   const alreadyMarked: number[] = [];
   const alreadyMemoed: number[] = [];
   const unresolved: number[] = [];
@@ -139,17 +146,17 @@ export async function runRunTtlSweep(input: {
   const skippedFetchCap: number[] = [];
   const failed: number[] = [];
   const result = (reason?: string): RunTtlResult => ({
-    mode, ttlHours, considered, freshByCreation, fetched, fresh, unknown, stale, memo, label, alreadyMarked,
+    mode, ttlHours, considered, freshByCreation, fetched, fresh, unknown, stale, memo, label, regate, alreadyMarked,
     alreadyMemoed, unresolved, skippedOverCap, skippedFetchCap, failed, durationMs: Math.max(0, now() - startedAt),
     ...(reason ? { reason } : {}),
   });
   const summary = (out: RunTtlResult): RunTtlResult => {
     emit('summary', {
       ttlHours, cap, maxFetch, concurrency, considered, freshByCreation, fetched, fresh,
-      unknown: unknown.length, stale: stale.length, memo: memo.length, label: label.length,
+      unknown: unknown.length, stale: stale.length, memo: memo.length, label: label.length, regate: regate.length,
       alreadyMarked: alreadyMarked.length, alreadyMemoed: alreadyMemoed.length, unresolved: unresolved.length,
       skippedOverCap: skippedOverCap.length, skippedFetchCap: skippedFetchCap.length, failed: failed.length,
-      memoPrs: memo, labelPrs: label, durationMs: out.durationMs, ...(out.reason ? { reason: out.reason } : {}),
+      memoPrs: memo, labelPrs: label, regatePrs: regate, durationMs: out.durationMs, ...(out.reason ? { reason: out.reason } : {}),
     });
     return out;
   };
@@ -200,6 +207,7 @@ export async function runRunTtlSweep(input: {
   }
   stalePrs.sort((a, b) => b.ageMs - a.ageMs || a.pr.number - b.pr.number);
   let actions = 0;
+  let selectedRegate = false;
   for (const { pr, target, ageMs } of stalePrs) {
     const ageHours = ageMs / 3_600_000;
     const key = `${pr.number}:${pr.headSha}`;
@@ -240,9 +248,15 @@ export async function runRunTtlSweep(input: {
       }
     }
     const reason = target.alive ? 'memo-failed' : target.reason;
+    const canRegate = Boolean(input.requestRegate) && !target.alive && !selectedRegate;
     if (mode === 'shadow') {
       label.push(pr.number);
       emit('would-label', { pr: pr.number, label: RUN_TTL_MARKER_LABEL, reason, ageHours: Math.floor(ageHours) });
+      if (canRegate) {
+        selectedRegate = true;
+        regate.push(pr.number);
+        emit('would-regate', { pr: pr.number, reason, ageHours: Math.floor(ageHours) });
+      }
       continue;
     }
     try {
@@ -253,6 +267,16 @@ export async function runRunTtlSweep(input: {
       failed.push(pr.number);
       emit('label-failed', { pr: pr.number, error: String(error) });
     }
+    if (canRegate) {
+      selectedRegate = true;
+      try {
+        await input.requestRegate!(pr);
+        regate.push(pr.number);
+        emit('regate-requested', { pr: pr.number, reason, ageHours: Math.floor(ageHours) });
+      } catch (error) {
+        emit('regate-failed', { pr: pr.number, error: String(error) });
+      }
+    }
   }
   return summary(result());
 }

package/src/self-implement/seams.ts

@@ -2493,6 +2493,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
 
     openPr: async ({ title, body, head, base, draft, labels, cwd }) => {
       const resolvedBase = assertBaseBranchOnOrigin(cwd, base);
+      const harnessSeat = process.env.ELANOUS_HARNESS_SEAT;
       const outcome = (o.prManager ?? makePrManager()).upsertPr({
         branch: head,
         worktreePath: cwd,
@@ -2501,6 +2502,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         commitMessage: title,
         ...(resolvedBase ? { base: resolvedBase } : {}),
         ...(draft !== undefined ? { draft } : {}),
+        ...(harnessSeat === 'OP' || harnessSeat === 'TC' || harnessSeat === 'MK' || harnessSeat === 'UX' ? { seat: harnessSeat } : {}),
         // BENCH-ISOLATED-ARMS ② — base 가 `bench/<id>/base` 면 라벨 `elanous:bench` 를 더한다.
         ...(() => {
           const all = benchIdFromBase(resolvedBase) && !labels?.includes(BENCH_LABEL) ? [...(labels ?? []), BENCH_LABEL] : labels;

package/src/self-implement/shadow-stage.ts

@@ -10,6 +10,7 @@
 // 배선은 P4(현재 비-git 은 front door 에서 refuse 유지 → 이 적용 경로는 프로덕션 미도달).
 
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { cpSync, existsSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
@@ -49,7 +50,7 @@ export function stageNonGitDir(opts: { target: string; branch: string }): StageN
   const slug = basename(target).replace(/[^a-zA-Z0-9._-]/g, '-');
   const shadowPath = join(tmpdir(), `elanous-shadow-${slug}-${process.pid}`);
   // 이전 세대 잔여 정리(고아 방지·createWorktree resetExisting 정합).
-  try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS }); } catch { /* fail-soft */ }
+  try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER }); } catch { /* fail-soft */ }
 
   // ② 대상 → 그림자 복사(내용 전체·심볼릭 보존 X: cpSync 기본).
   cpSync(target, shadowPath, { recursive: true });
@@ -69,7 +70,7 @@ export function stageNonGitDir(opts: { target: string; branch: string }): StageN
     path: shadowPath,
     branch,
     base,
-    cleanup: () => { try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS }); } catch { /* fail-soft */ } },
+    cleanup: () => { try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER }); } catch { /* fail-soft */ } },
   };
 }
 
@@ -94,9 +95,9 @@ export function stageFile(opts: { target: string; branch: string }): StageFileRe
   const fileName = basename(target);
   const slug = fileName.replace(/[^a-zA-Z0-9._-]/g, '-');
   const shadowPath = join(tmpdir(), `elanous-shadow-file-${slug}-${process.pid}`);
-  try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS }); } catch { /* fail-soft */ }
+  try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER }); } catch { /* fail-soft */ }
 
-  spawnSync('mkdir', ['-p', shadowPath], { timeout: GIT_TIMEOUT_MS });
+  spawnSync('mkdir', ['-p', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   cpSync(target, join(shadowPath, fileName));
 
   git(shadowPath, ['init', '-b', 'shadow-base']);
@@ -113,7 +114,7 @@ export function stageFile(opts: { target: string; branch: string }): StageFileRe
     fileName,
     branch,
     base,
-    cleanup: () => { try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS }); } catch { /* fail-soft */ } },
+    cleanup: () => { try { spawnSync('rm', ['-rf', shadowPath], { timeout: GIT_TIMEOUT_MS, maxBuffer: SPAWN_SYNC_MAX_BUFFER }); } catch { /* fail-soft */ } },
   };
 }
 
@@ -166,7 +167,7 @@ export function applyShadowToTarget(opts: { shadowPath: string; target: string;
   debug.log('harness.target', 'apply.backup', { target: target.slice(-48), backup: backup.slice(-48) });
 
   // ② rsync 미러링(--delete·그림자 git 메타 제외). rsync 부재 = fail-closed(백업만 남기고 미적용).
-  const probe = spawnSync('rsync', ['--version'], { encoding: 'utf8', timeout: 5_000 });
+  const probe = spawnSync('rsync', ['--version'], { encoding: 'utf8', timeout: 5_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
   if (probe.status !== 0) {
     debug.log('harness.target', 'apply.no-rsync', { target: target.slice(-48) });
     return { backup, applied: false, log: 'rsync 미설치 → 적용 안 함(백업만 생성·fail-closed). 수동 적용 필요.' };

package/src/self-implement/stop-autoheal.ts

@@ -13,7 +13,7 @@
  *   main-sync          → rebase-regate            리베이스(MERGE-INTENT-RESOLVE 의도 해석) 뒤 재게이트
  *   pod-died           → resume-from-salvage      `salvage/run-<6hex>/<leaf>` 가지에서 resume(DRAFT-NOT-ARCHIVE)
  *   evidence-uncovered → derive-evidence-rejudge  런 출력·시험·배선에서 증거를 끌어내 1회 재판정
- *   review-repeat · review-out-of-scope · fabric · launch-failed · unclassified → needs-owner(새 라운드 없음)
+ *   review-repeat · review-out-of-scope · fabric · launch-failed · gate-failed · unclassified → needs-owner(새 라운드 없음)
  *
  * 사다리의 «출처»: `graphs/overlays/stop-heal-ladder.yaml` 이 갈래마다 처방 노드(id = 처방 이름)를 선언한다.
  *    그 갈래에 얹힌 오버레이가 더한 노드 id 가 처방이다(source='graph'). 선언이 없거나 못 읽으면
@@ -52,6 +52,7 @@ export const AUTOHEAL_ACTION_BY_CLASS: Readonly<Record<RunStopClass, AutohealAct
   'review-out-of-scope': 'needs-owner',
   fabric: 'needs-owner',
   'launch-failed': 'needs-owner',
+  'gate-failed': 'needs-owner',
   unclassified: 'needs-owner',
 };
 

package/src/self-implement/train-gate-remote.ts

@@ -3,9 +3,10 @@
  *  Unlike `dispatchHeavyCheck` it never falls back to a local run: a busy host or an infra failure is «unmeasured».
  *  The only local commands are git (cat-file · rev-parse · push · diff). */
 import { debug } from '../debug/log.js';
+import { parseGateScenario, readGateScenarioFile } from './gate-scenario.js';
 import { getDefaultLogStore } from '../mss/logging/log-store.js';
 import {
-  realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote,
+  gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote,
   type GateRemoteRunner, type GateRemoteSettings, type RemoteRunOutcome,
 } from './gate-remote.js';
 
@@ -21,6 +22,9 @@ export interface TrainGateInput {
   changedFiles: readonly string[];
   /** Paths deleted by the integration commit — kept in `changedFiles` for tsc/PWA reach, never run as tests. */
   deletedFiles?: readonly string[];
+  /** Optional v0 JSON scenario. Selected tests are additive; invalid input is unmeasured. */
+  scenario?: unknown;
+  scenarioFile?: string;
   settings?: GateRemoteSettings;
 }
 
@@ -42,9 +46,10 @@ const quote = (value: string) => `'${value.replaceAll("'", `'\\''`)}'`;
 const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
 
 /** The host-side shell body: each step runs only if the one before it passed. Exported for tests. */
-export function trainGateScript(baseSha: string, changedFiles: readonly string[], deleted: ReadonlySet<string> = new Set()): string {
+export function trainGateScript(baseSha: string, changedFiles: readonly string[], deleted: ReadonlySet<string> = new Set(), scenarioTests: readonly string[] = []): string {
   // A deleted test file is a changed path (tsc/PWA reach) but not something to run.
-  const tests = changedFiles.filter((file) => TEST_FILE.test(file) && !deleted.has(file));
+  const changedTests = changedFiles.filter((file) => TEST_FILE.test(file) && !deleted.has(file));
+  const tests = scenarioTests.length ? [...new Set([...changedTests, ...scenarioTests])] : changedTests;
   const steps = [
     `TSC_BASE_REF=${quote(baseSha)} bun scripts/ci-typecheck-changed.ts --local`,
     ...(tests.length ? [`bun run test:deterministic ${tests.map(quote).join(' ')}`] : []),
@@ -72,6 +77,30 @@ export const TRAIN_GATE_HOST = 'node-b';
 export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemoteRunner = realGateRemoteRunner, deps: TrainGateDeps = {}): Promise<TrainGateResult> {
   const settings = input.settings ?? await loadSettings();
   const host = settings.host;
+  const hostCap = gateRemoteHostCap(settings, host);
+  let scenarioTests: string[] = [];
+  if (input.scenario !== undefined || input.scenarioFile !== undefined) {
+    try {
+      if (input.scenario !== undefined && input.scenarioFile !== undefined) throw new Error('choose scenario or scenarioFile');
+      const scenario = parseGateScenario(input.scenarioFile === undefined ? input.scenario : readGateScenarioFile(input.scenarioFile), { baseSha: input.baseSha, headSha: input.commit, changedFiles: input.changedFiles });
+      if (scenario.selectedTests.some(({ path }) => input.deletedFiles?.includes(path))) throw new Error('selected test deleted');
+      scenarioTests = scenario.selectedTests.map(({ path }) => path);
+      // The remote checks out this exact commit. Verify every path against its tree locally before spending a host slot.
+      for (const path of scenarioTests) {
+        const file = runner.local('git', ['cat-file', '-e', `${input.commit}:${path}`], input.repo);
+        if (file.rc !== 0 || file.error) throw new Error(`selected test missing at head: ${path}`);
+        const tree = runner.local('git', ['ls-tree', '-z', input.commit, '--', path], input.repo);
+        if (tree.rc !== 0 || tree.error || !/^100(?:644|755) blob [0-9a-f]{40}\t/.test(tree.stdout)
+          || !tree.stdout.endsWith(`\t${path}\0`)) throw new Error(`selected test is not a regular file at head: ${path}`);
+      }
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      const entry: TrainGateObservation = { host, commit: input.commit, baseSha: input.baseSha, outcome: 'unmeasured', reason, changedFiles: input.changedFiles.length };
+      debug.log('merge-queue', 'train-gate', entry);
+      try { (deps.observe ?? defaultObserve)(entry); } catch { /* observation only */ }
+      return { outcome: 'unmeasured', host, reason };
+    }
+  }
   if (host !== TRAIN_GATE_HOST) {
     const entry: TrainGateObservation = { host, commit: input.commit, baseSha: input.baseSha, outcome: 'unmeasured', reason: `host-not-gate-host (${host} ≠ ${TRAIN_GATE_HOST})`, changedFiles: input.changedFiles.length };
     debug.log('merge-queue', 'train-gate', entry);
@@ -81,13 +110,13 @@ export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemo
   const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
   const now = deps.now ?? Date.now;
   const deadline = now() + settings.slotWaitSeconds * 1000;
-  const script = trainGateScript(input.baseSha, input.changedFiles, new Set(input.deletedFiles ?? []));
+  const script = trainGateScript(input.baseSha, input.changedFiles, new Set(input.deletedFiles ?? []), scenarioTests);
   let outcome: RemoteRunOutcome;
   for (;;) {
     try {
       outcome = runOnRemote({
         repo: input.repo, host, mirror: settings.mirror, commit: input.commit, refs: [input.baseSha],
-        argv: ['sh', '-c', script], installPwa: true, hostCap: settings.hostCap,
+        argv: ['sh', '-c', script], installPwa: true, hostCap,
       }, runner);
     } catch (error) {
       outcome = { kind: 'infra', reason: `exception: ${error instanceof Error ? error.message : String(error)}` };
@@ -100,7 +129,7 @@ export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemo
   }
   const result: TrainGateResult = outcome.kind === 'ran'
     ? { outcome: outcome.rc === 0 ? 'pass' : 'fail', host, ms: outcome.ms, rc: outcome.rc }
-    : { outcome: 'unmeasured', host, reason: outcome.kind === 'busy' ? `host-busy (cap ${settings.hostCap} held for ${settings.slotWaitSeconds}s)` : outcome.reason };
+    : { outcome: 'unmeasured', host, reason: outcome.kind === 'busy' ? `host-busy (occupied ${outcome.occupied ?? 'unknown'}/${hostCap}, held for ${settings.slotWaitSeconds}s)` : outcome.reason };
   const entry: TrainGateObservation = {
     host, commit: input.commit, baseSha: input.baseSha, outcome: result.outcome,
     rc: result.rc, ms: result.ms, reason: result.reason, changedFiles: input.changedFiles.length,
@@ -116,7 +145,7 @@ export async function runTrainGateOnHost(input: TrainGateInput, runner: GateRemo
  *  integration commit's diff against `baseSha` (local git only); a diff failure is «unmeasured», never a local run. */
 export type TrainGate = (commitSha: string, prNumbers: readonly number[]) => Promise<TrainGateOutcome>;
 
-export function trainGateOnHost(opts: { repo: string; baseSha: string; settings?: GateRemoteSettings }, runner: GateRemoteRunner = realGateRemoteRunner, deps: TrainGateDeps = {}): TrainGate {
+export function trainGateOnHost(opts: { repo: string; baseSha: string; settings?: GateRemoteSettings; scenario?: unknown; scenarioFile?: string }, runner: GateRemoteRunner = realGateRemoteRunner, deps: TrainGateDeps = {}): TrainGate {
   const unmeasured = (commitSha: string, reason: string): 'unmeasured' => {
     const entry: TrainGateObservation = { host: opts.settings?.host ?? TRAIN_GATE_HOST, commit: commitSha, baseSha: opts.baseSha, outcome: 'unmeasured', reason, changedFiles: 0 };
     debug.log('merge-queue', 'train-gate', entry);
@@ -128,7 +157,7 @@ export function trainGateOnHost(opts: { repo: string; baseSha: string; settings?
       const diff = runner.local('git', ['diff', '--name-status', '-z', opts.baseSha, commitSha], opts.repo);
       if (diff.rc !== 0 || diff.error) return unmeasured(commitSha, 'changed-files-unavailable');
       const { changedFiles, deletedFiles } = parseNameStatus(diff.stdout);
-      return (await runTrainGateOnHost({ repo: opts.repo, commit: commitSha, baseSha: opts.baseSha, changedFiles, deletedFiles, settings: opts.settings }, runner, deps)).outcome;
+      return (await runTrainGateOnHost({ repo: opts.repo, commit: commitSha, baseSha: opts.baseSha, changedFiles, deletedFiles, settings: opts.settings, scenario: opts.scenario, scenarioFile: opts.scenarioFile }, runner, deps)).outcome;
     } catch (error) {
       // Any preparation failure (local git spawn, parse, settings) is «unmeasured» — never a rejected promise, never a local run.
       return unmeasured(commitSha, `prepare-failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 200));

package/src/self-implement/train-reach-grouping.ts

@@ -0,0 +1,157 @@
+import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
+import { isAbsolute } from 'node:path';
+import { selectGateTestFiles } from './gate-cli.js';
+
+export interface TrainReachCandidate {
+  pr: string;
+  headSha: string;
+  tree: string;
+  changedFiles: string[];
+}
+
+export interface TrainReachInput {
+  version: 1;
+  baseSha: string;
+  queueSig: string;
+  prs: TrainReachCandidate[];
+}
+
+export interface TrainReachObservation {
+  changedFiles: readonly string[];
+  testFiles: readonly string[];
+  unverified: readonly string[];
+  unrunImporterTotal: number | null;
+  lookupFailed?: string;
+  routeLookupFailures: readonly { source: string; reason: string }[];
+  callerTestsOverflow: readonly { file: string }[];
+  alwaysIncludeMissing: readonly string[];
+}
+
+export interface TrainReachGroup {
+  prs: string[];
+  reachTests: string[];
+  interactionTests: string[];
+  overlapEdges: Array<{ a: string; b: string; tests: string[]; paths: string[] }>;
+  status: 'measured' | 'unmeasured';
+  capacityBlocked: boolean;
+  reasons: string[];
+}
+
+export interface TrainReachDecision {
+  version: 1;
+  baseSha: string;
+  queueSig: string;
+  parallelSafe: boolean;
+  groups: TrainReachGroup[];
+  deferred: Array<{ pr: string; reason: string }>;
+}
+
+type InspectCandidate = (candidate: TrainReachCandidate, baseSha: string) => TrainReachObservation;
+
+const SHA40 = /^[a-f0-9]{40}$/i;
+const SHA256 = /^[a-f0-9]{64}$/i;
+const safePath = (path: string) => path.length > 0 && !path.startsWith('/')
+  && !path.includes('\\') && !/[\x00-\x1f\x7f]/.test(path)
+  && !path.split('/').some((part) => part === '..' || part === '.');
+const sortedUnique = (values: readonly string[]) => [...new Set(values)].sort();
+
+function git(tree: string, ...args: string[]): string {
+  const result = spawnSync('git', args, { cwd: tree, encoding: 'utf8', timeout: 15_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+  if (result.status !== 0 || result.error) {
+    throw new Error(`git ${args[0]} unmeasured: ${result.error?.message ?? result.stderr?.trim() ?? `rc=${result.status}`}`);
+  }
+  return result.stdout.trim();
+}
+
+/** The selector's own base...HEAD comparison is independently checked against the queue snapshot. */
+function inspectTrainReachCandidate(candidate: TrainReachCandidate, baseSha: string): TrainReachObservation {
+  if (git(candidate.tree, 'rev-parse', 'HEAD').toLowerCase() !== candidate.headSha.toLowerCase()) {
+    throw new Error('tree HEAD differs from queued headSha');
+  }
+  if (git(candidate.tree, 'status', '--porcelain=v1')) throw new Error('tree is dirty');
+  git(candidate.tree, 'cat-file', '-e', `${baseSha}^{commit}`);
+  const observation = selectGateTestFiles(candidate.tree, { base: baseSha, includeImporterTests: true });
+  if (git(candidate.tree, 'rev-parse', 'HEAD').toLowerCase() !== candidate.headSha.toLowerCase()) {
+    throw new Error('tree HEAD changed during reach selection');
+  }
+  if (git(candidate.tree, 'status', '--porcelain=v1')) throw new Error('tree changed during reach selection');
+  return observation;
+}
+
+function validateInput(input: TrainReachInput): void {
+  if (input?.version !== 1 || !SHA40.test(input.baseSha) || !SHA256.test(input.queueSig) || !Array.isArray(input.prs)) {
+    throw new Error('train reach input identity unmeasured');
+  }
+  const seen = new Set<string>();
+  for (const candidate of input.prs) {
+    if (!/^[1-9]\d*$/.test(candidate?.pr) || seen.has(candidate.pr) || !SHA40.test(candidate.headSha)
+      || !isAbsolute(candidate.tree) || !Array.isArray(candidate.changedFiles) || candidate.changedFiles.length === 0
+      || !candidate.changedFiles.every((path) => typeof path === 'string' && safePath(path))) {
+      throw new Error(`train reach candidate invalid: ${candidate?.pr ?? 'unknown'}`);
+    }
+    seen.add(candidate.pr);
+  }
+}
+
+/** Pure grouping after one independently measured selector observation per queued PR. */
+export function buildTrainReachDecision(input: TrainReachInput, inspect: InspectCandidate = inspectTrainReachCandidate): TrainReachDecision {
+  validateInput(input);
+  const measured: Array<{ candidate: TrainReachCandidate; tests: string[]; files: string[] }> = [];
+  const deferred: TrainReachDecision['deferred'] = [];
+  for (const candidate of input.prs) {
+    try {
+      const observed = inspect(candidate, input.baseSha);
+      const actual = sortedUnique(observed.changedFiles);
+      const expected = sortedUnique(candidate.changedFiles);
+      if (actual.length !== expected.length || actual.some((path, index) => path !== expected[index])) {
+        throw new Error('changedFiles differ from selector observation');
+      }
+      if (observed.lookupFailed || observed.routeLookupFailures.length || observed.unrunImporterTotal !== 0
+        || observed.callerTestsOverflow.length || observed.alwaysIncludeMissing.length || observed.unverified.length) {
+        throw new Error('test selection has unmeasured reach');
+      }
+      if (!observed.testFiles.every(safePath)) throw new Error('selected test path invalid');
+      measured.push({ candidate, tests: sortedUnique(observed.testFiles), files: sortedUnique(observed.changedFiles) });
+    } catch (error) {
+      deferred.push({ pr: candidate.pr, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+
+  const parent = measured.map((_, index) => index);
+  const find = (index: number): number => {
+    while (parent[index] !== index) index = parent[index] = parent[parent[index]];
+    return index;
+  };
+  const edges: Array<{ left: number; right: number; tests: string[]; paths: string[] }> = [];
+  for (let left = 0; left < measured.length; left++) {
+    for (let right = left + 1; right < measured.length; right++) {
+      const tests = measured[left].tests.filter((path) => measured[right].tests.includes(path));
+      const paths = measured[left].files.filter((path) => measured[right].files.includes(path));
+      if (!tests.length && !paths.length) continue;
+      edges.push({ left, right, tests, paths });
+      parent[find(right)] = find(left);
+    }
+  }
+  const components = new Map<number, number[]>();
+  for (let index = 0; index < measured.length; index++) {
+    const root = find(index);
+    components.set(root, [...(components.get(root) ?? []), index]);
+  }
+  const groups = [...components.values()].map((indices): TrainReachGroup => {
+    const prs = indices.map((index) => measured[index].candidate.pr);
+    const counts = new Map<string, number>();
+    for (const index of indices) for (const test of measured[index].tests) counts.set(test, (counts.get(test) ?? 0) + 1);
+    const reachTests = sortedUnique([...counts.keys()]);
+    const interactionTests = reachTests.filter((test) => (counts.get(test) ?? 0) > 1);
+    const overlapEdges = edges.filter(({ left, right }) => indices.includes(left) && indices.includes(right))
+      .map(({ left, right, tests, paths }) => ({ a: measured[left].candidate.pr, b: measured[right].candidate.pr, tests, paths }));
+    const capacityBlocked = indices.length > 5;
+    const reasons = capacityBlocked ? ['connected reach group exceeds five PR train limit'] : [];
+    return { prs, reachTests, interactionTests, overlapEdges,
+      status: 'measured', capacityBlocked, reasons };
+  });
+  return { version: 1, baseSha: input.baseSha, queueSig: input.queueSig,
+    parallelSafe: deferred.length === 0 && groups.every(({ status, capacityBlocked }) => status === 'measured' && !capacityBlocked),
+    groups, deferred };
+}

package/src/self-implement/train-scenario-layers.ts

@@ -0,0 +1,133 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { isGateSpawnLaneFile } from '../self-dev/spawn-lane-files.js';
+import { isTestPath } from './importer-test-index.js';
+import type { TrainReachDecision, TrainReachInput } from './train-reach-grouping.js';
+
+export interface TrainRiskEvidence {
+  /** Only evidence-backed paths; an empty list asserts no known hot paths for this queue. */
+  verifiedHotFiles: Array<{ path: string; evidence: string }>;
+  /** Both endpoints are test paths; evidence must describe a reproduced interaction. */
+  verifiedInterferencePairs: Array<{ a: string; b: string; evidence: string }>;
+  /** Unreproduced pairs remain visible and prohibit parallel apply when either endpoint is reached. */
+  suspectedPairs: Array<{ a: string; b: string; reason: string }>;
+}
+
+export interface TrainScenarioGroup {
+  prs: string[];
+  reachTests: string[];
+  interactionTests: string[];
+  riskTests: string[];
+  riskReasons: Array<{ test: string; reason: string; evidence: string }>;
+  groupRiskReasons: Array<{ reason: string; evidence: string }>;
+  canaryTests: string[];
+  scenarioTests: string[];
+  populationSize: number;
+  eligiblePopulationSize: number;
+  canaryTarget: number;
+  /** Reproducible SHA-256 input prefix: baseSha, queueSig, and sorted PRs separated by NUL. */
+  canarySelectionKey: string;
+  canaryHashMethod: string;
+  unmeasured: string[];
+}
+
+export interface TrainScenarioDecision {
+  version: 1;
+  baseSha: string;
+  queueSig: string;
+  parallelSafe: boolean;
+  groups: TrainScenarioGroup[];
+  unmeasured: string[];
+}
+
+const sorted = (paths: readonly string[]) => [...new Set(paths)].sort();
+const validPath = (path: unknown): path is string => typeof path === 'string' && !!path && !path.startsWith('/') && !path.includes('\\')
+  && !/[\x00-\x1f\x7f]/.test(path) && !path.split('/').some((part) => part === '.' || part === '..');
+const hash = (value: string) => createHash('sha256').update(value).digest('hex');
+
+/** Read the tracked test population from the pinned base commit, including paths containing spaces. */
+export function readTrainTestPopulation(tree: string, baseSha: string): string[] {
+  if (!/^[a-f0-9]{40}$/i.test(baseSha)) throw new Error('invalid baseSha for test population');
+  const result = spawnSync('git', ['ls-tree', '-r', '-z', '--name-only', baseSha],
+    { cwd: tree, encoding: 'utf8', timeout: 30_000, maxBuffer: 256 * 1024 * 1024 });
+  if (result.error || result.status !== 0) throw new Error(`test population unmeasured: ${result.error?.message ?? result.stderr?.trim() ?? result.status}`);
+  return sorted(result.stdout.split('\0').filter(isTestPath));
+}
+
+/** Pure scenario composition. No unverified hot path or interference guess is promoted to a verified risk. */
+export function buildTrainScenarioDecision(
+  input: TrainReachInput, reach: TrainReachDecision, population: readonly string[], evidence: TrainRiskEvidence,
+): TrainScenarioDecision {
+  if (reach.version !== 1 || reach.baseSha !== input.baseSha || reach.queueSig !== input.queueSig
+    || !Array.isArray(population) || !population.every((path) => typeof path === 'string' && validPath(path) && isTestPath(path))
+    || !evidence || !Array.isArray(evidence.verifiedHotFiles) || !Array.isArray(evidence.verifiedInterferencePairs)
+    || !Array.isArray(evidence.suspectedPairs)) throw new Error('scenario identity or population unmeasured');
+  const tests = sorted(population);
+  const commonTests = new Set(tests);
+  const known = new Set([...tests, ...reach.groups.flatMap((group) => group.reachTests)]);
+  const validEvidence = (value: unknown): value is string => typeof value === 'string' && value.trim().length > 0;
+  for (const item of evidence.verifiedHotFiles) {
+    if (!validPath(item?.path) || !validEvidence(item?.evidence)) throw new Error('hot-file evidence unmeasured');
+  }
+  for (const item of [...evidence.verifiedInterferencePairs, ...evidence.suspectedPairs]) {
+    if (!validPath(item?.a) || !validPath(item?.b) || !known.has(item.a) || !known.has(item.b)
+      || item.a === item.b || !validEvidence(item && 'evidence' in item ? item.evidence : item?.reason)) {
+      throw new Error('interference-pair evidence unmeasured');
+    }
+  }
+  const changedByPr = new Map(input.prs.map(({ pr, changedFiles }) => [pr, changedFiles]));
+  const groups = reach.groups.map((group): TrainScenarioGroup => {
+    const reached = new Set(group.reachTests);
+    if ([...reached].some((path) => !validPath(path) || !isTestPath(path))) throw new Error('reached test path invalid');
+    const riskReasons: TrainScenarioGroup['riskReasons'] = [];
+    const groupRiskReasons: TrainScenarioGroup['groupRiskReasons'] = [];
+    const unavailable: string[] = [];
+    const risk = new Set<string>();
+    const addRisk = (test: string, reason: string, source: string): void => {
+      risk.add(test);
+      riskReasons.push({ test, reason, evidence: source });
+    };
+    for (const test of reached) if (isGateSpawnLaneFile(test)) addRisk(test, 'spawn-lane', 'src/self-dev/spawn-lane-files.ts');
+    const changed = new Set(group.prs.flatMap((pr) => changedByPr.get(pr) ?? []));
+    for (const hot of evidence.verifiedHotFiles) if (changed.has(hot.path)) {
+      groupRiskReasons.push({ reason: `hot-file:${hot.path}`, evidence: hot.evidence });
+    }
+    for (const pair of evidence.verifiedInterferencePairs) {
+      if (reached.has(pair.a) || reached.has(pair.b)) {
+        const endpoints: Array<[string, string]> = [[pair.a, pair.b], [pair.b, pair.a]];
+        for (const [test, other] of endpoints) {
+          if (reached.has(test) || commonTests.has(test)) addRisk(test, `interference-with:${other}`, pair.evidence);
+          else unavailable.push(`verified interference endpoint unavailable in every PR head: ${test}`);
+        }
+      }
+    }
+    const canaryPrefix = `${input.baseSha}\0${input.queueSig}\0${sorted(group.prs).join(',')}`;
+    const used = new Set([...reached, ...risk]);
+    const eligible = tests.filter((test) => !used.has(test));
+    const canaryTarget = eligible.length ? Math.max(1, Math.round(eligible.length * 0.02)) : 0;
+    const canaryTests = eligible
+      .sort((a, b) => hash(`${canaryPrefix}\0${a}`).localeCompare(hash(`${canaryPrefix}\0${b}`)) || a.localeCompare(b))
+      .slice(0, canaryTarget).sort();
+    const scenarioTests = sorted([...reached, ...risk, ...canaryTests]);
+    const scenarioSet = new Set(scenarioTests);
+    const unmeasured = [...unavailable, ...evidence.suspectedPairs
+      .filter((pair) => scenarioSet.has(pair.a) || scenarioSet.has(pair.b))
+      .map((pair) => `suspected interference ${pair.a} ↔ ${pair.b}: ${pair.reason}`)];
+    return { prs: group.prs, reachTests: group.reachTests, interactionTests: group.interactionTests,
+      riskTests: sorted([...risk]), riskReasons, groupRiskReasons, canaryTests,
+      scenarioTests, populationSize: tests.length, eligiblePopulationSize: eligible.length,
+      canaryTarget, canarySelectionKey: canaryPrefix,
+      canaryHashMethod: 'sha256(canarySelectionKey\\0path)', unmeasured };
+  });
+  const unmeasured = groups.flatMap((group) => group.unmeasured);
+  // A verified interference pair executed by multiple scenarios bars parallel trains, including canary selection.
+  for (const pair of evidence.verifiedInterferencePairs) {
+    const aOwners = groups.flatMap((group, index) => group.scenarioTests.includes(pair.a) ? [index] : []);
+    const bOwners = groups.flatMap((group, index) => group.scenarioTests.includes(pair.b) ? [index] : []);
+    if (aOwners.some((a) => bOwners.some((b) => a !== b))) {
+      unmeasured.push(`verified interference crosses groups ${pair.a} ↔ ${pair.b}: ${pair.evidence}`);
+    }
+  }
+  return { version: 1, baseSha: input.baseSha, queueSig: input.queueSig,
+    parallelSafe: reach.parallelSafe && unmeasured.length === 0, groups, unmeasured };
+}

package/src/self-implement/uncommitted-work.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { isElanousRuntimeArtifactPath } from './gate-scope.js';
 
 export type UncommittedWork =
@@ -19,6 +20,7 @@ export function detectUncommittedWork(worktree: string): UncommittedWork {
       env: gitEnv,
       encoding: 'utf8',
       timeout: 10_000,
+      maxBuffer: SPAWN_SYNC_MAX_BUFFER,
     });
   } catch (error) {
     return { status: 'unavailable', reason: error instanceof Error ? error.message : String(error) };

package/src/session/pending-input.ts

@@ -99,6 +99,25 @@ export function removePendingUserInput(
   return removedIds.length;
 }
 
+/**
+ * id 로 고른 항목을 버킷 «맨 앞»으로 옮긴다(주어진 순서대로) — «지금 밀어 넣기»가 끊을 수 없는 도구 때문에
+ * 다음 경계로 떨어질 때, 같은 버킷의 다른 항목(goal-loop 메모 등)보다 먼저 들어가게 한다. 옮긴 수를 낸다.
+ */
+export function prioritizePendingUserInput(ids: readonly string[]): number {
+  if (ids.length === 0) return 0;
+  const order = new Map(ids.map((id, index) => [id, index]));
+  let moved = 0;
+  for (const bucket of buckets.values()) {
+    const front = bucket.items.filter(item => order.has(item.id))
+      .sort((a, b) => (order.get(a.id) ?? 0) - (order.get(b.id) ?? 0));
+    if (front.length === 0) continue;
+    bucket.items = [...front, ...bucket.items.filter(item => !order.has(item.id))];
+    moved += front.length;
+  }
+  if (moved > 0) debug.log('llm.interjection', 'prioritized', { requested: ids.length, moved });
+  return moved;
+}
+
 /** 지금 이 세션에 대기 중인 수(관측·표시용). 비우지 «않는다». */
 export function pendingUserInputCount(sessionId: string): number {
   return buckets.get(sessionId)?.items.length ?? 0;