elanous 0.2.32 → 0.2.34

package/src/self-implement/run-stop.ts

@@ -11,11 +11,12 @@
  */
 import { debug } from '../debug/log.js';
 import { appendRunLedgerEntry, type RunLedgerEntry, type RunLedgerWriter, type RunShardIdentity } from './run-ledger.js';
+import type { PodChildEvidence } from '../task-orchestrator/surfaces/self-implement.js';
 
 /** 닫힌 목록 — 못 고르면 `unclassified`. */
 export const RUN_STOP_CLASSES = [
   'env-unrelated', 'main-sync', 'pod-died', 'review-repeat',
-  'review-out-of-scope', 'evidence-uncovered', 'fabric', 'launch-failed', 'gate-failed', 'unclassified',
+  'review-out-of-scope', 'scope-escape', 'evidence-uncovered', 'fabric', 'launch-failed', 'gate-failed', 'unclassified',
 ] as const;
 export type RunStopClass = typeof RUN_STOP_CLASSES[number];
 
@@ -28,6 +29,8 @@ export interface RunStopRecord {
   evidenceRef: string;
   /** 다음 한 수(사람·힐러가 읽는다). */
   nextMove: string;
+  /** Facts from the complete child JSON, lifted before the Pod stdout tail is shortened. */
+  childEvidence?: PodChildEvidence;
 }
 
 export const RUN_STOP_EVENT = 'stop';
@@ -44,6 +47,7 @@ export interface RunStopInput {
   nextMove: string;
   /** 관측용 — 어느 자리가 불렀나(merge-hold · implement-aborted · draft-pr-open-failed · pod-exit · launch-failed). */
   site?: string;
+  childEvidence?: PodChildEvidence;
 }
 
 export function isRunStopClass(value: unknown): value is RunStopClass {
@@ -99,6 +103,7 @@ export function recordRunStop(input: RunStopInput, write: RunLedgerWriter = appe
     cause: boundRunStopCause(input.cause),
     evidenceRef: input.evidenceRef,
     nextMove: input.nextMove,
+    ...(input.childEvidence ? { childEvidence: input.childEvidence } : {}),
   };
   const entry: RunLedgerEntry = {
     timestamp: new Date().toISOString(), runId: input.runId, event: RUN_STOP_EVENT,
@@ -120,5 +125,6 @@ export function readRunStopRecord(entry: RunLedgerEntry): RunStopRecord | undefi
   if (entry.event !== RUN_STOP_EVENT) return undefined;
   const data = entry.data as Partial<RunStopRecord>;
   if (typeof data.cause !== 'string' || typeof data.evidenceRef !== 'string' || typeof data.nextMove !== 'string') return undefined;
-  return { class: isRunStopClass(data.class) ? data.class : 'unclassified', cause: data.cause, evidenceRef: data.evidenceRef, nextMove: data.nextMove };
+  return { class: isRunStopClass(data.class) ? data.class : 'unclassified', cause: data.cause, evidenceRef: data.evidenceRef, nextMove: data.nextMove,
+    ...(data.childEvidence ? { childEvidence: data.childEvidence } : {}) };
 }

package/src/self-implement/seams.ts

@@ -69,6 +69,7 @@ import { stageNonGitDir, stageFile, applyShadowToTarget, applyFileToTarget } fro
 import type { TargetKind } from './target-kind.js';
 import { basename } from 'node:path';
 import { ghAutomationEnv, makePrManager, type PrManager } from '../autopilot/pr-manager.js';
+import { cardPrNumber, taskAgentStatePath, updateTaskCard } from '../task-agent/task-hand.js';
 import { defaultSpawnGh, lookupOpenDraftPrs } from '../cli/logs-abandoned-draft-prs.js';
 import { loadRunLedger, runLedgerDir } from './run-ledger.js';
 import { readdirSync } from 'node:fs';
@@ -2494,11 +2495,14 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
     openPr: async ({ title, body, head, base, draft, labels, cwd }) => {
       const resolvedBase = assertBaseBranchOnOrigin(cwd, base);
       const harnessSeat = process.env.ELANOUS_HARNESS_SEAT;
+      const taskCardId = process.env.ELANOUS_TASK_CARD_ID;
+      const bodyWithCard = taskCardId && /^[A-Za-z0-9][A-Za-z0-9._:-]{2,}$/.test(taskCardId)
+        ? `${body}\n\n카드: ${taskCardId}` : body;
       const outcome = (o.prManager ?? makePrManager()).upsertPr({
         branch: head,
         worktreePath: cwd,
         title,
-        body: buildPrBody(cwd, body),
+        body: buildPrBody(cwd, bodyWithCard),
         commitMessage: title,
         ...(resolvedBase ? { base: resolvedBase } : {}),
         ...(draft !== undefined ? { draft } : {}),
@@ -2511,6 +2515,33 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       });
       if (!outcome.ok) throw new Error(`self-implement PR ${outcome.reason} 실패: ${outcome.detail}`);
       const number = Number.parseInt(outcome.url.match(/\/pull\/(\d+)/)?.[1] ?? '', 10);
+      if (outcome.supersededPr && Number.isSafeInteger(number) && number > 0) {
+        const rebindFailed = (reason: string): never => {
+          debug.log('self-implement.pr', 'same-cell-card-rebind-failed', {
+            cardId: taskCardId ?? null, oldPr: outcome.supersededPr, newPr: number,
+            url: outcome.url, reason,
+          }, { level: 'warn' });
+          throw new Error(`same-cell 새 draft ${outcome.url} 개설됨; 카드 재결속 실패(${reason}) — 새 PR 수확 필요`);
+        };
+        debug.log('self-implement.pr', 'same-cell-rebound', {
+          cardId: taskCardId ?? null, oldPr: outcome.supersededPr, newPr: number, url: outcome.url,
+          oldDraftCleanup: 'deferred',
+        });
+        const cardId = taskCardId ?? rebindFailed('카드 ID 없음');
+        let rebound: ReturnType<typeof updateTaskCard>;
+        try {
+          rebound = updateTaskCard(taskAgentStatePath(), cardId, (card) => {
+            if (!card || card.refSource === 'manual' || (cardPrNumber(card) !== undefined
+              && cardPrNumber(card) !== outcome.supersededPr && cardPrNumber(card) !== number)) return undefined;
+            if (cardPrNumber(card) === number && card.history.some((event) => event.event === 'same-cell-pr-rebound' && event.pr === number)) return undefined;
+            return { ...card, pr: { number, url: outcome.url }, history: [...card.history, {
+              at: new Date().toISOString(), event: 'same-cell-pr-rebound', pr: number,
+              detail: `이전 draft #${outcome.supersededPr} 정리 후속 · 새 PR #${number} 결속`,
+            }] };
+          });
+        } catch (error) { rebindFailed(error instanceof Error ? error.message : String(error)); }
+        if (!rebound || cardPrNumber(rebound) !== number) rebindFailed('카드 없음 또는 기존 PR 결속 충돌');
+      }
       return { url: outcome.url, number: Number.isFinite(number) ? number : 0 };
     },
 

package/src/self-implement/stop-autoheal.ts

@@ -13,7 +13,7 @@
  *   main-sync          → rebase-regate            리베이스(MERGE-INTENT-RESOLVE 의도 해석) 뒤 재게이트
  *   pod-died           → resume-from-salvage      `salvage/run-<6hex>/<leaf>` 가지에서 resume(DRAFT-NOT-ARCHIVE)
  *   evidence-uncovered → derive-evidence-rejudge  런 출력·시험·배선에서 증거를 끌어내 1회 재판정
- *   review-repeat · review-out-of-scope · fabric · launch-failed · gate-failed · unclassified → needs-owner(새 라운드 없음)
+ *   review-repeat · review-out-of-scope · scope-escape · fabric · launch-failed · gate-failed · unclassified → needs-owner(새 라운드 없음)
  *
  * 사다리의 «출처»: `graphs/overlays/stop-heal-ladder.yaml` 이 갈래마다 처방 노드(id = 처방 이름)를 선언한다.
  *    그 갈래에 얹힌 오버레이가 더한 노드 id 가 처방이다(source='graph'). 선언이 없거나 못 읽으면
@@ -50,6 +50,7 @@ export const AUTOHEAL_ACTION_BY_CLASS: Readonly<Record<RunStopClass, AutohealAct
   'evidence-uncovered': 'derive-evidence-rejudge',
   'review-repeat': 'needs-owner',
   'review-out-of-scope': 'needs-owner',
+  'scope-escape': 'needs-owner',
   fabric: 'needs-owner',
   'launch-failed': 'needs-owner',
   'gate-failed': 'needs-owner',
@@ -164,6 +165,12 @@ export interface AutohealDeps {
   writeLedger?: RunLedgerWriter;
   /** 사다리 선언 읽기 — 기본은 활성 템플릿 ⊕ `graphs/overlays`. 던지면 코드 표로 간다. */
   loadLadder?: () => AutohealLadder;
+  /**
+   * 같은 골·칸의 «앞 런» stop 레코드(원장 줄은 `readRunStopRecord` 로 읽는다).
+   * 같은 갈래(class)의 멈춤이 반복되면 자동 재시도를 하지 않고 사유를 골 되먹임 대상으로 넘긴다.
+   * 안 주면 지금과 똑같이 동작한다.
+   */
+  priorStops?: readonly RunStopRecord[];
 }
 
 /**
@@ -184,6 +191,15 @@ export function autohealAlreadyAttempted(ledger: readonly RunLedgerEntry[] | nul
   return ledger.some((e) => e.event === AUTOHEAL_EVENT && e.data?.class === cls && e.data?.mode === mode);
 }
 
+/**
+ * 반복 멈춤 가드 — 앞 런의 stop 레코드 중 같은 갈래(class)가 `threshold` 이상이면 참.
+ * 같은 골에서 같은 갈래가 반복되면 자동 재시도를 끊고 사유를 골 되먹임 대상으로 넘긴다.
+ */
+export function repeatedStop(prior: readonly RunStopRecord[] | undefined, record: RunStopRecord, threshold = 2): boolean {
+  if (!prior) return false;
+  return prior.filter((p) => p.class === record.class).length >= threshold;
+}
+
 function observe(event: string, data: Record<string, unknown>): void {
   try { debug.log('self-implement.autoheal', event, data); } catch { /* observation is fail-soft */ }
 }
@@ -197,6 +213,14 @@ export async function autohealFromStop(ctx: AutohealContext, deps: AutohealDeps
   const { action, source, overlayId } = pickAutohealAction(cls, deps.loadLadder);
   const base = { runId: ctx.runId, class: cls, action, source, ...(overlayId ? { overlayId } : {}), mode };
 
+  if (repeatedStop(deps.priorStops, ctx.record)) {
+    // ⛔ 같은 골에서 같은 갈래의 멈춤이 반복되면 자동 재시도를 하지 않는다 — 사유를 골 되먹임 대상으로 넘긴다.
+    const n = deps.priorStops!.filter((p) => p.class === cls).length;
+    const reason = `repeat-stop: ${cls} ×${n} — feed back to goal: ${ctx.record.cause}`;
+    observe('repeat-stop', { ...base, reason });
+    return { ...base, outcome: 'needs-owner', reason };
+  }
+
   let ledger: readonly RunLedgerEntry[] | null = null;
   try {
     ledger = (deps.loadLedger ?? ((id) => loadRunLedger(id)))(ctx.runId);

package/src/session/chat.ts

@@ -42,6 +42,8 @@ import {
 // chat 툴루프를 canonical 엔진(runGoalLoop→runCoreTurn→streamLLMWithTools)으로 라우팅.
 // ACP bridge(core-turn-bridge.ts)·dashboard(runGoalLoopHook)와 동일 엔진 재사용(재발명 제거).
 import { runGoalLoop, type CoreTurnContext, type CoreTurnDispatchTool } from '../core-turn/index.js';
+import { composeChildContext, type ChildContextProfile } from '../self-implement/child-context-composition.js';
+import { getHarnessSpace } from '../harness/harness-space.js';
 
 export interface RunTurnOpts {
   userConfig: UserConfig;
@@ -272,6 +274,10 @@ export function buildRecentToolObservations(
   return `[직전 턴에 네가 실행한 도구와 결과 (참고용 컨텍스트) — 이어서 교정·판단할 때 근거로 삼되, 사용자가 이 원문을 봤다고 가정하지 말 것]\n${body}`;
 }
 
+/** CHILD-CONTEXT-BUDGET — 세션별 첫 goal-loop 턴 계측 1회 플래그(모듈 인메모리 —
+ * 원장·세션 저장소 형식은 무변경). 키: runTurn sessionId. */
+const childContextComposedSessions = new Set<string>();
+
 /** Run one conversational turn, persisting both sides to the session
  *  JSONL. Never throws on LLM failure — reraises with context. */
 export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
@@ -435,6 +441,27 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
     const goalLoopCfg = opts.userConfig.llm.goalLoop;
     const armGoalLoop = opts.goalLoop === true || goalLoopCfg?.enabled === true;
     if (armGoalLoop) {
+      // ⭐ CHILD-CONTEXT-BUDGET(0.2.35 칸) — 구현 자식(self-implement 공간)의 첫 goal-loop
+      //    턴에서 실제 effectiveSystemPrompt·turnTools 스키마·userText(골)의 구성 바이트를
+      //    composeChildContext 로 계측해 child.context-composition 사건 1회로 남긴다.
+      //    관측 전용 — 프롬프트·메시지는 무변경, 계측이 턴을 깨지 않는다(fail-open).
+      //    게이트: harness-space SSOT 로 구현 자식만 판별(getHarnessSpace().kind === 'self-implement')·
+      //    세션 첫 goal-loop 무장 턴 1회(모듈 인메모리 플래그 — 원장·세션 저장소는 무변경).
+      //    profile 은 자식 프롬프트 예산 신호(ELANOUS_PROMPT_BUDGET=lean — local 자식 스폰 시 주입)에서
+      //    실측 파생한다: lean → small(32k 바이트 상한), 아니면 default(무상한).
+      const isSelfImplementChild = getHarnessSpace()?.kind === 'self-implement';
+      if (isSelfImplementChild && !childContextComposedSessions.has(opts.sessionId)) {
+        childContextComposedSessions.add(opts.sessionId);
+        const childContextProfile: ChildContextProfile
+          = process.env.ELANOUS_PROMPT_BUDGET?.trim() === 'lean' ? 'small' : 'default';
+        try {
+          composeChildContext({
+            systemPrompt: effectiveSystemPrompt,
+            toolSchemas: JSON.stringify(turnTools),
+            goal: opts.userText,
+          }, { profile: childContextProfile });
+        } catch { /* 계측은 턴을 깨지 않는다 */ }
+      }
       const coreCtx: CoreTurnContext = {
         sessionId: opts.sessionId,
         // ⭐ 이 턴의 «사람 문장» 운반자. 없으면 표면 판정이 늘 기본값으로 떨어진다

package/src/session-runtime/retry-policy.ts

@@ -226,7 +226,8 @@ export function providerNamesFromFallbackChain(chain: readonly string[]): string
   const seen = new Set<string>();
   for (const step of chain) {
     // `codex-credits`(체인 마지막 칸 · 크레딧)도 provider 는 openai-codex 다 — 이미 앞에 있으면 중복이라 빠진다.
-    const name = step === 'grok' ? 'grok' : step === 'codex-rotate' || step === 'codex-credits' ? 'openai-codex' : undefined;
+    const name = step === 'grok' ? 'grok' : step === 'zai' ? 'glm'
+      : step === 'codex-rotate' || step === 'codex-credits' ? 'openai-codex' : undefined;
     if (!name || seen.has(name)) continue;
     seen.add(name);
     out.push(name);

package/src/skills/tools/schedule-wakeup.ts

@@ -41,6 +41,17 @@ export const WAKEUP_MAX_CALLS_PER_TURN = 6;
 export const WAKEUP_REPEAT_INVALID_ERROR =
   'repeatMinutes 는 반복 간격(분 · 1 이상)이다 — 한 번만 깨우려면 repeatMinutes 를 빼거나 0 으로 두고 delaySeconds 또는 at 만 줘라';
 
+function formatWakeupTimeConflictError(req: ScheduleWakeupRequest): string {
+  const corrected = { ...req };
+  delete corrected.at;
+  delete corrected.atProvided;
+  return `at 과 delaySeconds 는 둘 중 하나만 줄 수 있다 — 교정 인자 예시(at 을 빼고 delaySeconds 사용): ${JSON.stringify(corrected)}. 같은 인자를 다시 보내지 말고 이 교정 인자로 한 번만 재시도하라`;
+}
+
+function canonicalToolArgs(args: Record<string, unknown>): string {
+  return JSON.stringify(Object.fromEntries(Object.entries(args).sort(([a], [b]) => a.localeCompare(b))));
+}
+
 export type WakeupTimerHandle = unknown;
 
 export interface WakeupEntry {
@@ -79,7 +90,9 @@ export interface WakeupSchedulerDeps {
 
 export type ScheduleWakeupRequest = {
   /** «HH:MM»(로컬 시각 · 지났으면 내일). delaySeconds 와 둘 중 하나. */
-  at?: string;
+  at?: unknown;
+  /** Host tool must preserve property presence even when the provider sent a non-string value. */
+  atProvided?: boolean;
   delaySeconds?: number;
   reason: string;
   /** 반복 간격(분). 첫 발화는 at/delaySeconds — 둘 다 없으면 지금부터 repeatMinutes 뒤. 0 = 일회성(생략과 같다). */
@@ -93,7 +106,7 @@ export type ScheduleWakeupResult =
 export type CancelWakeupResult = { ok: true } | { ok: false; error: string; capped?: boolean };
 
 export interface WakeupScheduler {
-  schedule(req: ScheduleWakeupRequest): ScheduleWakeupResult;
+  schedule(req: ScheduleWakeupRequest, requestKey?: string): ScheduleWakeupResult;
   list(): WakeupEntry[];
   cancel(id: string): boolean;
   /** cancel 과 같되 거부 사유(없는 id · 턴 상한)를 값으로 낸다 — LLM 도구가 쓴다. */
@@ -151,12 +164,24 @@ export function createWakeupScheduler(deps: WakeupSchedulerDeps): WakeupSchedule
   const maxCallsPerTurn = deps.maxCallsPerTurn ?? WAKEUP_MAX_CALLS_PER_TURN;
   let callTurnKey: string | null = null;
   let callCount = 0;
+  const conflictErrors = new Map<string, string>();
+
+  const readTurnId = (): string | null => deps.currentTurnId?.() ?? null;
 
-  /** 한 턴 호출 상한 — 넘었으면 거부 문구, 아니면 null. 턴 경계를 모르면(currentTurnId 없음) 걸지 않는다. */
-  const loopCapError = (action: 'schedule' | 'cancel'): string | null => {
-    if (!deps.currentTurnId) return null;
-    const turnId = deps.currentTurnId() ?? 'none';
-    if (turnId !== callTurnKey) { callTurnKey = turnId; callCount = 0; }
+  /** 한 턴 호출 상한 — 넘었으면 거부 문구, 아니면 null. 턴 경계가 unknown 이면 cap·dedupe 상태를 버린다. */
+  const loopCapError = (action: 'schedule' | 'cancel', observedTurnId = readTurnId()): string | null => {
+    if (observedTurnId === null) {
+      callTurnKey = null;
+      callCount = 0;
+      conflictErrors.clear();
+      return null;
+    }
+    const turnId = observedTurnId;
+    if (turnId !== callTurnKey) {
+      callTurnKey = turnId;
+      callCount = 0;
+      conflictErrors.clear();
+    }
     callCount += 1;
     if (callCount <= maxCallsPerTurn) return null;
     log('tui.wakeup', 'loop-capped', { turnId, count: callCount, max: maxCallsPerTurn, action });
@@ -252,20 +277,35 @@ export function createWakeupScheduler(deps: WakeupSchedulerDeps): WakeupSchedule
   };
 
   return {
-    schedule(req) {
+    schedule(req, requestKey) {
       const t = now();
       const reason = (req.reason ?? '').replace(/\s+/g, ' ').trim();
       const reject = (error: string): ScheduleWakeupResult => {
         log('tui.wakeup', 'rejected', { id: null, reason: 'invalid', error });
         return { ok: false, error };
       };
-      const capped = loopCapError('schedule');
+      // Every schedule attempt consumes the per-turn budget before validation.
+      const turnId = readTurnId();
+      const capped = loopCapError('schedule', turnId);
       if (capped) return { ok: false, error: capped };
+      // Presence is the contract: invalidly typed `at` values from the host
+      // must still conflict with delaySeconds rather than silently disappear.
+      const hasAt = req.atProvided ?? req.at !== undefined;
+      const hasDelay = req.delaySeconds !== undefined;
+      if (hasAt && hasDelay) {
+        const key = requestKey ?? canonicalToolArgs(req as Record<string, unknown>);
+        if (turnId !== null) {
+          const previousError = conflictErrors.get(key);
+          if (previousError !== undefined) {
+            return { ok: false, error: `${previousError} — 같은 충돌 인자의 재시도는 억제했다` };
+          }
+          if (conflictErrors.size < maxCallsPerTurn) conflictErrors.set(key, formatWakeupTimeConflictError(req));
+        }
+        const error = formatWakeupTimeConflictError(req);
+        return reject(error);
+      }
       if (!reason) return reject('reason 이 비었다 — 깨어나서 무엇을 할지 한 줄로 적어라');
       if (entries.size >= maxEntries) return reject(`예약 상한 ${maxEntries}개 — list 로 보고 cancel 뒤 다시`);
-      const hasAt = typeof req.at === 'string' && req.at.trim() !== '';
-      const hasDelay = typeof req.delaySeconds === 'number';
-      if (hasAt && hasDelay) return reject('at 과 delaySeconds 는 둘 중 하나만');
       let repeatMs: number | undefined;
       // ⭐ 0 = 일회성(생략과 같다) — 모델이 «한 번만»을 0 으로 부른다(라이브 실측). 음수·NaN·1 미만 소수는 거부.
       if (req.repeatMinutes !== undefined && req.repeatMinutes !== 0) {
@@ -276,7 +316,8 @@ export function createWakeupScheduler(deps: WakeupSchedulerDeps): WakeupSchedule
       }
       let dueAt: number;
       if (hasAt) {
-        const resolved = resolveWakeupAt(req.at!, t);
+        if (typeof req.at !== 'string') return reject(`at 은 «HH:MM» 문자열이어야 한다 — 받은 값 ${JSON.stringify(req.at)}`);
+        const resolved = resolveWakeupAt(req.at, t);
         if (resolved === null) return reject(`at 은 «HH:MM»(24시간) 꼴 — 받은 값 ${JSON.stringify(req.at)}`);
         dueAt = resolved;
       } else if (hasDelay) {
@@ -342,7 +383,7 @@ export function buildScheduleWakeupHostTool(scheduler: WakeupScheduler): LLMTool
     name: SCHEDULE_WAKEUP_TOOL_NAME,
     description:
       'Wake THIS TUI later with an internal turn: when you would write «다음 점검 HH:MM» and end the turn, call this instead so the check actually happens. '
-      + 'action=schedule (default) needs reason plus one of at ("HH:MM" local, past → tomorrow) / delaySeconds (≥60) / repeatMinutes (≥1; repeats expire after 7 days). '
+      + 'action=schedule (default) needs reason plus one of at ("HH:MM" local, past → tomorrow) / delaySeconds (≥60) / repeatMinutes (≥1; repeats expire after 7 days). Never provide both at and delaySeconds; the schema requires one timing variant. '
       + 'ONE-SHOT (wake once): give only delaySeconds or at and OMIT repeatMinutes (0 also means one-shot). Set repeatMinutes only when you really want it to repeat. '
       + `action=list shows pending wakeups; action=cancel needs id. Limits: ≥60s ahead, ≤7 days, at most 5 pending, at most ${WAKEUP_MAX_CALLS_PER_TURN} schedule/cancel calls per turn. `
       + 'If the TUI is busy or the human is typing at that time it retries once a minute later, then gives up (repeats move to the next tick). '
@@ -358,6 +399,11 @@ export function buildScheduleWakeupHostTool(scheduler: WakeupScheduler): LLMTool
         id: { type: 'string', description: 'Wakeup id for action=cancel (from schedule/list).' },
       },
       required: [],
+      oneOf: [
+        { not: { anyOf: [{ required: ['at'] }, { required: ['delaySeconds'] }] } },
+        { required: ['at'], not: { required: ['delaySeconds'] } },
+        { required: ['delaySeconds'], not: { required: ['at'] } },
+      ],
     },
     handler: async (args) => {
       const action = typeof args.action === 'string' ? args.action : 'schedule';
@@ -368,12 +414,15 @@ export function buildScheduleWakeupHostTool(scheduler: WakeupScheduler): LLMTool
         return r.ok ? { cancelled: id } : { error: r.error };
       }
       if (action !== 'schedule') return { error: `unknown action ${JSON.stringify(action)}` };
-      const result = scheduler.schedule({
+      const atProvided = Object.prototype.hasOwnProperty.call(args, 'at');
+      const request: ScheduleWakeupRequest = {
         reason: typeof args.reason === 'string' ? args.reason : '',
-        ...(typeof args.at === 'string' ? { at: args.at } : {}),
+        atProvided,
+        ...(atProvided ? { at: args.at } : {}),
         ...(typeof args.delaySeconds === 'number' ? { delaySeconds: args.delaySeconds } : {}),
         ...(typeof args.repeatMinutes === 'number' ? { repeatMinutes: args.repeatMinutes } : {}),
-      });
+      };
+      const result = scheduler.schedule(request, canonicalToolArgs(args));
       return result.ok ? { scheduled: describeEntry(result.entry) } : { error: result.error };
     },
   };

package/src/steward/release-day.ts

@@ -15,16 +15,19 @@ export interface ReleaseDayDecision {
   reason?: string;
 }
 
-/** The release record, rather than publishAt (a planned time), opens green-back. */
+/** Green-back waits for both the scheduled publish end and the actual publication record. */
 export function decideReleaseDayPhase(schedule: ReleaseSchedule, now: Date, publishedAt: string | null): ReleaseDayDecision {
   const cut = Date.parse(schedule.cutAt);
   const land = schedule.landBy ? Date.parse(schedule.landBy) : cut;
   const gate = cut - 30 * 60_000;
   const time = now.getTime();
+  const published = publishedAt ? Date.parse(publishedAt) : Number.NaN;
+  const publishEnd = schedule.publishAt ? Date.parse(schedule.publishAt) : published;
+  const greenAt = Number.isFinite(published) && Number.isFinite(publishEnd) ? Math.max(published, publishEnd) : Number.NaN;
   let phase: ReleaseDayPhase = 'none';
   let dueAt: string | null = null;
-  if (publishedAt && time >= Date.parse(publishedAt)) {
-    phase = 'green-back'; dueAt = publishedAt;
+  if (time >= greenAt) {
+    phase = 'green-back'; dueAt = publishEnd >= published ? schedule.publishAt ?? publishedAt : publishedAt;
   } else if (time >= cut) {
     phase = 'cut-run'; dueAt = schedule.cutAt;
   } else if (time >= land) {
@@ -133,6 +136,7 @@ export function runReleaseDayShadow(deps: ReleaseDayShadowDeps = {}): ReleaseDay
         continue;
       }
       const publishedAt = publication.kind === 'published' ? publication.at : null;
+      // The steward graph tick records this judgment only; release CLI actions remain outside this shadow boundary.
       const decision = decideReleaseDayPhase(schedule, now, publishedAt);
       let recorded = false;
       if (decision.phase !== 'none') {

package/src/steward/triage.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { closeSync, existsSync, openSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, writeFileSync, mkdirSync, renameSync, rmSync } from 'node:fs';
 import { launchModeOf, rescueAllows } from './rescue.js';
 import { join } from 'node:path';
 import { fetchLinearIssues } from '../connectors/linear.js';
@@ -328,13 +328,46 @@ function logStageFailure(root: string, stage: StewardStage, reason: string): voi
 }
 const SCHEDULE_CHECK_MS = 15 * 60_000;
 
+/** Atomic marker write: stage the payload at `<marker>.tmp-<pid>`, then renameSync it into place so a
+ *  crash mid-write never leaves a half-written marker for the next sync to trip over. */
+export function writeScheduleCheckMarker(
+  marker: string,
+  at: Date,
+  write: (path: string, data: string) => void = writeFileSync,
+): void {
+  const tmp = `${marker}.tmp-${process.pid}`;
+  try {
+    write(tmp, JSON.stringify({ at: at.toISOString() }));
+    renameSync(tmp, marker);
+  } catch (error) {
+    try { rmSync(tmp, { force: true }); } catch { /* Preserve the write or rename error. */ }
+    throw error;
+  }
+}
+
 /** Called by runStewardStage(sync) under its stage slot, never from the checker CLI. */
 async function checkStewardSchedules(root: string, settings: StewardSettings, deps: StewardDeps): Promise<void> {
   const now = (deps.now ?? (() => new Date()))();
   const marker = join(root, 'steward', 'schedule-check.json');
   let previous: { at?: string } = {};
-  try { previous = JSON.parse(readFileSync(marker, 'utf8')) as typeof previous; }
-  catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; }
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(marker, 'utf8'));
+    if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+      && (!('at' in parsed) || typeof parsed.at === 'string')) {
+      previous = parsed as typeof previous;
+    } else {
+      debug.log('steward.schedule-check', 'marker-recovered', { reason: 'invalid-marker-shape' });
+    }
+  }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') { /* first run in this window — previous stays {} */ }
+    else if (error instanceof SyntaxError) {
+      // Corrupt marker bytes self-heal: previous stays {} so this check runs now and the fresh
+      // writeScheduleCheckMarker below replaces the broken file. The recovery is observed.
+      debug.log('steward.schedule-check', 'marker-recovered', { reason: redactSecretText(String(error)) });
+    }
+    else throw error;
+  }
   const elapsed = now.getTime() - Date.parse(previous.at ?? '');
   if (Number.isFinite(elapsed) && elapsed >= 0 && elapsed < SCHEDULE_CHECK_MS) return;
   const inventory = deps.scheduleInventory ?? (() => {
@@ -378,7 +411,7 @@ async function checkStewardSchedules(root: string, settings: StewardSettings, de
     debug.log('steward.schedule-check', 'routing', { ownerRequests, opEscalations, recovered });
   }
   debug.log('steward.schedule-check', 'checked', { count: checked.length, findings: findings.length, mode: settings.mode });
-  writeFileSync(marker, JSON.stringify({ at: now.toISOString() }));
+  writeScheduleCheckMarker(marker, now);
 }
 
 function readState(path: string): { issues: Record<string, string>; digestDay?: string } {

package/src/task-agent/harvest-unit.ts

@@ -0,0 +1,141 @@
+export type HarvestInput = {
+  ask?: unknown;
+  context?: unknown;
+  prior?: unknown;
+};
+
+export type ReviewInvocation = {
+  stdout: string;
+  stderr?: string;
+  exitCode: number | null;
+};
+
+export type HarvestResult = {
+  outcome: 'done' | 'rework' | 'needs-human' | 'failed';
+  result: Record<string, unknown>;
+  evidence: Record<string, unknown>;
+};
+
+type ReviewRecord = Record<string, unknown> & {
+  pr?: string | number;
+  reviewed?: boolean;
+  verdict?: string | null;
+  mustFix?: unknown;
+  model?: string;
+  headCommit?: string;
+  currentHeadCommit?: string;
+};
+
+function object(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function expectedHead(input: HarvestInput): string | undefined {
+  if (object(input.context) && typeof input.context.expectedHead === 'string' && input.context.expectedHead.trim()) return input.context.expectedHead.trim();
+  return undefined;
+}
+
+function normalizedPr(value: unknown): string | undefined {
+  const raw = typeof value === 'number' && Number.isSafeInteger(value) ? String(value) : typeof value === 'string' ? value.trim() : '';
+  const normalized = raw.replace(/^#/, '');
+  return /^\d+$/.test(normalized) ? normalized : undefined;
+}
+
+function previousAttempts(input: HarvestInput): number {
+  if (!object(input.prior)) return 0;
+  const result = object(input.prior.result) ? input.prior.result : input.prior;
+  const attempts = result.attempts;
+  return Number.isSafeInteger(attempts) && (attempts as number) >= 0 ? attempts as number : 0;
+}
+
+function parseReview(stdout: string): ReviewRecord | undefined {
+  try {
+    const parsed: unknown = JSON.parse(stdout.trim());
+    if (Array.isArray(parsed)) {
+      if (parsed.length !== 1) return undefined;
+      return object(parsed[0]) ? parsed[0] as ReviewRecord : undefined;
+    }
+    return object(parsed) ? parsed as ReviewRecord : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export async function runHarvestUnit(
+  input: HarvestInput,
+  invokeReview: (args: { pr: string; intent: string }) => Promise<ReviewInvocation>,
+): Promise<HarvestResult> {
+  const attempts = previousAttempts(input) + 1;
+  const prValue = object(input.context) ? input.context.pr : undefined;
+  const pr = normalizedPr(prValue);
+  if (!pr) {
+    return { outcome: 'failed', result: { attempts, error: 'context.pr must identify one pull request' }, evidence: { pr: pr || null, attempts } };
+  }
+
+  const context = object(input.context) ? input.context : {};
+  const hasContextIntent = Object.prototype.hasOwnProperty.call(context, 'reviewIntent');
+  const intentValue = context.reviewIntent;
+  const intent = hasContextIntent
+    ? typeof intentValue === 'string' ? intentValue.trim() : ''
+    : typeof input.ask === 'string' ? input.ask.trim() : '';
+  if (!intent) {
+    return { outcome: 'failed', result: { attempts, error: hasContextIntent ? 'context.reviewIntent must be a non-empty string' : 'context.reviewIntent or ask is required' }, evidence: { pr, attempts } };
+  }
+  const expected = expectedHead(input);
+  if (!expected || !/^[0-9a-f]{40}$/i.test(expected)) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'expected PR head is required' }, evidence: { pr, attempts, expectedHead: expected ?? null } };
+  }
+
+  let invocation: ReviewInvocation;
+  try {
+    invocation = await invokeReview({ pr: pr.replace(/^#/, ''), intent });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review could not be executed' }, evidence: { pr, attempts, error: reason } };
+  }
+
+  const review = parseReview(invocation.stdout);
+  if (!review || review.reviewed !== true || typeof review.headCommit !== 'string' || typeof review.currentHeadCommit !== 'string') {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review result is missing or incomplete' }, evidence: {
+      pr, attempts, exitCode: invocation.exitCode, stderr: invocation.stderr ?? '', stdout: invocation.stdout.slice(0, 4000),
+    } };
+  }
+  if (normalizedPr(review.pr) !== pr) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review result belongs to a different pull request' }, evidence: {
+      pr, attempts, reviewedPr: review.pr ?? null, expectedHead: expected,
+    } };
+  }
+  if (invocation.exitCode !== 0) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review command exited unsuccessfully' }, evidence: {
+      pr, attempts, exitCode: invocation.exitCode, stderr: invocation.stderr ?? '',
+    } };
+  }
+  if (review.headCommit !== review.currentHeadCommit || (expected !== undefined && review.headCommit !== expected)) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review head is stale or differs from expected head' }, evidence: {
+      pr, attempts, expectedHead: expected ?? null, reviewedHead: review.headCommit, currentHead: review.currentHeadCommit,
+    } };
+  }
+  if (!['pass', 'warn', 'fail'].includes(review.verdict ?? '')) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review verdict is missing or invalid' }, evidence: {
+      pr, attempts, verdict: review.verdict ?? null, headCommit: review.headCommit,
+    } };
+  }
+  if (!Array.isArray(review.mustFix) || !review.mustFix.every(item => typeof item === 'string' && item.trim().length > 0)) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review mustFix field is invalid' }, evidence: { pr, attempts, headCommit: review.headCommit } };
+  }
+
+  const mustFix = review.mustFix as string[];
+  if ((review.verdict === 'fail' && mustFix.length === 0)
+    || ((review.verdict === 'pass' || review.verdict === 'warn') && mustFix.length > 0)) {
+    return { outcome: 'needs-human', result: { pr, attempts, reason: 'review verdict conflicts with mustFix findings' }, evidence: {
+      pr, attempts, verdict: review.verdict, mustFix, headCommit: review.headCommit,
+    } };
+  }
+  const evidence = {
+    pr, headCommit: review.headCommit, attempts, model: review.model ?? null, verdict: review.verdict ?? null,
+    reviewResultsJson: true, exitCode: invocation.exitCode,
+  };
+  return mustFix.length > 0
+    ? { outcome: 'rework', result: { pr, headCommit: review.headCommit, attempts, mustFix }, evidence }
+    : { outcome: 'done', result: { pr, headCommit: review.headCommit, attempts, mustFix: [] }, evidence };
+}