elanous 0.2.34 → 0.2.35

package/src/oauth/codex.ts

@@ -458,6 +458,10 @@ export async function loadFreshCodexAuthState(
     });
     return state;
   }
+  if (process.env.ELANOUS_REMOTE_CODEX_ACCESS_ONLY === '1') {
+    observeCodexAuth('no-credential', { storeKey: account.storeKey, mirrorPath: mirrorPath ?? null, reason: 'access-only-expiring' });
+    return null;
+  }
   observeCodexAuth('refresh-start', {
     storeKey: account.storeKey, remainingSeconds: remainingSeconds(state),
     mirrorPath: mirrorPath ?? null, bufferMs: CODEX_REFRESH_BUFFER_MS,
@@ -602,6 +606,9 @@ export async function refreshCodexAccountHome(
     now?: () => number;
   } = {},
 ): Promise<CodexAccountRefreshResult> {
+  if (process.env.ELANOUS_REMOTE_CODEX_ACCESS_ONLY === '1') {
+    return { ok: false, kind: 'no-tokens', message: '원격 access 미러는 refresh 권한이 없다' };
+  }
   // ⛔ The CEO's default account (~/.codex) is shared with the official CLI — refreshing it here
   //   rotates the refresh token out from under that CLI. Named accounts only.
   if (name === DEFAULT_CODEX_ACCOUNT) {

package/src/ops/overview-collect.ts

@@ -13,7 +13,7 @@ import type { ResourceView } from '../control-plane/ledger.js';
 import { cardPrNumber, type TaskCard } from '../task-agent/task-hand.js';
 import { measureLandingThroughput, type LandingThroughput } from '../task-agent/cover.js';
 import {
-  okCell, unmeasured, type Cell, type CapacityInfo, type ChecklistCounts, type LaunchableInfo, type LoopRow, type MachineRow,
+  okCell, unmeasured, type Cell, type CapacityInfo, type ChecklistCounts, type IoPressure, type LaunchableInfo, type LoopRow, type MachineRow,
   type OverviewSnapshot, type OwnerTaskRow, type ParentsInfo, type PodMemberRow, type ReleaseRunInfo, type ScheduleInfo,
   type SchedulerMetrics,
 } from './overview.js';
@@ -161,6 +161,20 @@ function collectRelease(root: string, version: string | null, schedules: Release
   return { version: versionCell, run, schedule, checklist };
 }
 
+/**
+ * 하트비트가 실어 온 I/O 압박(diskIo.io · PSI 10초 평균)을 꺼낸다.
+ * 못 잼(맥 · /proc/pressure/io 없음 · 항목 빠짐)은 null — «0%» 로 굳히지 않는다.
+ */
+function ioPressureOf(diskIo: unknown): IoPressure | null {
+  const cell = (diskIo as { io?: { status?: unknown; value?: { someAvg10?: unknown; fullAvg10?: unknown } } } | null | undefined)?.io;
+  if (!cell || cell.status !== 'ok') return null;
+  const someAvg10 = cell.value?.someAvg10;
+  const fullAvg10 = cell.value?.fullAvg10;
+  if (typeof someAvg10 !== 'number' || !Number.isFinite(someAvg10)) return null;
+  if (typeof fullAvg10 !== 'number' || !Number.isFinite(fullAvg10)) return null;
+  return { someAvg10, fullAvg10 };
+}
+
 function collectMachines(root: string, ledgerRows: ResourceView[] | Error, poolSpec: string | null, psOut: string | Error, now: number): OverviewSnapshot['machines'] {
   const expected = new Set<string>();
   const pods: PodMemberRow[] = [];
@@ -181,7 +195,7 @@ function collectMachines(root: string, ledgerRows: ResourceView[] | Error, poolS
     for (const r of machines) expected.add(r.machine);
     for (const name of [...expected].sort()) {
       const row = machines.find((r) => r.machine === name);
-      const load = (row?.attrs as { load?: { loadAvg?: number[]; cpuCount?: number; freeMem?: number; totalMem?: number; observedAt?: number } } | undefined)?.load;
+      const load = (row?.attrs as { load?: { loadAvg?: number[]; cpuCount?: number; freeMem?: number; totalMem?: number; observedAt?: number; diskIo?: unknown } } | undefined)?.load;
       if (!row || !load || !Array.isArray(load.loadAvg)) { hosts.push({ name, load: unmeasured('control ledger heartbeat', '하트비트 없음') }); continue; }
       const observed = typeof load.observedAt === 'number' ? load.observedAt : row.observedAt;
       const [l1, l5, l15] = load.loadAvg;
@@ -192,7 +206,8 @@ function collectMachines(root: string, ledgerRows: ResourceView[] | Error, poolS
       }
       const age = Math.max(0, Math.round((now - observed) / 1000));
       const value = { load1: l1, load5: l5, load15: l15, cpuCount: load.cpuCount,
-        freeGb: load.freeMem / GB, totalGb: load.totalMem / GB, ageSeconds: age };
+        freeGb: load.freeMem / GB, totalGb: load.totalMem / GB, ageSeconds: age,
+        ioPressure: ioPressureOf(load.diskIo) };
       hosts.push({ name, load: age > HEARTBEAT_STALE_S
         ? unmeasured('control ledger heartbeat', `낡음(${age}초)`, iso(observed))
         : okCell(value, 'control ledger heartbeat', iso(observed)) });

package/src/ops/overview.ts

@@ -51,7 +51,14 @@ export interface LaunchableInfo {
   interim: true;
 }
 export interface CapacityInfo { podUsed: number; podTarget: number; localUsed: number; localMax: number; free: number }
-export interface MachineLoad { load1: number; load5: number; load15: number; cpuCount: number; freeGb: number; totalGb: number; ageSeconds: number }
+/** 리눅스 PSI(/proc/pressure/io · 10초 평균) — 적어도 한 작업이 I/O 를 기다린 시간 비율(%). 100 이면 늘 막혀 있었다. */
+export interface IoPressure { someAvg10: number; fullAvg10: number }
+
+export interface MachineLoad {
+  load1: number; load5: number; load15: number; cpuCount: number; freeGb: number; totalGb: number; ageSeconds: number;
+  /** 하트비트가 실어 온 I/O 압박. 못 잼(맥·/proc/pressure/io 없음)은 null — 축에서 빼지 «넉넉»으로 읽지 않는다. */
+  ioPressure?: IoPressure | null;
+}
 export interface MachineRow { name: string; load: Cell<MachineLoad> }
 export interface PodMemberRow { context: string; capacity: number; occupied: Cell<number> }
 export interface ParentsInfo { count: number; staleOver6h: number; oldestHours: number | null }
@@ -100,10 +107,10 @@ export interface OverviewSnapshot {
 
 export interface VerdictResult { verdict: Verdict; reasons: string[]; nextActions: string[] }
 
-/** 부하/코어가 이 값을 넘으면 «기계 압박»(흐름 저하의 사유). 디스크 I/O 신호는 OVW-MACHINE-HB 전까지 없다. */
+/** 부하/코어가 이 값을 넘으면 «기계 압박»(흐름 저하의 사유). */
 export const LOAD_PER_CORE_PRESSURE = 3;
 
-/** 자원 지도의 축 어휘(닫힌 집합 · RES-FLOOR-BINDING). I/O·게이트 예약은 이 칸에 원천이 없어 늘 제외다. */
+/** 자원 지도의 축 어휘(닫힌 집합 · RES-FLOOR-BINDING). 게이트 예약은 이 칸에 원천이 없어 늘 제외다. */
 export type ResourceKind = 'memory' | 'cpu' | 'io' | 'slots' | 'gate';
 
 /** 구속 조건 — 남은 비율이 최소인 축. 남은 비율 = 남은 양/전체 양(CPU 는 압박선 LOAD_PER_CORE_PRESSURE×코어를 전체로 본다). */
@@ -111,7 +118,7 @@ export interface ResourceBinding {
   kind: ResourceKind;
   label: string;
   remainingRatio: number;
-  /** 남은 양/전체 양의 사람 표기 — `5/64GB` · `0/54코어(압박선 3/코어)` · `0/46자리`. */
+  /** 남은 양/전체 양의 사람 표기 — `5/64GB` · `0/54코어(압박선 3/코어)` · `4/100(압박 96% · full 61% · 10초 평균)` · `0/46자리`. */
   remainingText: string;
 }
 
@@ -125,8 +132,9 @@ function remainingAmount(n: number): string {
 
 /**
  * 구속 조건 규칙(RES-FLOOR-BINDING) — 메모리·CPU·I/O·슬롯·게이트 예약 중 «남은 비율 최소»인 축이 흐름을 묶는다.
- * 못 잰 축(하트비트 없는 호스트 · 용량 못 잼 · 원천 없는 I/O·게이트 예약)은 후보에서 뺀다 — «넉넉»으로도 «바닥»으로도 읽지 않는다.
- * 측정 축이 하나도 없으면 null. 동율은 정해진 순서(호스트 순 메모리→CPU, 그 다음 슬롯)의 첫 축이 이긴다.
+ * 못 잰 축(하트비트 없는 호스트 · 용량 못 잼 · 하트비트에 PSI 가 없는 I/O · 원천이 없는 게이트 예약)은 후보에서 뺀다
+ * — «넉넉»으로도 «바닥»으로도 읽지 않는다.
+ * 측정 축이 하나도 없으면 null. 동율은 정해진 순서(호스트 순 메모리→CPU→I/O, 그 다음 슬롯)의 첫 축이 이긴다.
  */
 export function bindingResource(s: OverviewSnapshot): ResourceBinding | null {
   const candidates: ResourceBinding[] = [];
@@ -142,6 +150,11 @@ export function bindingResource(s: OverviewSnapshot): ResourceBinding | null {
       const remaining = Math.max(0, cpuCap - l.load5);
       candidates.push({ kind: 'cpu', label: `${host.name} CPU`, remainingRatio: ratio01(remaining / cpuCap), remainingText: `${remainingAmount(remaining)}/${cpuCap.toFixed(0)}코어(압박선 ${LOAD_PER_CORE_PRESSURE}/코어)` });
     }
+    const io = l.ioPressure;
+    if (io) {
+      const remaining = Math.max(0, 100 - io.someAvg10);
+      candidates.push({ kind: 'io', label: `${host.name} I/O`, remainingRatio: ratio01(remaining / 100), remainingText: `${remainingAmount(remaining)}/100(압박 ${remainingAmount(io.someAvg10)}% · full ${remainingAmount(io.fullAvg10)}% · 10초 평균)` });
+    }
   }
   const capacity = s.tasks.capacity.value;
   if (capacity && capacity.podTarget + capacity.localMax > 0) {
@@ -280,7 +293,7 @@ export function renderOverview(s: OverviewSnapshot, v: VerdictResult, meta: { el
   lines.push(`일꾼   ${owners} · 끝 ${show(s.tasks.done, String)}`);
   lines.push(`       발사 가능 ${show(s.tasks.launchable, (l) => `${l.count}${l.interim ? '(임시 술어)' : ''} · 대상 경로 없음 ${l.skipped.noTargetPath} · 선행 미완 ${l.skipped.predecessorOpen} · 이미 넘김 ${l.skipped.alreadyHanded}`)}`);
   lines.push(`       빈 자리 ${show(s.tasks.capacity, (c) => `${c.free} (Pod ${c.podUsed}/${c.podTarget} · 로컬 ${c.localUsed}/${c.localMax})`)} [${s.tasks.capacity.source}]`);
-  const hosts = s.machines.hosts.map((h) => `${h.name} ${show(h.load, (l) => `${l.load1.toFixed(0)}/${l.cpuCount}코어 여유 ${l.freeGb.toFixed(0)}/${l.totalGb.toFixed(0)}GB (${l.ageSeconds}s 전)`)}`);
+  const hosts = s.machines.hosts.map((h) => `${h.name} ${show(h.load, (l) => `${l.load1.toFixed(0)}/${l.cpuCount}코어 여유 ${l.freeGb.toFixed(0)}/${l.totalGb.toFixed(0)}GB${l.ioPressure ? ` · I/O 압박 ${l.ioPressure.someAvg10}% · full ${l.ioPressure.fullAvg10}%` : ''} (${l.ageSeconds}s 전)`)}`);
   lines.push(`기계   ${hosts.join(' · ') || '못 잼(하트비트 원장 비어 있음)'}`);
   lines.push(`       Pod ${s.machines.pods.map((p) => `${p.context} ${show(p.occupied, String)}/${p.capacity}`).join(' · ') || '못 잼(풀 설정 없음)'}`);
   lines.push(`       하니스 부모(이 기계) ${show(s.machines.parents, (p) => `${p.count} · 6h 넘음 ${p.staleOver6h}${p.oldestHours !== null ? ` · 최고 ${p.oldestHours}h` : ''}`)}`);

package/src/pr-tool/census.ts

@@ -5,9 +5,13 @@ import { join } from 'node:path';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { withFileLockSync } from '../storage/file-lock.js';
 import { resolveHostId } from '../platform/host-id.js';
+import { spawnSync } from 'node:child_process';
 
 export interface PrToolCommandResult { ok: boolean; out: string; err?: string }
 export type PrToolCommand = (command: string, args: readonly string[], opts?: { cwd?: string }) => PrToolCommandResult;
+export interface PrToolCall { command: string; args: readonly string[]; opts?: { cwd?: string } }
+/** PR-CENSUS-PARALLEL: run every call with at most `concurrency` in flight; results stay in input order. */
+export type PrToolParallelCommand = (calls: readonly PrToolCall[], concurrency: number) => PrToolCommandResult[];
 export type Seat = 'OP' | 'TC' | 'MK' | 'UX';
 export interface OpenPr {
   number: number;
@@ -23,6 +27,8 @@ export interface OpenPr {
   cellId: string | null;
   cardId?: string | null;
   cardMarkerPresent?: boolean;
+  /** «조각 i/N — 부모 <칸>» 표지가 있으면 그 조각 번호(없으면 null) — sibling-slice 판정용. */
+  slice?: { slice: number; total: number } | null;
   hunks?: readonly DiffHunk[];
 }
 export type Inventory = { status: 'checked'; prs: readonly OpenPr[] } | { status: 'unknown'; reason: string };
@@ -35,6 +41,7 @@ export interface GuardReason { code: GuardCode; detail: string; prs?: readonly n
 /** PR-GUARD-HUNK-WARN (대표 10-17): 줄 겹침은 기본 경고 — 착지 쪽 스마트 머지가 푼다. 'refuse' = 옛 거부 동작. */
 export type HunkOverlapMode = 'refuse' | 'warn';
 export interface GuardVerdict { status: 'allow' | 'refuse' | 'unknown'; reasons: readonly GuardReason[]; warnings: readonly GuardReason[];
+  sameCellConflicts?: readonly { pr: number; cardId: string | null; slice?: { slice: number; total: number } | null }[];
   sameCellReuse?: { number: number; branch: string; headSha: string; cellId: string; cardId: string; legacyBound?: true } }
 
 const SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
@@ -45,6 +52,126 @@ const MAX_FILES = 3000; // GitHub does not expose more than 3000 PR files.
 const UNMEASURED_WINDOW_MS = 60 * 60 * 1000;
 const UNMEASURED_ALLOW_COUNT = 3;
 
+export const DEFAULT_DIFF_CONCURRENCY = 6;
+const DIFF_CACHE_MAX = 2000;
+const DIFF_CACHE_MAX_BYTES = 64 * 1024 * 1024;
+const DIFF_CACHE_ENTRY_MAX_BYTES = 4 * 1024 * 1024;
+const PARALLEL_CALL_TIMEOUT_MS = 120_000;
+/** Whole pool ceiling, independent of the call count — a stuck pool fails (inventory unknown) instead of hanging the guard. */
+const PARALLEL_POOL_TIMEOUT_MS = 10 * 60 * 1000;
+const PARALLEL_MAX_BUFFER = 256 * 1024 * 1024;
+
+/** `gh pr diff` patches keyed by PR number ⊕ head sha. A head sha fixes the diff, so a retry or a second guard
+ *  call in the same process never refetches it. Bounded by entry count and total bytes (the oldest entry leaves
+ *  first); a single patch above the per-entry limit is not cached at all. */
+export class CensusDiffCache {
+  private readonly entries = new Map<string, { patch: string; bytes: number }>();
+  private totalBytes = 0;
+  constructor(private readonly max = DIFF_CACHE_MAX, private readonly maxBytes = DIFF_CACHE_MAX_BYTES,
+    private readonly entryMaxBytes = DIFF_CACHE_ENTRY_MAX_BYTES) {}
+  private key(number: number, headSha: string): string { return `${number}@${headSha}`; }
+  private drop(key: string): void {
+    const entry = this.entries.get(key);
+    if (!entry) return;
+    this.totalBytes -= entry.bytes;
+    this.entries.delete(key);
+  }
+  get(number: number, headSha: string): string | undefined { return this.entries.get(this.key(number, headSha))?.patch; }
+  set(number: number, headSha: string, patch: string): void {
+    const key = this.key(number, headSha);
+    this.drop(key);
+    const bytes = Buffer.byteLength(patch, 'utf8');
+    if (bytes > this.entryMaxBytes || bytes > this.maxBytes) return;
+    while (this.entries.size > 0 && (this.entries.size >= this.max || this.totalBytes + bytes > this.maxBytes)) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest === undefined) break;
+      this.drop(oldest);
+    }
+    this.entries.set(key, { patch, bytes });
+    this.totalBytes += bytes;
+  }
+  get size(): number { return this.entries.size; }
+  get bytes(): number { return this.totalBytes; }
+  clear(): void { this.entries.clear(); this.totalBytes = 0; }
+}
+/** Process-lifetime cache for production callers (PR creation guard · `pr open-guard`). Tests pass their own. */
+export const sharedCensusDiffCache = new CensusDiffCache();
+export function resetCensusDiffCache(): void { sharedCensusDiffCache.clear(); }
+
+// Runs inside a child `bun`/`node` so the synchronous inventory API can still fan out. stdin: { calls, concurrency,
+// timeoutMs } · stdout: one result per call, input order. Each call runs in its own process group (detached) so a
+// per-call timeout, or this pool ending on SIGTERM/SIGINT/SIGHUP from the outer ceiling, kills the whole group —
+// no `gh` (or its children) outlives the pool.
+const PARALLEL_SCRIPT = `
+const { spawn } = require('node:child_process');
+const live = new Set();
+const killGroup = pid => { try { process.kill(-pid, 'SIGKILL'); } catch { try { process.kill(pid, 'SIGKILL'); } catch {} } };
+const killAll = () => { for (const pid of live) killGroup(pid); live.clear(); };
+for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, () => { killAll(); process.exit(124); });
+process.on('exit', killAll);
+let input = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => { input += chunk; });
+process.stdin.on('end', () => {
+  const { calls, concurrency, timeoutMs } = JSON.parse(input);
+  const results = new Array(calls.length);
+  let next = 0;
+  const one = index => new Promise(resolve => {
+    const call = calls[index];
+    const out = []; const err = [];
+    let settled = false; let timedOut = false; let timer;
+    let child;
+    const finish = result => {
+      if (settled) return; settled = true; clearTimeout(timer);
+      if (child && child.pid) { killGroup(child.pid); live.delete(child.pid); }
+      results[index] = result; resolve();
+    };
+    try { child = spawn(call.command, call.args, { cwd: call.cwd || undefined, stdio: ['ignore', 'pipe', 'pipe'], detached: true }); }
+    catch (error) { results[index] = { ok: false, out: '', err: String(error && error.message || error) }; resolve(); return; }
+    if (child.pid) live.add(child.pid);
+    timer = setTimeout(() => { timedOut = true; if (child.pid) killGroup(child.pid); }, timeoutMs);
+    child.stdout.on('data', chunk => out.push(chunk));
+    child.stderr.on('data', chunk => err.push(chunk));
+    child.on('error', error => finish({ ok: false, out: '', err: String(error && error.message || error) }));
+    child.on('close', (code, signal) => finish({ ok: code === 0 && !signal && !timedOut, out: Buffer.concat(out).toString('utf8').trim(),
+      err: [Buffer.concat(err).toString('utf8').trim(), timedOut ? 'timed out after ' + timeoutMs + 'ms' : signal ? 'terminated by ' + signal : ''].filter(Boolean).join('\\n') }));
+  });
+  const worker = async () => { while (next < calls.length) { const index = next++; await one(index); } };
+  Promise.all(Array.from({ length: Math.max(1, Math.min(concurrency, calls.length)) }, worker))
+    .then(() => process.stdout.write(JSON.stringify(results)));
+});
+`;
+
+/** Real-spawn {@link PrToolParallelCommand}: one child runtime fans out the calls with a bounded pool. Any failure of
+ *  the pool itself (including the fixed pool ceiling) returns every call as failed, so the caller's conservative
+ *  unknown rule applies. `timeoutMs` = per call · `poolTimeoutMs` = whole pool (tests inject short values). */
+export function spawnParallelCommands(calls: readonly PrToolCall[], options: { concurrency?: number; env?: NodeJS.ProcessEnv; timeoutMs?: number; poolTimeoutMs?: number } = {}): PrToolCommandResult[] {
+  if (calls.length === 0) return [];
+  const concurrency = Math.max(1, Math.floor(options.concurrency ?? DEFAULT_DIFF_CONCURRENCY));
+  const timeoutMs = options.timeoutMs ?? PARALLEL_CALL_TIMEOUT_MS;
+  const failAll = (err: string) => calls.map(() => ({ ok: false, out: '', err }));
+  try {
+    const r = spawnSync(process.execPath, ['-e', PARALLEL_SCRIPT], {
+      input: JSON.stringify({ calls: calls.map(call => ({ command: call.command, args: [...call.args], cwd: call.opts?.cwd })), concurrency, timeoutMs }),
+      encoding: 'utf-8', maxBuffer: PARALLEL_MAX_BUFFER, timeout: options.poolTimeoutMs ?? PARALLEL_POOL_TIMEOUT_MS, killSignal: 'SIGTERM',
+      ...(options.env ? { env: options.env } : {}),
+    });
+    if ((r.error as NodeJS.ErrnoException | undefined)?.code === 'ENOBUFS') return failAll('parallel output exceeded 256MiB (ENOBUFS)');
+    if ((r.error as NodeJS.ErrnoException | undefined)?.code === 'ETIMEDOUT' || r.signal) return failAll(`parallel runner timed out or was killed (${r.signal ?? 'ETIMEDOUT'})`);
+    if (r.status !== 0) return failAll(`parallel runner rc=${r.status}: ${(r.stderr ?? '').trim().slice(0, 300)}`);
+    const parsed: unknown = JSON.parse(r.stdout ?? '');
+    if (!Array.isArray(parsed) || parsed.length !== calls.length) return failAll('parallel runner result shape mismatch');
+    return parsed.map(row => {
+      const value = row as { ok?: unknown; out?: unknown; err?: unknown } | null;
+      return value && typeof value.ok === 'boolean' && typeof value.out === 'string'
+        ? { ok: value.ok, out: value.out, err: typeof value.err === 'string' ? value.err : '' }
+        : { ok: false, out: '', err: 'parallel runner row missing' };
+    });
+  } catch (error) {
+    return failAll(`parallel runner: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
 function unknown(reason: string): Inventory { return { status: 'unknown', reason }; }
 function seatValue(value: unknown): Seat | null { return SEATS.find(seat => seat === value) ?? null; }
 function seatFromLabels(labels: readonly string[]): Seat | null {
@@ -60,6 +187,15 @@ export function cardIdFromBody(body: string): string | null {
 export function hasCardMarker(body: string): boolean {
   return /^\s*(?:[-*]\s*)?카드\s*:/m.test(body);
 }
+/** 골/PR 본문의 «조각 i/N — 부모 <칸>» 표지 → {slice,total}. 표지 없으면 null, 1≤i≤N 아니면 null. */
+export function sliceMarkerFromBody(body: string): { slice: number; total: number } | null {
+  const m = /^\s*(?:[-*]\s*)?(?:«\s*)?조각\s*(\d+)\s*\/\s*(\d+)\s*(?:»)?\s*—\s*부모\s+\S[^\r\n]*$/m.exec(body);
+  if (!m) return null;
+  const slice = Number(m[1]);
+  const total = Number(m[2]);
+  return Number.isSafeInteger(slice) && Number.isSafeInteger(total) && slice >= 1 && total >= 1 && slice <= total
+    ? { slice, total } : null;
+}
 
 export function parseDiffHunks(patch: string): DiffHunk[] {
   const hunks: DiffHunk[] = [];
@@ -92,8 +228,8 @@ export function parseDiffHunks(patch: string): DiffHunk[] {
 }
 
 /** `gh api --paginate --slurp` must return every REST page, including the last page. */
-function pages(run: PrToolCommand, endpoint: string, cwd?: string): readonly unknown[] {
-  const result = run('gh', ['api', '--paginate', '--slurp', endpoint], cwd ? { cwd } : undefined);
+function pagesArgs(endpoint: string): string[] { return ['api', '--paginate', '--slurp', endpoint]; }
+function parsePages(result: PrToolCommandResult, endpoint: string): readonly unknown[] {
   if (!result.ok) throw new Error(`gh api ${endpoint}: ${result.err || result.out || '조회 실패'}`);
   let parsed: unknown;
   try { parsed = JSON.parse(result.out); } catch { throw new Error(`gh api ${endpoint}: JSON 오류`); }
@@ -102,6 +238,9 @@ function pages(run: PrToolCommand, endpoint: string, cwd?: string): readonly unk
   }
   return parsed.flat();
 }
+function pages(run: PrToolCommand, endpoint: string, cwd?: string): readonly unknown[] {
+  return parsePages(run('gh', pagesArgs(endpoint), cwd ? { cwd } : undefined), endpoint);
+}
 
 function object(value: unknown): Record<string, unknown> {
   if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error('PR 응답 행 형식 오류');
@@ -116,29 +255,59 @@ function date(value: unknown, name: string): string {
   if (!Number.isFinite(Date.parse(raw))) throw new Error(`${name} 날짜 오류`);
   return raw;
 }
-function pathsForPr(run: PrToolCommand, number: number, cwd?: string): string[] {
-  const rows = pages(run, `repos/{owner}/{repo}/pulls/${number}/files?per_page=100`, cwd);
+function filesEndpoint(number: number): string { return `repos/{owner}/{repo}/pulls/${number}/files?per_page=100`; }
+function pathsFromFilesResult(result: PrToolCommandResult, number: number): string[] {
+  const rows = parsePages(result, filesEndpoint(number));
   if (rows.length >= MAX_FILES) throw new Error(`PR #${number}: 파일 ${MAX_FILES}개 GitHub 상한에 닿음`);
   return rows.map(row => text(object(row).filename, `PR #${number} 파일명`));
 }
 
-/** Fast file projection; the REST page census below remains the authority for which PRs exist. */
-function projectedFiles(run: PrToolCommand, count: number, cwd?: string): Map<number, string[]> {
+interface FileProjection {
+  files: Map<number, string[]>;
+  /** Set when the one-shot list produced nothing usable — every PR then takes the REST file fallback. */
+  failure?: string;
+  /** Rows the projection could not vouch for (malformed · file list shorter than changedFiles, e.g. >100 files). */
+  skipped: number;
+}
+
+/** Fast file projection; the REST page census below remains the authority for which PRs exist. A failed or partial
+ *  projection is never silent: the reason and skipped row count go to the `diff-scan` observation. */
+function projectedFiles(run: PrToolCommand, count: number, cwd?: string): FileProjection {
   const result = run('gh', ['pr', 'list', '--state', 'open', '--limit', String(Math.max(count, 1)), '--json', 'number,changedFiles,files'], cwd ? { cwd } : undefined);
-  if (!result.ok) return new Map();
+  if (!result.ok) return { files: new Map(), skipped: 0, failure: `gh pr list 실패: ${(result.err || result.out || 'rc≠0').trim().slice(0, 200)}` };
   let rows: unknown;
-  try { rows = JSON.parse(result.out); } catch { return new Map(); }
-  if (!Array.isArray(rows)) return new Map();
+  try { rows = JSON.parse(result.out); } catch { return { files: new Map(), skipped: 0, failure: `gh pr list JSON 오류 (${result.out.length}자)` }; }
+  if (!Array.isArray(rows)) return { files: new Map(), skipped: 0, failure: 'gh pr list 응답이 배열 아님' };
   const projection = new Map<number, string[]>();
+  let skipped = 0;
   for (const value of rows) {
     try {
       const row = object(value);
-      if (!Number.isSafeInteger(row.number) || (row.number as number) <= 0 || !Number.isSafeInteger(row.changedFiles) || (row.changedFiles as number) < 0 || !Array.isArray(row.files)) continue;
+      if (!Number.isSafeInteger(row.number) || (row.number as number) <= 0 || !Number.isSafeInteger(row.changedFiles) || (row.changedFiles as number) < 0 || !Array.isArray(row.files)) { skipped += 1; continue; }
       const paths = row.files.map(file => text(object(file).path, 'PR 파일명'));
       if (paths.length === row.changedFiles && paths.length < MAX_FILES && !projection.has(row.number as number)) projection.set(row.number as number, paths);
-    } catch { /* malformed projection: REST file endpoint below decides this PR */ }
+      else skipped += 1;
+    } catch { skipped += 1; /* malformed projection: REST file endpoint below decides this PR */ }
   }
-  return projection;
+  if (rows.length > 0 && projection.size === 0) return { files: projection, skipped, failure: `gh pr list ${rows.length}행 모두 사용 불가` };
+  return { files: projection, skipped };
+}
+
+/** Run `calls` through the bounded pool when given, else one by one with the injected runner, stopping at the first
+ *  failure (the historical order and call count). The result may be shorter than `calls` only in that sequential case. */
+function runCalls(run: PrToolCommand, calls: readonly PrToolCall[], runParallel: PrToolParallelCommand | undefined, concurrency: number, what: string): PrToolCommandResult[] {
+  if (runParallel) {
+    const results = runParallel(calls, concurrency);
+    if (results.length !== calls.length) throw new Error(`${what} 결과 ${results.length}/${calls.length}건 · 판정 불가`);
+    return results;
+  }
+  const results: PrToolCommandResult[] = [];
+  for (const call of calls) {
+    const result = run(call.command, call.args, call.opts);
+    results.push(result);
+    if (!result.ok) break;
+  }
+  return results;
 }
 
 export function readOpenPrs(run: PrToolCommand, options: {
@@ -146,10 +315,28 @@ export function readOpenPrs(run: PrToolCommand, options: {
   seatOfPr?: (pr: { number: number; headRefName: string; body: string; labels: readonly string[] }) => Seat | null;
   includeDraftCommitDates?: boolean;
   candidateFiles?: readonly string[];
+  /** Bounded parallel REST-file fallback and diff fetch. Absent ⇒ the injected `run`, one by one (historical order and call count). */
+  runParallel?: PrToolParallelCommand;
+  /** Operations default {@link DEFAULT_DIFF_CONCURRENCY} (6) — production callers do not pass it; for test injection. */
+  diffConcurrency?: number;
+  /** Absent ⇒ no cache. Production callers pass {@link sharedCensusDiffCache}. */
+  diffCache?: CensusDiffCache;
 } = {}): Inventory {
+  const started = Date.now();
+  const callOpts = options.cwd ? { opts: { cwd: options.cwd } } : {};
+  const concurrency = options.runParallel ? Math.max(1, Math.floor(options.diffConcurrency ?? DEFAULT_DIFF_CONCURRENCY)) : 1;
+  const scan = { openPrs: 0, projected: 0, restFallback: 0, projectionFailed: false, projectionReason: undefined as string | undefined,
+    projectionSkipped: 0, fileOverlap: 0, patchFetched: 0, cacheHits: 0 };
+  let status: 'checked' | 'inventory-unknown' | 'files-failed' | 'diff-failed' | 'commit-date-failed' = 'inventory-unknown';
+  const logDiffScan = () => {
+    debug.log('pr-tool.census', 'diff-scan', { ...scan, concurrency, elapsedMs: Date.now() - started, status });
+  };
   try {
     const rows = pages(run, 'repos/{owner}/{repo}/pulls?state=open&per_page=100', options.cwd);
-    const projected = projectedFiles(run, rows.length, options.cwd);
+    const projection = projectedFiles(run, rows.length, options.cwd);
+    scan.projectionFailed = projection.failure !== undefined;
+    scan.projectionReason = projection.failure;
+    scan.projectionSkipped = projection.skipped;
     const prs: OpenPr[] = [];
     const seen = new Set<number>();
     for (const value of rows) {
@@ -166,26 +353,69 @@ export function readOpenPrs(run: PrToolCommand, options: {
       const headSha = text(head.sha, `PR #${number} head sha`);
       const body = typeof row.body === 'string' ? row.body : '';
       const seat = seatValue(options.seatOfPr?.({ number: number as number, headRefName, body, labels: labelNames })) ?? seatFromLabels(labelNames);
-      const pr: OpenPr = {
+      prs.push({
         number: number as number, headRefName, title: text(row.title, `PR #${number} title`), draft: row.draft,
         updatedAt: date(row.updated_at, `PR #${number} updated_at`), headSha, labels: labelNames,
-        files: projected.get(number as number) ?? pathsForPr(run, number as number, options.cwd), seat,
+        files: projection.files.get(number as number) ?? [], seat,
         cellId: cellIdFromBody(body), cardId: cardIdFromBody(body), cardMarkerPresent: hasCardMarker(body),
-      };
-      if (options.candidateFiles?.some(file => pr.files.includes(file))) {
-        const patch = run('gh', ['pr', 'diff', String(number), '--patch'], options.cwd ? { cwd: options.cwd } : undefined);
-        if (!patch.ok) throw new Error(`PR #${number}: 수정 줄 조회 실패: ${patch.err || patch.out}`);
+        slice: sliceMarkerFromBody(body),
+      });
+    }
+    scan.openPrs = prs.length;
+    // Files: PRs the one-shot projection did not cover take the REST file endpoint — in the pool when given.
+    const restPrs = prs.filter(pr => !projection.files.has(pr.number));
+    scan.projected = prs.length - restPrs.length;
+    scan.restFallback = restPrs.length;
+    if (restPrs.length) {
+      status = 'files-failed';
+      const results = runCalls(run, restPrs.map(pr => ({ command: 'gh', args: pagesArgs(filesEndpoint(pr.number)), ...callOpts })), options.runParallel, concurrency, 'PR 파일 조회');
+      // The first failure in input order decides the reason; one failure keeps the whole inventory unknown.
+      // Invariant: a result is missing only after an earlier failure (sequential stop), which throws first. Still,
+      // a missing result is a failure (unknown), never an empty file list.
+      restPrs.forEach((pr, index) => {
+        const result = results[index];
+        if (!result) throw new Error(`PR #${pr.number}: 파일 조회 결과 없음 · 판정 불가`);
+        pr.files = pathsFromFilesResult(result, pr.number);
+      });
+    }
+    // Diffs: only PRs sharing a candidate file; a cached (number, headSha) patch is not refetched.
+    const pendingDiffs: OpenPr[] = [];
+    for (const pr of prs) {
+      if (!options.candidateFiles?.some(file => pr.files.includes(file))) continue;
+      scan.fileOverlap += 1;
+      const cached = options.diffCache?.get(pr.number, pr.headSha);
+      if (cached !== undefined) { pr.hunks = parseDiffHunks(cached); scan.cacheHits += 1; }
+      else pendingDiffs.push(pr);
+    }
+    if (pendingDiffs.length) {
+      status = 'diff-failed';
+      const results = runCalls(run, pendingDiffs.map(pr => ({ command: 'gh', args: ['pr', 'diff', String(pr.number), '--patch'], ...callOpts })), options.runParallel, concurrency, '수정 줄 조회');
+      scan.patchFetched = results.length;
+      pendingDiffs.forEach((pr, index) => {
+        const patch = results[index];
+        if (!patch) throw new Error(`PR #${pr.number}: 수정 줄 조회 결과 없음 · 판정 불가`);
+        if (!patch.ok) throw new Error(`PR #${pr.number}: 수정 줄 조회 실패: ${patch.err || patch.out}`);
+      });
+      pendingDiffs.forEach((pr, index) => {
+        const patch = results[index]!;
         pr.hunks = parseDiffHunks(patch.out);
+        options.diffCache?.set(pr.number, pr.headSha, patch.out);
+      });
+    }
+    if (options.includeDraftCommitDates) {
+      status = 'commit-date-failed';
+      for (const pr of prs) {
+        if (!pr.draft) continue;
+        const commit = run('gh', ['api', `repos/{owner}/{repo}/commits/${pr.headSha}`, '--jq', '.commit.committer.date'], options.cwd ? { cwd: options.cwd } : undefined);
+        if (!commit.ok) throw new Error(`PR #${pr.number}: 마지막 커밋 날짜 조회 실패: ${commit.err || commit.out}`);
+        pr.lastCommitAt = date(commit.out.trim(), `PR #${pr.number} 마지막 커밋`);
       }
-      if (pr.draft && options.includeDraftCommitDates) {
-        const commit = run('gh', ['api', `repos/{owner}/{repo}/commits/${headSha}`, '--jq', '.commit.committer.date'], options.cwd ? { cwd: options.cwd } : undefined);
-        if (!commit.ok) throw new Error(`PR #${number}: 마지막 커밋 날짜 조회 실패: ${commit.err || commit.out}`);
-        pr.lastCommitAt = date(commit.out.trim(), `PR #${number} 마지막 커밋`);
-      }
-      prs.push(pr);
     }
+    status = 'checked';
+    logDiffScan();
     return { status: 'checked', prs };
   } catch (error) {
+    logDiffScan();
     return unknown(error instanceof Error ? error.message : String(error));
   }
 }
@@ -222,7 +452,7 @@ export function censusOpenPrs(inventory: Inventory, now = Date.now()): Census {
   return result;
 }
 
-export function guardNewPr(input: { files: readonly string[] | null; seat?: Seat | null; seatCap?: number; cellId?: string | null; cardId?: string | null; boundPrNumber?: number; hunks?: readonly DiffHunk[]; hunkOverlap?: HunkOverlapMode }, inventory: Inventory): GuardVerdict {
+export function guardNewPr(input: { files: readonly string[] | null; seat?: Seat | null; seatCap?: number; cellId?: string | null; cardId?: string | null; slice?: { slice: number; total: number } | null; boundPrNumber?: number; hunks?: readonly DiffHunk[]; hunkOverlap?: HunkOverlapMode }, inventory: Inventory): GuardVerdict {
   if (!input.files || input.files.length === 0 || input.files.some(file => !file || file.startsWith('/') || file.includes('..'))) {
     const reasons: GuardReason[] = [{ code: 'candidate-unknown', detail: '새 PR 변경 파일을 확인할 수 없음' }];
     debug.log('pr.tool', 'guard-refuse', { status: 'unknown', reasons });
@@ -275,10 +505,14 @@ export function guardNewPr(input: { files: readonly string[] | null; seat?: Seat
     && input.boundPrNumber === sameCell[0].number;
   const reusable = status === 'refuse' && reasons.length === 1 && reasons[0]?.code === 'same-cell'
     && input.cardId && sameCell.length === 1 && (sameCell[0]?.cardId === input.cardId || legacyBound)
+    && (input.slice?.slice ?? null) === (sameCell[0]?.slice?.slice ?? null)
+    && (input.slice?.total ?? null) === (sameCell[0]?.slice?.total ?? null)
     && sameCell[0].headRefName && /^[0-9a-f]{40}$/i.test(sameCell[0].headSha)
     ? { number: sameCell[0].number, branch: sameCell[0].headRefName, headSha: sameCell[0].headSha,
       cellId: input.cellId!, cardId: input.cardId, ...(legacyBound ? { legacyBound: true as const } : {}) } : undefined;
-  return { status, reasons, warnings, ...(reusable ? { sameCellReuse: reusable } : {}) };
+  return { status, reasons, warnings,
+    ...(sameCell.length ? { sameCellConflicts: sameCell.map(pr => ({ pr: pr.number, cardId: pr.cardId ?? null, slice: pr.slice ?? null })) } : {}),
+    ...(reusable ? { sameCellReuse: reusable } : {}) };
 }
 
 /** Persist the unknown-read budget across harness processes sharing one instance state root. */

package/src/pty-shell/pty-manifest.ts

@@ -251,6 +251,13 @@ function recordPtyLifecycle(event: PtyLifecycleEvent, row: PtyManifestRow, now:
       exitCode: row.exitCode,
       startedAt: row.startedAt,
       closedAt: row.closedAt,
+      // 시작·종료·오류·산출을 같은 seatId 한 흐름으로 대조할 수 있게
+      // 매니페스트 행의 자리 정체성과 산출 총량을 원장 이벤트에도 싣는다.
+      ...(row.seat ? { seat: row.seat } : {}),
+      ...(row.purpose ? { purpose: row.purpose } : {}),
+      outputBytesTotal: row.outputBytesTotal,
+      ...(row.lastControlAt === undefined ? {} : { lastControlAt: row.lastControlAt }),
+      ...(row.turnState ? { turnState: row.turnState, turnAt: row.turnAt } : {}),
     },
   });
   if (seq === 0) debug.log('pty.manifest', 'ledger-write-failed', { ptyId: row.id, event });

package/src/release-loop/checklist.ts

@@ -132,6 +132,28 @@ function mentionedPaths(text: string): string[] {
   return [...text.matchAll(PATH_TOKEN)].map((match) => match[1]!).filter((path) => !path.split('/').includes('..'));
 }
 
+/** `docs/goal-context/03-verification-menu.md` §선택 원칙: merge SHA·타입검사는 수용선이 아니다. */
+export const MERGE_OR_TYPECHECK_ONLY_REAL_WARNING = '- 완료 경계 실물: merge sha·타입검사만으로는 실물이 아니다 — docs/goal-context/03-verification-menu.md 에서 동작을 재는 방법을 고른다';
+/** 통합 이력·정적 타입 상태만 말하는 낱말(조사 뗀 꼴). 이 밖의 낱말이 하나라도 있으면 실물 주장으로 본다. */
+const MERGE_OR_TYPECHECK_WORD = /^(?:pr|merge|merged|머지|병합|착지|landed|land|sha|merge-sha|commit|커밋|origin|main|tsc|typecheck|type-check|typecheck-changed|타입검사|타입|검사|type|check|changed|통과|pass|passed|green|clean|errors?|error|오류|에러|없음|후|뒤|완료|확인|and|및|만|됨|된다)$/i;
+const MERGE_OR_TYPECHECK_SIGNAL = /^(?:merge|merged|머지|병합|착지|landed|land|sha|merge-sha|tsc|typecheck|type-check|타입검사)$/i;
+const KOREAN_PARTICLE_TAIL = /(?:했다|했음|하였다|했고|함|으로|로|이|가|은|는|을|를|와|과|에|의|만|됨|된|된다)$/u;
+
+/** 「완료 경계 실물」 값이 merge sha·PR 착지·타입검사 낱말로만 이뤄졌나(동작 관측이 하나도 없나). */
+export function isMergeOrTypecheckOnlyEvidence(value: string): boolean {
+  const words = value.split(/[\s.!?。…~`'"·,⊕+()[\]:;/=|→-]+/u).map((word) => word.replace(/^#/, '')).filter(Boolean);
+  if (!words.length) return false;
+  let signal = false;
+  for (const raw of words) {
+    if (/^\d+$/.test(raw) || /^[0-9a-f]{7,40}$/i.test(raw)) continue;
+    let word = raw;
+    for (let strip = 0; strip < 3 && !MERGE_OR_TYPECHECK_WORD.test(word); strip++) word = word.replace(KOREAN_PARTICLE_TAIL, '');
+    if (!MERGE_OR_TYPECHECK_WORD.test(word)) return false;
+    if (MERGE_OR_TYPECHECK_SIGNAL.test(word)) signal = true;
+  }
+  return signal;
+}
+
 /** Shadow check at checklist authorship. Callers supply the origin/main file probe and merged-PR file reader. */
 export function inspectChecklistTargetPaths(input: {
   title: string; evidence?: string; refs?: readonly string[]; dispatchKind?: ChecklistDispatchKind;
@@ -179,6 +201,8 @@ export function inspectChecklistTargetPaths(input: {
       if (!lines.some((line) => line.startsWith(`- 완료 경계 ${label}:`) && line.slice(`- 완료 경계 ${label}:`.length).trim()))
         warnings.push(`- 완료 경계 ${label}: 줄이 없다`);
     }
+    const real = lines.find((line) => line.startsWith('- 완료 경계 실물:'))?.slice('- 완료 경계 실물:'.length).trim();
+    if (real && isMergeOrTypecheckOnlyEvidence(real)) warnings.push(MERGE_OR_TYPECHECK_ONLY_REAL_WARNING);
   }
   if (!warnings.length) return { targets, warnings, candidates: [] };
   const sources = [input.title, input.evidence ?? '', ...(input.refs ?? [])].join('\n');