elanous 0.2.35 → 0.2.37

package/src/self-implement/headless-elanous-driver.ts

@@ -72,6 +72,12 @@ import { setEventLoopActivity } from '../debug/event-loop-watchdog.js';
 import { resolveEscalateTarget, resolveExplicitChildEscalateTarget } from './rework-policy.js';
 import { tailWithOmissionMarker } from './off-diff-evidence.js';
 import type { EscalateTier } from './rework-policy.js';
+
+const VERIFIED_PR_SUPERVISOR_INPUT = 'PR source already verified. Implement the requested repair in this worktree now.';
+
+function supervisorInputForSource(input: string, verifiedPrSource: boolean | undefined): string {
+  return verifiedPrSource ? VERIFIED_PR_SUPERVISOR_INPUT : input;
+}
 import { readRunLifecycleFromStateDir } from '../signal/lifecycle-bridge.js';
 import { lifecycleRootReportEnv, lifecycleRootReportPath, readLifecycleRootReport, removeLifecycleRootReport } from '../signal/lifecycle-root-report.js';
 import { compareLifecycleToScreen, type LifecycleScreenComparison } from './lifecycle-screen-scoreboard.js';
@@ -967,6 +973,8 @@ export interface HeadlessGoalLoopPtyOptions {
   sendOutbound?: typeof sendOutbound;
   /** Queues an argv child supervisor input for the orchestrator's next-round prompt; never writes stdin. */
   onSupervisorInput?: (text: string, updateDelivery: (delivery: SupervisorDeliveryState, reason?: string) => void) => void;
+  /** The Pod has already checked out its pinned PR source. Supervisor input must not relaunch it. */
+  verifiedPrSource?: boolean;
   /** ★ 턴 abort 신호(#21) — /cancel 이 이 신호를 abort 하면 호스팅 PTY 를 즉시 kill + 폴 루프 조기 종료
    *  (고아 자식 프로세스 방지). 미주입 시 종전대로 exit/GOAL-COMPLETE/타임아웃까지 폴. */
   signal?: AbortSignal;
@@ -1720,7 +1728,7 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                   // pipeline with a synthetic wait, whose evidence is honestly `action-wait`; calling
                   // the brain would violate the no-consultation boundary, while weakening brainCalls
                   // would hide that boundary instead of preserving it.
-                  const decision: ControlDecision = blockedWrite
+                  const suggestedDecision: ControlDecision = blockedWrite
                     ? { action: 'wait' }
                     : await Promise.race([
                     Promise.resolve(opts.brain.decide(controlObs, controller.signal)),
@@ -1735,6 +1743,13 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
                     }),
                     ...(parentAbort ? [parentAbort] : []),
                   ]);
+                  // The supervisor suggestion is untrusted text. In a PR-source Pod the
+                  // source was verified before this process started, so any proposed
+                  // input is reduced to an implementation instruction before it can
+                  // reach either the child queue or the parent progress surface.
+                  const decision: ControlDecision = opts.verifiedPrSource && suggestedDecision.action === 'input'
+                    ? { action: 'input', text: supervisorInputForSource(suggestedDecision.text, opts.verifiedPrSource) }
+                    : suggestedDecision;
                   const actionDetail = decision.action === 'input'
                     ? decision.text.slice(0, 120)
                     : decision.action === 'done' || decision.action === 'no-progress' ? decision.reason.slice(0, 120) : '';
@@ -2015,11 +2030,12 @@ export async function runHeadlessGoalLoopPty(opts: HeadlessGoalLoopPtyOptions):
       });
       if (artifactDecision.kind === 'escalate-terminal-success') {
         reachedCompletion = false;
+        const restartPacket = supervisorInputForSource(artifactDecision.restartPacket, opts.verifiedPrSource);
         debug.log('self-implement', 'headless.output-artifact-intervention', {
           ptyId, runId, kind: artifactDecision.kind, missing: artifactDecision.missing,
-          diagnostic: artifactDecision.diagnostic, restartPacket: artifactDecision.restartPacket,
+          diagnostic: artifactDecision.diagnostic, restartPacket,
         }, { level: 'warn' });
-        opts.onSupervisorInput?.(artifactDecision.restartPacket, () => {});
+        opts.onSupervisorInput?.(restartPacket, () => {});
       }
     }
     if (exitReason === 'loop-exhausted-without-completion' && reachedCompletion) {

package/src/self-implement/importer-test-index.ts

@@ -4,10 +4,42 @@ import ts from 'typescript';
 
 const IMPORTER_TEST_DISPLAY_LIMIT = 20;
 
+/** 런타임 간선 클래스 — 시험이 소스를 **실제 프로세스**·`git`·파일 상태로 건드리는 경우다.
+ *  임포트 그래프에는 이 간선이 «없다»: `import` 문이 없으니 `testsBySource` 에도 안 잡힌다. */
+export type RuntimeEdgeKind = 'spawn' | 'git' | 'file-state';
+
+/** 시험 1건이 만든 런타임 간선 1건. `source` 가 `null` 이면 그 명령은 파일을 지목하지 않는다(`git`). */
+export interface RuntimeEdge {
+  readonly test: string;
+  readonly kind: RuntimeEdgeKind;
+  readonly source: string | null;
+}
+
+/** 런타임 간선의 **영향 크기** — 임포트 그래프가 표현할 수 없는 간선이 변경 감시에 «얼마나 더하는가».
+ *
+ *  ⛔ #28322 착지분(BFS 분포·사람용 표)을 재구현하지 않는다 — 여기는 **수**만 낸다. */
+export interface RuntimeEdgeImpact {
+  /** 변경 소스에 «임포트가 아니라 런타임으로» 닿는 (시험, 소스) 짝의 수 — 임포트 그래프 위에 더해지는 크기. */
+  readonly pairs: number;
+  /** 클래스별 크기 — 그 클래스의 런타임 간선**만**이 변경 소스에 닿는 시험 수. */
+  readonly byKind: Readonly<Record<RuntimeEdgeKind, number>>;
+  /** 손으로 관리하는 착지 열차 spawn-lane 목록(`GATE_SPAWN_LANE_FILES`)이 **빠뜨린** 실측 시험들.
+   *  ⛔ 손 목록은 구조적으로 드리프트한다 — 그 드리프트 «크기»를 재는 자리다(고치지는 않는다). */
+  readonly unlistedSpawnLaneTests: readonly string[];
+  /** 실재 소스로 풀리지 않은 런타임 경로 리터럴 수 — `unresolvedRelativeSpecifiers` 와 «같은» 정직성 계수. */
+  readonly unresolvedRuntimeTargets: number;
+  /** 「쟀다」표 — `runtimeEdges` 가 없는 색인은 «못 잰 것»이므로 `measured: false` 다(`pairs: 0` 과 섞지 않는다). */
+  readonly measured: boolean;
+}
+
 export interface ImporterTestIndex {
   readonly testsBySource: ReadonlyMap<string, readonly string[]>;
   readonly testPaths?: readonly string[];
   readonly unresolvedRelativeSpecifiers: number;
+  /** 측정된 런타임 간선(선택) — 없으면 「안 쟀다」이지 「0건」이 아니다(`measureRuntimeEdgeImpact` 참조). */
+  readonly runtimeEdges?: readonly RuntimeEdge[];
+  /** 소스로 풀리지 않은 런타임 경로 리터럴 수(선택 · 위와 같은 이유로 optional). */
+  readonly unresolvedRuntimeTargets?: number;
 }
 
 // ⛔⭐ `\S+` 를 쓰지 않는다(무인 리뷰 should-fix) — 공백이 든 «유효한» 추적 경로가 «조용히» 빠진다.
@@ -80,10 +112,143 @@ export function sourceCandidates(testPath: string, specifier: string): readonly
   ];
 }
 
+/** 실물 자식 프로세스·파일 상태를 만드는 «런타임 모듈 임포트»의 호출 이름 → 클래스. ⛔⭐ 호출 이름의
+ *  마지막 조각만 보지 않는다(무인 리뷰 must-fix) — 수신 객체·맨살 callee 의 **임포트 바인딩** 출처를
+ *  확인한다(`runtimeEdgeImports`·`declaredRuntimeEdgeKind`). 그래서 `/re/.exec(str)`·`db.exec(...)`·
+ *  `fsMock.readFile(...)` 같은 일반 호출은 이 표와 «이름이 같아도» 간선이 되지 않는다. */
+const RUNTIME_EDGE_CALLS: Readonly<Record<string, RuntimeEdgeKind>> = {
+  spawn: 'spawn', spawnSync: 'spawn', exec: 'spawn', execSync: 'spawn', execFile: 'spawn', execFileSync: 'spawn',
+  readFile: 'file-state', readFileSync: 'file-state', writeFile: 'file-state', writeFileSync: 'file-state',
+  appendFileSync: 'file-state', copyFileSync: 'file-state', cpSync: 'file-state', renameSync: 'file-state',
+  existsSync: 'file-state', statSync: 'file-state', lstatSync: 'file-state', readdir: 'file-state',
+  readdirSync: 'file-state', mkdirSync: 'file-state', rmSync: 'file-state', unlinkSync: 'file-state',
+  accessSync: 'file-state', openSync: 'file-state', chmodSync: 'file-state', truncateSync: 'file-state',
+  readlinkSync: 'file-state', realpathSync: 'file-state',
+};
+
+/** URL·절대경로는 저장소 경로가 아니다 — 후보 해석에도, 「못 풀었다」에도 넣지 않는다. */
+function isRepoRelativeLiteral(literal: string): boolean {
+  if (!literal.includes('/')) return false;
+  if (literal.startsWith('/')) return false;
+  return !/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(literal);
+}
+
+/** 런타임 리터럴 → 실재 소스. 루트 기준 리터럴(`bin/elanous.mjs`)은 «상대 지정자»가 아니므로 `''` 를 기준점으로
+ *  쓴다 — 그래야 확장자·쿼리 규칙이 임포트 해석(`sourceCandidates`)과 **갈리지 않는다**. */
+function resolveRuntimeTarget(testPath: string, literal: string, sources: ReadonlySet<string>): string | null {
+  if (!isRepoRelativeLiteral(literal)) return null;
+  const candidates = literal.startsWith('.')
+    ? sourceCandidates(testPath, literal)
+    : [normalize(stripModuleQuery(literal)), ...sourceCandidates('', literal)];
+  return candidates.find((candidate) => sources.has(candidate)) ?? null;
+}
+
+interface RuntimeEdgeCall { readonly kind: RuntimeEdgeKind; readonly literals: readonly string[] }
+
+/** 런타임 간선을 만드는 모듈 — `node:` 접두사는 벗겨 비교한다. `Bun` 은 전역이라 임포트가 없고, 수신
+ *  객체 이름으로만 허용한다(`declaredRuntimeEdgeKind`). */
+const RUNTIME_EDGE_MODULES: ReadonlySet<string> = new Set(['child_process', 'fs', 'fs/promises', 'bun']);
+
+function isRuntimeEdgeModule(specifier: string): boolean {
+  return RUNTIME_EDGE_MODULES.has(specifier.startsWith('node:') ? specifier.slice('node:'.length) : specifier);
+}
+
+/** 시험 파일의 런타임 모듈 임포트 바인딩 — 로컬 이름 → 임포트된 이름(네임스페이스·기본 임포트는 `'*'`).
+ *  ⛔⭐ 임포트 출처를 알 수 없는 수신 객체는 간선을 만들지 «않는다»(무인 리뷰 must-fix) — `db.exec(...)`·
+ *  `fsMock.readFile(...)` 같은 호출 이름이 spawn·file-state 간선으로 승격되던 오탐을 고치는 자리다. */
+function runtimeEdgeImports(sourceFile: ts.SourceFile): ReadonlyMap<string, string> {
+  const bindings = new Map<string, string>();
+  for (const statement of sourceFile.statements) {
+    if (!ts.isImportDeclaration(statement) || !statement.moduleSpecifier || !ts.isStringLiteral(statement.moduleSpecifier)) continue;
+    if (!isRuntimeEdgeModule(statement.moduleSpecifier.text)) continue;
+    const clause = statement.importClause;
+    if (!clause) continue;
+    if (clause.name) bindings.set(clause.name.text, '*');
+    const named = clause.namedBindings;
+    if (!named) continue;
+    if (ts.isNamespaceImport(named)) bindings.set(named.name.text, '*');
+    else for (const element of named.elements) {
+      if (element.isTypeOnly) continue;
+      bindings.set(element.name.text, element.propertyName?.text ?? element.name.text);
+    }
+  }
+  return bindings;
+}
+
+/** 수신 객체·맨살 callee 가 런타임 모듈에서 왔는지 임포트 바인딩으로 확인하고, 그럴 때만 클래스를 낸다.
+ *  - `obj.method`: 수신 객체가 런타임 모듈 바인딩이거나 전역 `Bun` 일 때만.
+ *  - 맨살 `fn(...)`: 런타임 모듈의 named import 이고 «임포트된 이름»이 표에 있을 때만(`as` 별칭도 잡는다).
+ *  - 정규식 리터럴(`/re/.exec`)·출처를 알 수 없는 수신 객체는 `undefined` — 간선이 아니다. */
+function declaredRuntimeEdgeKind(callee: ts.Expression, imports: ReadonlyMap<string, string>): RuntimeEdgeKind | undefined {
+  if (ts.isPropertyAccessExpression(callee)) {
+    const receiver = callee.expression;
+    if (!ts.isIdentifier(receiver)) return undefined;
+    if (receiver.text !== 'Bun' && !imports.has(receiver.text)) return undefined;
+    return RUNTIME_EDGE_CALLS[callee.name.text];
+  }
+  if (ts.isIdentifier(callee)) {
+    const imported = imports.get(callee.text);
+    if (imported === undefined || imported === '*') return undefined;
+    return RUNTIME_EDGE_CALLS[imported];
+  }
+  return undefined;
+}
+
+/** 시험 소스에서 런타임 호출을 찾아 «무엇을 지목했는지»까지 모은다. */
+function runtimeEdgeCalls(text: string, path: string): RuntimeEdgeCall[] {
+  const sourceFile = ts.createSourceFile(path, text, ts.ScriptTarget.Latest, false);
+  const calls: RuntimeEdgeCall[] = [];
+  const literalsOf = (node: ts.Node, out: string[]): void => {
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) out.push(node.text);
+    else ts.forEachChild(node, (child) => literalsOf(child, out));
+  };
+  const runtimeImports = runtimeEdgeImports(sourceFile);
+  const visit = (node: ts.Node): void => {
+    if (ts.isCallExpression(node)) {
+      const declared = declaredRuntimeEdgeKind(node.expression, runtimeImports);
+      if (declared) {
+        const literals: string[] = [];
+        for (const argument of node.arguments) literalsOf(argument, literals);
+        // `git` 은 파일을 «지목하지 않는» 별도 클래스다(`spawnSync('git', ['diff', …])` · `execSync('git …')`).
+        const command = literals[0] ?? '';
+        calls.push({ kind: /^git\b/.test(command) ? 'git' : declared, literals });
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return calls;
+}
+
+/** 시험 1건의 런타임 간선과 «못 푼» 경로 리터럴. 지목한 소스가 하나도 없으면 `source: null` 간선 하나를 남긴다
+ *  — 파일을 안 지목해도 실물 프로세스를 띄운 사실은 사라지지 않는다. */
+function runtimeEdgesOfTest(text: string, testPath: string, sources: ReadonlySet<string>): { edges: RuntimeEdge[]; unresolved: readonly string[] } {
+  const edges: RuntimeEdge[] = [];
+  const unresolved: string[] = [];
+  for (const call of runtimeEdgeCalls(text, testPath)) {
+    const targets = call.literals.map((literal) => resolveRuntimeTarget(testPath, literal, sources));
+    call.literals.forEach((literal, position) => {
+      if (targets[position] !== null) return;
+      if (!isRepoRelativeLiteral(literal) || !isSourceLikeSpecifier(literal)) return;
+      // `.json`·`.css` 같은 자원은 «런타임 대상»이지 못 푼 소스가 아니다(`isSourceLikeSpecifier` 가 이미 거른다).
+      if (!unresolved.includes(literal)) unresolved.push(literal);
+    });
+    const resolved = targets.filter((target): target is string => target !== null);
+    for (const source of resolved.length > 0 ? resolved : [null]) edges.push({ test: testPath, kind: call.kind, source });
+  }
+  return { edges, unresolved };
+}
+
+/** 경로 정렬 — 기존 표시 순서(`localeCompare` 수치)와 같은 자를 쓴다. */
+function comparePaths(left: string, right: string): number { return left.localeCompare(right, undefined, { numeric: true }); }
+
 export function buildImporterTestIndex(cwd: string, testPaths: readonly string[], sourcePaths: readonly string[]): ImporterTestIndex | null {
   const sources = new Set(sourcePaths);
   const testsBySource = new Map<string, string[]>();
   let unresolvedRelativeSpecifiers = 0;
+  const runtimeEdges: RuntimeEdge[] = [];
+  const seenRuntimeEdges = new Set<string>();
+  const unresolvedRuntimeTargets = new Set<string>();
   for (const testPath of testPaths) {
     if (!TEST_PATH_RE.test(testPath)) continue;
     let text: string;
@@ -107,8 +272,16 @@ export function buildImporterTestIndex(cwd: string, testPaths: readonly string[]
       if (!importers.includes(testPath)) importers.push(testPath);
       testsBySource.set(source, importers);
     }
+    const runtime = runtimeEdgesOfTest(text, testPath, sources);
+    for (const edge of runtime.edges) {
+      const key = `${edge.test}\u0000${edge.kind}\u0000${edge.source ?? ''}`;
+      if (seenRuntimeEdges.has(key)) continue;
+      seenRuntimeEdges.add(key);
+      runtimeEdges.push(edge);
+    }
+    for (const literal of runtime.unresolved) unresolvedRuntimeTargets.add(`${testPath}\u0000${literal}`);
   }
-  return { testsBySource, testPaths, unresolvedRelativeSpecifiers };
+  return { testsBySource, testPaths, unresolvedRelativeSpecifiers, runtimeEdges, unresolvedRuntimeTargets: unresolvedRuntimeTargets.size };
 }
 
 export function importerTestsNotInRunSet(
@@ -117,7 +290,47 @@ export function importerTestsNotInRunSet(
   runSet: readonly string[],
 ): { readonly total: number; readonly files: readonly string[]; readonly truncated: boolean; readonly unresolvedRelativeSpecifiers: number } {
   const names = [...new Set(changed.flatMap((source) => index.testsBySource.get(source) ?? []).filter((test) => !runSet.includes(test)))]
-    .sort((left, right) => left.localeCompare(right, undefined, { numeric: true }));
+    .sort(comparePaths);
   const files = names.slice(0, IMPORTER_TEST_DISPLAY_LIMIT);
   return { total: names.length, files, truncated: names.length > files.length, unresolvedRelativeSpecifiers: index.unresolvedRelativeSpecifiers };
 }
+
+/** ⭐ 런타임 간선의 **영향 크기 실측** — 임포트 그래프가 «표현할 수 없는» 간선이 변경 감시에 얼마나 더하는가.
+ *
+ *  ⛔ #28322 착지분(BFS 분포·사람용 표 렌더링)은 여기서 재구현하지 않는다 — 이 함수는 **수**만 낸다.
+ *  ⛔ «색인이 안 실렸다»와 «런타임 간선 0건»은 다른 값이다: `runtimeEdges` 가 없는 색인은 `pairs: 0` 이
+ *    아니라 **못 잰 것**이므로 `measured: false` 로 드러낸다.
+ *
+ *  `handListed` 는 «손으로 관리하는 목록»이다(착지 열차의 `GATE_SPAWN_LANE_FILES`). 그 목록이 빠뜨린
+ *  실측 시험 수가 곧 착지 열차 소비자의 영향 크기다.
+ */
+export function measureRuntimeEdgeImpact(
+  index: ImporterTestIndex,
+  changed: readonly string[],
+  opts: { readonly handListed?: readonly string[] } = {},
+): RuntimeEdgeImpact {
+  const edges = index.runtimeEdges;
+  const changedSet = new Set(changed);
+  const pairs = new Set<string>();
+  const testsByKind: Record<RuntimeEdgeKind, Set<string>> = { spawn: new Set(), git: new Set(), 'file-state': new Set() };
+  for (const edge of edges ?? []) {
+    if (edge.source === null || !changedSet.has(edge.source)) continue;
+    // 이미 «임포트» 간선이 있는 짝은 런타임 간선의 몫이 아니다 — 같은 커버리지를 두 번 세지 않는다.
+    if ((index.testsBySource.get(edge.source) ?? []).includes(edge.test)) continue;
+    pairs.add(`${edge.test}\u0000${edge.source}`);
+    testsByKind[edge.kind].add(edge.test);
+  }
+  const handListed = new Set(opts.handListed ?? []);
+  const unlistedSpawnLaneTests = [...new Set((edges ?? [])
+    .filter((edge) => edge.kind === 'spawn' || edge.kind === 'git')
+    .map((edge) => edge.test))]
+    .filter((test) => !handListed.has(test))
+    .sort(comparePaths);
+  return {
+    measured: edges !== undefined,
+    pairs: pairs.size,
+    byKind: { spawn: testsByKind.spawn.size, git: testsByKind.git.size, 'file-state': testsByKind['file-state'].size },
+    unlistedSpawnLaneTests,
+    unresolvedRuntimeTargets: index.unresolvedRuntimeTargets ?? 0,
+  };
+}

package/src/self-implement/knowhow-pack.ts

@@ -42,8 +42,8 @@ function mentionedPaths(text: string): Set<string> {
   return paths;
 }
 
-function relevance(goal: string, section: string): number {
-  const paths = mentionedPaths(goal);
+function relevance(goal: string, section: string, targetPaths?: readonly string[]): number {
+  const paths = targetPaths === undefined ? mentionedPaths(goal) : new Set(targetPaths);
   const sourcePaths = mentionedPaths(section);
   let score = 0;
   for (const path of paths) {
@@ -58,8 +58,8 @@ function relevance(goal: string, section: string): number {
   return score;
 }
 
-/** Reads only 내부 문서 `KNOWHOW` inside the supplied repository. */
-export function selectKnowhowPack(repo: string, goal: string): KnowhowPack {
+/** Reads only 내부 문서 `KNOWHOW` inside the supplied repository. Verified target paths narrow relevance when supplied. */
+export function selectKnowhowPack(repo: string, goal: string, targetPaths?: readonly string[]): KnowhowPack {
   if (goal.includes(MARKER)) return { text: '', ids: [], bytes: 0 };
   const rolesDir = resolve(repo, 'docs/roles');
   let realRoles: string;
@@ -78,7 +78,7 @@ export function selectKnowhowPack(repo: string, goal: string): KnowhowPack {
       const real = realpathSync(file);
       if (!inside(realRoles, real) || !statSync(real).isFile() || statSync(real).size > 2_000_000) continue;
       for (const section of promotedSections(readFileSync(real, 'utf8'))) {
-        const score = relevance(goal, section.text);
+        const score = relevance(goal, section.text, targetPaths);
         if (score > 0) candidates.push({ ...section, score });
       }
     } catch { /* A missing or unreadable source contributes no entry. */ }

package/src/self-implement/off-diff-evidence.ts

@@ -3,6 +3,7 @@
 import { requirePosixShellCommand } from '../platform/default-shell.js';
 import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
+import { narrowerEvidenceCommand } from './evidence-command-budget.js';
 import { resolveRunIdentity } from '../harness/harness-space.js';
 //
 // ⛔ **왜 필요한가** — 리뷰어의 증거 채널은 워크트리 diff 하나다(`seams.ts` 의 `reviewDiff`).
@@ -320,14 +321,21 @@ export function authorLimitationCountFromGoal(goal: string): number {
  *  추론된다. 위 두 타입과 같은 규율이다(죽은 공개 표면은 계약처럼 읽힌다 · 리뷰 must-fix). */
 interface RequiredEvidenceCheckRun {
   readonly tag: string;
+  /** Command required by the authored goal, even if a diagnostic substitute ran. */
   readonly command: string;
+  /** Command actually run; absent when the timeout budget stopped execution. */
+  readonly executedCommand?: string;
   readonly exitCode: number | null;
   readonly stdout: string;
   /** EVIDENCE-WIRING-EXEMPT — `bun test` writes its «N pass / 0 fail» summary to stderr. */
   readonly stderr: string;
   readonly durationMs: number;
+  /** A narrower smoke check diagnoses the timeout but cannot prove the original requirement. */
+  readonly substitutedFor?: string;
 }
 
+type EvidenceCommandRunner = (command: string, cwd: string) => Pick<ReturnType<typeof spawnSync>, 'status' | 'stdout' | 'stderr' | 'error'>;
+
 /**
  * ★ `I-24` / `RUN-T6` — 골에서 **요구된 증거**를 읽는다. **순수**.
  *
@@ -394,7 +402,7 @@ export function goalDeclaresNoWiring(goal: string): boolean {
 
 /** A `bun test` check that ran its tests and failed none: rc 0 ⊕ «N pass» (N ≥ 1) ⊕ «0 fail» in its output. */
 function bunTestCheckPassed(run: RequiredEvidenceCheckRun): boolean {
-  if (run.exitCode !== 0 || !/(?:^|[\s;&|(])bun\s+(?:run\s+)?test\b/.test(run.command)) return false;
+  if (run.substitutedFor || run.exitCode !== 0 || !/(?:^|[\s;&|(])bun\s+(?:run\s+)?test\b/.test(run.executedCommand ?? run.command)) return false;
   const output = `${run.stdout}\n${run.stderr}`;
   return /(?:^|\n)\s*[1-9]\d*\s+pass\b/.test(output) && /(?:^|\n)\s*0\s+fail\b/.test(output);
 }
@@ -418,20 +426,46 @@ export function settleUncoveredEvidence(
 }
 
 /** 골 작성자가 요구 줄에 명시한 셸 체크를 하니스 worktree에서 관측한다. `bun test` 체크의 통과는
- *  settleUncoveredEvidence 가 그 요구의 덮임으로 받는다(EVIDENCE-WIRING-EXEMPT). */
-export function runRequiredEvidenceChecks(goal: string, cwd: string, runId?: string): RequiredEvidenceCheckRun[] {
+ *  settleUncoveredEvidence 가 그 요구의 덮임으로 받는다(EVIDENCE-WIRING-EXEMPT).
+ *  단독 호출에 timeoutCounts/headCommit을 주지 않으면 재시도 예산이 없다. 실제 라운드 호출자는
+ *  run 단위 createRequiredEvidenceBudget을 써야 HEAD 미확인 때도 임시 예산이 적용된다. */
+export function runRequiredEvidenceChecks(goal: string, cwd: string, runId?: string, options: {
+  timeoutCounts?: Map<string, number>;
+  headCommit?: string;
+  run?: EvidenceCommandRunner;
+} = {}): RequiredEvidenceCheckRun[] {
   const identity = resolveRunIdentity({ explicit: runId });
   const checks = requiredEvidenceFromGoal(goal).flatMap(({ tag, verifyCommand }) => verifyCommand ? [{ tag, command: verifyCommand }] : []);
+  // Direct callers without a measured HEAD have no stable revision identity;
+  // the run-owned wrapper supplies a temporary identity when appropriate.
+  const timeoutCounts = options.headCommit ? options.timeoutCounts : undefined;
+  const budgetKey = (command: string) => `${options.headCommit ?? ''}\0${command}`;
   const runs = checks.map(({ tag, command }) => {
     const startedAt = Date.now();
-    const result = spawnSync(requirePosixShellCommand('/bin/sh'), ['-c', command], { cwd, encoding: 'utf8', timeout: 180_000, maxBuffer: 32 * 1024 * 1024 });
+    const priorTimeouts = timeoutCounts?.get(budgetKey(command)) ?? 0;
+    const replacement = priorTimeouts >= 2 ? narrowerEvidenceCommand(command, cwd) : null;
+    const executedCommand = replacement ?? command;
+    const replacementTimeouts = replacement ? (timeoutCounts?.get(budgetKey(replacement)) ?? 0) : 0;
+    if (priorTimeouts >= 2 && (!replacement || replacementTimeouts >= 2)) {
+      try { debug.log('self-implement.evidence', 'command-budget-stop', { runId: identity.runId, command, replacement, timeoutCount: priorTimeouts, replacementTimeoutCount: replacementTimeouts }); } catch { /* observation is fail-soft */ }
+      return { tag, command, exitCode: null, stdout: '', stderr: 'Evidence command timed out twice; no further identical test run was attempted.', durationMs: 0 };
+    }
+    if (replacement) {
+      try { debug.log('self-implement.evidence', 'command-budget-switch', { runId: identity.runId, from: command, to: replacement, timeoutCount: priorTimeouts }); } catch { /* observation is fail-soft */ }
+    }
+    const result = options.run?.(executedCommand, cwd)
+      ?? spawnSync(requirePosixShellCommand('/bin/sh'), ['-c', executedCommand], { cwd, encoding: 'utf8', timeout: 180_000, maxBuffer: 32 * 1024 * 1024 });
+    const timedOut = result.error && 'code' in result.error && result.error.code === 'ETIMEDOUT';
+    if (timedOut && timeoutCounts) timeoutCounts.set(budgetKey(executedCommand), (timeoutCounts.get(budgetKey(executedCommand)) ?? 0) + 1);
     return {
       tag,
       command,
+      executedCommand,
       exitCode: result.status,
-      stdout: tailWithOmissionMarker(result.stdout ?? '', MAX_OFF_DIFF_EVIDENCE_RESULT_CHARS),
-      stderr: tailWithOmissionMarker(result.stderr ?? '', MAX_OFF_DIFF_EVIDENCE_RESULT_CHARS),
+      stdout: tailWithOmissionMarker(typeof result.stdout === 'string' ? result.stdout : result.stdout?.toString('utf8') ?? '', MAX_OFF_DIFF_EVIDENCE_RESULT_CHARS),
+      stderr: tailWithOmissionMarker(typeof result.stderr === 'string' ? result.stderr : result.stderr?.toString('utf8') ?? '', MAX_OFF_DIFF_EVIDENCE_RESULT_CHARS),
       durationMs: Date.now() - startedAt,
+      ...(replacement ? { substitutedFor: command } : {}),
     };
   });
   const observation = { count: runs.length, runs };
@@ -443,6 +477,24 @@ export function runRequiredEvidenceChecks(goal: string, cwd: string, runId?: str
   return runs;
 }
 
+/** One self-implement run owns this state; a changed HEAD starts a fresh budget. */
+export function createRequiredEvidenceBudget(options: { run?: EvidenceCommandRunner } = {}): (
+  goal: string, cwd: string, runId: string | undefined, headCommit: string | undefined,
+) => RequiredEvidenceCheckRun[] {
+  let previousHead: string | undefined;
+  const timeoutCounts = new Map<string, number>();
+  // This closure is created once per self-implement run. Its unresolved key
+  // bounds repeats within that run without pooling with another run or SHA.
+  const unresolvedRunHead = 'unresolved-head-within-this-run';
+  return (goal, cwd, runId, headCommit) => {
+    if (previousHead !== headCommit) {
+      timeoutCounts.clear();
+      previousHead = headCommit;
+    }
+    return runRequiredEvidenceChecks(goal, cwd, runId, { timeoutCounts, headCommit: headCommit ?? unresolvedRunHead, run: options.run });
+  };
+}
+
 /** 자식 프롬프트에 실을 요구 목록. 요구가 없으면 **아무 줄도 안 붙인다**(빈 계약을 만들지 않는다). */
 export function renderRequiredEvidencePrompt(items: readonly RequiredEvidenceItem[]): string[] {
   if (!items.length) return [];