elanous 0.2.35 → 0.2.37

package/src/self-implement/orchestrator.ts

@@ -40,6 +40,7 @@ import { writeGoalDocumentAtomic } from './goal-document-write.js';
 import { hostname, loadavg } from 'node:os';
 import { resolveHostId } from '../platform/host-id.js';
 import { resolveInstanceName } from '../instance-identity.js';
+import { ghAutomationEnv } from '../autopilot/pr-manager.js';
 import { citedReviewSymbols, MAX_CITED_REVIEW_SYMBOL_CHARS, measureReviewFindingKeyOverlap, normalizeReviewFindingKey, REVIEW_FINDING_KEY_VERSION, reviewFindingKey, shortNormalizedReviewFindingHash, type CitedReviewSymbol } from '../agent-substrate/review-finding-key.js';
 export { citedReviewSymbols, MAX_CITED_REVIEW_SYMBOL_CHARS, normalizeReviewFindingKey, REVIEW_FINDING_KEY_VERSION, reviewFindingKey, shortNormalizedReviewFindingHash, type CitedReviewSymbol } from '../agent-substrate/review-finding-key.js';
 
@@ -47,6 +48,46 @@ function displayBranchName(ref: string): string {
   return ref.trim().replace(/^refs\/heads\//, '').replace(/^origin\//, '');
 }
 
+export const HARVEST_DEFERRED_MARKER = '수확보류: harvest-deferred';
+const execFileAsync = promisify(execFileCallback);
+
+export function markHarvestDeferredBody(input: {
+  runStatus: string | undefined;
+  prNumber: number | undefined;
+  body: string | undefined;
+}): string | undefined {
+  if (input.runStatus !== 'failed' || input.prNumber === undefined || !Number.isSafeInteger(input.prNumber) || input.prNumber < 1 || input.body === undefined) return undefined;
+  if (harvestDeferredMarker(input.body)) return input.body;
+  const separator = input.body.endsWith('\n') ? '\n' : '\n\n';
+  return `${input.body}${separator}${HARVEST_DEFERRED_MARKER}`;
+}
+
+export async function readHarvestPrBody(opts: { number: number; cwd: string }): Promise<{ body: string; state: string; isDraft: boolean } | undefined> {
+  const { stdout } = await execFileAsync('gh', ['pr', 'view', String(opts.number), '--json', 'body,state,isDraft'], {
+    cwd: opts.cwd,
+    env: ghAutomationEnv(process.env),
+    encoding: 'utf8',
+    timeout: 120_000,
+    maxBuffer: 2 * 1024 * 1024,
+  });
+  const parsed: unknown = JSON.parse(stdout);
+  if (!parsed || typeof parsed !== 'object') return undefined;
+  const record = parsed as { body?: unknown; state?: unknown; isDraft?: unknown };
+  return typeof record.body === 'string' && typeof record.state === 'string' && typeof record.isDraft === 'boolean'
+    ? { body: record.body, state: record.state, isDraft: record.isDraft }
+    : undefined;
+}
+
+export async function updateHarvestPrBody(opts: { number: number; body: string; cwd: string }): Promise<void> {
+  await execFileAsync('gh', ['pr', 'edit', String(opts.number), '--body', opts.body], {
+    cwd: opts.cwd,
+    env: ghAutomationEnv(process.env),
+    encoding: 'utf8',
+    timeout: 120_000,
+    maxBuffer: 2 * 1024 * 1024,
+  });
+}
+
 export function formatAutoMergeSuccessMessage(input: {
   prNumber: number;
   mergedBase?: string | undefined;
@@ -68,6 +109,7 @@ import { getUserConfig } from '../user-config.js';
 import { appendRunLedgerEntry, loadRunLedger, parseRunShardIdentity, queryRunChain, type RunChainShardSibling, type RunLedgerEntry, type RunLedgerWriter, type RunOriginData, type RunShardIdentity } from './run-ledger.js';
 import { classifyMergeHoldStop, forgetRunStop, isRunStopClass, readRunStopRecord, recordRunStop, runStopRecorded } from './run-stop.js';
 import { autohealFromStop, parseAutohealMode, type AutohealActions, type AutohealResult } from './stop-autoheal.js';
+import { recordParentNeedsOwnerVisit } from './doctor-visit.js';
 import { emitSessionEvent, type SessionEventInput } from '../context-bus/session-events.js';
 import { decideLineageSupersede, lineageSupersedeCloseComment, type LineageSupersedeOpenDraft } from './lineage-supersede.js';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
@@ -79,6 +121,7 @@ import { classifyGateEnvDeficit, DEFAULT_GATE_ENV_RETRY, GATE_ENV_DEFICIT_HARVES
 import { recordFailureEvent } from './heal-intake.js';
 import { classifyReworkCapExhaustion, type ReworkCapHealDecision } from './heal-triage.js';
 import { releasePathHold, releasePathHoldComment, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
+import { harvestDeferredMarker } from '../self-dev/draft-triage-rules.js';
 import { emitDecision } from '../live/detail-switch.js';
 import { reworkDecision } from './decision-events.js';
 import type { LogSink } from '../mss/logging/sink.js';
@@ -91,7 +134,7 @@ import { classifyError } from '../session-runtime/retry-policy.js';
 import { decomposeSelfDevGoal, inferHotPaths, type SelfDevDecomposeOptions } from '../self-dev/decompose.js';
 import { boundaryGlobs, boundaryViolations } from './goal-boundary.js';
 import { askAtExecution, type ExecutionClarificationResult } from './execution-clarification.js';
-import { decideScopeExpansion, renderScopeExpansionSection, SCOPE_EXPANSION_CAP, type ScopeExpansion } from './scope-adjacency.js';
+import { decideScopeExpansion, renderScopeExpansionSection, SCOPE_EXPANSION_CAP, type ScopeExpansion, type ScopeStopReason } from './scope-adjacency.js';
 import { targetScopedGoalText } from './goal-text-path-scope.js';
 import { selectKnowhowPack } from './knowhow-pack.js';
 import { declaredNewFilePaths } from './goal-new-paths.js';
@@ -175,7 +218,7 @@ function onePrChecklistLine(body: string): string {
 }
 import { renderRoundSummaryCard, type RoundSummaryEntry } from './round-summary-card.js';
 import { computeFlexSignals } from './flex-signals.js';
-import { resolveAdaptiveMaxReworkDecision, resolveEscalateTier, resolveEscalateTarget, buildReworkFeature, failIndicator, isRepeatedUnverifiedOnlyGateFailure, unverifiedRepeatKey, appendReworkHistory, truncateReworkHistoryByItem, applyReworkBudgetDecision, parseContractConflictRelaxation, parseReworkBudgetDecision, resolveReworkBudgetCarry, stripReworkBudgetHeaders, countConsecutiveMustFixIds, mergeReworkNotes, resolveReworkKind, type ReworkPlanRevision, type ReworkNotePart } from './rework-policy.js';
+import { resolveAdaptiveMaxReworkDecision, resolveEscalateTier, resolveEscalateTarget, buildReworkFeature, failIndicator, isRepeatedUnverifiedOnlyGateFailure, unverifiedRepeatKey, appendReworkHistory, truncateReworkHistoryByItem, applyReworkBudgetDecision, parseContractConflictRelaxation, parseReworkBudgetDecision, resolveReworkBudgetCarry, stripReworkBudgetHeaders, countConsecutiveMustFixIds, mergeReworkNotes, resolveReworkKind, decideReviewRound, type ReviewRoundDecision, type ReworkPlanRevision, type ReworkNotePart } from './rework-policy.js';
 import type { SupervisionReworkSource } from './supervision-vocabulary.js';
 import { classifyReworkBudgetShadow } from './classify-shadow.js';
 import { createReworkBudgetJudgment, REWORK_BUDGET_JUDGMENT, reworkBudgetEvidenceForObservation, reworkBudgetWorkflow } from './rework-budget-judgment.js';
@@ -183,7 +226,8 @@ import { formatGateFailedId, type PremiseReviewCard, type PremiseReviewInput } f
 import { runWorkflowToCompletion } from '../workflow-runtime/executor.js';
 import { mapReworkVerdict, supervisionObservationFields } from './supervision-vocabulary.js';
 import { resolveRunOutcome } from './run-outcome.js';
-import { authorLimitationCountFromGoal, harvestEvidenceLines, harvestedEvidenceObservation, MAX_HARVESTED_EVIDENCE_CHARS, parseOffDiffEvidence, requiredEvidenceFromGoal, runRequiredEvidenceChecks, coverRequiredEvidence, settleUncoveredEvidence, formatUncoveredEvidenceFeedback, type OffDiffEvidenceParse } from './off-diff-evidence.js';
+import { authorLimitationCountFromGoal, harvestEvidenceLines, harvestedEvidenceObservation, MAX_HARVESTED_EVIDENCE_CHARS, parseOffDiffEvidence, requiredEvidenceFromGoal, createRequiredEvidenceBudget, coverRequiredEvidence, settleUncoveredEvidence, formatUncoveredEvidenceFeedback, type OffDiffEvidenceParse } from './off-diff-evidence.js';
+import { resolveEvidenceHeadCommit } from './evidence-command-budget.js';
 import { pressDecisionSignals, type DecisionSignalPressResult } from './decision-signal-press.js';
 import { inspectDecisionObservations, inspectDecisionSignalKinds, inspectDecisionSignalObservations } from '../../scripts/ask-marker-check.js';
 
@@ -257,7 +301,9 @@ import type { ClassifyShadowCallLLM } from './classify-shadow.js';
 import { hasModuleLoadFailure, type GateTestFailure } from './gate-baseline.js';
 import { commitWorktree, defaultBranchRef, preservationHasChanges } from './seams.js';
 import { detectUncommittedWork } from './uncommitted-work.js';
-import { spawnSync } from 'node:child_process';
+import { execFile as execFileCallback, spawnSync } from 'node:child_process';
+import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
+import { promisify } from 'node:util';
 import { blockedDraftDisposition, blockedDraftTargetFor, decideDraftOnStop, nextMoveFor, parseDraftOnStopMode, repairSalvageLinkComment, salvageBranchForRun, syntheticRepairBasePr, type DraftOnStopMode } from './blocked-draft-policy.js';
 import { formatLlmMergeOutcome } from '../autopilot/build/llm-conflict-merge.js';
 import { FOUND_CITED_PATH_REFUTATION_QUOTE, MISSING_CITED_PATH_REFUTATION_QUOTE, MUST_FIX_REFUTATION_ACKNOWLEDGEMENT_WITH_REASON, REFUTATION_QUOTE_GRAMMAR, observeMustFixCitedPaths, parseMustFixRefutationAcknowledgement, parseMustFixRefutations, renderMustFixCitedPathFacts, snapshotMustFixFindings, stableMustFixId, type ReflectEvidenceFacts, type ReflectGateFacts, type MustFixCitedPathFact, type MustFixFinding, type MustFixRecurrenceHistory, type MustFixRefutation, type MustFixRefutationKind } from './reflect-mustfix.js';
@@ -281,6 +327,7 @@ import { appendGateWorktreeFreshnessEvidence, gateEvidenceNote } from '../harnes
 import { diffHeaderPaths } from '../agent-substrate/self-review-cli.js';
 import { format as formatPrComment, type PrCommentRole } from '../agent-substrate/pr-comment-meta.js';
 import { changedFiles, commitTitles, type OpenPrOutcome, type SelfImplementCompletionDisposition } from './seams.js';
+import { findUnwiredExports, gitBaseFileReader } from './wiring-check.js';
 import {
   classifyAbandonedRun,
   isAbandonedClassificationOutcome,
@@ -291,6 +338,7 @@ import {
 export type { QuotaAccountAvailabilityEvidence };
 import { decideReworkSalvage, type ReworkSalvageEvidence } from './rework-salvage.js';
 import { type SupervisorGoalFillEvidence, fillUnverifiableGoalSlots, type SupervisorGoalFillResult } from './goal-supervisor-fill.js';
+import { repairNextMove } from '../task-agent/repair-next-move.js';
 import { escalateGoalDocumentClarifications, recordSupervisorPlanRevision, type GoalClarificationEscalationResult, type SupervisorPlanRevisionRelaxation, type SupervisorPlanRevisionResult } from './goal-clarification-escalation.js';
 import { parseGoalDocumentClarifications, selfAnswerGoalDocumentClarifications, type GoalClarificationSelfResolver } from './goal-author-clarification.js';
 import {
@@ -1008,6 +1056,7 @@ export type ImplementTerminalStatus = {
 export interface SelfImplementSeams {
   /** Run-observer ledger sink. Tests inject an in-memory sink to avoid touching user state. */
   writeRunLedger?: RunLedgerWriter;
+  checkUnwiredExports?: typeof findUnwiredExports;
   /** STOP-AUTOHEAL — heal action seams (live mode only runs actions given here; missing = needs-owner). */
   stopAutohealActions?: AutohealActions;
   /** STOP-AUTOHEAL — one-attempt guard reader. Default: real run ledger, or none when `writeRunLedger` is injected. */
@@ -1159,6 +1208,8 @@ export interface SelfImplementSeams {
   /** Test seam for blocked environment branch persistence; return whether the branch was pushed. */
   /** Test seam — the worktree commit to pin before main sync (default `git rev-parse HEAD`). */
   headCommit?: (cwd: string) => string | undefined;
+  /** Test seam for required evidence command execution; production uses its bounded shell runner. */
+  evidenceCommandRunner?: (command: string, cwd: string) => Pick<ReturnType<typeof spawnSync>, 'status' | 'stdout' | 'stderr' | 'error'>;
   /** `commit` pins the pushed state; without it the worktree HEAD is pushed. */
   preserveBlockedBranch?: (ctx: { cwd: string; branch: string; title: string; commit?: string }) => boolean | Promise<boolean>;
   /** DRAFT-NOT-ARCHIVE — `tools.selfImplement.draftOnStop` 읽기 seam. 생략하면 user-config(실패·부재 = 'always' · 종전). */
@@ -1173,11 +1224,17 @@ export interface SelfImplementSeams {
   openPr: (opts: { title: string; body: string; head: string; base?: string; draft?: boolean; labels?: string[]; cwd: string; runId?: string }) => Promise<OpenPrOutcome>;
   /** PR 생성 뒤 런의 라운드 대화를 게시한다. 실패는 PR 개설을 되돌리지 않는다. */
   postPrComment?: (opts: { number: number; body: string; cwd: string }) => Promise<void>;
+  /** Read-only body/state confirmation for the failed-run draft preservation marker. */
+  readPrBodyForHarvest?: (opts: { number: number; cwd: string }) => Promise<{ body: string; state: string; isDraft: boolean } | undefined>;
+  /** Update only the confirmed existing PR body; never creates a PR. */
+  updatePrBodyForHarvest?: (opts: { number: number; body: string; cwd: string }) => Promise<void>;
   /** Read and edit the single marked status comment; missing seams fall back to individual comments. */
   findPrComment?: (opts: { number: number; marker: string; cwd: string; comments?: unknown }) => Promise<{ id: number; body: string } | undefined>;
   editPrComment?: (opts: { id: number; body: string; cwd: string }) => Promise<void>;
   addPrLabel?: (opts: { number: number; label: string; cwd: string }) => Promise<void>;
   readPrFiles?: (opts: { number: number; cwd: string; base?: string }) => Promise<string[]>;
+  /** Read the authoritative GitHub head branch and creation timestamp before run attribution. */
+  readPrAttribution?: (opts: { number: number; cwd: string }) => Promise<{ headRefName: string; createdAt: string }>;
   /** PR의 base/head SHA와 관측된 PR base를 한 응답에서 고정한다. 미주입·실패·빈 SHA면 검사 대상을 증명할 수 없어 fail-closed로 PR을 열어 둔다. */
   readPrCommitShas?: (opts: { number: number; cwd: string }) => Promise<{ baseCommit: string; headCommit: string; baseRefName?: string }>;
   /** 고정한 base/head SHA 쌍의 unified diff. 가변 PR 조회를 다시 사용하면 ABA head 변경에 안전하지 않으므로 두 SHA는 필수 입력이다. */
@@ -2333,6 +2390,8 @@ export interface SelfImplementResult {
   scopeExpansion?: ScopeExpansion;
   /** Bounded names measured by the execution-scope guard on a held edit. */
   outOfScopeEdits?: string[];
+  /** SCOPE-ESCAPE-AS-REFINE: why the held edit stops (deletion · protected path · cap) — the parent stops only on these. */
+  scopeStopReasons?: ScopeStopReason[];
   nameCapReached?: boolean;
   outsideCount?: number;
   gate?: SelfImplementGateResult;
@@ -3507,6 +3566,17 @@ async function autohealRecordedStop(stopEntry: RunLedgerEntry, s: SelfImplementS
       ...(loadLedger ? { loadLedger } : {}),
       ...(s?.writeRunLedger ? { writeLedger: s.writeRunLedger } : {}),
     });
+    if (result.action === 'needs-owner') {
+      try {
+        const stopKey = JSON.stringify([stopEntry.timestamp, record.site ?? '', record.class, record.cause, record.evidenceRef]);
+        const visit = recordParentNeedsOwnerVisit({ runId: stopEntry.runId, stopKey, evidence: result.reason ?? record.cause });
+        if (visit.status === 'missing-ledger') {
+          debug.log('run-doctor', 'visit-failed', { runId: stopEntry.runId, from: 'parent', symptom: 'needs-owner', error: 'run-ledger-missing' });
+        }
+      } catch (error) {
+        try { debug.log('run-doctor', 'visit-failed', { runId: stopEntry.runId, from: 'parent', symptom: 'needs-owner', error: error instanceof Error ? error.message : String(error) }); } catch { /* fail-soft */ }
+      }
+    }
     s?.onStopAutoheal?.(result);
   } catch (error) {
     try { debug.log('self-implement.autoheal', 'dispatch-failed', { runId: stopEntry.runId, error: error instanceof Error ? error.message : String(error) }); } catch { /* fail-soft */ }
@@ -3760,6 +3830,7 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
   reworkCapProceed = false;
   const progressDelivery = { delivered: 0, unwired: 0, callbackFailed: 0 };
   let capturedPrNumber: number | undefined;
+  let prAttributionMismatch = false;
   let openPrInvoked = false;
   const defaultProviderName = opts.seams.currentProviderName?.() ?? currentProviderName();
   const runProviderName = opts.childLlm?.provider ?? defaultProviderName;
@@ -3778,8 +3849,6 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
         openPrInvoked = true;
         const pr = await opts.seams.openPr(args);
         if (pr.rebind) debug.log('self-implement.same-cell', 'rebind-result', pr.rebind);
-        const number = recordedPrNumber(pr.number);
-        if (number !== undefined) capturedPrNumber = number;
         return pr;
       },
       onProgress: (event) => {
@@ -4213,6 +4282,9 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
       hasCurrentCredentialFailure,
       (commit: string | undefined) => { finishedImplementationAtMainSync = true; preSyncCommit = commit; },
       preserveMergeHarvest,
+      startedAtMs,
+      (number) => { capturedPrNumber = number; },
+      () => { prAttributionMismatch = true; },
     );
     terminalNode = result.node;
     await mergeChildProviderErrors();
@@ -4257,6 +4329,22 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
       // ⛔ 이 스코프엔 `progress` 헬퍼가 «없다»(3695행 · 다른 스코프) — seam 을 직접 쓴다.
       progress: (stage, message) => { try { opts.seams.onProgress?.({ stage, message }); } catch { /* best-effort */ } },
     });
+    if (addressedResult.abandonedClassification?.classification === 'report-deficit') {
+      const classification = addressedResult.abandonedClassification;
+      const basis = classification.classificationBasis;
+      const kind = basis === 'terminal-state-not-reviewed' || basis === 'review-result-observation-unmeasured'
+        ? 'unmeasured' as const : 'unverified' as const;
+      const previousEvidence = JSON.stringify({ classification, stage: addressedResult.stage,
+        review: addressedResult.review ?? null, gate: addressedResult.gate ?? null });
+      const deficit = { evidenceId: `report:${runId}:${basis}`, kind, previousEvidence, round: roundCount };
+      observeOuter('supervisor-report-deficit', { ...deficit, supervisorResult: 'unverifiable', classification });
+      if (deficit.kind !== 'unverified') {
+        const move = repairNextMove({ supervisorDeficit: deficit, supervisorResult: 'unverifiable' });
+        if (move.kind === 'grounding') observeOuter('repair-next-move-input', {
+          ...move.supervisorDeficit, supervisorResult: 'unverifiable', action: move.action, classification,
+        });
+      }
+    }
     observeRunOutcome(observeOuter, {
       node: addressedResult.node,
       stage: addressedResult.stage,
@@ -4294,7 +4382,7 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
         ...terminalDetail(addressedResult.sessionId),
       },
     });
-    observeRunRollup(observeOuter, addressedResult, roundClassifications, roundCount, capturedPrNumber, openPrInvoked);
+    observeRunRollup(observeOuter, prAttributionMismatch ? { ...addressedResult, prNumber: undefined } : addressedResult, roundClassifications, roundCount, capturedPrNumber, openPrInvoked);
     observeProgressDelivery();
     return terminalResult;
   } catch (e) {
@@ -4369,7 +4457,7 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
           ...terminalDetail(addressedResult.sessionId ?? terminalSessionId),
         },
       });
-      observeRunRollup(observeOuter, addressedResult, roundClassifications, roundCount, capturedPrNumber, openPrInvoked);
+      observeRunRollup(observeOuter, prAttributionMismatch ? { ...addressedResult, prNumber: undefined } : addressedResult, roundClassifications, roundCount, capturedPrNumber, openPrInvoked);
       observeProgressDelivery();
       return terminalResult;
     }
@@ -4394,6 +4482,50 @@ export async function runSelfImplement(opts: SelfImplementOptions): Promise<Self
   } finally {
     if (loopRegistered) registerRunLoop('ended');
     const terminalStage = terminalResult?.stage ?? 'crashed';
+    // A blocked draft may be opened on the first failed attempt, before the
+    // normal outcome observer has written its terminal status. Persist the
+    // actual terminal result before exposing harvest-deferred on that PR.
+    const terminalOutcome = terminalResult ? mapStageToRunStatus(terminalStage) : undefined;
+    if (terminalOutcome?.runStatus === 'failed'
+      && loadRunLedger(runId)?.filter((entry) => entry.event === 'run-status').at(-1)?.data.runStatus !== 'failed') {
+      observeOuter('run-status', {
+        stage: terminalStage, node: terminalResult?.node ?? null, ...terminalOutcome,
+        ...(terminalResult?.reviewReflectRejectedCount !== undefined
+          ? { reviewReflectRejectedCount: terminalResult.reviewReflectRejectedCount }
+          : {}),
+      }, { level: 'warn' });
+    }
+    try {
+      const runStatus = terminalOutcome?.runStatus;
+      const prNumber = recordedPrNumber(terminalResult?.prNumber) ?? capturedPrNumber;
+      // openPr is required on every seam (including production); it cannot
+      // distinguish test PRs from real ones. The production adapter explicitly
+      // supplies both body operations. A test replacing openPr without both
+      // body operations must fail closed instead of touching a real PR.
+      const readPrBody = opts.seams.readPrBodyForHarvest;
+      const updatePrBody = opts.seams.updatePrBodyForHarvest;
+      // The terminal observer must have persisted this run's failure before a
+      // draft can advertise harvest deferral. Even an injected writer must
+      // leave a matching record in the canonical ledger before mutation.
+      const lastPersistedStatus = loadRunLedger(runId)?.filter((entry) => entry.event === 'run-status').at(-1)?.data.runStatus;
+      const persistedFailure = runStatus === 'failed' && lastPersistedStatus === 'failed';
+      if (persistedFailure && prNumber !== undefined && readPrBody && updatePrBody) {
+        const existing = await readPrBody({ number: prNumber, cwd: worktreePath ?? process.cwd() });
+        if (existing?.state === 'OPEN' && existing.isDraft === true) {
+          const markedBody = markHarvestDeferredBody({ runStatus, prNumber, body: existing.body });
+          if (markedBody !== undefined && markedBody !== existing.body) {
+            await updatePrBody({ number: prNumber, body: markedBody, cwd: worktreePath ?? process.cwd() });
+            observeOuter('harvest-deferred', { runStatus, prNumber, marker: HARVEST_DEFERRED_MARKER });
+          }
+        } else {
+          observeOuter('harvest-deferred-skipped', { runStatus, prNumber, reason: 'existing-draft-not-confirmed' }, { level: 'warn' });
+        }
+      } else {
+        observeOuter('harvest-deferred-skipped', { runStatus: runStatus ?? null, prNumber: prNumber ?? null, reason: 'status-pr-body-seam-unavailable' }, { level: 'warn' });
+      }
+    } catch (error) {
+      logRunAwareFailSoft(runId, 'harvest-deferred-failed', { error: safeErrorDescription(error) });
+    }
     try {
       const mappedStatus = mapStageToRunStatus(terminalStage)?.runStatus;
       const reworkCapStop = terminalResult?.stage === 'pr-opened' && (
@@ -4741,7 +4873,26 @@ export function observeRunOutcome(
 type RollupPrNumber = number | 'none' | 'unknown';
 
 function recordedPrNumber(value: unknown): number | undefined {
-  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+
+/** GitHub's second-precision createdAt cannot distinguish events within that second. */
+export function prCreatedInRunWindow(createdAt: string, startedAtMs: number): boolean {
+  const createdAtMs = Date.parse(createdAt);
+  if (!Number.isFinite(createdAtMs) || !Number.isFinite(startedAtMs)) return false;
+  const secondPrecision = !/\.\d+(?:Z|[+-]\d\d:\d\d)$/.test(createdAt);
+  return createdAtMs >= (secondPrecision ? Math.floor(startedAtMs / 1_000) * 1_000 : startedAtMs);
+}
+
+function prAttributedToRun(
+  attribution: { headRefName: string; createdAt: string }, branch: string, startedAtMs: number,
+  boundCardReuse: { headRefName: string } | undefined,
+): boolean {
+  if (attribution.headRefName !== (boundCardReuse?.headRefName ?? branch)) return false;
+  // A verified same-card PR predates this run. The production seam exposes the
+  // exception only after the manager verifies card, PR identity, and leased push.
+  return prCreatedInRunWindow(attribution.createdAt, startedAtMs)
+    || (!!boundCardReuse && Number.isFinite(Date.parse(attribution.createdAt)));
 }
 
 function rollupPrNumber(
@@ -4839,6 +4990,9 @@ async function runSelfImplementInner(
   hasCurrentCredentialFailure: () => boolean = hasCredentialFailure,
   onMainSyncStarted: (commit: string | undefined) => void = () => {},
   preserveMergeHarvest: (reason: string, inputChars?: number) => Promise<boolean> = async () => false,
+  startedAtMs = Date.now(),
+  onPrAttributed: (number: number) => void = () => {},
+  onPrAttributionMismatch: () => void = () => {},
 ): Promise<Omit<SelfImplementResult, 'runId'>> {
   const s = opts.seams;
   const pipelineStartedAtMs = Date.now();
@@ -4869,7 +5023,7 @@ async function runSelfImplementInner(
     const { graphVersionHash } = await import('./graph-yaml.js');
     const { applyGraphOverlays } = await import('./graph-overlay-yaml.js');
     const { createGraphVariant } = await import('./graph-variant.js');
-    const { runLedgerPath } = await import('./run-ledger.js');
+    const { saveRunGraphVariant, loadRunGraphVariant } = await import('./run-ledger.js');
     const { stringify } = await import('yaml');
     const baseSpec = GRAPH_SPECS[graphTemplate.graphId];
     const variantRunId = identity?.runId ?? opts.runId;
@@ -4881,16 +5035,16 @@ async function runSelfImplementInner(
       : undefined;
     if (launch && !launch.ok) throw new Error(`graph variant rejected: ${JSON.stringify(launch.rejections)}`);
     const sourceSpec = launch?.ok ? launch.template : baseSpec;
-    const variant = createGraphVariant({ template: sourceSpec, goal: `g_${variantRunId.replace(/[^a-z0-9_-]/gi, '_')}`, plan: opts.graphVariantPlan });
+    // ⭐ 최초 변형 선택 — 골 종류(graphGoalType)·대상 경로 수(declaredPremiseScopePaths) 두 입력만으로
+    //   결정론적으로 id·선택 이유를 유도해 검증 결과에 싣는다(종류를 못 읽었으면 지어내지 않는다).
+    const variant = createGraphVariant({ template: sourceSpec, goal: `g_${variantRunId.replace(/[^a-z0-9_-]/gi, '_')}`, plan: opts.graphVariantPlan,
+      ...(graphGoalType === undefined ? {} : { goalAnalysis: { goalType: graphGoalType, targetPathCount: declaredPremiseScopePaths(opts.feature).length } }) });
     if (!variant.ok) throw new Error(`graph variant rejected: ${JSON.stringify(variant.rejections)}`);
     variantSpec = variant.template;
     graphTemplate = { ...specToTemplate(variantSpec), version: graphVersionHash(variantSpec) };
-    const { runLedgerDir } = await import('./run-ledger.js');
-    const graphFile = `${runLedgerPath(variantRunId)}.graph.yaml`;
-    mkdirSync(runLedgerDir(), { recursive: true });
-    const { writeFileSync } = await import('node:fs');
-    writeFileSync(graphFile, stringify({
+    const graphFile = saveRunGraphVariant(variantRunId, stringify({
       graph_id: variantSpec.graphId, version: variantSpec.version,
+      ...(variant.selection === undefined ? {} : { variant_id: variant.selection.variantId, reason: variant.selection.reason }),
       entry_node: variantSpec.entryNode, terminal_nodes: variantSpec.terminalNodes,
       ...(variantSpec.journeyStages ? { journey_stages: variantSpec.journeyStages } : {}),
       ...(variantSpec.runContract ? { run_contract: variantSpec.runContract } : {}),
@@ -4900,6 +5054,9 @@ async function runSelfImplementInner(
         ...(n.progress ? { progress: n.progress } : {}), ...(n.phases ? { phases: n.phases } : {}),
         ...(n.terminalStages ? { terminal_stages: n.terminalStages } : {}),
         ...(n.fanOut ? { fan_out: n.fanOut } : {}), ...(n.contract ? { contract: n.contract } : {}),
+        ...(n.call ? { call: n.call } : {}),
+        ...(n.callEntry ? { call_entry: n.callEntry } : {}),
+        ...(n.budget ? { budget: { inner_steps: n.budget.innerSteps } } : {}),
         ...(n.skipWhen ? { skip_when: n.skipWhen } : {}),
       })),
       edges: variantSpec.edges.map(e => ({
@@ -4908,9 +5065,17 @@ async function runSelfImplementInner(
         ...(e.observed === undefined ? {} : { observed: e.observed }),
         ...(e.when ? { when: e.when } : {}),
       })),
-    }), { flag: 'wx' });
+    }));
+    // ⭐ 저장·diff — 방금 원장 옆에 쓴 선택(id·이유)을 다시 읽어 «같은지» 확인한다(다르면 이 런의 그래프 신원이 거짓).
+    if (variant.selection !== undefined) {
+      const persisted = loadRunGraphVariant(variantRunId);
+      if (persisted === null || persisted.variantId !== variant.selection.variantId || persisted.reason !== variant.selection.reason) {
+        throw new Error(`graph variant rejected: persisted selection mismatch: ${JSON.stringify(persisted)}`);
+      }
+    }
     observe('graph-variant-applied', { graphId: variant.template.graphId, overlayId: variant.overlay.overlayId,
-      graphFile, patches: variant.patches });
+      graphFile, patches: variant.patches,
+      ...(variant.selection === undefined ? {} : { variantId: variant.selection.variantId, variantReason: variant.selection.reason }) });
   }
   /** 단계 이름 → 그 템플릿의 노드 이름. */
   const node = (stage: PipelineNodeId): PipelineNodeId => nodeNameForStage(stage, graphTemplate) as PipelineNodeId;
@@ -5017,14 +5182,22 @@ async function runSelfImplementInner(
     : opts.goalFile
       ? 'authored-goal-file'
       : 'no-goal-file';
-  let activeProvider: Pick<ActiveProviderInfo, 'provider' | 'model' | 'auth'> | {
-    provider: 'unknown'; model: 'unknown'; auth: 'unknown';
-  };
+  let activeProvider: { provider: string; model: string; auth: string };
   try {
     activeProvider = (s.inspectActiveProvider ?? inspectActiveProvider)();
   } catch {
     activeProvider = { provider: 'unknown', model: 'unknown', auth: 'unknown' };
   }
+  const configuredProvider = activeProvider;
+  if (opts.childLlm) {
+    // The configured parent model can be sol while this run's implementation child is
+    // explicitly luna. Attribute the run to the model actually passed to implement.
+    activeProvider = {
+      provider: opts.childLlm.provider,
+      model: opts.childLlm.model,
+      auth: configuredProvider.provider?.replace(/^auto:/, '') === opts.childLlm.provider ? configuredProvider.auth : 'unknown',
+    };
+  }
   // ⭐ 관측 이벤트와 «같은 값»을 원장으로도 보낸다 — 로그에만 있으면 원장 질의가 못 센다(`F12`).
   try { onActiveProvider(activeProvider); } catch { /* 보조 기록이 런을 죽이지 않는다 */ }
   const boundedFeature = boundReadableText(opts.feature, RUN_START_FEATURE_MAX_CHARS);
@@ -5038,6 +5211,7 @@ async function runSelfImplementInner(
     nestDepth: nestInfo().depth, goalSource, goalFile: opts.goalFile === undefined ? null : resolve(launchCwd, opts.goalFile),
     targetRoot: gitRootOf(launchCwd) ?? launchCwd, ...originObservationFields(),
     provider: activeProvider.provider ?? null, model: activeProvider.model ?? null, auth: activeProvider.auth ?? null,
+    ...(opts.childLlm ? { configuredProvider: configuredProvider.provider ?? null, configuredModel: configuredProvider.model ?? null, modelSelectionSource: 'child' } : {}),
     ...(opts.correlationId !== undefined ? { correlationId: opts.correlationId } : {}),
   });
   try {
@@ -5091,6 +5265,14 @@ async function runSelfImplementInner(
     ...goalContext,
   }), T.worktree, 'worktree');
   onWorktreeCreated(wt.path);
+  // Capture the child worktree's HEAD at creation. `wt.invokedHead` names the
+  // caller checkout and may differ after base selection or PR-source checkout.
+  const terminalLaunchHeadRead = runGitCommand(wt.path, ['rev-parse', '--verify', 'HEAD'], { encoding: 'utf8', timeout: 10_000 });
+  const terminalLaunchHeadCandidate = terminalLaunchHeadRead.status === 0 ? terminalLaunchHeadRead.stdout.trim() : '';
+  const terminalLaunchHead = /^[0-9a-f]{40,64}$/i.test(terminalLaunchHeadCandidate) ? terminalLaunchHeadCandidate : undefined;
+  const terminalLaunchWork = detectUncommittedWork(wt.path);
+  const terminalLaunchDirtyPaths = terminalLaunchWork.status === 'unavailable' ? undefined
+    : new Set([...terminalLaunchWork.trackedChanges, ...terminalLaunchWork.untrackedFiles]);
   // ⭐ 제1원칙 — **어디서 갈랐나**를 관측에 남긴다. 이것이 없어서 2026-07-29 에 하니스 런 둘이
   //   `main` 위에서 돌았고(호출자가 브랜치 워크트리에서 발사했는데도) 산출 diff 를 눈으로 봐야 알았다.
   //   ⚠️ `branch` 는 **새로 만든 브랜치 이름**이라 그 질문에 답하지 않는다.
@@ -5104,6 +5286,8 @@ async function runSelfImplementInner(
   observe('worktree', {
     path: wt.path,
     branch: wt.branch,
+    terminalLaunchHead: terminalLaunchHead ?? null,
+    terminalLaunchDirtyPaths: terminalLaunchDirtyPaths ? [...terminalLaunchDirtyPaths] : null,
     // ⭐ 우리가 **무엇을 요청했는지는 이미 안다** — 시임 반환에서 되읽지 않는다.
     //    커스텀 시임이 관측 필드를 생략하면 명시/생략이 둘 다 null 이 되어 구분이 사라진다(리뷰 must-fix).
     requestedBase,
@@ -5635,6 +5819,9 @@ async function runSelfImplementInner(
     };
   }
   let round = 0;
+  // A timeout is evidence about this command, not an invitation to spend the
+  // next rework round on the identical oversized check.
+  const runBudgetedEvidenceChecks = createRequiredEvidenceBudget({ run: s.evidenceCommandRunner });
   // A goal-only retry spends its one allowance for this run even if a later
   // gate/review round removes the target diff and reaches the same disposition.
   let goalOnlyReworkUsed = false;
@@ -6121,7 +6308,7 @@ async function runSelfImplementInner(
         return preserveReviewBlockedBranch(`review-blocked 작업 커밋 실패: ${commitError}`, false, `; 미커밋 작업은 worktree 에 남음: ${wt.path}`);
       }
     }
-    let pr: { url: string; number: number };
+    let pr: OpenPrOutcome;
     try {
       pr = await withStepTimeout(s.openPr({
         title: prTitle(opts.feature, opts.goalFile),
@@ -6172,6 +6359,48 @@ async function runSelfImplementInner(
         : `중단 산출물의 draft PR 생성 실패(worktree·branch 보존 · 판정 본문 보존 실패: ${artifactError ?? 'unknown error'})`);
       return undefined;
     }
+    let draftAttribution: { headRefName: string; createdAt: string } | undefined;
+    let draftAttributionReadError: string | undefined;
+    try {
+      if (s.readPrAttribution) {
+        draftAttribution = await s.readPrAttribution({ number: pr.number, cwd: wt.path });
+      } else {
+        const viewed = spawnSync('gh', ['pr', 'view', String(pr.number), '--json', 'headRefName,createdAt'], { cwd: wt.path, encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER });
+        if (viewed.status !== 0) throw new Error('gh pr view failed');
+        const parsed = JSON.parse(viewed.stdout) as { headRefName?: unknown; createdAt?: unknown };
+        if (typeof parsed.headRefName !== 'string' || typeof parsed.createdAt !== 'string') throw new Error('invalid PR attribution metadata');
+        draftAttribution = { headRefName: parsed.headRefName, createdAt: parsed.createdAt };
+      }
+    } catch (error) { draftAttributionReadError = safeErrorDescription(error); }
+    const expectedPrHead = pr.boundCardReuse?.headRefName ?? wt.branch;
+    const draftAttributed = !draftAttributionReadError && !!draftAttribution
+      && prAttributedToRun(draftAttribution, wt.branch, startedAtMs, pr.boundCardReuse);
+    if (draftAttributionReadError || !draftAttribution) {
+      onPrAttributionMismatch();
+      observe('pr-attribution-unverified', {
+        expectedBranch: expectedPrHead,
+        number: pr.number,
+        url: pr.url,
+        reason: draftAttributionReadError ?? 'metadata-absent',
+      }, { level: 'warn' });
+    } else if (draftAttributed) {
+      onPrAttributed(pr.number);
+      observe('pr-opened', { url: pr.url, number: pr.number, branch: expectedPrHead, draft: true });
+    } else {
+      onPrAttributionMismatch();
+      observe('pr-attribution-mismatch', {
+        expectedBranch: expectedPrHead,
+        actualBranch: draftAttribution?.headRefName ?? null,
+        createdAt: draftAttribution?.createdAt ?? null,
+        number: pr.number,
+        url: pr.url,
+      }, { level: 'warn' });
+    }
+    if (!draftAttributed) {
+      blockedDraftPrFailure = `draft PR 귀속 확인 실패; worktree·branch 보존: ${wt.branch} (${wt.path})`;
+      progress('aborted', blockedDraftPrFailure);
+      return undefined;
+    }
     observe('rework-blocked-draft-pr', {
       ...observation,
       url: pr.url,
@@ -6389,6 +6618,19 @@ async function runSelfImplementInner(
       return 'parked';
     }
   };
+  let pendingReviewTriage: {
+    round: number;
+    verdict: 'fail';
+    rawMustFix: string[];
+    reflectedMustFix: string[];
+    reflectionApplied: boolean;
+    effectiveMax: number;
+  } | undefined;
+  const recordPendingReviewTriage = (decision: ReviewRoundDecision, nextNode: 'open-pr' | 'rework' | 'review-blocked', effectiveMax: number): void => {
+    if (!pendingReviewTriage) return;
+    observe('review-round-triage', { ...pendingReviewTriage, decision, nextNode, effectiveMax });
+    pendingReviewTriage = undefined;
+  };
   for (;;) {
     if (round > 0) {
       const stoppedBeforeRework = honorParentSoftStop('rework');
@@ -6441,7 +6683,7 @@ async function runSelfImplementInner(
         const predictionAccuracyBefore = supervisorDecisionHistory.length
           ? judgePredictionAccuracy(supervisorDecisionHistory)
           : undefined;
-        diagnosis = await withStepTimeout(s.diagnose({ runId, note: reworkJudgeNote, kind: reworkKind, round, cwd: wt.path, goal: opts.feature, history: priorHistory, supervisorDecisionHistory, ...(predictionAccuracyBefore ? { judgePredictionAccuracy: predictionAccuracyBefore } : {}), effectiveMax, priorRuns, reviewFindingTelemetry: reviewFindingTelemetrySnapshot, ...(diagnosisRefutations ? { refutations: diagnosisRefutations.refutations, refutationRound: diagnosisRefutations.round } : {}), purpose: 'budget' }), T.review, 'review');
+        diagnosis = await withStepTimeout(s.diagnose({ runId, note: reworkJudgeNote, kind: reworkKind, round, cwd: wt.path, goal: roundGoal, history: priorHistory, supervisorDecisionHistory, ...(predictionAccuracyBefore ? { judgePredictionAccuracy: predictionAccuracyBefore } : {}), effectiveMax, priorRuns, reviewFindingTelemetry: reviewFindingTelemetrySnapshot, ...(diagnosisRefutations ? { refutations: diagnosisRefutations.refutations, refutationRound: diagnosisRefutations.round } : {}), purpose: 'budget' }), T.review, 'review');
         const diagnosedDecision = parseReworkBudgetDecision(diagnosis);
         if (diagnosedDecision?.verdict === 'CONTRACT-CONFLICT') lastSupervisorVerdict = diagnosedDecision.verdict;
         let parsedDecision = diagnosedDecision;
@@ -6546,6 +6788,17 @@ async function runSelfImplementInner(
           });
         }
         effectiveMax = budgetDecision.effectiveMax;
+        if (pendingReviewTriage && budgetDecision.stop) {
+          recordPendingReviewTriage('follow-up', budgetDecision.exit === 'proceed' ? 'open-pr' : 'review-blocked', effectiveMax);
+        } else if (pendingReviewTriage && round <= effectiveMax) {
+          const extendedDecision = decideReviewRound({
+            verdict: pendingReviewTriage.verdict,
+            mustFix: pendingReviewTriage.reflectedMustFix,
+            round: pendingReviewTriage.round,
+            effectiveMax,
+          });
+          if (extendedDecision === 'rework') recordPendingReviewTriage('rework', 'rework', effectiveMax);
+        }
         if (parsedDecision) {
           if (diagnosisRefutations) {
             const adjudications = parseSupervisorRefutationAdjudications(diagnosis, diagnosisRefutations.refutations);
@@ -6754,6 +7007,7 @@ async function runSelfImplementInner(
               : 'UNCONVERGEABLE' as const;
             const supervisorOutcome = { supervisorVerdict, ...(goalCauseObserved ? { goalCauseObserved: true as const } : {}) };
             if (isReviewRework(reworkKind)) {
+              recordPendingReviewTriage('follow-up', 'review-blocked', effectiveMax);
               if (reflectRejectedAudit.length && review) review.shouldFix = [...review.shouldFix, ...reflectRejectedAudit];
               const pr = await preserveBlockedArtifacts({ stage: 'review-blocked', verdict: parsedDecision.verdict, reason: parsedDecision.reason, gate, decomposition: terminalDecomposition, salvageStatusExpected: false });
               await draftFollowUpAfterBlocked({ runId, prNumber: pr?.number, stage: 'review-blocked', unresolvedMustFix: review?.mustFix, decompositionPieces: terminalDecomposition?.pieces?.map((p) => p.feature), feature: opts.feature, cellId: opts.goalId, goalFile: opts.goalFile }, s.followUp);
@@ -6785,6 +7039,7 @@ async function runSelfImplementInner(
         const terminal = resolveRunOutcome({ termination: 'supervisor-abandoned', verdict: 'UNCONVERGEABLE', applied: true });
         const reason = `rework judged unconvergeable after ${round - 1} rework round(s)`;
         if (isReviewRework(reworkKind)) {
+          recordPendingReviewTriage('follow-up', 'review-blocked', effectiveMax);
           if (reflectRejectedAudit.length && review) review.shouldFix = [...review.shouldFix, ...reflectRejectedAudit];
           const pr = await preserveBlockedArtifacts({ stage: 'review-blocked', verdict: lastReworkVerdict, reason, gate, salvageStatusExpected: false });
           await draftFollowUpAfterBlocked({ runId, prNumber: pr?.number, stage: 'review-blocked', unresolvedMustFix: review?.mustFix, feature: opts.feature, cellId: opts.goalId, goalFile: opts.goalFile }, s.followUp);
@@ -6828,6 +7083,7 @@ async function runSelfImplementInner(
           );
           podDecision(acceptance.decision.action === 'accept');
           if (acceptance.decision.action === 'accept') {
+            recordPendingReviewTriage('follow-up', 'open-pr', effectiveMax);
             if (podReviewBlockedDraft) {
               observe('merge-decision', {
                 autoMerge: autoMergeEnabled(opts), reviewed: review?.reviewed === true, verdict: review?.verdict ?? 'none',
@@ -6866,6 +7122,7 @@ async function runSelfImplementInner(
             };
           }
         } else podDecision(false);
+        recordPendingReviewTriage('follow-up', 'review-blocked', effectiveMax);
         const pr = await preserveBlockedArtifacts({ stage: 'review-blocked', reason, gate, salvageStatusExpected: true });
         const salvage = blockedDraftNoChanges || blockedDraftPrFailure ? 'parked' : await salvageHardCap(canSalvage, pr);
         const disposition = { ...terminal, ...(salvage ? { salvage } : {}) };
@@ -6885,7 +7142,7 @@ async function runSelfImplementInner(
     if (escalationEligible && s.diagnose) {
       try {
         escalationJudgement = await withStepTimeout(s.diagnose({
-          runId, note: reworkNote, kind: reworkKind, round, cwd: wt.path, goal: opts.feature,
+          runId, note: reworkNote, kind: reworkKind, round, cwd: wt.path, goal: roundGoal,
           history: reworkHistory.slice(0, -1), supervisorDecisionHistory, effectiveMax,
           purpose: 'escalation-triage',
         }), T.review, 'review');
@@ -6906,7 +7163,9 @@ async function runSelfImplementInner(
       const firstRound = roundSummaryEntries.at(-1);
       const refined = await (await import('./goal-refine.js')).runFirstRoundRefine({
         goal: opts.feature, round, visit: goalRefineVisits, callLLM: s.elaborateCallLLM, observe,
-        evidence: { implSummary: firstRound?.tried, findings: reworkNote, changedFiles: firstRound?.filesTouched },
+        // SCOPE-ESCAPE-AS-REFINE — accepted out-of-scope edits are the «new scope» the first implementation found.
+        evidence: { implSummary: firstRound?.tried, findings: reworkNote, changedFiles: firstRound?.filesTouched,
+          ...(scopeExpansion?.files.length ? { newScope: scopeExpansion.files.map((file) => file.path) } : {}) },
       });
       roundGoal = refined.goal;
       // PR «골 변경» 절 — 유지(kept · no-provider 포함)여도 «시도 · v1 유지 · 사유» 한 줄을 싣는다(리뷰 r2).
@@ -7136,6 +7395,45 @@ async function runSelfImplementInner(
         }
       }
     }
+    // The child can report changed=false after committing its edits. Compare
+    // against the worktree HEAD captured at creation, not the caller's HEAD or
+    // origin/main: a PR source already had a diff before the child ran.
+    if (!impl.ok && impl.completionDisposition === 'completed-without-changes'
+      && impl.terminalStatus?.reached === true && impl.terminalStatus.timedOut === false
+      && !hasCurrentProviderError() && !hasCurrentCredentialFailure()) {
+      const committed = terminalLaunchHead
+        ? runGitCommand(wt.path, ['diff', '--name-only', '-z', terminalLaunchHead, 'HEAD'], { encoding: 'utf8', timeout: 10_000 })
+        : undefined;
+      const pending = detectUncommittedWork(wt.path);
+      const observedFiles = committed?.status === 0 && pending.status !== 'unavailable'
+        ? [...new Set([
+          ...committed.stdout.split('\0').filter(Boolean),
+          ...pending.trackedChanges, ...pending.untrackedFiles,
+        ])]
+        : [];
+      if (!terminalLaunchHead || terminalLaunchDirtyPaths === undefined || committed?.status !== 0 || pending.status === 'unavailable') {
+        observe('terminal-change-evidence', { round, status: 'unmeasured',
+          reason: !terminalLaunchHead ? 'launch-head-unavailable' : terminalLaunchDirtyPaths === undefined
+            ? 'launch-status-unavailable' : committed?.status !== 0 ? 'git-diff-unavailable' : 'git-status-unavailable' }, { level: 'warn' });
+      }
+      // A PR-source worktree may be dirty before this child starts. A path
+      // already dirty at launch cannot prove this child's edits from names
+      // alone, even if the child later commits it. Leave that path unmeasured.
+      const implementationFiles = terminalLaunchDirtyPaths === undefined ? [] : observedFiles.filter(path =>
+        !terminalLaunchDirtyPaths.has(path) && !harnessSeededPaths.includes(path) && !isHarnessTempArtifact(path));
+      const preexistingDirtyPaths = terminalLaunchDirtyPaths === undefined ? [] : observedFiles.filter(path =>
+        terminalLaunchDirtyPaths.has(path) && !harnessSeededPaths.includes(path) && !isHarnessTempArtifact(path));
+      if (preexistingDirtyPaths.length > 0) observe('terminal-change-evidence', {
+        round, status: 'unmeasured', reason: 'preexisting-dirty-path', paths: preexistingDirtyPaths,
+      }, { level: 'warn' });
+      if (implementationFiles.length > 0) {
+        observe('terminal-change-reconciled', {
+          round, source: 'post-launch-git-diff', launchHead: terminalLaunchHead, childDisposition: impl.completionDisposition,
+          paths: implementationFiles, pathCount: implementationFiles.length,
+        });
+        impl = { ...impl, ok: true, completionDisposition: undefined };
+      }
+    }
     // A finished child can leave edits without a commit. Measure them before any
     // diff/no-changes classification, and commit only paths declared in the goal.
     finishedChildCommitMissing = false;
@@ -7184,7 +7482,7 @@ async function runSelfImplementInner(
               env.GIT_COMMITTER_NAME = childName;
               env.GIT_COMMITTER_EMAIL = childEmail;
               const git = (args: string[]) => spawnSync('git', ['--no-optional-locks', ...args], {
-                cwd, env, encoding: 'utf8', timeout: 20_000,
+                cwd, env, encoding: 'utf8', timeout: 20_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER,
               });
               const staged = git(['add', '-A', '--', ...paths]);
               if (staged.status !== 0) return { ok: false, out: staged.stderr || staged.stdout || staged.error?.message || 'git add failed' };
@@ -7241,7 +7539,13 @@ async function runSelfImplementInner(
     // E3 — refine 뒤 라운드는 «현재 골»(v2)로 증거를 센다(REQUIRED EVIDENCE 절은 고정 칸이라 v1 과 같다).
     const requiredEvidence = requiredEvidenceFromGoal(roundGoal);
     const limitationCount = authorLimitationCountFromGoal(roundGoal);
-    const evidenceChecks = runRequiredEvidenceChecks(roundGoal, wt.path, runId);
+    const evidenceHead = resolveEvidenceHeadCommit(s.headCommit?.(wt.path), () =>
+      runGitCommand(wt.path, ['rev-parse', '--verify', 'HEAD'], { encoding: 'utf8', timeout: 10_000 }).stdout.trim());
+    if (!evidenceHead) {
+      try { debug.log('self-implement.evidence', 'command-budget-head-unresolved', { runId, round, cwd: wt.path }); }
+      catch { /* observation is fail-soft */ }
+    }
+    const evidenceChecks = runBudgetedEvidenceChecks(roundGoal, wt.path, runId, evidenceHead);
     const tagCoverage = coverRequiredEvidence(requiredEvidence, offDiffEvidence.items);
     // EVIDENCE-WIRING-EXEMPT — a requirement whose own `|| bun test …` check passed is covered by what the harness measured.
     const settledByCheck = settleUncoveredEvidence(tagCoverage.uncovered, { checks: evidenceChecks, required: requiredEvidence });
@@ -7387,7 +7691,7 @@ async function runSelfImplementInner(
             files: decision.expansion.files });
           if ('parked' in result) progress('parked', `critical 질문 ${result.questionId} 미응답 — 이 런만 대기`);
           return { ok: false, stage: 'parked' in result ? 'parked' : 'soft-stopped', node: 'implement', ...resolveRunOutcome({ termination: 'abandoned' }), sessionId, worktreePath: wt.path, branch: wt.branch,
-            outOfScopeEdits, nameCapReached: scope.nameCapReached, outsideCount: scope.outsideCount,
+            outOfScopeEdits, ...(!decision.accept ? { scopeStopReasons: decision.reasons } : {}), nameCapReached: scope.nameCapReached, outsideCount: scope.outsideCount,
             detail: 'parked' in result ? `critical-unanswered: ${result.questionId}` : 'Out-of-scope edits held in the worktree; gate and publication skipped.' };
         }
       }
@@ -7684,6 +7988,43 @@ async function runSelfImplementInner(
         if (untracked.status === 0) untrackedFiles = untracked.stdout.split(/\r?\n/).filter(Boolean);
       } catch { /* change discovery must not stop review */ }
     }
+    // Gate has passed. Measure newly exported runtime values before review, without
+    // turning a static-analysis guess into a rework verdict during the first rollout.
+    const wiringFiles = [...new Set([...(runFacts.changedFiles ?? []), ...(gateRouteFiles ?? []), ...untrackedFiles])];
+    let goalWiring: 'unwired' | undefined;
+    if (wiringFiles.some((file) => /^(?:src|scripts|apps\/pwa\/src)\/.*\.tsx?$/.test(file))) {
+      const wiringBase = wt.resolvedBase;
+      const wiring = wiringBase && /^[0-9a-f]{40}$/i.test(wiringBase)
+        ? (s.checkUnwiredExports ?? findUnwiredExports)({
+            cwd: wt.path,
+            changedFiles: wiringFiles,
+            // Timeouts and git errors throw → recorded as `failure`, never as "absent at base".
+            readBaseFile: gitBaseFileReader(
+              (args) => runGitCommand(wt.path, args, { encoding: 'utf8', timeout: 10_000 }),
+              wiringBase,
+            ),
+          })
+        : { checked: 0, unwired: [], failure: 'resolved-base-unavailable' };
+      if (!wiring.failure && opts.goalFile && wiring.unwired.length > 0) {
+        try {
+          const declared = declaredPathsFromGoalDocumentText(readFileSync(opts.goalFile, 'utf8'));
+          if (declared.readable && wiring.unwired.some(({ file }) =>
+            declared.paths.some((target) => normalizeDeclaredScopePath(target) === normalizeDeclaredScopePath(file)))) {
+            goalWiring = 'unwired';
+          }
+        } catch { /* unreadable goal text cannot establish a wiring deficit */ }
+      }
+      const wiringObservation = {
+        round,
+        checked: wiring.checked,
+        unwired: wiring.unwired.length,
+        examples: wiring.unwired.slice(0, 10),
+        ...(wiring.failure ? { failure: wiring.failure } : {}),
+        mode: 'warn',
+      };
+      debug.log('self-implement.wiring-check', wiring.failure ? 'unmeasured' : 'measured', wiringObservation);
+      observe('wiring-check', wiringObservation, wiring.failure || wiring.unwired.length ? { level: 'warn' } : {});
+    }
     if ([...(runFacts.changedFiles ?? []), ...(gateRouteFiles ?? []), ...untrackedFiles].some((file) => /\.(?:html|css)$/i.test(file))) {
       try {
         designGate = (s.runDesignGate ?? runDesignGate)({ projectDir: wt.path, base: wt.resolvedBase });
@@ -7798,15 +8139,74 @@ async function runSelfImplementInner(
         : `리뷰 미실행${review.failureReason !== undefined ? ` (${review.failureReason})` : ''}`);
       if (opts.goalFile) {
         let goalSlotFill: SupervisorGoalFillResult = 'unverifiable';
+        let goalSlotDeficit: import('./goal-supervisor-fill.js').SupervisorGoalDeficit | undefined;
+        let goalSlotAction: 'remeasure' | 'connect-goal' | undefined;
         try {
           goalSlotFill = await fillUnverifiableGoalSlots({
             path: opts.goalFile, round, gate, review,
+            ...(goalWiring ? { wiring: goalWiring } : {}),
             independentlyCheck: s.independentlyCheckGoalSlots ?? (async () => false),
+            observeDeficit: (deficit) => { goalSlotDeficit = deficit; },
           });
         } catch {
           goalSlotFill = 'rejected';
         }
-        observe('goal-slot-fill', { round, result: goalSlotFill, gatePassed: gate.passed, reviewVerdict: review.verdict });
+        if (goalSlotFill === 'not-applicable') {
+          observe('goal-slot-remeasure-result', { round, result: goalSlotFill, gatePassed: gate.passed,
+            reason: 'test-step-scope-skipped', scopeReason: gate.scopeReason, testStepExecuted: gate.testStepExecuted });
+        }
+        if (goalSlotDeficit) {
+          observe('supervisor-report-deficit', { runId, ...goalSlotDeficit, supervisorResult: goalSlotFill });
+          if (goalSlotDeficit.kind !== 'unverified') {
+            const move = repairNextMove({ supervisorDeficit: goalSlotDeficit,
+              supervisorResult: goalSlotFill === 'rejected' ? 'rejected' : 'unverifiable' });
+            if (move.kind === 'grounding') {
+              goalSlotAction = move.action;
+              observe('repair-next-move-input', { runId, ...move.supervisorDeficit,
+                supervisorResult: goalSlotFill, action: move.action });
+            }
+          }
+        }
+        if (goalSlotFill === 'unverifiable' && gate.passed && goalSlotAction === 'remeasure' && goalSlotDeficit && runsGate) {
+          observe('goal-slot-remeasure', { round, evidenceId: goalSlotDeficit.evidenceId, action: 'remeasure' });
+          const measuredGate = await stepTimeout(s.gate(wt.path, { runId, round }), T.gate, 'gate');
+          gate = measuredGate;
+          let remeasureDeficit: import('./goal-supervisor-fill.js').SupervisorGoalDeficit | undefined;
+          if (gate.passed) {
+            goalSlotFill = await fillUnverifiableGoalSlots({ path: opts.goalFile, round, gate, review,
+              independentlyCheck: s.independentlyCheckGoalSlots ?? (async () => false),
+              observeDeficit: (deficit) => { remeasureDeficit = deficit; } });
+          }
+          observe('goal-slot-remeasure-result', { round, evidenceId: goalSlotDeficit.evidenceId, result: goalSlotFill,
+            gatePassed: measuredGate.passed,
+            ...(remeasureDeficit ? { deficitKind: remeasureDeficit.kind,
+              deficitEvidenceId: remeasureDeficit.evidenceId, gateLog: remeasureDeficit.gateLog,
+              reason: remeasureDeficit.reason, inputSummary: remeasureDeficit.inputSummary, gateLogRef: remeasureDeficit.gateLogRef } : {}) });
+          if (!gate.passed || goalSlotFill === 'unverifiable' || goalSlotFill === 'rejected') {
+            finalizeSupervisorDeliveries('goal-slot-remeasure-gate-failed');
+            const reason = `goal-slot remeasurement ${!gate.passed ? 'failed' : goalSlotFill === 'rejected' ? 'rejected' : 'unmeasured'} · evidence ${goalSlotDeficit.evidenceId}`;
+            const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', reason, gate, salvageStatusExpected: false });
+            return { ok: false, stage: 'gate-failed', node: 'rework', ...resolveRunOutcome({ termination: 'abandoned' }),
+              sessionId, worktreePath: wt.path, branch: wt.branch, gate,
+              quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(),
+              ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
+          }
+        }
+        observe('goal-slot-fill', { round, result: goalSlotFill, gatePassed: gate.passed, reviewVerdict: review.verdict,
+          ...(goalSlotFill === 'unverifiable' && goalSlotDeficit ? { reason: goalSlotDeficit.reason, inputSummary: goalSlotDeficit.inputSummary, gateLogRef: goalSlotDeficit.gateLogRef } : {}),
+          ...(goalSlotFill === 'not-applicable' ? { reason: 'test-step-scope-skipped', scopeReason: gate.scopeReason,
+            testStepExecuted: gate.testStepExecuted } : {}) });
+        if (goalSlotAction === 'connect-goal' && goalSlotDeficit) {
+          finalizeSupervisorDeliveries('goal-slot-connect-goal');
+          const reason = `goal-slot wiring deficit · evidence ${goalSlotDeficit.evidenceId}`;
+          const pr = await preserveBlockedArtifacts({ stage: 'review-blocked', reason, gate, salvageStatusExpected: false });
+          await draftFollowUpAfterBlocked({ runId, prNumber: pr?.number, stage: 'review-blocked',
+            unresolvedMustFix: [reason], feature: opts.feature, cellId: opts.goalId, goalFile: opts.goalFile }, s.followUp);
+          return { ok: false, stage: 'review-blocked', node: 'rework', ...resolveRunOutcome({ termination: 'abandoned' }),
+            sessionId, worktreePath: wt.path, branch: wt.branch, gate, review,
+            quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(),
+            ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
+        }
       }
       const evidenceFacts: ReflectEvidenceFacts = evidenceCoverage
         ? { requiredEvidence: evidenceCoverage.required, coveredEvidence: evidenceCoverage.covered, missingEvidence: evidenceCoverage.uncovered }
@@ -7868,6 +8268,9 @@ async function runSelfImplementInner(
           });
         } catch { /* fail-safe: REFUTE never changes a finding without supervisor judgment */ }
       }
+      const rawReviewMustFix = [...review.mustFix];
+      let reflectionApplied = false;
+      let reviewTriageRecorded = false;
       if (review.verdict === 'fail' && review.mustFix.length > 0) {
         let effectiveMustFix = review.mustFix;
         if (s.reflectMustFix) {
@@ -7876,6 +8279,7 @@ async function runSelfImplementInner(
           try {
             const recurrenceHistory = recurrenceHistoryFor(review.mustFix);
             const reflected = await withStepTimeout(s.reflectMustFix({ mustFix: review.mustFix, goal: roundGoal, cwd: wt.path, evidenceFacts, gateFacts: gate.reflectGateFacts, citedPathFacts, ...(recurrenceHistory.length ? { recurrenceHistory } : {}), runId, round }), T.review, 'review');
+            reflectionApplied = true;
             const rejectedItems = new Set(reflected.rejected.filter((r) => r.reason && r.reason.trim().length > 0).map((r) => r.item));
             const rejected = reflected.rejected.filter((r) => rejectedItems.has(r.item));
             effectiveMustFix = review.mustFix.filter((m) => !rejectedItems.has(m));
@@ -7912,6 +8316,17 @@ async function runSelfImplementInner(
           }
         }
         if (effectiveMustFix.length === 0) {
+          observe('review-round-triage', {
+            round,
+            verdict: 'fail',
+            rawMustFix: rawReviewMustFix,
+            reflectedMustFix: effectiveMustFix,
+            reflectionApplied,
+            decision: 'pass',
+            nextNode: 'open-pr',
+            effectiveMax,
+          });
+          reviewTriageRecorded = true;
           finalizeSupervisorDeliveries('review-reflect-converged');
           completionStatus = 'review-reflect-converged';
           review.mustFix = [];
@@ -7921,6 +8336,21 @@ async function runSelfImplementInner(
           progress('reviewed', '리뷰: fail → warn (반사가 must-fix 를 «전부» 기각 — 사유는 위 줄과 PR 코멘트에)');
           break;
         }
+        const reviewDecision = decideReviewRound({ verdict: review.verdict, mustFix: effectiveMustFix, round, effectiveMax });
+        const reviewTriage = {
+          round,
+          verdict: review.verdict,
+          rawMustFix: rawReviewMustFix,
+          reflectedMustFix: [...effectiveMustFix],
+          reflectionApplied,
+          effectiveMax,
+        };
+        if (reviewDecision === 'follow-up') {
+          pendingReviewTriage = { ...reviewTriage, verdict: 'fail' };
+        } else {
+          observe('review-round-triage', { ...reviewTriage, decision: reviewDecision, nextNode: 'rework' });
+          reviewTriageRecorded = true;
+        }
         appliedLastRound = [...effectiveMustFix];
         roundSummaryEntries.push({ round, kind: 'review', tried: impl.summary.replace(/\s+/g, ' ').trim().slice(0, 200),
           failedIds: effectiveMustFix.map(stableMustFixId), filesTouched: runFacts.changedFiles,
@@ -7973,6 +8403,18 @@ async function runSelfImplementInner(
         round++;
         continue;
       }
+      if (!reviewTriageRecorded && !pendingReviewTriage) {
+        observe('review-round-triage', {
+          round,
+          verdict: review.verdict,
+          rawMustFix: rawReviewMustFix,
+          reflectedMustFix: rawReviewMustFix,
+          reflectionApplied: false,
+          decision: 'pass',
+          nextNode: 'open-pr',
+          effectiveMax,
+        });
+      }
     }
     // EVIDENCE-WIRING-EXEMPT — a commandless [preservation] is covered once the changed-file gate passed.
     if (gate.passed && evidenceCoverage?.uncoveredCount) {
@@ -8044,10 +8486,13 @@ async function runSelfImplementInner(
   //     (모집단 0인데 distinguishes=1) 틀린 값으로 막으면 새 병목이 된다.
   //   ⛔ `ran === false`(skipped)는 «다른 것»이다 — 자식이 테스트를 안 건드린 경우이고
   //     그건 `skippedReason` 이 이미 가른다. 그래서 여기 조건에 넣지 않는다.
-  const verifyInconclusive = gate.verifyByBreaking?.ran === true && (gate.verifyByBreaking.distinguishes ?? 0) === 0;
-  const verifyNothingAtBase = verifyInconclusive && (gate.verifyByBreaking?.missingAtBase ?? 0) > 0;
+  // A new test absent from the fixed base is a structural RED witness when the
+  // head gate passed. Keep that distinct from an executed test that proved nothing.
+  const verifyStructuralRed = gate.verifyByBreaking?.ran === true && (gate.verifyByBreaking.missingAtBase ?? 0) > 0;
+  const verifyInconclusive = gate.verifyByBreaking?.ran === true
+    && (gate.verifyByBreaking.distinguishes ?? 0) === 0 && !verifyStructuralRed;
   let mergeReason = canAuto && reviewDeferredToHost ? REVIEW_DEFERRED_TO_HOST_MERGE_REASON
-    : canAuto ? (verifyNothingAtBase ? 'review-clean-verify-nothing-at-base' : verifyInconclusive ? 'review-clean-verify-inconclusive' : 'review-clean-armed')
+    : canAuto ? (verifyStructuralRed ? 'review-clean-verify-structural-red' : verifyInconclusive ? 'review-clean-verify-inconclusive' : 'review-clean-armed')
     : gateTimeoutUnmeasured ? GATE_TIMEOUT_UNMEASURED_MERGE_REASON
     : !autoMerge ? 'no-auto-flag'
       : requiredEvidenceMissing ? 'required-evidence-uncovered'
@@ -8316,7 +8761,7 @@ async function runSelfImplementInner(
     s.persistPrBodyArtifact,
     'self-implement-pr',
   );
-  let pr: { url: string; number: number };
+  let pr: OpenPrOutcome;
   try {
     pr = await withStepTimeout(s.openPr({
       title: prTitle(opts.feature, opts.goalFile),
@@ -8347,15 +8792,64 @@ async function runSelfImplementInner(
     const current = runGitCommand(wt.path, ['rev-parse', '--verify', 'HEAD'], { encoding: 'utf8', timeout: 10_000 });
     if (current.status !== 0 || current.stdout.trim() !== reviewedHeadCommit) delete reviewedHeadResult.reviewedHeadCommit;
   }
-  observe('pr-opened', {
-    url: pr.url,
-    number: pr.number,
-    branch: wt.branch,
-    headCommit: runGitCommand(wt.path, ['rev-parse', '--verify', 'HEAD'], { encoding: 'utf8', timeout: 10_000 }).stdout.trim(),
-    autoMerge: canAuto,
-    autoReview: !!labels,
-    ...(preparedPrBody.truncated ? { prBodyTruncated: true, prBodyOriginalChars: preparedPrBody.originalChars } : {}),
-  });
+  let prAttribution: { headRefName: string; createdAt: string } | undefined;
+  let prAttributionReadError: string | undefined;
+  try {
+    if (s.readPrAttribution) {
+      prAttribution = await s.readPrAttribution({ number: pr.number, cwd: wt.path });
+    } else {
+      const viewed = spawnSync('gh', ['pr', 'view', String(pr.number), '--json', 'headRefName,createdAt'], {
+        cwd: wt.path, encoding: 'utf8', timeout: 30_000, maxBuffer: SPAWN_SYNC_MAX_BUFFER,
+      });
+      if (viewed.status !== 0) throw new Error(viewed.stderr || viewed.stdout || 'gh pr view failed');
+      const parsed = JSON.parse(viewed.stdout) as { headRefName?: unknown; createdAt?: unknown };
+      if (typeof parsed.headRefName !== 'string' || typeof parsed.createdAt !== 'string') throw new Error('invalid PR attribution metadata');
+      prAttribution = { headRefName: parsed.headRefName, createdAt: parsed.createdAt };
+    }
+  } catch (error) {
+    prAttributionReadError = safeErrorDescription(error);
+  }
+  const expectedPrHead = pr.boundCardReuse?.headRefName ?? wt.branch;
+  const prAttributed = !prAttributionReadError && !!prAttribution
+    && prAttributedToRun(prAttribution, wt.branch, startedAtMs, pr.boundCardReuse);
+  if (prAttributionReadError || !prAttribution) {
+    onPrAttributionMismatch();
+    observe('pr-attribution-unverified', {
+      expectedBranch: expectedPrHead,
+      number: pr.number,
+      url: pr.url,
+      reason: prAttributionReadError ?? 'metadata-absent',
+    }, { level: 'warn' });
+  } else if (!prAttributed) {
+    onPrAttributionMismatch();
+    observe('pr-attribution-mismatch', {
+      expectedBranch: expectedPrHead,
+      actualBranch: prAttribution.headRefName,
+      createdAt: prAttribution.createdAt,
+      number: pr.number,
+      url: pr.url,
+    }, { level: 'warn' });
+  } else {
+    const attributedNumber = recordedPrNumber(pr.number);
+    if (attributedNumber !== undefined) onPrAttributed(attributedNumber);
+    observe('pr-opened', {
+      url: pr.url,
+      number: pr.number,
+      branch: expectedPrHead,
+      headCommit: runGitCommand(wt.path, ['rev-parse', '--verify', 'HEAD'], { encoding: 'utf8', timeout: 10_000 }).stdout.trim(),
+      autoMerge: canAuto,
+      autoReview: !!labels,
+      ...(preparedPrBody.truncated ? { prBodyTruncated: true, prBodyOriginalChars: preparedPrBody.originalChars } : {}),
+    });
+  }
+  if (!prAttributed) {
+    progress('aborted', `PR 귀속 확인 실패 — 외부 PR 후속 처리 중단 (${wt.branch}; worktree: ${wt.path})`);
+    return {
+      ok: false, stage: 'aborted', node: 'open-pr', ...resolveRunOutcome({ termination: 'abandoned' }),
+      ...decisionSignalResult, ...scopeExpansionResult, sessionId, worktreePath: wt.path, branch: wt.branch,
+      gate, ...(review ? { review } : {}), detail: 'PR attribution could not be verified; worktree and branch preserved',
+    };
+  }
   await flushPrComments(pr);
 
   // Inspect the opened PR itself: the goal text and the pre-sync worktree can differ from its final file list.