elanous 0.2.36 → 0.2.37

package/src/self-implement/running-runs.ts

@@ -246,6 +246,8 @@ export interface RunningRunsLedgerObservation {
 
 export interface RunningRunsQueryObservation {
   readonly caller?: string | null;
+  /** ID 조회(src/index.ts `self running-runs [runId]`가 넘겨준 runIds)가 요청한 runId 들 — 전체 관측 질의에는 이 키가 없다. */
+  readonly requestedRunIds?: readonly string[];
   readonly cacheHits?: number;
   readonly cacheMisses?: number;
   readonly elapsedMs: number;
@@ -478,6 +480,9 @@ export function queryRunningRuns(options: { includeTest?: boolean; runIds?: read
   const processStartTime = deps.processStartedAt ?? processStartedAt;
   const observeQuery = deps.observeQuery ?? ((observation: RunningRunsQueryObservation) => debug.log('self-implement.running-runs', 'query', observation));
   const startedAt = Date.now();
+  // ID 조회 배선 — src/index.ts의 `self running-runs [runId]` 액션이 넘겨준 options.runIds 를 이 조회가 소비한다:
+  // 정의된 runIds 는 연합 원장 질의 전달·엔트리·pty 관측을 모두 그 runId 들로 한정한다.
+  const requestedRunIdSet = options.runIds === undefined ? undefined : new Set(options.runIds);
   let ledgerDirectoryCollectionElapsedMs = 0;
   let ledgerReadElapsedMs = 0;
   let screenProcessReadElapsedMs = 0;
@@ -521,7 +526,15 @@ export function queryRunningRuns(options: { includeTest?: boolean; runIds?: read
     } finally {
       screenProcessReadElapsedMs = Date.now() - screenProcessReadStartedAt;
     }
-    const runIds = [...new Set([...ledger.entries.map((entry) => entry.runId), ...pty.refs.flatMap((ref) => ref.runId ? [ref.runId] : [])])];
+    // ID 조회 소비 지점 — deps·원장 질의가 runIds를 무시하고 넓게 관측해도 결과를 요청한 runId들로 한정하고,
+    // 일치하는 런이 없으면 entries는 []다(부분 관측 계수는 원장·pty 판독성 관측을 그대로 보존한다).
+    const scopedLedgerEntries = requestedRunIdSet === undefined
+      ? ledger.entries
+      : ledger.entries.filter((entry) => requestedRunIdSet.has(entry.runId));
+    const scopedPty = requestedRunIdSet === undefined
+      ? pty
+      : { ...pty, refs: pty.refs.filter((ref) => typeof ref.runId === 'string' && requestedRunIdSet.has(ref.runId)) };
+    const runIds = [...new Set([...scopedLedgerEntries.map((entry) => entry.runId), ...scopedPty.refs.flatMap((ref) => ref.runId ? [ref.runId] : [])])];
     let observedPhases: ObservedRunPhases = { events: [], targetCount: 0, unreadableTargets: [] };
     const stageStoreReadStartedAt = Date.now();
     try {
@@ -534,7 +547,7 @@ export function queryRunningRuns(options: { includeTest?: boolean; runIds?: read
       discardedNonStageEventCount = observedPhases.discardedNonStageEventCount ?? 0;
     }
     const phaseObservation = phaseObservationFor(observedPhases);
-    const result = assessRunningRuns(ledger.entries, pty, ledger, observedPhases.events, phaseObservation);
+    const result = assessRunningRuns(scopedLedgerEntries, scopedPty, ledger, observedPhases.events, phaseObservation);
     const unreadable: UnreadableRunningRunsLedger[] = [...(result.unreadable ?? [])].filter((entry) => entry.reason === 'unreadable-ledger');
     const failedDirectories = hasUnreadableLedgerObservation(ledger)
       ? collectedLedgerDirectories.filter((dir) => !ledger.ledgerDirectories.includes(dir))
@@ -571,7 +584,7 @@ export function queryRunningRuns(options: { includeTest?: boolean; runIds?: read
     let lingeringLaunchParents: LingeringLaunchParentAssessment;
     try {
       lingeringLaunchParents = assessLingeringLaunchParents(
-        ledger.entries, loadRun, isProcessAlive, processStartTime, ledger,
+        scopedLedgerEntries, loadRun, isProcessAlive, processStartTime, ledger,
       );
     } finally {
       launchParentClassificationElapsedMs = Date.now() - launchParentClassificationStartedAt;
@@ -581,6 +594,7 @@ export function queryRunningRuns(options: { includeTest?: boolean; runIds?: read
     try {
       observeQuery({
         caller: options.caller ?? null,
+        ...(options.runIds === undefined ? {} : { requestedRunIds: options.runIds }),
         cacheHits,
         cacheMisses,
         elapsedMs: Date.now() - startedAt,

package/src/self-implement/seams.ts

@@ -1287,7 +1287,7 @@ export interface SameCellCardRebindObservation {
   detail?: string;
 }
 
-export type OpenPrOutcome = { url: string; number: number; rebind?: SameCellCardRebindObservation };
+export type OpenPrOutcome = { url: string; number: number; boundCardReuse?: { headRefName: string }; rebind?: SameCellCardRebindObservation };
 
 type DefaultSeamsResult = Omit<SelfImplementSeams, 'diagnose' | 'openPr'> & {
   diagnose: (ctx: DefaultSeamsDiagnoseInput) => Promise<string>;
@@ -2590,10 +2590,10 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         "if (!testLine) process.exit(1);",
         "const m = testLine.match(/(\\d+)\\s+fail/); if (!m) process.exit(1);",
         "const failFromLog = Number(m[1]); if (failFromLog !== 0) process.exit(1);",
-        "if (log.indexOf('[gate-baseline] introduced=0, preexisting=0, unknown=0, precondition-unmet=0') < 0) process.exit(1);",
+        // PASS는 시험 자체의 0 fail을 잰다. 실패 귀속 baseline이 없으면 'not run'으로만 기록한다.
         // 문서가 적은 관측값이 **로그에서 읽은 값과 같아야** 한다.
         "const sections = [body('## 불변식'), body('## 판정 신호')];",
-        "if (sections.some((p) => p.indexOf('UNVERIFIABLE') >= 0)) process.exit(1);",
+        "if (sections.some((p) => /^- UNVERIFIABLE(?:[ \t]*:|[ \t]*$)/m.test(p))) process.exit(1);",
         "if (sections.some((p) => p.indexOf('filled-by: supervisor@round-' + e.round) < 0)) process.exit(1);",
                 // ⛔ writer 가 넘긴 command 를 믿지 않는다 — **로그에서 직접** 뽑아 문서와 대조한다(리뷰 must-fix).
         "const cm = testLine.match(/^\\[test\\]\\s+PASS\\s+(.+?)\\s*(?:—|$)/); if (!cm) process.exit(1);",
@@ -2602,8 +2602,9 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         // 문서가 baseline 문면도 담고 있어야 한다 — 근거가 문서 안에서 재검증 가능해야 한다.
                 // ⛔ 부분 문자열이 아니라 **로그의 baseline 줄 전체**와 대조한다 — `preexisting=9` 같은
         //   불일치가 통과하면 근거가 근거가 아니다(리뷰 must-fix).
-        "const bl = log.split('\\n').find((l) => l.indexOf('[gate-baseline]') === 0); if (!bl) process.exit(1);",
-        "if (body('## 불변식').indexOf(bl.trim()) < 0) process.exit(1);",
+        "const bl = log.split('\\n').find((l) => l.indexOf('[gate-baseline]') === 0);",
+        "if (bl) { if (!/^\\[gate-baseline\\] introduced=0, preexisting=0, unknown=0, precondition-unmet=0(?:,|$)/.test(bl)) process.exit(1); if (e.baselineLine !== bl.trim()) process.exit(1); if (sections.some((p) => p.indexOf(bl.trim()) < 0)) process.exit(1); }",
+        "else { if (e.baselineLine !== undefined) process.exit(1); if (sections.some((p) => p.indexOf('baseline not run (test PASS)') < 0)) process.exit(1); }",
         // ② 조건 줄의 명령을 **그 필드에서** 파싱해 대조한다 — 절 어딘가에 있으면 통과하던 것을 막는다.
         "const condLine = body('## 불변식').split('\\n').find((l) => l.indexOf('조건 —') >= 0); if (!condLine) process.exit(1);",
         "if (condLine.indexOf(cmdFromLog) < 0) process.exit(1);",
@@ -2686,7 +2687,12 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           taskCardId, storePath: taskAgentStatePath(), oldPr: outcome.supersededPr, newPr: number, url: outcome.url,
         });
       }
-      const opened: OpenPrOutcome = { url: outcome.url, number: Number.isFinite(number) ? number : 0, ...(rebind ? { rebind } : {}) };
+      // `reused` also covers unbound legacy branches. The manager supplies the
+      // proven old head only after exact same-card identity and lease checks.
+      const boundCardReuse = outcome.reused && outcome.boundCardHeadRefName
+        && !!taskCardId && /^[A-Za-z0-9][A-Za-z0-9._:-]{2,}$/.test(taskCardId)
+        ? { headRefName: outcome.boundCardHeadRefName } : undefined;
+      const opened: OpenPrOutcome = { url: outcome.url, number: Number.isFinite(number) ? number : 0, ...(boundCardReuse ? { boundCardReuse } : {}), ...(rebind ? { rebind } : {}) };
       return opened;
     },
 

package/src/self-implement/stop-autoheal.ts

@@ -51,6 +51,7 @@ export const AUTOHEAL_ACTION_BY_CLASS: Readonly<Record<RunStopClass, AutohealAct
   'env-unrelated': 'clean-workspace-regate',
   'main-sync': 'rebase-regate',
   'pod-died': 'resume-from-salvage',
+  'pod-vanished': 'needs-owner',
   'evidence-uncovered': 'derive-evidence-rejudge',
   'review-repeat': 'needs-owner',
   'review-out-of-scope': 'needs-owner',

package/src/self-implement/test-seams.ts

@@ -11,7 +11,8 @@ export function seams(over: Partial<SelfImplementSeams> & { gateResults?: boolea
   const gateResults = over.gateResults ?? [true];
   let gateCall = 0;
   const features = over.features ?? [];
-  return {
+  let openedHead = '';
+  const defaults: SelfImplementSeams = {
     // ⭐ 테스트는 «환경(실제 stdin)»이 아니라 계약을 검사한다 — 기본은 「사람이 있다」로 둔다.
     //    비-TTY 게이트 자체는 아래 전용 테스트가 «명시»로 확인한다.
     stdinIsInteractive: () => true,
@@ -41,4 +42,15 @@ export function seams(over: Partial<SelfImplementSeams> & { gateResults?: boolea
     decomposeShadowGoals: async () => ({ goals: [], decomposition: { recommendedMaxTasks: 6, actualTaskCount: 0, truncatedAtHardMax: false, exceededRecommendedMax: false, outcome: 'single-no-subtasks' } }),
     ...over,
   };
+  const openPr = defaults.openPr;
+  const defaultPrAttribution = Object.assign(async () => ({
+    headRefName: openedHead, createdAt: new Date(Date.now() + 60_000).toISOString(),
+  }), { testDefaultPrAttribution: true });
+  return {
+    ...defaults,
+    openPr: async (input) => { openedHead = input.head; return openPr(input); },
+    // Unit seams represent the PR just opened by this run. Tests of mismatch
+    // and metadata failures override this explicitly, without invoking gh.
+    readPrAttribution: over.readPrAttribution ?? defaultPrAttribution,
+  };
 }

package/src/self-implement/train-reach-grouping.ts

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { SPAWN_SYNC_MAX_BUFFER } from '../util/spawn-sync-output.js';
 import { isAbsolute } from 'node:path';
 import { selectGateTestFiles } from './gate-cli.js';
+import { defineTrainGrouping } from '../../scripts/release-loop/gate-closure.js';
 
 export interface TrainReachCandidate {
   pr: string;
@@ -126,9 +127,14 @@ export function buildTrainReachDecision(input: TrainReachInput, inspect: Inspect
   const edges: Array<{ left: number; right: number; tests: string[]; paths: string[] }> = [];
   for (let left = 0; left < measured.length; left++) {
     for (let right = left + 1; right < measured.length; right++) {
-      const tests = measured[left].tests.filter((path) => measured[right].tests.includes(path));
+      // 도달 시험 집합의 교집합이 «같은 열차»를 정한다 — TRAIN-REACH-GROUPING 원장(gate-closure.ts).
+      const grouping = defineTrainGrouping(
+        { pr: measured[left].candidate.pr, tests: measured[left].tests },
+        { pr: measured[right].candidate.pr, tests: measured[right].tests },
+      );
+      const tests = [...grouping.intersection];
       const paths = measured[left].files.filter((path) => measured[right].files.includes(path));
-      if (!tests.length && !paths.length) continue;
+      if (!grouping.sameTrain && !paths.length) continue;
       edges.push({ left, right, tests, paths });
       parent[find(right)] = find(left);
     }

package/src/session/chat.ts

@@ -183,7 +183,7 @@ function toLLM(messages: SerializedMessage[], systemPrompt?: string): LLMMessage
   for (const m of messages) {
     // 'tool' = durable tool-telemetry (추적성·audit-only). Excluded from replay
     // so persisted tool rounds don't pollute the next turn's conversation context.
-    if (m.role === 'tool') continue;
+    if (m.role === 'tool' || m.goalInterim === true) continue;
     const role: LLMMessage['role'] =
       m.role === 'user' ? 'user'
       : m.role === 'assistant' ? 'assistant'
@@ -473,6 +473,12 @@ export async function runTurn(opts: RunTurnOpts): Promise<RunTurnResult> {
         signal: opts.signal ?? new AbortController().signal,
         callbacks: {
           onText: (delta) => { opts.onDelta?.(delta); },
+          onGoalInterim: (interimText) => {
+            appendMessage(opts.sessionId, {
+              role: 'assistant', content: interimText, ts: new Date().toISOString(),
+              tokenEstimate: estimateTokens(interimText), goalInterim: true,
+            });
+          },
           onToolCall: (call) => { toolCallArgs.set(call.id, call.args); opts.onToolCall?.(call); },
           onToolResult: (call) => {
             try {

package/src/session/id-prefix.ts

@@ -0,0 +1,60 @@
+// Shortest session-id prefix that still names exactly one session (TUI-RESUME-PICKER).
+// Lists used to cut every id to 8 characters, so two sessions sharing those 8 looked the same and
+// `/session load <shown prefix>` failed as ambiguous. `resolveSessionId` searches the whole index,
+// so uniqueness is measured against every id there — not only the rows on screen.
+import { listSessions } from './index.js';
+
+/** Never shorter than this, so short lists keep the familiar 8-character look. */
+export const SESSION_ID_PREFIX_MIN = 8;
+
+function commonPrefixLength(a: string, b: string): number {
+  const n = Math.min(a.length, b.length);
+  let i = 0;
+  while (i < n && a.charCodeAt(i) === b.charCodeAt(i)) i++;
+  return i;
+}
+
+/**
+ * For each id in `ids`, the shortest prefix (≥ `min`) that no other id in `universe` starts with.
+ * An id that is itself a prefix of another id gets the whole id (resolveSessionId takes an exact match).
+ */
+export function uniqueIdPrefixes(ids: readonly string[], universe: readonly string[], min = SESSION_ID_PREFIX_MIN): Map<string, string> {
+  const sorted = [...new Set([...universe, ...ids])].sort();
+  const position = new Map(sorted.map((id, i) => [id, i]));
+  const out = new Map<string, string>();
+  for (const id of ids) {
+    if (out.has(id)) continue;
+    const i = position.get(id)!;
+    // In sorted order the longest shared prefix is always with a direct neighbour.
+    const shared = Math.max(
+      i > 0 ? commonPrefixLength(id, sorted[i - 1]!) : 0,
+      i + 1 < sorted.length ? commonPrefixLength(id, sorted[i + 1]!) : 0,
+    );
+    out.set(id, id.slice(0, Math.min(id.length, Math.max(min, shared + 1))));
+  }
+  return out;
+}
+
+/** `uniqueIdPrefixes` against every session in the store (the set `/session load` resolves in). */
+export function sessionIdPrefixes(ids: readonly string[], root?: string): Map<string, string> {
+  const universe = (root === undefined ? listSessions() : listSessions({}, root)).map((m) => m.id);
+  return uniqueIdPrefixes(ids, universe);
+}
+
+/** Display helper: the unique prefix of one id, padded so a column stays aligned. */
+export function idPrefixCell(prefixes: ReadonlyMap<string, string>, id: string): string {
+  const width = Math.max(SESSION_ID_PREFIX_MIN, ...[...prefixes.values()].map((p) => p.length));
+  return (prefixes.get(id) ?? id.slice(0, SESSION_ID_PREFIX_MIN)).padEnd(width);
+}
+
+const pad2 = (n: number) => String(n).padStart(2, '0');
+
+/**
+ * `MM-DD HH:mm` in the viewer's local time zone. Lists used to slice the stored UTC ISO string
+ * (`updatedAt.slice(5, 16)`), so a KST viewer saw 16:24 for a session touched at 01:24.
+ */
+export function sessionListTime(iso: string): string {
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return iso.slice(5, 16).replace('T', ' ');
+  return `${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}`;
+}

package/src/session/index.ts

@@ -304,6 +304,8 @@ export interface SerializedMessage {
   toolArgs?: unknown;
   toolResult?: unknown;
   tokenEstimate?: number;
+  /** Goal-loop iteration reply, not the final assistant answer. */
+  goalInterim?: boolean;
   /** Per-turn stable identifier. Auto-populated by `appendMessage` when the
    *  caller omits it (SAM S0 seed · M1.2 narrow). The wire format stays a
    *  bare 26-char ULID; external inputs should pass through `asTurnUri()`
@@ -1513,6 +1515,8 @@ export function resolveSessionId(
   root: string = sessionRoot(),
 ): string | null {
   const idx = readIndex(root);
+  // A whole id wins even when it is also the start of a longer id — otherwise that session could never be named.
+  if (idx.some(m => m.id === prefix)) return prefix;
   const matches = idx.filter(m => m.id.startsWith(prefix));
   if (matches.length === 0) return null;
   if (matches.length > 1) {

package/src/session-runtime/index.ts

@@ -1702,12 +1702,20 @@ function buildEssentialSessionRuntimeToolSpecs(opts: {
         .map(tool => tool.spec)
       : [];
   });
+  // External MCP proxy runtimes are registered asynchronously by the TUI boot
+  // path and carry both `mcp` and `tui` surfaces. They are intentionally not
+  // part of the fixed built-in family allowlist above; include these explicit
+  // dynamic capabilities so ACP can advertise and dispatch their exact IDs.
+  const mcpProxySpecs = opts.runtimeTools
+    .filter(tool => tool.id.includes('.') && tool.surfaces?.includes('mcp') && tool.surfaces.includes('tui'))
+    .filter(tool => isToolAvailable(tool.spec.name, opts.toolAvailability))
+    .map(tool => tool.spec);
   const optionalByName = new Map(opts.optionalTools.map(tool => [tool.name, tool] as const));
   const optionalSpecs = ESSENTIAL_OPTIONAL_TOOL_NAMES
     .map(name => optionalByName.get(name))
     .filter((tool): tool is LLMToolSpec => !!tool)
     .filter(tool => isToolAvailable(tool.name, opts.toolAvailability));
-  return [...nativeSpecs, ...hostSpecs, ...runtimeSpecs, ...optionalSpecs];
+  return [...nativeSpecs, ...hostSpecs, ...runtimeSpecs, ...mcpProxySpecs, ...optionalSpecs];
 }
 
 export function buildSessionRuntimeToolSpecs(opts: {

package/src/skills/tools/pty.ts

@@ -149,6 +149,11 @@ export async function dispatchPtyShellStart(
   opts: PtyDispatchOpts = {},
 ): Promise<{ output: string }> {
   const args = validateStart(rawArgs);
+  // Keep the self-nest guard at the shared production boundary: the daemon
+  // tool surface and the skills runner both reach this dispatcher.
+  const { decideTuiSelfNest } = await import('../../agent/terminal-surface.js');
+  const selfNest = decideTuiSelfNest([args.cmd, ...(args.args ?? [])]);
+  if (selfNest.reject) return { output: selfNest.output ?? '' };
   const boundaryReject = harnessCommandWriteReject([args.cmd, ...(args.args ?? [])], args.workdir ?? process.cwd(), 'pty-start');
   if (boundaryReject) return { output: boundaryReject };
   if (!ptyAvailable()) {

package/src/status/metrics.ts

@@ -16,7 +16,7 @@
 
 import { costForUsageDetailed, type TokenUsage } from '../models/costs.js';
 import { resolveModelContextWindow } from '../models/context-window.js';
-import { DEFAULT_TOKEN_BUDGET, estimateTokens } from '../tokens.js';
+import { DEFAULT_TOKEN_BUDGET, estimateMessagesTokens, estimateTokens } from '../tokens.js';
 
 export interface SessionMetrics {
   /** Cumulative input tokens sent this session. */
@@ -119,6 +119,17 @@ export function recordTurn(input: RecordTurnInput): SessionMetrics {
   return singleton;
 }
 
+/**
+ * A conversation was just restored (`/session load` · `--resume`): the next turn will send all of it,
+ * so the ctx readout shows that size now instead of 0 until the first turn reports real usage
+ * (TUI-RESUME-PICKER ④). The first `recordTurn` replaces it with the provider's number.
+ */
+export function noteRestoredContext(history: readonly { role: string; content: unknown }[]): number {
+  const used = estimateMessagesTokens(history.map((m) => ({ role: m.role, content: typeof m.content === 'string' ? m.content : JSON.stringify(m.content ?? '') })));
+  singleton.lastContextUsed = used;
+  return used;
+}
+
 /** Elapsed time since session start, in seconds. Updated on every
  *  call (doesn't depend on recordTurn firing). */
 export function sessionElapsedSec(): number {

package/src/steward/rejudge-tick.ts

@@ -19,7 +19,7 @@ import { debug } from '../debug/log.js';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
 import { spawnElanous } from '../instance/spawn-elanous.js';
 import { getUserConfig } from '../user-config.js';
-import { resyncPendingPath } from './resync-tick.js';
+import { resyncPendingPath, resyncPendingRecoveryPath } from './resync-tick.js';
 
 export const REJUDGE_TICK_EVENT = 'rejudge-tick';
 export const REJUDGE_DEFAULT_MAX_LOAD = 60;
@@ -145,11 +145,18 @@ export async function rejudgeTick(deps: RejudgeTickDeps = {}): Promise<RejudgeTi
   }
 }
 
+/**
+ * The resync marker, or its recovery sibling when the primary record could not be written after a push. Both carry
+ * `{ savedAt }`, so a same-tick rejudge still sees the new head instead of falling back to the cadence alone.
+ */
 function readPending(path: string): string | null {
-  try {
-    const value = (JSON.parse(readFileSync(path, 'utf8')) as { savedAt?: unknown }).savedAt;
-    return typeof value === 'string' && Number.isFinite(Date.parse(value)) ? value : null;
-  } catch { return null; }
+  for (const candidate of [path, resyncPendingRecoveryPath(path)]) {
+    try {
+      const value = (JSON.parse(readFileSync(candidate, 'utf8')) as { savedAt?: unknown }).savedAt;
+      if (typeof value === 'string' && Number.isFinite(Date.parse(value))) return value;
+    } catch { /* missing or unreadable: fall through to the recovery marker */ }
+  }
+  return null;
 }
 
 if (import.meta.main) {

package/src/steward/resync-tick.ts

@@ -16,6 +16,36 @@ type ResyncTickResult = { decision: 'ran' | 'failed' | 'skipped-release' | 'skip
 
 export function resyncPendingPath(): string { return join(effectiveInstanceRoot(), 'steward', 'resync-pending.json'); }
 
+/**
+ * Fallback marker for the same-tick rejudge node when the primary marker cannot be written after a successful
+ * remote push. It lives next to the primary marker and carries the same `{ savedAt }` shape, so the consumer
+ * contract does not change — only the location the marker is read from.
+ */
+export function resyncPendingRecoveryPath(pendingPath: string = resyncPendingPath()): string {
+  return join(dirname(pendingPath), 'resync-pending-recovery.json');
+}
+
+/** Best-effort marker write: a record failure must not undo the completed push or hide its new head. */
+function recordResyncPending(pendingPath: string): void {
+  const savedAt = new Date().toISOString();
+  try {
+    mkdirSync(dirname(pendingPath), { recursive: true });
+    writeFileSync(pendingPath, JSON.stringify({ savedAt }));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`steward resync: pending record write failed — ${message}`);
+    try {
+      const recoveryPath = resyncPendingRecoveryPath(pendingPath);
+      mkdirSync(dirname(recoveryPath), { recursive: true });
+      writeFileSync(recoveryPath, JSON.stringify({ savedAt }));
+      console.error(`steward resync: pending record recovered at ${recoveryPath}`);
+    } catch (fallbackError) {
+      // Nothing left to write: the tick still reports `ran` with the pushed summary, and the failure stays observable.
+      console.error(`steward resync: pending record recovery failed — ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
+    }
+  }
+}
+
 /** The same registered, detached OP checkout used by steward launch; the installed package is not a git repository. */
 export function stewardResyncRepoRoot(
   resolveSeat: typeof resolveHqLaunchSeat = resolveHqLaunchSeat,
@@ -185,10 +215,7 @@ export async function resyncTickWithReleaseProbe(
           result = { decision: 'skipped-release-window', reason: window === 'inside' ? 'scheduled release window' : 'release schedule unavailable' };
         } else {
           const summary = await run();
-          if (summary.saved > 0) {
-            mkdirSync(dirname(pendingPath), { recursive: true });
-            writeFileSync(pendingPath, JSON.stringify({ savedAt: new Date().toISOString() }));
-          }
+          if (summary.saved > 0) recordResyncPending(pendingPath);
           result = { decision: 'ran', summary };
         }
       }