elanous 0.2.37 → 0.2.38

package/src/self-implement/off-diff-evidence.ts

@@ -5,6 +5,7 @@ import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
 import { narrowerEvidenceCommand } from './evidence-command-budget.js';
 import { resolveRunIdentity } from '../harness/harness-space.js';
+import { authoredSignalCommandFromGoal } from './goal-doc/section.js';
 //
 // ⛔ **왜 필요한가** — 리뷰어의 증거 채널은 워크트리 diff 하나다(`seams.ts` 의 `reviewDiff`).
 // 그래서 자식이 **diff 로 드러나지 않는 이행**(명령을 돌려 확인한 결과·라이브 관측)을 했을 때
@@ -334,6 +335,26 @@ interface RequiredEvidenceCheckRun {
   readonly substitutedFor?: string;
 }
 
+function authoredSignalCommand(goal: string): string | undefined {
+  const command = authoredSignalCommandFromGoal(goal);
+  if (!command) return undefined;
+  // Goal-authored signals run as one explicit command. Reject shell composition and
+  // substitutions; keep the accepted executable set aligned with goal-author's contract.
+  if (/[\r\n;|&<>`$()]/u.test(command) || /\b(?:sudo|eval|exec)\b/u.test(command)) return undefined;
+  const match = command.match(/^([A-Za-z0-9_./~-]+)\s+(.+)$/u);
+  if (!match) return undefined;
+  const executable = match[1]!.split('/').at(-1);
+  if (!new Set(['eln','bun','git','gh','rg','test','npm','pnpm','yarn','node','python','python3','pytest','make','cargo','go','curl','jq','sqlite3','grep','sed','awk','cat','find','docker','kubectl']).has(executable!)) return undefined;
+  if (executable === 'test' && !/^(?:-f|-e)\s+[^\s]+$/u.test(match[2]!)) return undefined;
+  return command;
+}
+
+export function authoredSignalExecution(goal: string, checks: readonly RequiredEvidenceCheckRun[]): { command: string; exitCode: number | null; stdout: string; stderr: string } | undefined {
+  const command = authoredSignalCommand(goal);
+  const run = command ? checks.find((check) => check.command === command) : undefined;
+  return run ? { command: run.command, exitCode: run.exitCode, stdout: run.stdout, stderr: run.stderr } : undefined;
+}
+
 type EvidenceCommandRunner = (command: string, cwd: string) => Pick<ReturnType<typeof spawnSync>, 'status' | 'stdout' | 'stderr' | 'error'>;
 
 /**
@@ -436,6 +457,8 @@ export function runRequiredEvidenceChecks(goal: string, cwd: string, runId?: str
 } = {}): RequiredEvidenceCheckRun[] {
   const identity = resolveRunIdentity({ explicit: runId });
   const checks = requiredEvidenceFromGoal(goal).flatMap(({ tag, verifyCommand }) => verifyCommand ? [{ tag, command: verifyCommand }] : []);
+  const signalCommand = authoredSignalCommand(goal);
+  if (signalCommand && !checks.some(({ command }) => command === signalCommand)) checks.push({ tag: 'authored-signal', command: signalCommand });
   // Direct callers without a measured HEAD have no stable revision identity;
   // the run-owned wrapper supplies a temporary identity when appropriate.
   const timeoutCounts = options.headCommit ? options.timeoutCounts : undefined;

package/src/self-implement/orchestrator.ts

@@ -33,7 +33,7 @@ export {
 } from './pr-evidence-artifact.js';
 import { judgePredictionAccuracy } from './judge-prediction-accuracy.js';
 import { classifyPodReviewBudgetResidue, measureReviewFindingRecurrence, type ReviewFindingRecurrence, type RecurrenceFinding } from './review-finding-recurrence.js';
-import type { ReviewRework } from '../self-dev/run-types.js';
+import type { ReviewRework, SelfDevJobResult } from '../self-dev/run-types.js';
 import { createHash } from 'node:crypto';
 import { appendFileSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync } from 'node:fs';
 import { writeGoalDocumentAtomic } from './goal-document-write.js';
@@ -226,7 +226,7 @@ import { formatGateFailedId, type PremiseReviewCard, type PremiseReviewInput } f
 import { runWorkflowToCompletion } from '../workflow-runtime/executor.js';
 import { mapReworkVerdict, supervisionObservationFields } from './supervision-vocabulary.js';
 import { resolveRunOutcome } from './run-outcome.js';
-import { authorLimitationCountFromGoal, harvestEvidenceLines, harvestedEvidenceObservation, MAX_HARVESTED_EVIDENCE_CHARS, parseOffDiffEvidence, requiredEvidenceFromGoal, createRequiredEvidenceBudget, coverRequiredEvidence, settleUncoveredEvidence, formatUncoveredEvidenceFeedback, type OffDiffEvidenceParse } from './off-diff-evidence.js';
+import { authorLimitationCountFromGoal, authoredSignalExecution, harvestEvidenceLines, harvestedEvidenceObservation, MAX_HARVESTED_EVIDENCE_CHARS, parseOffDiffEvidence, requiredEvidenceFromGoal, createRequiredEvidenceBudget, coverRequiredEvidence, settleUncoveredEvidence, formatUncoveredEvidenceFeedback, type OffDiffEvidenceParse } from './off-diff-evidence.js';
 import { resolveEvidenceHeadCommit } from './evidence-command-budget.js';
 import { pressDecisionSignals, type DecisionSignalPressResult } from './decision-signal-press.js';
 import { inspectDecisionObservations, inspectDecisionSignalKinds, inspectDecisionSignalObservations } from '../../scripts/ask-marker-check.js';
@@ -1107,6 +1107,8 @@ export interface SelfImplementSeams {
   synthesizeGoalContext?: (input: { goalFile?: string }) => Promise<Pick<import('../harness/harness-worktree-add.js').HarnessWorktreeGoalMetadata, 'goalTitle' | 'goalDescription' | 'goalDescriptionSource'>>;
   createWorktree: (opts: { branch: string; base?: string; runId?: string } & import('../harness/harness-worktree-add.js').HarnessWorktreeGoalMetadata) => Promise<{
     path: string; branch: string;
+    /** A single-use Pod may implement in its already checked-out source tree. */
+    inPlace?: boolean;
     /** Strict provenance values are returned only after their recording succeeds. */
     owner?: string;
     command?: string;
@@ -2355,6 +2357,8 @@ export interface SelfImplementResult {
   walk?: readonly { node: string; round: number }[];
   /** Canonical run-identity join key; always present because resolveRunIdentity always mints or inherits one. */
   runId: string;
+  /** Parent-observed goal-plan revision attempt evidence; omitted when no ledger evidence was read. */
+  goalPlanRevision?: SelfDevJobResult['goalPlanRevision'];
   ok: boolean;
   stage: SelfImplementStage;
   /** Verbatim must-fix findings retained on a review-blocked terminal result. */
@@ -3329,7 +3333,12 @@ async function runPostMergeCleanup(
   goalFile: string | undefined,
   remoteBranch: string | undefined,
   observe: (event: string, data: Record<string, unknown>) => void,
+  inPlace = false,
 ): Promise<void> {
+  if (inPlace) {
+    observe('post-merge-cleanup-preserved', { worktreePath, branch, reason: 'pod-inplace-source' });
+    return;
+  }
   if (!cleanup?.enabled) {
     observe('post-merge-cleanup-preserved', { worktreePath, branch, reason: cleanup ? 'disabled' : 'not-configured' });
     return;
@@ -5286,6 +5295,7 @@ async function runSelfImplementInner(
   observe('worktree', {
     path: wt.path,
     branch: wt.branch,
+    inPlace: wt.inPlace === true,
     terminalLaunchHead: terminalLaunchHead ?? null,
     terminalLaunchDirtyPaths: terminalLaunchDirtyPaths ? [...terminalLaunchDirtyPaths] : null,
     // ⭐ 우리가 **무엇을 요청했는지는 이미 안다** — 시임 반환에서 되읽지 않는다.
@@ -5306,7 +5316,7 @@ async function runSelfImplementInner(
   // ⛔ 발사 부모(`harness ask`·`dev`)에는 ELANOUS_HARNESS_SPACE_ID 가 «없다» — 그 env 는 자식에게만 심긴다.
   //   그래서 getHarnessSpace() 만 보면 운영에서 늘 undefined 이고 정지 확인이 «한 번도» 안 돈다(#20040 착지 직후 실측).
   //   `self send <space> --stop` 이 겨냥하는 것은 자식의 공간 = 워크트리 이름이다(아래 activeChildInboxId 와 같은 식 · dev-cli.ts recordRestart 폴백과 같다).
-  const parentSoftStopSpaceId = s.parentSoftStopSpaceId || getHarnessSpace()?.id || normalizeSpaceId(basename(wt.path)) || undefined;
+  const parentSoftStopSpaceId = s.parentSoftStopSpaceId || getHarnessSpace()?.id || normalizeSpaceId(wt.inPlace ? runId : basename(wt.path)) || undefined;
   if (parentSoftStopSpaceId) {
     try { s.onSoftStopSpaceReady?.(parentSoftStopSpaceId); } catch { /* UI registration must not break execution */ }
   }
@@ -5457,7 +5467,11 @@ async function runSelfImplementInner(
   // The repository copy travels with both local and Pod worktrees. Operational HQ ledgers are never read here.
   const knowhow = selectKnowhowPack(wt.path, opts.feature);
   if (knowhow.text) round0Feature = `${knowhow.text}\n\n${round0Feature}`;
-  observe('knowhow-pack', { ids: knowhow.ids, bytes: knowhow.bytes, injected: knowhow.bytes > 0 });
+  const knowhowRevisionRead = runGitCommand(wt.path, ['rev-parse', '--verify', 'HEAD'], { encoding: 'utf8', timeout: 10_000 });
+  const knowhowRevision = knowhowRevisionRead.status === 0 && /^[0-9a-f]{40,64}$/i.test(knowhowRevisionRead.stdout.trim())
+    ? knowhowRevisionRead.stdout.trim() : null;
+  observe('knowhow-pack', { ids: knowhow.ids, bytes: knowhow.bytes, injected: knowhow.bytes > 0,
+    reason: knowhow.reason, repoPath: wt.path, repoRevision: knowhowRevision });
 
   // E1 착수 구체화(RFC-progressive-goal-elaboration §2 E1 · §7 간선 ①) — 고정 층(KPI·판정 신호)은 그대로, 카드만 덧붙인다.
   const elaboration = await (await import('./goal-elaborate.js')).runArrivalElaboration({ goal: opts.feature, prompt: round0Feature, cwd: wt.path, callLLM: s.elaborateCallLLM, observe });
@@ -5523,7 +5537,7 @@ async function runSelfImplementInner(
     readonly update?: (delivery: SupervisorDeliveryState, reason?: string) => void;
   };
   let supervisorDeliveryUpdates: PendingSupervisorDelivery[] = [];
-  const activeChildInboxId = normalizeSpaceId(basename(wt.path));
+  const activeChildInboxId = normalizeSpaceId(wt.inPlace ? runId : basename(wt.path));
   const undeliveredSupervisorInputs: UndeliveredSupervisorInput[] = [];
   const recordUndeliveredSupervisorInput = (text: string, reason: string): void => {
     undeliveredSupervisorInputs.push({ text, reason });
@@ -7383,12 +7397,16 @@ async function runSelfImplementInner(
           try { after = (s.changedFilesForGateRoute ?? changedFiles)(wt.path); } catch { /* unknown diff */ }
           const targetDiff = after === undefined ? undefined : eligible(after);
           const resultLine = /(?:^|\n)\s*RESULT:\s*\S/m.test(impl.evidenceTranscript ?? impl.summary);
-          const succeeded = impl.ok && !!targetDiff?.length && resultLine;
+          // A completed child can leave a real, declared-target diff while its
+          // final screen omits RESULT. The measured diff is sufficient to enter
+          // review/gate; a failed child or an unmeasured/empty diff still stops.
+          const succeeded = impl.ok && !!targetDiff?.length;
           goalOnlyReworkExhausted = !succeeded;
           observe('implementation-goal-only-rework', {
             status: succeeded ? 'succeeded' : 'exhausted', round: retryRound, targets,
             firstToolCalls, retryToolCalls: impl.toolCalls ?? null,
             targetDiffCount: targetDiff?.length ?? null, diffMeasured: after !== undefined, resultLine,
+            ...(succeeded ? { evidenceBasis: resultLine ? 'result-and-target-diff' : 'declared-target-diff' } : {}),
           }, succeeded ? {} : { level: 'warn' });
           if (!succeeded) impl = { ...impl, ok: false, summary: `goal-only-rework-exhausted: ${impl.summary}` };
           round = retryRound;
@@ -7546,6 +7564,7 @@ async function runSelfImplementInner(
       catch { /* observation is fail-soft */ }
     }
     const evidenceChecks = runBudgetedEvidenceChecks(roundGoal, wt.path, runId, evidenceHead);
+    const authoredSignal = authoredSignalExecution(roundGoal, evidenceChecks);
     const tagCoverage = coverRequiredEvidence(requiredEvidence, offDiffEvidence.items);
     // EVIDENCE-WIRING-EXEMPT — a requirement whose own `|| bun test …` check passed is covered by what the harness measured.
     const settledByCheck = settleUncoveredEvidence(tagCoverage.uncovered, { checks: evidenceChecks, required: requiredEvidence });
@@ -8141,15 +8160,17 @@ async function runSelfImplementInner(
         let goalSlotFill: SupervisorGoalFillResult = 'unverifiable';
         let goalSlotDeficit: import('./goal-supervisor-fill.js').SupervisorGoalDeficit | undefined;
         let goalSlotAction: 'remeasure' | 'connect-goal' | undefined;
+        let goalSlotFillError = false;
         try {
           goalSlotFill = await fillUnverifiableGoalSlots({
-            path: opts.goalFile, round, gate, review,
+            path: opts.goalFile, round, gate, review, ...(authoredSignal ? { authoredSignal } : {}),
             ...(goalWiring ? { wiring: goalWiring } : {}),
             independentlyCheck: s.independentlyCheckGoalSlots ?? (async () => false),
             observeDeficit: (deficit) => { goalSlotDeficit = deficit; },
           });
         } catch {
           goalSlotFill = 'rejected';
+          goalSlotFillError = true;
         }
         if (goalSlotFill === 'not-applicable') {
           observe('goal-slot-remeasure-result', { round, result: goalSlotFill, gatePassed: gate.passed,
@@ -8173,7 +8194,7 @@ async function runSelfImplementInner(
           gate = measuredGate;
           let remeasureDeficit: import('./goal-supervisor-fill.js').SupervisorGoalDeficit | undefined;
           if (gate.passed) {
-            goalSlotFill = await fillUnverifiableGoalSlots({ path: opts.goalFile, round, gate, review,
+            goalSlotFill = await fillUnverifiableGoalSlots({ path: opts.goalFile, round, gate, review, ...(authoredSignal ? { authoredSignal } : {}),
               independentlyCheck: s.independentlyCheckGoalSlots ?? (async () => false),
               observeDeficit: (deficit) => { remeasureDeficit = deficit; } });
           }
@@ -8181,8 +8202,27 @@ async function runSelfImplementInner(
             gatePassed: measuredGate.passed,
             ...(remeasureDeficit ? { deficitKind: remeasureDeficit.kind,
               deficitEvidenceId: remeasureDeficit.evidenceId, gateLog: remeasureDeficit.gateLog,
-              reason: remeasureDeficit.reason, inputSummary: remeasureDeficit.inputSummary, gateLogRef: remeasureDeficit.gateLogRef } : {}) });
-          if (!gate.passed || goalSlotFill === 'unverifiable' || goalSlotFill === 'rejected') {
+              reason: remeasureDeficit.reason, reasonDetail: remeasureDeficit.reasonDetail,
+              inputSummary: remeasureDeficit.inputSummary, gateLogRef: remeasureDeficit.gateLogRef } : {}) });
+          if (goalSlotFill === 'unverifiable' && gate.passed) {
+            finalizeSupervisorDeliveries('goal-slot-remeasurement-unverifiable');
+            const evidenceReason = [remeasureDeficit?.reason, remeasureDeficit?.reasonDetail]
+              .filter((part): part is string => Boolean(part)).join(' · ');
+            const reason = `goal-slot remeasurement remained unverifiable after the second gate passed · evidence ${goalSlotDeficit.evidenceId}${evidenceReason ? ` · ${evidenceReason}` : ''}`;
+            observe('goal-slot-remeasurement-preserved', {
+              round, evidenceId: goalSlotDeficit.evidenceId, gatePassed: true,
+              reason: remeasureDeficit?.reason ?? 'remeasurement-deficit-not-reported',
+              ...(remeasureDeficit?.reasonDetail ? { reasonDetail: remeasureDeficit.reasonDetail } : {}),
+              ...(remeasureDeficit?.gateLogRef ? { gateLogRef: remeasureDeficit.gateLogRef } : {}),
+              disposition: 'preserve-for-recovery',
+            });
+            const pr = await preserveBlockedArtifacts({ stage: 'review-blocked', reason, gate, salvageStatusExpected: false });
+            return { ok: false, stage: 'review-blocked', node: 'rework', ...resolveRunOutcome({ termination: 'budget-exhausted' }),
+              sessionId, worktreePath: wt.path, branch: wt.branch, gate,
+              quotaExhaustionAssessment: quotaExhaustionAssessmentForRun(),
+              ...(pr ? { prUrl: pr.url, prNumber: pr.number } : {}), detail: reason };
+          }
+          if (!gate.passed || goalSlotFill === 'rejected') {
             finalizeSupervisorDeliveries('goal-slot-remeasure-gate-failed');
             const reason = `goal-slot remeasurement ${!gate.passed ? 'failed' : goalSlotFill === 'rejected' ? 'rejected' : 'unmeasured'} · evidence ${goalSlotDeficit.evidenceId}`;
             const pr = await preserveBlockedArtifacts({ stage: 'gate-failed', reason, gate, salvageStatusExpected: false });
@@ -8193,7 +8233,10 @@ async function runSelfImplementInner(
           }
         }
         observe('goal-slot-fill', { round, result: goalSlotFill, gatePassed: gate.passed, reviewVerdict: review.verdict,
-          ...(goalSlotFill === 'unverifiable' && goalSlotDeficit ? { reason: goalSlotDeficit.reason, inputSummary: goalSlotDeficit.inputSummary, gateLogRef: goalSlotDeficit.gateLogRef } : {}),
+          ...(goalSlotDeficit ? { reason: goalSlotDeficit.reason, reasonDetail: goalSlotDeficit.reasonDetail,
+            inputSummary: goalSlotDeficit.inputSummary, gateLogRef: goalSlotDeficit.gateLogRef } : {}),
+          ...(!goalSlotDeficit && goalSlotFill === 'unverifiable' ? { reason: 'goal-slot-fill-no-deficit' } : {}),
+          ...(goalSlotFillError ? { reason: 'goal-slot-fill-error' } : {}),
           ...(goalSlotFill === 'not-applicable' ? { reason: 'test-step-scope-skipped', scopeReason: gate.scopeReason,
             testStepExecuted: gate.testStepExecuted } : {}) });
         if (goalSlotAction === 'connect-goal' && goalSlotDeficit) {
@@ -9042,7 +9085,7 @@ async function runSelfImplementInner(
       await withJourneyNode('cleanup', { provenance: 'post-merge', runId }, () => runPostMergeCleanup(s.postMergeCleanup, wt.path, wt.branch, opts.goalFile, mergedBase && defaultBranch && displayBranchName(mergedBase) === displayBranchName(defaultBranch) ? defaultBranch : undefined, (event, data) => {
         if (event.startsWith('post-merge-cleanup-')) cleanupOutcome = event.slice('post-merge-cleanup-'.length);
         observe(event, data);
-      }));
+      }, wt.inPlace === true));
       exitJourneyNode('cleanup', { provenance: 'post-merge', runId, outcome: cleanupOutcome });
       const mergedLedger = (() => {
         try { return loadRunLedger(runId); } catch { return null; }

package/src/self-implement/pod-inplace-worktree.ts

@@ -0,0 +1,82 @@
+import { realpathSync } from 'node:fs';
+import { relative, resolve, sep } from 'node:path';
+import { debug } from '../debug/log.js';
+import { runGitCommand } from '../git-fs/runner.js';
+import { DEFAULT_BRANCH_WORKTREE_BASE, prepareWorktreeDependencies, resolveDefaultBranchBase, worktreeDependenciesAvailable } from '../git-fs/worktree.js';
+import type { CreateWorktreeResult } from '../git-fs/worktree.js';
+
+export type PodInplaceWorktree = CreateWorktreeResult & { readonly inPlace: true };
+
+export function tryCreatePodInplaceWorktree(input: {
+  readonly repoRoot: string;
+  readonly cwd: string;
+  readonly branch: string;
+  readonly base?: string;
+  readonly runId?: string;
+  readonly goalFile?: string;
+  readonly env: NodeJS.ProcessEnv;
+  readonly dependencyFallbackRoot?: string;
+}): PodInplaceWorktree | null {
+  if (input.env.ELANOUS_POD_INPLACE_WORKTREE !== '1') return null;
+  const skip = (reason: string): null => {
+    debug.log('self-implement', 'pod-inplace-worktree-skipped', { reason, branch: input.branch }, { level: 'warn' });
+    process.stderr.write(`ELANOUS_POD_INPLACE_SKIP reason=${reason}\n`);
+    return null;
+  };
+  if (input.env.ELANOUS_SUBSTRATE !== 'pod' || input.env.ELANOUS_POD_SINGLE_CHILD !== '1'
+    || !input.env.ELANOUS_POD_NAME?.trim() || !input.runId || input.env.ELANOUS_RUN_ID !== input.runId) {
+    return skip('not-single-owned-pod-child');
+  }
+  let repoRoot: string;
+  try {
+    repoRoot = realpathSync(input.repoRoot);
+    if (repoRoot !== realpathSync(input.cwd)) return skip('different-cwd');
+  } catch { return skip('repo-path-unavailable'); }
+  const git = (args: string[]) => runGitCommand(repoRoot, args, { encoding: 'utf8', timeout: 10_000 });
+  const top = git(['rev-parse', '--show-toplevel']);
+  if (top.status !== 0 || resolve(top.stdout.trim()) !== repoRoot) return skip('not-repo-root');
+  const head = git(['rev-parse', '--verify', 'HEAD']);
+  const resolvedBase = head.status === 0 ? head.stdout.trim() : '';
+  if (!/^[0-9a-f]{40,64}$/i.test(resolvedBase)) return skip('head-unavailable');
+  const base = input.base === DEFAULT_BRANCH_WORKTREE_BASE
+    ? (resolveDefaultBranchBase(repoRoot) ?? 'HEAD')
+    : (input.base ?? 'origin/main');
+  const pin = git(['rev-parse', '--verify', `${base}^{commit}`]);
+  if (pin.status !== 0 || pin.stdout.trim() !== resolvedBase) return skip('base-pin-mismatch');
+  const clean = git(['status', '--porcelain', '-z', '--untracked-files=all']);
+  let expectedGoalStatus: string | undefined;
+  if (input.goalFile) {
+    try {
+      const goalRelative = relative(repoRoot, realpathSync(resolve(repoRoot, input.goalFile))).split(sep).join('/');
+      if (/^docs\/goals\/GOAL-[^/]+\.md$/.test(goalRelative)) expectedGoalStatus = `?? ${goalRelative}`;
+    } catch { /* An unavailable goal file cannot exempt source dirt. */ }
+  }
+  const dirty = clean.stdout.split('\0').filter(Boolean);
+  if (clean.status !== 0 || (dirty.length > 0 && (dirty.length !== 1 || dirty[0] !== expectedGoalStatus))) return skip('source-dirty');
+  if (!worktreeDependenciesAvailable(repoRoot, input.dependencyFallbackRoot)) return skip('dependencies-unavailable');
+  const validBranch = git(['check-ref-format', '--branch', input.branch]);
+  if (validBranch.status !== 0) return skip('invalid-branch');
+  const held = git(['show-ref', '--verify', '--quiet', `refs/heads/${input.branch}`]);
+  if (held.status !== 1) return skip('branch-exists-or-unreadable');
+  const started = Date.now();
+  const switched = git(['switch', '--no-guess', '-c', input.branch]);
+  if (switched.status !== 0) {
+    throw new Error(`pod in-place branch switch failed: ${(switched.stderr || switched.stdout || `git exited ${switched.status}`).trim()}`);
+  }
+  const after = git(['rev-parse', '--verify', 'HEAD']);
+  const currentBranch = git(['branch', '--show-current']);
+  if (after.status !== 0 || after.stdout.trim() !== resolvedBase
+    || currentBranch.status !== 0 || currentBranch.stdout.trim() !== input.branch) {
+    throw new Error('pod in-place branch switch changed pin or branch unexpectedly');
+  }
+  const switchElapsedMs = Date.now() - started;
+  prepareWorktreeDependencies(repoRoot, repoRoot,
+    input.dependencyFallbackRoot ? { dependencyFallbackRoot: input.dependencyFallbackRoot } : {}, {});
+  const elapsedMs = Date.now() - started;
+  debug.log('self-implement', 'pod-inplace-worktree-selected', {
+    branch: input.branch, runId: input.runId, sourcePath: repoRoot,
+    resolvedBase, elapsedMs, switchElapsedMs, checkoutFiles: 0,
+  });
+  process.stderr.write(`ELANOUS_POD_INPLACE_SELECTED elapsedMs=${elapsedMs} switchMs=${switchElapsedMs} checkoutFiles=0\n`);
+  return { path: repoRoot, branch: input.branch, base: input.base ?? 'HEAD', resolvedBase, baseFreshness: 'head', inPlace: true };
+}

package/src/self-implement/pod-warm-pool-profile.ts

@@ -3,8 +3,8 @@ export const WARM_POOL_PROFILES = ['fixed', 'gate', 'landing', 'feature'] as con
 export type WarmPoolProfile = (typeof WARM_POOL_PROFILES)[number];
 export type WarmPoolTier = 'lite' | 'standard';
 const STANDARD_HOST_MAX: Readonly<Record<string, number>> = {
-  node-b: 16,
-  node-c: 4,
+  'node-b': 16,
+  'node-c': 4,
   'elangram-wsl': 5,
   'host-e-wsl': 5,
 };

package/src/self-implement/premise-review.ts

@@ -42,6 +42,11 @@ function latestFailingIds(input: FlexSignalsInput): readonly string[] | undefine
   return latest !== undefined && latest.length > 0 ? latest : undefined;
 }
 
+/** P2 evidence may name a file only when the latest failure ID itself confirms that attribution. */
+function latestPreexistingFailureId(input: FlexSignalsInput): string | undefined {
+  return latestFailingIds(input)?.find((id) => /\(preexisting\)\s*$/.test(id));
+}
+
 /**
  * 게이트 실패 id — 생산자(orchestrator 의 roundSummaryEntries.failedIds)와 P3 파서가 «같은 꼴»을 쓰도록
  * 둘 다 이 함수 짝을 거친다. 꼴: `${name}@${file ?? '?'} (${attribution})`.
@@ -96,11 +101,8 @@ function judgeP2(input: PremiseReviewInput): PremiseFinding {
   }
   const preexistingIndex = attributions.indexOf('preexisting');
   if (preexistingIndex >= 0) {
-    const latest = latestFailingIds(input);
-    const evidence = latest !== undefined && preexistingIndex < latest.length
-      ? latest[preexistingIndex]!
-      : 'preexisting';
-    return { premise: 'P2', verdict: 'wrong', evidence };
+    const latestPreexistingId = latestPreexistingFailureId(input);
+    return { premise: 'P2', verdict: 'wrong', evidence: latestPreexistingId ?? 'preexisting' };
   }
   if (attributions.includes('unknown')) {
     return { premise: 'P2', verdict: 'unknown', evidence: UNMEASURED };

package/src/self-implement/run-ledger.ts

@@ -452,6 +452,237 @@ export function loadRunGraphVariant(runId: string, dir = runLedgerDir()): RunGra
   return { variantId: record.variant_id, reason: record.reason };
 }
 
+/**
+ * Axes compared between what a run asked for and what it actually ran with:
+ * the child LLM request (`childModel`/`childProvider`), `zaiCodingPlan.overage`,
+ * the Pod pool and the parent host.
+ */
+export type RunRequestEffectiveAxis = 'childModel' | 'childProvider' | 'overagePolicy' | 'podPool' | 'parentHost';
+
+/** Ledger event carrying one requested-vs-effective comparison row set. */
+export const RUN_REQUEST_VS_EFFECTIVE_EVENT = 'run-request-vs-effective';
+
+const RUN_REQUEST_EFFECTIVE_AXES: readonly RunRequestEffectiveAxis[] = [
+  'childModel',
+  'childProvider',
+  'overagePolicy',
+  'podPool',
+  'parentHost',
+];
+
+/** Values of the compared axes. Requested and effective sides share this shape so a row can name both. */
+export interface RunRequestEffectiveValues {
+  childModel?: string;
+  childProvider?: string;
+  overagePolicy?: string;
+  podPool?: string;
+  parentHost?: string;
+}
+
+/** One axis whose requested value differs from the effective value observed while the run executed. */
+export interface RunRequestEffectiveMismatch {
+  axis: RunRequestEffectiveAxis;
+  requested: string;
+  effective: string;
+}
+
+export interface RunRequestEffectiveComparison {
+  requested: RunRequestEffectiveValues;
+  effective: RunRequestEffectiveValues;
+  mismatches: RunRequestEffectiveMismatch[];
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function readRunRequestEffectiveValues(value: unknown): RunRequestEffectiveValues {
+  if (!isPlainRecord(value)) return {};
+  const values: RunRequestEffectiveValues = {};
+  for (const axis of RUN_REQUEST_EFFECTIVE_AXES) {
+    const raw = value[axis];
+    if (typeof raw === 'string' && raw.trim()) values[axis] = raw.trim();
+  }
+  return values;
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+/** Compare both sides axis by axis; an axis observed on one side only is not a mismatch. */
+export function compareRunRequestEffective(
+  requested: RunRequestEffectiveValues,
+  effective: RunRequestEffectiveValues,
+): RunRequestEffectiveMismatch[] {
+  const mismatches: RunRequestEffectiveMismatch[] = [];
+  for (const axis of RUN_REQUEST_EFFECTIVE_AXES) {
+    const requestedValue = requested[axis];
+    const effectiveValue = effective[axis];
+    if (requestedValue === undefined || effectiveValue === undefined || requestedValue === effectiveValue) continue;
+    mismatches.push({ axis, requested: requestedValue, effective: effectiveValue });
+  }
+  return mismatches;
+}
+
+/**
+ * Read the two sides out of one observer event. The canonical contract is an explicit
+ * `data.requested` / `data.effective` object. The real orchestrator records the
+ * requested child at run-origin and the selected execution provider at start.
+ */
+function runRequestEffectiveSidesOf(entry: RunLedgerEntry): RunRequestEffectiveComparison {
+  const data = isPlainRecord(entry.data) ? entry.data : {};
+  const requested = readRunRequestEffectiveValues(data.requested);
+  const effective = readRunRequestEffectiveValues(data.effective);
+
+  if (entry.event === 'run-origin') {
+    requested.childProvider ??= nonEmptyString(data.childProvider);
+    requested.childModel ??= nonEmptyString(data.childModel);
+  }
+  if (entry.event === 'start') {
+    effective.childProvider ??= nonEmptyString(data.provider);
+    effective.childModel ??= nonEmptyString(data.model);
+  }
+
+  const childLlm = data.childLlm;
+  if (isPlainRecord(childLlm)) {
+    const provider = nonEmptyString(childLlm.provider);
+    if (provider !== undefined && requested.childProvider === undefined) requested.childProvider = provider;
+    const model = nonEmptyString(childLlm.model);
+    if (model !== undefined && requested.childModel === undefined) requested.childModel = model;
+  }
+  const zaiCodingPlan = data.zaiCodingPlan;
+  if (isPlainRecord(zaiCodingPlan)) {
+    const overage = nonEmptyString(zaiCodingPlan.overage);
+    if (overage !== undefined && requested.overagePolicy === undefined) requested.overagePolicy = overage;
+  }
+
+  for (const key of ['childStart', 'llmConsumeStart'] as const) {
+    const start = data[key];
+    if (!isPlainRecord(start)) continue;
+    const provider = nonEmptyString(start.provider);
+    if (provider !== undefined && effective.childProvider === undefined) effective.childProvider = provider;
+    const model = nonEmptyString(start.model);
+    if (model !== undefined && effective.childModel === undefined) effective.childModel = model;
+  }
+
+  return { requested, effective, mismatches: compareRunRequestEffective(requested, effective) };
+}
+
+/**
+ * Merge every non-comparison event of a run into one comparison. The request side keeps the
+ * first recorded value (run-origin) and the effective side keeps the last observed one
+ * (child start, first llm consume-start, actual Pod pool).
+ */
+export function runRequestEffectiveFromLedger(ledger: readonly RunLedgerEntry[]): RunRequestEffectiveComparison {
+  const requested: RunRequestEffectiveValues = {};
+  const effective: RunRequestEffectiveValues = {};
+  for (const entry of ledger) {
+    if (entry.event === RUN_REQUEST_VS_EFFECTIVE_EVENT) continue;
+    const sides = runRequestEffectiveSidesOf(entry);
+    for (const axis of RUN_REQUEST_EFFECTIVE_AXES) {
+      const requestedValue = sides.requested[axis];
+      if (requestedValue !== undefined && requested[axis] === undefined) requested[axis] = requestedValue;
+      const effectiveValue = sides.effective[axis];
+      if (effectiveValue !== undefined && effective[axis] === undefined) effective[axis] = effectiveValue;
+    }
+  }
+  return { requested, effective, mismatches: compareRunRequestEffective(requested, effective) };
+}
+
+/** Mismatch rows this run already wrote, de-duplicated across repeated comparisons. */
+export function recordedRunRequestEffectiveMismatches(
+  ledger: readonly RunLedgerEntry[],
+): RunRequestEffectiveMismatch[] {
+  const seen = new Set<string>();
+  const rows: RunRequestEffectiveMismatch[] = [];
+  for (const entry of ledger) {
+    if (entry.event !== RUN_REQUEST_VS_EFFECTIVE_EVENT) continue;
+    const recorded = isPlainRecord(entry.data) ? entry.data.mismatches : undefined;
+    if (!Array.isArray(recorded)) continue;
+    for (const row of recorded) {
+      if (!isPlainRecord(row)) continue;
+      const axis = row.axis;
+      if (typeof axis !== 'string' || !RUN_REQUEST_EFFECTIVE_AXES.includes(axis as RunRequestEffectiveAxis)) continue;
+      const requested = nonEmptyString(row.requested);
+      const effective = nonEmptyString(row.effective);
+      if (requested === undefined || effective === undefined) continue;
+      const key = `${axis}\u0000${requested}\u0000${effective}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      rows.push({ axis: axis as RunRequestEffectiveAxis, requested, effective });
+    }
+  }
+  return rows;
+}
+
+export interface RunRequestVsEffectiveRecordOptions {
+  /** Ledger directory; default = `runLedgerDir()`. */
+  dir?: string;
+}
+
+/**
+ * Write one `run-request-vs-effective` row under the run's own ledger file, inheriting the
+ * run's goalId and shard identity so the run stays a single mission on the timeline.
+ */
+export function recordRunRequestVsEffective(
+  runId: string,
+  requested: RunRequestEffectiveValues,
+  effective: RunRequestEffectiveValues,
+  options: RunRequestVsEffectiveRecordOptions = {},
+): RunRequestEffectiveComparison {
+  const dir = options.dir ?? runLedgerDir();
+  const ledger = loadRunLedger(runId, dir) ?? [];
+  const start = ledger.find((entry) => entry.event === 'start' && typeof entry.timestamp === 'string');
+  const goalOwner = ledger.find((entry) => nonEmptyString(entry.goalId) !== undefined);
+  const comparison: RunRequestEffectiveComparison = {
+    requested,
+    effective,
+    mismatches: compareRunRequestEffective(requested, effective),
+  };
+  appendRunLedgerEntry({
+    timestamp: new Date().toISOString(),
+    runId,
+    event: RUN_REQUEST_VS_EFFECTIVE_EVENT,
+    data: { requested: comparison.requested, effective: comparison.effective, mismatches: comparison.mismatches },
+    ...(goalOwner?.goalId === undefined ? {} : { goalId: goalOwner.goalId }),
+    ...(start?.orchestrationId === undefined ? {} : { orchestrationId: start.orchestrationId }),
+    ...(start?.shardId === undefined ? {} : { shardId: start.shardId }),
+    ...(start?.pieceIndex === undefined ? {} : { pieceIndex: start.pieceIndex }),
+    ...(start?.pieceTotal === undefined ? {} : { pieceTotal: start.pieceTotal }),
+  }, dir);
+  return comparison;
+}
+
+function sameRunRequestEffectiveMismatches(
+  left: readonly RunRequestEffectiveMismatch[],
+  right: readonly RunRequestEffectiveMismatch[],
+): boolean {
+  if (left.length !== right.length) return false;
+  const keys = new Set(right.map((row) => `${row.axis}\u0000${row.requested}\u0000${row.effective}`));
+  return left.every((row) => keys.has(`${row.axis}\u0000${row.requested}\u0000${row.effective}`));
+}
+
+/**
+ * Production hook: after any observer event lands, compare the run's requested and effective
+ * sides and write the mismatch rows when they differ. Idempotent — a run whose rows already
+ * match its current comparison writes nothing. Recording only; no alerting and no repair.
+ */
+function recordRunRequestVsEffectiveFromLedger(runId: string, dir: string, appended: RunLedgerEntry): void {
+  // Keep unrelated observer writes O(1); only events carrying one side can
+  // change the comparison. In particular, a long run must not reread its
+  // complete ledger after every progress event.
+  if (!['run-origin', 'start', 'child-start', 'llm-consume-start'].includes(appended.event)
+    && !isPlainRecord(appended.data?.requested) && !isPlainRecord(appended.data?.effective)) return;
+  if (appended.event === RUN_REQUEST_VS_EFFECTIVE_EVENT) return;
+  const ledger = loadRunLedger(runId, dir);
+  if (!ledger?.length) return;
+  const comparison = runRequestEffectiveFromLedger(ledger);
+  if (comparison.mismatches.length === 0) return;
+  if (sameRunRequestEffectiveMismatches(recordedRunRequestEffectiveMismatches(ledger), comparison.mismatches)) return;
+  recordRunRequestVsEffective(runId, comparison.requested, comparison.effective, { dir });
+}
+
 /** Append one observer event. Callers own fail-soft handling. */
 export function appendRunLedgerEntry(entry: RunLedgerEntry, dir = runLedgerDir()): void {
   if (refuseProductionLedgerWriteInTest(dir, 'run-ledger')) return;
@@ -465,6 +696,11 @@ export function appendRunLedgerEntry(entry: RunLedgerEntry, dir = runLedgerDir()
     const line = `${JSON.stringify(row)}\n`;
     if (!restoreArchivedRunLedger(dir, entry.runId, line)) appendFileSync(live, line, 'utf8');
   });
+  try {
+    recordRunRequestVsEffectiveFromLedger(entry.runId, dir, entry);
+  } catch {
+    // The comparison is observation: it must never fail a producer write that already landed.
+  }
 }
 
 /** Caller decision inside `appendRunLedgerEntryChecked`: either `append` exactly one entry, or skip with `result`. */
@@ -836,6 +1072,13 @@ export interface RunLedgerTimelineEntry {
   pieceTotal?: number;
   /** Producer-recorded `graph.unit` visits of this run, with terminal unmatched enters reported as orphans. */
   unitVisits?: GraphUnitVisitClassification;
+  /** Requested vs effective values this run recorded; present only when the two sides differ. */
+  requestVsEffective?: {
+    requested: RunRequestEffectiveValues;
+    effective: RunRequestEffectiveValues;
+  };
+  /** Mismatch rows (axis · requested · effective) for this run; absent when requested equals effective. */
+  mismatches?: RunRequestEffectiveMismatch[];
 }
 
 export interface RunLedgerTimelineQueryOptions {
@@ -844,6 +1087,20 @@ export interface RunLedgerTimelineQueryOptions {
   list?: (path: string) => string[];
 }
 
+/**
+ * Timeline projection of the requested-vs-effective rows. Recorded rows win over a derived
+ * comparison so the timeline shows what the run actually wrote; equal sides project nothing.
+ */
+function runRequestEffectiveTimelineFields(
+  ledger: readonly RunLedgerEntry[],
+): Pick<RunLedgerTimelineEntry, 'mismatches' | 'requestVsEffective'> {
+  const recorded = recordedRunRequestEffectiveMismatches(ledger);
+  const derived = runRequestEffectiveFromLedger(ledger);
+  const mismatches = recorded.length > 0 ? recorded : derived.mismatches;
+  if (mismatches.length === 0) return {};
+  return { mismatches, requestVsEffective: { requested: derived.requested, effective: derived.effective } };
+}
+
 /**
  * Read runs whose sole recorded goalId equals the historian missionId.
  * goalId is chosen because the producer already persists it on each observer event, while orchestrationId only groups shards.
@@ -878,6 +1135,7 @@ export function queryRunLedgerTimeline(missionId: string, options: RunLedgerTime
         ...(execution.pieceIndex === undefined ? {} : { pieceIndex: execution.pieceIndex }),
         ...(execution.pieceTotal === undefined ? {} : { pieceTotal: execution.pieceTotal }),
         unitVisits: classifyGraphUnitVisits(ledger),
+        ...runRequestEffectiveTimelineFields(ledger),
       });
     } catch {
       // A corrupt or concurrently replaced ledger must not leak a partial run into another mission timeline.