elanous 0.2.37 → 0.2.40

package/src/self-implement/run-ledger.ts

@@ -452,6 +452,237 @@ export function loadRunGraphVariant(runId: string, dir = runLedgerDir()): RunGra
   return { variantId: record.variant_id, reason: record.reason };
 }
 
+/**
+ * Axes compared between what a run asked for and what it actually ran with:
+ * the child LLM request (`childModel`/`childProvider`), `zaiCodingPlan.overage`,
+ * the Pod pool and the parent host.
+ */
+export type RunRequestEffectiveAxis = 'childModel' | 'childProvider' | 'overagePolicy' | 'podPool' | 'parentHost';
+
+/** Ledger event carrying one requested-vs-effective comparison row set. */
+export const RUN_REQUEST_VS_EFFECTIVE_EVENT = 'run-request-vs-effective';
+
+const RUN_REQUEST_EFFECTIVE_AXES: readonly RunRequestEffectiveAxis[] = [
+  'childModel',
+  'childProvider',
+  'overagePolicy',
+  'podPool',
+  'parentHost',
+];
+
+/** Values of the compared axes. Requested and effective sides share this shape so a row can name both. */
+export interface RunRequestEffectiveValues {
+  childModel?: string;
+  childProvider?: string;
+  overagePolicy?: string;
+  podPool?: string;
+  parentHost?: string;
+}
+
+/** One axis whose requested value differs from the effective value observed while the run executed. */
+export interface RunRequestEffectiveMismatch {
+  axis: RunRequestEffectiveAxis;
+  requested: string;
+  effective: string;
+}
+
+export interface RunRequestEffectiveComparison {
+  requested: RunRequestEffectiveValues;
+  effective: RunRequestEffectiveValues;
+  mismatches: RunRequestEffectiveMismatch[];
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+function readRunRequestEffectiveValues(value: unknown): RunRequestEffectiveValues {
+  if (!isPlainRecord(value)) return {};
+  const values: RunRequestEffectiveValues = {};
+  for (const axis of RUN_REQUEST_EFFECTIVE_AXES) {
+    const raw = value[axis];
+    if (typeof raw === 'string' && raw.trim()) values[axis] = raw.trim();
+  }
+  return values;
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+/** Compare both sides axis by axis; an axis observed on one side only is not a mismatch. */
+export function compareRunRequestEffective(
+  requested: RunRequestEffectiveValues,
+  effective: RunRequestEffectiveValues,
+): RunRequestEffectiveMismatch[] {
+  const mismatches: RunRequestEffectiveMismatch[] = [];
+  for (const axis of RUN_REQUEST_EFFECTIVE_AXES) {
+    const requestedValue = requested[axis];
+    const effectiveValue = effective[axis];
+    if (requestedValue === undefined || effectiveValue === undefined || requestedValue === effectiveValue) continue;
+    mismatches.push({ axis, requested: requestedValue, effective: effectiveValue });
+  }
+  return mismatches;
+}
+
+/**
+ * Read the two sides out of one observer event. The canonical contract is an explicit
+ * `data.requested` / `data.effective` object. The real orchestrator records the
+ * requested child at run-origin and the selected execution provider at start.
+ */
+function runRequestEffectiveSidesOf(entry: RunLedgerEntry): RunRequestEffectiveComparison {
+  const data = isPlainRecord(entry.data) ? entry.data : {};
+  const requested = readRunRequestEffectiveValues(data.requested);
+  const effective = readRunRequestEffectiveValues(data.effective);
+
+  if (entry.event === 'run-origin') {
+    requested.childProvider ??= nonEmptyString(data.childProvider);
+    requested.childModel ??= nonEmptyString(data.childModel);
+  }
+  if (entry.event === 'start') {
+    effective.childProvider ??= nonEmptyString(data.provider);
+    effective.childModel ??= nonEmptyString(data.model);
+  }
+
+  const childLlm = data.childLlm;
+  if (isPlainRecord(childLlm)) {
+    const provider = nonEmptyString(childLlm.provider);
+    if (provider !== undefined && requested.childProvider === undefined) requested.childProvider = provider;
+    const model = nonEmptyString(childLlm.model);
+    if (model !== undefined && requested.childModel === undefined) requested.childModel = model;
+  }
+  const zaiCodingPlan = data.zaiCodingPlan;
+  if (isPlainRecord(zaiCodingPlan)) {
+    const overage = nonEmptyString(zaiCodingPlan.overage);
+    if (overage !== undefined && requested.overagePolicy === undefined) requested.overagePolicy = overage;
+  }
+
+  for (const key of ['childStart', 'llmConsumeStart'] as const) {
+    const start = data[key];
+    if (!isPlainRecord(start)) continue;
+    const provider = nonEmptyString(start.provider);
+    if (provider !== undefined && effective.childProvider === undefined) effective.childProvider = provider;
+    const model = nonEmptyString(start.model);
+    if (model !== undefined && effective.childModel === undefined) effective.childModel = model;
+  }
+
+  return { requested, effective, mismatches: compareRunRequestEffective(requested, effective) };
+}
+
+/**
+ * Merge every non-comparison event of a run into one comparison. The request side keeps the
+ * first recorded value (run-origin) and the effective side keeps the last observed one
+ * (child start, first llm consume-start, actual Pod pool).
+ */
+export function runRequestEffectiveFromLedger(ledger: readonly RunLedgerEntry[]): RunRequestEffectiveComparison {
+  const requested: RunRequestEffectiveValues = {};
+  const effective: RunRequestEffectiveValues = {};
+  for (const entry of ledger) {
+    if (entry.event === RUN_REQUEST_VS_EFFECTIVE_EVENT) continue;
+    const sides = runRequestEffectiveSidesOf(entry);
+    for (const axis of RUN_REQUEST_EFFECTIVE_AXES) {
+      const requestedValue = sides.requested[axis];
+      if (requestedValue !== undefined && requested[axis] === undefined) requested[axis] = requestedValue;
+      const effectiveValue = sides.effective[axis];
+      if (effectiveValue !== undefined && effective[axis] === undefined) effective[axis] = effectiveValue;
+    }
+  }
+  return { requested, effective, mismatches: compareRunRequestEffective(requested, effective) };
+}
+
+/** Mismatch rows this run already wrote, de-duplicated across repeated comparisons. */
+export function recordedRunRequestEffectiveMismatches(
+  ledger: readonly RunLedgerEntry[],
+): RunRequestEffectiveMismatch[] {
+  const seen = new Set<string>();
+  const rows: RunRequestEffectiveMismatch[] = [];
+  for (const entry of ledger) {
+    if (entry.event !== RUN_REQUEST_VS_EFFECTIVE_EVENT) continue;
+    const recorded = isPlainRecord(entry.data) ? entry.data.mismatches : undefined;
+    if (!Array.isArray(recorded)) continue;
+    for (const row of recorded) {
+      if (!isPlainRecord(row)) continue;
+      const axis = row.axis;
+      if (typeof axis !== 'string' || !RUN_REQUEST_EFFECTIVE_AXES.includes(axis as RunRequestEffectiveAxis)) continue;
+      const requested = nonEmptyString(row.requested);
+      const effective = nonEmptyString(row.effective);
+      if (requested === undefined || effective === undefined) continue;
+      const key = `${axis}\u0000${requested}\u0000${effective}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      rows.push({ axis: axis as RunRequestEffectiveAxis, requested, effective });
+    }
+  }
+  return rows;
+}
+
+export interface RunRequestVsEffectiveRecordOptions {
+  /** Ledger directory; default = `runLedgerDir()`. */
+  dir?: string;
+}
+
+/**
+ * Write one `run-request-vs-effective` row under the run's own ledger file, inheriting the
+ * run's goalId and shard identity so the run stays a single mission on the timeline.
+ */
+export function recordRunRequestVsEffective(
+  runId: string,
+  requested: RunRequestEffectiveValues,
+  effective: RunRequestEffectiveValues,
+  options: RunRequestVsEffectiveRecordOptions = {},
+): RunRequestEffectiveComparison {
+  const dir = options.dir ?? runLedgerDir();
+  const ledger = loadRunLedger(runId, dir) ?? [];
+  const start = ledger.find((entry) => entry.event === 'start' && typeof entry.timestamp === 'string');
+  const goalOwner = ledger.find((entry) => nonEmptyString(entry.goalId) !== undefined);
+  const comparison: RunRequestEffectiveComparison = {
+    requested,
+    effective,
+    mismatches: compareRunRequestEffective(requested, effective),
+  };
+  appendRunLedgerEntry({
+    timestamp: new Date().toISOString(),
+    runId,
+    event: RUN_REQUEST_VS_EFFECTIVE_EVENT,
+    data: { requested: comparison.requested, effective: comparison.effective, mismatches: comparison.mismatches },
+    ...(goalOwner?.goalId === undefined ? {} : { goalId: goalOwner.goalId }),
+    ...(start?.orchestrationId === undefined ? {} : { orchestrationId: start.orchestrationId }),
+    ...(start?.shardId === undefined ? {} : { shardId: start.shardId }),
+    ...(start?.pieceIndex === undefined ? {} : { pieceIndex: start.pieceIndex }),
+    ...(start?.pieceTotal === undefined ? {} : { pieceTotal: start.pieceTotal }),
+  }, dir);
+  return comparison;
+}
+
+function sameRunRequestEffectiveMismatches(
+  left: readonly RunRequestEffectiveMismatch[],
+  right: readonly RunRequestEffectiveMismatch[],
+): boolean {
+  if (left.length !== right.length) return false;
+  const keys = new Set(right.map((row) => `${row.axis}\u0000${row.requested}\u0000${row.effective}`));
+  return left.every((row) => keys.has(`${row.axis}\u0000${row.requested}\u0000${row.effective}`));
+}
+
+/**
+ * Production hook: after any observer event lands, compare the run's requested and effective
+ * sides and write the mismatch rows when they differ. Idempotent — a run whose rows already
+ * match its current comparison writes nothing. Recording only; no alerting and no repair.
+ */
+function recordRunRequestVsEffectiveFromLedger(runId: string, dir: string, appended: RunLedgerEntry): void {
+  // Keep unrelated observer writes O(1); only events carrying one side can
+  // change the comparison. In particular, a long run must not reread its
+  // complete ledger after every progress event.
+  if (!['run-origin', 'start', 'child-start', 'llm-consume-start'].includes(appended.event)
+    && !isPlainRecord(appended.data?.requested) && !isPlainRecord(appended.data?.effective)) return;
+  if (appended.event === RUN_REQUEST_VS_EFFECTIVE_EVENT) return;
+  const ledger = loadRunLedger(runId, dir);
+  if (!ledger?.length) return;
+  const comparison = runRequestEffectiveFromLedger(ledger);
+  if (comparison.mismatches.length === 0) return;
+  if (sameRunRequestEffectiveMismatches(recordedRunRequestEffectiveMismatches(ledger), comparison.mismatches)) return;
+  recordRunRequestVsEffective(runId, comparison.requested, comparison.effective, { dir });
+}
+
 /** Append one observer event. Callers own fail-soft handling. */
 export function appendRunLedgerEntry(entry: RunLedgerEntry, dir = runLedgerDir()): void {
   if (refuseProductionLedgerWriteInTest(dir, 'run-ledger')) return;
@@ -465,6 +696,11 @@ export function appendRunLedgerEntry(entry: RunLedgerEntry, dir = runLedgerDir()
     const line = `${JSON.stringify(row)}\n`;
     if (!restoreArchivedRunLedger(dir, entry.runId, line)) appendFileSync(live, line, 'utf8');
   });
+  try {
+    recordRunRequestVsEffectiveFromLedger(entry.runId, dir, entry);
+  } catch {
+    // The comparison is observation: it must never fail a producer write that already landed.
+  }
 }
 
 /** Caller decision inside `appendRunLedgerEntryChecked`: either `append` exactly one entry, or skip with `result`. */
@@ -483,7 +719,9 @@ export interface RunLedgerCheckedAppendOutcome<T> {
  * Thrown (typed, with the stable `runId-mismatch` reason) when a checked-append
  * decision returns an entry whose `runId` differs from the locked `runId`. Callers
  * classify identity violations from `error.reason === 'runId-mismatch'` instead of
- * parsing message substrings.
+ * parsing message substrings. `RunLedgerEntryRunIdMismatchError` below is the same
+ * identity violation observed on already-written ledger bytes, so one `instanceof`
+ * covers both producers.
  */
 export class RunLedgerCheckedAppendRunIdMismatchError extends Error {
   readonly reason = 'runId-mismatch' as const;
@@ -495,6 +733,21 @@ export class RunLedgerCheckedAppendRunIdMismatchError extends Error {
   }
 }
 
+/**
+ * Thrown (typed, same `runId-mismatch` reason) when a stored ledger *row* declares a
+ * `runId` other than the one being loaded. The message prefixes the stable reason and keeps
+ * the parser's existing wording, so message-based classifiers (`goal-archive`, the
+ * doctor-compare caller's own regression test) keep recognizing it, while
+ * `decisionRunId`/`lockedRunId` travel as typed fields so no caller has to re-parse it.
+ */
+export class RunLedgerEntryRunIdMismatchError extends RunLedgerCheckedAppendRunIdMismatchError {
+  constructor(decisionRunId: string, lockedRunId: string, readonly lineNumber: number) {
+    super(decisionRunId, lockedRunId);
+    this.name = 'RunLedgerEntryRunIdMismatchError';
+    this.message = `runId-mismatch: invalid run ledger entry at line ${lineNumber}: runId does not match ${lockedRunId}`;
+  }
+}
+
 /**
  * Atomically decide-and-append under a single per-run lock: the caller-supplied
  * decision runs on the loaded ledger inside `withRunLedgerLock`, and at most one
@@ -660,7 +913,7 @@ function parseRunLedgerEntry(line: string, lineNumber: number, expectedRunId: st
     throw new Error(`invalid run ledger entry at line ${lineNumber}: expected optional timestamp, goalId, shard identity, runId, event, and object data`);
   }
   if (entry.runId !== expectedRunId) {
-    throw new Error(`invalid run ledger entry at line ${lineNumber}: runId does not match ${expectedRunId}`);
+    throw new RunLedgerEntryRunIdMismatchError(entry.runId, expectedRunId, lineNumber);
   }
   return entry as RunLedgerEntry;
 }
@@ -836,6 +1089,13 @@ export interface RunLedgerTimelineEntry {
   pieceTotal?: number;
   /** Producer-recorded `graph.unit` visits of this run, with terminal unmatched enters reported as orphans. */
   unitVisits?: GraphUnitVisitClassification;
+  /** Requested vs effective values this run recorded; present only when the two sides differ. */
+  requestVsEffective?: {
+    requested: RunRequestEffectiveValues;
+    effective: RunRequestEffectiveValues;
+  };
+  /** Mismatch rows (axis · requested · effective) for this run; absent when requested equals effective. */
+  mismatches?: RunRequestEffectiveMismatch[];
 }
 
 export interface RunLedgerTimelineQueryOptions {
@@ -844,6 +1104,20 @@ export interface RunLedgerTimelineQueryOptions {
   list?: (path: string) => string[];
 }
 
+/**
+ * Timeline projection of the requested-vs-effective rows. Recorded rows win over a derived
+ * comparison so the timeline shows what the run actually wrote; equal sides project nothing.
+ */
+function runRequestEffectiveTimelineFields(
+  ledger: readonly RunLedgerEntry[],
+): Pick<RunLedgerTimelineEntry, 'mismatches' | 'requestVsEffective'> {
+  const recorded = recordedRunRequestEffectiveMismatches(ledger);
+  const derived = runRequestEffectiveFromLedger(ledger);
+  const mismatches = recorded.length > 0 ? recorded : derived.mismatches;
+  if (mismatches.length === 0) return {};
+  return { mismatches, requestVsEffective: { requested: derived.requested, effective: derived.effective } };
+}
+
 /**
  * Read runs whose sole recorded goalId equals the historian missionId.
  * goalId is chosen because the producer already persists it on each observer event, while orchestrationId only groups shards.
@@ -878,6 +1152,7 @@ export function queryRunLedgerTimeline(missionId: string, options: RunLedgerTime
         ...(execution.pieceIndex === undefined ? {} : { pieceIndex: execution.pieceIndex }),
         ...(execution.pieceTotal === undefined ? {} : { pieceTotal: execution.pieceTotal }),
         unitVisits: classifyGraphUnitVisits(ledger),
+        ...runRequestEffectiveTimelineFields(ledger),
       });
     } catch {
       // A corrupt or concurrently replaced ledger must not leak a partial run into another mission timeline.
@@ -896,15 +1171,24 @@ export interface GraphAdaptReport {
   nonAdapted: { landed: number; denominator: number; rate: number | null };
   excludedCount: number;
   exclusionReasons: Record<string, number>;
+  unmeasuredCount: number;
+  unmeasuredReasons: Record<string, number>;
+  window: { since: string | null; until: string | null };
 }
 
 /** Measure only producer-observed traversals and variant applications; never activate adaptation. */
-export function queryGraphAdaptReport(goalId: string, stateDir = elanousStateRoot()): GraphAdaptReport {
+export function queryGraphAdaptReport(goalId: string, stateDir = elanousStateRoot(), window: { since?: string; until?: string } = {}): GraphAdaptReport {
   const dir = runLedgerDir(stateDir);
   const signatures = new Set<string>();
   const counts = { adapted: { landed: 0, denominator: 0 }, nonAdapted: { landed: 0, denominator: 0 } };
   const exclusionReasons: Record<string, number> = {};
+  const unmeasuredReasons: Record<string, number> = {};
   const exclude = (reason: string): void => { exclusionReasons[reason] = (exclusionReasons[reason] ?? 0) + 1; };
+  const unmeasured = (reason: string): void => { unmeasuredReasons[reason] = (unmeasuredReasons[reason] ?? 0) + 1; };
+  const since = window.since === undefined ? null : Date.parse(window.since);
+  const until = window.until === undefined ? null : Date.parse(window.until);
+  if ((since !== null && !Number.isFinite(since)) || (until !== null && !Number.isFinite(until)) ||
+    (since !== null && until !== null && since > until)) throw new Error('invalid adaptation measurement window');
   let unitCallCount = 0;
   let adaptationCount = 0;
   let fileNames: string[];
@@ -923,6 +1207,15 @@ export function queryGraphAdaptReport(goalId: string, stateDir = elanousStateRoo
     const goalIds = new Set(ledger.map(entry => entry.goalId).filter((id): id is string => typeof id === 'string' && id.length > 0));
     if (goalIds.size === 1 && !goalIds.has(goalId)) continue;
     if (goalIds.size !== 1) { exclude('goal-id-missing-or-conflicting'); continue; }
+    const start = ledger.find(entry => entry.event === 'start');
+    const startedAt = start && typeof start.timestamp === 'string' ? Date.parse(start.timestamp) : NaN;
+    if (!Number.isFinite(startedAt)) { unmeasured('start-time-missing-or-invalid'); continue; }
+    if ((since !== null && startedAt < since) || (until !== null && startedAt >= until)) { exclude('outside-start-window'); continue; }
+    const lastStatus = [...ledger].reverse().find(entry => entry.event === 'run-status');
+    if (lastStatus && !['completed', 'failed', 'cancelled'].includes(String(lastStatus.data.runStatus))) {
+      exclude('in-flight'); continue;
+    }
+    if (!lastStatus && !ledger.some(entry => entry.event === 'merged')) { exclude('in-flight'); continue; }
     const traversals = ledger.filter(entry => entry.event === 'pipeline-traversal-shadow');
     const paths = traversals.map(entry => entry.data.observedNodes);
     if (paths.length === 0 || paths.some(path => !Array.isArray(path) || path.length === 0 || !path.every(node => typeof node === 'string' && node.length > 0))) {
@@ -931,12 +1224,13 @@ export function queryGraphAdaptReport(goalId: string, stateDir = elanousStateRoo
     let graphRun: unknown;
     try { graphRun = JSON.parse(readFileSync(join(stateDir, 'graph-runs', 'self-implement', `${runId}.json`), 'utf8')); }
     catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') { exclude('graph-run-unreadable'); continue; }
+      unmeasured((error as NodeJS.ErrnoException).code === 'ENOENT' ? 'graph-run-missing' : 'graph-run-unreadable');
+      continue;
     }
     const recorded = graphRun && typeof graphRun === 'object' && !Array.isArray(graphRun) ? graphRun as Record<string, unknown> : null;
-    if (recorded && (recorded.runId !== runId || recorded.graphId !== 'self-implement' ||
-      (recorded.unitCalls !== undefined && !Array.isArray(recorded.unitCalls)))) {
-      exclude('unit-calls-invalid'); continue;
+    if (!recorded || recorded.runId !== runId || recorded.graphId !== 'self-implement' ||
+      (recorded.unitCalls !== undefined && !Array.isArray(recorded.unitCalls))) {
+      unmeasured('graph-run-invalid'); continue;
     }
     const merge = [...ledger].reverse().find(entry => entry.event === 'merged');
     if (merge && typeof merge.data.merged !== 'boolean') { exclude('landing-invalid'); continue; }
@@ -952,7 +1246,9 @@ export function queryGraphAdaptReport(goalId: string, stateDir = elanousStateRoo
   return { goalId, runCount: counts.adapted.denominator + counts.nonAdapted.denominator,
     uniquePathSignatures: signatures.size, unitCallCount, adaptationCount,
     adapted: rate(counts.adapted), nonAdapted: rate(counts.nonAdapted),
-    excludedCount: Object.values(exclusionReasons).reduce((total, count) => total + count, 0), exclusionReasons };
+    excludedCount: Object.values(exclusionReasons).reduce((total, count) => total + count, 0), exclusionReasons,
+    unmeasuredCount: Object.values(unmeasuredReasons).reduce((total, count) => total + count, 0), unmeasuredReasons,
+    window: { since: window.since ?? null, until: window.until ?? null } };
 }
 
 export interface GoalSourceDistributionQuery {

package/src/self-implement/run-stop.ts

@@ -40,6 +40,15 @@ export interface RunStopRecord {
 export const RUN_STOP_EVENT = 'stop';
 export const RUN_STOP_CAUSE_MAX = 120;
 
+type RunStopListener = (entry: RunLedgerEntry) => void;
+const runStopListeners = new Set<RunStopListener>();
+
+/** Subscribe to live terminal run-stop facts. The durable ledger remains the source of truth. */
+export function onRunStop(listener: RunStopListener): () => void {
+  runStopListeners.add(listener);
+  return () => { runStopListeners.delete(listener); };
+}
+
 export interface RunStopInput {
   runId: string;
   goalId?: string;
@@ -121,6 +130,9 @@ export function recordRunStop(input: RunStopInput, write: RunLedgerWriter = appe
   write(entry);
   if (recordedThisProcess.size >= RECORDED_MAX) recordedThisProcess.clear();
   recordedThisProcess.add(input.runId);
+  for (const listener of runStopListeners) {
+    try { listener(entry); } catch { /* wake consumers cannot change run outcome */ }
+  }
   try {
     debug.log('self-implement.run-stop', 'recorded', { runId: input.runId, site: input.site ?? null, ...record, requestedClass: input.class ?? null });
   } catch { /* observation is fail-soft */ }

package/src/self-implement/seams.ts

@@ -23,7 +23,6 @@ import { createArtifactStore } from '../artifact/index.js';
 import { tmpdir } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { promisify } from 'node:util';
-import { forkSessionById, HARNESS_SESSION_ORIGIN, isHarnessSessionOrigin } from '../session/index.js';
 import { configuredWorktreeRoot, getUserConfig, resolveActiveProvider, resolveRoleLlm } from '../user-config.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
 import { addHarnessQueue } from '../harness/harness-queue.js';
@@ -1305,7 +1304,9 @@ type SameCellRebindDecision =
 type SameCellRebindExtra = { boundPr?: number; detail?: string };
 
 /** 같은 칸 새 draft 뒤 카드 재결속 — 사유를 다섯 갈래로 나눠 남기고, 카드 저장소가 없는 실행은 던지지 않고
- *  deferred 로 돌려준다(Pod 자식은 본부 카드 저장소가 없다 · 부모 pr-terminal 결속은 #29948 이 맡는다). */
+ *  deferred 로 돌려준다(Pod 자식은 본부 카드 저장소가 없다 · 부모 pr-terminal 결속은 #29948 이 맡는다).
+ *  카드 저장소가 있는 호스트에서 card-missing·card-id-absent 는 조용한 성공이 아니라
+ *  debug.log('self-implement.same-cell','rebind-missing-on-host',{reason}) 경고로 분리한다(#30021 r4 shouldFix). */
 function rebindSameCellCardToPr(input: {
   taskCardId: string | undefined;
   storePath: string;
@@ -1329,8 +1330,14 @@ function rebindSameCellCardToPr(input: {
     debug.log('self-implement.pr', 'same-cell-card-rebind-failed', { ...base, ...extra, reason }, { level: 'warn' });
     throw new Error(`same-cell 새 draft ${input.url} 개설됨; 카드 재결속 실패(${reasonText}) — 새 PR 수확 필요`);
   };
-  if (!input.taskCardId) return deferred('card-id-absent');
-  if (!existsSync(input.storePath)) return deferred('card-store-absent');
+  const hostStore = existsSync(input.storePath);
+  /** 호스트(카드 저장소 있음)인데 결속 대상이 없으면 deferred 로 조용히 지나가지 않고 경고 이벤트로 분리한다. */
+  const missingOnHost = (reason: SameCellCardRebindReason): SameCellCardRebindObservation => {
+    debug.log('self-implement.same-cell', 'rebind-missing-on-host', { ...base, reason }, { level: 'warn' });
+    return deferred(reason);
+  };
+  if (!input.taskCardId) return hostStore ? missingOnHost('card-id-absent') : deferred('card-id-absent');
+  if (!hostStore) return deferred('card-store-absent');
   let decision: SameCellRebindDecision | undefined;
   let updated: ReturnType<typeof updateTaskCard>;
   try {
@@ -1372,7 +1379,7 @@ function rebindSameCellCardToPr(input: {
     case 'manual-ref':
       return failed('manual-ref');
     case 'card-missing':
-      return deferred('card-missing');
+      return missingOnHost('card-missing');
     case 'already-rebound':
       observe('already-rebound');
       return { outcome: 'already-rebound', reason: 'already-rebound', cardId, oldPr: input.oldPr, newPr: input.newPr };
@@ -1674,6 +1681,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
     },
 
     forkSession: async (parentSessionId) => {
+      const { forkSessionById, HARNESS_SESSION_ORIGIN, isHarnessSessionOrigin } = await import('../session/index.js');
       const forked = forkSessionById(parentSessionId, { origin: HARNESS_SESSION_ORIGIN });
       if (!forked) throw new Error(`self-implement fork: source session not found — ${parentSessionId}`);
       if (!isHarnessSessionOrigin(forked.meta.origin)) {
@@ -1738,7 +1746,11 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       }
       // P1 — 대상 repo: 명시 repoRoot(외부 개발) 우선, 없으면 데몬 cwd 의 repo(=elanous 자신·현행).
       const repoRoot = o.repoRoot ?? resolveMainRepoRoot(process.cwd()) ?? process.cwd();
-      const r = createWorktree({
+      // Keep the optional Pod-only implementation out of the TUI's static module graph.
+      const inPlaceCandidate = process.env.ELANOUS_POD_INPLACE_WORKTREE === '1'
+        ? (await import('./pod-inplace-worktree.js')).tryCreatePodInplaceWorktree({ repoRoot, cwd: process.cwd(), branch, ...(base ? { base } : {}), runId, ...(goalFile ? { goalFile } : {}), env: process.env })
+        : null;
+      const r = inPlaceCandidate ?? createWorktree({
         repoRoot,
         branch,
         worktreeRoot: configuredWorktreeRoot(),
@@ -1748,6 +1760,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         ...(base ? { base } : {}),
         ...(runId ? { currentOwner: `dev:${runId}` } : {}),
       });
+      const inPlace = 'inPlace' in r && r.inPlace === true;
       if (r.resolvedBase) baselineRefs.set(r.path, r.resolvedBase);
       const benchId = benchIdFromBase(base);
       if (benchId) benchWorktrees.set(r.path, benchId);
@@ -1775,6 +1788,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           baseIsIntegration: baseIsIntegration(r.path, r.resolvedBase),
           baseFreshness: r.baseFreshness,
           ...(r.reused ? { reused: true } : {}),
+          ...(inPlace ? { inPlace: true } : {}),
           ...provenance,
         };
         const goalMetadata: HarnessWorktreeGoalMetadata = {
@@ -1795,6 +1809,8 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         const provenanceError = error instanceof Error ? error.message : String(error);
         // Manual creation rolls back on a metadata failure; self-implement retains its workspace and continues.
         debug.log('self-implement', 'worktree-provenance-failed', { path: r.path, ...(provenance ?? {}), reason: provenanceError }, { level: 'warn' });
+        // This source tree is also the Pod's recovery anchor. Never continue in-place without an owner marker.
+        if (inPlace) throw new Error(`pod in-place provenance unavailable: ${provenanceError}`);
         return {
           path: r.path,
           branch: r.branch,
@@ -1804,6 +1820,7 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
           baseIsIntegration: baseIsIntegration(r.path, r.resolvedBase),
           baseFreshness: r.baseFreshness,
           ...(r.reused ? { reused: true } : {}),
+          ...(inPlace ? { inPlace: true } : {}),
           provenanceError,
         };
       }
@@ -2219,7 +2236,10 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
       };
       if (failedTest) {
         const worktreeLog = failedTest.output ?? '';
-        const failedFiles = [...new Set(extractGateTestFailures(worktreeLog)
+        // A supplied gate runner can report a virtual checkout, just like gate-cli's injected runner.
+        const currentFileExists = o.runIntegrityGate ? undefined : (file: string) => existsSync(resolve(cwd, file));
+        const worktreeFailures = extractGateTestFailures(worktreeLog, currentFileExists);
+        const failedFiles = [...new Set(worktreeFailures
           .flatMap((failure) => failure.file ? [failure.file] : []))];
         // 워크트리와 같은 묶음으로 베이스라인을 돌려 파일 간 간섭을 재현한다. 스코프가 없으면 실패 파일로 폴백.
         const testArgs = gateOpts.testArgs;
@@ -2229,14 +2249,14 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         const baseline = (o.runGateBaseline ?? runGateBaseline)(cwd, baselineFiles, baselineRefs.get(cwd));
         const rerun = (o.rerunBunTimeoutFailures ?? rerunBunTimeoutFailures)(
           cwd,
-          extractGateTestFailures(worktreeLog),
+          worktreeFailures,
           undefined,
           baseline.status === 'unknown' ? undefined : (baseline.output ?? ''),
           baseline.missingAtBase ?? [],
         );
         const rerunObservations = rerun instanceof Map ? rerun : rerun.observations;
         const rerunNotRun = rerun instanceof Map ? 0 : rerun.rerunNotRun;
-        const report = buildGateBaselineReport(worktreeLog, baseline, rerunObservations, rerunNotRun);
+        const report = buildGateBaselineReport(worktreeLog, baseline, rerunObservations, rerunNotRun, currentFileExists);
         baselineReport = report;
         baselineFailures = report.failures;
         const unknownReason = baseline.unknownReason;
@@ -2598,19 +2618,24 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
                 // ⛔ writer 가 넘긴 command 를 믿지 않는다 — **로그에서 직접** 뽑아 문서와 대조한다(리뷰 must-fix).
         "const cm = testLine.match(/^\\[test\\]\\s+PASS\\s+(.+?)\\s*(?:—|$)/); if (!cm) process.exit(1);",
         "const cmdFromLog = cm[1].trim();",
-        "if (sections.some((p) => p.indexOf(cmdFromLog) < 0)) process.exit(1);",
+        "if (body('## 불변식').indexOf(cmdFromLog) < 0) process.exit(1);",
         // 문서가 baseline 문면도 담고 있어야 한다 — 근거가 문서 안에서 재검증 가능해야 한다.
                 // ⛔ 부분 문자열이 아니라 **로그의 baseline 줄 전체**와 대조한다 — `preexisting=9` 같은
         //   불일치가 통과하면 근거가 근거가 아니다(리뷰 must-fix).
         "const bl = log.split('\\n').find((l) => l.indexOf('[gate-baseline]') === 0);",
         "if (bl) { if (!/^\\[gate-baseline\\] introduced=0, preexisting=0, unknown=0, precondition-unmet=0(?:,|$)/.test(bl)) process.exit(1); if (e.baselineLine !== bl.trim()) process.exit(1); if (sections.some((p) => p.indexOf(bl.trim()) < 0)) process.exit(1); }",
         "else { if (e.baselineLine !== undefined) process.exit(1); if (sections.some((p) => p.indexOf('baseline not run (test PASS)') < 0)) process.exit(1); }",
-        // ② 조건 줄의 명령을 **그 필드에서** 파싱해 대조한다 — 절 어딘가에 있으면 통과하던 것을 막는다.
+        // ② 조건 줄의 저작 명령을 **그 필드에서** 파싱하고, 해당 명령의 별도 실행 결과가
+        // 정확히 일치하며 0으로 끝났는지 확인한다. 게이트 측정 명령은 독립된 증거다.
         "const condLine = body('## 불변식').split('\\n').find((l) => l.indexOf('조건 —') >= 0); if (!condLine) process.exit(1);",
+        // 불변식에는 writer가 측정한 명령 전문을 기록하므로, 원문 gate 명령이 해당 필드에도 있어야 한다.
         "if (condLine.indexOf(cmdFromLog) < 0) process.exit(1);",
+        "const signalLine = body('## 판정 신호').split('\\n').find((l) => l.indexOf('- Condition:') >= 0);",
+        "const authoredCommand = signalLine?.match(/- Condition:\\s*(.+?)\\s*$/)?.[1]?.trim().replace(/^`([^`]+)`(?=\\s|를|$)/, '$1').replace(/\\s*를\\s*실행한다[.。]?$/, '').replace(/[.。]$/, '').trim();",
+        "if (authoredCommand) { const s = e.authoredSignal; if (!s || s.command !== authoredCommand || s.exitCode !== 0) process.exit(1); const rendered = body('## 판정 신호'); if (!rendered.includes('exit 0') || !rendered.includes(s.command)) process.exit(1); const raw = (s.stdout + '\\n' + s.stderr).trim().slice(-1200) || '(출력 없음)'; if (!rendered.includes(raw.replace(/\\r?\\n/g, ' ⏎ '))) process.exit(1); }",
         // ⭐ 핵심 — 문서의 관측값이 로그의 값과 다르면 거부한다.
         "if (String(e.observedFail) !== String(failFromLog)) process.exit(1);",
-        "if (body('## 판정 신호').indexOf('fail ' + failFromLog) < 0) process.exit(1);",
+        "if (!e.authoredSignal && body('## 판정 신호').indexOf('fail ' + failFromLog) < 0) process.exit(1);",
         // ⛔ 불변식 쪽 관측값도 대조한다 — 한쪽만 보면 다른 쪽에 거짓 수치가 들어간다(리뷰 must-fix).
         "if (body('## 불변식').indexOf('관측됨 — fail ' + failFromLog) < 0) process.exit(1);",
         // 문서 어디에도 로그와 **다른** fail 수치가 있으면 안 된다(정규식은 런타임에 만든다).
@@ -2623,8 +2648,9 @@ export function defaultSeams(o: DefaultSeamsOptions = {}): SelfImplementSeams {
         //   그 안에 게이트 로그가 통째로 들어 있어 `$(...)`·백틱이 **셸에서 실행**될 수 있었다(리뷰 must-fix).
         //   ⇒ 파일로 넘기고 검사기가 읽는다. 명령 문자열에는 **고정 리터럴만** 남는다.
         writeFileSync(join(root, 'evidence.json'), JSON.stringify(evidence));
+        writeFileSync(join(root, 'checker.cjs'), checker);
         const rule = withIndependentChecker({ kind: 'and', rules: [] }, {
-          command: `bun -e ${JSON.stringify(checker)}`,
+          command: 'bun checker.cjs',
           timeoutMs: 5_000,
         });
         const outcome = await evaluateTermination(rule, { vault: {} as never, budget: {} as never, goalRoot: root });