elanous 0.2.38 → 0.2.40

package/src/loops/orchestrator/tick.ts

@@ -6,6 +6,7 @@ import { Database } from 'bun:sqlite';
 import { checklistDevVersion, listChecklist, type ChecklistItem } from '../../release-loop/checklist.js';
 import { readTrafficSignal } from '../../seat-loop/traffic-signal.js';
 import { runHoldHygiene, type HygieneCell, type HygieneDeps } from '../../steward/hold-hygiene.js';
+import { runDirectiveAudit, type DirectiveAuditDeps } from '../../steward/directive-audit.js';
 import { effectiveInstanceRoot } from '../../instance/resolve.js';
 import { getUserConfig, ORCHESTRATOR_DEFAULTS, resolveConfiguredAgentRoleLlm, type OrchestratorLoopConfig } from '../../user-config.js';
 import { rubricPriority } from '../../release-loop/rubric.js';
@@ -70,6 +71,7 @@ export interface TickDeps {
   heartbeatIntervalMs?: number;
   hygieneCells?: () => HygieneCell[];
   hygienePaths?: Pick<HygieneDeps, 'trafficPath' | 'metaPath' | 'dispatcherDir'>;
+  directiveAudit?: DirectiveAuditDeps;
   cards?: () => TaskCard[]; split?: SplitAdapter; placeCell?: PlaceAdapter;
   degradation?: () => { llm: boolean; board: boolean };
   gridHosts?: readonly GridHost[];
@@ -960,6 +962,12 @@ export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Prom
           const sent = runHoldHygiene({ root, now, cells, ...deps.hygienePaths });
           for (const notice of sent) observe('exchange', `hold-hygiene:${notice.key}`, 1, SEAT_LOOP_IDS[notice.to]);
         } catch (error) { observe('hold-hygiene-failed', String(error).slice(0, 160), 0); }
+        // COORD-DIRECTIVE-AUDIT — 지시 원장 행마다 로직 점검(원장·로그·config)을 실제로 돌린다.
+        try {
+          const audit = runDirectiveAudit({ root, now: currentTime, ...deps.directiveAudit });
+          if (audit.alerts.length > 0) observe('directive-audit', `alerts:${audit.alerts.length}`, audit.alerts.length);
+          for (const proposal of audit.proposals) observe('directive-audit', `repair-proposal:${proposal.id}`, 1);
+        } catch (error) { observe('directive-audit-failed', String(error).slice(0, 160), 0); }
       }
       (deps.print ?? console.log)(reportLine(state));
     }

package/src/nexus/api/harness-api.ts

@@ -9,6 +9,7 @@ import { queryRunScreenKey } from '../../self-implement/run-ledger.js';
 import { logsDbPath } from '../../mss/logging/log-store.js';
 import { redactSecretText } from '../../debug/log.js';
 import { runAskLaunchFlow, type AskLaunchFlowResult } from '../../self-dev/ask-launch-flow.js';
+import { defaultGoalAuthorSelfResolve } from '../../self-implement/goal-author-clarification.js';
 import * as askIo from '../../self-dev/ask-launch-io.js';
 import { DAEMON_HARNESS_ASK_ENTRANCE } from '../../self-dev/entrance-registry.js';
 import { prepareAskLaunch } from '../../self-dev/launch-preflight.js';
@@ -211,12 +212,12 @@ function defaultAskDeps(rows: Awaited<ReturnType<typeof askIo.readAskPreflightLo
     print: () => {},
     log: (event: string, data: Record<string, unknown>, level?: 'info' | 'warn' | 'error') => debug.log('harness-http', event, data, { level }),
     readLine: async () => '',
-    readClarification: async () => '',
     readFile: (file: string) => readFileSync(file, 'utf8'),
     writeFile: (file: string, data: string) => writeFileSync(file, data, 'utf8'),
     cwd: () => process.cwd(),
     now: () => Date.now(),
     isInteractive: () => false,
+    selfResolveClarification: defaultGoalAuthorSelfResolve,
     buildPreflightDeps: askIo.buildAskPreflightDeps,
     priorBlockSamples: () => askIo.priorBlockSamplesFrom(rows),
     recentAuthoringSamples: () => askIo.recentAuthoringSamplesFrom(rows),

package/src/pty/snapshot.py

@@ -0,0 +1,132 @@
+"""Capture PTY state and retain the live descriptor for replay comparison."""
+
+from dataclasses import dataclass
+import fcntl
+import json
+import os
+from pathlib import Path
+import re
+import select
+import struct
+import tempfile
+import termios
+
+
+DEFAULT_SNAPSHOT_ID = "pty_dee629e3"
+_SCHEMA = 1
+_LIVE_FDS: dict[str, int] = {}
+
+
+@dataclass(eq=True)
+class Snapshot:
+    snapshot_id: str
+    rows: int
+    cols: int
+    termios_attributes: list
+    output: str
+
+
+@dataclass(eq=True)
+class ReplayState:
+    snapshot: Snapshot
+    live_rows: int
+    live_cols: int
+    live_termios_attributes: list
+    matches_live: bool
+
+
+def _location(snapshot_id: str) -> Path:
+    if not isinstance(snapshot_id, str) or not re.fullmatch(r"[A-Za-z0-9_-]+", snapshot_id):
+        raise ValueError("invalid snapshot id")
+    directory = Path(os.environ.get("ELANOUS_PTY_SNAPSHOT_DIR", tempfile.gettempdir() + "/elanous-pty-snapshots"))
+    return directory / (snapshot_id + ".json")
+
+
+def _size(fd: int) -> tuple[int, int]:
+    rows, cols, _, _ = struct.unpack("HHHH", fcntl.ioctl(fd, termios.TIOCGWINSZ, b"\0" * 8))
+    return rows, cols
+
+
+def _serialize_attrs(attrs: list) -> list:
+    return attrs[:6] + [[
+        {"bytes": entry.hex()} if isinstance(entry, bytes) else entry
+        for entry in attrs[6]
+    ]]
+
+
+def _deserialize_attrs(value: object) -> list:
+    if not isinstance(value, list) or len(value) != 7 or any(
+        type(item) is not int for item in value[:6]
+    ) or not isinstance(value[6], list):
+        raise ValueError("invalid termios attributes")
+    controls = []
+    for item in value[6]:
+        if type(item) is int and 0 <= item <= 255:
+            controls.append(item)
+        elif isinstance(item, dict) and set(item) == {"bytes"} and isinstance(item["bytes"], str):
+            try:
+                controls.append(bytes.fromhex(item["bytes"]))
+            except ValueError as error:
+                raise ValueError("invalid termios control byte") from error
+        else:
+            raise ValueError("invalid termios control byte")
+    return value[:6] + [controls]
+
+
+def snapshot(pty_fd: int, snapshot_id: str = DEFAULT_SNAPSHOT_ID) -> Snapshot:
+    """Drain currently available output from a PTY master and save its state."""
+    path = _location(snapshot_id)
+    rows, cols = _size(pty_fd)
+    attrs = termios.tcgetattr(pty_fd)
+    output = bytearray()
+    while select.select([pty_fd], [], [], 0)[0]:
+        chunk = os.read(pty_fd, 65536)
+        if not chunk:
+            break
+        output.extend(chunk)
+    captured = Snapshot(snapshot_id, rows, cols, attrs, output.decode("utf-8"))
+    payload = {
+        "schema": _SCHEMA,
+        "snapshot_id": snapshot_id,
+        "rows": rows,
+        "cols": cols,
+        "termios_attributes": _serialize_attrs(attrs),
+        "output": captured.output,
+    }
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", dir=path.parent, delete=False) as file:
+        temporary = Path(file.name)
+        try:
+            json.dump(payload, file, ensure_ascii=False)
+        except BaseException:
+            temporary.unlink(missing_ok=True)
+            raise
+    temporary.replace(path)
+    _LIVE_FDS[snapshot_id] = pty_fd
+    return captured
+
+
+def restore(snapshot_id: str = DEFAULT_SNAPSHOT_ID) -> ReplayState:
+    """Load a validated snapshot and compare it with its live PTY."""
+    path = _location(snapshot_id)
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, UnicodeError) as error:
+        raise ValueError("invalid snapshot document") from error
+    if not isinstance(payload, dict) or set(payload) != {
+        "schema", "snapshot_id", "rows", "cols", "termios_attributes", "output"
+    } or type(payload["schema"]) is not int or payload["schema"] != _SCHEMA or payload["snapshot_id"] != snapshot_id or any(
+        type(payload[field]) is not int or not 0 <= payload[field] <= 65535 for field in ("rows", "cols")
+    ) or not isinstance(payload["output"], str):
+        raise ValueError("snapshot schema or id mismatch")
+    attrs = _deserialize_attrs(payload["termios_attributes"])
+    saved = Snapshot(snapshot_id, payload["rows"], payload["cols"], attrs, payload["output"])
+    if snapshot_id not in _LIVE_FDS:
+        raise RuntimeError("no live PTY registered for snapshot")
+    fd = _LIVE_FDS[snapshot_id]
+    live_rows, live_cols = _size(fd)
+    live_attrs = termios.tcgetattr(fd)
+    return ReplayState(
+        saved, live_rows, live_cols, live_attrs,
+        (live_rows, live_cols, live_attrs) == (saved.rows, saved.cols, saved.termios_attributes),
+    )

package/src/pty-shell/pty-control-ipc.ts

@@ -15,7 +15,7 @@ import { encodeSgrMouse, mouseModeOffReason, type PtyMouseInput } from './pty-mo
 import { startPtyRecording, stopPtyRecording } from './pty-recording.js';
 import { withExternalKeyCommand } from '../input/external-input-queue.js';
 
-const OWNER_PTY_CONTROL_ACTIONS = ['takeover', 'release', 'input-text', 'input-key', 'input-mouse', 'resize', 'snapshot', 'rename', 'terminate', 'capabilities', 'record-start', 'record-stop'] as const;
+const OWNER_PTY_CONTROL_ACTIONS = ['takeover', 'release', 'input-text', 'input-key', 'input-mouse', 'resize', 'snapshot', 'rename', 'terminate', 'stop-turn', 'capabilities', 'record-start', 'record-stop'] as const;
 export type PtyControlAction = typeof OWNER_PTY_CONTROL_ACTIONS[number];
 type PtyControlStatus = 'success' | 'unknown-pty' | 'denied' | 'failed' | 'write-failed' | 'owner-unreachable';
 
@@ -42,7 +42,8 @@ export type PtyControlPayload =
   | { readonly cols: number; readonly rows: number }
   | { readonly ansi: boolean }
   | { readonly nickname: string }
-  | { readonly cols: number; readonly rows: number; readonly title?: string };
+  | { readonly cols: number; readonly rows: number; readonly title?: string }
+  | { readonly force: true; readonly actorIdentity: string; readonly reason: string };
 
 export interface PtyControlRequestOptions {
   /** 요청자가 주장하는 쓰기 주체. `'agent'` 는 run-identity 일치를 요구한다(`resolveRemoteControlActor`). */
@@ -609,6 +610,19 @@ async function processPtyControlRequestsOnce(getHandle: (id: string) => PtyContr
       else if (!isOwnerPtyControlAction(row.action)) result = { status: 'denied', reason: 'unsupported-action' };
       else if (row.action === 'capabilities') result = { status: 'success', actions: OWNER_PTY_CONTROL_ACTIONS };
       else if (row.action === 'terminate') result = await terminatePty(handle);
+      else if (row.action === 'stop-turn') {
+        const payload = parsePayload(row);
+        const targetRunId = getPtyManifest(row.pty_id)?.runId?.trim() ?? '';
+        const requesterRunId = row.requester_run_id?.trim() ?? '';
+        if (requested === null) result = { status: 'denied', reason: 'invalid-actor' };
+        else if (payload === null || typeof payload !== 'object' || Array.isArray(payload) || !('force' in payload) || payload.force !== true) result = { status: 'denied', reason: 'force-required' };
+        else if (!('actorIdentity' in payload) || typeof payload.actorIdentity !== 'string' || !payload.actorIdentity.trim()) result = { status: 'denied', reason: 'actor-identity-required' };
+        else if (!('reason' in payload) || typeof payload.reason !== 'string' || !payload.reason.trim()) result = { status: 'denied', reason: 'reason-required' };
+        else if (!requesterRunId || !targetRunId) result = { status: 'denied', reason: 'run-identity-unavailable' };
+        else if (requesterRunId === targetRunId) result = { status: 'denied', reason: 'self-turn-refused' };
+        else if (!handle.stopTurn) result = { status: 'denied', reason: 'force-stop-unsupported' };
+        else result = handle.stopTurn(true) ? { status: 'success' } : { status: 'denied', reason: 'no-active-turn' };
+      }
       else if (row.action === 'record-start' || row.action === 'record-stop') {
         if (requested === null) result = { status: 'denied', reason: 'invalid-actor' };
         else if (row.action === 'record-stop') {
@@ -733,6 +747,19 @@ async function processPtyControlRequestsOnce(getHandle: (id: string) => PtyContr
       result = { status: 'failed', reason: 'control-processing-error' };
       debug.log('pty.takeover', 'control-processing-error', { id: row.pty_id, action: row.action, actor: requested ?? row.actor, error: (error as Error).message });
     }
+    if (row.action === 'stop-turn') {
+      const payload = parsePayload(row);
+      debug.log('pty.turn', 'force-stop-settled', {
+        ptyId: row.pty_id,
+        actor: requested ?? row.actor ?? 'unknown',
+        actorIdentity: payload && 'actorIdentity' in payload && typeof payload.actorIdentity === 'string' ? payload.actorIdentity.trim() || null : null,
+        reason: payload && 'reason' in payload && typeof payload.reason === 'string' ? payload.reason.trim() || null : null,
+        requesterRunId: row.requester_run_id?.trim() || null,
+        targetRunId: getPtyManifest(row.pty_id)?.runId?.trim() || null,
+        outcome: result.status,
+        refusal: result.reason ?? null,
+      });
+    }
     d.run("UPDATE pty_control_requests SET status=?, result_json=?, updated_at=? WHERE request_id=? AND status='processing'", [result.status, JSON.stringify(result), Date.now(), row.request_id]);
     debug.log('pty.arbiter', 'control-settled', { id: row.pty_id, action: row.action, actor: requested ?? row.actor, outcome: result.status, reason: result.reason });
   }

package/src/pty-shell/pty-manifest.ts

@@ -104,6 +104,10 @@ export interface PtyManifestRow {
   /** TUI 턴 상태 — TUI 가 턴 시작·끝에 스스로 적는다(화면 글자 추정 아님). 없으면 기록 안 하는 행/옛 판. */
   turnState?: PtyTurnState;
   turnAt?: number;
+  /** 마지막 진전 시각(epoch ms) — 스트림 텍스트·도구 시작/끝·상태 줄에서 갱신(SURVIVAL-PROGRESS-CLOCK). */
+  progressAt?: number;
+  /** Esc 로 턴 중단을 청한 시각(epoch ms) — 이후 busy 가 지속되면 abort-ignored 판정 재료. */
+  abortRequestedAt?: number;
   /** 행 소유 프로세스가 «기동 때» 실은 코드 판 — 트리 HEAD(`codeSha`)와 다른 축이다. */
   build?: PtyBuildIdentity;
 }
@@ -128,6 +132,7 @@ let _dbFailed = false;
 let _dbPathForTesting: string | null = null;
 const _lastSnapshotAt = new Map<string, number>();
 const _lastFrameAt = new Map<string, number>();
+const _lastProgressAt = new Map<string, number>();
 
 export function setPtyManifestDbPathForTesting(path: string | null): void {
   _db?.close();
@@ -136,6 +141,7 @@ export function setPtyManifestDbPathForTesting(path: string | null): void {
   _dbPathForTesting = path;
   _lastSnapshotAt.clear();
   _lastFrameAt.clear();
+  _lastProgressAt.clear();
 }
 
 function db(): Database | null {
@@ -172,6 +178,11 @@ function db(): Database | null {
 }
 
 export function migratePtyManifestSchema(d: Database): void {
+  // 이행 문장 전체를 한 트랜잭션에 묶는다 — 문장별 autocommit fsync(첫 열기 ~35회)를 없애
+  // 매니페스트 DB 를 처음 여는 비용을 크게 줄인다. 이미 트랜잭션 안이면 그대로 진행한다.
+  let ownsTxn = false;
+  try { d.run('BEGIN'); ownsTxn = true; } catch { /* caller transaction */ }
+  try {
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN nickname TEXT'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN purpose TEXT'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN seat TEXT'); } catch { /* already exists */ }
@@ -201,12 +212,19 @@ export function migratePtyManifestSchema(d: Database): void {
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN last_control_at INTEGER'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN turn_state TEXT'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN turn_at INTEGER'); } catch { /* already exists */ }
+  try { d.run('ALTER TABLE pty_manifest ADD COLUMN progress_at INTEGER'); } catch { /* already exists */ }
+  try { d.run('ALTER TABLE pty_manifest ADD COLUMN abort_requested_at INTEGER'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN build_version TEXT'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN build_sha TEXT'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN build_source TEXT'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest ADD COLUMN build_code_root TEXT'); } catch { /* already exists */ }
   try { d.run('ALTER TABLE pty_manifest DROP COLUMN chain_depth'); } catch { /* legacy schema has no duplicate column */ }
   try { d.run('UPDATE pty_manifest SET closed_at=updated_at WHERE alive=0 AND closed_at=0'); } catch { /* fail-soft */ }
+  } finally {
+    if (ownsTxn) {
+      try { d.run('COMMIT'); } catch { try { d.run('ROLLBACK'); } catch { /* fail-soft */ } }
+    }
+  }
 }
 
 function codeShaForWorkdir(workdir: string | undefined): string {
@@ -290,6 +308,7 @@ export function upsertPtyManifest(row: {
     // 행을 (다시) 세우면 snapshot·frame 칸이 비워진다 — 같은 프로세스의 쓰기 스로틀도 비워 다음 쓰기가 바로 닿게 한다.
     _lastSnapshotAt.delete(row.id);
     _lastFrameAt.delete(row.id);
+    _lastProgressAt.delete(row.id);
     const d = db(); if (!d) return;
     const runId = getHarnessRunId(process.env);
     const runIdSource = getHarnessRunIdSource();
@@ -343,7 +362,7 @@ export function upsertPtyManifest(row: {
            terminal_origin_reason=excluded.terminal_origin_reason, external_tool_name=excluded.external_tool_name,
            started_at=excluded.started_at, alive=1, exit_code=NULL,
            snapshot='', snapshot_at=0, frame='', frame_at=0, closed_at=0, updated_at=excluded.updated_at,
-           turn_state=NULL, turn_at=NULL, build_version=NULL, build_sha=NULL, build_source=NULL, build_code_root=NULL`,
+           turn_state=NULL, turn_at=NULL, progress_at=NULL, abort_requested_at=NULL, build_version=NULL, build_sha=NULL, build_source=NULL, build_code_root=NULL`,
         values,
       );
       d.run('COMMIT');
@@ -434,11 +453,46 @@ export function updatePtyManifestSession(id: string, sessionId: string, now: num
   }
 }
 
-/** 턴 상태 기록 — 행이 없거나 db 를 못 열면 false(호출자가 관측을 남긴다). */
+/** 턴 상태 기록 — 행이 없거나 db 를 못 열면 false(호출자가 관측을 남긴다). 새 busy 턴은 이전 Esc 청구를 비운다. */
 export function updatePtyManifestTurn(id: string, turn: PtyTurnState, at: number): boolean {
   try {
     const d = db(); if (!d) return false;
-    return d.run('UPDATE pty_manifest SET turn_state=?, turn_at=? WHERE id=?', [turn, at, id]).changes > 0;
+    const result = turn === 'busy'
+      ? d.run('UPDATE pty_manifest SET turn_state=?, turn_at=?, progress_at=?, abort_requested_at=NULL WHERE id=?', [turn, at, at, id])
+      : d.run('UPDATE pty_manifest SET turn_state=?, turn_at=? WHERE id=?', [turn, at, id]);
+    if ((result.changes ?? 0) > 0 && turn === 'busy') _lastProgressAt.set(id, at);
+    return (result.changes ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
+
+/** 진전 기록 스로틀 — 같은 행은 이만큼 안에 다시 쓰지 않는다. */
+export const PTY_MANIFEST_PROGRESS_THROTTLE_MS = 5_000;
+
+/**
+ * 마지막 진전 시각 기록(SURVIVAL-PROGRESS-CLOCK). 같은 행을 5초 안에 다시 쓰면 생략하지만
+ * «실패가 아니다» — true 를 돌려 호출자의 실패 관측을 일으키지 않는다. 실패(0행·db 오류)만 false.
+ */
+export function updatePtyManifestProgress(id: string, at: number): boolean {
+  try {
+    const last = _lastProgressAt.get(id);
+    if (last !== undefined && at - last < PTY_MANIFEST_PROGRESS_THROTTLE_MS) return true;
+    const d = db(); if (!d) return false;
+    const result = d.run('UPDATE pty_manifest SET progress_at=?, updated_at=? WHERE id=?', [at, at, id]);
+    const ok = (result.changes ?? 0) > 0;
+    if (ok) _lastProgressAt.set(id, at);
+    return ok;
+  } catch {
+    return false;
+  }
+}
+
+/** Esc 로 턴 중단을 청한 시각 기록 — busy 턴이 이 뒤로 계속되면 abort-ignored 판정 재료가 된다. */
+export function updatePtyManifestAbortRequested(id: string, at: number): boolean {
+  try {
+    const d = db(); if (!d) return false;
+    return (d.run('UPDATE pty_manifest SET abort_requested_at=?, updated_at=? WHERE id=?', [at, at, id]).changes ?? 0) > 0;
   } catch {
     return false;
   }
@@ -903,6 +957,8 @@ function mapRow(r: Record<string, unknown>): PtyManifestRow {
     closedAt: Number(r.closed_at ?? 0),
     codeSha: String(r.code_sha ?? ''),
     ...(r.turn_state === 'busy' || r.turn_state === 'idle' ? { turnState: r.turn_state, turnAt: Number(r.turn_at ?? 0) } : {}),
+    ...(r.progress_at === null || r.progress_at === undefined ? {} : { progressAt: Number(r.progress_at) }),
+    ...(r.abort_requested_at === null || r.abort_requested_at === undefined ? {} : { abortRequestedAt: Number(r.abort_requested_at) }),
     ...(typeof r.build_sha === 'string' ? { build: mapBuild(r) } : {}),
     updatedAt: Number(r.updated_at),
   };

package/src/pty-shell/registry.ts

@@ -180,6 +180,8 @@ export interface PtyControlTarget {
   isAlive(): boolean;
   /** Registry-backed PTY targets expose termination; non-PTY control targets omit it. */
   kill?(signal?: NodeJS.Signals): void;
+  /** TUI owners may expose an explicit, forceful cancellation of the active turn. */
+  stopTurn?(force: true): boolean;
   canWrite(actor?: PtyWriteActor): boolean;
   write(chars: string, actor?: PtyWriteActor): void;
   resize(cols: number, rows: number): void;

package/src/pty-shell/tui-run-state.ts

@@ -27,7 +27,7 @@ import {
   versionedDashboardInstallDir,
 } from './stale-install-check.js';
 import {
-  updatePtyManifestBuild, updatePtyManifestTurn,
+  updatePtyManifestAbortRequested, updatePtyManifestBuild, updatePtyManifestProgress, updatePtyManifestTurn,
   type PtyBuildIdentity, type PtyManifestRow, type PtyTurnState,
 } from './pty-manifest.js';
 
@@ -231,6 +231,10 @@ export type PtyTurnView = PtyTurnState | 'unknown';
 export interface PtyRunStateView {
   readonly turn: PtyTurnView;
   readonly turnAt?: number;
+  /** 마지막 진전 시각(SURVIVAL-PROGRESS-CLOCK) — 기록 없는 행·옛 판은 undefined. */
+  readonly progressAt?: number;
+  /** Esc 로 턴 중단을 청한 시각 — 이 뒤로 busy 가 지속되면 abort-ignored 판정 재료. */
+  readonly abortRequestedAt?: number;
   readonly build: PtyBuildIdentity | null;
   readonly installed: string | null;
   readonly stale: boolean | null;
@@ -244,7 +248,7 @@ export interface DescribeRunStateDeps {
 
 /** manifest 행 하나의 턴 ⊕ 판 ⊕ stale. 행이 없거나 죽었으면 턴은 unknown. */
 export function describePtyRunState(
-  row: Pick<PtyManifestRow, 'alive' | 'startedAt' | 'kind' | 'turnState' | 'turnAt' | 'build'> | null,
+  row: Pick<PtyManifestRow, 'alive' | 'startedAt' | 'kind' | 'turnState' | 'turnAt' | 'progressAt' | 'abortRequestedAt' | 'build'> | null,
   deps: DescribeRunStateDeps = {},
 ): PtyRunStateView {
   let installed: InstalledRecord = {};
@@ -265,6 +269,8 @@ export function describePtyRunState(
   const turnView = ptyTurnViewOfRow(row);
   return {
     ...turnView,
+    ...(row?.alive && row.progressAt !== undefined ? { progressAt: row.progressAt } : {}),
+    ...(row?.alive && row.abortRequestedAt !== undefined ? { abortRequestedAt: row.abortRequestedAt } : {}),
     build: build ?? null,
     installed: installed.sha ?? null,
     stale: staleness.stale,
@@ -446,6 +452,50 @@ export const spawnTuiRelaunch = (sessionId: string): Promise<void> => {
   });
 };
 
+// ── SURVIVAL-PROGRESS-CLOCK — «마지막 진전 시각»로 느림·정체·Esc 무시를 가른다 ──
+//
+// `turnAt` 은 턴 값이 «바뀔 때만» 적히므로 busy 경과만으로는 «일하는 중»인지 «죽었다»인지를 못 가른다.
+// 진전 신호(스트림 텍스트·도구 시작/끝·상태 줄)가 `progress_at` 를 계속 올리면 긴 턴도 «느리지만 가는 중»이
+// 되고, 진전이 끊기면 «정체», Esc 청구 뒤에도 busy 가 지속되면 «Esc 무시»로 판정한다.
+
+export const DEFAULT_TURN_STALL_MS = 12 * 60 * 1000;
+export const DEFAULT_SLOW_TURN_MS = 20 * 60 * 1000;
+export const DEFAULT_ABORT_IGNORE_MS = 30 * 1000;
+
+export type TurnProgressJudgment = 'progressing' | 'slow' | 'stalled' | 'abort-ignored' | 'unknown';
+
+export interface TurnProgressInput {
+  readonly turn: PtyTurnView;
+  readonly turnAt?: number;
+  readonly progressAt?: number;
+  readonly abortRequestedAt?: number;
+  readonly now: number;
+  /** 정체 임계 — 진전이 이만큼 끊기면 stalled. 기본 12분. */
+  readonly stallMs?: number;
+  /** 느린 턴 임계 — 턴 경과가 이만큼이면 slow. 기본 20분. */
+  readonly slowTurnMs?: number;
+  /** Esc 무시 임계 — 청구 뒤 이만큼 busy 면 abort-ignored. 기본 30초. */
+  readonly abortIgnoreMs?: number;
+}
+
+/** 순수 판정: busy 턴의 진전·정체·Esc 무시를 임계로 가른다. 재료가 없으면 unknown(«괜찮다»가 아니다). */
+export function judgeTurnProgress(input: TurnProgressInput): TurnProgressJudgment {
+  const { turn, turnAt, progressAt, abortRequestedAt, now } = input;
+  if (turn !== 'busy') return 'unknown';
+  if (!Number.isFinite(now)) return 'unknown';
+  // Esc 청구 뒤에도 busy 가 지속되면 무시 — 정체보다 구체적이므로 먼저 가른다.
+  if (abortRequestedAt !== undefined && Number.isFinite(abortRequestedAt)) {
+    if (now - abortRequestedAt >= (input.abortIgnoreMs ?? DEFAULT_ABORT_IGNORE_MS)) return 'abort-ignored';
+  }
+  // 진전 시각이 없으면 턴 시작(turnAt)이 진전의 0초다.
+  const since = progressAt !== undefined && Number.isFinite(progressAt) ? progressAt : turnAt;
+  if (since === undefined || !Number.isFinite(since)) return 'unknown';
+  const elapsed = Math.max(0, now - since);
+  if (elapsed >= (input.stallMs ?? DEFAULT_TURN_STALL_MS)) return 'stalled';
+  if (turnAt !== undefined && Number.isFinite(turnAt) && now - turnAt >= (input.slowTurnMs ?? DEFAULT_SLOW_TURN_MS)) return 'slow';
+  return 'progressing';
+}
+
 // ── 기록(TUI) ──
 
 export interface TuiRunStateRecorderDeps {
@@ -453,6 +503,10 @@ export interface TuiRunStateRecorderDeps {
   readonly build?: () => PtyBuildIdentity;
   readonly writeBuild?: (id: string, build: PtyBuildIdentity) => boolean;
   readonly writeTurn?: (id: string, turn: PtyTurnState, at: number) => boolean;
+  /** 진전 시각 기록 — 생략하면 `updatePtyManifestProgress`(같은 행 5초 스로틀). */
+  readonly writeProgress?: (id: string, at: number) => boolean;
+  /** Esc 청구 시각 기록 — 생략하면 `updatePtyManifestAbortRequested`. */
+  readonly writeAbortRequested?: (id: string, at: number) => boolean;
   readonly log?: (event: string, data: Record<string, unknown>) => void;
   /**
    * herdr pane 신고기. 생략 시: `writeTurn` 을 주입하지 않은 기본 녹음기만
@@ -476,6 +530,8 @@ interface ActiveRecorder {
   readonly surfaceId: string;
   readonly now: () => number;
   readonly writeTurn: (id: string, turn: PtyTurnState, at: number) => boolean;
+  readonly writeProgress: (id: string, at: number) => boolean;
+  readonly writeAbortRequested: (id: string, at: number) => boolean;
   readonly log: (event: string, data: Record<string, unknown>) => void;
   readonly herdr: HerdrAgentReporterLike | null;
   /** manifest 에 실제로 적힌 마지막 턴. 실패면 안 바뀐다(재시도). */
@@ -495,6 +551,8 @@ export function startTuiRunStateRecorder(surfaceId: string, deps: TuiRunStateRec
   const now = deps.now ?? Date.now;
   const log = deps.log ?? defaultLog;
   const writeTurn = deps.writeTurn ?? updatePtyManifestTurn;
+  const writeProgress = deps.writeProgress ?? updatePtyManifestProgress;
+  const writeAbortRequested = deps.writeAbortRequested ?? updatePtyManifestAbortRequested;
   // 기본 신고기는 기본 manifest 쓰기와 짝일 때만. writeTurn 주입(시험)은 herdr 를 안 만든다.
   const herdr = deps.herdr !== undefined
     ? deps.herdr
@@ -508,7 +566,7 @@ export function startTuiRunStateRecorder(surfaceId: string, deps: TuiRunStateRec
     log(ok ? 'build-recorded' : 'build-write-failed', { ptyId: surfaceId, sha: build.sha, version: build.version, source: build.source });
   }
   // 기동 순서: 판 → manifest 초기 idle → herdr 신고. herdr start 가 idle 을 신고하므로 초기 idle 을 turn 으로 다시 안 보낸다.
-  const recorder: ActiveRecorder = { surfaceId, now, writeTurn, log, herdr, herdrLast: herdr ? 'idle' : undefined };
+  const recorder: ActiveRecorder = { surfaceId, now, writeTurn, writeProgress, writeAbortRequested, log, herdr, herdrLast: herdr ? 'idle' : undefined };
   active = recorder;
   writeTurnState(recorder, 'idle');
   if (herdr) { try { herdr.start(); } catch { /* 신고 실패가 녹음기를 깨지 않는다 */ } }
@@ -614,6 +672,25 @@ export function reportTuiTurn(turn: PtyTurnState): void {
   writeTurnState(active, turn);
 }
 
+/** 진전 신호(스트림 텍스트·도구 시작/끝·상태 줄)에서 부른다 — 마지막 진전 시각을 올린다. 녹음기가 없으면 아무것도 안 한다. */
+export function reportTuiProgress(): void {
+  if (!active) return;
+  const at = active.now();
+  let ok = false;
+  try { ok = active.writeProgress(active.surfaceId, at); } catch { ok = false; }
+  // 실패(0행·예외)는 관측으로만 남긴다 — 진전 기록이 턴을 막지 않는다. 스로틀 생략(false 아님 실패만)은 조용히 지나간다.
+  if (!ok) active.log('progress-write-failed', { ptyId: active.surfaceId, at });
+}
+
+/** Esc 게이트가 턴 중단을 청할 때 부른다 — 청구 시각을 남긴다(busy 가 지속되면 abort-ignored 판정 재료). */
+export function reportTuiAbortRequested(): void {
+  if (!active) return;
+  const at = active.now();
+  let ok = false;
+  try { ok = active.writeAbortRequested(active.surfaceId, at); } catch { ok = false; }
+  if (!ok) active.log('abort-requested-write-failed', { ptyId: active.surfaceId, at });
+}
+
 function writeTurnState(recorder: ActiveRecorder, turn: PtyTurnState): void {
   const at = recorder.now();
   let ok = false;

package/src/release-loop/gate-host-reservation.ts

@@ -11,11 +11,13 @@ interface GateHostClaim {
   hosts: string[];
   pid: number;
   pidStartedAt: number | null;
+  /** Wall-clock claim time. Claims written before this field existed stay readable (optional on read). */
+  reservedAt?: number;
 }
 
 export type GateHostReservation =
   | { status: 'free' }
-  | { status: 'reserved' | 'unknown'; reason: string; runId?: string };
+  | { status: 'reserved' | 'unknown'; reason: string; runId?: string; reservedAt?: number };
 
 const hostName = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const claimsDir = (root: string) => join(root, 'release', 'gate-host-reservations');
@@ -44,7 +46,7 @@ export function reserveReleaseGateHosts(root: string, runId: string, hosts: read
   const token = randomUUID();
   const pidStartedAt = psProcessStartMs(process.pid);
   if (pidStartedAt === null) throw new Error('release gate owner start time unmeasured');
-  const claim: GateHostClaim = { token, runId, hosts: unique, pid: process.pid, pidStartedAt };
+  const claim: GateHostClaim = { token, runId, hosts: unique, pid: process.pid, pidStartedAt, reservedAt: Date.now() };
   const path = join(dir, `${token}.json`);
   const temp = join(dir, `.${token}.tmp`);
   try {
@@ -82,7 +84,9 @@ export function inspectReleaseGateHost(root: string, host: string): GateHostRese
         || !Number.isSafeInteger(claim.pid) || claim.pid <= 0 || typeof claim.token !== 'string'
         || typeof claim.runId !== 'string' || !claim.runId
         || (claim.pidStartedAt !== null && (!Number.isSafeInteger(claim.pidStartedAt)
-          || claim.pidStartedAt <= 0 || claim.pidStartedAt > Date.now()))) throw new Error('invalid claim');
+          || claim.pidStartedAt <= 0 || claim.pidStartedAt > Date.now()))
+        || (claim.reservedAt !== undefined && (!Number.isSafeInteger(claim.reservedAt)
+          || claim.reservedAt <= 0 || claim.reservedAt > Date.now()))) throw new Error('invalid claim');
     } catch (error) { return { status: 'unknown', reason: `reservation unreadable: ${name}: ${String(error)}` }; }
     const live = claimAlive(claim);
     if (live === 'dead') {
@@ -91,7 +95,12 @@ export function inspectReleaseGateHost(root: string, host: string): GateHostRese
       continue;
     }
     if (!claim.hosts.includes(host) && !claim.hosts.includes('*')) continue;
-    return { status: live === 'unknown' ? 'unknown' : 'reserved', reason: `release gate ${claim.runId} holds ${host}`, runId: claim.runId };
+    return {
+      status: live === 'unknown' ? 'unknown' : 'reserved',
+      reason: `release gate ${claim.runId} holds ${host}`,
+      runId: claim.runId,
+      ...(claim.reservedAt !== undefined ? { reservedAt: claim.reservedAt } : {}),
+    };
   }
   return { status: 'free' };
 }

package/src/release-loop/gate-shard-ledger.ts

@@ -0,0 +1,68 @@
+// One append-only observation per gate shard transition. The live board is a projection, not evidence for reuse.
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { releaseLedgerRoot } from '../instance/resolve.js';
+
+export interface GateShardLedgerRow {
+  v: 1;
+  version: string;
+  phase: 'cut' | 'baseline';
+  shardId: string;
+  files: string[];
+  host: string | null;
+  executor: 'pod' | 'host';
+  imageDigest: string | null;
+  commit: string;
+  envFingerprint: string;
+  startedAt: string | null;
+  endedAt: string | null;
+  observedAt: string;
+  state: 'pending' | 'running' | 'done' | 'retry' | 'timeout' | 'failed';
+  rc: number | null;
+  pass: number | null;
+  fail: number | null;
+  errors: number | null;
+  ran: number | null;
+  failureIds: string[] | null;
+  errorIds: string[] | null;
+  attribution: 'complete' | 'unmeasured';
+  logPath: string | null;
+  junitPath: string | null;
+  stopReason: string | null;
+  attemptId: string | null;
+}
+
+export function gateShardLedgerPath(version: string, root = releaseLedgerRoot()): string {
+  if (!/^\d+\.\d+\.\d+(?:[-.][A-Za-z0-9.-]+)?$/.test(version)) throw new Error('invalid release version');
+  return join(root, 'release', version, 'gate-logs', 'shard-ledger.jsonl');
+}
+
+/** Each newline is a complete event, so an observer can read while the gate is running. */
+export function appendGateShardLedger(path: string, row: GateShardLedgerRow): void {
+  if (!/^[a-f0-9]{40}$/i.test(row.commit) || !/^[a-f0-9]{64}$/i.test(row.envFingerprint)) throw new Error('invalid shard ledger identity');
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(row.shardId) || row.files.some((file) => file.startsWith('/') || file.split('/').includes('..'))) throw new Error('invalid shard ledger path');
+  mkdirSync(dirname(path), { recursive: true });
+  appendFileSync(path, `${JSON.stringify(row)}\n`, { mode: 0o600 });
+}
+
+export function readGateShardLedger(path: string): { rows: GateShardLedgerRow[]; malformed: number } | null {
+  if (!existsSync(path)) return null;
+  const rows: GateShardLedgerRow[] = [];
+  let malformed = 0;
+  for (const line of readFileSync(path, 'utf8').split('\n')) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line) as GateShardLedgerRow;
+      if (row.v !== 1 || typeof row.shardId !== 'string' || !Array.isArray(row.files) || typeof row.observedAt !== 'string') throw new Error('invalid row');
+      rows.push(row);
+    } catch { malformed++; }
+  }
+  return { rows, malformed };
+}
+
+/** The newest event for each phase/shard. Preserve every attempt in the underlying ledger. */
+export function latestGateShardLedger(rows: readonly GateShardLedgerRow[]): GateShardLedgerRow[] {
+  const latest = new Map<string, GateShardLedgerRow>();
+  for (const row of rows) latest.set(`${row.phase}:${row.shardId}`, row);
+  return [...latest.values()].sort((a, b) => a.phase.localeCompare(b.phase) || a.shardId.localeCompare(b.shardId, undefined, { numeric: true }));
+}