elanous 0.2.40 → 0.2.42

package/src/self-implement/gate-cli.ts

@@ -4,7 +4,6 @@ import { tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { basename, join, resolve } from 'node:path/posix';
 import { prepareDeterministicChildEnvironment } from '../../scripts/lib/deterministic-env.js';
-import { audit as auditEntryBudget, entryBudgetAffected } from '../../scripts/ratchets/next-tui-entry-budget.js';
 import { withGateTestEnv } from '../../scripts/lib/gate-test-env.js';
 import { runIsolationHardcodeGate } from '../../scripts/ci-isolation-hardcode-gate.js';
 import { runModelHardcodeGate } from '../../scripts/ci-model-hardcode-gate.js';
@@ -58,6 +57,49 @@ export interface SelfGateCliOptions {
   scenarioFile?: string;
   /** SIDE-VERIFY — 조각별 지금/기준 JUnit ⊕ summary.json 을 이 디렉토리에 «쓰기만» 한다(판정·exit·기존 줄 불변). */
   artifactDir?: string;
+  /** Marker captured by the process entry point; keeps receipts stable if the environment changes during dispatch. */
+  trainGate?: boolean;
+}
+
+const SELF_GATE_SEAT_TRACKS = new Set(['OP', 'OPC', 'OPT', 'TC', 'UX', 'MK']);
+
+interface SelfGateTrainMarker {
+  track: string | null;
+  received: boolean;
+}
+
+/** Capture and log the marker exactly as the self-gate process received it. */
+export function observeSelfGateTrainMarker(): SelfGateTrainMarker {
+  const track = process.env.ELANOUS_TRACK?.trim() || null;
+  const received = process.env.ELANOUS_TRAIN_GATE === '1';
+  try { debug.log('self-gate', 'train-gate-marker', { track, received }); } catch { /* evidence logging must not change gate behavior */ }
+  return { track, received };
+}
+
+/** Seat invocations may only measure the pinned tree after the landing train has admitted the gate. */
+export function refuseSeatSelfGateWithoutTrainMarker(marker = observeSelfGateTrainMarker()): { track: string; message: string } | undefined {
+  const { track, received } = marker;
+  if (!track || !SELF_GATE_SEAT_TRACKS.has(track) || received) return undefined;
+  try { debug.log('self-gate', 'seat-refused', { track, requiredMarker: 'ELANOUS_TRAIN_GATE=1' }); } catch { /* refusal must survive an unavailable observer */ }
+  return { track, message: 'gate 는 열차가 착지 때 1회 — land-enqueue.sh 로 줄에 올려라' };
+}
+
+/** A refused admission still writes the observed marker when an artifact directory was requested. */
+export function writeSeatSelfGateRefusalArtifact(cwd: string, artifactDir: string, marker: SelfGateTrainMarker): string | undefined {
+  if (!artifactDir.trim()) return undefined;
+  const dir = resolveArtifactDir(artifactDir, cwd);
+  const written = writeGateArtifacts({
+    dir,
+    head40: defaultRevResolver(cwd)('HEAD'),
+    base40: null,
+    envKey: defaultGateEnvKey(),
+    trainGate: marker.received,
+    testFiles: [],
+    verdict: 'seat-refused',
+    verdictLine: `seat gate refused before dispatch (track=${marker.track ?? 'none'}; trainGate=${marker.received})`,
+    exitCode: 2,
+  });
+  return written.summaryPath;
 }
 
 interface ProcessResult {
@@ -125,7 +167,6 @@ interface SelfGateCliDeps {
   /** iOS 순수-로직 시험 게이트 심(시험 주입용). */
   runIosGate?: (out: GateOutput) => number;
   runPwaGate?: (out: GateOutput) => number;
-  runEntryBudgetGate?: (cwd: string, changedFiles: readonly string[]) => { affected: boolean; errors: string[] };
   listPrWorktrees?: (cwd: string) => PrWorktreeListEntry[] | { lookupFailed: string };
   inspectWorktreeDirtiness?: (path: string) => { dirty: boolean } | { lookupFailed: string };
   /** `--artifact-dir` 전용 심 — 커밋 sha 해석(실패 = null) · 환경 키. */
@@ -809,23 +850,25 @@ export function selectGateTestFiles(cwd: string, options: GateSelectionOptions =
 
 export function runSelfGateCli(cwd: string, options: SelfGateCliOptions = {}, deps: SelfGateCliDeps = {}): SelfGateCliResult {
   const capture: GateArtifactCapture = {};
+  const trainGate = options.trainGate ?? process.env.ELANOUS_TRAIN_GATE === '1';
   const result = runSelfGateCliCore(cwd, options, deps, capture, false) as SelfGateCliResult;
   persistGateReceipt(cwd, capture, deps);
-  if (options.artifactDir !== undefined) emitGateArtifacts(cwd, options.artifactDir, result, capture, deps);
+  if (options.artifactDir !== undefined) emitGateArtifacts(cwd, options.artifactDir, result, capture, deps, trainGate);
   return result;
 }
 
 /** Production path: shard bundles use async Bun children; all non-shard policy and timeout logic is shared. */
 export async function runSelfGateCliAsync(cwd: string, options: SelfGateCliOptions = {}, deps: SelfGateCliDeps = {}): Promise<SelfGateCliResult> {
   const capture: GateArtifactCapture = {};
+  const trainGate = options.trainGate ?? process.env.ELANOUS_TRAIN_GATE === '1';
   const result = await runSelfGateCliCore(cwd, options, deps, capture, true);
   persistGateReceipt(cwd, capture, deps);
-  if (options.artifactDir !== undefined) emitGateArtifacts(cwd, options.artifactDir, result, capture, deps);
+  if (options.artifactDir !== undefined) emitGateArtifacts(cwd, options.artifactDir, result, capture, deps, trainGate);
   return result;
 }
 
 /** 쓰기 실패는 «경고 한 줄»로만 접는다 — 판정·exit 코드는 그대로다. */
-function emitGateArtifacts(cwd: string, artifactDir: string, result: SelfGateCliResult, capture: GateArtifactCapture, deps: SelfGateCliDeps): void {
+function emitGateArtifacts(cwd: string, artifactDir: string, result: SelfGateCliResult, capture: GateArtifactCapture, deps: SelfGateCliDeps, trainGate: boolean): void {
   if (!artifactDir.trim()) {
     result.lines.push('⚠ artifacts: --artifact-dir 가 빈 경로라 안 썼다 (판정은 그대로다)');
     return;
@@ -839,6 +882,7 @@ function emitGateArtifacts(cwd: string, artifactDir: string, result: SelfGateCli
       head40: resolveRev('HEAD'),
       base40: capture.baseRef ? resolveRev(capture.baseRef) : null,
       envKey: (deps.envKey ?? defaultGateEnvKey)(),
+      trainGate,
       testFiles: capture.testFiles ?? result.testFiles,
       verdict: capture.verdict ?? null,
       ...(capture.verdictLine !== undefined ? { verdictLine: capture.verdictLine } : {}),
@@ -1210,20 +1254,6 @@ function runSelfGateCliCore(cwd: string, options: SelfGateCliOptions, deps: Self
   // 🍎 iOS 축 — 안드로이드와 «같은 자리»에 둔다(skipTestStep 앞). Swift 만 바뀐 PR 도 여기서 조기 리턴한다.
   const iosPassed = runAdditionalGate('ios-gate', deps.runIosGate ?? runIosUnitTestGate, selection.files, cwd, lines);
   const pwaPassed = runAdditionalGate('pwa-gate', deps.runPwaGate ?? runPwaBuildGate, selection.files, cwd, lines);
-  let entryBudgetPassed = false;
-  try {
-    const budget = (deps.runEntryBudgetGate ?? ((dir, files) => {
-      const affected = entryBudgetAffected(files);
-      return { affected, errors: affected ? auditEntryBudget(dir).errors : [] };
-    }))(cwd, selection.files);
-    entryBudgetPassed = budget.errors.length === 0;
-    lines.push(budget.affected
-      ? `next-tui-entry-budget: ${entryBudgetPassed ? 'pass' : `FAIL ${budget.errors.join('; ')}`}`
-      : 'next-tui-entry-budget: skip (unrelated changes)');
-  } catch (error) {
-    lines.push(`next-tui-entry-budget: UNMEASURED ${error instanceof Error ? error.message : String(error)}`);
-  }
-
   if (receiptDecision?.mode === 'inherit' && testFiles.length === 0 && fullTestFiles.length > 0) {
     capture.testReceiptMeasured = true;
     capture.failedTestFiles = [];
@@ -1235,7 +1265,7 @@ function runSelfGateCliCore(cwd: string, options: SelfGateCliOptions, deps: Self
     const policyPassed = runPolicyGates(selection.files, cwd, lines, deps);
     logGateCliBaseline(cwd, { ...ZERO_GATE_BASELINE, unrunImporterTotal, lookupFailed: importerLookupFailed });
     return {
-      exitCode: policyPassed && androidPassed && iosPassed && pwaPassed && entryBudgetPassed && expose.passed ? 0 : 1,
+      exitCode: policyPassed && androidPassed && iosPassed && pwaPassed && expose.passed ? 0 : 1,
       lines, changedFiles: selection.files, testFiles, unverified: scope.unverified,
       documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests,
       alwaysIncludeMissing, importerTestsAdded,
@@ -1249,7 +1279,7 @@ function runSelfGateCliCore(cwd: string, options: SelfGateCliOptions, deps: Self
     capture.failedTestFiles = [];
     logGateCliBaseline(cwd, { ...ZERO_GATE_BASELINE, unrunImporterTotal, lookupFailed: importerLookupFailed });
     Object.assign(capture, { verdict: 'skipped', artifactsUnavailable: 'no-tests' } satisfies GateArtifactCapture);
-    return { exitCode: androidPassed && iosPassed && pwaPassed && entryBudgetPassed && policyPassed && expose.passed ? 0 : 1, lines, changedFiles: selection.files, testFiles: [], unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests, alwaysIncludeMissing, importerTestsAdded, baseline: { introduced: 0, preexisting: 0, unknown: 0, preconditionUnmet: 0 } };
+    return { exitCode: androidPassed && iosPassed && pwaPassed && policyPassed && expose.passed ? 0 : 1, lines, changedFiles: selection.files, testFiles: [], unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests, alwaysIncludeMissing, importerTestsAdded, baseline: { introduced: 0, preexisting: 0, unknown: 0, preconditionUnmet: 0 } };
   }
 
   // The default direct Bun path has one process and one 300s limit. Route real child/PTY tests through
@@ -1339,7 +1369,7 @@ function runSelfGateCliCore(cwd: string, options: SelfGateCliOptions, deps: Self
       capture.verdictLine = lines[lines.length - 1];
       const policyPassed = runPolicyGates(selection.files, cwd, lines, deps);
       return {
-        exitCode: capture.verdict !== 'passed' || !policyPassed || !androidPassed || !iosPassed || !pwaPassed || !entryBudgetPassed || !expose.passed ? 1 : 0,
+        exitCode: capture.verdict !== 'passed' || !policyPassed || !androidPassed || !iosPassed || !pwaPassed || !expose.passed ? 1 : 0,
         lines, changedFiles: selection.files, testFiles, unverified: scope.unverified,
         documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests,
         alwaysIncludeMissing, importerTestsAdded, ...(shardBaseline ? { baseline: shardBaseline } : {}),
@@ -1359,7 +1389,7 @@ function runSelfGateCliCore(cwd: string, options: SelfGateCliOptions, deps: Self
     Object.assign(capture, { verdict: 'passed', verdictLine: lines[lines.length - 1] } satisfies GateArtifactCapture);
     const policyPassed = runPolicyGates(selection.files, cwd, lines, deps);
     logGateCliBaseline(cwd, { ...ZERO_GATE_BASELINE, unrunImporterTotal, lookupFailed: importerLookupFailed });
-    return { exitCode: policyPassed && androidPassed && iosPassed && pwaPassed && entryBudgetPassed && expose.passed ? 0 : 1, lines, changedFiles: selection.files, testFiles, unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests, alwaysIncludeMissing, importerTestsAdded, baseline: { introduced: 0, preexisting: 0, unknown: 0, preconditionUnmet: 0 } };
+    return { exitCode: policyPassed && androidPassed && iosPassed && pwaPassed && expose.passed ? 0 : 1, lines, changedFiles: selection.files, testFiles, unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests, alwaysIncludeMissing, importerTestsAdded, baseline: { introduced: 0, preexisting: 0, unknown: 0, preconditionUnmet: 0 } };
   }
 
   if (worktreeLog.includes('deterministic environment setup failed')) lines.push(worktreeLog);
@@ -1394,7 +1424,7 @@ function runSelfGateCliCore(cwd: string, options: SelfGateCliOptions, deps: Self
     verdictLine: lines[lines.length - 1],
   } satisfies GateArtifactCapture);
   const policyPassed = runPolicyGates(selection.files, cwd, lines, deps);
-  const exitCode = !androidPassed || !iosPassed || !pwaPassed || !entryBudgetPassed || !policyPassed || !expose.passed || report.introduced > 0 || report.unknown > 0 || report.preconditionUnmet > 0 ? 1 : 0;
+  const exitCode = !androidPassed || !iosPassed || !pwaPassed || !policyPassed || !expose.passed || report.introduced > 0 || report.unknown > 0 || report.preconditionUnmet > 0 ? 1 : 0;
   return { exitCode, lines, changedFiles: selection.files, testFiles, unverified: scope.unverified, documentPaths: scope.documentPaths, documentsWithoutDerivedTests: scope.documentsWithoutDerivedTests, alwaysIncludeMissing, importerTestsAdded, baseline: { introduced: report.introduced, preexisting: report.preexisting, unknown: report.unknown, preconditionUnmet: report.preconditionUnmet } };
 }
 

package/src/self-implement/gate-remote.ts

@@ -7,7 +7,7 @@ import { existsSync, lstatSync, realpathSync } from 'node:fs';
 import { loadavg } from 'node:os';
 import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { debug } from '../debug/log.js';
-import { gateHostReservationRoot, inspectReleaseGateHost } from '../release-loop/gate-host-reservation.js';
+import { gateHostReservationRoot, inspectReleaseGateHost, readGateHostResourcesForHost, type GateHostResourceReading } from '../release-loop/gate-host-reservation.js';
 import type { GateRemoteConfig } from '../user-config.js';
 
 export type GateRemoteTool = 'self-gate' | 'ci-typecheck-changed' | 'public-export-test-run';
@@ -538,6 +538,8 @@ export interface DispatchDeps {
   now?: () => number;
   /** Test seam for gate.remote events; production defaults to the structured debug log. */
   log?: (event: string, data: Record<string, unknown>) => void;
+  /** Read-only host-resource probe; production reads Pod pool ledgers, tests inject the same measured snapshot. */
+  readHostResources?: (host: string) => GateHostResourceReading;
   write?: { out: (data: string | Uint8Array) => void; err: (data: string | Uint8Array) => void };
 }
 
@@ -595,8 +597,24 @@ export async function dispatchHeavyCheck(opts: DispatchOptions, deps: DispatchDe
   const reservationRoot = opts.tool === 'self-gate' || opts.tool === 'ci-typecheck-changed'
     ? opts.reservationRoot ?? (deps.runner ? undefined : gateHostReservationRoot()) : undefined;
   if (reservationRoot) {
+    const resourceStatus = (target: string) => {
+      if (!deps.readHostResources && deps.runner) return null; // fake runners keep tests hermetic unless the producer is explicitly exercised
+      return (deps.readHostResources ?? ((selected) => readGateHostResourcesForHost(selected, env)))(target.split('@').at(-1)!);
+    };
+    const inspect = (target: string) => {
+      const claim = inspectReleaseGateHost(reservationRoot, target);
+      const resources = resourceStatus(target);
+      if (!resources) return claim;
+      if (resources.status === 'unmeasurable') {
+        // Keep a concrete release owner visible even if the independent Pod ledgers cannot be read.
+        if (claim.status === 'reserved') return claim;
+        return { status: 'unknown' as const, reason: `resource probe unmeasurable: ${resources.reason}` };
+      }
+      if (!resources.empty) return { status: 'reserved' as const, reason: `Pod resource pool occupied (${resources.reservations} reservations)` };
+      return claim;
+    };
     const reservationHost = host.split('@').at(-1)!;
-    const first = inspectReleaseGateHost(reservationRoot, reservationHost);
+    const first = inspect(reservationHost);
     if (first.status !== 'free') {
       // A reserved host is never a reason to run this check locally (반증: 예약 상태에서 --local 무거운 시험 금지).
       // Self gate first tries another remote host, then waits bounded for the release, then ends unmeasured with
@@ -609,7 +627,7 @@ export async function dispatchHeavyCheck(opts: DispatchOptions, deps: DispatchDe
         : `observed-at=${observedAt}`;
       const alternates = opts.tool === 'self-gate'
         ? gateReservationAlternateHosts(reservationHost, opts.reservationAltHosts) : [];
-      const alternate = alternates.find((candidate) => inspectReleaseGateHost(reservationRoot, candidate).status === 'free');
+      const alternate = alternates.find((candidate) => inspect(candidate).status === 'free');
       if (alternate) {
         const rerouted = host.includes('@') ? `${host.slice(0, host.lastIndexOf('@'))}@${alternate}` : alternate;
         debug.log('gate.remote', 'host-reserved-reroute', { tool: opts.tool, from: host, to: rerouted, owner, reason: first.reason, reservedAt: first.reservedAt, observedAt });
@@ -619,7 +637,7 @@ export async function dispatchHeavyCheck(opts: DispatchOptions, deps: DispatchDe
         const waitSeconds = opts.tool === 'self-gate' ? opts.reservationWaitSeconds ?? settings.slotWaitSeconds : 0;
         const waitStart = now();
         const deadline = waitStart + Math.max(0, waitSeconds) * 1000;
-        let latest = inspectReleaseGateHost(reservationRoot, reservationHost);
+        let latest = inspect(reservationHost);
         while (waitSeconds > 0 && latest.status !== 'free') {
           const left = deadline - now();
           if (left <= 0) break;
@@ -627,7 +645,7 @@ export async function dispatchHeavyCheck(opts: DispatchOptions, deps: DispatchDe
           const before = now();
           await sleep(Math.min(15_000, left));
           if (now() <= before) break; // a frozen test clock must not spin past the bound
-          latest = inspectReleaseGateHost(reservationRoot, reservationHost);
+          latest = inspect(reservationHost);
         }
         const waitedMs = Math.max(0, now() - waitStart);
         if (latest.status === 'free') {

package/src/self-implement/goal-author-clarification.ts

@@ -84,7 +84,7 @@ export interface GoalAuthorSelfResolutionContext {
 
 export type GoalAuthorSelfResolution =
   | { answer: string; evidence: readonly string[]; assumption?: string; declined?: undefined }
-  | { answer?: undefined; evidence?: undefined; declined?: boolean };
+  | { answer?: undefined; evidence?: undefined; declined?: boolean; failed?: boolean };
 
 export interface GoalAuthorClarificationResolutionDeps {
   /** Elanousic authoring seam; it must return no answer when the available evidence is insufficient. */
@@ -227,7 +227,7 @@ export async function defaultGoalAuthorSelfResolve(
       parsed = JSON.parse(result);
     } catch {
       observeSelfResolve('self-resolve-parse-failed', context, startedAt, { usage: deriveUsage(usages) });
-      return {};
+      return { failed: true };
     }
     const answer = parsed !== null && typeof parsed === 'object'
       ? (parsed as { answer?: unknown }).answer
@@ -256,7 +256,7 @@ export async function defaultGoalAuthorSelfResolve(
       startedAt,
       { usage: deriveUsage(usages) },
     );
-    return {};
+    return { failed: true };
   } finally {
     clearTimeout(timeout);
   }
@@ -530,7 +530,7 @@ export function goalClarificationDecisionCategory(
   const text = [clarification.header, clarification.question, ...clarification.options.flatMap((option) => [option.label, option.description])]
     .join(' ')
     .toLocaleLowerCase();
-  if (/\b(payment|purchase|spend|budget|credit|charge|price|cost|paid)\b|결제|구매|지출|예산|크레딧|과금|가격|비용/.test(text)) return 'money';
+  if (/\b(payment|purchase|spend|budget|credit|charge|price|cost|paid|refund|reimburse(?:ment)?|chargeback|transfer|wire(?:\s+transfer)?|withdraw(?:al)?|deposit|invoice|subscribe|subscription|renewal)\b|결제|구매|지출|예산|크레딧|과금|가격|비용|환불|환급|송금|이체|구독|정기결제/.test(text)) return 'money';
   if (/\b(security|credential|token|secret|password|authorization|authentication|permission|access control)\b|보안|자격 증명|토큰|비밀키|비밀번호|인가|인증|권한/.test(text)) return 'security';
   if (/\b(publish|publication|deploy|send|delete|release|irreversible|external side effect|production)\b|발행|게시|배포|전송|삭제|릴리스|되돌릴 수 없|외부 효과|운영 환경/.test(text)) return 'irreversible';
   return undefined;
@@ -827,7 +827,7 @@ export async function selfAnswerGoalDocumentClarifications(
     runId?: string;
     skipQuestionIds?: ReadonlySet<string>;
   },
-): Promise<{ document: string; asked: number; answered: number; unanswered: number; newlyAnswered: number }> {
+): Promise<{ document: string; asked: number; answered: number; unanswered: number; newlyAnswered: number; resolverFailedQuestionIds: string[] }> {
   const clarifications = parseGoalDocumentClarifications(document);
   const pending = clarifications.filter((item) => !item.answered);
   // The first say pass may already have self-answered some questions while authoring: count those,
@@ -837,6 +837,7 @@ export async function selfAnswerGoalDocumentClarifications(
     : 0;
   let updated = document;
   let answered = 0;
+  const resolverFailedQuestionIds: string[] = [];
   const evidence = options.evidence ?? document.split(/\r?\n/)
     .filter((line) => /^(?:\s*- (?:\[code:|\[document:|TRACED PATHS|evidence:|Evidence:)|\s*-?\s*`?(?:src|test|scripts)\/[^\s`]+:\d+)/i.test(line))
     .slice(0, 40);
@@ -844,6 +845,8 @@ export async function selfAnswerGoalDocumentClarifications(
     if (parseGoalDocumentClarifications(updated).filter((entry) => entry.questionId === item.questionId).length !== 1) continue;
     let response: Awaited<ReturnType<typeof resolveGoalAuthorClarification>>;
     let declined = false;
+    let resolverFailed = false;
+    const baseResolver = options.resolver ?? defaultGoalAuthorSelfResolve;
     try { response = await resolveGoalAuthorClarification({
       questionId: item.questionId,
       kind: 'scope',
@@ -853,17 +856,25 @@ export async function selfAnswerGoalDocumentClarifications(
       blocking: false,
     }, {
       selfResolve: async (context) => {
-        const resolution = await (options.resolver ?? defaultGoalAuthorSelfResolve)(context);
-        declined = resolution.declined === true;
-        return resolution;
+        try {
+          const resolution = await baseResolver(context);
+          declined = resolution.declined === true;
+          resolverFailed = 'failed' in resolution && resolution.failed === true;
+          return resolution;
+        } catch (error) {
+          resolverFailed = true;
+          throw error;
+        }
       },
       evidence,
       ask: options.ask,
       selfResolutionSelected: true,
     }); } catch {
       // A resolver failure leaves this question unanswered; the remaining questions are still attempted.
+      resolverFailedQuestionIds.push(item.questionId);
       continue;
     }
+    if (resolverFailed) resolverFailedQuestionIds.push(item.questionId);
     let defaultExportCount: number | undefined;
     if (response.answer === null && item.questionId === 'preservation_contract'
       && declined) {
@@ -916,7 +927,7 @@ export async function selfAnswerGoalDocumentClarifications(
     path: options.path, asked, answered, unanswered,
     reason: unanswered === 0 ? 'answered' : 'insufficient-evidence',
   });
-  return { document: updated, asked, answered, unanswered, newlyAnswered };
+  return { document: updated, asked, answered, unanswered, newlyAnswered, resolverFailedQuestionIds };
 }
 
 /** SelfImplement boundary: resolve pending questions itself and record a bounded policy assumption if that fails.
@@ -940,15 +951,23 @@ export async function selfAnswerOrAssumeGoalDocumentClarifications(
   const decisionRequired: Array<{ questionId: string; header: string; question: string; category: GoalClarificationDecisionCategory }> =
     safetyQuestions.map(({ entry, category }) => ({ questionId: entry.questionId, header: entry.header, question: entry.question, category }));
   for (const item of parseGoalDocumentClarifications(updated).filter((entry) => !entry.answered)) {
+    if (attempted.resolverFailedQuestionIds.includes(item.questionId)) continue;
     const category = goalClarificationDecisionCategory(item);
     if (category) continue;
     const offered = item.options.filter((option) => option.label.trim() && !/[\r\n]/.test(option.label));
-    const useOfferedOption = !item.includeOther && offered.length > 0;
+    const requestText = (options.ask ?? '').toLocaleLowerCase().replace(/\s+/g, ' ').trim();
+    const inScopeOptions = item.includeOther ? [] : offered.filter((option) =>
+      [option.label, option.description ?? ''].some((candidate) => {
+        const normalized = candidate.toLocaleLowerCase().replace(/\s+/g, ' ').trim();
+        return normalized.length >= 4 && requestText.includes(normalized);
+      }));
+    if (!item.includeOther && inScopeOptions.length !== 1) continue;
+    const useOfferedOption = !item.includeOther;
     const answer = useOfferedOption
-      ? offered[0]!.label.trim()
+      ? inScopeOptions[0]!.label.trim()
       : '근거가 부족하므로 요청에 명시된 범위만 진행한다고 가정한다';
     const assumption = useOfferedOption
-      ? '자가 해소가 답을 내지 못해 자유 답변 없이 제시된 첫 후보를 정책 가정으로 선택했다'
+      ? '요청 원문에 명시된 후보만 허용되어 그 후보를 정책 가정으로 선택했다'
       : '자가 해소가 답을 내지 못해 추가 범위를 만들지 않고 요청에 명시된 범위만 진행한다고 가정했다';
     try {
       const current = findUnansweredGoalDocumentClarification(updated, item.questionId);