elanous 0.2.42 → 0.2.43

package/src/registry/loader.ts

@@ -31,6 +31,8 @@ import type {
 } from './types.js';
 import { PROVIDER_CAPABILITIES_NONE } from './types.js';
 import { readDiscoveryCache, type DiscoverySnapshot } from './discovery/cache.js';
+import { debug } from '../debug/log.js';
+import { readVerifiedCatalogCache, scheduleServerCatalogRefresh } from './catalog-server.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -85,6 +87,15 @@ function listYamlFiles(dir: string): string[] {
     .map((e) => join(dir, e));
 }
 
+function readCatalogVersion(builtinDir: string): number {
+  const path = join(builtinDir, 'meta', 'catalogVersion.yaml');
+  if (!existsSync(path)) return 1;
+  const raw = safeReadYaml(path) as { catalogVersion?: unknown } | null;
+  return Number.isSafeInteger(raw?.catalogVersion) && (raw?.catalogVersion as number) >= 1
+    ? raw?.catalogVersion as number
+    : 1;
+}
+
 // ── Provider parse + validate ─────────────────────────────────────────
 
 function parseProvider(raw: unknown, source: string): ProviderRegistration | null {
@@ -282,11 +293,13 @@ let cachedCatalog: Catalog | null = null;
 
 function buildCatalog(): Catalog {
   const builtinDir = resolveBuiltinCatalogDir();
+  const catalogVersion = readCatalogVersion(builtinDir);
   const globalDir = resolveGlobalCatalogDir();
 
   const providers = new Map<string, ProviderRegistration>();
   const models = new Map<string, ModelSpec>();
   const patterns = new Map<string, ModelPatternFallback>();
+  const sourceLayers = ['package'];
   let fileCount = 0;
 
   // --- builtin tier ---
@@ -326,12 +339,36 @@ function buildCatalog(): Catalog {
     }
   }
 
+  // --- signed server catalog; package YAML remains available if cache is absent/stale-invalid ---
+  // Keep isolated tests hermetic; an explicit cache path opts a test into the signed-server layer.
+  const serverCatalog = isolatedCatalogTestUniverse() && !process.env.ELANOUS_CATALOG_SERVER_CACHE?.trim()
+    ? null
+    : readVerifiedCatalogCache();
+  if (serverCatalog) {
+    sourceLayers.push('server-cache');
+    for (const raw of serverCatalog.payload.providers) {
+      const provider = parseProvider(raw, 'signed-server-catalog');
+      if (!provider) continue;
+      const base = providers.get(provider.id);
+      providers.set(provider.id, base ? mergeProviders(base, provider) : provider);
+      fileCount++;
+    }
+    for (const raw of serverCatalog.payload.models) {
+      const model = parseModel(raw, 'signed-server-catalog');
+      if (!model) continue;
+      models.set(model.id, model);
+      fileCount++;
+    }
+  }
+
   // --- global tier overlay ---
   const globalProviderDir = join(globalDir, 'providers');
+  let hasUserOverlay = false;
   for (const path of listYamlFiles(globalProviderDir)) {
     const raw = safeReadYaml(path);
     const overlay = parseProvider(raw, path);
     if (!overlay) continue;
+    hasUserOverlay = true;
     fileCount++;
     const base = providers.get(overlay.id);
     providers.set(overlay.id, base ? mergeProviders(base, overlay) : overlay);
@@ -359,6 +396,7 @@ function buildCatalog(): Catalog {
         }
         const model = parseModel(raw, path);
         if (model) {
+          hasUserOverlay = true;
           // global wins on dup id (RFC §6.4 — single-value fields replace).
           models.set(model.id, model);
           fileCount++;
@@ -370,9 +408,14 @@ function buildCatalog(): Catalog {
   // --- discovery fold (대표 2026-09-23 «파생한다») ---
   const folded = foldDiscoveredModels(providers, models, loadFoldSnapshot());
   for (const m of folded) models.set(m.id, m);
+  if (hasUserOverlay) sourceLayers.push('user');
+  if (folded.length > 0) sourceLayers.push('live-discovery');
+  debug.log('registry.catalog', 'catalog.source', {
+    source: 'merged', layers: sourceLayers, ...(serverCatalog ? { stale: serverCatalog.stale } : {}),
+  });
 
   return {
-    catalogVersion: 1,
+    catalogVersion,
     providers,
     models,
     patterns,
@@ -435,6 +478,7 @@ export function foldDiscoveredModels(
 export function getCatalog(): Catalog {
   if (cachedCatalog) return cachedCatalog;
   cachedCatalog = buildCatalog();
+  scheduleServerCatalogRefresh(() => { cachedCatalog = buildCatalog(); });
   return cachedCatalog;
 }
 

package/src/registry/types.ts

@@ -196,8 +196,7 @@ export interface ModelPatternFallback {
 // ── Top-level catalog (loader output) ─────────────────────────────────
 
 export interface Catalog {
-  /** Schema version — bumps when ProviderRegistration / ModelSpec
-   *  shape changes in a non-backwards-compat way. */
+  /** Catalog release version from catalog/meta/catalogVersion.yaml. */
   catalogVersion: number;
   /** Indexed by provider id. */
   providers: Map<string, ProviderRegistration>;

package/src/research/axis-fanout.ts

@@ -1,12 +1,13 @@
 // Research-only native fanout. The caller supplies Bloom's question ladder;
 // each axis gets its own direct tool call and evidence stays attributed to it.
 import type { BloomResearchQuestion, ResearchEvidenceEnvelope } from '../auto-research/question-ladder-contract.js';
-import { getAvailableWebSearchProviders } from '../web-search/index.js';
+import { getAvailableResearchWebSearchProviders } from '../web-search/index.js';
 import type { WebSearchHit, WebSearchProvider } from '../web-search/provider.js';
 import { debug } from '../debug/log.js';
 
-const RESEARCH_SEARCH_ENGINES = ['grok', 'grok-api', 'firecrawl'] as const;
-const RESEARCH_GROK_TIMEOUT_MS = 8_000;
+const RESEARCH_SEARCH_ENGINES = ['exa', 'firecrawl'] as const;
+const RESEARCH_WEB_FALLBACK_IDS = ['exa', 'firecrawl'] as const;
+const RESEARCH_EXA_TIMEOUT_MS = 4_500;
 // Leave scheduler/logging headroom under the user-visible 15s aggregate cap.
 export const RESEARCH_SEARCH_BUDGET_MS = 14_500;
 const ENGINE_BREAKER_FAILURE_LIMIT = 2;
@@ -33,11 +34,16 @@ export interface AxisSearchResult {
   hits: AxisSearchHit[];
   errors: string[];
 }
-export type AxisSearch = (query: string, signal?: AbortSignal) => Promise<AxisSearchHit[] | AxisSearchResult>;
+export interface AxisSearchContext {
+  questionPrompt?: string;
+  requestedWindow?: string;
+}
+export type AxisSearch = (query: string, signal?: AbortSignal, context?: AxisSearchContext) => Promise<AxisSearchHit[] | AxisSearchResult>;
 
 export interface AxisFanoutDeps {
   search?: AxisSearch;
   signal?: AbortSignal;
+  admitToolCall?: (toolName: 'OmniSearch') => boolean;
 }
 
 interface ProviderHealth {
@@ -45,20 +51,16 @@ interface ProviderHealth {
   open: boolean;
 }
 
-/** Build one bounded searcher per research prepass. Free/DDG is deliberately
- * excluded: it is not a safe fallback for stock research and can consume a
- * full 15s timeout for every query. Per-engine serialization lets the first
- * timeout open that engine's breaker before queued Bloom axes start. */
+/** Build one bounded searcher per research prepass. Research uses only the
+ * sequential Exa → Firecrawl fallback; Grok is reserved for explicit X intent.
+ * Per-engine serialization lets a timeout open that engine's
+ * breaker before queued Bloom axes start. */
 export function createResearchAxisSearcher(
-  availableProviders: readonly WebSearchProvider[] = getAvailableWebSearchProviders(),
+  availableProviders: readonly WebSearchProvider[] = getAvailableResearchWebSearchProviders(),
   now: () => number = Date.now,
 ): AxisSearch {
-  const grok = availableProviders.find(provider => provider.id === 'grok')
-    ?? availableProviders.find(provider => provider.id === 'grok-api');
-  const allowed = [
-    ...(grok ? [grok] : []),
-    ...availableProviders.filter(provider => provider.id === 'firecrawl'),
-  ];
+  const webFallback = RESEARCH_WEB_FALLBACK_IDS.flatMap(id => availableProviders.filter(provider => provider.id === id));
+  const allowed = [...webFallback];
   const health = new Map(allowed.map(provider => [provider.id, { failures: 0, open: false }]));
   const deadline = now() + RESEARCH_SEARCH_BUDGET_MS;
   const tails = new Map<string, Promise<void>>();
@@ -81,23 +83,18 @@ export function createResearchAxisSearcher(
   return async (query, signal) => {
     const hits: AxisSearchHit[] = [];
     const errors: string[] = [];
-    const selected = allowed.filter(provider => !health.get(provider.id)?.open);
-    if (selected.length === 0) return { hits, errors: ['no healthy Grok/Firecrawl research provider'] };
-
-    await Promise.all(selected.map(provider => enqueue(provider.id, async () => {
+    const execute = async (provider: WebSearchProvider): Promise<boolean> => enqueue(provider.id, async () => {
       const state = health.get(provider.id)!;
-      if (state.open) return;
+      if (state.open) return false;
       const remainingMs = deadline - now();
       if (remainingMs <= 0) {
         state.open = true;
         errors.push(`${provider.id}: research search budget exhausted`);
-        return;
+        return false;
       }
-      const activeCount = Math.max(1, allowed.filter(candidate => !health.get(candidate.id)?.open).length);
-      const isGrok = provider.id === 'grok' || provider.id === 'grok-api';
-      const timeoutMs = isGrok
-        ? Math.min(RESEARCH_GROK_TIMEOUT_MS, remainingMs)
-        : Math.max(1, Math.floor(remainingMs / activeCount));
+      const timeoutMs = provider.id === 'exa'
+        ? Math.min(RESEARCH_EXA_TIMEOUT_MS, remainingMs)
+        : remainingMs;
       const startedAt = now();
       try {
         const controller = new AbortController();
@@ -131,6 +128,7 @@ export function createResearchAxisSearcher(
           provider: provider.id, queryLength: query.length, hits: result.hits.length,
           durationMs: now() - startedAt, breakerOpen: state.open,
         });
+        return result.hits.length > 0;
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         const timeout = error instanceof Error && /timeout|timed out|abort/i.test(`${error.name} ${error.message}`);
@@ -142,8 +140,16 @@ export function createResearchAxisSearcher(
           provider: provider.id, queryLength: query.length, durationMs: now() - startedAt,
           timeout, quota, failures: state.failures, breakerOpen: state.open,
         }, { level: 'warn' });
+        return false;
       }
-    })));
+    });
+    const runWebFallback = async (): Promise<void> => {
+      for (const provider of webFallback) {
+        if (!health.get(provider.id)?.open && await execute(provider)) return;
+      }
+    };
+    await runWebFallback();
+    if (hits.length === 0 && errors.length === 0) errors.push('no healthy Exa/Firecrawl research provider');
     return { hits, errors };
   };
 }
@@ -195,7 +201,16 @@ export async function fanOutAxisEvidence(
     throw new Error('research axis question IDs must be unique');
   }
   const search = deps.search ?? createResearchAxisSearcher();
-  const settled = await Promise.allSettled(plan.map(call => search(call.query, deps.signal)));
+  const settled = await Promise.allSettled(plan.map(call => {
+    if (deps.admitToolCall && !deps.admitToolCall('OmniSearch')) {
+      return Promise.resolve({ hits: [], errors: ['research tool budget reached'] } satisfies AxisSearchResult);
+    }
+    const question = questions.find(candidate => candidate.id === call.questionId)!;
+    return search(call.query, deps.signal, {
+      questionPrompt: question.prompt,
+      requestedWindow: question.requestedWindow,
+    });
+  }));
   const axes: AxisEvidenceGroup[] = questions.map(question => ({ questionId: question.id, evidence: [] }));
   const groups = new Map(axes.map(axis => [axis.questionId, axis]));
   const byQuestion = new Map(questions.map(question => [question.id, question]));

package/src/self-dev/ask-launch-flow.ts

@@ -29,8 +29,10 @@ import {
   renderConcurrentAuthoringNotice,
   renderLaunchPreflight,
   renderRepeatedBlockNotice,
+  renderSiblingContextLines,
   siblingTestPath,
   type AskPreflightDeps,
+  type SiblingContextCard,
   type LaunchPreflightResult,
   type PriorBlockSample,
   type RecentAuthoringSample,
@@ -245,6 +247,8 @@ export interface AskLaunchFlowInput {
   readonly goalType?: import('../self-implement/goal-author.js').GoalType;
   /** 런 식별자가 이미 있으면 앞단 관측을 그 키로 잇는다. 없으면 관측은 runId 없이 남는다. */
   readonly runId?: string;
+  /** CARD-TARGET-PATHS가 제공한 같은-경로 카드 관측. 발사 판정에는 쓰지 않는다. */
+  readonly cardsTouchingPaths?: readonly SiblingContextCard[];
   /** Explicit harness choice; false is distinct from omission. */
   readonly selfResolveClarifications?: boolean;
 }
@@ -258,6 +262,18 @@ export type AskLaunchFlowResult =
   /** ⑴ 저작에서 접지 예산(AUTHOR-TIMEBOX)을 넘겨 NOT-GROUNDED 로 끝났다 — 발사하지 «않는다». */
   | { readonly kind: 'stopped-by-timebox'; readonly goalFile: string };
 
+/**
+ * A harness entry can be named inside a request whose operative instruction is
+ * explicitly read-only. Require both a read-only marker and a no-write marker;
+ * either alone is too broad (for example, implementing a read-only feature).
+ */
+function isExplicitReadOnlyNoWriteRequest(text: string): boolean {
+  const normalized = text.normalize('NFKC').toLowerCase();
+  const readOnly = /(?:read[\s-]*only|readonly|읽기\s*전용|읽기만|파일\s*존재\s*여부만|상태만\s*확인)/u.test(normalized);
+  const noWrite = /(?:수정하지\s*마|변경하지\s*마|변경\s*금지|파일을?\s*만들지\s*마|쓰지\s*마|편집하지\s*마|no\s+(?:file\s+)?changes?|do\s+not\s+(?:edit|modify|write|create)|don't\s+(?:edit|modify|write|create)|without\s+(?:editing|modifying|writing)|\bcommit\b.{0,24}(?:하지\s*마|금지)|\bpush\b.{0,24}(?:하지\s*마|금지)|\bpr\b.{0,24}(?:하지\s*마|금지))/u.test(normalized);
+  return readOnly && noWrite;
+}
+
 /** ⑴ AUTHOR-TIMEBOX NOT-GROUNDED — 결과 줄을 쓰고 흐름을 끊는 값. */
 export type AskLaunchFlowTimeboxStop = Extract<AskLaunchFlowResult, { kind: 'stopped-by-timebox' }>;
 
@@ -858,9 +874,23 @@ export async function runAskLaunchFlow(
     // ⛔ 이 목록은 «광고»다 — 실제 단계와 어긋나면 조회하는 사람이 없는 단계를 찾거나 있는 단계를 안 찾는다.
     // ⛔ 분해 단계는 «두 이름 중 하나»로 난다 — 켜졌으면 `…-decomposition`, 꺼졌으면 `…-decomposition-skipped`.
     //   ⭐ 뒤엣것을 빼 두면 조회하는 사람이 「분해 관측이 0건이다」를 보고 «없어졌다»로 읽는다(실은 꺼진 것이다).
-    steps: ['ask-start', 'ask-pre-preflight', 'ask-authored', 'ask-launching-tree', 'ask-preflight', 'ask-launch-decomposition', 'ask-launch-decomposition-skipped', 'ask-launch'],
+    steps: ['ask-start', 'ask-readonly-no-launch', 'ask-pre-preflight', 'ask-authored', 'ask-launching-tree', 'ask-preflight', 'ask-launch-decomposition', 'ask-launch-decomposition-skipped', 'ask-launch'],
   }, 'info');
 
+  if (isExplicitReadOnlyNoWriteRequest(input.askText)) {
+    deps.log('ask-readonly-no-launch', {
+      entrance: entrance.id,
+      surface: entrance.surface,
+      inputSource: input.inputSource,
+      runId: input.runId ?? process.env.ELANOUS_RUN_ID ?? null,
+      authoringSkipped: true,
+      launchSkipped: true,
+      completionModeSelected: false,
+    }, 'info');
+    deps.print('[ask] 읽기 전용·변경 금지 요청으로 판정해 구현·자동 병합을 시작하지 않았습니다. TUI 읽기 도구로 결과만 확인하세요.');
+    return { kind: 'stopped-before-authoring' };
+  }
+
   const launchPreflight = await runPrePreflight(input, deps);
   if (launchPreflight === false) return { kind: 'stopped-before-authoring' };
 
@@ -1036,6 +1066,47 @@ export async function runAskLaunchFlow(
     const preflight = decision.result;
     deps.print(renderLaunchPreflight(preflight, input.forceRequested && decision.shouldLaunch && preflight.blockers.length > 0, 'before-launch'));
     observeLaunchPreflight(deps, 'before-launch', decision);
+    let siblingCards = input.cardsTouchingPaths;
+    let siblingCardsUnmeasured = false;
+    if (siblingCards === undefined && preflight.paths.length > 0) {
+      try {
+        // CARD-TARGET-PATHS is a read-only signal: production entrances use the shared task-card store when
+        // no caller supplied a precomputed snapshot. The launch decision never depends on these matches.
+        const taskHand = await import('../task-agent/task-hand.js');
+        const state = taskHand.readTaskAgentState<{ tasks?: Record<string, import('../task-agent/task-hand.js').TaskCard> }>(taskHand.taskAgentStatePath());
+        siblingCards = taskHand.cardsTouchingPaths(Object.values(state.tasks ?? {}), preflight.paths)
+          .map(({ card, runId, paths }) => ({ cardId: card.id, ...(runId ? { runId } : {}), overlapPaths: paths }));
+      } catch (error) {
+        siblingCardsUnmeasured = true;
+        try { debug.log('self-dev.ask', 'sibling-context-cards-unmeasured', { reason: error instanceof Error ? error.message : String(error) }); }
+        catch { /* supplemental card context remains fail-soft */ }
+        siblingCards = [];
+      }
+    }
+    const siblingContextLines = renderSiblingContextLines(preflight, siblingCards);
+    const recentLanded = preflight.warnings.filter((warning) => warning.kind === 'recent-change' && preflight.paths.includes(warning.name)).length;
+    const siblingContextObservation = {
+      liveRuns: preflight.warnings.filter((warning) => warning.kind === 'live-run').length,
+      openPrs: preflight.warnings.filter((warning) => warning.kind === 'open-pr' || warning.kind === 'sibling-pr').length,
+      recentLanded,
+      unmeasured: siblingCardsUnmeasured || preflight.liveRuns.state === 'unknown' || preflight.openPrs.state === 'unknown' || preflight.recentChanges.state === 'unknown' || preflight.unreadableRuns > 0,
+    };
+    try { debug.log('self-dev.ask', 'sibling-context', siblingContextObservation); }
+    catch { /* sibling context observation must not change launch */ }
+    if (!sanitizeFailed && existsSync(goalFile)) {
+      try {
+        const document = deps.readFile(goalFile);
+        const firstSection = document.search(/^## /mu);
+        const header = siblingContextLines.join('\n');
+        const beforeFirstSection = firstSection < 0 ? document : document.slice(0, firstSection).trimEnd();
+        const contextualized = firstSection < 0
+          ? `${header}\n\n${document}`
+          : `${beforeFirstSection ? `${beforeFirstSection}\n` : ''}${header}\n형제가 같은 파일을 고친다 — 국소 변경만 · 무관 포맷 금지 · 자기 의도를 시험으로 고정\n\n${document.slice(firstSection)}`;
+        (deps.writeGoalDocument ?? deps.writeFile)(goalFile, contextualized);
+      } catch (error) {
+        deps.print(`[ask] 형제 맥락 기록 못 남김 (${error instanceof Error ? error.message : String(error)})`);
+      }
+    }
     // ⛔ 자식 격리 worktree를 만들기 전, 이 흐름을 호출한 작업 트리에서만 센다.
     //    이 관측은 발사 판정의 입력이 아니다 — 의도적으로 옛 판에서 쏘는 경우도 있다.
     const invokerBehindDefaultBranch = deps.measureInvokerBehindDefaultBranch?.()

package/src/self-dev/dev-cli.ts

@@ -67,6 +67,7 @@ import { BEDROCK_DEFAULT_MODEL, BEDROCK_MODELS, findBedrockModel, resolveBedrock
 import { ZAI_CODING_DEFAULT_MODEL, ZAI_CODING_MODELS } from '../llm/zai-coding-plan.js';
 import { isVerifiedOpenGatewayModel, OPENGATEWAY_DEFAULT_MODEL, OPENGATEWAY_VERIFIED_MODELS } from '../llm/opengateway-models.js';
 import { DEV_PLAN_REPLACEMENT } from './cli-help-text.js';
+import { DEFAULT_TUI_TEST_READY_TIMEOUT_MS } from '../self-implement/elanous-tui-spawn.js';
 export { DEV_PLAN_REPLACEMENT, formatDevPlanOptionHelp } from './cli-help-text.js';
 
 /** dev CLI 옵션(commander) — `--no-*` 는 false 로 도착. input/executor 는 액션이 빌드해 별도 전달. */
@@ -2187,7 +2188,9 @@ export function buildDevCliSpec(
       ...spec,
       elanous: {
         ...(opts.hold ? { hold: true } : {}),
-        ...(opts.readyTimeoutMs !== undefined ? { readyTimeoutMs: parsePositiveInt(opts.readyTimeoutMs, '--ready-timeout-ms') } : {}),
+        ...(opts.readyTimeoutMs !== undefined
+          ? { readyTimeoutMs: parsePositiveInt(opts.readyTimeoutMs, '--ready-timeout-ms') }
+          : opts.hold ? { readyTimeoutMs: DEFAULT_TUI_TEST_READY_TIMEOUT_MS } : {}),
         ...(opts.json ? { json: true } : {}),
         ...(opts.goal !== undefined ? { goal: opts.goal } : {}),
         ...(opts.maxSteps !== undefined ? { maxSteps: parsePositiveInt(opts.maxSteps, '--max-steps') } : {}),

package/src/self-dev/dev-pipeline.ts

@@ -68,6 +68,8 @@ export interface DevMissionOpts {
   resources?: 'on' | 'off';
   backendExplicit?: string;
   headless?: boolean;
+  /** Optional second user turn resumed in the same Claude/Codex CLI session. */
+  followUp?: string;
   evidence?: EvidenceMode;
   maxRounds?: number;
   commit?: boolean;
@@ -643,6 +645,7 @@ export function toAgentMissionSpec(
     evidence: m.evidence ?? { kind: 'tsc' }, // 기본 tsc(mission 옵션 미지정 시)
     agent: resolveBackend(plan.executor.backend),
     ...(m.headless === true ? { headless: true } : {}),
+    ...(m.followUp !== undefined ? { followUp: m.followUp } : {}),
     ...(m.chain ? { chain: m.chain } : {}),
     ...(m.plugin ? { plugin: m.plugin } : {}),
     ...(m.resources !== undefined ? { resources: m.resources } : {}),
@@ -670,6 +673,7 @@ export function buildAgentMissionDevSpec(o: {
   branch: string;
   base?: string;
   headless?: boolean;
+  followUp?: string;
   chain?: readonly ('codex' | 'claude' | 'elanous')[];
   plugin?: { plugin: string; marketplace: string };
   resources?: 'on' | 'off';
@@ -691,6 +695,7 @@ export function buildAgentMissionDevSpec(o: {
     mission: {
       evidence: o.evidence,
       ...(o.headless === true ? { headless: true } : {}),
+      ...(o.followUp !== undefined ? { followUp: o.followUp } : {}),
       ...(o.chain ? { chain: o.chain } : {}),
       ...(o.plugin ? { plugin: o.plugin } : {}),
       ...(o.resources !== undefined ? { resources: o.resources } : {}),

package/src/self-dev/draft-residue.ts

@@ -3,7 +3,7 @@ import { readdirSync, readFileSync, existsSync } from 'node:fs';
 import { gunzipSync } from 'node:zlib';
 import { basename, dirname, join } from 'node:path';
 import { findGitDir } from '../git-fs/locate.js';
-import { debug } from '../debug/log.js';
+import { debug, redactSecretText } from '../debug/log.js';
 import { PR_LABELS, PR_LABEL_NAMES } from '../github/pr-labels.js';
 import { appendRunLedgerEntry, listRunLedgers, loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
 import { queryRunningRuns } from '../self-implement/running-runs.js';
@@ -161,9 +161,42 @@ const GH_MAX_BUFFER = 64 * 1024 * 1024;
  *  several times larger than this projection, so the listing asks gh to project each page down to these fields. */
 const OPEN_DRAFT_FIELDS = '[.[] | {number, title, headRefName: .head.ref, createdAt: .created_at, body, labels: [.labels[] | {name}], draft}]';
 
+interface GhFailureEvidence {
+  args: readonly string[];
+  status: number | null;
+  signal: NodeJS.Signals | null;
+  errorCode?: string;
+  stderr: string;
+  capturedStderrBytes: number;
+  stdoutBytes: number;
+}
+
+class GhCommandError extends Error {
+  constructor(message: string, readonly evidence: GhFailureEvidence) {
+    super(message);
+    this.name = 'GhCommandError';
+  }
+}
+
+function executionSha(): string | undefined {
+  const sha = process.env.ELANOUS_EXECUTION_SHA?.trim();
+  return sha && /^[a-f0-9]{40}$/i.test(sha) ? sha : undefined;
+}
+
 function gh(args: string[]): string {
-  const result = spawnSync('gh', args, { cwd: findGitDir(process.cwd())?.root ?? process.cwd(), encoding: 'utf8', timeout: 60_000, maxBuffer: GH_MAX_BUFFER });
-  if (result.status !== 0) throw new Error((result.stderr || result.error?.message || `gh exited ${result.status}`).trim().slice(0, 200));
+  const cwd = findGitDir(process.cwd())?.root ?? process.cwd();
+  const result = spawnSync('gh', args, { cwd, encoding: 'utf8', timeout: 60_000, maxBuffer: GH_MAX_BUFFER });
+  if (result.status !== 0) {
+    const spawnError = result.error as NodeJS.ErrnoException | undefined;
+    const stderr = result.stderr ?? '';
+    const reason = (stderr || spawnError?.message || `gh exited ${result.status}`).trim().slice(0, 200);
+    throw new GhCommandError(reason, {
+      args: [...args], status: result.status, signal: result.signal,
+      ...(spawnError?.code ? { errorCode: spawnError.code } : {}),
+      stderr: redactSecretText(stderr).replace(/[\r\n\t\x00-\x1f\x7f]+/g, ' ').slice(0, 4_000), capturedStderrBytes: Buffer.byteLength(stderr),
+      stdoutBytes: Buffer.byteLength(result.stdout ?? ''),
+    });
+  }
   return result.stdout.trim();
 }
 function ghPr(row: { number: number; title: string; headRefName: string; headRefOid?: string; isDraft?: boolean; createdAt: string; body: string; labels: Array<{ name: string }>; comments?: Array<{ body: string }>; state?: string }): ResiduePr {
@@ -233,8 +266,9 @@ export function defaultAdapters(sources: ResidueRunStatusSources = defaultRunSta
     },
     listOpenDrafts: (repository) => {
       const rows: ResiduePr[] = [];
+      let page = 0;
       try {
-        for (let page = 1; page <= 100; page++) {
+        for (page = 1; page <= 100; page++) {
           const result = JSON.parse(gh(['api', `repos/${repository}/pulls?state=open&per_page=100&page=${page}`, '--jq', OPEN_DRAFT_FIELDS])) as Array<{
             number: number; title: string; headRefName: string; createdAt: string; body: string;
             labels: Array<{ name: string }>; draft: boolean;
@@ -246,7 +280,32 @@ export function defaultAdapters(sources: ResidueRunStatusSources = defaultRunSta
         throw new Error('Open PR inventory exceeded pagination limit');
       } catch (error) {
         // «못 셌음»: a failed (or truncated) listing is unmeasurable — it must never surface as a counted zero.
-        debug.log('draft.residue', 'list-open-drafts-unobserved', { repository, reason: error instanceof Error ? error.message : String(error) });
+        const ghEvidence = error instanceof GhCommandError ? error.evidence : undefined;
+        const reason = error instanceof Error ? error.message : String(error);
+        const isEnobufs = ghEvidence?.errorCode === 'ENOBUFS' || /ENOBUFS/.test(reason);
+        const runSha = executionSha();
+        const responseBytes = !ghEvidence
+          ? { status: 'unmeasured', complete: false,
+            reason: /pagination limit/.test(reason) ? 'pagination limit reached; aggregate page response bytes were not retained'
+              : 'the failed inventory response byte count was not retained' }
+          : isEnobufs || ghEvidence.errorCode || ghEvidence.status === null || ghEvidence.signal !== null
+            ? { status: 'unmeasured', capturedBytes: ghEvidence.stdoutBytes, complete: false,
+              reason: isEnobufs ? 'spawnSync ENOBUFS truncates child output before the complete REST response length is known'
+                : ghEvidence.signal ? `child process was terminated by ${ghEvidence.signal}`
+                  : ghEvidence.status === null ? 'child exit status is unavailable, so response completeness is unknown'
+                    : 'the child process ended with an error before response completeness could be established' }
+            : { status: 'measured', bytes: ghEvidence.stdoutBytes, complete: true };
+        debug.log('draft.residue', 'list-open-drafts-unobserved', {
+          repository, reason: redactSecretText(reason), requestedPage: page <= 100 ? page : null,
+          paginationLimitExceeded: page > 100, request: ghEvidence?.args ?? null,
+          exitStatus: ghEvidence?.status ?? null, signal: ghEvidence?.signal ?? null,
+          errorCode: ghEvidence?.errorCode ?? null,
+          stderr: ghEvidence?.stderr ?? null, capturedStderrBytes: ghEvidence?.capturedStderrBytes ?? null,
+          responseBytes,
+          executionSha: runSha ? { status: 'measured', value: runSha } : {
+            status: 'unmeasured', reason: 'ELANOUS_EXECUTION_SHA is absent or invalid for this process invocation',
+          },
+        });
         return undefined;
       }
     },

package/src/self-dev/graph-front-nodes.ts

@@ -220,7 +220,8 @@ export function observeFrontNodeExit(exit: FrontNodeExit, data: FrontNodeExitDat
     const graphRoute: JourneyRoute = { ...route, to: budget.to };
     const taken = data.taken ?? budget.to ?? exit.outcome;
     const reason = [budget.budgetReason, data.reason].filter((part): part is string => part !== undefined).join(' · ');
-    recordJourneyEdge(graphRoute, taken, reason.length > 0 ? reason : undefined);
+    recordJourneyEdge(graphRoute, taken, reason.length > 0 ? reason : undefined,
+      data.runId === undefined ? {} : { runId: data.runId });
     recorded = graphRoute;
     const payload = {
       graphId: 'self-implement',