elanous 0.2.9 → 0.2.11

package/src/cli/pr-cli.ts

@@ -13,11 +13,12 @@ import { runGate as runChangedTypecheckGate } from '../../scripts/ci-typecheck-c
 import { runIsolationHardcodeGate } from '../../scripts/ci-isolation-hardcode-gate.js';
 import { androidFilesIn, runAndroidUnitTestGate } from '../../scripts/ci-android-unit-tests.js';
 import { iosFilesIn, runIosUnitTestGate } from '../../scripts/ci-ios-unit-tests.js';
+import { runPwaBuildGate } from '../../scripts/ci-pwa-build-gate.js';
 import { runMockModuleRestoreGate } from '../../scripts/ci-mock-module-restore-gate.js';
 import { runModelHardcodeGate } from '../../scripts/ci-model-hardcode-gate.js';
 import { runDaemonPortGate } from '../../scripts/ci-daemon-port-gate.js';
 import { runPublicLeakGate } from '../../scripts/ci-public-leak-gate.js';
-import { exportLeakCheck, type ExportLeakCheck } from '../../scripts/ci-public-export-leak-gate.js';
+import { exportLeakCheck, publicExportChangedFiles, type ExportLeakCheck } from '../../scripts/ci-public-export-leak-gate.js';
 import { checkCommands, extractElanousCommands, type Finding as DocsCliFinding } from '../../scripts/docs-cli-check.js';
 import { runTestInterferenceGate } from '../../scripts/ci-test-interference-gate.js';
 import { isGoalDocumentFileName } from '../self-implement/goal-document.js';
@@ -51,6 +52,7 @@ import {
   unionPaths,
 } from './pr-granularity.js';
 import { branchLineageSlug, findSiblingPrs } from './pr-lineage.js';
+import { parseReleaseNoteSection } from '../release-loop/release-note.js';
 
 export { branchLineageSlug, findSiblingPrs };
 
@@ -102,7 +104,7 @@ export interface PrLandDeps {
   runMockModuleRestoreGate?: (out: { log: (message: string) => void; error: (message: string) => void }) => boolean;
   runModelHardcodeGate?: (out: { log: (message: string) => void; error: (message: string) => void }) => boolean;
   runDaemonPortGate?: (out: { log: (message: string) => void; error: (message: string) => void }) => boolean;
-  /** 공개 유출 래칫(경고 전용) — 반환 0 통과 · 1 늘었다 · 2 못 쟀다. */
+  /** 공개 유출 래칫(경고 전용) — 반환 0 동일 · 1 늘었다 · 2 못 쟀다 · 3 줄었다. */
   runPublicLeakGate?: (changedFiles: readonly string[], out: { log: (message: string) => void; error: (message: string) => void }) => number;
   /** Test seam — the post-transform export leak check on changed files. */
   runExportLeakCheck?: (changedFiles: readonly string[], cwd: string) => ExportLeakCheck;
@@ -114,6 +116,7 @@ export interface PrLandDeps {
   runAndroidGate?: (out: { log: (message: string) => void; error: (message: string) => void }, changedFiles: readonly string[]) => boolean;
   /** iOS 시험 게이트 심(시험 주입용). */
   runIosGate?: (out: { log: (message: string) => void; error: (message: string) => void }, changedFiles: readonly string[]) => boolean;
+  runPwaGate?: (out: { log: (message: string) => void; error: (message: string) => void }, changedFiles: readonly string[]) => boolean;
   isInteractive?: () => boolean;
   /** Clock for the recent-landings window (test seam · default Date.now). */
   now?: () => number;
@@ -272,8 +275,10 @@ export function runPrLandIsolationGate(
 
 /** ⭐ 2026-09-24 — 공개 유출 래칫은 «경고만» 낸다(착지를 막지 않는다 · 막는 것은 공개 결정 뒤 · 채널 합의).
  *  계기: 기준선 뒤 3시간 만에 🅢 착지분에서 유출 증가 다섯을 이 게이트가 잡았다 — 착지 순간에 보여야 그 자리에서 고친다. */
-function runPrLandPublicLeakGate(changedFiles: readonly string[], out: { log: (message: string) => void; error: (message: string) => void }): number {
-  return runPublicLeakGate({ args: ['--changed-files', ...changedFiles], log: out.log, error: out.log });
+function runPrLandPublicLeakGate(changedFiles: readonly string[], out: { log: (message: string) => void; error: (message: string) => void }, cwd: string, baselineRef: string): number {
+  const top = runGitCommand(cwd, ['rev-parse', '--show-toplevel'], { encoding: 'utf-8' });
+  if (top.status !== 0 || !String(top.stdout ?? '').trim()) return 2;
+  return runPublicLeakGate({ args: ['--changed-files', ...changedFiles], root: String(top.stdout).trim(), baselineRef, log: out.log, error: out.log });
 }
 
 /** The prepare check on this landing's changed files — scripts/ci-public-export-leak-gate.ts. */
@@ -282,23 +287,49 @@ export function runPrLandExportLeakCheck(changedFiles: readonly string[], cwd: s
   return exportLeakCheck(changedFiles, top.status === 0 && String(top.stdout ?? '').trim() ? String(top.stdout).trim() : cwd);
 }
 
-/** Blocks the landing when changed files would leak into the public export, unless allowPublicLeak. Returns false to stop. */
+/** Blocks changed public files that leak or cannot be measured. */
 export function exportLeakBlock(
   changedFiles: readonly string[] | undefined,
   check: () => ExportLeakCheck,
   allow: boolean,
   out: { log: (message: string) => void; error: (message: string) => void },
+  cwd: string = process.cwd(),
 ): boolean {
   if (!changedFiles || changedFiles.length === 0) return true;
   let result: ExportLeakCheck;
-  try { result = check(); } catch (error) { result = { measured: false, hits: [], detail: error instanceof Error ? error.message : String(error) }; }
-  record('public-export-leak', result.measured ? result.hits.length === 0 || allow : true, { measured: result.measured, hits: result.hits.length, allowed: allow && result.hits.length > 0 });
-  if (!result.measured) { out.log(`⚠ public-export-leak: 못 쟀다(${result.detail ?? '?'}) — 착지는 막지 않는다. 확인: bun scripts/public-export.ts --leak-check --files <파일…>`); return true; }
-  if (result.hits.length === 0) { out.log('✓ public-export-leak: 바뀐 파일이 공개본에 사적 흔적을 싣지 않는다(prepare 와 같은 변환 뒤).'); return true; }
+  try { result = check(); } catch { result = { measured: false, hits: [], detail: '검사 실행 실패' }; }
+  let publicFiles: string[] = [];
+  if (!result.measured) {
+    try { publicFiles = publicExportChangedFiles(changedFiles, cwd); }
+    catch { publicFiles = [...changedFiles]; } // A missing/invalid manifest cannot prove these files are private.
+  }
+  const applicable = result.hits.filter((hit) => hit.marker !== 'skill-boundary' || changedFiles.includes(hit.file));
+  const missingReason: ExportLeakCheck['hits'][number][] = [];
+  const blockedHits: ExportLeakCheck['hits'][number][] = [];
+  let allowed = 0;
+  for (const hit of applicable) {
+    let lines: string[];
+    try { lines = readFileSync(join(cwd, hit.file), 'utf8').split(/\r?\n/); }
+    catch { blockedHits.push(hit); continue; }
+    const notes = [lines[hit.line - 1], lines[hit.line - 2]].filter((line): line is string => line !== undefined)
+      .map((line) => /(?:\/\/|\/\*|\*|#|<!--)\s*public-export-allow:\s*(.*)/u.exec(line));
+    if (notes.some((note) => note?.[1]?.replace(/(?:\*\/|-->)\s*$/u, '').trim())) { allowed++; continue; }
+    blockedHits.push(hit);
+    if (notes.some(Boolean)) missingReason.push(hit);
+  }
+  const blocked = (!result.measured && publicFiles.length > 0) || (blockedHits.length > 0 && !allow);
+  record('public-export-leak', !blocked, { measured: result.measured, hits: applicable.length, allowed });
+  debug.log('pr.land', 'leak-gate', { blocked, hits: applicable.map(({ file, marker }) => ({ file, marker })), measured: result.measured, allowed });
+  if (!result.measured) {
+    const write = blocked ? out.error : out.log;
+    write(`${blocked ? '✗' : '⚠'} public-export-leak: 못 쟀다${blocked ? ' — 막는다' : ' — 공개 대상 변경 없음'}(${result.detail ?? '?'}) · 확인: bun scripts/public-export.ts --leak-check --json --all --files <파일…>`);
+    return !blocked;
+  }
+  if (blockedHits.length === 0) { out.log('✓ public-export-leak: 바뀐 파일이 공개본에 사적 흔적을 싣지 않는다(prepare 와 같은 변환 뒤).'); return true; }
   const write = allow ? out.log : out.error;
-  write(`${allow ? '⚠' : '✗'} public-export-leak: 바뀐 파일 ${result.hits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`);
-  for (const h of result.hits.slice(0, 20)) write(`   ${h.file}:${h.line}  ${h.marker}`);
-  if (result.hits.length > 20) write(`   … 외 ${result.hits.length - 20}곳`);
+  write(`${allow ? '⚠' : '✗'} public-export-leak: 바뀐 파일 ${blockedHits.length}곳이 공개본에 사적 흔적을 싣는다 — 다음 release prepare 가 여기서 실패한다:`);
+  for (const hit of blockedHits.slice(0, 20)) write(`   ${hit.file}:${hit.line} · ${hit.marker}${missingReason.includes(hit) ? ' · 사유 없음' : ''}`);
+  if (blockedHits.length > 20) write(`   … 외 ${blockedHits.length - 20}곳`);
   write('   확인: bun scripts/public-export.ts --leak-check --all --files <파일…>');
   if (allow) { out.log('   --allow-public-leak 로 넘긴다(이유는 --land-reason).'); return true; }
   out.error('   고치거나, 공개본과 무관한 것이 확실하면 --allow-public-leak --land-reason "<이유>" 로 넘긴다.');
@@ -319,8 +350,12 @@ export function publicLeakWarning(
     record('public-leak-gate', true, { warnOnly: true, measured: false });
     return;
   }
-  record('public-leak-gate', true, { warnOnly: true, measured: rc !== 2, grew: rc === 1 });
+  record('public-leak-gate', true, { warnOnly: true, measured: rc !== 2, grew: rc === 1, shrank: rc === 3 });
   if (rc === 0) { out.log('✓ public-leak-gate(경고 전용): 공개 유출이 늘지 않았다.'); return; }
+  if (rc === 3) {
+    for (const line of captured.filter((l) => /→/.test(l))) out.log(`✓ public-leak-gate(경고 전용): 공개 유출이 줄었다 · 기준선 --update 권장 — ${line.trim()}`);
+    return;
+  }
   if (rc === 1) {
     out.log('⚠ public-leak-gate(경고 전용 · 착지는 막지 않는다): 공개 유출이 늘었다 —');
     for (const line of captured.filter((l) => /→/.test(l))) out.log(`   ${line.trim()}`);
@@ -406,13 +441,14 @@ function gateVerdict(
   label: string,
   gate: (out: { log: (message: string) => void; error: (message: string) => void }) => boolean,
   out: { log: (message: string) => void; error: (message: string) => void },
+  failClosed = false,
 ): { ok: boolean; measured: boolean } {
   try {
     return { ok: gate(out), measured: true };
   } catch (error) {
     out.error(`⚠ ${label}: 게이트가 «못 쟀다» — ${error instanceof Error ? error.message : String(error)}`);
-    out.error(`⚠ ${label}: 「위반 없음」이 아니라 「검사 못 함」이다. 이 착지는 통과시키되 게이트를 고쳐라.`);
-    return { ok: true, measured: false };
+    out.error(`⚠ ${label}: 「위반 없음」이 아니라 「검사 못 함」이다. ${failClosed ? '착지를 막는다.' : '이 착지는 통과시키되 게이트를 고쳐라.'}`);
+    return { ok: !failClosed, measured: false };
   }
 }
 
@@ -426,6 +462,21 @@ function record(step: string, ok: boolean, extra: Record<string, unknown> = {}):
   debug.log('pr.land', 'step', { step, ok, ...extra });
 }
 
+export function nextMdWarning(body: string, changedFiles: readonly string[], out: { log: (message: string) => void }): void {
+  const section = body.split(/^## 릴리스 노트[ \t]*\r?$/m).at(-1)!;
+  const parsed = parseReleaseNoteSection(body);
+  const hasNote = parsed.fragment !== undefined || parsed.problems.length > 0;
+  const kind = parsed.fragment?.kind ?? (hasNote
+    ? /^[ \t]*- 종류:[ \t]*(feat|fix|security|internal)[ \t]*\r?$/m.exec(section.split(/^#{1,6}[ \t]+/m)[0]!)?.[1]
+    : undefined);
+  const reason = hasNote
+    ? (kind === 'feat' || kind === 'fix' || kind === 'security' ? `release-note:${kind}` : undefined)
+    : (changedFiles.some((file) => /^(?:apps\/pwa\/src\/|src\/cli\/|src\/dashboard\/)/.test(file)) ? 'user-facing-path' : undefined);
+  const warn = !!reason && !changedFiles.includes('release/next.md');
+  record('next-md', true, { warnOnly: true, reason: reason ?? (hasNote ? 'non-user-facing-note' : 'no-user-facing-path') });
+  if (warn) out.log('⚠ next-md: 사용자에게 보이는 변경인데 release/next.md 에 줄이 없습니다 — 공개 노트에서 빠집니다. 「- <kind> — <영어 한 문장>. Documentation: … Target: next.」 한 줄을 더하십시오.');
+}
+
 type PrRemoteCapability = 'github' | 'local-path' | 'no-remote' | 'other';
 
 function isLocalRemote(raw: string): boolean {
@@ -1012,6 +1063,10 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     out.error('✗ body: --body와 --body-file은 함께 사용할 수 없습니다.');
     return 1;
   }
+  if (opts.allowPublicLeak && !opts.landReason?.trim()) {
+    out.error('✗ public-export-leak: --allow-public-leak 에는 --land-reason "<이유>" 가 필요합니다.');
+    return 1;
+  }
   if (opts.includeActiveRunFiles && opts.excludeActiveRunFiles) {
     out.error('✗ active-run-files: --include-active-run-files와 --exclude-active-run-files는 함께 사용할 수 없습니다.');
     return 1;
@@ -1323,8 +1378,9 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
   }
 
   const changedPaths = currentChangePaths(run, cwd, staged, base, out);
-  publicLeakWarning(changedPaths, deps.runPublicLeakGate ?? runPrLandPublicLeakGate, out);
-  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out)) return 1;
+  nextMdWarning(body ?? '', changedPaths, out);
+  publicLeakWarning(changedPaths, deps.runPublicLeakGate ?? ((files, sink) => runPrLandPublicLeakGate(files, sink, cwd, base)), out);
+  if (!exportLeakBlock(changedPaths, () => (deps.runExportLeakCheck ?? runPrLandExportLeakCheck)(changedPaths ?? [], cwd), opts.allowPublicLeak === true, out, cwd)) return 1;
   if (publicDocPaths(changedPaths, () => true).length > 0) {
     const top = run('git', ['rev-parse', '--show-toplevel'], { cwd });
     const docsRoot = top.ok && top.out.trim() ? top.out.trim() : cwd;
@@ -1371,6 +1427,15 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
     out.log('✓ ios-gate: scripts/ci-ios-unit-tests.ts PASS — iOS 순수-로직 시험이 «실제로 돌았고» 실패 0.');
   }
 
+  // PWA 는 bun test/tsc 밖의 정적 번들이다. 측정 불가도 착지 불가로 판정한다.
+  const pwaGate = gateVerdict('pwa-gate', deps.runPwaGate
+    ? (o) => deps.runPwaGate!(o, changedPaths)
+    : (o) => runPwaBuildGate({ args: ['--changed-files', ...changedPaths], cwd, log: o.log, error: o.error }) === 0, out, true);
+  record('pwa-gate', pwaGate.ok && pwaGate.measured, { measured: pwaGate.measured });
+  if (!pwaGate.ok || !pwaGate.measured) {
+    out.error('✗ pwa-gate: scripts/ci-pwa-build-gate.ts blocked pr land — PWA 빌드 실패 또는 측정 불가.');
+    return 1;
+  }
 
   const overlapFound = emitLandingOverlapAdvisory(run, cwd, base, changedPaths, out);
   const siblingFound = emitSiblingPrAdvisory(

package/src/cli/pty-drive-cli.ts

@@ -8,6 +8,7 @@ import type { StreamLLMFn } from '../autopilot/llm-control-brain.js';
 import { establishElanousTuiIsolation, elanousTuiSpawnOptions, type ElanousTuiIsolation } from '../self-implement/elanous-tui-spawn.js';
 import { resolveObserveOnlyDecision } from '../self-implement/observe-only.js';
 import { getUserConfig } from '../user-config.js';
+import { verdictForFinalPtyScreen } from './pty-drive-verdict.js';
 import { debug } from '../debug/log.js';
 import { writeHarnessScreen } from '../harness/harness-screen.js';
 import { resolveControlInboxDir } from '../harness/control-inbox.js';
@@ -19,6 +20,7 @@ import { resolvePtyRef } from '../pty-shell/pty-ref.js';
 import { parsePtyWriteActor } from '../pty-shell/pty-write-arbiter.js';
 import { controlDepsForHandle, controlDepsForRemoteRef, runPtyControlLoop } from '../autopilot/pty-control-loop.js';
 import { createLlmControlBrain } from '../autopilot/llm-control-brain.js';
+import { withDriveJail } from './drive-input-jail.js';
 
 /** `pty list` 한 줄의 상태 컬럼 위치 — `<id>\t<kind>\t<nickname>\t<scope>\t<state>\t<extra…>`.
  *  ⚠️⛔ **회귀 테스트의 fixture 는 실측 형식의 *스냅샷*이지 형식 변경 감지기가 아니다**(리뷰 지적 · 과장 정정) —
@@ -166,6 +168,8 @@ export interface PtyDriveOpts {
   readonly maxSteps?: number;
   readonly pollMs?: number;
   readonly model?: string;
+  /** DRIVE-JAIL: brain inputs naming paths outside this directory are not sent to the PTY. */
+  readonly jailHome?: string;
   /** Enable the child SelfImplement observation-only override at boot. */
   readonly observeOnly?: boolean;
   readonly cwd?: string;
@@ -213,6 +217,8 @@ const liveAttachDriveDeps: PtyAttachDriveDeps = {
 
 export interface PtyAttachDriveOpts {
   readonly goal: string;
+  /** DRIVE-JAIL: brain inputs naming paths outside this directory are not sent to the PTY. */
+  readonly jailHome?: string;
   readonly maxSteps?: number;
   readonly pollMs?: number;
   readonly model?: string;
@@ -250,8 +256,11 @@ export async function runPtyAttachDrive(ref: string, opts: PtyAttachDriveOpts, d
     ...(opts.stream ? { stream: opts.stream } : {}),
     onDecision: (decision) => out(decision.action === 'input' ? `  → input (${decision.text.length} chars)\n` : decision.action === 'done' ? `  → done (${decision.reason})\n` : '  · wait\n'),
   });
+  const controlDeps = withDriveJail(handle ? deps.controlDepsForHandle(handle) : deps.controlDepsForRemoteRef?.(id, { actor }) ?? (() => { throw new Error('pty auto: remote control dependencies unavailable'); })(), opts.jailHome, (event, data) => deps.log(event, data));
+  const inputHistory: string[] = [];
   const result = await deps.runControlLoop(brain, {
-    ...(handle ? deps.controlDepsForHandle(handle) : deps.controlDepsForRemoteRef?.(id, { actor }) ?? (() => { throw new Error('pty auto: remote control dependencies unavailable'); })()),
+    ...controlDeps,
+    inject: (text: string) => { inputHistory.push(text); return controlDeps.inject(text); },
     subjectPtyId: id,
     canReceiveInput: true,
   }, {
@@ -260,7 +269,14 @@ export async function runPtyAttachDrive(ref: string, opts: PtyAttachDriveOpts, d
   });
   deps.log('attach-finish', { id, termination: result.termination.kind, steps: result.steps });
   out(`\n▸ ${result.termination.kind} (${result.steps} steps)\n`);
-  return { exitCode: result.termination.kind === 'success' ? 0 : 1, message: `pty auto: ${id} ${result.termination.kind}` };
+  if (result.termination.kind !== 'success') return { exitCode: 1, message: `pty auto: ${id} ${result.termination.kind}` };
+  // DRIVE-OK: «done» from the brain still has to show on the final screen.
+  let screen = '';
+  try { screen = String(await controlDeps.observe()); } catch { /* unreadable → unverified */ }
+  const verdict = verdictForFinalPtyScreen({ screen, inputHistory, exitCode: null });
+  out(`▸ verdict: ${verdict.kind} — ${verdict.reason}\n`);
+  deps.log('attach-verdict', { id, kind: verdict.kind, reason: verdict.reason.slice(0, 200) });
+  return { exitCode: verdict.kind === 'success' ? 0 : 1, message: `pty auto: ${id} ${verdict.kind}` };
 }
 
 export type PtyAttachDriveRunner = (start: () => Promise<{ readonly exitCode: number; readonly message: string }>) => Promise<void>;
@@ -273,14 +289,15 @@ export function registerPtyAttachDriveCommand(pty: Command, run: PtyAttachDriveR
     .option('--poll-ms <ms>', 'screen polling interval in milliseconds', '800')
     .option('--model <model>', 'LLM model override')
     .option('--actor <who>', 'remote input actor (human or agent)', 'human')
+    .option('--jail-home <dir>', 'DRIVE-JAIL: do not send inputs naming paths outside this directory')
     .description('Drive an existing agent-owned PTY without spawning a terminal')
-    .action((ref: string, opts: { goal: string; maxSteps: string; pollMs: string; model?: string; actor?: string }) => run(async () => {
+    .action((ref: string, opts: { goal: string; maxSteps: string; pollMs: string; model?: string; actor?: string; jailHome?: string }) => run(async () => {
       const maxSteps = Number(opts.maxSteps);
       const pollMs = Number(opts.pollMs);
       const actor = parsePtyWriteActor(opts.actor);
       if (!actor) return { exitCode: 2, message: 'pty auto: --actor must be human or agent' };
       return Number.isInteger(maxSteps) && maxSteps >= 1 && Number.isInteger(pollMs) && pollMs >= 0
-        ? runPtyAttachDrive(ref, { goal: opts.goal, maxSteps, pollMs, actor, ...(opts.model ? { model: opts.model } : {}) }, deps)
+        ? runPtyAttachDrive(ref, { goal: opts.goal, maxSteps, pollMs, actor, ...(opts.model ? { model: opts.model } : {}), ...(opts.jailHome ? { jailHome: opts.jailHome } : {}) }, deps)
         : { exitCode: 2, message: 'pty auto: --max-steps must be an integer >= 1 and --poll-ms must be an integer >= 0' };
     }));
 }
@@ -299,6 +316,8 @@ export interface DriveCliOpts {
   json?: boolean;
   /** Existing PTY ref. Absent = spawn a new shell PTY (the default). */
   attach?: string;
+  /** DRIVE-JAIL boundary directory. */
+  jailHome?: string;
 }
 
 export interface DriveCliDeps {
@@ -357,6 +376,7 @@ export async function runDriveCliCommand(command: string | undefined, opts: Driv
       attached = await runAttach(attach, {
         goal: opts.goal, maxSteps, pollMs,
         ...(opts.model ? { model: opts.model } : {}),
+        ...(opts.jailHome ? { jailHome: opts.jailHome } : {}),
       });
     } catch (err) {
       writeError(`drive: ${err instanceof Error ? err.message : String(err)}\n`);
@@ -379,6 +399,7 @@ export async function runDriveCliCommand(command: string | undefined, opts: Driv
       command, goal: opts.goal, maxSteps, pollMs,
       ...(opts.model ? { model: opts.model } : {}),
       ...(opts.cwd ? { cwd: opts.cwd } : {}),
+      ...(opts.jailHome ? { jailHome: opts.jailHome } : {}),
     }));
   } catch (err) {
     writeError(`drive: ${err instanceof Error ? err.message : String(err)}\n`);
@@ -827,7 +848,10 @@ async function runPtyDriveInner(opts: PtyDriveOpts): Promise<{ exitCode: number
       writeScreen(screenKey, await h!.renderScreen(), process.env);
       delivered = true;
     } : undefined;
-    const deps = controlDepsForHandle(h);
+    const rawDeps = withDriveJail(controlDepsForHandle(h), opts.jailHome, (event, data) => debug.log('pty.drive', event, data));
+    // DRIVE-OK: keep what we typed so the final verdict can tell child output from echoed input.
+    const inputHistory: string[] = [];
+    const deps = { ...rawDeps, inject: (text: string) => { inputHistory.push(text); return rawDeps.inject(text); } };
     const autoAssist = opts.elanous ? getUserConfig().tools.selfImplement.autoAssist : undefined;
     const observe = opts.elanous ? async () => {
       const frame = await deps.observe();
@@ -851,12 +875,22 @@ async function runPtyDriveInner(opts: PtyDriveOpts): Promise<{ exitCode: number
     if (screen.trim()) out(`▸ 최종 화면:\n${screen}\n`);
     const childExit = h.exitCode;
     const alive = h.isAlive();
-    const exitCode = childExit !== null
+    // DRIVE-OK (10-03 X1: every step failed yet drive said ok): the brain's «done» is not proof —
+    // judge the final screen. Plain drives take the verdict as the exit; elanous-TUI drives only observe it.
+    const verdict = result.termination.kind === 'success' ? verdictForFinalPtyScreen({ screen, inputHistory, exitCode: childExit }) : null;
+    if (verdict) {
+      out(`▸ verdict: ${verdict.kind} — ${verdict.reason}\n`);
+      debug.log('pty.drive', 'verdict', { kind: verdict.kind, reason: verdict.reason.slice(0, 200), enforced: !opts.elanous });
+    }
+    const verdictFails = !!verdict && !opts.elanous && verdict.kind !== 'success';
+    const baseExit = childExit !== null
       ? childExit
       : alive
         ? result.termination.kind === 'success' ? 0 : 1
         : null;
-    debug.log('pty.drive', 'exit-resolve', { alive, childExit, exitCode, termination: result.termination.kind });
+    // The verdict only withholds a success: nonzero and unknown (null) exits keep their meaning.
+    const exitCode = baseExit === 0 && verdictFails ? 1 : baseExit;
+    debug.log('pty.drive', 'exit-resolve', { alive, childExit, exitCode, termination: result.termination.kind, ...(verdict ? { verdict: verdict.kind } : {}) });
     if (exitCode === null) out('▸ child exited without an exit code; reporting failure at the process boundary (exit 1)\n');
     return { exitCode };
   } finally {

package/src/cli/pty-drive-verdict.ts

@@ -0,0 +1,40 @@
+// Final-screen evidence is independent of the controller's "done" declaration.
+export type PtyDriveVerdict =
+  | { readonly kind: 'done-but-failed'; readonly reason: string; readonly evidence: null }
+  | { readonly kind: 'success'; readonly reason: string; readonly evidence: string }
+  | { readonly kind: 'success-unverified'; readonly reason: string; readonly evidence: null };
+
+export interface FinalPtyEvidence {
+  readonly screen: string;
+  readonly inputHistory: readonly string[];
+  readonly exitCode: number | null;
+}
+
+// eslint-disable-next-line no-control-regex
+const ANSI = /\x1b(?:\][^\x07\x1b]*(?:\x07|\x1b\\)|\[[0-?]*[ -/]*[@-~]|[@-Z\\-_])/g;
+const FAILURE = /(?:\bcommand not found\b|\bnot recognized as (?:an internal or external )?command\b|\bno such file or directory\b|\b(?:error|fatal|exception)\s*:|\berror TS\d+\b|\b(?:build failed|tests? failed|test suite failed|failed to|compilation failed|permission denied)\b|(?:^|\s)[1-9]\d*\s+fail(?:ed|ing|ures?)?\b|\b(?:exit(?:ed)? (?:with )?(?:code |status )?)[1-9]\d*\b|\bnpm ERR!\b|^\s*(?:FAIL\b|✗|❌))/i;
+const SUCCESS = /(?:\b[1-9]\d*\s+(?:pass|passed)\b|\btests?:\s*[1-9]\d*\s+passed\b|\bbuild successful\b|\b(?:successfully|succeeded)\b|\bGOAL-COMPLETE\b)/i;
+
+/** Failure wins over success; an exit code of zero is not itself proof of the goal. */
+export function verdictForFinalPtyScreen({ screen, inputHistory, exitCode }: FinalPtyEvidence): PtyDriveVerdict {
+  if (exitCode !== null && exitCode !== 0) {
+    return { kind: 'done-but-failed', reason: `child exit code ${exitCode}`, evidence: null };
+  }
+  // The PTY may echo commands (including fabricated success markers). Only child output is evidence.
+  const inputs = new Set(inputHistory.flatMap((input) => input.replace(/\r/g, '\n').split('\n').map((line) => line.trim()).filter(Boolean)));
+  // An echo/printf command prints its operand; that output is not independent proof of anything
+  // (`echo "7 pass"` must not count as passing tests — review round 2).
+  const echoedLiterals = new Set([...inputs].flatMap((input) => {
+    const match = /^(?:echo(?:\s+-[neE]+)?|printf)\s+(.+)$/i.exec(input);
+    if (!match) return [];
+    const operand = match[1]!.trim().replace(/^(['"])(.*)\1$/s, '$2').replace(/\\n$/, '').trim();
+    return operand ? [operand] : [];
+  }));
+  const lines = screen.replace(ANSI, '').replace(/\r/g, '\n').split('\n')
+    .map((line) => line.trim()).filter((line) => line && !inputs.has(line) && !echoedLiterals.has(line) && ![...inputs].some((input) => line.endsWith(`$ ${input}`) || line.endsWith(`> ${input}`)));
+  const failure = lines.find((line) => FAILURE.test(line));
+  if (failure) return { kind: 'done-but-failed', reason: failure, evidence: null };
+  const evidence = lines.find((line) => SUCCESS.test(line) && !/\b0\s+(?:pass|passed)\b/i.test(line));
+  if (evidence) return { kind: 'success', reason: 'final PTY screen has success evidence', evidence };
+  return { kind: 'success-unverified', reason: 'final PTY screen has no success evidence', evidence: null };
+}

package/src/cli/pwa-stop.ts

@@ -23,6 +23,12 @@ import { probeTailscale, type TailscaleProbe } from '../nexus/onboarding/tailsca
 import { unregisterPwaInstance } from './pwa-registry.js';
 import { readNexusLock } from '../nexus/supervisor/lock.js';
 import { resolveNexusPwa, type NexusPwaResolution } from './nexus-show.js';
+import { debug } from '../debug/log.js';
+import { isPidAlive } from '../process/pid-liveness.js';
+import { execFileSync } from 'node:child_process';
+import { join as joinPath, resolve as resolvePath } from 'node:path';
+import { hostname } from 'node:os';
+import { safeReadLock } from '../telegram-lock.js';
 
 export interface PwaStopOpts {
   out?: { log: (s: string) => void; error: (s: string) => void };
@@ -45,7 +51,19 @@ export interface PwaStopOpts {
    *  from `~/.elanous/pwa-registry.json`. */
   unregisterFn?: (pid: number) => void;
   /** P4 — read the nexus lock to recover daemon pid. Test seam. */
-  readLockFn?: () => { pid: number } | null;
+  readLockFn?: () => { pid: number; host?: string; startedAt?: string } | null;
+  /** Isolated test daemon stop only: the project-local root to inspect for orphans. */
+  isolatedRoot?: string;
+  /** Test seams for signals, liveness and bounded polling. */
+  signalFn?: (pid: number, signal: 'SIGINT' | 'SIGTERM') => void;
+  pidAliveFn?: (pid: number) => boolean;
+  sleepFn?: (ms: number) => Promise<void>;
+  stopTimeoutMs?: number;
+  nowFn?: () => number;
+  /** Process table for isolated daemon identity checks and orphan discovery (pid, start time, argv). */
+  processTableFn?: () => Array<{ pid: number; startedAt: string; args: string }>;
+  /** Test seam for the raw `ps -eo pid=,lstart=,args=` response. */
+  psOutputFn?: () => string;
 }
 
 export type PwaStopShareUnmount =
@@ -57,7 +75,7 @@ export interface PwaStopResult {
   exitCode: number;
   /** True when the dev BG was actually killed (vs no-lock no-op). */
   devKilled: boolean;
-  /** True when the nexus stop signal was sent. */
+  /** True when the daemon stop completed (or the ordinary stop trigger succeeded). */
   nexusStopped: boolean;
   /** True when `tailscale serve reset` was issued (not skipped). */
   shareReset: boolean;
@@ -73,6 +91,126 @@ async function defaultNexusStop(): Promise<{ exitCode: number }> {
   return { exitCode: 0 };
 }
 
+function runningProcesses(output: string): Array<{ pid: number; startedAt: string; args: string }> {
+  const lines = output.split('\n');
+  return lines.flatMap(line => {
+    const match = line.match(/^\s*(\d+)\s+((?:\S+\s+){4}\d{4})\s+(.+)$/);
+    return match ? [{ pid: Number(match[1]), startedAt: match[2]!, args: match[3]! }] : [];
+  });
+}
+
+type ProcessRow = ReturnType<typeof runningProcesses>[number];
+
+function isolatedDaemons(root: string, table: ProcessRow[]): ProcessRow[] {
+  return table.filter(row => {
+    if (!/^(?:(?:\S*\/)?(?:bun|node)\s+)?(?:\S*\/)?elanous(?:\.(?:mjs|cjs))?\s/.test(row.args)
+        || !/(?:^|\s)nexus\s+run(?:\s|$)/.test(row.args)) return false;
+    const roots = ['--config-dir', '--test-state-dir'].flatMap(flag => {
+      const value = row.args.match(new RegExp(`(?:^|\\s)${flag}(?:=|\\s+)(?:"([^"]+)"|'([^']+)'|(\\S+))`));
+      const arg = value?.[1] ?? value?.[2] ?? value?.[3];
+      return arg === undefined ? [] : [resolvePath(arg)];
+    });
+    return roots.length > 0 && roots.every(value => value === resolvePath(root));
+  });
+}
+
+async function stopIsolatedNexus(
+  opts: PwaStopOpts,
+  out: NonNullable<PwaStopOpts['out']>,
+  lock: ReturnType<NonNullable<PwaStopOpts['readLockFn']>>,
+): Promise<{ exitCode: number }> {
+  const root = opts.isolatedRoot!;
+  const inspect = (): ProcessRow[] => isolatedDaemons(root, opts.processTableFn
+    ? opts.processTableFn()
+    : runningProcesses((opts.psOutputFn ?? (() => execFileSync('ps', ['-eo', 'pid=,lstart=,args='], { encoding: 'utf8' })))()));
+  const reportOrphans = (): { exitCode: number } => {
+    const orphans = inspect();
+    debug.log('nexus.stop', 'orphans', { pid: 0, waitedMs: 0, count: orphans.length });
+    if (orphans.length === 0) {
+      out.log('  nothing to stop (no lock)');
+      return { exitCode: 0 };
+    }
+    for (const row of orphans) out.error(`  orphan pid ${row.pid} · started ${row.startedAt} · root ${root}`);
+    out.error(`  cleanup: ${orphans.map(row => `kill ${row.pid}`).join(' ; ')}`);
+    return { exitCode: 1 };
+  };
+  if (!lock) {
+    try { return reportOrphans(); }
+    catch (error) {
+      out.error(`  cannot inspect nexus processes: ${error instanceof Error ? error.message : String(error)}`);
+      return { exitCode: 1 };
+    }
+  }
+  const pid = lock.pid;
+  if (lock.host && lock.host !== hostname()) {
+    out.error(`  nexus lock held by remote host ${lock.host}; cannot stop from here`);
+    return { exitCode: 1 };
+  }
+  if (!Number.isSafeInteger(pid) || pid <= 0) {
+    out.error(`  invalid nexus lock pid ${pid}`);
+    return { exitCode: 1 };
+  }
+  const signal = opts.signalFn ?? ((target: number, name: 'SIGINT' | 'SIGTERM') => process.kill(target, name));
+  const alive = opts.pidAliveFn ?? isPidAlive;
+  const sleep = opts.sleepFn ?? ((ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms)));
+  const timeout = opts.stopTimeoutMs ?? 10_000;
+  const now = opts.nowFn ?? Date.now;
+  let waitedMs = 0;
+  const wait = async (): Promise<boolean> => {
+    const start = now();
+    let elapsed = 0;
+    while (alive(pid) && elapsed < timeout) {
+      const interval = Math.min(100, timeout - elapsed);
+      await sleep(interval);
+      elapsed = Math.max(elapsed + interval, now() - start);
+    }
+    waitedMs += elapsed;
+    debug.log('nexus.stop', 'wait', { pid, waitedMs, count: 1 });
+    return !alive(pid);
+  };
+  try {
+    if (!alive(pid)) return reportOrphans();
+    const identity = inspect().find(row => row.pid === pid);
+    if (!identity) {
+      out.error(`  pid ${pid} does not match this tree's isolated nexus daemon; no signal sent`);
+      return { exitCode: 1 };
+    }
+    if (lock.startedAt) {
+      const processStart = Date.parse(identity.startedAt);
+      const lockStart = Date.parse(lock.startedAt);
+      if (!Number.isFinite(processStart) || !Number.isFinite(lockStart) || processStart > lockStart + 1_000) {
+        out.error(`  pid ${pid} start time cannot match the nexus lock; no signal sent`);
+        return { exitCode: 1 };
+      }
+    }
+    // Recheck the argv and start time immediately before each signal: a stale
+    // lock or a PID recycled during the wait must never target another process.
+    const stillOwned = (): boolean => inspect().some(row => row.pid === pid && row.startedAt === identity.startedAt && row.args === identity.args);
+    if (!stillOwned()) {
+      out.error(`  pid ${pid} no longer matches the locked daemon; no signal sent`);
+      return { exitCode: 1 };
+    }
+    signal(pid, 'SIGINT');
+    out.log(`  SIGINT sent to pid ${pid}`);
+    if (await wait()) return { exitCode: 0 };
+    if (!alive(pid)) return { exitCode: 0 };
+    if (!stillOwned()) {
+      out.error(`  pid ${pid} no longer matches the locked daemon; SIGTERM not sent`);
+      return { exitCode: 1 };
+    }
+    signal(pid, 'SIGTERM');
+    debug.log('nexus.stop', 'escalated', { pid, waitedMs, count: 1 });
+    if (await wait()) return { exitCode: 0 };
+  } catch (error) {
+    out.error(`  pid ${pid} 이 멈추지 않았다: ${error instanceof Error ? error.message : String(error)}`);
+    debug.log('nexus.stop', 'stuck', { pid, waitedMs, count: 1 });
+    return { exitCode: 1 };
+  }
+  out.error(`  pid ${pid} 이 멈추지 않았다`);
+  debug.log('nexus.stop', 'stuck', { pid, waitedMs, count: 1 });
+  return { exitCode: 1 };
+}
+
 async function defaultShareReset(binary: string, port: number): Promise<{ exitCode: number }> {
   const r = await unmountTailscaleServe({
     mode: { kind: 'tls-tcp', port },
@@ -111,11 +249,12 @@ export async function runPwaStop(opts: PwaStopOpts = {}): Promise<PwaStopResult>
   const out = opts.out ?? console;
   const portResolution = resolveShareUnmountPort(opts);
   const devStopFn = opts.devStopFn ?? (() => runPwaDevStop({ out }));
-  const nexusStopFn = opts.nexusStopFn ?? defaultNexusStop;
   const shareProbeFn = opts.shareProbeFn ?? (() => probeTailscale());
   const shareResetFn = opts.shareResetFn ?? defaultShareReset;
-  const unregisterFn = opts.unregisterFn ?? unregisterPwaInstance;
-  const readLockFn = opts.readLockFn ?? (() => readNexusLock());
+  const unregisterFn = opts.unregisterFn ?? (opts.isolatedRoot ? undefined : unregisterPwaInstance);
+  const readLockFn = opts.readLockFn ?? (opts.isolatedRoot
+    ? () => safeReadLock(joinPath(opts.isolatedRoot!, 'nexus', '.lock'))
+    : () => readNexusLock());
 
   out.log('elanous nexus pwa stop: cascade');
 
@@ -157,19 +296,30 @@ export async function runPwaStop(opts: PwaStopOpts = {}): Promise<PwaStopResult>
   }
 
   // P4 registry unregister — read the lock for the daemon pid before
-  // we send SIGINT (the lock is removed during stop). Best-effort: if
-  // the lock is already gone or pid missing, just skip.
+  // we send SIGINT (the lock is removed during stop). The isolated stop
+  // never writes to the production registry. Missing lock/pid is best-effort.
   let unregisteredPid: number | undefined;
+  let lock: ReturnType<typeof readLockFn> = null;
+  try { lock = readLockFn(); }
+  catch (error) {
+    if (opts.isolatedRoot) {
+      out.error(`  cannot read nexus lock: ${error instanceof Error ? error.message : String(error)}`);
+      return { exitCode: 1, devKilled: false, nexusStopped: false, shareReset, shareUnmount };
+    }
+  }
   try {
-    const lock = readLockFn();
-    if (lock && typeof lock.pid === 'number') {
-      unregisteredPid = lock.pid;
-      unregisterFn(lock.pid);
+    if (lock && typeof lock.pid === 'number' && (!opts.isolatedRoot || !lock.host || lock.host === hostname())) {
+      if (unregisterFn) {
+        unregisterFn(lock.pid);
+        unregisteredPid = lock.pid;
+      }
     }
-  } catch { /* lock read or unregister failure — non-fatal */ }
+  } catch { /* registry unregister failure — non-fatal */ }
 
   const devR = await devStopFn();
-  const nexusR = await nexusStopFn();
+  const nexusR = await (opts.nexusStopFn ?? (opts.isolatedRoot
+    ? () => stopIsolatedNexus(opts, out, lock)
+    : defaultNexusStop))();
   const exitCode = devR.exitCode === 0 && nexusR.exitCode === 0 ? 0 : 1;
   return {
     exitCode,

package/src/cli/pwa-test.ts

@@ -720,8 +720,11 @@ async function runStop(
     out,
     shareProbeFn: async () => ({ installed: false, alive: false }),
     shareResetFn: async () => ({ exitCode: 0 }),
+    isolatedRoot: layout.stateDir,
   });
 
+  // Keep the record when the daemon did not stop; status must not imply a clean shutdown.
+  if (stopRes.exitCode !== 0) return { exitCode: stopRes.exitCode };
   // Cleanup state files — leave logs/ for post-mortem.
   const stateFile = joinPath(layout.stateDir, 'test-state.json');
   if (existsSync(stateFile)) {