elanous 0.2.9 → 0.2.11

package/src/harness/harness-incidents-writer.fixture.ts

@@ -0,0 +1,24 @@
+import { Database } from 'bun:sqlite';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { recordRunExit, type RunExit } from './harness-incidents.js';
+
+const [root, json, mode] = process.argv.slice(2);
+if (!root || !json) throw new Error('root and exit are required');
+const exit = JSON.parse(json) as RunExit;
+if (mode === 'hold') {
+  const db = new Database(join(root, '.incident-write-lock.sqlite'));
+  db.exec('BEGIN IMMEDIATE');
+  process.stdout.write('locked\n');
+  // Released by a file, not a signal: SIGUSR2 handlers are not delivered reliably under Bun on macOS.
+  const release = join(root, 'release-hold');
+  await new Promise<void>((done) => {
+    const timer = setInterval(() => { if (existsSync(release)) { clearInterval(timer); done(); } }, 20);
+  });
+  db.exec('COMMIT');
+  db.close();
+  recordRunExit(exit, root);
+  process.exit(0);
+} else {
+  recordRunExit(exit, root);
+}

package/src/harness/harness-incidents.ts

@@ -0,0 +1,129 @@
+import { Database } from 'bun:sqlite';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+export interface RunExit {
+  runId: string;
+  reason: string;
+  status: number | null;
+  signal: string | null;
+  at: string;
+}
+
+export interface IncidentBurst {
+  reason: string;
+  count: number;
+  firstAt: string;
+  lastAt: string;
+  runIds: string[];
+}
+
+const KST_OFFSET_MS = 9 * 60 * 60_000;
+const INCIDENT_FILE = /^\d{4}-\d{2}-\d{2}\.jsonl$/;
+
+function kstDate(at: number): string {
+  return new Date(at + KST_OFFSET_MS).toISOString().slice(0, 10);
+}
+
+/** Read only recorded exits. Missing ledgers are not evidence that no runs failed. */
+export function readRunExits(root: string): RunExit[] {
+  const dir = join(root, 'incidents');
+  if (!existsSync(dir)) return [];
+  const rows: RunExit[] = [];
+  const seen = new Set<string>();
+  for (const file of readdirSync(dir).filter((name) => INCIDENT_FILE.test(name)).sort()) {
+    const path = join(dir, file);
+    let text: string;
+    try {
+      if (!statSync(path).isFile()) continue;
+      text = readFileSync(path, 'utf8');
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw error;
+    }
+    for (const line of text.split('\n')) {
+      if (!line.trim()) continue;
+      let value: unknown;
+      try { value = JSON.parse(line); } catch { continue; }
+      if (!value || typeof value !== 'object') continue;
+      const row = value as Partial<RunExit>;
+      if (typeof row.runId !== 'string' || !row.runId.trim() || seen.has(row.runId)
+        || typeof row.reason !== 'string' || typeof row.at !== 'string' || !Number.isFinite(Date.parse(row.at))
+        || !(row.status === null || typeof row.status === 'number')
+        || !(row.signal === null || typeof row.signal === 'string')) continue;
+      seen.add(row.runId);
+      rows.push(row as RunExit);
+    }
+  }
+  return rows.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
+}
+
+/** SQLite's process-owned write lock serializes ledger checks and appends across processes. */
+export function recordRunExit(row: RunExit, root: string): void {
+  if (!row.runId?.trim()) return;
+  const at = Date.parse(row.at);
+  if (!Number.isFinite(at)) throw new Error('invalid incident exit time');
+  const dir = join(root, 'incidents');
+  mkdirSync(dir, { recursive: true });
+  const lock = new Database(join(root, '.incident-write-lock.sqlite'));
+  try {
+    lock.exec('PRAGMA busy_timeout = 60000');
+    lock.exec('BEGIN IMMEDIATE');
+    try {
+      if (!readRunExits(root).some((record) => record.runId === row.runId)) {
+        appendFileSync(join(dir, `${kstDate(at)}.jsonl`), `${JSON.stringify(row)}\n`);
+      }
+      lock.exec('COMMIT');
+    } catch (error) {
+      lock.exec('ROLLBACK');
+      throw error;
+    }
+  } finally {
+    lock.close();
+  }
+}
+
+/** Non-overlapping, maximal same-reason windows; no run contributes to two bursts. */
+export function detectBursts(rows: readonly RunExit[], { windowMs = 60_000, threshold = 3 }: {
+  windowMs?: number; threshold?: number;
+} = {}): IncidentBurst[] {
+  const bursts: IncidentBurst[] = [];
+  const byReason = new Map<string, RunExit[]>();
+  const seen = new Set<string>();
+  for (const row of rows) {
+    if (!row.runId || seen.has(row.runId) || !Number.isFinite(Date.parse(row.at))) continue;
+    seen.add(row.runId);
+    const group = byReason.get(row.reason) ?? [];
+    group.push(row);
+    byReason.set(row.reason, group);
+  }
+  for (const [reason, group] of byReason) {
+    group.sort((a, b) => Date.parse(a.at) - Date.parse(b.at) || a.runId.localeCompare(b.runId));
+    for (let start = 0; start < group.length;) {
+      let end = start + 1;
+      while (end < group.length && Date.parse(group[end]!.at) - Date.parse(group[start]!.at) <= windowMs) end++;
+      if (end - start < threshold) { start++; continue; }
+      const members = group.slice(start, end);
+      bursts.push({ reason, count: members.length, firstAt: members[0]!.at,
+        lastAt: members[members.length - 1]!.at, runIds: members.map((row) => row.runId) });
+      start = end;
+    }
+  }
+  return bursts.sort((a, b) => Date.parse(a.firstAt) - Date.parse(b.firstAt) || a.reason.localeCompare(b.reason));
+}
+
+export function recentBurst(root: string, now: Date | number, { lookbackMs = 15 * 60_000 }: {
+  lookbackMs?: number;
+} = {}): IncidentBurst | null {
+  const time = typeof now === 'number' ? now : now.getTime();
+  const recent = detectBursts(readRunExits(root)).filter((burst) => {
+    const last = Date.parse(burst.lastAt);
+    return last <= time && last >= time - lookbackMs;
+  });
+  return recent.sort((a, b) => Date.parse(a.lastAt) - Date.parse(b.lastAt)).at(-1) ?? null;
+}
+
+export function formatIncidentBurstWarning(burst: IncidentBurst): string {
+  const time = new Date(Date.parse(burst.lastAt) + KST_OFFSET_MS).toISOString().slice(11, 16);
+  return `⚠ 최근 묶음 사고: ${burst.reason} ×${burst.count} (${time} KST) — 원인 확인 전 재발사는 중복·재사고 위험 · elanous harness incidents`;
+}

package/src/harness/harness-pod-dispatch.ts

@@ -7,8 +7,9 @@
  *    매니페스트가 실은 런 계약(`ELANOUS_RUN_CONTRACT`)으로 자기가 Pod 인 줄 안다(graph-run-contract.ts).
  */
 import { spawn } from 'node:child_process';
-import { readFileSync, realpathSync } from 'node:fs';
-import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { selfDevRunsDir } from '../self-dev/run-store.js';
 import { findGitDir } from '../git-fs/locate.js';
 import { debug } from '../debug/log.js';
 import { ELANOUS_ENTRY_SCRIPT } from '../self-implement/seams.js';
@@ -23,6 +24,8 @@ export interface HarnessPodDispatchInput {
   readonly dispatchRecorded?: boolean;
   /** Pod 메모리 등급(standard|high) — 오케스트레이터 환경 `ELANOUS_POD_MEMORY_TIER` 로 Job 까지 간다. */
   readonly podMemory?: string;
+  /** L7c — Pod queue predecessor (goal ID or PR) — `ELANOUS_POD_AFTER` carries it to every Pod Job admission. */
+  readonly after?: string;
   readonly autoMerge?: boolean;
   readonly base?: string;
   readonly json?: boolean;
@@ -30,16 +33,9 @@ export interface HarnessPodDispatchInput {
   readonly source?: string;
 }
 
-/** 오케스트레이터가 `;;` 로 골을 나누므로 한 골 안의 `;;` 는 풀어 둔다(한 발 = 한 골). */
-export function podGoalText(input: HarnessPodDispatchInput, readFile: (path: string) => string = (p) => readFileSync(p, 'utf8')): string {
-  // 오케스트레이터에는 내용도 보내고, 저장소 안의 ask 는 별도로 Secret 을 통해 Pod 클론에 심는다.
-  const text = input.entrance === 'cli-harness-ask' ? readFile(input.input) : input.input;
-  return text.replace(/;;/gu, '; ;');
-}
-
-export function podOrchestrateArgs(input: HarnessPodDispatchInput, goal: string): string[] {
+export function podOrchestrateArgs(input: HarnessPodDispatchInput, goalFile: string): string[] {
   return [
-    ELANOUS_ENTRY_SCRIPT, 'self', 'orchestrate', goal,
+    ELANOUS_ENTRY_SCRIPT, 'self', 'orchestrate', '--goal-file', goalFile,
     '--substrate', 'pod',
     ...(input.podPool ? ['--pod-pool', input.podPool] : []),
     // 하니스 기본(자동 병합)을 따른다 · 끄면 PR 까지 — 어느 쪽이든 Pod 가 사라져도 결과가 남는다.
@@ -66,13 +62,30 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
       return 2;
     }
   }
-  const goal = podGoalText(input, deps.readFile ?? ((p) => readFileSync(resolve(cwd, p), 'utf8')));
-  const args = podOrchestrateArgs(input, goal);
+  let tempDir: string | undefined;
+  let goalFile: string;
+  let goalChars: number;
+  if (input.entrance === 'cli-harness-ask') {
+    goalFile = resolve(cwd, input.input);
+    goalChars = (deps.readFile ?? ((p) => readFileSync(p, 'utf8')))(goalFile).length;
+  } else {
+    const goal = input.input;
+    const runsDir = selfDevRunsDir();
+    mkdirSync(runsDir, { recursive: true });
+    tempDir = mkdtempSync(join(runsDir, 'pod-goal-'));
+    goalFile = join(tempDir, 'goal.txt');
+    writeFileSync(goalFile, goal, { mode: 0o600 });
+    goalChars = goal.length;
+  }
+  const args = podOrchestrateArgs(input, goalFile);
+  debug.log('harness.substrate', 'goal-file', { entrance: input.entrance, mode: tempDir ? 'temp' : 'path' });
   const env = { ...process.env };
   delete env.ELANOUS_POD_GOAL_DOC;
   delete env.ELANOUS_DISPATCH_RECORDED;
   if (input.dispatchRecorded) env.ELANOUS_DISPATCH_RECORDED = '1';
   if (input.podMemory) env.ELANOUS_POD_MEMORY_TIER = input.podMemory;
+  delete env.ELANOUS_POD_AFTER;
+  if (input.after) env.ELANOUS_POD_AFTER = input.after;
   if (input.entrance === 'cli-harness-ask') {
     const root = findGitDir(cwd)?.root;
     const path = resolve(cwd, input.input);
@@ -84,8 +97,8 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     }
   }
   debug.log('harness.substrate', 'dispatch-pod', {
-    entrance: input.entrance, podPool: input.podPool ?? null, podMemory: input.podMemory ?? null, autoMerge: input.autoMerge !== false,
-    goalChars: goal.length, ...(input.entrance === 'cli-harness-ask' ? { goalPath: input.input } : {}),
+    entrance: input.entrance, podPool: input.podPool ?? null, podMemory: input.podMemory ?? null, after: input.after ?? null, autoMerge: input.autoMerge !== false,
+    goalChars, ...(input.entrance === 'cli-harness-ask' ? { goalPath: input.input } : {}),
   });
   const run = deps.run ?? ((cmd: string, a: readonly string[], childEnv: NodeJS.ProcessEnv) => new Promise<number>((resolveStatus) => {
     const child = (deps.spawnChild ?? spawn)(cmd, [...a], { stdio: deps.onOutput ? ['inherit', 'pipe', 'inherit'] : 'inherit', env: childEnv });
@@ -104,13 +117,20 @@ export function dispatchHarnessOnPod(input: HarnessPodDispatchInput, deps: PodDi
     child.once('error', () => { cleanup(); resolveStatus(1); });
     child.once('close', (code, signal) => { cleanup(); resolveStatus(code ?? ((signal ?? forwarded) === 'SIGINT' ? 130 : 143)); });
   }));
-  const status = run(process.execPath, args, env);
-  if (typeof status === 'number' || status === null) {
-    debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status });
-    return status ?? 1;
+  const cleanup = () => { if (tempDir) rmSync(tempDir, { recursive: true, force: true }); };
+  try {
+    const status = run(process.execPath, args, env);
+    if (typeof status === 'number' || status === null) {
+      cleanup();
+      debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status });
+      return status ?? 1;
+    }
+    return status.then((code) => {
+      debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status: code });
+      return code;
+    }).finally(cleanup);
+  } catch (error) {
+    cleanup();
+    throw error;
   }
-  return status.then((code) => {
-    debug.log('harness.substrate', 'dispatch-pod-exit', { entrance: input.entrance, status: code });
-    return code;
-  });
 }

package/src/harness/harness-seams.ts

@@ -23,6 +23,7 @@ import { buildReviewSeam, gateEvidenceNote, reviewResultToCritiqueLike, type Gat
 import { buildExecuteProgressJudge } from './execute-progress-judge.js';
 import type { StagedHarnessSeams } from './staged-harness.js';
 import { debug } from '../debug/log.js';
+import { releasePathHold, releasePathHoldComment, RELEASE_PATH_LABEL } from '../self-dev/release-path-guard.js';
 import { setEventLoopActivity } from '../debug/event-loop-watchdog.js';
 import { nestInfo } from '../agent/nest-depth.js';
 import { originObservationFields } from '../agent/origin-observation.js';
@@ -721,10 +722,43 @@ export function buildHarnessSeams(deps: HarnessSeamsDeps): StagedHarnessSeams {
         suppressedRiskHits: eligibility?.suppressedRiskHits.length ?? 0,
         ...(declineReasons ? { reasons: declineReasons } : {}),
       });
-      const pr = await deps.seams.openPr({ title, body, head: branch, ...(deps.base ? { base: deps.base } : {}), draft: true, ...(labels ? { labels } : {}), cwd });
-      // ★ 리뷰 반영(#5338) — 라벨 관측은 openPr 성공 후 PR 번호와 함께(생성 실패 시 거짓 운영 증거 방지).
-      if (labels) observe('auto-review-labeled', { branch, number: pr.number, label: AUTO_REVIEW_LABEL });
-      observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: !!labels });
+      const pr = await deps.seams.openPr({ title, body, head: branch, ...(deps.base ? { base: deps.base } : {}), draft: true, cwd });
+      let holdPath: string | undefined;
+      let inspectionError: string | undefined;
+      try {
+        if (!deps.seams.readPrFiles) throw new Error('readPrFiles seam unavailable');
+        const prFiles = await deps.seams.readPrFiles({ number: pr.number, cwd });
+        if (!Array.isArray(prFiles) || !prFiles.every((path) => typeof path === 'string')) throw new Error('invalid PR file list');
+        holdPath = releasePathHold(prFiles);
+      } catch (error) { inspectionError = String(error); }
+      if (holdPath) {
+        const protectedPath = holdPath;
+        const prCwd = cwd;
+        debug.log('self-dev.merge', 'release-path-hold', { number: pr.number, path: protectedPath, label: RELEASE_PATH_LABEL });
+        for (const [action, annotate] of [
+          ['add-label', deps.seams.addPrLabel && (() => deps.seams.addPrLabel!({ number: pr.number, label: RELEASE_PATH_LABEL, cwd: prCwd }))],
+          ['comment', deps.seams.postPrComment && (() => deps.seams.postPrComment!({ number: pr.number, body: releasePathHoldComment(protectedPath), cwd: prCwd }))],
+        ] as const) {
+          if (!annotate) { observe('release-path-annotation-failed', { number: pr.number, action, error: 'annotation seam unavailable' }); continue; }
+          try { await annotate(); } catch (error) { observe('release-path-annotation-failed', { number: pr.number, action, error: String(error) }); }
+        }
+        observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: false, mergeReason: 'release-path-hold' });
+      } else if (inspectionError) {
+        observe('release-path-inspection-failed', { number: pr.number, error: inspectionError });
+        observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: false, mergeReason: 'release-path-inspection-failed' });
+      } else {
+        let autoReviewLabeled = false;
+        if (labels?.includes(AUTO_REVIEW_LABEL)) {
+          if (deps.seams.addPrLabel) {
+            try {
+              await deps.seams.addPrLabel({ number: pr.number, label: AUTO_REVIEW_LABEL, cwd });
+              autoReviewLabeled = true;
+              observe('auto-review-labeled', { branch, number: pr.number, label: AUTO_REVIEW_LABEL });
+            } catch (error) { observe('auto-review-label-failed', { number: pr.number, error: String(error) }); }
+          } else observe('auto-review-label-failed', { number: pr.number, error: 'addPrLabel seam unavailable' });
+        }
+        observe('deployed-pr', { number: pr.number, url: pr.url, autoReview: autoReviewLabeled });
+      }
       // B(대표 2026-07-21): post-PR 자율 리뷰 — 리뷰기가 PR 에 커멘트(fail-soft). 게이트가 놓친 품질 블로커 표면화.
       await postPrReview(cwd, pr.number, objective, deps.llmReview, deps.spawnSyncFn ?? spawnSync, deps.goalDocument);
       return { ok: true, ref: pr.url, kind: 'pr' };

package/src/harness/harness-stop.ts

@@ -7,15 +7,52 @@
 //
 // ⛔ 불변식: 기록된 시작 시각과 실제 프로세스 시작 시각이 다르면 신호를 보내지 않는다(PID 재사용 방지).
 // ⛔ 불변식: `elanous.run=<runId>` 라벨이 붙은 Job 만 지운다.
+// ⛔ 불변식: 짧은 runId 의 후보가 둘 이상이면 프로세스 신호·Job 삭제 전에 중단한다.
 
-import { readFileSync, readlinkSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, readlinkSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { debug } from '../debug/log.js';
 import { selfDevRunsDir } from '../self-dev/run-store.js';
-import { loadRunLedger, runLedgerDir } from '../self-implement/run-ledger.js';
+import { launchBindingRunIds, launchRegistryDir, readLaunchBinding } from './launch-registry.js';
+import { loadRunLedger, resolveFederatedRunLedgerDirectories, runLedgerDir } from '../self-implement/run-ledger.js';
 
 const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+const FULL_RUN_ID = /^run-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export class AmbiguousHarnessStopRunIdError extends Error {
+  constructor(given: string, candidates: readonly string[]) {
+    super(`harness stop ${given}: 더 긴 id 를 주십시오\n${candidates.map((id) => `  ${id}`).join('\n')}`);
+    this.name = 'AmbiguousHarnessStopRunIdError';
+  }
+}
+
+/** List names, not ledger bodies: a run may have written its pid.json before its ledger. */
+export function stopRunIdCandidates(given: string, ledgerDirs: readonly string[], runsDir: string): string[] {
+  const found = new Set<string>();
+  for (const dir of ledgerDirs) {
+    let names: string[];
+    try { names = readdirSync(dir); }
+    catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue;
+      throw error;
+    }
+    for (const name of names) {
+      if (!name.endsWith('.jsonl')) continue;
+      const id = name.slice(0, -'.jsonl'.length);
+      if (FULL_RUN_ID.test(id) && id.startsWith(given)) found.add(id);
+    }
+  }
+  try {
+    for (const entry of readdirSync(runsDir, { withFileTypes: true })) {
+      if (entry.isDirectory() && entry.name.startsWith(given) && FULL_RUN_ID.test(entry.name)
+        && existsSync(join(runsDir, entry.name, 'pid.json'))) found.add(entry.name);
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+  }
+  return [...found].sort();
+}
 /** `pid.json` 의 `startedAt` 은 `Date.now() − uptime` 근삿값이다 — 이만큼의 차이는 같은 프로세스로 본다. */
 export const START_TOLERANCE_MS = 5_000;
 
@@ -101,6 +138,7 @@ function scanStopProcessTable(runId: string, goalPath: string | null): StopProce
 
 export interface HarnessStopDeps {
   readPidRecord: (runId: string) => PidRecord | null;
+  runIdCandidates?: (given: string) => string[];
   readGoalPath: (runId: string) => string | null;
   scanProcesses: (runId: string, goalPath: string | null) => StopProcessScan;
   /** 살아 있는 프로세스의 시작 시각(ms) · 없으면 null. */
@@ -115,6 +153,7 @@ export interface HarnessStopDeps {
 
 export interface HarnessStopResult {
   runId: string;
+  givenRunId?: string;
   process: 'stopped' | 'killed' | 'absent' | 'owner-mismatch' | 'unmeasured' | 'dry-run';
   pid?: number;
   candidates: StopProcessCandidate[];
@@ -135,6 +174,16 @@ export function readPidRecordFrom(runsDir: string, runId: string): PidRecord | n
   }
 }
 
+/** The launching universe's pid.json when the binding names it, else the binding's own pid — both still pass the start-time check. */
+export function pidRecordFromLaunchBinding(runId: string, registryDir = launchRegistryDir()): PidRecord | null {
+  const binding = readLaunchBinding(runId, registryDir);
+  if (!binding) return null;
+  const fromRunsDir = binding.runsDir ? readPidRecordFrom(binding.runsDir, runId) : null;
+  if (fromRunsDir) return fromRunsDir;
+  debug.log('harness.stop', 'pid-from-launch-binding', { runId, pid: binding.pid });
+  return { pid: binding.pid, startedAt: binding.startedAt, ...(binding.argv0 ? { argv0: binding.argv0 } : {}) };
+}
+
 /** macOS·Linux 공통 — `ps -o lstart=` 는 로컬 시각 문자열(초 단위)이다. */
 export function psProcessStartMs(pid: number): number | null {
   const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 5_000 });
@@ -145,7 +194,8 @@ export function psProcessStartMs(pid: number): number | null {
   return Number.isFinite(ms) ? ms : null;
 }
 
-export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {}): HarnessStopDeps {
+export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {}, opts: { launchRegistryDir?: string } = {}): HarnessStopDeps {
+  const registry = opts.launchRegistryDir ?? launchRegistryDir();
   const env = { ...process.env };
   for (const key of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy']) delete env[key];
   const kubectl = (args: readonly string[]) => {
@@ -153,8 +203,19 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {})
     return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
   };
   return {
-    readPidRecord: (runId) => readPidRecordFrom(selfDevRunsDir(), runId),
-    readGoalPath: stopGoalPathFromLedger,
+    // This universe first; then the host-wide launch binding, so a run launched from another worktree is still found.
+    readPidRecord: (runId) => readPidRecordFrom(selfDevRunsDir(), runId) ?? pidRecordFromLaunchBinding(runId, registry),
+    runIdCandidates: (given) => {
+      const ledgerDirs = new Set([runLedgerDir(), ...resolveFederatedRunLedgerDirectories({})]);
+      const found = new Set(stopRunIdCandidates(given, [...ledgerDirs], selfDevRunsDir()));
+      for (const id of launchBindingRunIds(registry)) if (id.startsWith(given) && FULL_RUN_ID.test(id)) found.add(id);
+      return [...found].sort();
+    },
+    readGoalPath: (runId) => {
+      let fromLedger: string | null = null;
+      try { fromLedger = stopGoalPathFromLedger(runId); } catch { fromLedger = null; }
+      return fromLedger ?? readLaunchBinding(runId, registry)?.goalPath ?? null;
+    },
     scanProcesses: scanStopProcessTable,
     processStartMs: psProcessStartMs,
     kill: (pid, signal) => { process.kill(pid, signal); },
@@ -172,6 +233,13 @@ export function defaultHarnessStopDeps(overrides: Partial<HarnessStopDeps> = {})
 
 export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, contexts?: readonly string[], dryRun = false): Promise<HarnessStopResult> {
   if (!RUN_ID.test(runId)) throw new Error(`invalid run id: ${runId}`);
+  const given = runId;
+  if (!FULL_RUN_ID.test(given)) {
+    const matches = [...new Set(deps.runIdCandidates?.(given) ?? [])].sort();
+    if (matches.length === 1) runId = matches[0]!;
+    debug.log('harness.stop', 'run-id-resolved', { given, resolved: runId, candidates: matches });
+    if (matches.length > 1) throw new AmbiguousHarnessStopRunIdError(given, matches);
+  }
   // ── ⓐ 프로세스 ────────────────────────────────────────────
   let processState: HarnessStopResult['process'] = 'absent';
   const record = deps.readPidRecord(runId);
@@ -235,7 +303,7 @@ export async function stopHarnessRun(runId: string, deps: HarnessStopDeps, conte
     if (r.status === 0) jobsDeleted += r.stdout.split('\n').filter((line) => line.startsWith('job.batch/')).length;
     else debug.log('harness.stop', 'job-delete-failed', { runId, context, error: r.stderr.slice(0, 200) }, { level: 'warn' });
   }
-  const result: HarnessStopResult = { runId, process: processState, ...(record ? { pid: record.pid } : {}), candidates, scanned: scan.status === 'ok', pidRecordFound: record !== null, dryRun, jobsDeleted, contexts: targets };
+  const result: HarnessStopResult = { runId, ...(given !== runId ? { givenRunId: given } : {}), process: processState, ...(record ? { pid: record.pid } : {}), candidates, scanned: scan.status === 'ok', pidRecordFound: record !== null, dryRun, jobsDeleted, contexts: targets };
   debug.log('harness.stop', 'stopped', { runId, process: processState, jobsDeleted, contexts: targets.length });
   return result;
 }
@@ -249,6 +317,7 @@ export function formatHarnessStop(r: HarnessStopResult): string {
     'owner-mismatch': '소유 불일치(건드리지 않음 — PID 가 다른 프로세스로 재사용됐다)',
   };
   return [
+    ...(r.givenRunId ? [`↳ ${r.givenRunId} → ${r.runId}(전체)`] : []),
     `harness stop ${r.runId}`,
     `  프로세스: ${label[r.process]}${r.pid ? ` · pid ${r.pid}` : ''}`,
     ...(!r.scanned && r.process !== 'unmeasured' ? ['  프로세스 표: 못 잼(기록 밖 발사 프로세스는 확인하지 못함)'] : []),

package/src/harness/launch-registry.ts

@@ -0,0 +1,91 @@
+/** Host-wide run → process binding for `harness stop`, independent of the launching worktree and its universe.
+ *  A run launched from another worktree writes `pid.json` and its ledger under that tree's state dir, so a stop from
+ *  any other tree found «no pid.json · goal path 0» while the launcher was alive (10-03 · 09-29). The binding below lives
+ *  in a per-user directory under the OS temp dir — it only has to outlive the process it names, not a reboot. */
+import { closeSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir, userInfo } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { debug } from '../debug/log.js';
+
+export interface LaunchBinding {
+  readonly pid: number;
+  /** Same approximation as `pid.json` (`Date.now() − uptime`) — compared with `ps` start time before any signal. */
+  readonly startedAt: number;
+  readonly argv0?: string;
+  /** The launching process's working directory (absolute). */
+  readonly cwd: string;
+  /** Absolute goal document path when the launcher was given one (`--goal-file`/`--ask`/`--goal`). */
+  readonly goalPath?: string;
+  /** The `self-dev-runs` directory that holds this run's `pid.json` — tells a stop which universe launched it. */
+  readonly runsDir?: string;
+}
+
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+/** One directory per OS user: `$TMPDIR` is per-user on macOS, `/tmp` is shared on Linux. */
+export function launchRegistryDir(): string {
+  let uid: string;
+  try { uid = String(userInfo().uid); } catch { uid = 'unknown'; }
+  return join(tmpdir(), `elanous-harness-launches-${uid}`);
+}
+
+/** The goal document named in an argv, resolved against `cwd` — the same option set `harness stop` already matches. */
+export function goalPathFromArgv(argv: readonly string[], cwd: string): string | undefined {
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]!;
+    let value: string | undefined;
+    for (const flag of ['--goal-file', '--ask', '--goal']) {
+      if (arg === flag) value = argv[i + 1];
+      else if (arg.startsWith(`${flag}=`)) value = arg.slice(flag.length + 1);
+    }
+    if (value?.trim()) return isAbsolute(value) ? resolve(value) : resolve(cwd, value);
+  }
+  return undefined;
+}
+
+export function writeLaunchBinding(runId: string, binding: LaunchBinding, dir = launchRegistryDir()): string | null {
+  if (!RUN_ID.test(runId)) return null;
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = join(dir, `${runId}.json`);
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    const fd = openSync(temporary, 'wx', 0o600);
+    try { writeFileSync(fd, JSON.stringify(binding)); } finally { closeSync(fd); }
+    renameSync(temporary, path);
+    debug.log('harness.launch-registry', 'bound', { runId, pid: binding.pid, goalPath: binding.goalPath ?? null });
+    return path;
+  } catch (error) {
+    debug.log('harness.launch-registry', 'bind-failed', { runId, error: String(error) }, { level: 'warn' });
+    return null;
+  }
+}
+
+export function readLaunchBinding(runId: string, dir = launchRegistryDir()): LaunchBinding | null {
+  if (!RUN_ID.test(runId)) return null;
+  try {
+    const value = JSON.parse(readFileSync(join(dir, `${runId}.json`), 'utf8')) as Partial<LaunchBinding>;
+    if (!Number.isSafeInteger(value.pid) || (value.pid as number) <= 0 || !Number.isFinite(value.startedAt)) return null;
+    if (typeof value.cwd !== 'string' || !isAbsolute(value.cwd)) return null;
+    return {
+      pid: value.pid as number, startedAt: value.startedAt as number, cwd: value.cwd,
+      ...(typeof value.argv0 === 'string' ? { argv0: value.argv0 } : {}),
+      ...(typeof value.goalPath === 'string' && isAbsolute(value.goalPath) ? { goalPath: value.goalPath } : {}),
+      ...(typeof value.runsDir === 'string' && isAbsolute(value.runsDir) ? { runsDir: value.runsDir } : {}),
+    };
+  } catch { return null; }
+}
+
+export function removeLaunchBinding(runId: string, dir = launchRegistryDir()): void {
+  if (!RUN_ID.test(runId)) return;
+  try { unlinkSync(join(dir, `${runId}.json`)); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') debug.log('harness.launch-registry', 'unbind-failed', { runId, error: String(error) }, { level: 'warn' });
+  }
+}
+
+/** Run IDs with a live-looking binding — used for stop's prefix resolution next to ledgers and `pid.json` names. */
+export function launchBindingRunIds(dir = launchRegistryDir()): string[] {
+  try { return readdirSync(dir).filter((name) => name.endsWith('.json')).map((name) => name.slice(0, -5)).filter((id) => RUN_ID.test(id)); }
+  catch { return []; }
+}

package/src/harness/process-garbage.ts

@@ -12,7 +12,9 @@ export interface GarbageProcess extends Pick<GarbageProcessRow, 'pid' | 'ppid' |
 
 const TEST_PATH = /elanous|repo\.worktrees|self-impl|\.elanous-test|gate-baseline/i;
 const TEST_DAEMON = /(?:^|[\s/])daemon\.ts(?:\s|$)/;
-const TEST_RUNNER = /\bbun\s+test\b|\bgate(?:[-\s]baseline|\b)/i;
+const TEST_RUNNER = /^(?:\S*\/)?bun\s+test(?:\s|$)/i;
+// Only the command itself counts — `bun [run|x] <…gate…>`; goal text later in argv must not (PROC1).
+const GATE_RUNNER = /^(?:\S*\/)?bun\s+(?:(?:run|x)\s+)?\S*gate(?:[-\s]baseline|\b)/i;
 const NEXUS_RUN = /\bnexus\s+run\b/;
 const TEST_MARKER = /\.elanous-test|(?:^|\s)--test(?:\s|$)/;
 
@@ -20,7 +22,7 @@ const TEST_MARKER = /\.elanous-test|(?:^|\s)--test(?:\s|$)/;
 export function isGarbageProcessTarget(command: string): boolean {
   return command.includes('elanous.mjs')
     || (TEST_DAEMON.test(command) && /elanous-nexus-|\.elanous-test/.test(command))
-    || (TEST_RUNNER.test(command) && TEST_PATH.test(command));
+    || ((TEST_RUNNER.test(command) || GATE_RUNNER.test(command)) && TEST_PATH.test(command));
 }
 
 export function classifyGarbage(
@@ -36,7 +38,7 @@ export function classifyGarbage(
     const reason: GarbageProcess['reason'] = TEST_DAEMON.test(row.command)
       && /elanous-nexus-|\.elanous-test/.test(row.command)
       ? 'orphan-test-daemon'
-      : TEST_RUNNER.test(row.command) && TEST_PATH.test(row.command)
+      : (TEST_RUNNER.test(row.command) || GATE_RUNNER.test(row.command)) && TEST_PATH.test(row.command)
         ? 'orphan-test-runner'
         : 'orphan-elanous';
     garbage.push({ pid: row.pid, ppid: row.ppid, elapsedSeconds: row.elapsedSeconds, command: row.command, reason });

package/src/hitl/clarification-policy.ts

@@ -182,7 +182,7 @@ export function decideAndObserveClarification(
     impact: candidate.impact,
     action: decision.action,
     reason: decision.reason,
-    recommendedOption: decision.recommendedOption,
+    ...(context.phase === 'execution' ? {} : { recommendedOption: decision.recommendedOption }),
     budgetUsed: context.budget.used,
     budgetLimit: context.budget.limit,
   });
@@ -210,6 +210,8 @@ export function toAskUserQuestionRequest(decision: ClarificationDecision): AskUs
     header: 'Direction',
     question: `${candidate.prompt}\n\nRecommended: ${decision.recommendedOption}. ${candidate.whyNow}`,
     options: candidate.options.map(({ recommended: _recommended, ...option }) => option),
+    impact: candidate.impact,
+    recommendedIndex: candidate.options.findIndex(option => option.recommended),
     includeOther: true,
   };
   return { questions: [question] };