elanous 0.2.11 → 0.2.13

package/scripts/context-hooks/emit.ts

@@ -1,24 +1,46 @@
+// Bounded Claude Code hook extractor: only seat folders (marked by `.claude/seat`) emit, and only fixed metadata.
 import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+
+const SEATS = new Set(['OP', 'TC', 'MK', 'UX']);
+const MAX_LEVELS = 6;
+
+// Walks up from the session cwd to the git root (or MAX_LEVELS); no or invalid marker → null.
+function findSeat(start: string): string | null {
+  let dir = start;
+  for (let level = 0; level <= MAX_LEVELS; level++) {
+    const marker = join(dir, '.claude', 'seat');
+    if (existsSync(marker)) {
+      const seat = readFileSync(marker, 'utf8').trim();
+      return SEATS.has(seat) ? seat : null;
+    }
+    if (existsSync(join(dir, '.git'))) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
 
 const event = process.argv[2];
 if (event !== 'stop' && event !== 'post-tool-use') process.exit(0);
-
 try {
   const payload = JSON.parse(await Bun.stdin.text()) as Record<string, unknown>;
-  // A locator is useful only when it is a session ID, not arbitrary hook input.
   const session = payload.session_id;
   if (typeof session !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(session)) process.exit(0);
+  const cwd = typeof payload.cwd === 'string' && isAbsolute(payload.cwd) ? payload.cwd : process.cwd();
+  const seat = findSeat(cwd);
+  if (seat === null) process.exit(0);
+  if (event === 'stop') {
+    spawnSync('elanous', ['context', 'emit', 'task-done', '--seat', seat, '--text', 'Claude Code session stopped', '--ref', session],
+      { stdio: 'ignore', timeout: 3000 });
+    process.exit(0);
+  }
   const tool = payload.tool_name;
-  if (event === 'post-tool-use' && (typeof tool !== 'string' || !/^[a-z][a-z0-9_.:-]{0,63}$/i.test(tool))) process.exit(0);
-  // Only known tool identifiers can appear in the generated summary. Never copy hook free text.
-  const knownTools = new Set(['Read', 'Write', 'Edit', 'MultiEdit', 'Bash', 'Glob', 'Grep', 'LS',
-    'Task', 'WebFetch', 'WebSearch', 'NotebookEdit', 'TodoWrite', 'AskUserQuestion']);
-  const summary = event === 'stop' ? 'Claude Code session stopped'
-    : `Claude Code tool ${knownTools.has(tool as string) ? tool : 'other'} completed`;
+  if (typeof tool !== 'string' || !/^[a-z][a-z0-9_.:-]{0,63}$/i.test(tool)) process.exit(0);
+  const knownTools = new Set(['Read', 'Write', 'Edit', 'MultiEdit', 'Bash', 'Glob', 'Grep', 'LS', 'Task', 'WebFetch', 'WebSearch', 'NotebookEdit', 'TodoWrite', 'AskUserQuestion']);
+  const summary = `Claude Code tool ${knownTools.has(tool) ? tool : 'other'} completed`;
   const source = `elanous://context/claude-code/${session}`;
-  spawnSync('elanous', ['context', 'emit', '--kind', 'done', '--summary', summary, '--source', source], {
-    stdio: 'ignore', timeout: 3000,
-  });
-} catch {
-  // Hooks must not interrupt the seat session on malformed input or unavailable CLI.
-}
+  spawnSync('elanous', ['context', 'emit', '--kind', 'done', '--summary', summary, '--source', source], { stdio: 'ignore', timeout: 3000 });
+} catch { /* never interrupt the seat session */ }

package/scripts/coord-channel-watch.sh

@@ -47,6 +47,7 @@
 # 환경 노브: CH_PR · CH_REPO · CH_INTERVAL(기본 60) · CH_BODY_CHARS(기본 1500) · CH_WATCH_BODY(기본 1)
 
 set -u
+set -o pipefail
 
 PR_NUM="${CH_PR:-23032}"  # ⛔ 2026-10-03: #20798 가 2,500 상한 → 채널 «6»(OP)  # ⛔ 2026-09-27: #16815 가 2,500 상한에 닿아 채널 «5» 로 옮김(🅞 · 벽에 «닿은 뒤» — 미리 못 옮겼다)
 #   📏 이력: #5730(07-28~08-12) → #8328(08-11~08-25) → #12577(08-25~09-10) → #16815(09-10~09-27) → #20798(09-27~10-03) → #23032.

package/scripts/discord-seat-probe.ts

@@ -0,0 +1,144 @@
+import { Database } from 'bun:sqlite';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { discordDecisionOwner } from '../src/decisions/discord-decision-cards.js';
+import { handleDiscordSeatWork, type DiscordSeatWorkDeps } from '../src/intake-plane/discord-seat-work.js';
+import { submitIntakeWork } from '../src/intake-plane/submit-intake-work.js';
+import type { MsgStore } from '../src/msg/msg-store.js';
+import { dispatchCeoTask } from '../src/seat-dispatch/ceo-commands.js';
+import { resolveSeat } from '../src/seat-address/seat-address.js';
+import { getUserConfig, type UserConfig } from '../src/user-config.js';
+
+export type ProbeResult = {
+  text: string;
+  ms: number;
+  route: 'dispatch' | 'ask' | 'submit' | 'none';
+  seat: string | null;
+  body: string | null;
+  reply: string | null;
+};
+
+type ProbeOptions = { config?: UserConfig; dm?: boolean; live?: boolean; liveDeps?: DiscordSeatWorkDeps; messageId?: string };
+
+/** Execute the real Discord seat router; dry dependencies never open a live store or delivery channel. */
+export async function probeDiscordSeatWork(text: string, options: ProbeOptions = {}): Promise<ProbeResult> {
+  const config = options.config ?? getUserConfig();
+  const ownerId = discordDecisionOwner(config);
+  if (options.dm && !ownerId) throw new Error('Discord 소유자 ID가 없어 DM을 재현할 수 없습니다.');
+  const messageId = options.messageId ?? 'probe-1';
+  const msg = { channelId: options.dm ? `probe-dm-${ownerId}` : 'probe-channel', messageId,
+    ...(ownerId ? { userId: ownerId } : {}), isDm: options.dm ?? false };
+  let route: ProbeResult['route'] = 'none';
+  let seat: string | null = null;
+  let body: string | null = null;
+  const capture = (path: ProbeResult['route'], seatId: string | null, forwarded: string) => {
+    route = path;
+    seat = seatId;
+    body = Array.from(forwarded).slice(0, 80).join('');
+  };
+  const dry: DiscordSeatWorkDeps = {
+    config,
+    // An unknown address must not cause registry I/O or a persona/LLM answer in a dry run.
+    personaSource: { list: () => [], get: () => undefined },
+    personaAnswer: async () => { throw new Error('dry persona answer unavailable'); },
+    answer: async () => null,
+    commandDeps: { ownerId, replyTarget: null, runGh: async () => { throw new Error('dry channel delivery unavailable'); },
+      append: () => { throw new Error('dry seat delivery unavailable'); } },
+    dispatch: async (seatId, forwarded) => {
+      capture('dispatch', seatId, forwarded);
+      return { channel: 'unknown', reply: `마른 실행 — ${seatId}에 맡길 예정 (실제 맡김 없음).` };
+    },
+    submit: async (input) => {
+      capture('submit', resolveSeat(input.text.split(/\s+/)[0] ?? '')?.id ?? null, input.text);
+      return { ok: true, track: 'graph', acceptanceId: 'DRY-RUN (모의 · 실제 접수 없음)' };
+    },
+    askDeps: {
+      open: () => { const db = new Database(':memory:'); return { db, close: () => db.close() } as unknown as MsgStore; },
+      dispatch: async (seatId, forwarded) => {
+        capture('ask', seatId, forwarded);
+        return { channel: 'unknown', reply: '마른 실행 — 질문을 맡기지 않았습니다.' };
+      },
+      send: async () => { throw new Error('dry Discord delivery unavailable'); },
+    },
+  };
+  const live: DiscordSeatWorkDeps = {
+    ...options.liveDeps,
+    config,
+    dispatch: async (seatId, forwarded, deps, extra) => {
+      capture('dispatch', seatId, forwarded);
+      return (options.liveDeps?.dispatch ?? dispatchCeoTask)(seatId, forwarded, deps, extra);
+    },
+    submit: async (input, deps) => {
+      capture('submit', resolveSeat(input.text.split(/\s+/)[0] ?? '')?.id ?? null, input.text);
+      return (options.liveDeps?.submit ?? submitIntakeWork)(input, deps);
+    },
+    askDeps: {
+      ...options.liveDeps?.askDeps,
+      dispatch: async (seatId, forwarded, deps, extra) => {
+        capture('ask', seatId, forwarded);
+        return (options.liveDeps?.askDeps?.dispatch ?? dispatchCeoTask)(seatId, forwarded, deps, extra);
+      },
+      // This CLI has no Discord transport: even live mode must not post to Discord.
+      send: async () => { throw new Error('probe does not send Discord messages'); },
+    },
+  };
+  const start = performance.now();
+  const reply = await handleDiscordSeatWork(text, msg, options.live ? live : dry);
+  return { text: Array.from(text).slice(0, 80).join(''), ms: Math.round((performance.now() - start) * 100) / 100,
+    route, seat, body, reply: reply === null ? null : Array.from(reply).slice(0, 120).join('') };
+}
+
+/** Extract only the '치는 문장' column of a Markdown runbook table, in row order. */
+export function runbookTexts(markdown: string): string[] {
+  const lines = markdown.split(/\r?\n/);
+  const header = lines.findIndex((line) => /^\|.*\|\s*치는 문장(?:\s*\([^|]*\))?\s*\|/.test(line));
+  if (header < 0) throw new Error('대본의 «치는 문장» 표를 찾지 못했습니다.');
+  const columns = lines[header]!.split('|').slice(1, -1).map((cell) => cell.trim());
+  const index = columns.findIndex((cell) => cell.startsWith('치는 문장'));
+  const texts: string[] = [];
+  for (const line of lines.slice(header + 2)) {
+    if (!line.startsWith('|')) break;
+    const cells = line.split('|').slice(1, -1);
+    if (cells.length !== columns.length) throw new Error('대본 표의 열 수가 맞지 않습니다.');
+    const cell = cells[index]?.trim() ?? '';
+    if (!cell.startsWith('`') || !cell.endsWith('`')) throw new Error('치는 문장 칸이 백틱으로 둘러싸여 있지 않습니다.');
+    texts.push(cell.slice(1, -1));
+  }
+  if (!texts.length) throw new Error('대본에 치는 문장이 없습니다.');
+  return texts;
+}
+
+export async function runProbeCli(argv: string[], config: UserConfig = getUserConfig()): Promise<ProbeResult[]> {
+  let text: string | undefined;
+  let runbook: string | undefined;
+  let dm = false;
+  let live = false;
+  let json = false;
+  for (let i = 0; i < argv.length; i++) {
+    const flag = argv[i];
+    if (flag === '--text' || flag === '--runbook') {
+      const value = argv[++i];
+      if (!value || value.startsWith('--')) throw new Error(`${flag} 값이 필요합니다.`);
+      if (flag === '--text') text = value;
+      else runbook = value;
+    } else if (flag === '--dm') dm = true;
+    else if (flag === '--live') live = true;
+    else if (flag === '--json') json = true;
+    else throw new Error(`알 수 없는 옵션: ${flag}`);
+  }
+  if (Boolean(text) === Boolean(runbook)) throw new Error('--text 또는 --runbook 중 하나만 지정하세요.');
+  const texts = runbook ? runbookTexts(readFileSync(resolve(runbook), 'utf8')) : [text!];
+  const results: ProbeResult[] = [];
+  for (const [index, line] of texts.entries()) {
+    const result = await probeDiscordSeatWork(line, { config, dm, live, messageId: `probe-${index + 1}` });
+    results.push(result);
+    if (!json) console.log(`글: ${result.text} | ${result.ms}ms | 길: ${result.route} | 자리: ${result.seat ?? '-'} | 본문: ${result.body ?? '-'} | 봇 답: ${result.reply ?? '-'}`);
+  }
+  if (json) console.log(JSON.stringify(results));
+  return results;
+}
+
+if (import.meta.main) {
+  try { await runProbeCli(process.argv.slice(2)); }
+  catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1; }
+}

package/scripts/hq/hq-standby.sh

@@ -0,0 +1,65 @@
+#!/bin/sh
+# HQ-REP replication body — the same file runs on both HQ hosts (OP 10-04 10:09 · «되돌리기 방향»).
+# The lease holder is the source, the other host is the standby: mbp → node-b today, node-b → mbp once node-b holds the lease.
+# Called by each host's short cron shim (~/.elanous/bin/hq-standby.sh: lock ⊕ fetch ⊕ detach origin/main) with:
+#   HQ_REP_PEER=<the other host's ssh name>  HQ_REP_DEFAULT_SOURCE=<lease names of the pre-lease source, comma list>
+#   [HQ_REP_SURVIVAL=<host>,s3://bucket/prefix]  [HQ_REP_STATE_DIR=<canonical ledgers · default ~/.elanous>]
+#   sh scripts/hq/hq-standby.sh core|big|obs|vault
+# HQ_REP_STATE_DIR (OP 10-04 11:27): on node-b the promoted HQ state lives in ~/.elanous-hqstate — its live ~/.elanous is the
+# Pod host's own state and must never be copied as HQ ledgers. The copy refuses a state dir without release/features.sqlite
+# (an empty or wrong root would otherwise become the standby's newest generation).
+# Direction comes from scripts/hq/standby-role.ts: `fenced` → the copy runs under `elanous hq fence --role cron`
+# (TC HQ-FENCE decides · skip exits 0), `direct` → no lease yet and this is the default source, `skip` → no lease, not it.
+MODE="$1"
+ts() { date '+%Y-%m-%dT%H:%M:%S%z'; }
+# Production ledgers on every host — a source-tree command resolves the test universe otherwise.
+# HQ_REP_CONFIG_DIR (TC drill step 0 · 10-04 11:5x): node-b keeps its hq settings (hq.hostName=node-b) in ~/.elanous-hqcfg
+# because its live ~/.elanous is the Pod host's; the role check and `hq fence` must read the same lease name as HQ-HB.
+# ⚠️ The config dir moves only by the `--config-dir` flag (src/elanous-config-dir.ts) — an ELANOUS_CONFIG_DIR env is ignored.
+export ELANOUS_STATE_DIR="$HOME/.elanous"
+CFG="${HQ_REP_CONFIG_DIR:-$HOME/.elanous}"
+STATE="${HQ_REP_STATE_DIR:-$HOME/.elanous}"
+case "$MODE" in core|big|obs|vault) ;; *) echo "$(ts) hq-standby skip: unknown mode $MODE"; exit 2 ;; esac
+[ -n "$HQ_REP_PEER" ] || { echo "$(ts) hq-standby skip($MODE): HQ_REP_PEER not set"; exit 2; }
+[ -n "$HQ_REP_DEFAULT_SOURCE" ] || { echo "$(ts) hq-standby skip($MODE): HQ_REP_DEFAULT_SOURCE not set"; exit 2; }
+verify_received() {
+  # Verification is observational: a broken or not-yet-received copy must not fail replication's cron exit status.
+  bun scripts/hq/standby-verify.ts --root "$HOME/.elanous-standby" --tier core,big --max-age-min core=30,big=400 || :
+}
+ROLE=$(bun scripts/hq/standby-role.ts --config-dir "$CFG" --default-source "$HQ_REP_DEFAULT_SOURCE" 2>/dev/null) || ROLE=fenced
+case "$ROLE" in
+  skip) if [ "$MODE" = core ]; then verify_received; else echo "$(ts) hq-standby skip($MODE): standby — no lease yet and this host is not the default source"; fi; exit 0 ;;
+  direct) set -- ;;
+  *) ROLE=fenced; set -- bun bin/elanous.mjs --config-dir "$CFG" hq fence --role cron -- ;;
+esac
+echo "$(ts) hq-standby run($MODE) role=$ROLE state=$STATE → $HQ_REP_PEER at $(git rev-parse --short HEAD 2>/dev/null)"
+if [ "$MODE" = vault ]; then
+  # Obsidian vault: one-way copy to the standby (no --delete; workspace state and trash stay local; --update keeps newer files there).
+  V="$HOME/Obsidian/ElanvitalAI/"
+  "$@" rsync -a --update --exclude '.obsidian/workspace*' --exclude '.trash/' "$V" "$HQ_REP_PEER:$V" 2>&1 \
+    && echo "$(ts) hq-standby vault done rc=0 (a fence skip line above means nothing was copied)" || { echo "$(ts) hq-standby vault FAILED"; exit 1; }
+  exit 0
+fi
+# In core fenced mode the guard runs inside the fence: a non-holder need not have HQ source ledgers.
+if [ "$MODE" != core ] || [ "$ROLE" = direct ]; then
+  [ -f "$STATE/release/features.sqlite" ] || { echo "$(ts) hq-standby skip($MODE): $STATE has no release/features.sqlite — not an HQ state dir, nothing copied"; exit 1; }
+fi
+SURV=""
+[ "$MODE" = core ] && [ -n "$HQ_REP_SURVIVAL" ] && SURV="--survival $HQ_REP_SURVIVAL"
+# The fence exits 0 both after copying and after skipping. Mark execution inside the fence,
+# not by parsing its diagnostic text: only the skipped host owns a received copy to verify.
+if [ "$MODE" = core ] && [ "$ROLE" = fenced ]; then
+  FENCE_RAN=$(mktemp) || { echo "$(ts) hq-standby FAILED: cannot track fence execution"; exit 1; }
+  # shellcheck disable=SC2086 — SURV is either empty or two words.
+  COPY_OUT=$("$@" sh -c '
+    [ -f "$1/release/features.sqlite" ] || { echo "hq-standby skip(core): $1 has no release/features.sqlite — not an HQ state dir, nothing copied"; exit 1; }
+    printf "ran\n" > "$2"; shift 2; exec "$@"
+  ' sh "$STATE" "$FENCE_RAN" env ELANOUS_STATE_DIR="$STATE" bun scripts/hq/standby-snapshot.ts --tier "$MODE" --push "$HQ_REP_PEER" $SURV 2>&1)
+  COPY_RC=$?
+  [ -z "$COPY_OUT" ] || printf '%s\n' "$COPY_OUT"
+  if [ "$COPY_RC" -eq 0 ] && [ ! -s "$FENCE_RAN" ]; then verify_received; fi
+  rm -f "$FENCE_RAN"
+  exit "$COPY_RC"
+fi
+# shellcheck disable=SC2086 — SURV is either empty or two words.
+"$@" env ELANOUS_STATE_DIR="$STATE" bun scripts/hq/standby-snapshot.ts --tier "$MODE" --push "$HQ_REP_PEER" $SURV 2>&1

package/scripts/hq/standby-promote.ts

@@ -0,0 +1,173 @@
+#!/usr/bin/env bun
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { chmodSync, copyFileSync, lstatSync, mkdirSync, readFileSync, readlinkSync, realpathSync, rmSync, statSync, utimesSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import type { Tier } from './standby-snapshot.js';
+
+interface Generation { tier: Tier; name: string; dir: string; files: string[] }
+interface Options { to: string; standby: string; tiers: Tier[]; hqConfig?: string; dryRun: boolean; json: boolean }
+
+function contained(base: string, name: string): string {
+  if (!name || isAbsolute(name) || name.includes('\\')) throw new Error(`invalid relative path: ${name}`);
+  const path = resolve(base, name);
+  const rel = relative(base, path);
+  if (!rel || rel === '..' || rel.startsWith(`..${sep}`)) throw new Error(`path escapes generation: ${name}`);
+  return path;
+}
+
+function expand(path: string): string { return path.startsWith('~/') ? join(homedir(), path.slice(2)) : path; }
+
+export function parsePromoteArgs(argv: string[]): Options {
+  const options: Options = { to: '', standby: join(homedir(), '.elanous-standby'), tiers: ['core', 'big'], dryRun: false, json: false };
+  for (let i = 0; i < argv.length; i++) {
+    const flag = argv[i];
+    if (flag === '--dry-run') { options.dryRun = true; continue; }
+    if (flag === '--json') { options.json = true; continue; }
+    if (!['--to', '--standby', '--tiers', '--hq-config'].includes(flag)) throw new Error(`unknown option: ${flag}`);
+    const value = argv[++i];
+    if (!value || value.startsWith('--')) throw new Error(`${flag} requires a value`);
+    if (flag === '--to') options.to = resolve(expand(value));
+    if (flag === '--standby') options.standby = resolve(expand(value));
+    if (flag === '--hq-config') options.hqConfig = resolve(expand(value));
+    if (flag === '--tiers') {
+      const tiers = value.split(',');
+      if (tiers.some(t => !['core', 'big', 'obs'].includes(t)) || new Set(tiers).size !== tiers.length) throw new Error('--tiers must be core,big,obs without duplicates');
+      options.tiers = tiers as Tier[];
+    }
+  }
+  if (!options.to) throw new Error('--to is required');
+  return options;
+}
+
+function isInside(base: string, path: string): boolean {
+  const rel = relative(base, path);
+  return !rel || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+
+async function sha256(path: string): Promise<string> {
+  const hash = createHash('sha256');
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest('hex');
+}
+
+function checkedFile(dir: string, name: string): string {
+  const path = contained(dir, name);
+  let current = dir;
+  for (const part of relative(dir, path).split(sep)) {
+    current = join(current, part);
+    if (lstatSync(current).isSymbolicLink()) throw new Error(`symlink in generation: ${name}`);
+  }
+  if (!lstatSync(path).isFile()) throw new Error(`not a file: ${name}`);
+  return path;
+}
+
+async function readGeneration(standby: string, tier: Tier): Promise<Generation> {
+  const base = join(standby, tier);
+  const name = readlinkSync(join(base, 'latest'));
+  const dir = contained(base, name);
+  if (relative(base, dir) !== name || !lstatSync(dir).isDirectory()) throw new Error(`${tier}: invalid latest`);
+  const manifest = JSON.parse(readFileSync(checkedFile(dir, 'MANIFEST.json'), 'utf8')) as { generation?: string; tier?: string; entries?: Array<{ path: string; sha256: string }> };
+  if (manifest.generation !== name || manifest.tier !== tier || !Array.isArray(manifest.entries)) throw new Error(`${tier}: invalid manifest`);
+  const lines = readFileSync(checkedFile(dir, 'SHA256SUMS'), 'utf8').trimEnd().split('\n');
+  const files: string[] = [];
+  const seen = new Set<string>();
+  for (const line of lines) {
+    const match = /^([a-fA-F0-9]{64})  (.+)$/.exec(line);
+    if (!match || seen.has(match[2]) || ['MANIFEST.json', 'SHA256SUMS'].includes(match[2])) throw new Error(`${tier}: invalid SHA256SUMS`);
+    seen.add(match[2]);
+    const file = checkedFile(dir, match[2]);
+    if (await sha256(file) !== match[1].toLowerCase()) throw new Error(`${tier}: checksum mismatch: ${match[2]}`);
+    files.push(match[2]);
+  }
+  if (manifest.entries.length !== files.length || manifest.entries.some(e => !e || !seen.has(e.path) || !lines.includes(`${e.sha256}  ${e.path}`))) throw new Error(`${tier}: manifest/checksum list mismatch`);
+  return { tier, name, dir, files };
+}
+
+function objectConfig(path: string): Record<string, unknown> {
+  const value: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`config is not an object: ${path}`);
+  return value as Record<string, unknown>;
+}
+
+function pollerOff(value: unknown): Record<string, unknown> {
+  if (value === undefined) return { enabled: false };
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('poller config is not an object');
+  return { ...value, enabled: false };
+}
+
+export async function promote(options: Options, writeConfig: (path: string, contents: string) => void = writeFileSync): Promise<{ to: string; tiers: Record<string, string>; files: number; features: 'yes' | 'no'; pollers: 'off'; hq: string; seconds: number; dryRun: boolean }> {
+  const started = Date.now();
+  const to = resolve(options.to);
+  const parent = realpathSync(dirname(to));
+  const targetPath = join(parent, relative(dirname(to), to));
+  if (isInside(realpathSync(options.standby), targetPath)) throw new Error('--to must be outside --standby');
+  if (options.hqConfig && isInside(realpathSync(options.hqConfig), targetPath)) throw new Error('--to must be outside --hq-config');
+  // Verify each tier before creating the target, so a bad big copy cannot leave a promoted core.
+  const generations: Generation[] = [];
+  for (const tier of options.tiers) generations.push(await readGeneration(options.standby, tier));
+  try { lstatSync(to); throw new Error(`target already exists: ${to}`); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; }
+  const files = generations.reduce((n, g) => n + g.files.length, 0);
+  const tiers = Object.fromEntries(generations.map(g => [g.tier, g.name]));
+  const configSource = [...generations].reverse().find(g => g.files.includes('config.json'));
+  let config: Record<string, unknown> | undefined;
+  let hq = '-';
+  if (!options.dryRun && configSource) {
+    config = objectConfig(checkedFile(configSource.dir, 'config.json'));
+    config.telegram = pollerOff(config.telegram);
+    config.discord = pollerOff(config.discord);
+    if (options.hqConfig) {
+      const hostConfig = objectConfig(join(options.hqConfig, 'config.json'));
+      const block = hostConfig.hq;
+      if (!block || typeof block !== 'object' || Array.isArray(block) || typeof (block as Record<string, unknown>).hostName !== 'string' || !(block as Record<string, unknown>).hostName) throw new Error('--hq-config has no hq.hostName');
+      config.hq = block;
+      hq = (block as { hostName: string }).hostName;
+    }
+  }
+  const summary = { to, tiers, files, features: generations.some(g => g.files.includes('release/features.sqlite')) ? 'yes' as const : 'no' as const, pollers: 'off' as const, hq, seconds: 0, dryRun: options.dryRun };
+  if (options.dryRun) return summary;
+  mkdirSync(to, { mode: 0o700 });
+  try {
+    chmodSync(to, 0o700);
+    for (const generation of generations) {
+      for (const name of generation.files) {
+        const source = checkedFile(generation.dir, name);
+        const dest = contained(to, name);
+        mkdirSync(dirname(dest), { recursive: true, mode: 0o700 });
+        copyFileSync(source, dest);
+        const stats = statSync(source);
+        chmodSync(dest, stats.mode);
+        utimesSync(dest, stats.atime, stats.mtime);
+      }
+    }
+    if (config && configSource) {
+      copyFileSync(join(to, 'config.json'), join(to, 'config.json.pre-promote'));
+      writeConfig(join(to, 'config.json'), `${JSON.stringify(config, null, 2)}\n`);
+    }
+    summary.seconds = Math.round((Date.now() - started) / 1000);
+    return summary;
+  } catch (error) {
+    rmSync(to, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+if (import.meta.main) {
+  let options: Options | undefined;
+  try {
+    options = parsePromoteArgs(process.argv.slice(2));
+    const result = await promote(options);
+    if (!result.dryRun) debug.log('hq.standby', 'promoted', { tiers: result.tiers, files: result.files, reason: 'promoted' });
+    console.log(options.json ? JSON.stringify(result) : result.dryRun
+      ? `promotion plan ${result.to} ${Object.entries(result.tiers).map(([t, g]) => `${t}=${g}`).join(' ')} files=${result.files}`
+      : `promoted ${result.to} core=${result.tiers.core ?? '-'} big=${result.tiers.big ?? '-'} files=${result.files} features=${result.features} pollers=off hq=${result.hq} ${result.seconds}s`);
+  } catch (error) {
+    const reason = String(error);
+    debug.log('hq.standby', 'promote-refused', { tiers: options?.tiers ?? [], files: 0, reason });
+    console.error(`promotion refused: ${reason}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/hq/standby-role.ts

@@ -0,0 +1,59 @@
+#!/usr/bin/env bun
+// HQ-REP direction — which way does this host replicate? (OP 10-04 10:09 · «되돌리기 방향»)
+// The lease holder is the source and the other host is the standby: once node-b holds the lease, node-b → mbp.
+//   · a lease record exists, or the arbiter cannot be read → `fenced`: the caller runs the copy under
+//     `elanous hq fence --role cron`, which alone decides (holder · generation · arbiter-down rules, src/hq/lease.ts).
+//   · no lease record yet (before HQ-HB acquires one) → `direct` on the default source host only, `skip` elsewhere,
+//     so the mbp → node-b copy keeps running until the first lease exists (OP 10:12 bootstrap rule).
+//   · TC 10:12: a host that has ever seen a lease generation treats a missing record as «unknown» and skips — otherwise
+//     a lost arbiter file after the drill would turn mbp back into the source while node-b is HQ (split-brain).
+//     «Seen» = `~/.elanous-hq/seen-generation` (HQ-HB writes it) or a generation in the local lease state (hq/local.json).
+// Usage: bun scripts/hq/standby-role.ts --default-source <host> [--config-dir <dir>] [--me <host>] [--json]   → prints `direct` | `fenced` | `skip`
+import { existsSync } from 'node:fs';
+import { homedir, hostname } from 'node:os';
+import { join } from 'node:path';
+import { debug } from '../../src/debug/log.js';
+import { getElanousConfigDir, setElanousConfigDir } from '../../src/elanous-config-dir.js';
+import { hqLease, readLocal } from '../../src/hq/hq.js';
+import { getUserConfig } from '../../src/user-config.js';
+import type { LeaseRecord } from '../../src/hq/lease.js';
+
+export type ReplicationRole = 'direct' | 'fenced' | 'skip';
+export interface RoleDecision { role: ReplicationRole; reason: 'lease-exists' | 'lease-unreadable' | 'no-lease-default-source' | 'no-lease-not-default' | 'no-lease-after-seen'; holder?: string }
+
+/** `defaultSource` may list aliases (`MacBookProM5,mbp`) — the lease name is `hq.hostName` when set, else the OS host name. */
+export function decideReplicationRole(input: { me: string; defaultSource: string; record: LeaseRecord | null | 'unreadable'; seenGeneration?: boolean }): RoleDecision {
+  const { me, defaultSource, record } = input;
+  if (record === 'unreadable') return { role: 'fenced', reason: 'lease-unreadable' };
+  if (record) return { role: 'fenced', reason: 'lease-exists', holder: record.holder };
+  if (input.seenGeneration) return { role: 'skip', reason: 'no-lease-after-seen' };
+  const aliases = defaultSource.split(',').map(s => s.trim()).filter(Boolean);
+  return aliases.includes(me) ? { role: 'direct', reason: 'no-lease-default-source' } : { role: 'skip', reason: 'no-lease-not-default' };
+}
+
+/** Has this host ever seen a lease generation? (TC 10:12 · see the header.) */
+export function hasSeenGeneration(home: string = homedir(), localPath: string = join(getElanousConfigDir(), 'hq', 'local.json')): boolean {
+  if (existsSync(join(home, '.elanous-hq', 'seen-generation'))) return true;
+  return typeof readLocal(localPath).generation === 'number';
+}
+
+/** Same host name the lease uses (src/hq/hq.ts resolve): `hq.hostName`, else the OS host name without `.local`. */
+export function leaseHostName(configured: string | undefined = getUserConfig().hq?.hostName, raw: string = hostname()): string {
+  return configured ?? raw.replace(/\.local$/, '');
+}
+
+if (import.meta.main) {
+  const argv = process.argv.slice(2);
+  const arg = (name: string) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : undefined; };
+  const defaultSource = arg('--default-source');
+  if (!defaultSource) { console.error('standby-role: --default-source <host> required'); process.exit(2); }
+  // Same lease name and local state as HQ-HB: the config dir moves only by this setter (an env var is ignored).
+  const configDir = arg('--config-dir');
+  if (configDir) setElanousConfigDir(configDir);
+  const me = arg('--me') ?? leaseHostName();
+  let record: LeaseRecord | null | 'unreadable';
+  try { record = hqLease('status').record; } catch { record = 'unreadable'; }
+  const decided = decideReplicationRole({ me, defaultSource, record, seenGeneration: hasSeenGeneration() });
+  debug.log('hq.standby', 'role', { me, defaultSource, ...decided });
+  console.log(argv.includes('--json') ? JSON.stringify({ me, defaultSource, ...decided }) : decided.role);
+}