elanous 0.2.11 → 0.2.13

package/src/seat-loop/seat-loop.ts

@@ -1,5 +1,5 @@
 import { execFile } from 'node:child_process';
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
 import { Database } from 'bun:sqlite';
 import { dirname, join, resolve } from 'node:path';
@@ -8,16 +8,18 @@ import { TRACK_AGENT_FORBIDDEN_ACTION_REGEX, universeLaunch } from '../autopilot
 import { debug } from '../debug/log.js';
 import { DecisionLedger, type DecisionEntry } from '../decisions/decision-ledger.js';
 import { effectiveInstanceRoot, releaseLedgerRoot } from '../instance/resolve.js';
+import { loopEvent } from '../loops/observe.js';
 import { getUserConfig, type PersonaLoopConfig, type SeatLoopConfig, type UserConfig } from '../user-config.js';
 import { checkSeatBudget, type RunningSeatPod } from '../org/seat-budget.js';
 import { DEFAULT_STALL_PARENTS, findStalls } from '../org/stall-escalation.js';
 import { openMsgStore, type MessageEnvelope } from '../msg/msg-store.js';
 import { loadLayeredPersonaDirs, resolveRepositoryPersonaDir, resolveStatePersonaDir } from '../persona/global-registry.js';
-import { nextPersonaTodo, personaTodoPath, readPersonaTodos, type PersonaTodo } from '../persona/persona-todo.js';
+import { orderedPersonaTodos, personaTodoPath, readPersonaTodos, type PersonaTodo } from '../persona/persona-todo.js';
 import { PersonaRegistry } from '../persona/registry.js';
+import { recordSeatAskShadow } from '../seat-dispatch/seat-ask.js';
 import { answerSeat, askSeat, deliveredSeatQuestion, hasSeatAnswer, isSeatId, seatQuestions, type SeatId } from '../seat-dispatch/seat-questions.js';
 import { queryRunningRuns } from '../self-implement/running-runs.js';
-import { listChecklist, type Checklist } from '../release-loop/checklist.js';
+import { checklistHistory, listChecklist, type Checklist } from '../release-loop/checklist.js';
 import { readSchedules, releasedVersion } from '../release-loop/feature-store.js';
 
 // `kind`/`createdAt` are the V3 shadow-compare keys (내부 문서 `METHOD-v3-shadow-compare-2026-10-02` · MK 10-02 18:54).
@@ -31,9 +33,14 @@ export type OpCandidate =
   | { kind: 'release-readiness'; version: string | null; verdict: 'ready' | 'not-ready' | 'no-open-release'; cutAt?: string; landBy?: string | null; red: string[]; undecided: string[]; blocked: string[] }
   | { kind: 'unassigned-cell'; version: string | null; id: string | null; title?: string; status?: string; verdict: 'assign' | 'none' }
   | { kind: 'decision-delegation'; id: string | null; title?: string; category?: DecisionEntry['category']; dueAt?: string; verdict: 'review-delegation' | 'none' };
-export type SeatEntry = { seat: string; ts?: string; at: string; status: 'shadow' | 'attempting' | 'outcome-unknown' | 'launched' | 'hitl' | 'wait' | 'asked' | 'answered' | 'awaiting-answer' | 'skipped-budget' | 'skipped-empty'; item?: SeatItem; candidate?: OpCandidate; action?: SeatAction; reason?: string; runId?: string; inquiry?: SeatInquiry; answer?: string; escalated?: boolean };
+export type TcCandidate =
+  | { kind: 'merged-pr-yellow-cell'; version: string; id: string; title: string; pr: number; mergedAt: string }
+  | { kind: 'publication-pr-approval-wait'; pr: number; title: string; readyAt: string; approvalWaitAt: string; paths: string[] }
+  | { kind: 'other-seat-cell-defect'; version: string; id: string; title: string; to: SeatId };
+export type TcPullRequest = { number: number; title: string; body?: string; state: 'OPEN' | 'MERGED' | 'CLOSED'; isDraft: boolean; createdAt: string; updatedAt?: string; mergedAt?: string | null; readyAt?: string; approvalWaitAt?: string; paths?: string[]; reviewDecision?: string };
+export type SeatEntry = { seat: string; ts?: string; at: string; status: 'shadow' | 'attempting' | 'outcome-unknown' | 'launched' | 'hitl' | 'wait' | 'asked' | 'answered' | 'awaiting-answer' | 'skipped-budget' | 'skipped-empty'; item?: SeatItem; candidate?: OpCandidate | TcCandidate; action?: SeatAction; reason?: string; runId?: string; inquiry?: SeatInquiry; answer?: string; escalated?: boolean };
 export type SeatLoopResult = SeatEntry | { seat: string; status: 'skipped-off' };
-export type PersonaShadowEntry = { personaId: string; ts: string; status: 'shadow' | 'skipped-empty'; todo: PersonaTodo | null };
+export type PersonaShadowEntry = { personaId: string; ts: string; status: 'shadow' | 'skipped-empty'; todo: PersonaTodo | null; action?: 'decision' | 'harness' | 'wait'; what?: string };
 export type SeatDeps = {
   personaConfig?: PersonaLoopConfig;
   personaRegistry?: PersonaRegistry;
@@ -54,12 +61,16 @@ export type SeatDeps = {
   schedules?: () => Array<{ version: string; cutAt: string; landBy?: string | null }>;
   /** Checklist items of one version — default reads the release ledger DB (checklist.json is only a legacy import source since REL5b). */
   checklistItems?: (version: string) => Array<{ id: string; title: string; status: string; owner?: string | null; disposition?: string; evidence?: string }>;
+  /** Chronological release-ledger events for a checklist id; injected for isolated release fixtures. */
+  checklistHistory?: (id: string) => ReturnType<typeof checklistHistory>;
   /** Full checklist snapshot including history, for stall detection. */
   stallChecklist?: (version: string) => Checklist;
   /** Inject a mailbox write for isolated failure tests; production uses the seat message store. */
   stallDelivery?: (message: MessageEnvelope, key: string, root: string) => boolean;
   /** Open cards from the decision ledger; injected only for isolated ledger tests. */
   pendingDecisions?: () => Array<Pick<DecisionEntry, 'id' | 'title' | 'category' | 'dueAt'>>;
+  /** Read-only PR snapshot for TC judgment; defaults to GitHub CLI reads. */
+  pullRequests?: () => Promise<TcPullRequest[]>;
   ledgerFiles?: (directory: string) => string[];
   lockContended?: () => void;
   /** Supply a question only when this seat lacks evidence for the selected work item. */
@@ -126,8 +137,17 @@ export function personaShadowLedgerPath(personaId: string, root: string, now: Da
   return join(root, 'persona-loop', personaId, `${seatDay(now)}.jsonl`);
 }
 
+export async function runPersonaLoopOnce(name: string, deps: SeatDeps = {}): Promise<PersonaShadowEntry> {
+  const entries = await pickPersonaShadows(deps, name);
+  return entries[0]!;
+}
+
 export async function runPersonaShadowOnce(deps: SeatDeps = {}): Promise<PersonaShadowEntry[]> {
   if ((deps.personaConfig ?? getUserConfig().loops?.persona)?.enabled !== true) return [];
+  return pickPersonaShadows(deps);
+}
+
+async function pickPersonaShadows(deps: SeatDeps, name?: string): Promise<PersonaShadowEntry[]> {
   const root = deps.root ?? effectiveInstanceRoot();
   const dir = deps.personaDir ?? (deps.root ? join(root, 'personas') : resolveStatePersonaDir());
   const registry = deps.personaRegistry ?? new PersonaRegistry();
@@ -137,19 +157,31 @@ export async function runPersonaShadowOnce(deps: SeatDeps = {}): Promise<Persona
   }
   const now = (deps.now ?? (() => new Date()))();
   const entries: PersonaShadowEntry[] = [];
-  for (const profile of registry.list().sort((a, b) => a.personaId.localeCompare(b.personaId))) {
+  const profiles = registry.list().sort((a, b) => a.personaId.localeCompare(b.personaId));
+  const selected = name === undefined ? profiles : profiles.filter((profile) => profile.personaId.toLowerCase() === name.trim().toLowerCase()
+    || profile.displayName.toLowerCase() === name.trim().toLowerCase());
+  if (name !== undefined && selected.length !== 1) throw new Error(selected.length ? `ambiguous persona name: ${name}` : `persona not found: ${name}`);
+  for (const profile of selected) {
     const personaId = profile.personaId;
-    const { todos, errors } = readPersonaTodos(dir, personaId);
+    const todoFile = profile.todo ?? `${personaId}.todo.jsonl`;
+    const { todos, errors } = readPersonaTodos(dir, todoFile.slice(0, -'.todo.jsonl'.length));
     for (const error of errors) observe('persona-todo-error', { personaId, error });
-    const todo = nextPersonaTodo(todos);
-    const entry: PersonaShadowEntry = { personaId, ts: now.toISOString(), status: todo ? 'shadow' : 'skipped-empty', todo };
+    const candidates = orderedPersonaTodos(todos);
+    const picked = pickNext({ requests: candidates.map((candidate) => ({
+      source: 'request', id: candidate.id, title: candidate.title, text: candidate.title, createdAt: candidate.createdAt,
+    })), checklist: [], role: '' }, [], { shadow: true });
+    const todo = picked ? candidates.find((candidate) => candidate.id === picked.id) ?? null : null;
+    const planned = name !== undefined && todo && picked ? planAction(picked, profile.seat) : undefined;
+    const entry: PersonaShadowEntry = { personaId, ts: now.toISOString(), status: todo ? 'shadow' : 'skipped-empty', todo,
+      ...(planned ? { action: planned.kind, what: planned.text } : {}) };
     const path = personaShadowLedgerPath(personaId, root, now);
     if (deps.appendPersona) deps.appendPersona(path, entry);
     else {
       mkdirSync(dirname(path), { recursive: true });
       appendFileSync(path, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
     }
-    observe('persona-shadow', { personaId, status: entry.status, todoId: todo?.id ?? null });
+    try { debug.log('persona.loop', 'picked', { personaId, status: entry.status, todoId: todo?.id ?? null, title: todo?.title ?? null, action: entry.action ?? null }); }
+    catch { /* observation cannot alter the shadow ledger */ }
     entries.push(entry);
   }
   return entries;
@@ -159,6 +191,25 @@ export async function runSeatLoopTurn(seat: string, deps: SeatDeps = {}): Promis
   const result = await runSeatLoopOnce(seat, deps);
   try { await runPersonaShadowOnce(deps); }
   catch (error) { observe('persona-shadow-error', { error: String(error).slice(0, 200) }); }
+  try {
+    const config = deps.config ?? getUserConfig().loops?.seat ?? { mode: 'off' };
+    const profile = result.status === 'skipped-off' ? 'off' : config.mode;
+    const context = { runId: 'runId' in result && result.runId ? result.runId : `seat-turn-${randomUUID()}`,
+      profile, sourceRef: `docs/roles/${seat}.md` };
+    const loopId = `${seat.toLowerCase()}-seat`;
+    loopEvent(loopId, 'tick', { ...context, outcome: result.status, reason: result.status });
+    if ('inquiry' in result && result.inquiry && (result.status === 'asked' || result.status === 'hitl')) {
+      loopEvent(loopId, 'exchange', { ...context, outcome: result.status, reason: 'delegation',
+        from: seat, to: result.inquiry.to, itemId: result.item?.id });
+    }
+    if ('escalated' in result && result.escalated && result.status === 'skipped-budget') {
+      loopEvent(loopId, 'exchange', { ...context, outcome: result.status, reason: 'delegation',
+        from: seat, to: (config.stall?.parents ?? {})[seat] ?? DEFAULT_STALL_PARENTS[seat], itemId: result.item?.id });
+    } else if (result.status === 'skipped-budget') {
+      loopEvent(loopId, 'exchange', { ...context, outcome: result.status, reason: 'requeue',
+        itemId: result.item?.id });
+    }
+  } catch { /* observation cannot change a completed seat turn */ }
   return result;
 }
 
@@ -190,6 +241,8 @@ function decisionReceipt(root: string, seat: string, item: SeatItem): DecisionEn
 function handledKeys(ledger: readonly SeatEntry[], shadow: boolean, root?: string): Set<string> {
   const inquiryRow = (entry: SeatEntry) => entry.action === 'seat-question' || entry.action === 'seat-answer' || !!entry.inquiry;
   return new Set(ledger.filter((entry, index) => entry.status === 'asked' || entry.status === 'answered'
+    // RM3a: only TC's other-seat defect ask-shadows are deduplicated here — an ordinary inquiry recorded in shadow must still be delivered once questions turn on.
+    || (entry.status === 'shadow' && entry.candidate?.kind === 'other-seat-cell-defect')
     || (entry.status === 'hitl' && (!entry.inquiry || (!!root && !!entry.item && !!decisionReceipt(root, entry.seat, entry.item))))
     || (entry.inquiry?.to === 'CEO' && !!root && !!entry.item && !!decisionReceipt(root, entry.seat, entry.item))
     || (!inquiryRow(entry) && entry.status === 'outcome-unknown')
@@ -211,17 +264,19 @@ function eligibleItem(item: SeatItem, ledger: readonly SeatEntry[], handled: Rea
   return !lastWait?.item || itemSnapshot(lastWait.item) !== itemSnapshot(item);
 }
 
-// Compare checklist snapshots without consulting release history or treating a version move as new work.
+const CHECKLIST_HANDLED_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;
+
+// Same-version snapshots are handled here; carried work requires an explicit release-ledger move.
 export function alreadyHandled(item: SeatItem, ledger: readonly SeatEntry[]): boolean {
   if (item.source !== 'checklist' || !item.seat || !item.asOf || item.evidenceHash === undefined) return false;
   const now = Date.parse(item.asOf);
   if (!Number.isFinite(now)) return false;
   return ledger.some((entry) => {
     const at = Date.parse(entry.at || entry.ts || '');
-    return entry.seat === item.seat && at >= now - 7 * 24 * 60 * 60 * 1000 && at <= now
+    return entry.seat === item.seat && at >= now - CHECKLIST_HANDLED_WINDOW_MS && at <= now
       // A shadowed seat question was never delivered — it must be picked again once delivery is on (RM3 · TC merge 10-03).
       && (entry.status === 'launched' || (entry.status === 'shadow' && !entry.inquiry))
-      && entry.item?.source === 'checklist' && entry.item.id === item.id
+      && entry.item?.source === 'checklist' && entry.item.id === item.id && entry.item.version === item.version
       && entry.item.title === item.title && entry.item.evidenceHash === item.evidenceHash;
   });
 }
@@ -293,9 +348,10 @@ export async function gatherSeatInputs(seat: string, deps: SeatDeps = {}, ledger
     debug.log('seat.loop', 'schedule-unreadable', { seat, error: String(error).slice(0, 200) });
   }
   const checklist: SeatItem[] = [];
+  const closed: string[] = [];
   for (const version of open === null ? [] : versions().sort(versionOrder)) {
     if (!open!.has(version)) {
-      debug.log('seat.loop', 'skip-closed-version', { seat, version });
+      closed.push(version);
       continue;
     }
     let items: ReturnType<typeof itemsOf>;
@@ -315,6 +371,9 @@ export async function gatherSeatInputs(seat: string, deps: SeatDeps = {}, ledger
       }
     }
   }
+  if (closed.length > 0) {
+    debug.log('seat.loop', 'skip-closed-versions', { seat, count: closed.length, newest: closed.at(-1)!, oldest: closed[0]! });
+  }
   checklist.sort((a, b) => versionOrder(a.version!, b.version!) || a.id.localeCompare(b.id));
   return { requests: pending, checklist, role: read(join(deps.repo ?? repoRoot, 'docs', 'roles', `${seat}.md`)).slice(0, 4_000) };
 }
@@ -357,6 +416,137 @@ function opCandidates(deps: SeatDeps, now: Date): OpCandidate[] {
   ];
 }
 
+const TC_APPROVAL_WAIT_MS = 2 * 60 * 60 * 1000;
+
+function readTcChecklist(root: string): Array<{ version: string; id: string; title: string; status: string; owner: string | null }> {
+  const path = join(root, 'release', 'features.sqlite');
+  if (!existsSync(path)) return [];
+  const db = new Database(path, { readonly: true, strict: true });
+  try {
+    return db.query(`SELECT a.version, f.id, COALESCE(a.title_override, f.title) AS title, a.status, a.owner
+      FROM assignments a JOIN features f ON f.id = a.feature_id WHERE a.status IN ('yellow', 'red') AND a.owner IN ('OP', 'TC', 'MK', 'UX')
+      ORDER BY a.version, f.id`).all() as Array<{ version: string; id: string; title: string; status: string; owner: string | null }>;
+  } finally { db.close(); }
+}
+
+type TcTimelineEvent = { event: string; created_at: string };
+
+export function tcApprovalWaitAt(pr: TcPullRequest, timeline: readonly TcTimelineEvent[]): { readyAt: string; approvalWaitAt: string } | undefined {
+  if (pr.state !== 'OPEN' || pr.isDraft || pr.reviewDecision !== 'REVIEW_REQUIRED') return undefined;
+  const events = timeline.filter((event) => typeof event.created_at === 'string' && Number.isFinite(Date.parse(event.created_at)))
+    .sort((a, b) => Date.parse(a.created_at) - Date.parse(b.created_at));
+  let readyAt: string | undefined = pr.createdAt;
+  let waitAt: string | undefined = pr.createdAt;
+  for (const event of events) {
+    if (event.event === 'converted_to_draft') { readyAt = undefined; waitAt = undefined; }
+    if (event.event === 'ready_for_review') { readyAt = event.created_at; waitAt = event.created_at; }
+    if (event.event === 'review_requested' && readyAt && Date.parse(event.created_at) >= Date.parse(readyAt)) waitAt = event.created_at;
+  }
+  return readyAt && waitAt && Number.isFinite(Date.parse(readyAt)) && Date.parse(waitAt) >= Date.parse(readyAt)
+    ? { readyAt, approvalWaitAt: waitAt } : undefined;
+}
+
+export async function readTcPullRequests(query: (args: string[]) => Promise<string> = async (args) => {
+  const { stdout } = await exec('gh', args, { cwd: repoRoot, encoding: 'utf8', timeout: 120_000, maxBuffer: 64 * 1024 * 1024 });
+  return stdout;
+}): Promise<TcPullRequest[]> {
+  const pages: unknown = JSON.parse(await query(['api', '--paginate', '--slurp', 'repos/{owner}/{repo}/pulls?state=all&per_page=100']));
+  if (!Array.isArray(pages) || !pages.every((page) => Array.isArray(page))) throw new Error('PR list is not an array of pages');
+  const prs = pages.flatMap((page: unknown[]) => page).filter((pr) => pr && typeof pr === 'object'
+    && ((pr as Record<string, unknown>).state === 'open' || typeof (pr as Record<string, unknown>).merged_at === 'string'));
+  const results: TcPullRequest[] = [];
+  for (let offset = 0; offset < prs.length; offset += 10) {
+    results.push(...await Promise.all(prs.slice(offset, offset + 10).map(async (pr): Promise<TcPullRequest> => {
+    const listing = pr as Record<string, unknown>;
+    if (typeof listing.number !== 'number' || typeof listing.title !== 'string' || typeof listing.created_at !== 'string'
+      || typeof listing.draft !== 'boolean' || (listing.state !== 'open' && listing.state !== 'closed')) {
+      throw new Error('incomplete PR record');
+    }
+    const details: unknown = listing.state === 'open'
+      ? JSON.parse(await query(['pr', 'view', String(listing.number), '--json', 'number,title,body,state,isDraft,createdAt,mergedAt,files,reviewDecision']))
+      : { number: listing.number, title: listing.title, body: listing.body, state: 'MERGED', isDraft: listing.draft,
+        createdAt: listing.created_at, mergedAt: listing.merged_at, files: [] };
+    if (!details || typeof details !== 'object' || Array.isArray(details)) throw new Error('invalid PR record');
+    const row = details as Record<string, unknown>;
+    if (typeof row.number !== 'number' || typeof row.title !== 'string' || typeof row.createdAt !== 'string'
+      || typeof row.isDraft !== 'boolean' || (row.state !== 'OPEN' && row.state !== 'MERGED' && row.state !== 'CLOSED')) {
+      throw new Error('incomplete PR record');
+    }
+    const paths = Array.isArray(row.files) ? row.files.flatMap((file: unknown) =>
+      file && typeof file === 'object' && typeof (file as { path?: unknown }).path === 'string' ? [(file as { path: string }).path] : []) : [];
+    const result: TcPullRequest = { number: row.number, title: row.title, body: typeof row.body === 'string' ? row.body : '',
+      state: row.state, isDraft: row.isDraft, createdAt: row.createdAt,
+      mergedAt: typeof row.mergedAt === 'string' ? row.mergedAt : null, paths,
+      reviewDecision: typeof row.reviewDecision === 'string' ? row.reviewDecision : undefined };
+    if (result.state === 'OPEN' && !result.isDraft && result.reviewDecision === 'REVIEW_REQUIRED'
+      && paths.some((path) => path.startsWith('release/public/') || path.startsWith('scripts/public-export') || path.startsWith('src/market/'))) {
+      try {
+        const pages: unknown = JSON.parse(await query(['api', '--paginate', '--slurp', `repos/{owner}/{repo}/issues/${result.number}/timeline`]));
+        if (!Array.isArray(pages) || !pages.every((page) => Array.isArray(page))) throw new Error('PR timeline is not an array of pages');
+        const timeline: unknown[] = pages.flatMap((page: unknown[]) => page);
+        const transitions = timeline.filter((event): event is Record<string, unknown> => event !== null && typeof event === 'object'
+          && ['converted_to_draft', 'ready_for_review', 'review_requested'].includes((event as Record<string, unknown>).event as string));
+        if (!transitions.every((event) => typeof event.created_at === 'string' && Number.isFinite(Date.parse(event.created_at)))) {
+          throw new Error('invalid PR timeline transition date');
+        }
+        Object.assign(result, tcApprovalWaitAt(result, transitions as TcTimelineEvent[]));
+      } catch (error) { observe('tc-pr-timeline-unreadable', { pr: result.number, error: String(error).slice(0, 200) }); }
+    }
+    return result;
+    })));
+  }
+  return results;
+}
+
+async function tcCandidates(deps: SeatDeps, now: Date): Promise<TcCandidate[]> {
+  let prs: TcPullRequest[];
+  // An injected instance root must not fetch unrelated live GitHub state.
+  try { prs = await (deps.pullRequests ?? (deps.root ? async () => [] : readTcPullRequests))(); }
+  catch (error) {
+    observe('tc-pr-unreadable', { seat: 'TC', error: String(error).slice(0, 200) });
+    return [];
+  }
+  const merged = prs.filter((pr) => pr.state === 'MERGED' && pr.mergedAt && Number.isFinite(Date.parse(pr.mergedAt)) && Date.parse(pr.mergedAt) <= now.getTime());
+  const candidates: TcCandidate[] = [];
+  const releaseRoot = deps.root ?? releaseLedgerRoot();
+  try {
+    const cells = deps.checklistItems && deps.schedules
+      ? deps.schedules().flatMap(({ version }) => deps.checklistItems!(version).map((cell) => ({ ...cell, version })))
+      : readTcChecklist(releaseRoot);
+    let shipped: string | undefined;
+    try { shipped = releasedVersion(releaseRoot); }
+    catch (error) { observe('tc-release-unreadable', { seat: 'TC', error: String(error).slice(0, 200) }); }
+    const openVersions = deps.schedules ? new Set(deps.schedules().filter(({ cutAt }) => Number.isFinite(Date.parse(cutAt))
+      && Date.parse(cutAt) > now.getTime()).map(({ version }) => version)) : null;
+    for (const cell of cells) {
+      if (cell.owner !== 'TC' && ((shipped && versionOrder(cell.version, shipped) <= 0) || (openVersions && !openVersions.has(cell.version)))) continue;
+      if (cell.status !== 'yellow' && cell.status !== 'red') continue;
+      if (!cell.owner || !isSeatId(cell.owner)) continue;
+      if (cell.owner !== 'TC') {
+        if (cell.status === 'red') candidates.push({ kind: 'other-seat-cell-defect', version: cell.version, id: cell.id, title: cell.title, to: cell.owner });
+        continue;
+      }
+      for (const pr of merged) {
+        const id = cell.id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const reference = new RegExp(`(?<![A-Za-z0-9])${id}(?![A-Za-z0-9])`);
+        if (reference.test(pr.title) || reference.test(pr.body ?? '')) {
+          if (cell.owner === 'TC' && cell.status === 'yellow') candidates.push({ kind: 'merged-pr-yellow-cell', version: cell.version, id: cell.id, title: cell.title, pr: pr.number, mergedAt: pr.mergedAt! });
+        }
+      }
+    }
+  } catch (error) { observe('tc-checklist-unreadable', { seat: 'TC', error: String(error).slice(0, 200) }); }
+  for (const pr of prs) {
+    if (pr.state !== 'OPEN' || pr.isDraft || pr.reviewDecision !== 'REVIEW_REQUIRED'
+      || !pr.paths?.some((path) => path.startsWith('release/public/') || path.startsWith('scripts/public-export') || path.startsWith('src/market/'))) continue;
+    const readyAt = pr.readyAt;
+    const age = now.getTime() - Date.parse(pr.approvalWaitAt ?? '');
+    if (!readyAt || !Number.isFinite(Date.parse(readyAt)) || Date.parse(readyAt) > now.getTime()
+      || !Number.isFinite(age) || age < TC_APPROVAL_WAIT_MS) continue;
+    candidates.push({ kind: 'publication-pr-approval-wait', pr: pr.number, title: pr.title, readyAt, approvalWaitAt: pr.approvalWaitAt!, paths: pr.paths });
+  }
+  return candidates;
+}
+
 function deliverStall(message: MessageEnvelope, key: string, root: string): boolean {
   const store = openMsgStore(join(root, 'msg', 'messages.db'));
   try {
@@ -411,13 +601,34 @@ function escalateStalls(seat: string, deps: SeatDeps, config: SeatLoopConfig, no
 }
 
 // In shadow mode a shadowed item counts as handled, so a rehearsal day walks the queue like the seat would.
-export function pickNext(inputs: SeatInputs, ledger: readonly SeatEntry[], opts: { shadow?: boolean; root?: string } = {}): SeatItem | null {
+export function pickNext(inputs: SeatInputs, ledger: readonly SeatEntry[], opts: { shadow?: boolean; root?: string; history?: SeatDeps['checklistHistory'] } = {}): SeatItem | null {
   const handled = handledKeys(ledger, opts.shadow === true, opts.root);
   return [...inputs.requests, ...inputs.checklist].find((item) => {
     if (alreadyHandled(item, ledger)) {
       debug.log('seat.loop', 'skip-handled', { id: item.id });
       return false;
     }
+    if (item.source === 'checklist' && item.version && item.seat && item.asOf && item.evidenceHash !== undefined && opts.history
+      && ledger.some((entry) => entry.seat === item.seat && entry.status === 'shadow'
+        && entry.item?.source === 'checklist' && entry.item.id === item.id && entry.item.version !== item.version)) {
+      // Only an actual move into this version identifies a carried cell; unrelated releases may reuse an id.
+      const moves = opts.history(item.id).filter((event) => event.field === 'move'
+        && typeof event.from === 'string' && typeof event.to === 'string' && Date.parse(event.at) <= Date.parse(item.asOf!));
+      const latest = moves.at(-1);
+      if (latest?.to === item.version) {
+        const processed = [...ledger].reverse().find((entry) => entry.seat === item.seat
+          && entry.status === 'shadow' && !entry.inquiry && entry.action !== 'wait'
+          && entry.item?.source === 'checklist' && entry.item.id === item.id);
+        if (processed && processed.item && processed.item.version === latest.from && processed.item.title === item.title
+          && processed.item.evidenceHash === item.evidenceHash
+          && Date.parse(processed.at || processed.ts || '') >= Date.parse(item.asOf) - CHECKLIST_HANDLED_WINDOW_MS
+          && Date.parse(processed.at || processed.ts || '') <= Date.parse(item.asOf)
+          && Date.parse(processed.at || processed.ts || '') <= Date.parse(latest.at)) {
+          debug.log('seat.loop', 'skip-carried', { id: item.id, from: latest.from, version: item.version });
+          return false;
+        }
+      }
+    }
     return eligibleItem(item, ledger, handled, opts.shadow === true);
   }) ?? null;
 }
@@ -470,6 +681,29 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
   const stateRoot = deps.root ?? effectiveInstanceRoot();
   let turnError: unknown;
   try {
+  if (seat === 'TC') {
+    const candidates = await tcCandidates(deps, now);
+    for (const candidate of candidates) {
+      if (candidate.kind === 'other-seat-cell-defect') {
+        const question = `${candidate.version} 체크리스트 ${candidate.id} · ${candidate.title}: ${candidate.to} 칸 결함을 확인해 주세요.`;
+        const recorded = recordSeatAskShadow(stateRoot, { from: 'TC', to: candidate.to, itemId: candidate.id, version: candidate.version, question }, now.getTime());
+        const inLedger = ledger.some((row) => row.status === 'shadow' && row.candidate?.kind === 'other-seat-cell-defect'
+          && row.candidate.version === candidate.version && row.candidate.id === candidate.id && row.candidate.to === candidate.to);
+        if (!inLedger) {
+          const entry: SeatEntry = { seat, ts: now.toISOString(), at: now.toISOString(), status: 'shadow', candidate,
+            item: { source: 'checklist', kind: 'cell', id: candidate.id, title: candidate.title, text: candidate.title, version: candidate.version, seat: candidate.to },
+            action: 'seat-question', inquiry: { to: candidate.to, question } };
+          (deps.append ?? defaultAppend)(path, entry);
+        }
+        if (!inLedger || recorded) observe('ask-shadow', { from: seat, to: candidate.to, itemId: candidate.id });
+        continue;
+      }
+      if (ledger.some((row) => row.status === 'shadow' && JSON.stringify(row.candidate) === JSON.stringify(candidate))) continue;
+      const entry: SeatEntry = { seat, ts: now.toISOString(), at: now.toISOString(), status: 'shadow', candidate };
+      (deps.append ?? defaultAppend)(path, entry);
+      observe('tc-shadow-candidate', { seat, candidate });
+    }
+  }
   if (seat === 'OP' && !seatQuestions(stateRoot, 'OP').some((question) =>
     !hasSeatAnswer(stateRoot, question)
     && !handledKeys(ledger, config.mode !== 'on' || (config.questions ?? 'shadow') !== 'on', stateRoot).has(`seat-question::${question.id}`))) {
@@ -526,7 +760,8 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
   const questionsMode = config.mode === 'on' ? config.questions ?? 'shadow' : 'shadow';
   const questionHandled = handledKeys(ledger, questionsMode !== 'on', stateRoot);
   const pendingQuestion = inputs.requests.find((candidate) => candidate.source === 'seat-question' && !questionHandled.has(itemKey(candidate)));
-  const ordinary = pickNext({ ...inputs, requests: inputs.requests.filter((candidate) => candidate.source !== 'seat-question') }, ledger, { shadow: config.mode === 'shadow', root: stateRoot });
+  const ordinary = pickNext({ ...inputs, requests: inputs.requests.filter((candidate) => candidate.source !== 'seat-question') }, ledger,
+    { shadow: config.mode === 'shadow', root: stateRoot, history: deps.checklistHistory ?? checklistHistory });
   const item = pendingQuestion ?? ordinary;
   const append = deps.append ?? defaultAppend;
   // RM3 review must-fix: `questions` now has a default, so it can't be the trigger — a shadow seat loop never calls the model on its own.
@@ -600,7 +835,7 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
               await run(['decisions', 'raise', '--title', `${seat}: ${ask.question}`, '--category', 'other',
                 '--s', `${seat} 질문 · ${item.title}`, '--c', '판단 근거 부족 — 사람의 결정이 필요하다',
                 '--option', 'a=승인:사람 판단으로 진행', '--option', 'b=보류:진행하지 않음',
-                '--skip-recommend', '근거가 부족하다', '--agent', 'seat-loop', '--ref', decisionRef(seat, item), '--json']);
+                '--skip-recommend', '근거가 부족하다', '--no-xcheck', '자리 루프 · 이웃 교환은 DEC-XCHECK ②', '--agent', 'seat-loop', '--ref', decisionRef(seat, item), '--json']);
             }
             if (!decisionReceipt(root, seat, item)) throw new Error('decisions raise did not deliver a matching card');
             entry.status = 'hitl';
@@ -705,7 +940,7 @@ export async function runSeatLoopOnce(seat: string, deps: SeatDeps = {}): Promis
       const raised = await run(['decisions', 'raise', '--title', title, '--category', 'other',
         '--s', `${seat} 배정 항목: ${action.text.replace(/[\r\n]+/g, ' ')}\n역할: ${inputs.role}`, '--c', '자동 실행 금지 문면에 해당하여 사람 결정이 필요하다',
         '--option', 'a=사람 승인:승인 후 별도로 집행', '--option', 'b=보류:집행하지 않음',
-        '--skip-recommend', '금지 문면은 자동으로 권고하지 않는다', '--agent', 'seat-loop', '--json']);
+        '--skip-recommend', '금지 문면은 자동으로 권고하지 않는다', '--no-xcheck', '자리 루프 · 이웃 교환은 DEC-XCHECK ②', '--agent', 'seat-loop', '--json']);
       const decision: unknown = JSON.parse(raised.trim());
       if (!decision || typeof decision !== 'object' || typeof (decision as { id?: unknown }).id !== 'string') {
         throw new Error('decisions raise returned no decision id');

package/src/seat-loop/seat-pack.ts

@@ -0,0 +1,127 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { userInfo } from 'node:os';
+import { DEFAULT_CONCURRENT_PODS, DEFAULT_DAILY_GOALS } from '../org/seat-budget.js';
+
+export interface SeatPackManifest {
+  name: string;
+  version: string;
+  files: Array<{ path: string; sha256: string }>;
+}
+
+export class SeatPackLeakError extends Error {
+  constructor(file: string, line: number, marker: string) {
+    super(`${file}:${line}: public leak (${marker})`);
+  }
+}
+
+function regularFile(path: string): boolean {
+  return lstatSync(path).isFile();
+}
+
+function walk(directory: string, root: string): string[] {
+  if (!existsSync(directory)) return [];
+  if (!lstatSync(directory).isDirectory()) throw new Error(`not a directory: ${relative(root, directory)}`);
+  return readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))
+    .flatMap((entry) => {
+      const path = join(directory, entry.name);
+      if (entry.isSymbolicLink()) throw new Error(`symlink in seat pack: ${relative(root, path)}`);
+      return entry.isDirectory() ? walk(path, root) : entry.isFile() ? [relative(root, path)] : [];
+    });
+}
+
+function scan(file: string, body: string): void {
+  const usernames = new Set([userInfo().username, process.env.ELANOUS_LEAK_HOME_USER].filter((name): name is string => Boolean(name)));
+  const accountPatterns = [...usernames].map((name) => new RegExp(`(?<![A-Za-z0-9._-])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9._-])`, 'iu'));
+  const patterns: Array<[string, RegExp]> = [
+    ['royal marker', /\u{1F451}/u],
+    ['track marker', /(?:🅞|🅣|🅢|🅕|\*\*\[(?:OP|TC|MK|UX|S|T|O|F)\]\*\*|\[(?:OP|TC|MK|UX|S|T|O|F)\])/u],
+    ['absolute user path', /\/Users\/[A-Za-z0-9._-]+/u],
+    ...accountPatterns.map((pattern): [string, RegExp] => ['account name', pattern]),
+  ];
+  for (const [index, line] of body.split(/\r?\n/u).entries()) {
+    for (const [marker, pattern] of patterns) {
+      if (pattern.test(line)) throw new SeatPackLeakError(file, index + 1, marker);
+    }
+  }
+}
+
+/** Build from charters, explicitly referenced seat graphs and the seat's own `graphs/<seat>/` folder; never copy an entire shared graph directory by default. */
+export function exportSeatPack(seat: string, out: string, root = resolve(import.meta.dir, '../..')): SeatPackManifest {
+  if (!/^[A-Za-z][A-Za-z0-9_-]*$/u.test(seat)) throw new Error(`invalid seat: ${seat}`);
+  const repo = resolve(root);
+  const output = resolve(out);
+  const roles = join(repo, 'docs', 'roles');
+  const charter = join(roles, `${seat}.md`);
+  if (!existsSync(charter) || !regularFile(charter)) throw new Error(`seat charter not found: docs/roles/${seat}.md`);
+  const roleFiles = [`docs/roles/${seat}.md`, ...walk(join(roles, seat), repo).filter((file) => file.endsWith('.md'))];
+  const graphFiles = new Set<string>();
+  const contents = new Map<string, Buffer>();
+  for (const file of roleFiles) {
+    const body = readFileSync(join(repo, file));
+    contents.set(file, body);
+    for (const match of body.toString('utf8').matchAll(/graphs\/([A-Za-z0-9_./-]+(?:\.ya?ml|\/\*\*))/gu)) {
+      const ref = `graphs/${match[1]!}`;
+      if (ref.split('/').includes('..')) throw new Error(`invalid seat graph: ${ref}`);
+      if (ref.endsWith('/**')) {
+        if (!existsSync(join(repo, ref.slice(0, -3)))) throw new Error(`seat graph not found: ${ref}`);
+        for (const graph of walk(join(repo, ref.slice(0, -3)), repo)) {
+          if (/\.ya?ml$/u.test(graph)) graphFiles.add(graph);
+        }
+      } else graphFiles.add(ref);
+    }
+  }
+  // A seat's own graph folder (`graphs/<seat in lower case>/`) belongs to the seat even when the
+  // charter no longer mentions it — inclusion must not hinge on a text reference that can be edited away.
+  const ownGraphs = join(repo, 'graphs', seat.toLowerCase());
+  if (existsSync(ownGraphs)) {
+    for (const graph of walk(ownGraphs, repo)) if (/\.ya?ml$/u.test(graph)) graphFiles.add(graph);
+  }
+  for (const file of graphFiles) {
+    const path = join(repo, file);
+    if (!existsSync(path) || !regularFile(path)) throw new Error(`seat graph not found: ${file}`);
+    contents.set(file, readFileSync(path));
+  }
+  const verdicts = roleFiles.flatMap((file) => contents.get(file)!.toString('utf8').split(/\r?\n/u)
+    .filter((line) => /\|\s*판정선\s*\|/u.test(line)).map((line) => ({ source: file, text: line.split('|').slice(2, -1).join('|').trim() })));
+  for (const file of roleFiles) {
+    const charter = contents.get(file)!.toString('utf8');
+    for (const match of charter.matchAll(/(?:^|\n)\s*[-*]\s*\*\*(?:관문|판정선)\*\*\s*[—:-]\s*([^\n]+)/gu)) {
+      verdicts.push({ source: file, text: match[1]!.trim() });
+    }
+    let inGateSection = false;
+    for (const line of charter.split(/\r?\n/u)) {
+      if (/^##\s+\d+\.\s+관문(?:\s|\(|$)/u.test(line)) { inGateSection = true; continue; }
+      if (/^##\s/u.test(line)) inGateSection = false;
+      if (!inGateSection) continue;
+      const bullet = line.match(/^\s*[-*]\s+(.+)$/u);
+      if (bullet) verdicts.push({ source: file, text: bullet[1]!.trim() });
+    }
+  }
+  if (verdicts.length === 0) throw new Error(`seat verdict not found for ${seat}`);
+  contents.set('verdicts.json', Buffer.from(`${JSON.stringify(verdicts, null, 2)}\n`));
+  contents.set('budget.json', Buffer.from(`${JSON.stringify({ dailyGoals: DEFAULT_DAILY_GOALS, concurrentPods: DEFAULT_CONCURRENT_PODS }, null, 2)}\n`));
+  const version = (JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8')) as { version: string }).version;
+  const files = [...contents].sort(([a], [b]) => a.localeCompare(b)).map(([path, body]) => ({
+    path, sha256: createHash('sha256').update(body).digest('hex'),
+  }));
+  const manifest: SeatPackManifest = { name: seat, version, files };
+  const manifestBody = Buffer.from(`${JSON.stringify(manifest, null, 2)}\n`);
+  for (const [file, body] of [...contents, ['manifest.json', manifestBody] as [string, Buffer]]) scan(file, body.toString('utf8'));
+  if (existsSync(output)) {
+    if (!lstatSync(output).isDirectory() || readdirSync(output).length > 0) throw new Error(`output must be an empty directory: ${output}`);
+  }
+  const sources = [roles, join(repo, 'graphs')];
+  if (output === repo || sources.some((source) => output === source || source.startsWith(`${output}${sep}`) || output.startsWith(`${source}${sep}`))) {
+    throw new Error('output overlaps seat pack sources');
+  }
+  mkdirSync(output, { recursive: true });
+  for (const [file, body] of contents) {
+    const dest = join(output, file);
+    mkdirSync(dirname(dest), { recursive: true });
+    writeFileSync(dest, body);
+  }
+  writeFileSync(join(output, 'manifest.json'), manifestBody);
+  return manifest;
+}

package/src/self-dev/ask-launch-flow.ts

@@ -158,6 +158,8 @@ export interface AskLaunchFlowDeps {
   /** ⛔ 못 얻으면 `null` — 같은 이유. */
   recentAuthoringSamples(): RecentAuthoringSample[] | null;
   authorGoal(args: readonly string[], options: Record<string, unknown>): Promise<AskAuthoredGoal>;
+  /** Pod launches reserve a host slot before goal authoring begins. */
+  beforeAuthoring?(): Promise<void>;
   /** 발사 전 권고용 분해 seam. 생략하면 전용 관측명을 준 기존 분해기를 쓴다. */
   decomposeGoal?(goal: string): Promise<SelfDevDecomposition>;
   /**
@@ -825,6 +827,7 @@ export async function runAskLaunchFlow(
   const launchPreflight = await runPrePreflight(input, deps);
   if (launchPreflight === false) return { kind: 'stopped-before-authoring' };
 
+  await deps.beforeAuthoring?.();
   const authorAndPreflight = async (): Promise<{
     readonly goalFile: string;
     readonly decision: ReturnType<typeof decideAskPreflight>;