elanous 0.2.13 → 0.2.15

package/src/hq/fence-audit.ts

@@ -0,0 +1,90 @@
+// Read-only HQ fence inventory: use the installed crontab, never install a proposed replacement.
+import { debug } from '../debug/log.js';
+import { FENCE_ROLES } from './hq.js';
+import { inventoryCrontab, listSchedules, openSchedulesDb, parseCronLine, readCrontab } from '../domains/schedule-registry.js';
+import { cronLaunchedActionsWithFence, listAllLoops, shellSegments, type LoopRegistryOptions } from '../loops/registry.js';
+
+type SuggestedRole = 'cron' | 'seat-loop' | 'release-run' | 'conatus' | 'git-push' | 'ledger-cli' | 'unknown';
+export interface UnfencedCron {
+  raw: string;
+  cron: string;
+  command: string;
+  recommendedRole: SuggestedRole;
+  suggestedLine: string;
+  /** Unknown roles are not executable fence arguments; the operator must choose a role. */
+  manualReview?: true;
+}
+
+/** Only infer a specific role where the launched command names that activity. */
+function roleFor(command: string): SuggestedRole {
+  const launched = shellSegments(command).map(segment => segment.replace(/^cd\s+\S+\s*&&\s*/, '').replace(/(?:^|\s)(?:--message|--label|--note)\s+(?:'[^']*'|"[^"]*")/g, '')).join(' ');
+  if (/(?:^|[\s;&|])(?:\S*\/)?git\s+push\b|(?:^|[\s/])git-push\b|tree-sync\.sh\b/i.test(launched)) return 'git-push';
+  if (/(?:^|[\s/])(?:seat-loop|(?:op|tc|mk|ux)-seat|coord-bridge)(?:[.\s/-]|$)/i.test(launched)) return 'seat-loop';
+  if (/(?:^|[\s/])(?:release-run|landing-heal)(?:[.\s/-]|$)|\brelease\s+(?:run|publish|place|rebalance)\b/i.test(launched)) return 'release-run';
+  if (/(?:^|[\s/])conatus(?:[.\s/-]|$)/i.test(launched)) return 'conatus';
+  if (/\b(?:ledger|checklist)\s+(?:set|write|update|add|create|delete)\b|(?:^|[\s/])ledger-cli(?:[.\s/-]|$)/i.test(launched)) return 'ledger-cli';
+  if (/(?:^|[\s/])(?:steward|draft-cleanup|test-diet|contract-coordinator|market-posture|mission-request-judge)(?:[.\s/-]|$)/i.test(launched)) return 'cron';
+  if (/\b(?:graph\s+run|harness\s+queue\s+tick|card\s+intake-scan|flow\s+tick)\b/i.test(launched)) return 'cron';
+  return 'unknown';
+}
+
+const READ_ONLY = /^(?:hq (?:heartbeat|arbiter-check|seen|lease status|fence-audit)|(?:logs|config) (?:query|get|list)|loop (?:status|list)|card list|harness queue list)(?: |$)/i;
+/** `hq fence --role <x>` with a role the CLI rejects never runs the payload fenced. */
+function isFenceRole(role: string | undefined): boolean {
+  return !!role && (FENCE_ROLES as readonly string[]).includes(role);
+}
+function isReadOnly(script: string, args: string[]): boolean {
+  if (/^(?:cd|echo|printf|date|true)$/.test(script.split('/').pop() ?? '')) return true;
+  if (!/^(?:elanous|elanous\.mjs|eln)$/.test(script.split('/').pop() ?? '')) return false;
+  return READ_ONLY.test(args.slice(0, 3).join(' '));
+}
+const quote = (command: string) => `'${command.replaceAll("'", "'\"'\"'")}'`;
+
+/** Reuse the installed loop inventory without touching the production schedule DB. A registry fenceRole
+ * may describe only one job or segment, so each launched action is checked independently below. */
+export function hqFenceAudit(deps: {
+  read?: () => string;
+  loops?: typeof listAllLoops;
+  loopOptions?: LoopRegistryOptions;
+  log?: typeof debug.log;
+} = {}): UnfencedCron[] {
+  const text = (deps.read ?? readCrontab)();
+  const parsed = text.split('\n').map(raw => ({ raw, job: parseCronLine(raw) })).filter(
+    (entry): entry is { raw: string; job: { cron: string; command: string } } => entry.job !== null,
+  );
+  // Inventory into an in-memory registry so the production schedule DB is never written by an audit.
+  let schedules: ReturnType<typeof listSchedules> = [];
+  try {
+    const db = openSchedulesDb(':memory:');
+    try {
+      inventoryCrontab(db, { crontab: text });
+      schedules = listSchedules(db);
+    } finally { db.close(); }
+  } catch { /* schedule metadata is advisory; the installed crontab is the source */ }
+  // Registry rows are hints only: a fenceRole on one segment must not hide an unfenced sibling.
+  // A broken graph or schedule inventory must not prevent auditing the installed crontab.
+  let loops: ReturnType<typeof listAllLoops> = [];
+  try { loops = (deps.loops ?? listAllLoops)({ ...deps.loopOptions, schedules }); } catch { /* cron inspection remains available */ }
+  const results: UnfencedCron[] = [];
+  for (const { raw, job: { cron, command } } of parsed) {
+    const launches = cronLaunchedActionsWithFence(command);
+    const unfenced = launches.filter(({ script, args, fenceRole }) => script && !isFenceRole(fenceRole) && !isReadOnly(script, args));
+    if (!unfenced.length) continue;
+    const unfencedCommand = unfenced.map(({ script, args }) => [script, ...args].join(' ')).join(' ; ');
+    const registered = loops.find(loop => loop.cron === cron && loop.command === command);
+    // An unfenced registered orchestrator can supply a role for an opaque launch.
+    // If the aggregate inventory carries a fenceRole from another segment, do not
+    // borrow that segment's classification for the unfenced sibling.
+    const inferred = roleFor(unfencedCommand);
+    const recommendedRole = inferred === 'unknown' && registered?.kind === 'orchestrator' && !registered.fenceRole ? 'cron' : inferred;
+    results.push({ raw, cron, command, recommendedRole,
+      ...(recommendedRole === 'unknown' ? { manualReview: true as const } : {}),
+      suggestedLine: recommendedRole === 'unknown'
+        ? `# manual review (unknown role): ${cron} ${command}`
+        : `${cron} hq-fence ${recommendedRole} ${quote(command)}` });
+  }
+  try { (deps.log ?? debug.log.bind(debug))('hq.fence-audit', 'listed', {
+    unfenced: results.length, unknownRole: results.filter(row => row.recommendedRole === 'unknown').length,
+  }); } catch { /* observation is fail-soft */ }
+  return results;
+}

package/src/hq/hq.ts

@@ -4,10 +4,14 @@ import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync,
 import { homedir, hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import type { Command } from 'commander';
+import { writeStdoutJson } from '../cli/stdout-json.js';
 import { debug } from '../debug/log.js';
 import { DEFAULT_NEXUS_HTTP_PORT } from '../nexus/default-port.js';
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { getUserConfig, type HqConfig, type HqFenceRole } from '../user-config.js';
+import { promoteHq, proposeHqPromotion, writeOpSeatRequest } from './promote.js';
+import type { HqOpRequestWriter, PromoteResult } from './promote.js';
 import {
   DEFAULT_TTL_SECONDS, decideAcquire, decideArbiterCheck, decideFence, decideRelease, decideRenew, defaultSshRunner,
   fileLeaseStore, leaseExpired, parseLease, probeReachable, recordView, serializeLease, sshLeaseStore, sshReachable, localShellRunner,
@@ -16,6 +20,21 @@ import {
 
 export const FENCE_ROLES: readonly HqFenceRole[] = ['telegram-poller', 'cron', 'seat-loop', 'release-run', 'conatus', 'git-push', 'ledger-cli'];
 
+/** Register only the read-only move inventory; keep it outside lease/fence mutation flows. */
+export function registerHqMovePlanCommand(hqCmd: Command): void {
+  hqCmd.command('move-plan').description('현재 호스트의 작업·launchd 및 대상 호스트 파일을 조회(읽기 전용)')
+    .requiredOption('--to <host>', '이동 대상 호스트')
+    .option('--json', 'JSON 출력')
+    .action(async (opts: { to: string; json?: boolean }) => {
+      try {
+        const { hqMovePlan, formatMovePlan } = await import('./move-plan.js');
+        const result = hqMovePlan(opts.to);
+        if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+        else console.log(formatMovePlan(result));
+      } catch (error) { console.error(`hq move-plan: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+    });
+}
+
 export interface HqDeps {
   config?: HqConfig;
   store?: LeaseStore;
@@ -29,6 +48,9 @@ export interface HqDeps {
   seenPath?: string;
   now?: () => number;
   log?: typeof debug.log;
+  /** Injection points for the OP seat request and the promotion runbook; production uses durable defaults. */
+  opRequest?: HqOpRequestWriter;
+  promote?: (host: string, apply: boolean) => PromoteResult;
 }
 
 interface Resolved { me: string; arbiter: string; standby: string; ttl: number; failOpen: Set<HqFenceRole>; store: LeaseStore; ssh: SshRunner; probe: HostProbe; localPath: string; seenPath: string; now: () => number; log: typeof debug.log }
@@ -247,19 +269,55 @@ export function hqHeartbeat(deps: HqDeps = {}) {
 
 /**
  * Arbiter check (cron on cloud-vm every 10 min, next to the file): probe the holder over the tailnet
- * (`tailscale ping` ⊕ nexus health · no ssh into home machines) and promote per rule ②.
+ * (`tailscale ping` ⊕ nexus health · no ssh into home machines); propose to OP by default.
  */
 export function hqArbiterCheck(deps: HqDeps & { leasePath?: string } = {}) {
   const r0 = resolve(deps);
   const r = deps.store ? r0 : { ...r0, store: fileLeaseStore(deps.leasePath ?? join(process.env.HOME ?? '', '.elanous-hq', 'lease.json')) };
-  let outcome: { promoted: boolean; streak: number; holder?: string; generation?: number; ping?: boolean; health?: boolean } = { promoted: false, streak: 0 };
+  let outcome: { promoted: boolean; streak: number; holder?: string; generation?: number; ping?: boolean; health?: boolean; runbookFailed?: string } = { promoted: false, streak: 0 };
+  let proposal: { holder: string; generation: number; streak: number } | undefined;
+  const config = deps.config ?? getUserConfig().hq ?? {};
+  const threshold = config.autoPromote?.streak ?? 3;
+  const autoPromote = config.autoPromote?.enabled === true;
+  let leaseMoved: { from: string; to: string; generation: number } | undefined;
   const result = mutate(r, (record, now) => {
     if (!record) return { ok: false, reason: 'no lease' };
     const seen = probeReachable(record.holder, r.probe);
-    const checked = decideArbiterCheck(record, { arbiter: r.me, standby: r.standby, arbiterReachesHolder: seen.reachable, now });
-    outcome = { promoted: checked.promoted, streak: checked.streak, holder: checked.next.holder, generation: checked.next.generation, ping: seen.ping, health: seen.health };
+    const checked = decideArbiterCheck(record, { arbiter: r.me, standby: r.standby, arbiterReachesHolder: seen.reachable, now,
+      promote: autoPromote, promoteAfterChecks: threshold });
+    proposal = !autoPromote && !seen.reachable && record.holder !== r.standby && checked.streak >= threshold
+      ? { holder: record.holder, generation: record.generation, streak: checked.streak } : undefined;
+    // promoteHq's own precondition is «lease holder = target», so the lease moves first and the runbook follows.
+    if (checked.promoted) leaseMoved = { from: record.holder, to: checked.next.holder, generation: checked.next.generation };
+    outcome = { promoted: false, streak: checked.streak, holder: checked.next.holder, generation: checked.next.generation, ping: seen.ping, health: seen.health };
     return { ok: true, next: checked.next };
   });
+  const moved = leaseMoved as { from: string; to: string; generation: number } | undefined; // assigned inside the mutate callback
+  if (result.ok && moved) {
+    let promotion: PromoteResult | undefined;
+    let failure: string | undefined;
+    try {
+      promotion = (deps.promote ?? ((host: string, apply: boolean) => promoteHq(host, apply)))(moved.to, true);
+      if (!promotion.ok) failure = promotion.lines.filter((line) => line.status === 'failed').map((line) => `${line.step}: ${line.measurement}`).join(' · ') || 'runbook returned ok=false';
+    } catch (error) { failure = String(error); }
+    if (failure === undefined) outcome = { ...outcome, promoted: true };
+    else {
+      // The lease already names the standby but the services did not move — never report this as a promotion.
+      outcome = { ...outcome, promoted: false, runbookFailed: failure };
+      try { r.log('hq.arbiter', 'promote-runbook-failed', { ...moved, error: failure }); } catch { /* observation is fail-soft */ }
+      try {
+        (deps.opRequest ?? ((request) => writeOpSeatRequest(request)))({
+          key: `hq:promote-failed:${moved.to}:${moved.generation}`,
+          text: `자동 승격 런북 실패 — 임대는 ${moved.to}(세대 ${moved.generation})로 옮겨졌지만 서비스 이전이 끝나지 않았다: ${failure}. OP 가 \`eln hq promote --to ${moved.to}\` 로 확인한다.`,
+        });
+      } catch (error) { try { r.log('hq.arbiter', 'promote-request-failed', { ...moved, error: String(error) }); } catch { /* fail-soft */ } }
+    }
+  }
+  const proposed = proposal as { holder: string; generation: number; streak: number } | undefined;
+  if (result.ok && proposed) {
+    try { proposeHqPromotion({ ...proposed, standby: r.standby }, { request: deps.opRequest, log: r.log }); }
+    catch (error) { try { r.log('hq.arbiter', 'promote-proposal-failed', { ...proposed, error: String(error) }); } catch { /* observation is fail-soft */ } }
+  }
   observe(r, 'hq.lease', outcome.promoted ? 'promoted' : 'arbiter-check', { ...outcome, ok: result.ok });
   return { ok: result.ok, ...outcome };
 }
@@ -302,7 +360,7 @@ export function hqCliWriteAllowed(command: string, override = false, deps: HqDep
   }
   if (allowed) return true;
   observe(r, 'hq.fence', 'cli-refused', { command, reason: decision.reason, holder: decision.holder, generation: decision.generation });
-  console.error(`본부는 ${decision.holder ?? 'unknown'} gen ${decision.generation ?? 'unknown'} — 거기서 쓰거나 --hq-override(관측)`);
+  console.error(`본부는 ${decision.holder ?? 'unknown'} gen ${decision.generation ?? 'unknown'} — 원장 쓰기는 지금 본부로 보내라 (수동 우회: --hq-override, 관측)`);
   process.exitCode = 4;
   return false;
 }

package/src/hq/lease.ts

@@ -1,5 +1,5 @@
 // HQ lease (본부 임대) — single writer across mbp · node-b · cloud-vm with a 2-of-3 quorum (OP 10-04 08:33 · 08:40).
-// The arbiter (cloud-vm) keeps one record; only the arbiter promotes the standby, and only after two consecutive
+// The arbiter (cloud-vm) keeps one record; promotion requires an explicit opt-in and consecutive
 // checks in which neither the arbiter nor the standby can reach the holder. Fenced work carries the generation.
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
@@ -64,9 +64,9 @@ export function recordView(record: LeaseRecord, observer: string, reachable: boo
 
 /**
  * Arbiter check (rule ②). Records the arbiter's own view; counts a dual-unreachable check only when the standby's
- * fresh view of the same holder also says unreachable; promotes the standby after PROMOTE_AFTER_CHECKS in a row.
+ * fresh view of the same holder also says unreachable; promotion is optional and its threshold is configurable.
  */
-export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string; standby: string; arbiterReachesHolder: boolean; now: number }):
+export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string; standby: string; arbiterReachesHolder: boolean; now: number; promote?: boolean; promoteAfterChecks?: number }):
   { next: LeaseRecord; promoted: boolean; streak: number } {
   let next = recordView(record, input.arbiter, input.arbiterReachesHolder, input.now);
   const view = next.views?.[input.standby];
@@ -74,7 +74,7 @@ export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string
   const dual = !input.arbiterReachesHolder && standbyDown && record.holder !== input.standby;
   const streak = dual ? (record.dualUnreachableStreak ?? 0) + 1 : 0;
   next = { ...next, dualUnreachableStreak: streak, lastCheckAt: input.now };
-  if (streak < PROMOTE_AFTER_CHECKS) return { next, promoted: false, streak };
+  if (input.promote === false || streak < (input.promoteAfterChecks ?? PROMOTE_AFTER_CHECKS)) return { next, promoted: false, streak };
   return {
     next: { holder: input.standby, generation: record.generation + 1, acquiredAt: input.now, renewedAt: input.now, ttlSeconds: record.ttlSeconds, views: {}, dualUnreachableStreak: 0, lastCheckAt: input.now, promotedFrom: record.holder },
     promoted: true, streak,

package/src/hq/move-plan.ts

@@ -0,0 +1,126 @@
+// Read-only inventory of work tied to the current HQ host before moving it.
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { homedir, hostname } from 'node:os';
+import { join } from 'node:path';
+import { inventoryCrontab, listSchedules, openSchedulesDb, parseCronLine } from '../domains/schedule-registry.js';
+import { cronLaunchedActionsWithFence, listAllLoops, type AllLoopEntry, type LoopRegistryOptions } from '../loops/registry.js';
+import { defaultSshRunner, type SshRunner } from './lease.js';
+import { FENCE_ROLES } from './hq.js';
+
+type Measurement<T> = { status: 'measured'; value: T } | { status: '못 잼'; reason: string };
+interface MovePlan {
+  to: string;
+  from: string | null;
+  unfencedCron: Measurement<Array<{ raw: string; cron: string; command: string }>>;
+  hostLoops: Measurement<AllLoopEntry[]>;
+  targetHost: Measurement<{ exists: boolean; name: string | null }>;
+  nexusLaunchd: Measurement<{ present: boolean; measuredOn: 'local' }>;
+}
+
+type CommandResult = { status: number | null; stdout: string; stderr: string };
+interface MovePlanDeps {
+  crontab?: () => CommandResult;
+  loops?: typeof listAllLoops;
+  loopOptions?: LoopRegistryOptions;
+  ssh?: SshRunner;
+  launchctl?: () => CommandResult;
+  localHost?: () => string;
+  hostFile?: string;
+}
+
+const measured = <T>(value: T): Measurement<T> => ({ status: 'measured', value });
+const unknown = <T>(reason: string): Measurement<T> => ({ status: '못 잼', reason });
+const run = (command: string, args: string[]): CommandResult => {
+  const r = spawnSync(command, args, { encoding: 'utf8', timeout: 15_000, env: process.env });
+  return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? String(r.error ?? '') };
+};
+const message = (error: unknown) => error instanceof Error ? error.message : String(error);
+
+// Only known HQ jobs qualify by script name; a random scripts/*.ts is not HQ work.
+const HQ_SCRIPTS = new Set([
+  'steward.ts', 'draft-cleanup.ts', 'test-diet.ts', 'contract-coordinator.ts',
+  'market-posture.ts', 'mission-request-judge.ts',
+]);
+function isHqAction(script: string): boolean {
+  if (/(?:^|\/)(?:eln|elanous|elanous\.mjs)$/i.test(script)) return true;
+  if (/(?:^|\/)\.elanous(?:\/|$)/i.test(script)) return true;
+  const match = script.match(/(?:^|\/)scripts\/([^/\s]+\.ts)$/);
+  return !!match && HQ_SCRIPTS.has(match[1]!);
+}
+
+export function hqMovePlan(to: string, deps: MovePlanDeps = {}): MovePlan {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9.-]*$/.test(to) || to.includes('..')) throw new Error('hq move-plan: invalid host');
+  let unfencedCron: MovePlan['unfencedCron'];
+  let hostLoops: MovePlan['hostLoops'];
+  let localName: string | undefined;
+  let localHostError: string | undefined;
+  try {
+    const value = readFileSync(deps.hostFile ?? join(homedir(), '.elanous-hq', 'host'), 'utf8');
+    const name = value.endsWith('\n') ? value.slice(0, -1) : value;
+    if (!name || name !== name.trim() || /[\r\n]/.test(name)) throw new Error('invalid local HQ host file');
+    localName = name;
+  } catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') localHostError = message(error); }
+  const from = deps.localHost?.() ?? localName ?? null;
+  let text = '';
+  try {
+    const r = (deps.crontab ?? (() => run('crontab', ['-l'])))();
+    if (r.status !== 0 && !(r.status === 1 && /no crontab for /i.test(r.stderr))) {
+      throw new Error(r.stderr.trim() || `crontab -l exit=${r.status}`);
+    }
+    text = r.status === 0 ? r.stdout : '';
+    const rows = text.split('\n').map(raw => ({ raw, parsed: parseCronLine(raw) }))
+      .filter((row): row is { raw: string; parsed: { cron: string; command: string } } => row.parsed !== null);
+    unfencedCron = measured(rows.filter(({ parsed }) =>
+      cronLaunchedActionsWithFence(parsed.command).some(action =>
+        !!action.script && !(FENCE_ROLES as readonly string[]).includes(action.fenceRole ?? '')
+        && isHqAction(action.script)))
+      .map(({ raw, parsed }) => ({ raw, cron: parsed.cron, command: parsed.command })));
+  } catch (error) { unfencedCron = unknown(message(error)); }
+  try {
+    if (unfencedCron.status !== 'measured') throw new Error(unfencedCron.reason);
+    // The registry accepts an already-inventoried schedule set. Never open the production DB.
+    const db = openSchedulesDb(':memory:');
+    let schedules: ReturnType<typeof listSchedules>;
+    try { inventoryCrontab(db, { crontab: text }); schedules = listSchedules(db); }
+    finally { db.close(); }
+    if (localHostError) throw new Error(localHostError);
+    if (!from) throw new Error('local HQ host identity not confirmed (~/.elanous-hq/host missing)');
+    // Cron rows use os.hostname(); match that label only after confirming this machine's HQ identity.
+    const names = new Set([from, hostname()]);
+    hostLoops = measured((deps.loops ?? listAllLoops)({ ...deps.loopOptions, schedules })
+      .filter(loop => !!loop.host && names.has(loop.host)));
+  } catch (error) { hostLoops = unknown(message(error)); }
+  let targetHost: MovePlan['targetHost'];
+  try {
+    const r = (deps.ssh ?? defaultSshRunner)(to,
+      'if [ -f "$HOME/.elanous-hq/host" ]; then printf "present\\n"; cat "$HOME/.elanous-hq/host"; elif [ ! -e "$HOME/.elanous-hq/host" ]; then printf "absent\\n"; else exit 2; fi');
+    if (r.status !== 0) throw new Error(r.stderr.trim() || `ssh exit=${r.status}`);
+    const [presence, ...lines] = r.stdout.split('\n');
+    if (presence === 'absent') targetHost = measured({ exists: false, name: null });
+    else if (presence === 'present' && lines.join('\n').trim() && !/[\r\n]/.test(lines.join('\n').trim()))
+      targetHost = measured({ exists: true, name: lines.join('\n').trim() });
+    else throw new Error('target host file unreadable or empty');
+  } catch (error) { targetHost = unknown(message(error)); }
+  let nexusLaunchd: MovePlan['nexusLaunchd'];
+  try {
+    const r = (deps.launchctl ?? (() => run('launchctl', ['list', 'com.elanous.nexus'])))();
+    if (r.status === 0) nexusLaunchd = measured({ present: true, measuredOn: 'local' });
+    else if (r.status !== null && /Could not find service|service not found|not found/i.test(r.stderr)) nexusLaunchd = measured({ present: false, measuredOn: 'local' });
+    else throw new Error(r.stderr.trim() || `launchctl exit=${r.status}`);
+  } catch (error) { nexusLaunchd = unknown(message(error)); }
+  return { to, from, unfencedCron, hostLoops, targetHost, nexusLaunchd };
+}
+
+export function formatMovePlan(plan: MovePlan): string {
+  const lines = [`hq move-plan: ${plan.from ?? '못 잼'} → ${plan.to} (read-only)`];
+  const section = <T>(name: string, result: Measurement<T>, render: (value: T) => string[]) => {
+    lines.push(`${name}: ${result.status === 'measured' ? '' : `못 잼 (${result.reason})`}`.trimEnd());
+    if (result.status === 'measured') lines.push(...render(result.value));
+  };
+  section('① unfenced elanous crontab', plan.unfencedCron, rows => rows.length ? rows.map(row => `  ${row.raw}`) : ['  none']);
+  section('② local host loops (loop status --all)', plan.hostLoops, rows => rows.length ? rows.map(row => `  ${row.id} · ${row.host} · ${row.title}`) : ['  none']);
+  section('③ target ~/.elanous-hq/host', plan.targetHost, host => [`  ${host.exists ? host.name : 'absent'}`]);
+  section('④ local launchd com.elanous.nexus', plan.nexusLaunchd, service => [`  ${service.present ? 'present' : 'absent'} (measured on local machine)`]);
+  return lines.join('\n');
+}