elanous 0.2.13 → 0.2.15

package/src/loops/orchestrator/resync-shadow.ts

@@ -0,0 +1,227 @@
+import { execFileSync, spawnSync, type SpawnSyncOptionsWithStringEncoding } from 'node:child_process';
+import { appendFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { debug } from '../../debug/log.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import {
+  defaultGitMergeSeam, defaultLlmResolve, mergeMainWithLlmResolve,
+  type LlmMergeOutcome, type MergeGitSeam,
+} from '../../autopilot/build/llm-conflict-merge.js';
+
+type ResyncVerdict = 'saved' | 'merge-ok-tests-failed' | 'merge-ok-no-tests' | 'unresolved' | 'guard-tripped' | 'error';
+interface ResyncShadowEntry {
+  at: string;
+  pr: number;
+  head: string;
+  verdict: ResyncVerdict;
+  status: LlmMergeOutcome['status'] | 'error';
+  resolvedFiles: string[];
+  testFiles: string[];
+  failedTests?: string[];
+}
+export interface ResyncShadowSummary { candidates: number; tried: number; saved: number; savedRatio: number | null }
+
+type OpenPr = { number: number; headRefName: string; mergeable: string; isDraft: boolean; labels: { name: string }[] };
+export interface ResyncShadowDeps {
+  repoRoot?: string;
+  instanceRoot?: string;
+  runGh?: (args: string[]) => string;
+  resolve?: (file: string, conflicted: string) => Promise<string>;
+  gitSeam?: MergeGitSeam;
+  runTests?: (cwd: string, files: string[]) => { ok: boolean; failedTests?: string[]; noTests?: boolean };
+  now?: () => Date;
+}
+
+function command(file: string, args: string[], cwd: string, timeout = 60_000): string {
+  return execFileSync(file, args, { cwd, encoding: 'utf8', timeout, maxBuffer: 20 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+}
+
+function changedTests(gh: (args: string[]) => string, number: number): string[] {
+  const observed: unknown = JSON.parse(gh(['pr', 'view', String(number), '--json', 'files']));
+  if (!observed || typeof observed !== 'object' || !('files' in observed) || !Array.isArray(observed.files)
+    || observed.files.some(file => !file || typeof file.path !== 'string')) throw new Error('invalid PR files observation');
+  return [...new Set((observed.files as { path: string }[]).map(file => file.path).filter(path =>
+    path.endsWith('.test.ts') && !isAbsolute(path) && path !== '' && !path.split('/').some(part => part === '..' || part === '.' || part === '')))];
+}
+
+// A PR test must not inherit credentials, reach the network or write outside its own worktree.
+// If the kernel does not provide the required isolation, fail closed before starting bun.
+const TEST_SANDBOX = `import ctypes, os, sys
+libc = ctypes.CDLL(None, use_errno=True)
+class Ruleset(ctypes.Structure):
+    _fields_ = [('handled_access_fs', ctypes.c_uint64)]
+class PathRule(ctypes.Structure):
+    _fields_ = [('allowed_access', ctypes.c_uint64), ('parent_fd', ctypes.c_int32)]
+EXEC, WRITE, READ_FILE, READ_DIR, REMOVE_DIR, REMOVE_FILE, MAKE_CHAR, MAKE_DIR, MAKE_REG, MAKE_SOCK, MAKE_FIFO, MAKE_BLOCK, MAKE_SYM = (1 << i for i in range(13))
+REFER, TRUNCATE = 1 << 13, 1 << 14
+READ = EXEC | READ_FILE | READ_DIR
+WRITE_BITS = WRITE | REMOVE_DIR | REMOVE_FILE | MAKE_CHAR | MAKE_DIR | MAKE_REG | MAKE_SOCK | MAKE_FIFO | MAKE_BLOCK | MAKE_SYM | REFER | TRUNCATE
+ALL = READ | WRITE_BITS
+def syscall(num, *args):
+    result = libc.syscall(num, *args)
+    if result < 0: raise OSError(ctypes.get_errno(), 'syscall ' + str(num) + ': ' + os.strerror(ctypes.get_errno()))
+    return result
+try:
+    cwd, bun, modules, report, *tests = sys.argv[1:]
+    version = syscall(444, 0, 0, 1)
+    rights = ALL & (~TRUNCATE if version < 3 else ~0) & (~REFER if version < 2 else ~0)
+    rules = Ruleset(rights)
+    fd = syscall(444, ctypes.byref(rules), ctypes.sizeof(rules), 0)
+    def allow(path, rights):
+        if not os.path.exists(path): return
+        pathfd = os.open(path, os.O_PATH | os.O_CLOEXEC)
+        try:
+            rule = PathRule(rights & rules.handled_access_fs, pathfd)
+            try: syscall(445, fd, 1, ctypes.byref(rule), 0)
+            except OSError as error: raise OSError(error.errno, path + ': ' + str(error))
+        finally: os.close(pathfd)
+    for path in ('/usr', '/lib', '/lib64', '/bin', '/etc', '/dev', '/proc/self', '/proc/thread-self', '/proc/cpuinfo', '/proc/meminfo', '/proc/stat', '/sys'):
+        allow(path, (EXEC | READ_FILE) if os.path.isfile(path) else READ)
+    allow(bun, EXEC | READ_FILE)
+    if modules != '-': allow(modules, READ)
+    allow(cwd, READ | WRITE_BITS)
+    if libc.prctl(38, 1, 0, 0, 0) != 0: raise OSError(ctypes.get_errno(), 'no_new_privs')
+    syscall(446, fd, 0)
+    os.close(fd)
+    os.environ.clear()
+    os.environ.update(PATH='/usr/bin:/bin', HOME=cwd, GH_CONFIG_DIR=cwd, TMPDIR=cwd, XDG_CONFIG_HOME=cwd, GIT_CONFIG_NOSYSTEM='1', GIT_CONFIG_GLOBAL='/dev/null', GIT_TERMINAL_PROMPT='0', GH_PROMPT_DISABLED='1')
+    print('RESYNC_SANDBOX_READY', file=sys.stderr, flush=True)
+    os.execv(bun, [bun, 'test', '--reporter=junit', '--reporter-outfile=' + report, *tests])
+except Exception as error:
+    print('resync test sandbox: ' + str(error), file=sys.stderr)
+    sys.exit(125)`;
+
+/** Bun's own JUnit report is the run evidence — a test file can print «1 pass» to stdout, but it cannot make the runner record a testcase. */
+export function junitCounts(xml: string): { tests: number; failures: number; failed: string[] } | null {
+  const suites = /<testsuites\b[^>]*\btests="(\d+)"[^>]*\bfailures="(\d+)"/.exec(xml);
+  if (!suites) return null;
+  const failed = [...xml.matchAll(/<testcase\b[^>]*\bname="([^"]*)"[^>]*>\s*<failure/g)].map(match => match[1]!);
+  return { tests: Number(suites[1]), failures: Number(suites[2]), failed };
+}
+
+function defaultRunTests(cwd: string, files: string[]): { ok: boolean; failedTests?: string[]; noTests?: boolean } {
+  const modules = existsSync(join(cwd, 'node_modules')) ? realpathSync(join(cwd, 'node_modules')) : '-';
+  const deadline = Date.now() + 300_000;
+  const failedTests: string[] = [];
+  // Review round 3 ②: a test file the PR deleted is not runnable — drop it; none left = «no tests», not a measurement error.
+  const present = files.filter(file => existsSync(resolve(cwd, file)));
+  if (present.length === 0) return { ok: true, noTests: true };
+  // Run each declared file separately: Bun's combined summary counts files loaded, not files with tests.
+  for (const file of present) {
+    const abs = resolve(cwd, file);
+    if (!abs.startsWith(`${cwd}/`) || !realpathSync(abs).startsWith(`${cwd}/`)) throw new Error(`test path outside worktree: ${file}`);
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error(`test runner timed out before ${file}`);
+    const report = join(cwd, `.resync-junit-${randomUUID()}.xml`);
+    rmSync(report, { force: true });
+    const args: string[] = ['--user', '--map-root-user', '--net', '--fork',
+      'python3', '-c', TEST_SANDBOX, cwd, realpathSync(process.execPath), modules, report, abs];
+    const options: SpawnSyncOptionsWithStringEncoding = { cwd, env: { PATH: '/usr/bin:/bin', LANG: 'C', NODE_ENV: 'test' },
+      encoding: 'utf8', timeout: remaining, maxBuffer: 20 * 1024 * 1024 };
+    const result = spawnSync('unshare', args, options);
+    const output = `${result.stdout ?? ''}\n${result.stderr ?? ''}`;
+    if (!result.stderr?.includes('RESYNC_SANDBOX_READY')) throw new Error(`test sandbox unavailable: ${result.error?.message ?? output.trim()}`);
+    if (result.error || result.signal) throw new Error(`test runner unavailable for ${file}: ${result.error?.message ?? output.trim()}`);
+    // Review round 3 ①: never trust stdout text — read the runner's JUnit report; no report or zero testcases is not a pass.
+    const counts = existsSync(report) ? junitCounts(readFileSync(report, 'utf8')) : null;
+    rmSync(report, { force: true });
+    if (!counts || counts.tests === 0) { failedTests.push(`${file}: no test cases recorded by the runner`); continue; }
+    if (result.status === 0 && counts.failures === 0) continue;
+    failedTests.push(...(counts.failed.length ? counts.failed : [`${file}: ${counts.failures} failure(s)`]));
+  }
+  return failedTests.length ? { ok: false, failedTests } : { ok: true };
+}
+
+/** Re-merge open conflicts only in disposable detached worktrees; no remote writes. */
+export async function runResyncShadow(max = 3, deps: ResyncShadowDeps = {}): Promise<ResyncShadowSummary> {
+  if (!Number.isSafeInteger(max) || max < 0) throw new Error('--max must be a nonnegative integer');
+  const repoRoot = deps.repoRoot ?? resolve(import.meta.dir, '../../..');
+  const gh = deps.runGh ?? ((args: string[]) => command('gh', args, repoRoot));
+  const observed: unknown = JSON.parse(gh(['pr', 'list', '--state', 'open', '--json', 'number,headRefName,mergeable,isDraft,labels', '--limit', '1000']));
+  if (!Array.isArray(observed) || observed.length >= 1000 || observed.some(pr => !pr || !Number.isSafeInteger(pr.number)
+    || typeof pr.headRefName !== 'string' || typeof pr.mergeable !== 'string' || typeof pr.isDraft !== 'boolean'
+    || !Array.isArray(pr.labels) || pr.labels.some((label: unknown) => !label || typeof label !== 'object' || typeof (label as { name?: unknown }).name !== 'string')))
+    throw new Error('incomplete or invalid PR observation');
+  const candidates = (observed as OpenPr[]).filter(pr => pr.headRefName.startsWith('self-impl/')
+    && pr.mergeable === 'CONFLICTING'
+    && !pr.labels.some(label => label.name === 'elanous:stalled' || label.name === 'elanous:superseded'))
+    .sort((a, b) => a.number - b.number).slice(0, max);
+  const ledger = join(deps.instanceRoot ?? effectiveInstanceRoot(), 'orchestrator', 'resync-shadow.jsonl');
+  let saved = 0;
+  let tried = 0;
+  for (const pr of candidates) {
+    const entry: ResyncShadowEntry = {
+      at: (deps.now?.() ?? new Date()).toISOString(), pr: pr.number, head: pr.headRefName,
+      verdict: 'error', status: 'error', resolvedFiles: [], testFiles: [],
+    };
+    let tmp: string | undefined;
+    try {
+      // Explicit destination refspecs make origin/<head> and origin/main fresh even without remote.origin.fetch.
+      command('git', ['fetch', 'origin', `+refs/heads/${pr.headRefName}:refs/remotes/origin/${pr.headRefName}`,
+        '+refs/heads/main:refs/remotes/origin/main'], repoRoot);
+      entry.testFiles = changedTests(gh, pr.number);
+      tmp = realpathSync(mkdtempSync(join(tmpdir(), 'resync-shadow-')));
+      command('git', ['worktree', 'add', '--detach', tmp, `origin/${pr.headRefName}`], repoRoot);
+      // Focused tests may import packages from the checkout; worktrees do not contain node_modules.
+      if (existsSync(join(repoRoot, 'node_modules'))) symlinkSync(realpathSync(join(repoRoot, 'node_modules')), join(tmp, 'node_modules'), 'dir');
+      const outcome = await mergeMainWithLlmResolve(tmp, 'origin/main', deps.resolve ?? ((file, content) => defaultLlmResolve(file, content, 'origin/main')), deps.gitSeam ?? defaultGitMergeSeam());
+      entry.status = outcome.status;
+      entry.resolvedFiles = outcome.resolvedFiles ?? [];
+      if (outcome.sizeCollapse?.length || outcome.providerFailure?.length || outcome.testDeclarationLoss?.length) {
+        entry.verdict = 'guard-tripped';
+      } else if (outcome.status === 'merged' || outcome.status === 'llm-resolved') {
+        if (entry.testFiles.length === 0) entry.verdict = 'merge-ok-no-tests';
+        else {
+          const test = (deps.runTests ?? defaultRunTests)(tmp, entry.testFiles);
+          entry.verdict = test.noTests ? 'merge-ok-no-tests' : test.ok ? 'saved' : 'merge-ok-tests-failed';
+          if (!test.ok) entry.failedTests = test.failedTests?.length ? test.failedTests : ['test runner failed'];
+        }
+      } else entry.verdict = outcome.status === 'conflict-unresolved' || outcome.status === 'up-to-date' ? 'unresolved' : 'error';
+    } catch (error) {
+      entry.verdict = 'error';
+      entry.failedTests = [error instanceof Error ? error.message : String(error)];
+    } finally {
+      if (tmp) {
+        try {
+          // Even a failed add can have registered a partially created worktree.
+          command('git', ['worktree', 'remove', '--force', tmp], repoRoot);
+        } catch (error) {
+          entry.verdict = 'error';
+          entry.failedTests = [`worktree cleanup: ${String(error)}`];
+        } finally {
+          try { rmSync(tmp, { recursive: true, force: true }); }
+          catch (error) { entry.verdict = 'error'; entry.failedTests = [`temporary directory cleanup: ${String(error)}`]; }
+        }
+      }
+    }
+    mkdirSync(dirname(ledger), { recursive: true });
+    appendFileSync(ledger, `${JSON.stringify(entry)}\n`);
+    debug.log('loop.orchestrator', 'resync-shadow', { pr: entry.pr, verdict: entry.verdict, status: entry.status });
+    if (entry.verdict !== 'error') tried++;
+    if (entry.verdict === 'saved') saved++;
+  }
+  const summary = { candidates: candidates.length, tried, saved, savedRatio: tried ? saved / tried : null };
+  debug.log('loop.orchestrator', 'resync-shadow-summary', { candidates: summary.candidates, tried: summary.tried, saved });
+  return summary;
+}
+
+if (import.meta.main) {
+  try {
+    const args = process.argv.slice(2);
+    if (args.includes('--help')) {
+      console.log('Usage: bun src/loops/orchestrator/resync-shadow.ts [--max N] [--json]');
+    } else {
+      const index = args.indexOf('--max');
+      if (args.some((arg, i) => arg !== '--json' && arg !== '--max' && (index < 0 || i !== index + 1))
+        || (index >= 0 && (index === args.length - 1 || args.lastIndexOf('--max') !== index))) throw new Error('usage: resync-shadow.ts [--max N] [--json]');
+      const max = index < 0 ? 3 : Number(args[index + 1]);
+      const summary = await runResyncShadow(max);
+      console.log(process.argv.includes('--json') ? JSON.stringify(summary) : `resync-shadow candidates=${summary.candidates} tried=${summary.tried} saved=${summary.saved} savedRatio=${summary.savedRatio === null ? 'n/a' : `${(summary.savedRatio * 100).toFixed(1)}%`}`);
+    }
+  } catch (error) {
+    console.error(`resync-shadow: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  }
+}

package/src/loops/orchestrator/seat-share.ts

@@ -0,0 +1,56 @@
+import type { ChecklistItem } from '../../release-loop/checklist.js';
+import type { OrchestratorSeat } from '../../user-config.js';
+
+const SEATS: readonly OrchestratorSeat[] = ['OP', 'TC', 'MK', 'UX'];
+type WorkCell = Pick<ChecklistItem, 'owner' | 'status'>;
+
+/** Allocate whole base slots by remaining work; this calculation does not decide launches. */
+export function calculateSeatBaseShares({ totalSlots, currentRound, nextRound, seatCaps }: {
+  totalSlots: number;
+  currentRound: readonly WorkCell[];
+  nextRound: readonly WorkCell[];
+  seatCaps: Readonly<Record<OrchestratorSeat, number>>;
+}): Record<OrchestratorSeat, number> {
+  if (!Number.isSafeInteger(totalSlots) || totalSlots < 0 ||
+    SEATS.some(seat => !Number.isSafeInteger(seatCaps[seat]) || seatCaps[seat] < 0)) {
+    throw new RangeError('totalSlots and seatCaps must be nonnegative safe integers');
+  }
+  const shares: Record<OrchestratorSeat, number> = { OP: 0, TC: 0, MK: 0, UX: 0 };
+  const weights: Record<OrchestratorSeat, number> = { OP: 0, TC: 0, MK: 0, UX: 0 };
+  for (const [cells, weight] of [[currentRound, 2], [nextRound, 1]] as const) {
+    for (const cell of cells) {
+      if (cell.status !== 'yellow') continue;
+      const seat = cell.owner?.split('/')[0];
+      if (SEATS.some(id => id === seat)) weights[seat as OrchestratorSeat] += weight;
+    }
+  }
+
+  let available = Math.min(totalSlots, SEATS.reduce((sum, seat) => sum + seatCaps[seat], 0));
+  let eligible = SEATS.filter(seat => weights[seat] > 0 && seatCaps[seat] > 0);
+  while (available > 0 && eligible.length > 0) {
+    const totalWeight = eligible.reduce((sum, seat) => sum + weights[seat], 0);
+    const ideal = (seat: OrchestratorSeat) => available * weights[seat] / totalWeight;
+    const capped = eligible.filter(seat => ideal(seat) >= seatCaps[seat]);
+    if (capped.length > 0) {
+      for (const seat of capped) {
+        shares[seat] = seatCaps[seat];
+        available -= seatCaps[seat];
+      }
+      eligible = eligible.filter(seat => !capped.includes(seat));
+      continue;
+    }
+    const remainders = eligible.map(seat => ({ seat, exact: ideal(seat) }));
+    for (const { seat, exact } of remainders) {
+      shares[seat] = Math.floor(exact);
+      available -= shares[seat];
+    }
+    remainders.sort((a, b) => (b.exact - Math.floor(b.exact)) - (a.exact - Math.floor(a.exact)));
+    for (const { seat } of remainders) {
+      if (available === 0) break;
+      shares[seat]++;
+      available--;
+    }
+    break;
+  }
+  return shares;
+}

package/src/loops/orchestrator/tick.ts

@@ -0,0 +1,309 @@
+import { withFileLockSync } from '../../storage/file-lock.js';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { CardStore, taskCardsDir, type TaskCard } from '../../task-cards/card-store.js';
+import { Database } from 'bun:sqlite';
+import { type ChecklistItem } from '../../release-loop/checklist.js';
+import { effectiveInstanceRoot } from '../../instance/resolve.js';
+import { getUserConfig } from '../../user-config.js';
+import { debug } from '../../debug/log.js';
+import { listSelfDevRuns, runSummaryLine, selfDevRunsDir } from '../../self-dev/run-store.js';
+
+export type Window = '08' | '12' | '18';
+export type Node = 'intake' | 'split' | 'place' | 'delegate' | 'reconcile' | 'report';
+export type Mode = 'off' | 'shadow' | 'live';
+const SEAT_LOOP_IDS: Readonly<Record<string, string>> = { OP: 'op-seat', MK: 'cmo-seat', TC: 'tc-seat', UX: 'ux-seat' };
+export interface Cell { id: string; title: string; seat?: string; host?: string; version?: string; cardId: string; origin: 'candidate' | 'flow1a'; priority?: 'P0' | 'P1' | 'P2'; predecessors?: string[] }
+export interface TickState {
+  runId: string; window: Window; mode: Mode; day: string;
+  cards: TaskCard[]; skippedCards: Array<{ id: string; reason: string }>; cells: Cell[]; placed: number; unplaced?: number; delegated: number; wouldDelegate: number; rebalanced?: number; rebalanceBlocked?: Array<{ id: string; reason: string }>;
+  reconciled: { reached: number; progressing: number; blocked: number; unknown: number };
+  runSummaries?: string[];
+  nodes: Partial<Record<Node, 'ok' | 'skipped'>>;
+  missing: string[];
+}
+/** FLOW1a contract: with `{ shadow: true }` the splitter only proposes cells and writes nothing (cards, ledgers, LLM side effects excepted). */
+export type SplitAdapter = (card: TaskCard, opts?: { shadow?: boolean }) => Promise<Array<{ id: string; title: string; seat?: string; host?: string }>> | Array<{ id: string; title: string; seat?: string; host?: string }>;
+/** RELPLAN1 `placeCell(input: PlacementCell)` — owner·priority·predecessors are required; the result carries no seat. */
+export type PlacementInput = { id: string; title: string; owner: string; priority: 'P0' | 'P1' | 'P2'; predecessors: string[] };
+export type PlaceAdapter = (cell: PlacementInput) => Promise<{ version?: string } | null> | { version?: string } | null;
+export type RebalanceAdapter = (version: string) => Promise<{ decisions: unknown[]; blocked: Array<{ id: string; reason: string }> }> | { decisions: unknown[]; blocked: Array<{ id: string; reason: string }> };
+export interface TickDeps {
+  root?: string; now?: Date; mode?: Mode; runId?: string; window?: Window;
+  cards?: () => TaskCard[]; split?: SplitAdapter; placeCell?: PlaceAdapter;
+  loadAdapter?: (path: string, name: string) => Promise<unknown>;
+  checklist?: (version: string) => Pick<ChecklistItem, 'id' | 'status'>[];
+  observe?: (event: string, data: { loopId: string; runId: string; window: Window; node: Node; reason: string; count: number; targetLoopId?: string }) => void;
+  print?: (line: string) => void;
+}
+
+export function kstWindow(now: Date): Window {
+  const hour = Number(new Intl.DateTimeFormat('en-US', { timeZone: 'Asia/Seoul', hour: '2-digit', hourCycle: 'h23' }).format(now));
+  return hour < 12 ? '08' : hour < 18 ? '12' : '18';
+}
+function kstDay(now: Date): string {
+  return new Intl.DateTimeFormat('en-CA', { timeZone: 'Asia/Seoul', year: 'numeric', month: '2-digit', day: '2-digit' }).format(now);
+}
+export function activeNode(node: Node, window: Window): boolean {
+  return node === 'report' || (window === '08' ? node !== 'reconcile' : node === 'reconcile');
+}
+function validVersion(version: unknown): version is string {
+  return typeof version === 'string' && /^\d+\.\d+\.\d+(?:-(?:rc|alpha|beta)\.\d+)?$/.test(version);
+}
+export function wishCards(cards: readonly TaskCard[]): TaskCard[] {
+  return cards.filter(card => card.status === 'open' && card.goalId.startsWith('wish:') &&
+    !card.sections.some(section => section.key === 'orch:split' || section.key.startsWith('orch:split:')));
+}
+export function reconciliation(cells: readonly Cell[], requests: readonly { key: string; status: string }[], checklist: (version: string) => Pick<ChecklistItem, 'id' | 'status'>[]): TickState['reconciled'] {
+  const result = { reached: 0, progressing: 0, blocked: 0, unknown: 0 };
+  const byVersion = new Map<string, Pick<ChecklistItem, 'id' | 'status'>[]>();
+  const keys = new Set(requests.filter(row => row.status === 'queued').map(row => row.key));
+  for (const cell of cells) {
+    if (!keys.has(`orch:${cell.cardId}:${cell.id}`) || !cell.version) { result.unknown++; continue; }
+    if (!byVersion.has(cell.version)) byVersion.set(cell.version, checklist(cell.version));
+    const status = byVersion.get(cell.version)!.find(item => item.id === cell.id)?.status;
+    if (status === 'green' || status === 'done') result.reached++;
+    else if (status === 'yellow') result.progressing++;
+    else if (status === 'red') result.blocked++;
+    else result.unknown++;
+  }
+  return result;
+}
+export function reportLine(state: TickState): string {
+  const r = state.reconciled;
+  const line = `orchestrator ${state.window} cards=${state.cards.length} cells=${state.cells.length} placed=${state.missing.includes('relplan1-absent') ? 'missing' : state.placed} delegated=${state.mode === 'shadow' ? `would ${state.wouldDelegate}` : state.delegated} reconciled=${r.reached}/${r.progressing}/${r.blocked}/${r.unknown} mode=${state.mode}`;
+  const details = [...(state.rebalanceBlocked ?? []).map(row => `⛔ 이월 거부 ${row.id}: ${row.reason}`), ...(state.runSummaries ?? [])];
+  return details.length ? `${line}\n${details.join('\n')}` : line;
+}
+function readCardSnapshot(root: string): { cards: TaskCard[]; skippedCards: TickState['skippedCards'] } {
+  const dir = taskCardsDir(root);
+  if (!existsSync(dir)) return { cards: [], skippedCards: [] };
+  const cards: TaskCard[] = [];
+  const skippedCards: TickState['skippedCards'] = [];
+  for (const name of readdirSync(dir).filter(name => /^[a-zA-Z0-9_-]+\.jsonl$/.test(name))) {
+    const id = name.slice(0, -'.jsonl'.length);
+    try {
+      let card: TaskCard | undefined;
+      const raw = readFileSync(join(dir, name), 'utf8');
+      if (raw && !raw.endsWith('\n')) throw new Error(`incomplete card journal: ${name}`);
+      for (const line of raw.split('\n').filter(Boolean)) {
+        const event = JSON.parse(line) as { type: string; id?: string; goalId?: string; title?: string; createdAt: string; key?: string; owner?: string; content?: string };
+        if (event.type === 'created' && event.id && event.goalId && event.title) card = { id: event.id, goalId: event.goalId, title: event.title, createdAt: event.createdAt, status: 'open', sections: [] };
+        else if (event.type === 'section' && card && event.key && event.owner && event.content) card.sections.push({ key: event.key, owner: event.owner, content: event.content, createdAt: event.createdAt });
+        else if (event.type === 'closed' && card) card.status = 'closed';
+      }
+      if (card) {
+        if (card.id !== id) throw new Error(`card journal id mismatch: ${name}`);
+        cards.push(card);
+      }
+    } catch (error) { skippedCards.push({ id, reason: String(error) }); }
+  }
+  return { cards: cards.sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.id.localeCompare(a.id)), skippedCards };
+}
+function readChecklist(root: string, version: string): Pick<ChecklistItem, 'id' | 'status'>[] {
+  const path = join(root, 'release', 'features.sqlite');
+  if (!existsSync(path)) return [];
+  const db = new Database(path, { readonly: true, strict: true });
+  try { return db.query('SELECT feature_id AS id, status FROM assignments WHERE version = ?').all(version) as Pick<ChecklistItem, 'id' | 'status'>[]; }
+  finally { db.close(); }
+}
+function journal(root: string): string { return join(root, 'seat-requests', 'requests.jsonl'); }
+function readRequests(root: string): Array<{ key: string; status: string }> {
+  const path = journal(root);
+  return existsSync(path) ? readFileSync(path, 'utf8').split('\n').filter(Boolean).map(line => JSON.parse(line) as { key: string; status: string }) : [];
+}
+function stateFile(root: string, runId: string): string {
+  if (!/^[a-zA-Z0-9._-]+$/.test(runId) || runId === '.' || runId === '..') throw new Error('Invalid orchestrator runId');
+  return join(root, 'loop', 'orchestrator', `${runId}.json`);
+}
+function restorePrevious(root: string, day: string, mode: Mode): Pick<TickState, 'cards' | 'cells'> | null {
+  const dir = join(root, 'loop', 'orchestrator');
+  if (!existsSync(dir)) return null;
+  const states = readdirSync(dir).filter(name => /^[a-zA-Z0-9._-]+\.json$/.test(name))
+    .map(name => ({ name, state: JSON.parse(readFileSync(join(dir, name), 'utf8')) as TickState }))
+    .filter(({ state }) => state.day === day && state.mode === mode && state.window === '08' && state.nodes.delegate === 'ok');
+  if (!states.length) return null;
+  states.sort((a, b) => a.name.localeCompare(b.name));
+  const cards = new Map<string, TaskCard>();
+  const cells = new Map<string, Cell>();
+  for (const { state } of states) {
+    for (const card of state.cards) cards.set(card.id, card);
+    for (const cell of state.cells) cells.set(`${cell.cardId}:${cell.id}`, cell);
+  }
+  return { cards: [...cards.values()], cells: [...cells.values()] };
+}
+function initial(runId: string, window: Window, mode: Mode, day: string): TickState {
+  return { runId, window, mode, day, cards: [], skippedCards: [], cells: [], placed: 0, delegated: 0, wouldDelegate: 0,
+    reconciled: { reached: 0, progressing: 0, blocked: 0, unknown: 0 }, nodes: {}, missing: [] };
+}
+function graphRunId(): string | undefined {
+  const context = process.env.ELANOUS_GRAPH_CONTEXT;
+  if (!context) return undefined;
+  try {
+    const value = JSON.parse(readFileSync(context, 'utf8')) as { graphId?: string; runId?: string };
+    if (value.graphId !== 'orchestrator' || typeof value.runId !== 'string') throw new Error('invalid orchestrator graph context');
+    return value.runId;
+  } catch (error) { throw new Error(`orchestrator graph context unavailable: ${String(error)}`); }
+}
+async function optionalAdapter<T>(path: string, name: string): Promise<T | undefined> {
+  try { return (await import(path) as Record<string, unknown>)[name] as T | undefined; }
+  catch (error) {
+    if ((error as { code?: string }).code === 'ERR_MODULE_NOT_FOUND' || (error as { code?: string }).code === 'MODULE_NOT_FOUND') return undefined;
+    throw error;
+  }
+}
+
+/** A graph command invokes one node; only the per-run file carries data across processes. */
+export async function runOrchestratorNode(node: Node, deps: TickDeps = {}): Promise<TickState> {
+  const now = deps.now ?? new Date();
+  const window = deps.window ?? kstWindow(now);
+  const root = deps.root ?? effectiveInstanceRoot();
+  const runId = deps.runId ?? graphRunId() ?? `${kstDay(now)}-${window}`;
+  const path = stateFile(root, runId);
+  const configured = deps.mode ?? getUserConfig().loops?.orchestrator?.mode;
+  const mode: Mode = configured === 'off' || configured === 'live' ? configured : 'shadow';
+  const state: TickState = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) as TickState : initial(runId, window, mode, kstDay(now));
+  if (state.window !== window || state.mode !== mode) throw new Error('orchestrator run window/mode changed');
+  const predecessor: Partial<Record<Node, Node>> = { split: 'intake', place: 'split', delegate: 'place', reconcile: 'delegate', report: 'reconcile' };
+  const preceding = predecessor[node];
+  if (preceding && !state.nodes[preceding]) throw new Error(`orchestrator ${node}: missing ${preceding} result`);
+  const loadAdapter = deps.loadAdapter ?? optionalAdapter;
+  const adapter = async <T>(module: string, name: string): Promise<T | undefined> => {
+    const value = await loadAdapter(module, name);
+    return typeof value === 'function' ? value as T : undefined;
+  };
+  const observe = (event: string, reason = '', count = 0, targetLoopId?: string): void => {
+    const data = { loopId: 'orchestrator', runId, window, node, reason, count, ...(targetLoopId ? { targetLoopId } : {}) };
+    try { (deps.observe ?? ((name, payload) => debug.log('loop.orchestrator', name, payload)))(event, data); }
+    catch { /* observation must not change the run */ }
+  };
+  if (mode !== 'off' && activeNode(node, window) && state.nodes[node] !== 'ok') {
+    if (node === 'intake') {
+      if (mode === 'live' && deps.cards) { state.cards = wishCards(deps.cards()); state.skippedCards = []; }
+      else {
+        const snapshot = readCardSnapshot(root);
+        state.cards = wishCards(snapshot.cards);
+        state.skippedCards = snapshot.skippedCards;
+        state.skippedCards.forEach(() => observe('exchange', 'card-unreadable', 1));
+      }
+      observe('exchange', 'wish-cards', state.cards.length);
+    } else if (node === 'split') {
+      // Shadow also asks the splitter (it only proposes cells); only live records `orch:split` on the card.
+      const split = deps.split ?? await adapter<SplitAdapter>('../../flow-loop/split.js', 'splitCard');
+      if (!split) { state.missing.push('flow1a-absent'); observe('node-missing', 'flow1a-absent', state.cards.length); }
+      state.cells = [];
+      for (const card of state.cards) {
+        const cells = split ? await split(card, { shadow: mode === 'shadow' }) : [{ id: card.id, title: card.title }];
+        for (const cell of cells) {
+          if (!cell.id?.trim() || !cell.title?.trim()) throw new Error('invalid split cell');
+          state.cells.push({ cardId: card.id, id: cell.id, title: cell.title, origin: split ? 'flow1a' : 'candidate', ...(cell.seat ? { seat: cell.seat } : {}), ...(cell.host !== undefined ? { host: cell.host } : {}) });
+        }
+        if (split && cells.length && mode === 'live') {
+          const store = new CardStore(root);
+          try {
+            store.appendSection(card.id, { key: 'orch:split', owner: 'orchestrator', content: JSON.stringify(cells) });
+          } finally { store.close(); }
+        }
+      }
+    } else if (node === 'place') {
+      const place = deps.placeCell ?? await adapter<PlaceAdapter>('../../release-loop/placement.js', 'placeCell');
+      const available = typeof place === 'function';
+      if (!available) { state.missing.push('relplan1-absent'); observe('node-missing', 'relplan1-absent', state.cells.length); }
+      else if (mode === 'shadow') observe('exchange', 'relplan1-shadow-not-invoked', state.cells.length);
+      if (mode === 'live' && available) for (const cell of state.cells) {
+        if (cell.origin !== 'flow1a') continue;
+        // TC review must-fix ②: map to the placer's required shape; a cell without an owner is unplaced, not a crash.
+        if (!cell.seat) { state.unplaced = (state.unplaced ?? 0) + 1; observe('exchange', 'unplaced-no-owner', 1); continue; }
+        const placed = await place({ id: cell.id, title: cell.title, owner: cell.seat, priority: cell.priority ?? 'P2', predecessors: cell.predecessors ?? [] });
+        if (validVersion(placed?.version)) {
+          cell.version = placed.version;
+          state.placed++;
+        }
+      }
+    } else if (node === 'delegate') {
+      const path = journal(root);
+      const keys = new Set(readRequests(root).map(row => row.key));
+      for (const cell of state.cells) {
+        if (cell.origin !== 'flow1a' || !cell.seat) continue;
+        const targetLoopId = SEAT_LOOP_IDS[cell.seat];
+        if (!targetLoopId) continue;
+        const key = `orch:${cell.cardId}:${cell.id}`;
+        if (keys.has(key)) continue;
+        // Shadow shows what it would hand over even before a release is chosen (placement is not invoked in shadow).
+        if (mode === 'shadow') { keys.add(key); state.wouldDelegate++; observe('would-delegate', validVersion(cell.version) ? key : `${key} (unplaced)`, 1, targetLoopId); continue; }
+        if (!validVersion(cell.version)) continue;
+        keys.add(key);
+        mkdirSync(dirname(path), { recursive: true });
+        // TC review must-fix ①: the seat-requests journal contract needs receiptId, and appends are serialized under the
+        // same lock as the traffic node — an invalid row stops request intake for every seat.
+        const appended = withFileLockSync(`${path}.lock`, () => {
+          const existing = existsSync(path) ? readFileSync(path, 'utf8') : '';
+          if (existing.split('\n').some(line => {
+            if (!line) return false;
+            try { return (JSON.parse(line) as { key?: string }).key === key; } catch { throw new Error('invalid seat request journal'); }
+          })) return false;
+          appendFileSync(path, `${JSON.stringify({ key, receiptId: key, seat: cell.seat, ...(cell.host !== undefined ? { host: cell.host } : {}), loopId: targetLoopId, text: cell.title, status: 'queued', queuedAt: now.toISOString(), source: 'orchestrator', cell: cell.id, version: cell.version })}\n`);
+          return true;
+        });
+        if (!appended) continue;
+        state.delegated++;
+        observe('exchange', 'queued', 1, targetLoopId);
+      }
+    } else if (node === 'reconcile') {
+      if (window !== '08' && state.cells.length === 0) {
+        const previous = restorePrevious(root, state.day, mode);
+        if (previous) { state.cards = previous.cards; state.cells = previous.cells; }
+      }
+      const requests = readRequests(root);
+      state.reconciled = reconciliation(state.cells, requests, mode === 'shadow' ? version => readChecklist(root, version) : (deps.checklist ?? (version => readChecklist(root, version))));
+      const from = new Date(`${state.day}T00:00:00+09:00`).getTime();
+      state.runSummaries = listSelfDevRuns(selfDevRunsDir(root))
+        .filter(run => run.updatedAt >= from && run.updatedAt < from + 86_400_000)
+        .map(run => runSummaryLine(run));
+      observe('exchange', 'reconciled', state.cells.length);
+      if (window === '18') {
+        const rebalance = await adapter<RebalanceAdapter>('../../release-loop/placement.js', 'rebalance');
+        if (!rebalance) { state.missing.push('k1b-absent'); observe('node-missing', 'k1b-absent', 1); }
+        else {
+          const versions = [...new Set(state.cells.map(cell => cell.version).filter(validVersion))];
+          if (mode === 'shadow') observe('exchange', 'rebalance-shadow-not-invoked', versions.length);
+          else {
+            state.rebalanced = 0;
+            state.rebalanceBlocked = [];
+            for (const version of versions) {
+              const result = await rebalance(version);
+              state.rebalanced += result.decisions.length;
+              state.rebalanceBlocked.push(...result.blocked);
+              for (const blocked of result.blocked) observe('exchange', `rebalance-blocked: ${blocked.id} ${blocked.reason}`, 1);
+            }
+          }
+        }
+      }
+    } else if (node === 'report') (deps.print ?? console.log)(reportLine(state));
+    state.nodes[node] = 'ok';
+  } else if (state.nodes[node] !== 'ok') {
+    // A rerun of a node that already completed keeps its result (review round 3): only never-run nodes become skipped.
+    state.nodes[node] = 'skipped';
+  }
+  observe('tick', state.nodes[node], state.cells.length);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(state));
+  return state;
+}
+
+if (import.meta.main) {
+  const node = process.argv[2];
+  const index = process.argv.indexOf('--window');
+  const window = index < 0 ? undefined : process.argv[index + 1];
+  if (!['intake', 'split', 'place', 'delegate', 'reconcile', 'report'].includes(node ?? '') ||
+      (window !== undefined && !['08', '12', '18'].includes(window))) {
+    console.error('orchestrator: expected <intake|split|place|delegate|reconcile|report> [--window 08|12|18]');
+    process.exitCode = 2;
+  } else {
+    void (async () => {
+      try { await (await import('../../domains/standalone-log-sink.js')).registerStandaloneLogSink('orchestrator'); }
+      catch { /* local execution can still use the per-run file */ }
+      await runOrchestratorNode(node as Node, { window: window as Window | undefined });
+    })().catch(error => { console.error(`orchestrator ${node}: ${String(error)}`); process.exitCode = 1; });
+  }
+}