elanous 0.2.14 → 0.2.15

package/src/harness/helper-scan.ts

@@ -125,12 +125,24 @@ export async function scanStoppedPrs({ runGh }: { runGh: RunGh }): Promise<Scann
 }
 
 if (import.meta.main) {
-  if (process.argv.slice(2).some((arg) => arg !== '--json')) {
-    console.error('사용법: bun src/harness/helper-scan.ts [--json]');
+  const args = process.argv.slice(2);
+  const json = args.includes('--json');
+  const recordShadows = args.includes('--record-shadows');
+  if (args.some((arg) => arg !== '--json' && arg !== '--record-shadows') || (json && recordShadows) || args.length > 1) {
+    console.error('사용법: bun src/harness/helper-scan.ts [--json | --record-shadows]');
     process.exitCode = 1;
   } else {
-    const rows = await scanStoppedPrs({ runGh: (args) => execFileSync('gh', [...args], { encoding: 'utf8' }) });
-    if (process.argv.includes('--json')) console.log(JSON.stringify(rows, null, 2));
+    // 열린 PR 본문 전체는 기본 버퍼(1MB)를 넘는다(10-05 운영 ENOBUFS) — 넉넉히 준다.
+    const runGh = (args: readonly string[]) => execFileSync('gh', [...args], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
+    const rows = await scanStoppedPrs({ runGh });
+    if (recordShadows) {
+      // 명시적 그림자 기록에서만 추가 PR 조회와 헬퍼 원장 쓰기를 수행한다(발사 0).
+      const { recordRepairShadows } = await import('./helper-repair.js');
+      const { effectiveInstanceRoot } = await import('../instance/resolve.js');
+      const shadows = await recordRepairShadows(rows, { runGh, root: effectiveInstanceRoot() });
+      if (shadows.length) console.log(`수리 골 그림자 ${shadows.length}건 → helper/repairs.jsonl`);
+    }
+    if (json) console.log(JSON.stringify(rows, null, 2));
     else for (const row of rows) {
       const gate = row.blockerCount ? ` · Gate 차단 ${row.blockerCount}(${row.hasPublicExportLeak ? row.blockers.find((line) => /public-export-leak/i.test(line))?.trim() ?? '✗ public-export-leak (6번째 이후)' : row.blockers[0]!.trim()})` : '';
       console.log(`#${row.pr} ${row.category}${gate} → ${row.firstAction}`);

package/src/harness/launch-stamp.ts

@@ -0,0 +1,236 @@
+/**
+ * ONEDOOR-1 — every harness run stamps which door it came through,
+ * who launched it, and whether it went through the queue.
+ *
+ * The stamp lives on the run ledger's first row (`run-origin`). A ledger
+ * written before this stamp, or a launch that named no door, reads as
+ * `unknown` — that is distinct from a count of zero.
+ */
+import { readdirSync } from 'node:fs';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
+
+export const LAUNCH_DOORS = [
+  'harness-say',
+  'harness-ask',
+  'dev-ask',
+  'self-implement',
+  'self-orchestrate',
+  'queue-tick',
+  'agent-mission',
+  'daemon-tool',
+  'telegram',
+  'pwa',
+  'unknown',
+] as const;
+
+export type LaunchDoor = (typeof LAUNCH_DOORS)[number];
+
+export const LAUNCH_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+export type LaunchSeat = (typeof LAUNCH_SEATS)[number];
+
+export interface LaunchStamp {
+  readonly entrance: LaunchDoor;
+  /** Seat, human session, or loop name — whichever the launch actually named. */
+  readonly actor: string;
+  readonly viaQueue: boolean;
+  readonly queueId?: string;
+}
+
+const ENTRANCE_TO_DOOR: Readonly<Record<string, LaunchDoor>> = {
+  'cli-harness-say': 'harness-say',
+  'cli-harness-ask': 'harness-ask',
+  'cli-dev-ask': 'dev-ask',
+  'cli-drive': 'dev-ask',
+  'tui-slash-ask': 'dev-ask',
+  'tui-slash-dev': 'dev-ask',
+  'cli-self-implement': 'self-implement',
+  'nl-self-implement': 'self-implement',
+  'daemon-self-implement': 'daemon-tool',
+  'cli-self-orchestrate': 'self-orchestrate',
+  'nl-self-orchestrate': 'self-orchestrate',
+  'cli-harness-orchestrate': 'self-orchestrate',
+  'cli-harness-mission': 'agent-mission',
+  'agent-mission': 'agent-mission',
+  'daemon-harness-ask': 'daemon-tool',
+  'daemon-tool': 'daemon-tool',
+  telegram: 'telegram',
+  pwa: 'pwa',
+};
+
+const DOOR_SET = new Set<string>(LAUNCH_DOORS);
+
+export function isLaunchDoor(value: string): value is LaunchDoor {
+  return DOOR_SET.has(value);
+}
+
+/** Reuse an existing entrance tag. Anything unnamed or unrecognized is `unknown`, never a zero. */
+export function doorFromEntrance(entrance: string | undefined | null): LaunchDoor {
+  if (!entrance) return 'unknown';
+  const trimmed = entrance.trim();
+  if (!trimmed) return 'unknown';
+  if (ENTRANCE_TO_DOOR[trimmed]) return ENTRANCE_TO_DOOR[trimmed];
+  if (isLaunchDoor(trimmed)) return trimmed;
+  return 'unknown';
+}
+
+export interface LaunchStampInput {
+  readonly entrance?: string | null;
+  readonly seat?: string | null;
+  readonly session?: string | null;
+  readonly loopName?: string | null;
+  readonly viaQueue?: boolean;
+  readonly queueId?: string | null;
+  readonly env?: NodeJS.ProcessEnv;
+}
+
+function named(value: string | null | undefined): string | undefined {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+/** Seat wins, then the human session, then the loop name. A blank actor stays blank. */
+export function resolveLaunchActor(input: LaunchStampInput, env: NodeJS.ProcessEnv = process.env): string {
+  const seat = named(input.seat) ?? named(env.ELANOUS_HARNESS_SEAT);
+  if (seat && (LAUNCH_SEATS as readonly string[]).includes(seat)) return seat;
+  return named(input.session)
+    ?? named(env.ELANOUS_ORIGIN_SESSION)
+    ?? named(input.loopName)
+    ?? named(env.ELANOUS_LOOP_NAME)
+    ?? '';
+}
+
+export function resolveLaunchStamp(input: LaunchStampInput = {}, env: NodeJS.ProcessEnv = input.env ?? process.env): LaunchStamp {
+  const queueId = named(input.queueId) ?? named(env.ELANOUS_HARNESS_QUEUE_LAUNCH);
+  const viaQueue = input.viaQueue === true || queueId !== undefined;
+  const door = viaQueue ? 'queue-tick' : doorFromEntrance(input.entrance ?? env.ELANOUS_HARNESS_ENTRANCE);
+  return {
+    entrance: door,
+    actor: resolveLaunchActor(input, env),
+    viaQueue,
+    ...(queueId ? { queueId } : {}),
+  };
+}
+
+/** Read the stamp off a ledger's first row. Missing or unreadable stamps are `unknown`. */
+export function launchStampFromLedger(entries: readonly RunLedgerEntry[] | null | undefined): LaunchStamp {
+  const first = entries?.[0];
+  const raw = first?.data?.launch;
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { entrance: 'unknown', actor: '', viaQueue: false };
+  }
+  const launch = raw as Record<string, unknown>;
+  const entrance = typeof launch.entrance === 'string' && isLaunchDoor(launch.entrance) ? launch.entrance : 'unknown';
+  const queueId = typeof launch.queueId === 'string' && launch.queueId.trim() ? launch.queueId.trim() : undefined;
+  return {
+    entrance,
+    actor: typeof launch.actor === 'string' ? launch.actor : '',
+    viaQueue: launch.viaQueue === true || queueId !== undefined,
+    ...(queueId ? { queueId } : {}),
+  };
+}
+
+export interface DoorRow {
+  readonly entrance: LaunchDoor;
+  readonly runs: number;
+  readonly viaQueue: number;
+  readonly outsideQueue: number;
+}
+
+export interface DoorTable {
+  readonly sinceMs: number;
+  readonly runs: number;
+  readonly unknown: number;
+  readonly outsideQueue: number;
+  readonly viaQueue: number;
+  readonly rows: readonly DoorRow[];
+}
+
+export interface DoorTableOptions {
+  readonly dir?: string;
+  readonly sinceMs?: number;
+  readonly now?: number;
+  readonly list?: (dir: string) => string[];
+  readonly load?: (runId: string, dir: string) => RunLedgerEntry[] | null;
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+function entryTime(entry: RunLedgerEntry | undefined): number | undefined {
+  if (!entry?.timestamp) return undefined;
+  const parsed = Date.parse(entry.timestamp);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+/** One row per door that actually fired, plus the period totals. Untagged ledgers count as `unknown`. */
+export function queryLaunchDoors(options: DoorTableOptions = {}): DoorTable {
+  const dir = options.dir ?? runLedgerDir();
+  const now = options.now ?? Date.now();
+  const sinceMs = options.sinceMs ?? DAY_MS;
+  const cutoff = now - sinceMs;
+  const list = options.list ?? ((path: string) => {
+    try { return readdirSync(path); } catch { return []; }
+  });
+  const load = options.load ?? ((runId: string, ledgerDir: string) => {
+    try { return loadRunLedger(runId, ledgerDir); } catch { return null; }
+  });
+  const counts = new Map<LaunchDoor, { runs: number; viaQueue: number }>();
+  let runs = 0;
+  let unknown = 0;
+  let outsideQueue = 0;
+  let viaQueue = 0;
+  for (const file of list(dir)) {
+    if (!file.endsWith('.jsonl')) continue;
+    const runId = file.slice(0, -'.jsonl'.length);
+    const entries = load(runId, dir);
+    if (!entries || entries.length === 0) continue;
+    const started = entryTime(entries[0]);
+    if (started !== undefined && started < cutoff) continue;
+    const stamp = launchStampFromLedger(entries);
+    runs += 1;
+    if (stamp.entrance === 'unknown') unknown += 1;
+    if (stamp.viaQueue) viaQueue += 1;
+    else outsideQueue += 1;
+    const row = counts.get(stamp.entrance) ?? { runs: 0, viaQueue: 0 };
+    row.runs += 1;
+    if (stamp.viaQueue) row.viaQueue += 1;
+    counts.set(stamp.entrance, row);
+  }
+  const rows = [...counts.entries()]
+    .map(([entrance, row]) => ({
+      entrance,
+      runs: row.runs,
+      viaQueue: row.viaQueue,
+      outsideQueue: row.runs - row.viaQueue,
+    }))
+    .sort((left, right) => right.runs - left.runs || left.entrance.localeCompare(right.entrance));
+  return { sinceMs, runs, unknown, outsideQueue, viaQueue, rows };
+}
+
+export function renderLaunchDoors(table: DoorTable): string {
+  const lines = [
+    `doors  runs=${table.runs}  outside-queue=${table.outsideQueue}  via-queue=${table.viaQueue}  unknown=${table.unknown}`,
+    'entrance          runs  via-queue  outside-queue',
+  ];
+  for (const row of table.rows) {
+    lines.push(`${row.entrance.padEnd(16)} ${String(row.runs).padStart(4)}  ${String(row.viaQueue).padStart(9)}  ${String(row.outsideQueue).padStart(13)}`);
+  }
+  if (table.rows.length === 0) lines.push('(no runs)');
+  const summed = table.rows.reduce((sum, row) => sum + row.runs, 0);
+  lines.push(`total            ${String(summed).padStart(4)}`);
+  return lines.join('\n');
+}
+
+const SINCE_PATTERN = /^(\d+)(m|h|d)$/;
+
+/** `--since 1d` (also `30m`, `12h`). Anything else is refused rather than guessed. */
+export function parseDoorSince(value: string | undefined, now = Date.now()): { sinceMs: number } | { error: string } {
+  if (value === undefined || value === '') return { sinceMs: DAY_MS };
+  const match = SINCE_PATTERN.exec(value.trim());
+  if (!match) return { error: `--since 는 30m · 12h · 1d 형태여야 합니다: ${value}` };
+  const amount = Number(match[1]);
+  const unit = match[2] === 'm' ? 60_000 : match[2] === 'h' ? 3_600_000 : DAY_MS;
+  if (!Number.isSafeInteger(amount) || amount < 1) return { error: `--since 는 1 이상이어야 합니다: ${value}` };
+  const sinceMs = amount * unit;
+  if (sinceMs > now) return { sinceMs };
+  return { sinceMs };
+}

package/src/harness/ledger-write-guard-child.fixture.ts

@@ -0,0 +1,12 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+import { recordRunExit } from './harness-incidents.js';
+import { appendRunLedgerEntry } from '../self-implement/run-ledger.js';
+
+const root = prodInstanceRoot();
+if (effectiveInstanceRoot() !== root) throw new Error('not the effective production root');
+const before = existsSync(root) ? readdirSync(root) : null;
+recordRunExit({ runId: 'run-test', reason: 'signal', status: 1, signal: null, at: new Date().toISOString() }, process.argv[2] ?? root);
+appendRunLedgerEntry({ runId: 'run-test', event: 'start', data: {} }, process.argv[3] ?? `${root}/run-ledger`);
+const after = existsSync(root) ? readdirSync(root) : null;
+console.log(JSON.stringify({ env: { NODE_ENV: process.env.NODE_ENV, ELANOUS_TEST_HOME: process.env.ELANOUS_TEST_HOME, HOME: process.env.HOME, ELANOUS_STATE_DIR: process.env.ELANOUS_STATE_DIR }, root, effectiveInstanceRoot: effectiveInstanceRoot(), before, after }));

package/src/harness/ledger-write-guard.ts

@@ -0,0 +1,35 @@
+import { realpathSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { debug } from '../debug/log.js';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+
+function physicalPath(path: string): string {
+  const absolute = resolve(path);
+  try {
+    return realpathSync(absolute);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    const parent = dirname(absolute);
+    if (parent === absolute) throw error;
+    return resolve(physicalPath(parent), relative(parent, absolute));
+  }
+}
+
+/** Refuse a test's write to the production instance, including an explicitly supplied ledger directory. */
+export function refuseProductionLedgerWriteInTest(
+  root: string,
+  store: string,
+  env: NodeJS.ProcessEnv = process.env,
+  productionRoot = prodInstanceRoot(),
+  instanceRoot = effectiveInstanceRoot(),
+): boolean {
+  if (env.NODE_ENV !== 'test' && !env.ELANOUS_TEST_HOME) return false;
+  const target = physicalPath(root);
+  const production = physicalPath(productionRoot);
+  const withinProduction = relative(production, target);
+  if (withinProduction === '..' || withinProduction.startsWith(`..${sep}`) || isAbsolute(withinProduction)) return false;
+  try {
+    debug.log('harness.incidents', 'write-refused', { store, root: target, effectiveInstanceRoot: instanceRoot });
+  } catch { /* Observation cannot reopen a closed write boundary. */ }
+  return true;
+}

package/src/harness/pod-memory-policy.ts

@@ -0,0 +1,15 @@
+import type { GoalType } from '../self-implement/goal-author.js';
+import type { PodMemoryTier } from '../task-orchestrator/surfaces/self-implement-pod.js';
+
+export type PodMemorySelectionReason = 'explicit-option' | 'goal-type-default' | 'existing-tier';
+
+/** Select the harness Pod tier without discarding the existing implementation/operate decision. */
+export function selectPodMemoryTier(
+  goalType: GoalType,
+  explicitPodMemory: PodMemoryTier | undefined,
+  existingTier: PodMemoryTier = 'standard',
+): { tier: PodMemoryTier; reason: PodMemorySelectionReason } {
+  if (explicitPodMemory !== undefined) return { tier: explicitPodMemory, reason: 'explicit-option' };
+  if (goalType === 'research' || goalType === 'document') return { tier: 'lite', reason: 'goal-type-default' };
+  return { tier: existingTier, reason: 'existing-tier' };
+}

package/src/harness/repository-name.ts

@@ -0,0 +1,55 @@
+import { execFileSync } from 'node:child_process';
+import { getUserConfig, type UserConfig } from '../user-config.js';
+
+const REPOSITORY_NAME = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export interface RepositoryNameOptions {
+  /** Explicit --repo value. */
+  repo?: string;
+  config?: Pick<UserConfig, 'harness'>;
+  env?: NodeJS.ProcessEnv;
+  cwd?: string;
+  executeGh?: (args: string[]) => string;
+  /** Test seam. Default asks git whether cwd is a work tree. */
+  insideGitWorkTree?: (cwd: string) => boolean;
+}
+
+/** Resolve the GitHub owner/name without asking gh outside a git checkout. */
+export function resolveRepositoryName(options: RepositoryNameOptions = {}): string {
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const valid = (source: string, candidate: string | undefined): string | undefined => {
+    if (!candidate?.trim()) return undefined;
+    const name = candidate.trim();
+    if (!REPOSITORY_NAME.test(name) || name.includes('..')) {
+      throw new Error(`invalid ${source} (expected owner/name): ${candidate}`);
+    }
+    return name;
+  };
+  const flag = valid('--repo', options.repo);
+  if (flag) return flag;
+  const configured = valid('harness.repo', (options.config ?? getUserConfig()).harness?.repo);
+  if (configured) return configured;
+  const inherited = valid('GH_REPO', env.GH_REPO);
+  if (inherited) return inherited;
+  const insideGit = options.insideGitWorkTree ?? ((dir) => {
+    try {
+      return execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
+        cwd: dir, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'pipe'],
+      }).trim() === 'true';
+    } catch { return false; }
+  });
+  if (insideGit(cwd)) {
+    try {
+      const name = (options.executeGh ?? ((args) => execFileSync('gh', args, {
+        cwd, encoding: 'utf8', timeout: 30_000, stdio: ['ignore', 'pipe', 'pipe'], env,
+      })))(['repo', 'view', '--json', 'nameWithOwner', '--jq', '.nameWithOwner']).trim();
+      if (REPOSITORY_NAME.test(name) && !name.includes('..')) return name;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const line = message.split(/\r?\n/).map((row) => row.trim()).find((row) => row && !/^at\s/.test(row));
+      throw new Error(line || '저장소 이름 없음 — --repo 또는 harness.repo 설정');
+    }
+  }
+  throw new Error('저장소 이름 없음 — --repo 또는 harness.repo 설정');
+}

package/src/hq/fence-audit.ts

@@ -0,0 +1,90 @@
+// Read-only HQ fence inventory: use the installed crontab, never install a proposed replacement.
+import { debug } from '../debug/log.js';
+import { FENCE_ROLES } from './hq.js';
+import { inventoryCrontab, listSchedules, openSchedulesDb, parseCronLine, readCrontab } from '../domains/schedule-registry.js';
+import { cronLaunchedActionsWithFence, listAllLoops, shellSegments, type LoopRegistryOptions } from '../loops/registry.js';
+
+type SuggestedRole = 'cron' | 'seat-loop' | 'release-run' | 'conatus' | 'git-push' | 'ledger-cli' | 'unknown';
+export interface UnfencedCron {
+  raw: string;
+  cron: string;
+  command: string;
+  recommendedRole: SuggestedRole;
+  suggestedLine: string;
+  /** Unknown roles are not executable fence arguments; the operator must choose a role. */
+  manualReview?: true;
+}
+
+/** Only infer a specific role where the launched command names that activity. */
+function roleFor(command: string): SuggestedRole {
+  const launched = shellSegments(command).map(segment => segment.replace(/^cd\s+\S+\s*&&\s*/, '').replace(/(?:^|\s)(?:--message|--label|--note)\s+(?:'[^']*'|"[^"]*")/g, '')).join(' ');
+  if (/(?:^|[\s;&|])(?:\S*\/)?git\s+push\b|(?:^|[\s/])git-push\b|tree-sync\.sh\b/i.test(launched)) return 'git-push';
+  if (/(?:^|[\s/])(?:seat-loop|(?:op|tc|mk|ux)-seat|coord-bridge)(?:[.\s/-]|$)/i.test(launched)) return 'seat-loop';
+  if (/(?:^|[\s/])(?:release-run|landing-heal)(?:[.\s/-]|$)|\brelease\s+(?:run|publish|place|rebalance)\b/i.test(launched)) return 'release-run';
+  if (/(?:^|[\s/])conatus(?:[.\s/-]|$)/i.test(launched)) return 'conatus';
+  if (/\b(?:ledger|checklist)\s+(?:set|write|update|add|create|delete)\b|(?:^|[\s/])ledger-cli(?:[.\s/-]|$)/i.test(launched)) return 'ledger-cli';
+  if (/(?:^|[\s/])(?:steward|draft-cleanup|test-diet|contract-coordinator|market-posture|mission-request-judge)(?:[.\s/-]|$)/i.test(launched)) return 'cron';
+  if (/\b(?:graph\s+run|harness\s+queue\s+tick|card\s+intake-scan|flow\s+tick)\b/i.test(launched)) return 'cron';
+  return 'unknown';
+}
+
+const READ_ONLY = /^(?:hq (?:heartbeat|arbiter-check|seen|lease status|fence-audit)|(?:logs|config) (?:query|get|list)|loop (?:status|list)|card list|harness queue list)(?: |$)/i;
+/** `hq fence --role <x>` with a role the CLI rejects never runs the payload fenced. */
+function isFenceRole(role: string | undefined): boolean {
+  return !!role && (FENCE_ROLES as readonly string[]).includes(role);
+}
+function isReadOnly(script: string, args: string[]): boolean {
+  if (/^(?:cd|echo|printf|date|true)$/.test(script.split('/').pop() ?? '')) return true;
+  if (!/^(?:elanous|elanous\.mjs|eln)$/.test(script.split('/').pop() ?? '')) return false;
+  return READ_ONLY.test(args.slice(0, 3).join(' '));
+}
+const quote = (command: string) => `'${command.replaceAll("'", "'\"'\"'")}'`;
+
+/** Reuse the installed loop inventory without touching the production schedule DB. A registry fenceRole
+ * may describe only one job or segment, so each launched action is checked independently below. */
+export function hqFenceAudit(deps: {
+  read?: () => string;
+  loops?: typeof listAllLoops;
+  loopOptions?: LoopRegistryOptions;
+  log?: typeof debug.log;
+} = {}): UnfencedCron[] {
+  const text = (deps.read ?? readCrontab)();
+  const parsed = text.split('\n').map(raw => ({ raw, job: parseCronLine(raw) })).filter(
+    (entry): entry is { raw: string; job: { cron: string; command: string } } => entry.job !== null,
+  );
+  // Inventory into an in-memory registry so the production schedule DB is never written by an audit.
+  let schedules: ReturnType<typeof listSchedules> = [];
+  try {
+    const db = openSchedulesDb(':memory:');
+    try {
+      inventoryCrontab(db, { crontab: text });
+      schedules = listSchedules(db);
+    } finally { db.close(); }
+  } catch { /* schedule metadata is advisory; the installed crontab is the source */ }
+  // Registry rows are hints only: a fenceRole on one segment must not hide an unfenced sibling.
+  // A broken graph or schedule inventory must not prevent auditing the installed crontab.
+  let loops: ReturnType<typeof listAllLoops> = [];
+  try { loops = (deps.loops ?? listAllLoops)({ ...deps.loopOptions, schedules }); } catch { /* cron inspection remains available */ }
+  const results: UnfencedCron[] = [];
+  for (const { raw, job: { cron, command } } of parsed) {
+    const launches = cronLaunchedActionsWithFence(command);
+    const unfenced = launches.filter(({ script, args, fenceRole }) => script && !isFenceRole(fenceRole) && !isReadOnly(script, args));
+    if (!unfenced.length) continue;
+    const unfencedCommand = unfenced.map(({ script, args }) => [script, ...args].join(' ')).join(' ; ');
+    const registered = loops.find(loop => loop.cron === cron && loop.command === command);
+    // An unfenced registered orchestrator can supply a role for an opaque launch.
+    // If the aggregate inventory carries a fenceRole from another segment, do not
+    // borrow that segment's classification for the unfenced sibling.
+    const inferred = roleFor(unfencedCommand);
+    const recommendedRole = inferred === 'unknown' && registered?.kind === 'orchestrator' && !registered.fenceRole ? 'cron' : inferred;
+    results.push({ raw, cron, command, recommendedRole,
+      ...(recommendedRole === 'unknown' ? { manualReview: true as const } : {}),
+      suggestedLine: recommendedRole === 'unknown'
+        ? `# manual review (unknown role): ${cron} ${command}`
+        : `${cron} hq-fence ${recommendedRole} ${quote(command)}` });
+  }
+  try { (deps.log ?? debug.log.bind(debug))('hq.fence-audit', 'listed', {
+    unfenced: results.length, unknownRole: results.filter(row => row.recommendedRole === 'unknown').length,
+  }); } catch { /* observation is fail-soft */ }
+  return results;
+}

package/src/hq/hq.ts

@@ -4,10 +4,14 @@ import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync,
 import { homedir, hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import type { Command } from 'commander';
+import { writeStdoutJson } from '../cli/stdout-json.js';
 import { debug } from '../debug/log.js';
 import { DEFAULT_NEXUS_HTTP_PORT } from '../nexus/default-port.js';
 import { getElanousConfigDir } from '../elanous-config-dir.js';
 import { getUserConfig, type HqConfig, type HqFenceRole } from '../user-config.js';
+import { promoteHq, proposeHqPromotion, writeOpSeatRequest } from './promote.js';
+import type { HqOpRequestWriter, PromoteResult } from './promote.js';
 import {
   DEFAULT_TTL_SECONDS, decideAcquire, decideArbiterCheck, decideFence, decideRelease, decideRenew, defaultSshRunner,
   fileLeaseStore, leaseExpired, parseLease, probeReachable, recordView, serializeLease, sshLeaseStore, sshReachable, localShellRunner,
@@ -16,6 +20,21 @@ import {
 
 export const FENCE_ROLES: readonly HqFenceRole[] = ['telegram-poller', 'cron', 'seat-loop', 'release-run', 'conatus', 'git-push', 'ledger-cli'];
 
+/** Register only the read-only move inventory; keep it outside lease/fence mutation flows. */
+export function registerHqMovePlanCommand(hqCmd: Command): void {
+  hqCmd.command('move-plan').description('현재 호스트의 작업·launchd 및 대상 호스트 파일을 조회(읽기 전용)')
+    .requiredOption('--to <host>', '이동 대상 호스트')
+    .option('--json', 'JSON 출력')
+    .action(async (opts: { to: string; json?: boolean }) => {
+      try {
+        const { hqMovePlan, formatMovePlan } = await import('./move-plan.js');
+        const result = hqMovePlan(opts.to);
+        if (opts.json) await writeStdoutJson(`${JSON.stringify(result)}\n`);
+        else console.log(formatMovePlan(result));
+      } catch (error) { console.error(`hq move-plan: ${error instanceof Error ? error.message : String(error)}`); process.exitCode = 1; }
+    });
+}
+
 export interface HqDeps {
   config?: HqConfig;
   store?: LeaseStore;
@@ -29,6 +48,9 @@ export interface HqDeps {
   seenPath?: string;
   now?: () => number;
   log?: typeof debug.log;
+  /** Injection points for the OP seat request and the promotion runbook; production uses durable defaults. */
+  opRequest?: HqOpRequestWriter;
+  promote?: (host: string, apply: boolean) => PromoteResult;
 }
 
 interface Resolved { me: string; arbiter: string; standby: string; ttl: number; failOpen: Set<HqFenceRole>; store: LeaseStore; ssh: SshRunner; probe: HostProbe; localPath: string; seenPath: string; now: () => number; log: typeof debug.log }
@@ -247,19 +269,55 @@ export function hqHeartbeat(deps: HqDeps = {}) {
 
 /**
  * Arbiter check (cron on cloud-vm every 10 min, next to the file): probe the holder over the tailnet
- * (`tailscale ping` ⊕ nexus health · no ssh into home machines) and promote per rule ②.
+ * (`tailscale ping` ⊕ nexus health · no ssh into home machines); propose to OP by default.
  */
 export function hqArbiterCheck(deps: HqDeps & { leasePath?: string } = {}) {
   const r0 = resolve(deps);
   const r = deps.store ? r0 : { ...r0, store: fileLeaseStore(deps.leasePath ?? join(process.env.HOME ?? '', '.elanous-hq', 'lease.json')) };
-  let outcome: { promoted: boolean; streak: number; holder?: string; generation?: number; ping?: boolean; health?: boolean } = { promoted: false, streak: 0 };
+  let outcome: { promoted: boolean; streak: number; holder?: string; generation?: number; ping?: boolean; health?: boolean; runbookFailed?: string } = { promoted: false, streak: 0 };
+  let proposal: { holder: string; generation: number; streak: number } | undefined;
+  const config = deps.config ?? getUserConfig().hq ?? {};
+  const threshold = config.autoPromote?.streak ?? 3;
+  const autoPromote = config.autoPromote?.enabled === true;
+  let leaseMoved: { from: string; to: string; generation: number } | undefined;
   const result = mutate(r, (record, now) => {
     if (!record) return { ok: false, reason: 'no lease' };
     const seen = probeReachable(record.holder, r.probe);
-    const checked = decideArbiterCheck(record, { arbiter: r.me, standby: r.standby, arbiterReachesHolder: seen.reachable, now });
-    outcome = { promoted: checked.promoted, streak: checked.streak, holder: checked.next.holder, generation: checked.next.generation, ping: seen.ping, health: seen.health };
+    const checked = decideArbiterCheck(record, { arbiter: r.me, standby: r.standby, arbiterReachesHolder: seen.reachable, now,
+      promote: autoPromote, promoteAfterChecks: threshold });
+    proposal = !autoPromote && !seen.reachable && record.holder !== r.standby && checked.streak >= threshold
+      ? { holder: record.holder, generation: record.generation, streak: checked.streak } : undefined;
+    // promoteHq's own precondition is «lease holder = target», so the lease moves first and the runbook follows.
+    if (checked.promoted) leaseMoved = { from: record.holder, to: checked.next.holder, generation: checked.next.generation };
+    outcome = { promoted: false, streak: checked.streak, holder: checked.next.holder, generation: checked.next.generation, ping: seen.ping, health: seen.health };
     return { ok: true, next: checked.next };
   });
+  const moved = leaseMoved as { from: string; to: string; generation: number } | undefined; // assigned inside the mutate callback
+  if (result.ok && moved) {
+    let promotion: PromoteResult | undefined;
+    let failure: string | undefined;
+    try {
+      promotion = (deps.promote ?? ((host: string, apply: boolean) => promoteHq(host, apply)))(moved.to, true);
+      if (!promotion.ok) failure = promotion.lines.filter((line) => line.status === 'failed').map((line) => `${line.step}: ${line.measurement}`).join(' · ') || 'runbook returned ok=false';
+    } catch (error) { failure = String(error); }
+    if (failure === undefined) outcome = { ...outcome, promoted: true };
+    else {
+      // The lease already names the standby but the services did not move — never report this as a promotion.
+      outcome = { ...outcome, promoted: false, runbookFailed: failure };
+      try { r.log('hq.arbiter', 'promote-runbook-failed', { ...moved, error: failure }); } catch { /* observation is fail-soft */ }
+      try {
+        (deps.opRequest ?? ((request) => writeOpSeatRequest(request)))({
+          key: `hq:promote-failed:${moved.to}:${moved.generation}`,
+          text: `자동 승격 런북 실패 — 임대는 ${moved.to}(세대 ${moved.generation})로 옮겨졌지만 서비스 이전이 끝나지 않았다: ${failure}. OP 가 \`eln hq promote --to ${moved.to}\` 로 확인한다.`,
+        });
+      } catch (error) { try { r.log('hq.arbiter', 'promote-request-failed', { ...moved, error: String(error) }); } catch { /* fail-soft */ } }
+    }
+  }
+  const proposed = proposal as { holder: string; generation: number; streak: number } | undefined;
+  if (result.ok && proposed) {
+    try { proposeHqPromotion({ ...proposed, standby: r.standby }, { request: deps.opRequest, log: r.log }); }
+    catch (error) { try { r.log('hq.arbiter', 'promote-proposal-failed', { ...proposed, error: String(error) }); } catch { /* observation is fail-soft */ } }
+  }
   observe(r, 'hq.lease', outcome.promoted ? 'promoted' : 'arbiter-check', { ...outcome, ok: result.ok });
   return { ok: result.ok, ...outcome };
 }

package/src/hq/lease.ts

@@ -1,5 +1,5 @@
 // HQ lease (본부 임대) — single writer across mbp · node-b · cloud-vm with a 2-of-3 quorum (OP 10-04 08:33 · 08:40).
-// The arbiter (cloud-vm) keeps one record; only the arbiter promotes the standby, and only after two consecutive
+// The arbiter (cloud-vm) keeps one record; promotion requires an explicit opt-in and consecutive
 // checks in which neither the arbiter nor the standby can reach the holder. Fenced work carries the generation.
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, statSync, writeFileSync } from 'node:fs';
@@ -64,9 +64,9 @@ export function recordView(record: LeaseRecord, observer: string, reachable: boo
 
 /**
  * Arbiter check (rule ②). Records the arbiter's own view; counts a dual-unreachable check only when the standby's
- * fresh view of the same holder also says unreachable; promotes the standby after PROMOTE_AFTER_CHECKS in a row.
+ * fresh view of the same holder also says unreachable; promotion is optional and its threshold is configurable.
  */
-export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string; standby: string; arbiterReachesHolder: boolean; now: number }):
+export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string; standby: string; arbiterReachesHolder: boolean; now: number; promote?: boolean; promoteAfterChecks?: number }):
   { next: LeaseRecord; promoted: boolean; streak: number } {
   let next = recordView(record, input.arbiter, input.arbiterReachesHolder, input.now);
   const view = next.views?.[input.standby];
@@ -74,7 +74,7 @@ export function decideArbiterCheck(record: LeaseRecord, input: { arbiter: string
   const dual = !input.arbiterReachesHolder && standbyDown && record.holder !== input.standby;
   const streak = dual ? (record.dualUnreachableStreak ?? 0) + 1 : 0;
   next = { ...next, dualUnreachableStreak: streak, lastCheckAt: input.now };
-  if (streak < PROMOTE_AFTER_CHECKS) return { next, promoted: false, streak };
+  if (input.promote === false || streak < (input.promoteAfterChecks ?? PROMOTE_AFTER_CHECKS)) return { next, promoted: false, streak };
   return {
     next: { holder: input.standby, generation: record.generation + 1, acquiredAt: input.now, renewedAt: input.now, ttlSeconds: record.ttlSeconds, views: {}, dualUnreachableStreak: 0, lastCheckAt: input.now, promotedFrom: record.holder },
     promoted: true, streak,