elanous 0.2.14 → 0.2.16

package/src/harness/helper-repair.ts

@@ -0,0 +1,218 @@
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { debug } from '../debug/log.js';
+import { releasePathHold, releasePrFilePaths } from '../self-dev/release-path-guard.js';
+import { getUserConfig, type UserConfig } from '../user-config.js';
+import type { QueueItem, QueueSeat } from './harness-queue.js';
+import type { RunGh, ScannedStoppedPr, StoppedPrCategory } from './helper-scan.js';
+
+export interface RepairGoalInput {
+  pr: number;
+  category: StoppedPrCategory;
+  /** The original user's request, not the supervisor's stop report or a paraphrase. */
+  originalRequest: string;
+  /** Remaining reviewer must-fix items, in their original wording and order. */
+  mustFix: readonly string[];
+}
+
+/** Author a single follow-up goal without changing the original ask or reviewer findings. */
+export function authorRepairGoal({ pr, category, originalRequest, mustFix }: RepairGoalInput): string | null {
+  if ((category !== 'review-budget' && category !== 'review-oscillation') || !originalRequest.trim() || !mustFix.length || mustFix.some((item) => !item.trim())) {
+    return null;
+  }
+
+  const guidance = category === 'review-oscillation'
+    ? '기존 시험 설계를 보존하고 리뷰 진동·설계 역행을 확인한 뒤 남은 must-fix를 수리하라.'
+    : '남은 must-fix를 수리하라. 원래 요청의 범위와 기존 시험 설계를 보존하라.';
+  return `${originalRequest}${originalRequest.endsWith('\n') ? '' : '\n'}\n## PR #${pr} 수리\n${guidance}\n\n## 남은 must-fix (원문)\n${mustFix.join('\n')}`;
+}
+
+/** PR 본문에서 원 요청(## 요청 절)과 남은 must-fix(## 마지막 리뷰 must-fix · ## Follow-up must-fix 의 «- » 항목)를 원문 그대로 뽑는다. */
+export function repairInputsFromBody(body: string): { originalRequest: string; mustFix: string[] } {
+  const section = (title: RegExp) => {
+    const lines = body.split('\n');
+    const start = lines.findIndex((line) => title.test(line));
+    if (start < 0) return [] as string[];
+    const end = lines.findIndex((line, index) => index > start && /^## /.test(line));
+    return lines.slice(start + 1, end < 0 ? undefined : end);
+  };
+  const requestLines = section(/^## 요청\s*$/);
+  while (requestLines[0] === '') requestLines.shift();
+  while (requestLines.length > 1 && requestLines.at(-1) === '' && requestLines.at(-2) === '') requestLines.pop();
+  if (requestLines.length === 2 && requestLines[1] === '') requestLines.pop();
+  const originalRequest = requestLines.join('\n');
+  const mustFix: string[] = [];
+  for (const lines of [section(/^## 마지막 리뷰 must-fix/), section(/^## Follow-up must-fix/)]) {
+    let item: string[] = [];
+    const flush = () => {
+      while (item.at(-1) === '') item.pop();
+      if (item.length) mustFix.push(item.join('\n'));
+      item = [];
+    };
+    for (const line of lines) {
+      if (/^- /.test(line)) {
+        flush();
+        item.push(line);
+      } else if (item.length) {
+        item.push(line);
+      }
+    }
+    flush();
+  }
+  return { originalRequest, mustFix };
+}
+
+export type RepairShadowRow = { pr: number; category: StoppedPrCategory; goalHash: string; at: string };
+
+type RepairLedgerResult = 'shadow' | 'launched' | 'cap' | 'needs-human' | 'launch-failed';
+
+type RepairLedgerLine = {
+  pr: number; category: StoppedPrCategory; goalHash: string; at: string;
+  mode: 'shadow' | 'live'; goal: string; result: RepairLedgerResult;
+  /** Harness queue item id — the run itself starts on a later queue tick. */ queueId?: string; reason?: string;
+};
+
+const RELEASE_FILE_PAGE = 100;
+
+/** Changed files of the original PR. A failed read is a reason to hold, never a reason to launch. */
+async function changedFiles(pr: number, runGh: RunGh): Promise<string[]> {
+  const pages: unknown[] = [];
+  for (let page = 1; ; page++) {
+    const raw = await runGh(['api', '--method', 'GET', '--raw-field', `per_page=${RELEASE_FILE_PAGE}`, '--raw-field', `page=${page}`, `repos/{owner}/{repo}/pulls/${pr}/files`]);
+    const parsed: unknown = JSON.parse(raw);
+    if (!Array.isArray(parsed)) throw new Error('gh api PR files returned an invalid file list');
+    pages.push(parsed);
+    if (parsed.length < RELEASE_FILE_PAGE) break;
+  }
+  return releasePrFilePaths(pages);
+}
+
+const QUEUE_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+
+/** 원 PR 의 자리 라벨(elanous:seat-<자리> 또는 자리 이름 라벨). 없거나 둘 이상이면 MK. */
+function seatOf(labels: readonly { name?: string }[] | undefined): QueueSeat {
+  const found = new Set<QueueSeat>();
+  for (const label of labels ?? []) {
+    const name = label.name ?? '';
+    const prefixed = /^elanous:seat-(OP|TC|MK|UX)$/.exec(name)?.[1];
+    const bare = (QUEUE_SEATS as readonly string[]).includes(name) ? name : undefined;
+    const seat = prefixed ?? bare;
+    if (seat) found.add(seat as QueueSeat);
+  }
+  return found.size === 1 ? [...found][0]! : 'MK';
+}
+
+function helperSettings(config: UserConfig | undefined): { mode: 'shadow' | 'live'; perDay: number } {
+  const helper = config?.harness?.helper;
+  return {
+    mode: helper?.repair === 'live' ? 'live' : 'shadow',
+    perDay: typeof helper?.repairPerDay === 'number' && Number.isSafeInteger(helper.repairPerDay) && helper.repairPerDay >= 0
+      ? helper.repairPerDay : 3,
+  };
+}
+
+/** 그림자(기본): 수리 골을 원장에만 남긴다. live: 같은 함수로 대기열에 넣고 원 PR 을 superseded 로 표시한다. 같은 PR 은 평생 한 번. */
+export async function recordRepairShadows(rows: readonly ScannedStoppedPr[], deps: {
+  runGh: RunGh; root: string; now?: Date;
+  config?: UserConfig;
+  /** 대기열 추가. 생략하면 addHarnessQueue — 실제 발사는 기존 대기열 틱이 한다. */
+  enqueue?: (input: { seat: QueueSeat; say: string; idempotencyKey: string }) => Promise<Pick<QueueItem, 'id'>>;
+}): Promise<RepairShadowRow[]> {
+  const ledger = join(deps.root, 'helper', 'repairs.jsonl');
+  const prior: RepairLedgerLine[] = [];
+  if (existsSync(ledger)) for (const line of readFileSync(ledger, 'utf8').split('\n')) {
+    if (!line.trim()) continue;
+    try { prior.push(JSON.parse(line) as RepairLedgerLine); } catch { /* malformed line is skipped */ }
+  }
+  const { mode, perDay } = helperSettings(deps.config ?? getUserConfig());
+  const day = (deps.now ?? new Date()).toISOString().slice(0, 10);
+  // Terminal results end a PR for good. A shadow line blocks only while still in shadow (live must still launch it),
+  // and a cap or failed launch blocks only for the same UTC day so the PR is retried tomorrow (ACP must-fix).
+  // Ledger lines written before results existed have no `result`; they were shadow records.
+  for (const line of prior) if (!line.result) line.result = 'shadow';
+  const seen = new Set(prior.filter((line) => line.result === 'launched' || line.result === 'needs-human'
+    || (line.result === 'shadow' && mode === 'shadow')
+    || ((line.result === 'cap' || line.result === 'launch-failed') && line.at.slice(0, 10) === day)).map((line) => line.pr));
+  // Distinct PRs: a follow-up repair line for an already launched PR is not a second launch.
+  let launchedToday = new Set(prior.filter((line) => line.result === 'launched' && line.at.slice(0, 10) === day).map((line) => line.pr)).size;
+  // A launched line whose label/comment failed is repaired here — the follow-up only, never a second enqueue.
+  if (mode === 'live') {
+    const latest = new Map<number, RepairLedgerLine>();
+    for (const line of prior) latest.set(line.pr, line);
+    for (const line of latest.values()) {
+      if (line.result !== 'launched' || !line.reason?.startsWith('후속 실패') || !line.queueId) continue;
+      const followups: string[] = [];
+      if (line.reason.includes('label ·')) {
+        try { await deps.runGh(['pr', 'edit', String(line.pr), '--add-label', 'elanous:superseded']); }
+        catch (error) { followups.push(`label · ${error instanceof Error ? error.message : String(error)}`); }
+      }
+      if (line.reason.includes('comment ·')) {
+        try { await deps.runGh(['pr', 'comment', String(line.pr), '--body', `수리 대기열 항목 ${line.queueId} 로 대체(런은 대기열 틱에서 시작)`]); }
+        catch (error) { followups.push(`comment · ${error instanceof Error ? error.message : String(error)}`); }
+      }
+      const repaired: RepairLedgerLine = { ...line, at: (deps.now ?? new Date()).toISOString(), ...(followups.length ? { reason: `후속 실패 · ${followups.join(' · ')}` } : { reason: '후속 복구' }) };
+      appendFileSync(ledger, JSON.stringify(repaired) + '\n');
+      debug.log('harness.helper', 'repair-followup-retried', { pr: line.pr, queueId: line.queueId, remaining: followups.length });
+    }
+  }
+  const enqueue = deps.enqueue ?? (async (input) => {
+    const { addHarnessQueue } = await import('./harness-queue.js');
+    return addHarnessQueue(input, { root: deps.root });
+  });
+  const written: RepairShadowRow[] = [];
+  for (const row of rows) {
+    if ((row.category !== 'review-budget' && row.category !== 'review-oscillation') || seen.has(row.pr)) continue;
+    const view = JSON.parse(await deps.runGh(['pr', 'view', String(row.pr), '--json', 'body'])) as { body: string };
+    // 자리 라벨은 본문 조회와 분리한다 — 기존 본문 조회 계약(--json body)을 그대로 둔다. 못 읽으면 MK.
+    let labels: { name?: string }[] | undefined;
+    if (mode === 'live') {
+      try { labels = (JSON.parse(await deps.runGh(['pr', 'view', String(row.pr), '--json', 'labels'])) as { labels?: { name?: string }[] }).labels; }
+      catch { labels = undefined; }
+    }
+    const goal = authorRepairGoal({ pr: row.pr, category: row.category, ...repairInputsFromBody(view.body) });
+    if (!goal) continue;
+    const at = (deps.now ?? new Date()).toISOString();
+    const base = { pr: row.pr, category: row.category, goalHash: createHash('sha256').update(goal).digest('hex').slice(0, 16), at, goal };
+    let record: RepairLedgerLine = { ...base, mode: 'shadow', result: 'shadow' };
+    if (mode === 'live') {
+      let files: string[] | undefined;
+      try { files = await changedFiles(row.pr, deps.runGh); }
+      catch (error) { files = undefined; debug.log('harness.helper', 'repair-files-unreadable', { pr: row.pr, reason: String(error) }); }
+      const release = files && releasePathHold(files);
+      // 상한은 «발사한 수»의 상한이다. 사람 승인이 필요한 PR 은 그 수를 쓰지 않으므로 상한보다 먼저 가른다.
+      if (files && !release && launchedToday >= perDay) {
+        record = { ...base, mode: 'live', result: 'cap', reason: '상한' };
+      } else if (!files) {
+        // An unreadable file list is transient: hold today, retry on a later day (never a permanent needs-human) (ACP must-fix).
+        record = { ...base, mode: 'live', result: 'launch-failed', reason: '변경 파일 조회 실패 · 다음 날 재시도' };
+      } else if (release) {
+        record = { ...base, mode: 'live', result: 'needs-human', reason: '사람 승인 필요' };
+      } else {
+        let item: Pick<QueueItem, 'id'> | undefined;
+        try {
+          item = await enqueue({ seat: seatOf(labels), say: goal, idempotencyKey: `helper-repair-${row.pr}` });
+          // The queue item exists from here on: a later label/comment failure is recorded on the launched line,
+          // never as launch-failed (which would let the next scan enqueue a second repair) (ACP must-fix).
+          const followups: string[] = [];
+          try { await deps.runGh(['pr', 'edit', String(row.pr), '--add-label', 'elanous:superseded']); }
+          catch (error) { followups.push(`label · ${error instanceof Error ? error.message : String(error)}`); }
+          try { await deps.runGh(['pr', 'comment', String(row.pr), '--body', `수리 대기열 항목 ${item.id} 로 대체(런은 대기열 틱에서 시작)`]); }
+          catch (error) { followups.push(`comment · ${error instanceof Error ? error.message : String(error)}`); }
+          record = { ...base, mode: 'live', result: 'launched', queueId: item.id, ...(followups.length ? { reason: `후속 실패 · ${followups.join(' · ')}` } : {}) };
+          launchedToday += 1;
+          debug.log('harness.helper', 'repair-launched', { pr: row.pr, queueId: item.id, mode: 'live', followupFailures: followups.length });
+        } catch (error) {
+          record = { ...base, mode: 'live', result: 'launch-failed', reason: `발사 실패 · ${error instanceof Error ? error.message : String(error)}` };
+          debug.log('harness.helper', 'repair-launch-failed', { pr: row.pr, reason: record.reason });
+        }
+      }
+    }
+    mkdirSync(dirname(ledger), { recursive: true });
+    appendFileSync(ledger, JSON.stringify(record) + '\n');
+    if (record.result === 'shadow') debug.log('harness.helper', 'repair-authored', { pr: row.pr, category: row.category, mode: 'shadow' });
+    seen.add(row.pr);
+    written.push({ pr: base.pr, category: base.category, goalHash: base.goalHash, at: base.at });
+  }
+  return written;
+}

package/src/harness/helper-scan.ts

@@ -125,12 +125,35 @@ export async function scanStoppedPrs({ runGh }: { runGh: RunGh }): Promise<Scann
 }
 
 if (import.meta.main) {
-  if (process.argv.slice(2).some((arg) => arg !== '--json')) {
-    console.error('사용법: bun src/harness/helper-scan.ts [--json]');
+  const args = process.argv.slice(2);
+  const json = args.includes('--json');
+  const recordShadows = args.includes('--record-shadows');
+  if (args.some((arg) => arg !== '--json' && arg !== '--record-shadows') || (json && recordShadows) || args.length > 1) {
+    console.error('사용법: bun src/harness/helper-scan.ts [--json | --record-shadows]');
     process.exitCode = 1;
   } else {
-    const rows = await scanStoppedPrs({ runGh: (args) => execFileSync('gh', [...args], { encoding: 'utf8' }) });
-    if (process.argv.includes('--json')) console.log(JSON.stringify(rows, null, 2));
+    // 열린 PR 본문 전체는 기본 버퍼(1MB)를 넘는다(10-05 운영 ENOBUFS) — 넉넉히 준다.
+    const runGh = (args: readonly string[]) => execFileSync('gh', [...args], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
+    const rows = await scanStoppedPrs({ runGh });
+    if (recordShadows) {
+      // 명시적 그림자 기록에서만 추가 PR 조회와 헬퍼 원장 쓰기를 수행한다(발사 0).
+      const { recordRepairShadows } = await import('./helper-repair.js');
+      const { effectiveInstanceRoot } = await import('../instance/resolve.js');
+      const { getUserConfig } = await import('../user-config.js');
+      const root = effectiveInstanceRoot();
+      const config = getUserConfig();
+      const live = config.harness?.helper?.repair === 'live';
+      const shadows = await recordRepairShadows(rows, {
+        runGh, root, config,
+        // live 만 대기열에 넣는다. 실제 발사는 기존 대기열 틱이 한다(새 발사 경로 0).
+        ...(live ? { enqueue: async (input) => {
+          const { addHarnessQueue } = await import('./harness-queue.js');
+          return addHarnessQueue(input, { root });
+        } } : {}),
+      });
+      if (shadows.length) console.log(live ? `수리 골 ${shadows.length}건 → helper/repairs.jsonl` : `수리 골 그림자 ${shadows.length}건 → helper/repairs.jsonl`);
+    }
+    if (json) console.log(JSON.stringify(rows, null, 2));
     else for (const row of rows) {
       const gate = row.blockerCount ? ` · Gate 차단 ${row.blockerCount}(${row.hasPublicExportLeak ? row.blockers.find((line) => /public-export-leak/i.test(line))?.trim() ?? '✗ public-export-leak (6번째 이후)' : row.blockers[0]!.trim()})` : '';
       console.log(`#${row.pr} ${row.category}${gate} → ${row.firstAction}`);

package/src/harness/launch-stamp.ts

@@ -0,0 +1,236 @@
+/**
+ * ONEDOOR-1 — every harness run stamps which door it came through,
+ * who launched it, and whether it went through the queue.
+ *
+ * The stamp lives on the run ledger's first row (`run-origin`). A ledger
+ * written before this stamp, or a launch that named no door, reads as
+ * `unknown` — that is distinct from a count of zero.
+ */
+import { readdirSync } from 'node:fs';
+import { loadRunLedger, runLedgerDir, type RunLedgerEntry } from '../self-implement/run-ledger.js';
+
+export const LAUNCH_DOORS = [
+  'harness-say',
+  'harness-ask',
+  'dev-ask',
+  'self-implement',
+  'self-orchestrate',
+  'queue-tick',
+  'agent-mission',
+  'daemon-tool',
+  'telegram',
+  'pwa',
+  'unknown',
+] as const;
+
+export type LaunchDoor = (typeof LAUNCH_DOORS)[number];
+
+export const LAUNCH_SEATS = ['OP', 'TC', 'MK', 'UX'] as const;
+export type LaunchSeat = (typeof LAUNCH_SEATS)[number];
+
+export interface LaunchStamp {
+  readonly entrance: LaunchDoor;
+  /** Seat, human session, or loop name — whichever the launch actually named. */
+  readonly actor: string;
+  readonly viaQueue: boolean;
+  readonly queueId?: string;
+}
+
+const ENTRANCE_TO_DOOR: Readonly<Record<string, LaunchDoor>> = {
+  'cli-harness-say': 'harness-say',
+  'cli-harness-ask': 'harness-ask',
+  'cli-dev-ask': 'dev-ask',
+  'cli-drive': 'dev-ask',
+  'tui-slash-ask': 'dev-ask',
+  'tui-slash-dev': 'dev-ask',
+  'cli-self-implement': 'self-implement',
+  'nl-self-implement': 'self-implement',
+  'daemon-self-implement': 'daemon-tool',
+  'cli-self-orchestrate': 'self-orchestrate',
+  'nl-self-orchestrate': 'self-orchestrate',
+  'cli-harness-orchestrate': 'self-orchestrate',
+  'cli-harness-mission': 'agent-mission',
+  'agent-mission': 'agent-mission',
+  'daemon-harness-ask': 'daemon-tool',
+  'daemon-tool': 'daemon-tool',
+  telegram: 'telegram',
+  pwa: 'pwa',
+};
+
+const DOOR_SET = new Set<string>(LAUNCH_DOORS);
+
+export function isLaunchDoor(value: string): value is LaunchDoor {
+  return DOOR_SET.has(value);
+}
+
+/** Reuse an existing entrance tag. Anything unnamed or unrecognized is `unknown`, never a zero. */
+export function doorFromEntrance(entrance: string | undefined | null): LaunchDoor {
+  if (!entrance) return 'unknown';
+  const trimmed = entrance.trim();
+  if (!trimmed) return 'unknown';
+  if (ENTRANCE_TO_DOOR[trimmed]) return ENTRANCE_TO_DOOR[trimmed];
+  if (isLaunchDoor(trimmed)) return trimmed;
+  return 'unknown';
+}
+
+export interface LaunchStampInput {
+  readonly entrance?: string | null;
+  readonly seat?: string | null;
+  readonly session?: string | null;
+  readonly loopName?: string | null;
+  readonly viaQueue?: boolean;
+  readonly queueId?: string | null;
+  readonly env?: NodeJS.ProcessEnv;
+}
+
+function named(value: string | null | undefined): string | undefined {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+/** Seat wins, then the human session, then the loop name. A blank actor stays blank. */
+export function resolveLaunchActor(input: LaunchStampInput, env: NodeJS.ProcessEnv = process.env): string {
+  const seat = named(input.seat) ?? named(env.ELANOUS_HARNESS_SEAT);
+  if (seat && (LAUNCH_SEATS as readonly string[]).includes(seat)) return seat;
+  return named(input.session)
+    ?? named(env.ELANOUS_ORIGIN_SESSION)
+    ?? named(input.loopName)
+    ?? named(env.ELANOUS_LOOP_NAME)
+    ?? '';
+}
+
+export function resolveLaunchStamp(input: LaunchStampInput = {}, env: NodeJS.ProcessEnv = input.env ?? process.env): LaunchStamp {
+  const queueId = named(input.queueId) ?? named(env.ELANOUS_HARNESS_QUEUE_LAUNCH);
+  const viaQueue = input.viaQueue === true || queueId !== undefined;
+  const door = viaQueue ? 'queue-tick' : doorFromEntrance(input.entrance ?? env.ELANOUS_HARNESS_ENTRANCE);
+  return {
+    entrance: door,
+    actor: resolveLaunchActor(input, env),
+    viaQueue,
+    ...(queueId ? { queueId } : {}),
+  };
+}
+
+/** Read the stamp off a ledger's first row. Missing or unreadable stamps are `unknown`. */
+export function launchStampFromLedger(entries: readonly RunLedgerEntry[] | null | undefined): LaunchStamp {
+  const first = entries?.[0];
+  const raw = first?.data?.launch;
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { entrance: 'unknown', actor: '', viaQueue: false };
+  }
+  const launch = raw as Record<string, unknown>;
+  const entrance = typeof launch.entrance === 'string' && isLaunchDoor(launch.entrance) ? launch.entrance : 'unknown';
+  const queueId = typeof launch.queueId === 'string' && launch.queueId.trim() ? launch.queueId.trim() : undefined;
+  return {
+    entrance,
+    actor: typeof launch.actor === 'string' ? launch.actor : '',
+    viaQueue: launch.viaQueue === true || queueId !== undefined,
+    ...(queueId ? { queueId } : {}),
+  };
+}
+
+export interface DoorRow {
+  readonly entrance: LaunchDoor;
+  readonly runs: number;
+  readonly viaQueue: number;
+  readonly outsideQueue: number;
+}
+
+export interface DoorTable {
+  readonly sinceMs: number;
+  readonly runs: number;
+  readonly unknown: number;
+  readonly outsideQueue: number;
+  readonly viaQueue: number;
+  readonly rows: readonly DoorRow[];
+}
+
+export interface DoorTableOptions {
+  readonly dir?: string;
+  readonly sinceMs?: number;
+  readonly now?: number;
+  readonly list?: (dir: string) => string[];
+  readonly load?: (runId: string, dir: string) => RunLedgerEntry[] | null;
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+function entryTime(entry: RunLedgerEntry | undefined): number | undefined {
+  if (!entry?.timestamp) return undefined;
+  const parsed = Date.parse(entry.timestamp);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+/** One row per door that actually fired, plus the period totals. Untagged ledgers count as `unknown`. */
+export function queryLaunchDoors(options: DoorTableOptions = {}): DoorTable {
+  const dir = options.dir ?? runLedgerDir();
+  const now = options.now ?? Date.now();
+  const sinceMs = options.sinceMs ?? DAY_MS;
+  const cutoff = now - sinceMs;
+  const list = options.list ?? ((path: string) => {
+    try { return readdirSync(path); } catch { return []; }
+  });
+  const load = options.load ?? ((runId: string, ledgerDir: string) => {
+    try { return loadRunLedger(runId, ledgerDir); } catch { return null; }
+  });
+  const counts = new Map<LaunchDoor, { runs: number; viaQueue: number }>();
+  let runs = 0;
+  let unknown = 0;
+  let outsideQueue = 0;
+  let viaQueue = 0;
+  for (const file of list(dir)) {
+    if (!file.endsWith('.jsonl')) continue;
+    const runId = file.slice(0, -'.jsonl'.length);
+    const entries = load(runId, dir);
+    if (!entries || entries.length === 0) continue;
+    const started = entryTime(entries[0]);
+    if (started !== undefined && started < cutoff) continue;
+    const stamp = launchStampFromLedger(entries);
+    runs += 1;
+    if (stamp.entrance === 'unknown') unknown += 1;
+    if (stamp.viaQueue) viaQueue += 1;
+    else outsideQueue += 1;
+    const row = counts.get(stamp.entrance) ?? { runs: 0, viaQueue: 0 };
+    row.runs += 1;
+    if (stamp.viaQueue) row.viaQueue += 1;
+    counts.set(stamp.entrance, row);
+  }
+  const rows = [...counts.entries()]
+    .map(([entrance, row]) => ({
+      entrance,
+      runs: row.runs,
+      viaQueue: row.viaQueue,
+      outsideQueue: row.runs - row.viaQueue,
+    }))
+    .sort((left, right) => right.runs - left.runs || left.entrance.localeCompare(right.entrance));
+  return { sinceMs, runs, unknown, outsideQueue, viaQueue, rows };
+}
+
+export function renderLaunchDoors(table: DoorTable): string {
+  const lines = [
+    `doors  runs=${table.runs}  outside-queue=${table.outsideQueue}  via-queue=${table.viaQueue}  unknown=${table.unknown}`,
+    'entrance          runs  via-queue  outside-queue',
+  ];
+  for (const row of table.rows) {
+    lines.push(`${row.entrance.padEnd(16)} ${String(row.runs).padStart(4)}  ${String(row.viaQueue).padStart(9)}  ${String(row.outsideQueue).padStart(13)}`);
+  }
+  if (table.rows.length === 0) lines.push('(no runs)');
+  const summed = table.rows.reduce((sum, row) => sum + row.runs, 0);
+  lines.push(`total            ${String(summed).padStart(4)}`);
+  return lines.join('\n');
+}
+
+const SINCE_PATTERN = /^(\d+)(m|h|d)$/;
+
+/** `--since 1d` (also `30m`, `12h`). Anything else is refused rather than guessed. */
+export function parseDoorSince(value: string | undefined, now = Date.now()): { sinceMs: number } | { error: string } {
+  if (value === undefined || value === '') return { sinceMs: DAY_MS };
+  const match = SINCE_PATTERN.exec(value.trim());
+  if (!match) return { error: `--since 는 30m · 12h · 1d 형태여야 합니다: ${value}` };
+  const amount = Number(match[1]);
+  const unit = match[2] === 'm' ? 60_000 : match[2] === 'h' ? 3_600_000 : DAY_MS;
+  if (!Number.isSafeInteger(amount) || amount < 1) return { error: `--since 는 1 이상이어야 합니다: ${value}` };
+  const sinceMs = amount * unit;
+  if (sinceMs > now) return { sinceMs };
+  return { sinceMs };
+}

package/src/harness/ledger-write-guard-child.fixture.ts

@@ -0,0 +1,12 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+import { recordRunExit } from './harness-incidents.js';
+import { appendRunLedgerEntry } from '../self-implement/run-ledger.js';
+
+const root = prodInstanceRoot();
+if (effectiveInstanceRoot() !== root) throw new Error('not the effective production root');
+const before = existsSync(root) ? readdirSync(root) : null;
+recordRunExit({ runId: 'run-test', reason: 'signal', status: 1, signal: null, at: new Date().toISOString() }, process.argv[2] ?? root);
+appendRunLedgerEntry({ runId: 'run-test', event: 'start', data: {} }, process.argv[3] ?? `${root}/run-ledger`);
+const after = existsSync(root) ? readdirSync(root) : null;
+console.log(JSON.stringify({ env: { NODE_ENV: process.env.NODE_ENV, ELANOUS_TEST_HOME: process.env.ELANOUS_TEST_HOME, HOME: process.env.HOME, ELANOUS_STATE_DIR: process.env.ELANOUS_STATE_DIR }, root, effectiveInstanceRoot: effectiveInstanceRoot(), before, after }));

package/src/harness/ledger-write-guard.ts

@@ -0,0 +1,35 @@
+import { realpathSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { debug } from '../debug/log.js';
+import { effectiveInstanceRoot, prodInstanceRoot } from '../instance/resolve.js';
+
+function physicalPath(path: string): string {
+  const absolute = resolve(path);
+  try {
+    return realpathSync(absolute);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    const parent = dirname(absolute);
+    if (parent === absolute) throw error;
+    return resolve(physicalPath(parent), relative(parent, absolute));
+  }
+}
+
+/** Refuse a test's write to the production instance, including an explicitly supplied ledger directory. */
+export function refuseProductionLedgerWriteInTest(
+  root: string,
+  store: string,
+  env: NodeJS.ProcessEnv = process.env,
+  productionRoot = prodInstanceRoot(),
+  instanceRoot = effectiveInstanceRoot(),
+): boolean {
+  if (env.NODE_ENV !== 'test' && !env.ELANOUS_TEST_HOME) return false;
+  const target = physicalPath(root);
+  const production = physicalPath(productionRoot);
+  const withinProduction = relative(production, target);
+  if (withinProduction === '..' || withinProduction.startsWith(`..${sep}`) || isAbsolute(withinProduction)) return false;
+  try {
+    debug.log('harness.incidents', 'write-refused', { store, root: target, effectiveInstanceRoot: instanceRoot });
+  } catch { /* Observation cannot reopen a closed write boundary. */ }
+  return true;
+}

package/src/harness/nested-elanous-policy.ts

@@ -0,0 +1,114 @@
+// Nested elanous launch policy.
+//
+// Codex children drop parent env under shell_environment_policy inherit=core, so a
+// depth marker that only lives in the environment never arrives. Depth is therefore
+// carried on the codex argv (`-c shell_environment_policy.set.ELANOUS_NESTED_DEPTH=<n>`).
+//
+// Unset ELANOUS_NESTED_DEPTH is depth 0 (the outer launcher). A missing marker is
+// not "depth unknown" and does not refuse an ordinary mission spawn.
+// Refusal for a backend that cannot carry the marker applies only when a nested
+// elanous launch was actually requested (allow flag or config allow).
+//
+// Only depth 0 (the outer launcher) may allow a nested elanous launch. At depth >= 1
+// an allow flag is ignored and the launch stays refused.
+
+import { debug } from '../debug/log.js';
+
+export const ELANOUS_NESTED_DEPTH_ENV = 'ELANOUS_NESTED_DEPTH';
+
+/** Codex config key that sets the depth marker inside the child's shell policy. */
+export const CODEX_NESTED_DEPTH_CONFIG_KEY = `shell_environment_policy.set.${ELANOUS_NESTED_DEPTH_ENV}`;
+
+export type NestedElanousBackendName = 'codex' | 'claude' | 'gemini' | 'grok' | 'aside' | (string & {});
+
+export interface NestedElanousDecision {
+  readonly allowed: boolean;
+  readonly depth: number;
+  /** True when depth >= 1 supplied allow and it was ignored. */
+  readonly allowIgnored: boolean;
+  readonly reason: 'depth-0' | 'depth-0-allow' | 'depth-unknown' | 'nested-refused' | 'allow-ignored';
+}
+
+/** Current process depth from the nested-depth marker. Unset or unreadable = 0 (outer launcher). */
+export function readNestedElanousDepth(env: Record<string, string | undefined> = process.env): number {
+  const raw = env[ELANOUS_NESTED_DEPTH_ENV];
+  if (raw === undefined || raw.trim() === '') return 0;
+  if (!/^\d+$/.test(raw.trim())) return 0;
+  return Number(raw);
+}
+
+/** True when this backend can carry the depth marker to its child. Only codex can. */
+export function backendCarriesNestedDepth(backendName: string): boolean {
+  return backendName === 'codex';
+}
+
+/**
+ * Codex argv fragment that sets the child's depth marker.
+ * `depth` is the child's depth (parent + 1). Non-codex backends return [] — they cannot carry it.
+ */
+export function nestedDepthCodexArgs(backendName: string, childDepth: number): string[] {
+  if (backendName !== 'codex') return [];
+  if (!Number.isInteger(childDepth) || childDepth < 0) return [];
+  return ['-c', `${CODEX_NESTED_DEPTH_CONFIG_KEY}=${childDepth}`];
+}
+
+/**
+ * Allow decision. Depth 0 allows only when `allow` is true.
+ * Depth >= 1 always refuses; a supplied allow is ignored and logged.
+ */
+export function decideNestedElanousLaunch(input: {
+  readonly depth: number;
+  readonly allow?: boolean;
+}): NestedElanousDecision {
+  const depth = Number.isInteger(input.depth) && input.depth >= 0 ? input.depth : 0;
+  if (depth >= 1) {
+    if (input.allow === true) {
+      debug.log('agent-mission.nested', 'allow-ignored', { depth });
+      return { allowed: false, depth, allowIgnored: true, reason: 'allow-ignored' };
+    }
+    return { allowed: false, depth, allowIgnored: false, reason: 'nested-refused' };
+  }
+  if (input.allow === true) {
+    return { allowed: true, depth, allowIgnored: false, reason: 'depth-0-allow' };
+  }
+  return { allowed: false, depth, allowIgnored: false, reason: 'depth-0' };
+}
+
+/** Config `harness.nestedElanous`. Only `'allow'` counts, and only at depth 0. */
+export function configAllowsNestedElanous(
+  config: { harness?: { nestedElanous?: string } } | undefined,
+  depth: number,
+): boolean {
+  if (depth !== 0) return false;
+  return config?.harness?.nestedElanous === 'allow';
+}
+
+/**
+ * Gate a nested elanous launch.
+ *
+ * Ordinary mission spawn is not this gate: call it only when a nested elanous
+ * launch was requested. A backend that cannot carry the depth marker is then
+ * refused (`depth-unknown`) — including depth 0 with allow — because the child
+ * would not know its own depth. Unset depth is 0, not unknown.
+ *
+ * `allow` is the flag. Config allow counts only at depth 0 and never overrides
+ * a depth >= 1 refusal.
+ */
+export function gateNestedElanousLaunch(input: {
+  readonly backendName: string;
+  readonly depth: number;
+  /** True only when this call is gating a requested nested elanous launch. */
+  readonly nestedLaunchRequested: boolean;
+  readonly allow?: boolean;
+  readonly configAllow?: boolean;
+}): NestedElanousDecision {
+  const depth = Number.isInteger(input.depth) && input.depth >= 0 ? input.depth : 0;
+  if (!input.nestedLaunchRequested) {
+    return decideNestedElanousLaunch({ depth, allow: false });
+  }
+  if (!backendCarriesNestedDepth(input.backendName)) {
+    return { allowed: false, depth, allowIgnored: false, reason: 'depth-unknown' };
+  }
+  const allow = input.allow === true || (depth === 0 && input.configAllow === true);
+  return decideNestedElanousLaunch({ depth, allow });
+}